There was a discussion previously about merging the different versions of paircompare logic, and I'd just like to mention a related issue. I was expecting that the following rlm_sql authorize_check_query response would work if the attribute was not present: 'Calling-Station-Id', '=~', '^$|^0845' However it doesn't. It looks like there are two sets of logic which might be used: src/lib/valuepair.c: paircmp() expands the argument using vp_prints_value. If it's missing then it expands to empty string. In that case, I think the match would succeed. src/main/valuepair.c: paircompare() fails immediately if the argument is non-existent, except when using the !* operator (T_OP_CMP_FALSE). I haven't yet worked out exactly in which circumstances paircmp() is used and in which circumstances paircompare() is used :-( Another usage case: 'Reply-Message', '!=', 'SPECIALOPTION' (i.e. I would like this to match if either Reply-Message is not present, or if its value is not SPECIALOPTION) It's a matter of discussion as to which is the desired behaviour, and is maybe something that could be considered for freeradius 3.x Regards, Brian.