Hi, I have a use case of EAP for which I have to verify that the outer identify has a realm. Before writing this verification under a new policy module, I just tried to use those existing by defaut under policy.d/filter. I don't know if it is really a mistake but the filter "deny_realms" seems to be wrong. I just try to call the filter "deny_realms" under the section authorize {} of the site default. I tried with freeradius 3.0.4 and 3.0.13, both packages on centOS 7.3 and 7.4. In both case, radiusd do not start because of syntax error in regex : - error on freeradius 3.0.4 /etc/raddb/policy.d/filter[6]: Invalid regular expression @|\: bad escape sequence at offset 3 - error on freeradius 3.0.13 /etc/raddb/policy.d/filter[6]: Invalid regular expression: /etc/raddb/policy.d/filter[6]: @|\ /etc/raddb/policy.d/filter[6]: ^ Pattern compilation failed: \ at end of pattern The line number 6 is this test : if (&User-Name && (&User-Name =~ /@|\\/)) { If I replace it with this test, radiusd starts correctly : if (&User-Name && (&User-Name =~ /@|\\{1}/)) { Then, after this first step, I have a second issue with the filter "filter_username". I would be interested to use it inside the inner tunnel to sanitize the inner identity. One of this tests is always true and I don't understand the reason why : if (&User-Name =~ /\.\./ ) { update request { &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' } reject } Whatever the identity I'm using, the test on double dot caracter is verified. I tried to call the filter "filter_username" under the section authorize {} of the site default or inner-tunnel. In both cas, It seems to have issue (below log from site default). Ready to process requests (0) Received Access-Request Id 0 from 10.10.10.12:36315 to 10.10.11.11:1812 length 146 (0) User-Name = "anonymous@mydomain.fr" (0) NAS-IP-Address = 127.0.0.1 (0) Calling-Station-Id = "xx-xx-xx-xx-xx-xx" (0) Framed-MTU = 1400 (0) NAS-Port-Type = Wireless-802.11 (0) Connect-Info = "Test client - app" (0) EAP-Message = 0x0200001701616e6f6e796d6f757340696e7269612e6672 (0) Message-Authenticator = 0x02df880a5342968b4e6455cc5e5d9841 (0) # Executing section authorize from file /etc/raddb/sites-enabled/default (0) authorize { (0) policy filter_username { (0) if (&User-Name) { (0) if (&User-Name) -> TRUE (0) if (&User-Name) { (0) if (&User-Name =~ / /) { (0) if (&User-Name =~ / /) -> FALSE (0) if (&User-Name =~ /@[^@]*@/ ) { (0) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (0) if (&User-Name =~ /\.\./ ) { (0) if (&User-Name =~ /\.\./ ) -> TRUE (0) if (&User-Name =~ /\.\./ ) { (0) update request { (0) &Module-Failure-Message += 'Rejected: User-Name contains multiple ..s' (0) } # update request = noop (0) [reject] = reject (0) } # if (&User-Name =~ /\.\./ ) = reject (0) } # if (&User-Name) = reject (0) } # policy filter_username = reject (0) } # authorize = reject (0) Invalid user (Rejected: User-Name contains multiple ..s): [anonymous@mydomain.fr] (from client app port 0 cli xx-xx-xx-xx-xx-xx) (0) Using Post-Auth-Type Reject Later, I will try to use also the filter "filter_inner_identity". Thanks you for this ! Have a nice day Regards, -- Jérôme BERTHIER