Stefan Winter <stefan.winter@restena.lu> writes:
RFC 2865 says
"Note that none of the types in RADIUS terminate with a NUL (hex 00). In particular, types "text" and "string" in RADIUS do not terminate with a NUL (hex 00). The Attribute has a length field and does not use a terminator. Text contains UTF-8 encoded 10646 [7] characters and String contains 8-bit binary data. Servers and servers and clients MUST be able to deal with embedded nulls. RADIUS implementers using C are cautioned not to use strcpy() when handling strings."
There is nothing here that forbids an attribute containing nothing but a NUL, or ending in NUL. The point is that the NUL in that case must be a *significant part* of the attribute value. RADIUS clients and servers MUST *handle* the NULs, not silently ignore them like string terminators.
Reading is a tough task, obviously. They are required NOT to end with a NUL.
Obviously. Where in the quoted text from the RFC do you find the word "end"?
That is: "blah\000" and "blah" have different value and length, but they are both allowed as attribute values.
blah\000 is an attribute that has a hex 00 as last character, while the RFC says "In particular, types "text" and "string" in RADIUS do not terminate with a NUL (hex 00)."
"terminate with" != "end with" The RFC talks about NULs used as terminators. A terminator is a character that is not part of the string, but is used merely to signify the end of data. Bjørn