From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 11 Apr 2025 11:06:42 +0000 (-0400)
Subject: print error on parsing no input
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=726dc7dfb8edcce105984ecdecc6ea94a59e4480;p=thirdparty%2Ffreeradius-server.git

print error on parsing no input

and update error location to point to the correct character
---

diff --git a/src/bin/unit_test_attribute.c b/src/bin/unit_test_attribute.c
index ce5fdb6df3a..eaf678adf14 100644
--- a/src/bin/unit_test_attribute.c
+++ b/src/bin/unit_test_attribute.c
@@ -1571,8 +1571,14 @@ static size_t command_condition_normalise(command_result_t *result, command_file
 	fr_skip_whitespace(in);
 
 	slen = xlat_tokenize_condition(cc->tmp_ctx, &head, &FR_SBUFF_IN(in, inlen), NULL, &cc->tmpl_rules);
-	if (slen <= 0) {
-		fr_strerror_printf_push_head("ERROR offset %d", (int) -slen);
+	if (slen == 0) {
+		fr_strerror_printf_push_head("ERROR failed to parse any input");
+		talloc_free(cs);
+		RETURN_OK_WITH_ERROR();
+	}
+
+	if (slen < 0) {
+		fr_strerror_printf_push_head("ERROR offset %d", (int) -slen - 1);
 		talloc_free(cs);
 		RETURN_OK_WITH_ERROR();
 	}
@@ -2891,29 +2897,34 @@ static size_t command_write(command_result_t *result, command_file_ctx_t *cc,
 static size_t command_xlat_normalise(command_result_t *result, command_file_ctx_t *cc,
 				     char *data, UNUSED size_t data_used, char *in, UNUSED size_t inlen)
 {
-	ssize_t			dec_len;
+	ssize_t			slen;
 	xlat_exp_head_t		*head = NULL;
 	size_t			input_len = strlen(in), escaped_len;
 	fr_sbuff_parse_rules_t	p_rules = { .escapes = &fr_value_unescape_double };
 
-	dec_len = xlat_tokenize(cc->tmp_ctx, &head, &FR_SBUFF_IN(in, input_len), &p_rules,
-				&(tmpl_rules_t) {
-					.attr = {
-						.dict_def = dictionary_current(cc),
-						.list_def = request_attr_request,
-						.allow_unresolved = cc->tmpl_rules.attr.allow_unresolved
-					},
-					.xlat = cc->tmpl_rules.xlat,
-				});
-	if (dec_len <= 0) {
-		fr_strerror_printf_push_head("ERROR offset %d", (int) -dec_len);
+	slen = xlat_tokenize(cc->tmp_ctx, &head, &FR_SBUFF_IN(in, input_len), &p_rules,
+			     &(tmpl_rules_t) {
+				     .attr = {
+					     .dict_def = dictionary_current(cc),
+					     .list_def = request_attr_request,
+					     .allow_unresolved = cc->tmpl_rules.attr.allow_unresolved
+				     },
+				     .xlat = cc->tmpl_rules.xlat,
+			     });
+	if (slen == 0) {
+		fr_strerror_printf_push_head("ERROR failed to parse any input");
+		RETURN_OK_WITH_ERROR();
+	}
+
+	if (slen < 0) {
+		fr_strerror_printf_push_head("ERROR offset %d", (int) -slen - 1);
 
 	return_error:
 		RETURN_OK_WITH_ERROR();
 	}
 
-	if (((size_t) dec_len != input_len)) {
-		fr_strerror_printf_push_head("offset %d 'Too much text'", (int) dec_len);
+	if (((size_t) slen != input_len)) {
+		fr_strerror_printf_push_head("offset %d 'Too much text'", (int) slen);
 		goto return_error;
 	}
 
@@ -2962,7 +2973,7 @@ static size_t command_xlat_expr(command_result_t *result, command_file_ctx_t *cc
 static size_t command_xlat_purify(command_result_t *result, command_file_ctx_t *cc,
 				     char *data, UNUSED size_t data_used, char *in, UNUSED size_t inlen)
 {
-	ssize_t			dec_len;
+	ssize_t			slen;
 	xlat_exp_head_t		*head = NULL;
 	size_t			input_len = strlen(in), escaped_len;
 	tmpl_rules_t		t_rules = (tmpl_rules_t) {
@@ -2981,16 +2992,20 @@ static size_t command_xlat_purify(command_result_t *result, command_file_ctx_t *
 	}
 	t_rules.xlat.runtime_el = el;
 
-	dec_len = xlat_tokenize_expression(cc->tmp_ctx, &head, &FR_SBUFF_IN(in, input_len), NULL, &t_rules);
-	if (dec_len <= 0) {
-		fr_strerror_printf_push_head("ERROR offset %d", (int) -dec_len);
+	slen = xlat_tokenize_expression(cc->tmp_ctx, &head, &FR_SBUFF_IN(in, input_len), NULL, &t_rules);
+	if (slen == 0) {
+		fr_strerror_printf_push_head("ERROR failed to parse any input");
+		RETURN_OK_WITH_ERROR();
+	}
 
+	if (slen < 0) {
+		fr_strerror_printf_push_head("ERROR offset %d", (int) -slen - 1);
 	return_error:
 		RETURN_OK_WITH_ERROR();
 	}
 
