Garbled class attribute?

[Geoff Silver]

Stefan Winter wrote:
>>>   It works for me, so my guess is that something else in your
>>> configuration is setting Class to that value.
>> Okay, I'll bite - so what on earth might be causing that?  I'm not doing
>> any rewriting, and both the Filter-Id and the Split-Tunnel-List attributes
>> come back as strings.  I thought maybe it was getting confused on the Class
>> since it contains an =, but changing that to an _ doesn't help.  Is this
>> perhaps coming back from the proxy server, and if so, is there a way to use
>> my local Class attribute instead?
> 
> Well, you can use := instead of = , this overwrites any Class attribute that a 
> proxy may have sent. See if that helps.
> 
> Stefan
> 

Setting Proxy-to-Realm=UAS doesn't seem to work... not sure why. 
Nevertheless, configuring attr_filter to only use attributes I care about from 
the proxy seems to work just fine.

As a side note, I had to change the Class attribute in dictionary.rfc2865 to 
be a string, *not* octets.  I changed:

ATTRIBUTE       Class                                   25      octets

to

ATTRIBUTE       Class                                   25      string

to make it work (and be readable), though I can't tell if that's just an 
oddity of the Cisco VPN 3000 and the way it was previously implemented here or 
what.  According to the RFC:

5.25. Class

    Description

       This Attribute is available to be sent by the server to the client
       in an Access-Accept and SHOULD be sent unmodified by the client to
       the accounting server as part of the Accounting-Request packet if
       accounting is supported.  The client MUST NOT interpret the
       attribute locally.

    A summary of the Class Attribute format is shown below.  The fields
    are transmitted from left to right.

     0                   1                   2
     0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
    |     Type      |    Length     |  String ...
    +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-

    Type

       25 for Class.

    Length

       >= 3

    String

       The String field is one or more octets.  The actual format of the
       information is site or application specific, and a robust
       implementation SHOULD support the field as undistinguished octets.

       The codification of the range of allowed usage of this field is
       outside the scope of this specification