there's overlap between ::1 and ::Framed-User

We'll have to think about that a bit more, but "::" is still
fairly reasonable

diff --git a/src/lib/server/tmpl_tokenize.c b/src/lib/server/tmpl_tokenize.c
index b75726cda850a5f543c014f9f4430d7a0c0aa342..b17a0a79ab6cd5e81a763d2075b25a17e0edb51b 100644 (file)
--- a/src/lib/server/tmpl_tokenize.c
+++ b/src/lib/server/tmpl_tokenize.c
@@ -2878,20 +2878,6 @@ fr_slen_t tmpl_afrom_substr(TALLOC_CTX *ctx, tmpl_t **out,
                if (fr_sbuff_is_char(&our_in, '&')) return tmpl_afrom_attr_substr(ctx, NULL, out, in,
                                                                                  p_rules, t_rules);
 
-               /*
-                *      ::value
-                *
-                *      Treated as enum name.
-                *
-                *      @todo - move the enum parsing here, and then unresolved tmpls _always_ become xlat references.
-                *      and when we fix that, change the enum name to include the ::
-                */
-               if (fr_sbuff_is_str_literal(&our_in, "::")) {
-                       (void) fr_sbuff_advance(&our_in, 2);
-                       goto do_enum;
-               }
-
-
                /*
                 *      Allow bareword xlats if we
                 *      find a '%' prefix.
@@ -2973,6 +2959,20 @@ fr_slen_t tmpl_afrom_substr(TALLOC_CTX *ctx, tmpl_t **out,
                if (slen > 0) goto done_bareword;
                fr_assert(!*out);
 
+               /*
+                *      ::value
+                *
+                *      Treated as enum name.  Note that this check MUST be done after the test for IPv6, as
+                *      "::1" is an allowed IPv6 address.
+                *
+                *      @todo - move the enum parsing here, and then unresolved tmpls _always_ become xlat references.
+                *      and when we fix that, change the enum name to include the ::
+                */
+               if (fr_sbuff_is_str_literal(&our_in, "::")) {
+                       (void) fr_sbuff_advance(&our_in, 2);
+                       goto do_enum;
+               }
+
                /*
                 *      See if it's a integer
                 */