-	if (((size_t) dec_len != input_len)) {
-		fr_strerror_printf_push_head("Passed in %zu characters, but only parsed %zd characters", input_len, dec_len);
+	if (((size_t) slen != input_len)) {
+		fr_strerror_printf_push_head("Passed in %zu characters, but only parsed %zd characters", input_len, slen);
 		goto return_error;
 	}
 
diff --git a/src/tests/unit/condition/base.txt b/src/tests/unit/condition/base.txt
index d8810a47ab8..6ba5dec23ea 100644
--- a/src/tests/unit/condition/base.txt
+++ b/src/tests/unit/condition/base.txt
@@ -14,26 +14,26 @@ match (request.User-Name == reply.User-Name)
 
 # All IP address literals should be parsed as prefixes
 condition ("foo\
-match ERROR offset 2: Unterminated string
+match ERROR offset 1: Unterminated string
 
 condition ("foo
-match ERROR offset 2: Unterminated string
+match ERROR offset 1: Unterminated string
 
 condition ()
-match ERROR offset 2: Empty expressions are invalid
+match ERROR offset 1: Empty expressions are invalid
 
 condition (!)
-match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
 
 condition (|| b)
-match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 1: Zero length attribute name: Unresolved attributes are not allowed here
 
 condition ((ok || handled) foo)
-match ERROR offset 18: Invalid operator
+match ERROR offset 17: Invalid operator
 
 # escapes in names are illegal
 condition (ok\ foo || handled)
-match ERROR offset 4: Unexpected text after return code
+match ERROR offset 3: Unexpected text after return code
 
 #
 #  @todo - parsing - This is just a bare word comparison, and should be disallowed?
@@ -46,13 +46,13 @@ match (Service-Type == (0 - 111))
 #  so that it finds out which specific parse problem it is, and gives a better error message.
 #
 condition (ok FOO handled)
-match ERROR offset 5: Invalid operator
+match ERROR offset 4: Invalid operator
 
 condition (ok !x handled)
-match ERROR offset 5: Invalid operator
+match ERROR offset 4: Invalid operator
 
 condition (ok =x handled)
-match ERROR offset 5: Invalid operator
+match ERROR offset 4: Invalid operator
 
 #
 # Re-enable when we have proper bareword xlat tokenization
@@ -79,7 +79,7 @@ condition !(ok)
 match !%expr.rcode('ok')
 
 condition !!ok
-match ERROR offset 2: Double operator is invalid
+match ERROR offset 1: Double operator is invalid
 
 #
 # @todo - peephole - do optimization to get rid of double negation?
@@ -124,13 +124,13 @@ condition handled &&&Packet-Type == ::Access-Challenge
 match (%expr.rcode('handled') && (Packet-Type == ::Access-Challenge))
 
 condition reply == request
-match ERROR offset 1: Cannot use list references in condition
+match ERROR offset 0: Cannot use list references in condition
 
 condition reply == "hello"
-match ERROR offset 1: Cannot use list references in condition
+match ERROR offset 0: Cannot use list references in condition
 
 condition "hello" == reply
-match ERROR offset 12: Cannot use list references in condition
+match ERROR offset 11: Cannot use list references in condition
 
 condition User-Name == User-Password
 match (User-Name == User-Password)
@@ -152,13 +152,13 @@ match ((ipaddr)Filter-Id == Framed-IP-Address)
 #  user forces incompatible types, then that's an error.
 #
 condition (ipaddr)Filter-Id == (uint) Framed-IP-Address
-match ERROR offset 23: Attribute 'uint' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 22: Attribute 'uint' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 condition (ipaddr)Filter-Id == (uint32) Framed-IP-Address
 match ((ipaddr)Filter-Id == (uint32)Framed-IP-Address)
 
 condition (blerg)Filter-Id == "foo"
-match ERROR offset 2: Attribute 'blerg' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 1: Attribute 'blerg' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 #
 #  Normalize things
@@ -168,23 +168,23 @@ match (127.0.0.1 < Framed-IP-Address)
 
 # =* and !* are only for attrs / lists
 condition "foo" !* bar
-match ERROR offset 7: Invalid operator
+match ERROR offset 6: Invalid operator
 
 condition "foo" =* bar
-match ERROR offset 7: Invalid operator
+match ERROR offset 6: Invalid operator
 
 # existence checks don't need the RHS
 condition User-Name =* bar
-match ERROR offset 11: Invalid operator
+match ERROR offset 10: Invalid operator
 
 condition User-Name !* bar
-match ERROR offset 11: Invalid operator
+match ERROR offset 10: Invalid operator
 
 condition !User-Name =* bar
-match ERROR offset 12: Invalid operator
+match ERROR offset 11: Invalid operator
 
 condition !User-Name !* bar
-match ERROR offset 12: Invalid operator
+match ERROR offset 11: Invalid operator
 
 # redundant casts get squashed
 condition (ipaddr)Framed-IP-Address == 127.0.0.1
@@ -228,10 +228,10 @@ condition Event-Timestamp == 'January 1, 2012'
 
