From: Alan T. DeKok <aland@freeradius.org>
Date: Thu, 23 Nov 2017 18:57:13 +0000 (-0500)
Subject: dynamic clients must contain at least an IP and shared secret
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f66503f06fe60315beddddce76769f96efc6e1b4;p=thirdparty%2Ffreeradius-server.git

dynamic clients must contain at least an IP and shared secret
---

diff --git a/src/modules/proto_radius/proto_radius_dynamic_client.c b/src/modules/proto_radius/proto_radius_dynamic_client.c
index c7aa9ab9531..bb6211a6f19 100644
--- a/src/modules/proto_radius/proto_radius_dynamic_client.c
+++ b/src/modules/proto_radius/proto_radius_dynamic_client.c
@@ -137,9 +137,27 @@ static fr_io_final_t mod_process(REQUEST *request, fr_io_action_t action)
 		}
 
 		if (request->reply->code == FR_CODE_ACCESS_ACCEPT) {
+			VALUE_PAIR *vp;
+
+			vp = fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IP_ADDRESS, TAG_ANY);
+			if (!vp) fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IPV6_ADDRESS, TAG_ANY);
+			if (!vp) fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IP_PREFIX, TAG_ANY);
+			if (!vp) fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_IPV6_PREFIX, TAG_ANY);
+			if (!vp) {
+				ERROR("The 'control' list MUST contain a FreeRADIUS-Client.. IP address attribute");
+				request->reply->code = FR_CODE_ACCESS_REJECT;
+				goto rerun_nak;
+			}
+
+			vp = fr_pair_find_by_num(request->control, 0, FR_FREERADIUS_CLIENT_SECRET, TAG_ANY);
+			if (!vp) {
+				ERROR("The 'control' list MUST contain a FreeRADIUS-Client-Secret attribute");
+				request->reply->code = FR_CODE_ACCESS_REJECT;
+				goto rerun_nak;
+			}
+
 			/*
-			 *	@todo - check for existence of all necessary VPs.
-			 *	If some don't exist, complain, and run "deny client"
+			 *	Else we're flexible.
 			 */
 		}