From: Alan T. DeKok <aland@freeradius.org>
Date: Wed, 10 Jan 2018 17:26:08 +0000 (-0500)
Subject: look for overlapping networks, and complain if so
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=32f5839cd68cd5d3af1a7513fdb7e3a922c8ef96;p=thirdparty%2Ffreeradius-server.git

look for overlapping networks, and complain if so
---

diff --git a/src/modules/proto_radius/proto_radius_udp.c b/src/modules/proto_radius/proto_radius_udp.c
index 99a2cbbc216..582c309867d 100644
--- a/src/modules/proto_radius/proto_radius_udp.c
+++ b/src/modules/proto_radius/proto_radius_udp.c
@@ -1385,6 +1385,7 @@ static int mod_bootstrap(void *instance, CONF_SECTION *cs)
 
 		num = talloc_array_length(inst->dynamic_clients.network);
 		for (i = 0; i < num; i++) {
+			fr_ipaddr_t *network;
 			char buffer[256];
 
 			/*
@@ -1399,21 +1400,33 @@ static int mod_bootstrap(void *instance, CONF_SECTION *cs)
 			/*
 			 *	Duplicates are bad.
 			 */
-			if (fr_trie_match(inst->dynamic_clients.trie,
-					   &inst->dynamic_clients.network[i].addr, inst->dynamic_clients.network[i].prefix) != NULL) {
+			network = fr_trie_match(inst->dynamic_clients.trie,
+					   &inst->dynamic_clients.network[i].addr, inst->dynamic_clients.network[i].prefix);
+			if (network) {
 				fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->dynamic_clients.network[i]), 0);
 				cf_log_err(cs, "Cannot add duplicate entry 'network = %s'", buffer);
 				return -1;
 			}
 
 			/*
-			 *	@todo - look for 192.168/16 followed
-			 *	by 192.168.1/24, or vice-versa.
-			 *	i.e. the networks MUST be disjoint!
+			 *	Look for overlapping entries.
+			 *	i.e. the networks MUST be disjoint.
 			 *
-			 *	Or maybe that can be added as a flag
-			 *	to fr_trie_alloc() ?
+			 *	Note that this catches 192.168.1/24
+			 *	followed by 192.168/16, but NOT the
+			 *	other way around.  The best fix is
+			 *	likely to add a flag to
+			 *	fr_trie_alloc() saying "we can only
+			 *	have terminal fr_trie_user_t nodes"
 			 */
+			network = fr_trie_lookup(inst->dynamic_clients.trie,
+					   &inst->dynamic_clients.network[i].addr, inst->dynamic_clients.network[i].prefix);
+			if (network && (network->prefix <= inst->dynamic_clients.network[i].prefix)) {
+				fr_value_box_snprint(buffer, sizeof(buffer), fr_box_ipaddr(inst->dynamic_clients.network[i]), 0);
+				cf_log_err(cs, "Cannot add overlapping entry 'network = %s'", buffer);
+				cf_log_err(cs, "Entry is completely enclosed inside of a previously defined network.");
+				return -1;
+			}
 
 			/*
 			 *	Insert the network into the trie.