As part of applying Joe Maimon's patches, I realized just how bad & repetitive some of the code is. So... 1) I've renamed paircmp() to paircompare() 2) added a paircmp(a,b) which does (a->strvalue a->operator b->stvalue) e.g. "foo == bar". 3) Started removing references to "simplepaircmp" Most of which are in rlm_attr_filter. Looking at rlm_attr_filter, it seems there's a lot of repetitive code in it. I've made it use the new paircmp(), and generalized the code a bit. It seems to work in my tests, but I've put a new version on my web page: http://www.striker.ottawa.on.ca/~aland/rlm_attr_filter.c If someone can test it for proxying, and see if it does the same thing as the previous version, I'd be grateful. If it works, I'll check it in, and continue on the code cleanups. As a side-effect of editing rlm_attr_filter, you can now filter in authorization & post-auth, too. Alan DeKok.