 # literals are parsed when the conditions are parsed
 condition (integer)X == 1
-match ERROR offset 10: Attribute 'X' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 9: Attribute 'X' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 condition NAS-Port == X
-match ERROR offset 13: Attribute 'X' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 12: Attribute 'X' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 #
 #  The RHS is a static string, so this gets mashed to a literal,
@@ -259,7 +259,7 @@ condition (ether) 00:11:22:33:44:55 == "%md4('00:11:22:33:44:55')"
 match (00:11:22:33:44:55 == "%md4(0x30303a31313a32323a33333a34343a3535)")
 
 condition (ether) 00:XX:22:33:44:55 == 00:11:22:33:44:55
-match ERROR offset 11: Unexpected text after attribute reference
+match ERROR offset 10: Unexpected text after attribute reference
 
 #
 #  Tests for boolean data types.
@@ -340,13 +340,13 @@ condition (ipaddr)127.0.0.1/32 == 127.0.0.1
 match true
 
 condition (ipaddr)127.0.0.1/327 == 127.0.0.1
-match ERROR offset 14: Parent type of nested attribute 0 must be of type "struct", "tlv", "vendor", "vsa" or "group", got "octets"
+match ERROR offset 13: Parent type of nested attribute 0 must be of type "struct", "tlv", "vendor", "vsa" or "group", got "octets"
 
 condition (ipaddr)127.0.0.1/32 == 127.0.0.1
 match true
 
 condition (/foo/)
-match ERROR offset 2: Unexpected regular expression
+match ERROR offset 1: Unexpected regular expression
 
 #
 #  Tests for (FOO).
@@ -379,7 +379,7 @@ condition ('a')
 match 'a'
 
 condition (a)
-match ERROR offset 2: Attribute 'a' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 1: Attribute 'a' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 #
 #  Module return codes are OK
@@ -403,7 +403,7 @@ match User-Name
 #  Forbidden data types in cast
 #
 condition ((vsa)"foo" == User-Name)
-match ERROR offset 2: Invalid data type 'vsa' in cast
+match ERROR offset 1: Invalid data type 'vsa' in cast
 
 #
 #  If the LHS is a cast to a type, and the RHS is an attribute
@@ -432,7 +432,7 @@ match (Acct-Input-Octets64 == reply.Session-Timeout)
 #  Casting attributes of different size
 #
 condition (ipaddr)Acct-Input-Octets64 == Framed-IP-Address
-match ERROR offset 9: Cannot cast type 'uint64' to 'ipaddr'
+match ERROR offset 8: Cannot cast type 'uint64' to 'ipaddr'
 
 #
 #  LHS is a prefix, which _might_ be castable to an address
@@ -468,7 +468,7 @@ match (User-Name[n] == "bob")
 #  Disallowed as it's an unknown attribute
 #
 condition Foo-Bar
-match ERROR offset 1: Attribute 'Foo-Bar' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 0: Attribute 'Foo-Bar' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 #  Same types are optimized
 #
@@ -512,19 +512,19 @@ match (26.24757.84.9.5.15 == 0x1a99)
 #  Invalid array references.
 #
 condition User-Name[a] == 'bob'
-match ERROR offset 11: Attribute 'a' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 10: Attribute 'a' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 condition User-Name == Filter-Id[a]
-match ERROR offset 24: Attribute 'a' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 23: Attribute 'a' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 #
 #  Bounds checks...
 #
 condition User-Name[1001] == 'bob'
-match ERROR offset 11: Invalid array index '1001' (should be between 0-1000)
+match ERROR offset 10: Invalid array index '1001' (should be between 0-1000)
 
 condition User-Name[-1] == 'bob'
-match ERROR offset 11: Invalid array index '-1'
+match ERROR offset 10: Invalid array index '-1'
 
 #
 #  Sometimes the attribute/condition parser needs to fallback to bare words
@@ -532,14 +532,14 @@ match ERROR offset 11: Invalid array index '-1'
 #  @todo - bare word - this is likely treating the LHS as an enum which is impossible here
 #
 condition request.Foo == 'request.Foo'
-match ERROR offset 9: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 8: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 # Bareword compared with bareword is true
 condition request.Foo+Bar == request.Foo+Bar
-match ERROR offset 9: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 8: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 condition request.Foo+Bar == 'request.Foo+Bar'
-match ERROR offset 9: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 8: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 condition request.User-Name+User-Password == 'request.Foo+Bar'
 match ((request.User-Name + User-Password) == 'request.Foo+Bar')
@@ -548,18 +548,18 @@ match ((request.User-Name + User-Password) == 'request.Foo+Bar')
 #  @todo - bare word - this is wrong
 #
 condition 'request.Foo+d' == request.Foo+Bar
-match ERROR offset 28: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 27: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 #  Attribute tags are not allowed for unknown attributes
 condition request.Tunnel-Password:0 == 0
-match ERROR offset 24: Unexpected text after attribute reference
+match ERROR offset 23: Unexpected text after attribute reference
 
 condition not-a-list:User-Name == not-a-list:User-Name
-match ERROR offset 1: Attribute 'not-a-list' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 0: Attribute 'not-a-list' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 # . is a valid dictionary name attribute, so we can't error out in pass1
 condition not-a-packet.User-Name == not-a-packet.User-Name
-match ERROR offset 1: Attribute 'not-a-packet' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 0: Attribute 'not-a-packet' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 #
 #  The LHS is a string with ASCII 5C 30 30 30 inside of it vs the RHS which should contain ASCII 0.
diff --git a/src/tests/unit/condition/filter.txt b/src/tests/unit/condition/filter.txt
index fb52339d339..2cfc260b44f 100644
--- a/src/tests/unit/condition/filter.txt
+++ b/src/tests/unit/condition/filter.txt
@@ -25,7 +25,7 @@ condition User-Name[n] == "foo"
 match (User-Name[n] == "foo")
 
 condition User-Name[-1] == "foo"
-match ERROR offset 11: Invalid array index '-1'
+match ERROR offset 10: Invalid array index '-1'
 
