Notes on embedded zeros in passwords

diff --git a/raddb/policy.d/filter b/raddb/policy.d/filter
index 31b12b5feb4ca63252e9ce117545383471015c20..7acf12f265cac8695715289d594d5b231a131937 100644 (file)
--- a/raddb/policy.d/filter
+++ b/raddb/policy.d/filter
@@ -93,3 +93,19 @@ filter_username {
                reject
        }
 }
+
+#
+#      Filter the User-Password
+#
+#  Some equipment sends passwords with embedded zeros.
+#  This poliocy filters them out.
+#
+filter_password {
+       if (&User-Password &&
+          (&User-Password != "%{string:User-Password}")) {
+               update request {
+                       &Tmp-String-0 := "%{string:User-Password}"
+                       &User-Password := "%{string:Tmp-String-0}"
+               }
+        }
+}

diff --git a/raddb/sites-available/default b/raddb/sites-available/default
index e16363f12d3b8ba38a4c056dd09ffa9c2d5e7de1..84b34dcd3bf5ffacfc92bfcd97783c1bd2e98ca2 100644 (file)
--- a/raddb/sites-available/default
+++ b/raddb/sites-available/default
@@ -261,6 +261,16 @@ authorize {
        #
        filter_username
 
+       #
+       #  Some broken equipment sends passwords with embedded zeros.
+       #  i.e. the debug output will show
+       #
+       #       User-Password = "password\000\000"
+       #
+       #  This policy will fix it to just be "password".
+       #
+#      filter_password
+
        #
        #  The preprocess module takes care of sanitizing some bizarre
        #  attributes in the request, and turning them into attributes

diff --git a/src/main/xlat.c b/src/main/xlat.c
index 87c206fe40963081c7b54050efdf939e39d48af8..31410b06b2aaba1f64953afd30509cfe43522fdf 100644 (file)
--- a/src/main/xlat.c
+++ b/src/main/xlat.c
@@ -623,6 +623,10 @@ static ssize_t xlat_string(UNUSED void *instance, REQUEST *request,
                len = fr_prints(out, outlen, (char const *) p, vp->vp_length, '"');
                break;
 
+               /*
+                *      Note that "%{string:...}" is NOT binary safe!
+                *      It is explicitly used to get rid of embedded zeros.
+                */
        case PW_TYPE_STRING:
                len = strlcpy(out, vp->vp_strvalue, outlen);
                break;