]> git.ipfire.org Git - thirdparty/freeradius-server.git/commitdiff
cross-check name / number for attributes
authorAlan T. DeKok <aland@freeradius.org>
Tue, 23 Feb 2021 16:53:23 +0000 (11:53 -0500)
committerAlan T. DeKok <aland@freeradius.org>
Tue, 23 Feb 2021 17:29:38 +0000 (12:29 -0500)
we previously looked up (and checked) duplicate attributes by name.

We now check if attributes of the same number are compatible.
If not, error out.

As a result, a number of dictionaries have to be updated in order
to have compatible types.  Mostly by commenting out one of the
incompatible types.

share/dictionary/dhcpv4/dictionary.rfc2131
share/dictionary/eap/aka-sim/dictionary.3gpp-ts24.302
share/dictionary/radius/dictionary
share/dictionary/radius/dictionary.cisco.vpn5000
share/dictionary/radius/dictionary.compat
share/dictionary/radius/dictionary.ruckus
share/dictionary/radius/dictionary.sandy
src/lib/util/dict_util.c

index cb9dcb654f567f928463c671580ea7f6d4568dac..415c48853f6bb003cc92f9e3e6fd3e128d39894c 100644 (file)
@@ -243,7 +243,7 @@ ATTRIBUTE   V-I-Vendor-Class                        124     octets
 # Vendor-Specific
 ATTRIBUTE      V-I-Vendor-Specific                     125     vsa
 
-ATTRIBUTE      Etherboot                               128     ether
+#ATTRIBUTE     Etherboot                               128     ether
 # (for IP Phone software load)
 
 # RFC 4578 - Options for the Intel Preboot eXecution Environment
index 0bacfc001c365917c1dbfff613f73c7fb83520a2..285ed4cebcc6882bd2ec86490d13d85180959095 100644 (file)
@@ -9,7 +9,7 @@
 #
 #  Skippable-Attributes
 #
-ATTRIBUTE      IPMS-Ind                                137     octets
+#ATTRIBUTE     IPMS-Ind                                137     octets
 ATTRIBUTE      IPMS-Res                                138     octets
 ATTRIBUTE      Tust-Ind                                139     octets
 ATTRIBUTE      Short-Name-For-Network                  140     octets
index 1dbc3c96ac16a7b7f1200230e50ff301221115f0..719aabbaf0442aca933f08365465e59f16cac0cb 100644 (file)
@@ -237,7 +237,11 @@ $INCLUDE dictionary.microsoft
 $INCLUDE dictionary.mikrotik
 $INCLUDE dictionary.mimosa
 $INCLUDE dictionary.motorola
-$INCLUDE dictionary.motorola.wimax
+#
+#  The WiMAX dictionary uses the sanme vendor space
+#  as the main motorola dictionary.
+#
+#$INCLUDE dictionary.motorola.wimax
 $INCLUDE dictionary.navini
 $INCLUDE dictionary.net
 $INCLUDE dictionary.netscreen
index c6c86aa23e743068b592231ae01f353e0861a1a9..1e689573bfbc5dc9efc508b35ee62cb6a7dbff1d 100644 (file)
@@ -14,7 +14,7 @@ VENDOR                Cisco-VPN5000                   255
 BEGIN-VENDOR   Cisco-VPN5000
 ATTRIBUTE      Tunnel-Throughput                       1       integer
 ATTRIBUTE      Client-Assigned-IP                      2       string
-ATTRIBUTE      Client-Real-IP                          3       string
+ATTRIBUTE      Client-Real-IP                          3       ipaddr
 ATTRIBUTE      VPN-GroupInfo                           4       string
 ATTRIBUTE      VPN-Password                            5       string
 ATTRIBUTE      Echo                                    6       integer
index f0aaaa07172d1b2187ee53ec82147d7f3345cf55..2a254d919d0557998421067888f82eb8ed7e9a29 100644 (file)
@@ -22,7 +22,7 @@ ATTRIBUTE     Old-Password                            17      string
 ATTRIBUTE      Port-Message                            18      string
 ATTRIBUTE      Dialback-No                             19      string
 ATTRIBUTE      Dialback-Name                           20      string
-ATTRIBUTE      Challenge-State                         24      string
+ATTRIBUTE      Challenge-State                         24      octets
 
 ATTRIBUTE      Framed-Compression                      13      integer
 VALUE  Framed-Compression              Van-Jacobsen-TCP-IP     1
index 4ebf4aab8b6f6df032a2b34cc34c246a04a488a4..ee17f5da12dac5d7b6214be0aae7c9fde0366fe8 100644 (file)
@@ -21,7 +21,8 @@ ATTRIBUTE     Grace-Period                            6       integer
 ATTRIBUTE      SCG-CBlade-IP                           7       integer
 ATTRIBUTE      SCG-DBlade-IP                           8       integer
 ATTRIBUTE      VLAN-ID                                 9       integer
-ATTRIBUTE      Sta-Expiration                          10      integer # not used by AP anymore. Please check SCG-33602
+# not used by AP anymore. Please check SCG-33602
+#ATTRIBUTE     Sta-Expiration                          10      integer
 ATTRIBUTE      Sta-UUID                                11      string
 ATTRIBUTE      Accept-Enhancement-Reason               12      integer
 ATTRIBUTE      Sta-Inner-Id                            13      string
index cd9fd17a6db91d735f7dd131b2191c2bf6a443ee..65795a16482393767a18de97a595df7060347f0f 100644 (file)
@@ -34,7 +34,7 @@ ATTRIBUTE     Mail-Quota                              108     integer
 ATTRIBUTE      Mail-Filter                             109     octets
 ATTRIBUTE      Mail-Box-Control                        110     integer
 ATTRIBUTE      Mail-Client-IP                          111     ipaddr
-ATTRIBUTE      Mail-Client-Helo                        110     string
+#ATTRIBUTE     Mail-Client-Helo                        110     string
 