 #
 #  tmpl_dcursor.c has an assert which fails if you try to use
@@ -36,7 +36,7 @@ match ERROR offset 11: Invalid array index '-1'
 #  @todo - feature - allow expressions in tmpl_attr_parse_filter(()
 #
 condition User-Name[(User-Name == 'bar')] == "foo"
-match ERROR offset 11: Invalid filter - cannot use filter on leaf attributes
+match ERROR offset 10: Invalid filter - cannot use filter on leaf attributes
 
 #
 #  The condition code doesn't allow Group-Thingy == { foo = bar }
@@ -52,7 +52,7 @@ match ERROR offset 11: Invalid filter - cannot use filter on leaf attributes
 #  @todo - feature - this error is misleading and wrong.
 #
 condition TLS-Certificate[(Common-Name == 'user@example.com')] == 'bar'
-match ERROR offset 1: Cannot use list references in condition
+match ERROR offset 0: Cannot use list references in condition
 
 count
 match 15
diff --git a/src/tests/unit/condition/nested.txt b/src/tests/unit/condition/nested.txt
index 1d79d95398e..62a86058f7e 100644
--- a/src/tests/unit/condition/nested.txt
+++ b/src/tests/unit/condition/nested.txt
@@ -36,15 +36,15 @@ tmpl-rules allow_unresolved=no
 #
 # Malformed filter
 condition Vendor-Specific.WiMAX.Packet-Flow-Descriptor[*.Uplink-QOS-Id[0]
-match ERROR offset 47: No closing ']' for array index
+match ERROR offset 46: No closing ']' for array index
 
 # Too many dots, point to the thing that's wrong
 condition Vendor-Specific.WiMAX.Packet-Flow-Descriptor..Uplink-QOS-Id[0]
-match ERROR offset 46: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 45: Zero length attribute name: Unresolved attributes are not allowed here
 
 # Trailing dots, point to the dot that's an error
 condition Vendor-Specific.WiMAX.Packet-Flow-Descriptor.Uplink-QOS-Id[0].
-match ERROR offset 62: Parent type of nested attribute Uplink-QOS-Id must be of type "struct", "tlv", "vendor", "vsa" or "group", got "uint8"
+match ERROR offset 61: Parent type of nested attribute Uplink-QOS-Id must be of type "struct", "tlv", "vendor", "vsa" or "group", got "uint8"
 
 count
 match 19
diff --git a/src/tests/unit/condition/regex.txt b/src/tests/unit/condition/regex.txt
index 2d0bed2cebd..8a852d80b99 100644
--- a/src/tests/unit/condition/regex.txt
+++ b/src/tests/unit/condition/regex.txt
@@ -8,16 +8,16 @@ proto-dictionary radius
 tmpl-rules allow_unresolved=yes allow_unknown=yes
 
 condition User-Name =~ (uint32) /foo/
-match ERROR offset 14: Expected regular expression
+match ERROR offset 13: Expected regular expression
 
 condition User-Name !~ /^foo\nbar$/
 match (User-Name !~ /^foo\nbar$/)
 
 condition ('ok' =~ 'handled')
-match ERROR offset 10: Expected regular expression
+match ERROR offset 9: Expected regular expression
 
 condition ('ok' == /foo/)
-match ERROR offset 10: Unexpected regular expression
+match ERROR offset 9: Unexpected regular expression
 
 condition 'foo' =~ /bar/
 match ('foo' =~ /bar/)
@@ -26,7 +26,7 @@ condition 'foo' !~ /bar/
 match ('foo' !~ /bar/)
 
 condition !foo !~ /bar/
-match ERROR offset 1: Operator '!' is only applied to the left hand side of the '!~' operation, add (..) to evaluate the operation first
+match ERROR offset 0: Operator '!' is only applied to the left hand side of the '!~' operation, add (..) to evaluate the operation first
 
 condition !('foo' !~ /bar/)
 match !('foo' !~ /bar/)
@@ -44,13 +44,13 @@ condition 'foo' =~ /bar/im
 match ('foo' =~ /bar/im)
 
 condition 'foo' =~ /bar/ima
-match ERROR offset 17: Unsupported regex flag 'a'
+match ERROR offset 16: Unsupported regex flag 'a'
 
 condition 'foo' =~ /bar/ii
-match ERROR offset 16: Duplicate regex flag 'i'
+match ERROR offset 15: Duplicate regex flag 'i'
 
 condition 'foo' =~ /bar/iia
-match ERROR offset 16: Duplicate regex flag 'i'
+match ERROR offset 15: Duplicate regex flag 'i'
 
