Don't try to check RHS value in update sections when the operator is !*

src/main/modcall.c

@@ -1548,8 +1548,12 @@ static modcallable *do_compile_modupdate(modcallable *parent, UNUSED rlm_compone
 		/*
 		 *	If LHS is an attribute, and RHS is a literal, we can
 		 *	check that the format is correct.
+		 *
+		 *	Unless it's a unary operator in which case map->src
+		 *	can by anything.
 		 */
-		if ((map->dst->type == VPT_TYPE_ATTR) && (map->src->type == VPT_TYPE_LITERAL)) {
+		if ((map->dst->type == VPT_TYPE_ATTR) && (map->src->type == VPT_TYPE_LITERAL) &&
+		    (map->op != T_OP_CMP_FALSE)) {
 			VALUE_PAIR *vp;
 			bool ret;
 

src/tests/keywords/update-remove-any

@@ -0,0 +1,50 @@
+#
+# PRE: update
+#
+#  Remove all attributes in a list
+#
+update {
+	control:Cleartext-Password := 'hello'
+	reply:Filter-Id := 'filter'
+}
+
+update {
+	request:Tmp-String-0 := 'foobarbaz'
+	request:Tmp-Integer-0 := 123456789
+	request:Tmp-IP-Address-0 := 192.0.2.1
+	request:Tmp-IP-Address-0 += 192.0.2.2
+	control:Tmp-IP-Address-0 := 192.0.2.1
+	control:Tmp-IP-Address-0 += 192.0.2.3
+}
+
+if (("%{Tmp-IP-Address-0[0]}" != 192.0.2.1) || ("%{Tmp-IP-Address-0[1]}" != 192.0.2.2)) {
+	update {
+		reply:Filter-Id := 'fail'
+	}
+}
+
+# Remove all attributes in the control list
+update {
+	request:Tmp-IP-Address-0 !* ANY
+}
+
+# Non Tmp-IP-Address-0 address attributes should still be in the request list
+if ((Tmp-String-0 != 'foobarbaz') || (Tmp-Integer-0 != 123456789)) {
+	update reply {
+		reply:Filter-Id := 'fail'
+	}
+}
+
+# There should be no Tmp-IP-Address attributes in the request list
+if (("%{Tmp-IP-Address-0[0]}" != '') || ("%{Tmp-IP-Address-0[1]}" != '')) {
+	update {
+		reply:Filter-Id := 'fail'
+	}
+}
+
+# But there should still be some in the control list
+if (("%{control:Tmp-IP-Address-0[0]}" != 192.0.2.1) || ("%{control:Tmp-IP-Address-0[1]}" != 192.0.2.3)) {
+	update {
+		reply:Filter-Id := 'fail'
+	}
+}