Hi! Today I noticed some strange problems on a number of RADIUS users in a test setup: I have a number of users in MySQL that contain a large number of attributes that should not occur in the Access-Request (i.e. attributes with the !* operator). When I tried to authenticate these users, I noticed that in some cases users were getting authenticated while they should have been rejected. Some investigation later, it turned out that after the first row in the radcheck table that contains a !* operator, all further attributes get ignored... I crawled through the code a bit more, and the problem appears to occur on line 287 of main/valuepair.c. This is in the function paircmp, which iterates over the list of check items to verify whether the incoming request matches: /* * Not found, it's not a match. */ if (auth_item == NULL) { /* * Didn't find it. If we were *trying* * to not find it, then we succeeded. */ if (check_item->operator == T_OP_CMP_FALSE) return 0; else return -1; } The 'return 0;' above causes paircmp to exit successfully (accepting the user) if it could not find the attribute and it should not find the attribute (because of the !* operator) instead of continuing to see if the rest of the attributes is correct too. I've changed the 'return 0;' to a 'continue;', so it does not break the for loop anymore. This appears to work, is this fix correct or would this introduce problems elsewhere? Gtnx Marcel