 #
 #  Escape the backslashes correctly
@@ -76,19 +76,19 @@ match ((string)NAS-Port =~ /%{NAS-Port}/)
 #  Cannot add a bad cast
 #
 condition (uint32)Filter-Id =~ /foo/
-match ERROR offset 1: Casts cannot be used with regular expressions
+match ERROR offset 0: Casts cannot be used with regular expressions
 
 condition Filter-Id =~ (uint32)/foo/
-match ERROR offset 14: Expected regular expression
+match ERROR offset 13: Expected regular expression
 
 xlat %{1}
 match %{1}
 
 xlat %{33}
-match ERROR offset 3: Invalid regex reference.  Must be in range 0-32
+match ERROR offset 2: Invalid regex reference.  Must be in range 0-32
 
 condition User-Name == /foo/
-match ERROR offset 14: Unexpected regular expression
+match ERROR offset 13: Unexpected regular expression
 
 condition %md5("foo") =~ /foo/
 match ((string)%md5(0x666f6f) =~ /foo/)
diff --git a/src/tests/unit/xlat/alternation.txt b/src/tests/unit/xlat/alternation.txt
index 83c93c4d0f8..a1b64fee857 100644
--- a/src/tests/unit/xlat/alternation.txt
+++ b/src/tests/unit/xlat/alternation.txt
@@ -21,10 +21,10 @@ xlat %{%test('bar') || %{%{User-Name} || 'bar'}}
 match %{(%test('bar') || %{(%{User-Name} || 'bar')})}
 
 xlat %{%{User-Name} || }
-match ERROR offset 19: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 18: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{%{Operator-Name} || }
-matchERROR offset 23: Zero length attribute name: Unresolved attributes are not allowed here
+matchERROR offset 22: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{%{%{User-Name} || 'foo'} || 'bar'}
 match %{(%{(%{User-Name} || 'foo')} || 'bar')}
@@ -33,23 +33,23 @@ xlat %{%{%{User-Name} || 'foo'} || %{%test('bar') || %{User-Name}}}
 match %{(%{(%{User-Name} || 'foo')} || %{(%test('bar') || %{User-Name})})}
 
 xlat %{ || }
-match ERROR offset 4: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{ || %{User-Name}}
-match ERROR offset 4: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{%{} || }
-match ERROR offset 5: Empty expressions are invalid
+match ERROR offset 4: Empty expressions are invalid
 
 xlat %{%{} || foo}
-match ERROR offset 5: Empty expressions are invalid
+match ERROR offset 4: Empty expressions are invalid
 
 xlat %{%{User-Name} || 
-match ERROR offset 19: Empty attribute reference
+match ERROR offset 18: Empty attribute reference
 
 # Discuss - Not sure the offset/message is correct here, but not sure if we can determine the correct offset either
 xlat %{%{User-Name} || 'foo'
-match ERROR offset 24: Missing closing brace
+match ERROR offset 23: Missing closing brace
 
 xlat %{%{User-Name}:}
 match %{%{User-Name}:}
diff --git a/src/tests/unit/xlat/base.txt b/src/tests/unit/xlat/base.txt
index 2b419f6b5eb..f77c49f93af 100644
--- a/src/tests/unit/xlat/base.txt
+++ b/src/tests/unit/xlat/base.txt
@@ -50,16 +50,16 @@ xlat %{32}
 match %{32}
 
 xlat %{33}
-match ERROR offset 3: Invalid regex reference.  Must be in range 0-32
+match ERROR offset 2: Invalid regex reference.  Must be in range 0-32
 
 xlat %{3a}
-match ERROR offset 3: Unexpected text after attribute reference
+match ERROR offset 2: Unexpected text after attribute reference
 
 #xlat %{-3}
 #match ERROR offset 3: Unresolved attributes not allowed in expansions here
 
 xlat %{3
-match ERROR offset 4: Missing closing brace
+match ERROR offset 3: Missing closing brace
 
 #
 #  Tests for xlat expansion
@@ -68,7 +68,7 @@ xlat %{Tunnel-Password}
 match %{Tunnel-Password}
 
 xlat %test_no_args('foo')
-match ERROR offset 20: Too many arguments, expected 0, got 1
+match ERROR offset 19: Too many arguments, expected 0, got 1
 
 xlat %test('bar')
 match %test('bar')
@@ -125,10 +125,10 @@ xlat %length()
 match %length()
 
 xlat %length(
-match ERROR offset 9: Missing closing brace
+match ERROR offset 8: Missing closing brace
 
 xlat %length(1 + 2
-match ERROR offset 14: Missing ')' after argument 1
+match ERROR offset 13: Missing ')' after argument 1
 
 xlat \"%t\tfoo\"
 match \"%t\tfoo\"
@@ -143,66 +143,66 @@ match \"foo %test('foo')\"
 #  Alternations
 #
 xlat %{%{foo} || %{bar}}
-match ERROR offset 5: Attribute 'foo' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 4: Attribute 'foo' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat %{%{User-Name} || %{bar}}
-match ERROR offset 21: Attribute 'bar' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 20: Attribute 'bar' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 #
 #  Empty and malformed expansions
 #
 xlat %{
-match ERROR offset 3: Missing closing brace
+match ERROR offset 2: Missing closing brace
 
 xlat %{}
-match ERROR offset 3: Empty expressions are invalid
+match ERROR offset 2: Empty expressions are invalid
 
 xlat %{:}
-match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{:bar}
-match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %foo(' bar')
-match ERROR offset 2: Unresolved expansion functions are not allowed here
+match ERROR offset 1: Unresolved expansion functions are not allowed here
 
