From: Alan T. DeKok <aland@freeradius.org>
Date: Sun, 19 Mar 2023 14:23:17 +0000 (-0400)
Subject: Revert "revert last two commits."
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6e408974b2e233a6a8823260b51ecb4bbc978b88;p=thirdparty%2Ffreeradius-server.git

Revert "revert last two commits."

This reverts commit b4a5aada3801b57f94ee2ade65f35f8f25ea5e10.
---

diff --git a/src/lib/server/tmpl_tokenize.c b/src/lib/server/tmpl_tokenize.c
index 3cab829b7f5..d185187d5c5 100644
--- a/src/lib/server/tmpl_tokenize.c
+++ b/src/lib/server/tmpl_tokenize.c
@@ -1570,7 +1570,7 @@ static inline int tmpl_attr_afrom_attr_substr(TALLOC_CTX *ctx, tmpl_attr_error_t
 	}
 
 	/*
-	 *	No parent means we need to go hunting through all the dictionaries
+	 *	No parent means we use the default dictionary.
 	 */
 	if (!our_parent) {
 		(void)fr_dict_attr_search_by_qualified_name_substr(&dict_err, &da,
@@ -1596,6 +1596,8 @@ static inline int tmpl_attr_afrom_attr_substr(TALLOC_CTX *ctx, tmpl_attr_error_t
 	 *	or its reference in the case of group attributes.
 	 */
 	} else {
+		fr_assert(namespace != NULL);
+
 		(void)fr_dict_attr_by_name_substr(&dict_err,
 						  &da,
 						  namespace,
@@ -1679,6 +1681,9 @@ static inline int tmpl_attr_afrom_attr_substr(TALLOC_CTX *ctx, tmpl_attr_error_t
 		goto error;
 	}
 
+	fr_assert(our_parent != NULL);
+	fr_assert(namespace != NULL);
+
 	/*
 	 *	See if the ref begins with an unsigned integer
 	 *	if it does it's probably an OID component
@@ -1848,7 +1853,9 @@ do_suffix:
 		switch (da->type) {
 		/*
 		 *	If this is a group then the parent is the
-		 *	group ref.
+		 *	group ref.  If no explicit ref is set in the
+		 *	dictionary, the ref is the dict root of the
+		 *	attribute.
 		 *
 		 *	The dictionary resolution functions will
 		 *	automatically follow the ref, so we don't
@@ -1861,23 +1868,25 @@ do_suffix:
 			ref = fr_dict_attr_ref(da);
 
 			/*
-			 *	if there's a real dictionary, and this reference is to group which is in fact
-			 *	the internal dict, then just keep using our dict_def.
+			 *	If we're swapping dictionaries, do so.  Otherwise ref is to the internal
+			 *	dictionary, and we don't want to use that.
+			 *
+			 *	Instead of using the internal dictionary, just reset parent / namespace to the
+			 *	root of dict_def.
+			 *
+			 *	Note that means we cannot put random protocol attributes into an internal
+			 *	attribute of type "group".
 			 */
-			if (at_rules->dict_def && (ref == fr_dict_root(fr_dict_internal()))) {
-				if (!namespace) namespace = ref;
-
-			} else {
+			if (ref != fr_dict_root(fr_dict_internal())) {
 				namespace = ref;
-			}
 
-			/*
-			 *	If the group is from the internal dictionary, then reset the search
-			 *	for the child attribute.  Protocol attributes are allowed inside
-			 *	internal group attributes.
-			 */
-			our_parent = (namespace && (namespace->dict == fr_dict_internal())) ? NULL : namespace;
+			} else if (at_rules->dict_def) {
+				namespace = fr_dict_root(at_rules->dict_def);
 
+			} else {
+				namespace = NULL;
+			}
+			our_parent = NULL;
 			break;
 
 		case FR_TYPE_STRUCT: