OpenVPN Radius Authentication Broke on upgrade to 26.03.01

powerguy42

I use OpenVPN with Radius Authentication. This has worked fine up until I upgraded to 26.03.01 a couple of days ago. I get the below crash in pfsense when i try to authenticate via radius.. Diag -> Authentication still works fine, it authorizes the user via radius. I made no changes to the radius server. I can use local authentication with openvpn also just fine, it's only radius + openvpn that gives this error. The OpenVPN Client is saying AUTH_FAILED but i believe that's because of this error.

PHP ERROR: Type: 1, File: /etc/inc/util.inc, Line: 2768, Message: Uncaught ArgumentCountError: 3 arguments are required, 2 given in /etc/inc/util.inc:2768
Stack trace:
#0 /etc/inc/util.inc(2768): sprintf()
#1 /etc/inc/util.inc(5058): localize_text()
#2 /etc/inc/util.inc(5277): cisco_extract_index()
#3 /etc/inc/openvpn.attributes.php(30): parse_cisco_acl()
#4 /etc/inc/openvpn.auth-user.php(121): include_once('/etc/inc/openvp...')
#5 {main}
thrown @ 2026-07-06 13:14:03

powerguy42

Pretty sure this is just the log message failing.

/etc/inc/util.inc 26.03.01 Code

function cisco_extract_index($prule) {
	$index = explode("#", $prule);
	if (is_numeric($index[1])) {
		return intval($index[1]);
	} else {
		logger(LOG_WARNING, localize_text("Error parsing RADIUS attribute - rule %s %s: Could not extract index", $prule));
	}
	return -1;;
}

In my older version before localize_text was introduced i was getting an error but Openvpn would continue on as the Cisco radius attributes are not needed for openvpn authentication.

Error parsing rule shell:priv-lvl: Could not extract index

/etc/inc/util.inc 25.11 Code

function cisco_extract_index($prule) {
	$index = explode("#", $prule);
	if (is_numeric($index[1])) {
		return intval($index[1]);
	} else {
		syslog(LOG_WARNING, "Error parsing rule {$prule}: Could not extract index");
	}
	return -1;;
}

However in 26.03.01 it's crashing at the log message due to too many placeholders, $prule for me is just a string "shell:priv-lvl"