 xlat %{[}
-match ERROR offset 3: Missing attribute name
+match ERROR offset 2: Missing attribute name
 
 xlat %{[baz}
-match ERROR offset 3: Missing attribute name
+match ERROR offset 2: Missing attribute name
 
 xlat %{ }
-match ERROR offset 4: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{\t}
-match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{\n}
-match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat %{foo }
-match ERROR offset 3: Attribute 'foo' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 2: Attribute 'foo' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat %{foo bar}
-match ERROR offset 3: Attribute 'foo' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 2: Attribute 'foo' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat %test(
-match ERROR offset 7: Missing closing brace
+match ERROR offset 6: Missing closing brace
 
 xlat %test(%{User-Name)
-match ERROR offset 18: Missing closing brace
+match ERROR offset 17: Missing closing brace
 
 # Discuss - Not sure the offset/message is correct here, but not sure if we can determine the correct offset either
 xlat %test(%{User-Name}
-match ERROR offset 19: Missing ')' after argument 1
+match ERROR offset 18: Missing ')' after argument 1
 
 xlat %{myfirstxlat
-match ERROR offset 14: Missing closing brace
+match ERROR offset 13: Missing closing brace
 
 # Issue seen in the wild that caused an SEGV during pass2
 xlat %{%{control.IP-Pool.Name}:%{reply.IP-Pool.Range}
-match ERROR offset 49: Missing closing brace
+match ERROR offset 48: Missing closing brace
 
 #
 #  API to split xlat strings into argv-style arguments.
@@ -248,7 +248,7 @@ xlat %debug( 5)
 match %debug(5)
 
 xlat %debug("foo")
-match ERROR offset 8: Invalid argument 1 - Failed parsing string as type 'int8'
+match ERROR offset 7: Invalid argument 1 - Failed parsing string as type 'int8'
 
 #
 #  This is correct.
@@ -263,7 +263,7 @@ match %rpad(User-Name, 5, 'x')
 #  so the "offset" is wrong.  It also doesn't say *which* string is wrong.  We'll fix that later.
 #
 xlat %rpad(User-Name, 'foo', 'x')
-match ERROR offset 17: Invalid argument 2 - Failed parsing string as type 'uint64'
+match ERROR offset 16: Invalid argument 2 - Failed parsing string as type 'uint64'
 
 #
 #  Argument quoting
diff --git a/src/tests/unit/xlat/cond_base.txt b/src/tests/unit/xlat/cond_base.txt
index e671b073170..1d92c9ab9c1 100644
--- a/src/tests/unit/xlat/cond_base.txt
+++ b/src/tests/unit/xlat/cond_base.txt
@@ -9,26 +9,26 @@ proto-dictionary radius
 
 # All IP address literals should be parsed as prefixes
 xlat_purify ("foo\
-match ERROR offset 2: Unterminated string
+match ERROR offset 1: Unterminated string
 
 xlat_purify ("foo
-match ERROR offset 2: Unterminated string
+match ERROR offset 1: Unterminated string
 
 xlat_purify ()
-match ERROR offset 2: Empty expressions are invalid
+match ERROR offset 1: Empty expressions are invalid
 
 xlat_purify (!)
-match ERROR offset 3: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat_purify (|| b)
-match ERROR offset 2: Zero length attribute name: Unresolved attributes are not allowed here
+match ERROR offset 1: Zero length attribute name: Unresolved attributes are not allowed here
 
 xlat_purify ((ok || handled) foo)
-match ERROR offset 18: Invalid operator
+match ERROR offset 17: Invalid operator
 
 # escapes in names are illegal
 xlat_purify (ok\ foo || handled)
-match ERROR offset 4: Unexpected text after return code
+match ERROR offset 3: Unexpected text after return code
 
 #
 #  0 - 111 is smaller than zero, and Service-Type is uint32.
@@ -43,13 +43,13 @@ xlat_purify (Service-Type == '000-111')
 match (Service-Type == '000-111')
 
 xlat_purify (ok FOO handled)
-match ERROR offset 5: Invalid operator
+match ERROR offset 4: Invalid operator
 
 xlat_purify (ok !x handled)
-match ERROR offset 5: Invalid operator
+match ERROR offset 4: Invalid operator
 
 xlat_purify (ok =x handled)
-match ERROR offset 5: Invalid operator
+match ERROR offset 4: Invalid operator
 
 #
 # Re-enable when we have proper bareword xlat tokenization
@@ -79,7 +79,7 @@ match ERROR offset 5: Invalid operator
 #match !ok
 
 xlat_purify !!true
-match ERROR offset 2: Double operator is invalid
+match ERROR offset 1: Double operator is invalid
 
 #xlat_purify !(!ok)
 #match ok
@@ -107,13 +107,13 @@ match (!(User-Name == User-Password) || (Filter-Id == Reply-Message))
 #  '!' is higher precedence that '==', so the '!' applies just to the User-Name
 #
 xlat_purify (!User-Name == User-Password || Filter-Id == Reply-Message)
-match ERROR offset 2: Operator '!' is only applied to the left hand side of the '==' operation, add (..) to evaluate the operation first
+match ERROR offset 1: Operator '!' is only applied to the left hand side of the '==' operation, add (..) to evaluate the operation first
 