 VALUE  Mail-Service                    Transfer                1
 VALUE  Mail-Service                    Delivery                2
index 8470ed2bf42305207be5e186c0972bf6b42f490e..74dbacdc25f53ef6e2295784eb42126aceef4b57 100644 (file)
@@ -1153,6 +1153,32 @@ int dict_attr_add_to_namespace(fr_dict_t *dict, fr_dict_attr_t const *parent, fr
        return 0;
 }
 
+static int dict_attr_compatible(fr_dict_attr_t const *parent, fr_dict_attr_t const *old, fr_dict_attr_t const *n)
+{
+       if (old->parent != parent) {
+               fr_strerror_printf_push("Cannot add duplicate attribute \"%s\" with different parent (old %s, new %s)",
+                                       n->name, old->parent->name, parent->name);
+               return -1;
+       }
+
+       if (old->attr != n->attr) {
+               fr_strerror_printf_push("Cannot add duplicate attribute name \"%s\" with different number (old %u, new %d)",
+                                       n->name, old->attr, n->attr);
+               return -1;
+       }
+
+       if (old->type != n->type) {
+               fr_strerror_printf_push("Cannot add duplicate attribute with different type (old %s has type %s, new %s has type %s)",
+                                       old->name,
+                                       fr_table_str_by_value(fr_value_box_type_table, old->type, "?Unknown?"),
+                                       n->name,
+                                       fr_table_str_by_value(fr_value_box_type_table, n->type, "?Unknown?"));
+               return -1;
+       }
+
+       return 0;
+}
+
 /** Add an attribute to the dictionary
  *
  * @param[in] dict             of protocol context we're operating in.
@@ -1183,46 +1209,43 @@ int fr_dict_attr_add(fr_dict_t *dict, fr_dict_attr_t const *parent,
         */
        if (!dict_attr_fields_valid(dict, parent, name, &attr, type, &our_flags)) return -1;
 
-       /*
-        *      Suppress duplicates.
-        */
+       n = dict_attr_alloc(dict->pool, parent, name, attr, type, &our_flags);
+       if (!n) return -1;
+
 #define FLAGS_EQUAL(_x) (old->flags._x == flags->_x)
 
        old = fr_dict_attr_by_name(NULL, parent, name);
        if (old) {
-               if ((old->parent == parent)&& (old->type == type) &&
+               /*
+                *      Don't bother inserting exact duplicates.
+                */
+               if ((old->parent == parent) && (old->type == type) &&
                    FLAGS_EQUAL(array) && FLAGS_EQUAL(subtype)  &&
                    ((old->attr == (unsigned int) attr) || ((attr < 0) && old->flags.internal))) {
                        return 0;
                }
 
-               if (old->parent != parent) {
-                       fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different parent (old %s, new %s)",
-                                               name, old->parent->name, parent->name);
-                       return -1;
-               }
-
-               if (old->attr != (unsigned int) attr) {
-                       fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different number (old %u, new %d)",
-                                               name, old->attr, attr);
-                       return -1;
-               }
-
-               if (old->type != type) {
-                       fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different type (old %s, new %s)",
-                                               name,
-                                               fr_table_str_by_value(fr_value_box_type_table, old->type, "?Unknown?"),
-                                               fr_table_str_by_value(fr_value_box_type_table, type, "?Unknown?"));
-                       return -1;
-               }
+               /*
+                *      We have the same name, but different
+                *      properties.  That's an error.
+                */
+               if (dict_attr_compatible(parent, old, n) < 0) goto error;
 
-               fr_strerror_printf_push("Cannot add duplicate name \"%s\" with different flags",
-                                       name);
-               return -1;
+               /*
+                *      We have the same name, and same (enough)
+                *      properties.  Discard the duplicate.
+                */
+               talloc_free(n);
+               return 0;
        }
 
-       n = dict_attr_alloc(dict->pool, parent, name, attr, type, &our_flags);
-       if (!n) return -1;
+       /*
+        *      Attributes can also be indexed by number.  Ensure that
+        *      all attributes of the same number have the same
+        *      properties.
+        */
+       old = fr_dict_attr_child_by_num(parent, n->attr);
+       if (old && (dict_attr_compatible(parent, old, n) < 0)) goto error;
 
        if (dict_attr_add_to_namespace(dict, parent, n) < 0) {
        error: