From: Alan T. DeKok <aland@freeradius.org>
Date: Sun, 3 Sep 2023 13:49:25 +0000 (-0400)
Subject: there's overlap between ::1 and ::Framed-User
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a04f0ee531c916490f5eb22b7b4e54ab682aa6e1;p=thirdparty%2Ffreeradius-server.git

there's overlap between ::1 and ::Framed-User

We'll have to think about that a bit more, but "::" is still
fairly reasonable
---

diff --git a/src/lib/server/tmpl_tokenize.c b/src/lib/server/tmpl_tokenize.c
index b75726cda85..b17a0a79ab6 100644
--- a/src/lib/server/tmpl_tokenize.c
+++ b/src/lib/server/tmpl_tokenize.c
@@ -2878,20 +2878,6 @@ fr_slen_t tmpl_afrom_substr(TALLOC_CTX *ctx, tmpl_t **out,
 		if (fr_sbuff_is_char(&our_in, '&')) return tmpl_afrom_attr_substr(ctx, NULL, out, in,
 										  p_rules, t_rules);
 
-		/*
-		 *	::value
-		 *
-		 *	Treated as enum name.
-		 *
-		 *	@todo - move the enum parsing here, and then unresolved tmpls _always_ become xlat references.
-		 *	and when we fix that, change the enum name to include the ::
-		 */
-		if (fr_sbuff_is_str_literal(&our_in, "::")) {
-			(void) fr_sbuff_advance(&our_in, 2);
-			goto do_enum;
-		}
-
-
 		/*
 		 *	Allow bareword xlats if we
 		 *	find a '%' prefix.
@@ -2973,6 +2959,20 @@ fr_slen_t tmpl_afrom_substr(TALLOC_CTX *ctx, tmpl_t **out,
 		if (slen > 0) goto done_bareword;
 		fr_assert(!*out);
 
+		/*
+		 *	::value
+		 *
+		 *	Treated as enum name.  Note that this check MUST be done after the test for IPv6, as
+		 *	"::1" is an allowed IPv6 address.
+		 *
+		 *	@todo - move the enum parsing here, and then unresolved tmpls _always_ become xlat references.
+		 *	and when we fix that, change the enum name to include the ::
+		 */
+		if (fr_sbuff_is_str_literal(&our_in, "::")) {
+			(void) fr_sbuff_advance(&our_in, 2);
+			goto do_enum;
+		}
+
 		/*
 		 *	See if it's a integer
 		 */