 #
 #  LHS is a boolean, which we then compare to a string
 #
 xlat_purify (!"foo" == "bar")
-match ERROR offset 2: Operator '!' is only applied to the left hand side of the '==' operation, add (..) to evaluate the operation first
+match ERROR offset 1: Operator '!' is only applied to the left hand side of the '==' operation, add (..) to evaluate the operation first
 
 xlat_purify ((!"foo") == "bar")
 match ERROR purifying node - Invalid boolean value.  Accepted values are "yes", "no", "true", "false" or any unquoted integer
@@ -131,27 +131,27 @@ match Passed in 63 characters, but only parsed 62 characters
 #  Truthy strings get omitted.
 #
 xlat_purify ('handled' && (Packet-Type == Access-Challenge))
-match ERROR offset 31: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 30: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat_purify (handled && (Packet-Type == Access-Challenge))
-match ERROR offset 29: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 28: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 # This is OK, without the braces
 xlat_purify 'handled' && Packet-Type == Access-Challenge
-match ERROR offset 29: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 28: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 # and this, though it's not a good idea.
 xlat_purify 'handled' &&&Packet-Type == Access-Challenge
-match ERROR offset 29: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 28: Attribute 'Access' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat_purify reply == request
-match ERROR offset 1: Cannot use list references in condition
+match ERROR offset 0: Cannot use list references in condition
 
 xlat_purify reply == "hello"
-match ERROR offset 1: Cannot use list references in condition
+match ERROR offset 0: Cannot use list references in condition
 
 xlat_purify "hello" == reply
-match ERROR offset 12: Cannot use list references in condition
+match ERROR offset 11: Cannot use list references in condition
 
 
 #
@@ -164,7 +164,7 @@ xlat_purify User-Name != User-Password
 match (User-Name != User-Password)
 
 xlat_purify !User-Name != User-Password
-match ERROR offset 1: Operator '!' is only applied to the left hand side of the '!=' operation, add (..) to evaluate the operation first
+match ERROR offset 0: Operator '!' is only applied to the left hand side of the '!=' operation, add (..) to evaluate the operation first
 
 #
 #  We allow a cast for the existence check.  Why not?
@@ -177,7 +177,7 @@ xlat_purify (ipv6addr)::1
 match ::1
 
 xlat_purify (ipv6addr)"xxx"
-match ERROR offset 11: Failed to parse IPv6 address string "xxx"
+match ERROR offset 10: Failed to parse IPv6 address string "xxx"
 
 #
 #  Various casts
@@ -210,7 +210,7 @@ xlat_purify User-Name == 'bob'
 match (User-Name == 'bob')
 
 xlat_purify User-Name == bob
-match ERROR offset 14: Attribute 'bob' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 13: Attribute 'bob' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 # Integer (etc.) types must be "bare"
 xlat_purify Session-Timeout == 10
@@ -236,14 +236,14 @@ xlat_purify Event-Timestamp == 'January 1 2012'
 
 # literals are parsed when the conditions are parsed
 xlat_purify (integer)X == 1
-match ERROR offset 10: Attribute 'X' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 9: Attribute 'X' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 #
 #  @todo - parsing - resolution is delayed, so we don't know where in the input
 #  string the RHS is.
 #
 xlat_purify NAS-Port == X
-match ERROR offset 13: Attribute 'X' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 12: Attribute 'X' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 #match ERROR offset 13: Failed parsing string as type 'uint32'
 
 #
@@ -272,7 +272,7 @@ xlat_purify (ether)00:11:22:33:44:55 == "%md4('00:11:22:33:44:55')"
 match ERROR purifying node - Missing separator, expected ':'
 
 xlat_purify (ether) 00:XX:22:33:44:55 == 00:11:22:33:44:55
-match ERROR offset 9: Unknown attributes not allowed here
+match ERROR offset 8: Unknown attributes not allowed here
 
 #
 #  Tests for boolean data types.
@@ -350,13 +350,13 @@ xlat_purify (ipaddr)127.0.0.1/32 == 127.0.0.1
 match true
 
 xlat_purify (ipaddr)127.0.0.1/327 == 127.0.0.1
-match ERROR offset 13: Unknown attributes not allowed here
+match ERROR offset 12: Unknown attributes not allowed here
 
 xlat_purify (ipaddr)127.0.0.1/32 == 127.0.0.1
 match true
 
 xlat_purify (/foo/)
-match ERROR offset 2: Unexpected regular expression
+match ERROR offset 1: Unexpected regular expression
 
 #
 #  Tests for (FOO).
@@ -413,7 +413,7 @@ match User-Name
 #  Forbidden data types in cast
 #
 xlat_purify ((vsa)"foo" == User-Name)
-match ERROR offset 2: Invalid data type 'vsa' in cast
+match ERROR offset 1: Invalid data type 'vsa' in cast
 
 #
 #  If the LHS is a cast to a type, and the RHS is an attribute
@@ -452,7 +452,7 @@ match (Acct-Input-Octets64 == reply.Callback-Id)
 #  Casting attributes of different size
 #
 xlat_purify (ipaddr)Acct-Input-Octets64 == Framed-IP-Address
-match ERROR offset 9: Cannot cast type 'uint64' to 'ipaddr'
+match ERROR offset 8: Cannot cast type 'uint64' to 'ipaddr'
 
 #
 #  LHS is a prefix, which _might_ be castable to an address
@@ -521,43 +521,43 @@ match (raw.26.24757.84.9.5.7 == 0x1a99)
 
 #  This one is really unknown
 xlat_purify 26.24757.84.9.5.15 == 0x1a99
-match ERROR offset 17: Unknown attributes not allowed here
+match ERROR offset 16: Unknown attributes not allowed here
 #match Vendor-Specific.WiMAX.Packet-Flow-Descriptor-v2.Classifier.Src-Spec.15 == 0x1a99
 
 #
 #  Invalid array references.
 #
 xlat_purify User-Name[a] == 'bob'
-match ERROR offset 11: Attribute 'a' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 10: Attribute 'a' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat_purify User-Name == Filter-Id[a]
-match ERROR offset 24: Attribute 'a' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 23: Attribute 'a' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 #
 #  Bounds checks...
 #
 xlat_purify User-Name[1001] == 'bob'
-match ERROR offset 11: Invalid array index '1001' (should be between 0-1000)
+match ERROR offset 10: Invalid array index '1001' (should be between 0-1000)
 
 xlat_purify User-Name[-1] == 'bob'
-match ERROR offset 11: Invalid array index '-1'
+match ERROR offset 10: Invalid array index '-1'
 
 #
 #  attributes MUST be prefixed with '&'.
 #
 xlat_purify request.Foo == 'request.Foo'
-match ERROR offset 9: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 8: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
 
 xlat_purify request.Foo == 'request.Foo'
-match ERROR offset 9: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
+match ERROR offset 8: Attribute 'Foo' not found in namespace 'internal': Unresolved attributes are not allowed here
 #match ERROR offset 10: Attribute 'Foo' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat_purify not-a-list.User-Name == not-a-list.User-Name
-match ERROR offset 1: Attribute 'not' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 0: Attribute 'not' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 # . is a valid dictionary name attribute, so we can't error out in pass1
 xlat_purify not-a-packet.User-Name == not-a-packet.User-Name
-match ERROR offset 1: Attribute 'not' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 0: Attribute 'not' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 #
 #  The LHS is a string with ASCII 5C 30 30 30 inside of it vs the RHS which should contain ASCII 0.
@@ -718,7 +718,7 @@ xlat_purify (User-Name == "bob") && (User-Password == "bob") && handled
 match ((User-Name == "bob") && (User-Password == "bob") && %expr.rcode('handled'))
 
 xlat_purify handledx
-match ERROR offset 1: Attribute 'handledx' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
+match ERROR offset 0: Attribute 'handledx' not found.  Searched in: RADIUS, internal: Unresolved attributes are not allowed here
 
 xlat_purify handled
 match %expr.rcode('handled')
diff --git a/src/tests/unit/xlat/cond_regex.txt b/src/tests/unit/xlat/cond_regex.txt
index 97d1521ba18..0d38ef8f48b 100644
--- a/src/tests/unit/xlat/cond_regex.txt
+++ b/src/tests/unit/xlat/cond_regex.txt
@@ -7,13 +7,13 @@ xlat_purify User-Name !~ /^foo\nbar$/i
 match (User-Name !~ /^foo\nbar$/i)
 
 xlat_purify (User-Name =~ "handled")
-match ERROR offset 15: Expected regular expression
+match ERROR offset 14: Expected regular expression
 
 xlat_purify (User-Name == /foo/)
-match ERROR offset 15: Unexpected regular expression
+match ERROR offset 14: Unexpected regular expression
 
 xlat_purify User-Name =~ Filter-Id
-match ERROR offset 14: Expected regular expression
+match ERROR offset 13: Expected regular expression
 
 xlat_expr User-Name =~ (/foo/)
 match ERROR offset 14: Expected regular expression
@@ -31,13 +31,13 @@ xlat_purify User-Name =~ /bar/im
 match (User-Name =~ /bar/im)
 
 xlat_purify User-Name =~ /bar/ima
-match ERROR offset 21: Unsupported regex flag 'a'
+match ERROR offset 20: Unsupported regex flag 'a'
 
 xlat_purify User-Name =~ /bar/ii
-match ERROR offset 20: Duplicate regex flag 'i'
+match ERROR offset 19: Duplicate regex flag 'i'
 
 xlat_purify User-Name =~ /bar/iia
-match ERROR offset 20: Duplicate regex flag 'i'
+match ERROR offset 19: Duplicate regex flag 'i'
 
 #
 #  Escape the backslashes correctly
@@ -61,16 +61,16 @@ match ((string)NAS-Port =~ /%{Login-TCP-Port} foo/)
 #  to "string" before the regular expression is evaluated.
 #
 xlat_purify (integer)Filter-Id =~ /foo/
-match ERROR offset 1: Casts cannot be used with regular expressions
+match ERROR offset 0: Casts cannot be used with regular expressions
 
 xlat_purify Filter-Id =~ <integer>/foo/
-match ERROR offset 14: Expected regular expression
+match ERROR offset 13: Expected regular expression
 
 xlat_expr %{33}
 match ERROR offset 3: Invalid regex reference.  Must be in range 0-32
 
 xlat_purify User-Name == /foo/
-match ERROR offset 14: Unexpected regular expression
+match ERROR offset 13: Unexpected regular expression
 
 #
 #  single-quoted strings in regexes!