Commit b345d4311a for strongswan.org
commit b345d4311a42388a7e36d92d21bf773ca27f650e
Author: Tobias Brunner <tobias@strongswan.org>
Date: Mon Jun 8 09:18:59 2026 +0200
message: Limit number of unknown payloads per message
diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c
index a4bf9cb26b..3037788bc5 100644
--- a/src/libcharon/encoding/message.c
+++ b/src/libcharon/encoding/message.c
@@ -68,6 +68,11 @@
*/
#define MAX_NAT_D_PAYLOADS 10
+/**
+ * Max number of unknown payloads per message
+ */
+#define MAX_UNKNOWN_PAYLOADS 5
+
/**
* A payload rule defines the rules for a payload
* in a specific message rule. It defines if and how
@@ -129,6 +134,7 @@ static payload_rule_t ike_sa_init_i_rules[] = {
{PLV2_KEY_EXCHANGE, 1, 1, FALSE, FALSE},
{PLV2_NONCE, 1, 1, FALSE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
};
/**
@@ -157,6 +163,7 @@ static payload_rule_t ike_sa_init_r_rules[] = {
{PLV2_NONCE, 1, 1, FALSE, FALSE},
{PLV2_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
};
/**
@@ -199,6 +206,7 @@ static payload_rule_t ike_auth_i_rules[] = {
#endif /* ME */
{PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -247,6 +255,7 @@ static payload_rule_t ike_auth_r_rules[] = {
{PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
{PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -286,6 +295,7 @@ static payload_rule_t informational_i_rules[] = {
{PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
{PLV2_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -313,6 +323,7 @@ static payload_rule_t informational_r_rules[] = {
{PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
{PLV2_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -344,6 +355,7 @@ static payload_rule_t create_child_sa_i_rules[] = {
{PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
{PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -379,6 +391,7 @@ static payload_rule_t create_child_sa_r_rules[] = {
{PLV2_TS_RESPONDER, 0, 1, TRUE, FALSE},
{PLV2_CONFIGURATION, 0, 1, TRUE, FALSE},
{PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -408,6 +421,7 @@ static payload_rule_t ike_intermediate_i_rules[] = {
{PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
{PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{PLV2_KEY_EXCHANGE, 0, 1, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -428,6 +442,7 @@ static payload_rule_t ike_intermediate_r_rules[] = {
{PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
{PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
{PLV2_KEY_EXCHANGE, 0, 1, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -448,6 +463,7 @@ static payload_rule_t ike_followup_ke_i_rules[] = {
{PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
{PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{PLV2_KEY_EXCHANGE, 1, 1, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -468,6 +484,7 @@ static payload_rule_t ike_followup_ke_r_rules[] = {
{PLV2_FRAGMENT, 0, 1, TRUE, TRUE},
{PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
{PLV2_KEY_EXCHANGE, 1, 1, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -488,7 +505,8 @@ static payload_rule_t me_connect_i_rules[] = {
/* payload type min max encr suff */
{PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
{PLV2_ID_PEER, 1, 1, TRUE, FALSE},
- {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE}
+ {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -507,7 +525,8 @@ static payload_order_t me_connect_i_order[] = {
static payload_rule_t me_connect_r_rules[] = {
/* payload type min max encr suff */
{PLV2_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, TRUE},
- {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE}
+ {PLV2_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
};
/**
@@ -534,6 +553,7 @@ static payload_rule_t id_prot_i_rules[] = {
{PLV1_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
{PLV1_NAT_D, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{PLV1_NAT_D_DRAFT_00_03, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
{PLV1_ID, 0, 1, TRUE, FALSE},
{PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
{PLV1_SIGNATURE, 0, 1, TRUE, FALSE},
@@ -574,6 +594,7 @@ static payload_rule_t id_prot_r_rules[] = {
{PLV1_CERTREQ, 0, MAX_CERTREQ_PAYLOADS, FALSE, FALSE},
{PLV1_NAT_D, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{PLV1_NAT_D_DRAFT_00_03, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
{PLV1_ID, 0, 1, TRUE, FALSE},
{PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
{PLV1_SIGNATURE, 0, 1, TRUE, FALSE},
@@ -615,6 +636,7 @@ static payload_rule_t aggressive_i_rules[] = {
{PLV1_NAT_D, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{PLV1_NAT_D_DRAFT_00_03, 0, MAX_NAT_D_PAYLOADS, FALSE, FALSE},
{PLV1_ID, 0, 1, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
{PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, TRUE, FALSE},
{PLV1_SIGNATURE, 0, 1, TRUE, FALSE},
{PLV1_HASH, 0, 1, TRUE, FALSE},
@@ -658,6 +680,7 @@ static payload_rule_t aggressive_r_rules[] = {
{PLV1_CERTIFICATE, 0, MAX_CERT_PAYLOADS, FALSE, FALSE},
{PLV1_SIGNATURE, 0, 1, FALSE, FALSE},
{PLV1_HASH, 0, 1, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
{PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
};
@@ -687,6 +710,7 @@ static payload_order_t aggressive_r_order[] = {
static payload_rule_t informational_i_rules_v1[] = {
/* payload type min max encr suff */
{PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
{PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{PLV1_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
{PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
@@ -708,6 +732,7 @@ static payload_order_t informational_i_order_v1[] = {
static payload_rule_t informational_r_rules_v1[] = {
/* payload type min max encr suff */
{PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
{PLV1_NOTIFY, 0, MAX_NOTIFY_PAYLOADS, TRUE, FALSE},
{PLV1_DELETE, 0, MAX_DELETE_PAYLOADS, TRUE, FALSE},
{PLV1_VENDOR_ID, 0, MAX_VID_PAYLOADS, TRUE, FALSE},
@@ -737,6 +762,7 @@ static payload_rule_t quick_mode_i_rules[] = {
{PLV1_ID, 0, 2, TRUE, FALSE},
{PLV1_NAT_OA, 0, 2, TRUE, FALSE},
{PLV1_NAT_OA_DRAFT_00_03, 0, 2, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
{PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
};
@@ -771,6 +797,7 @@ static payload_rule_t quick_mode_r_rules[] = {
{PLV1_ID, 0, 2, TRUE, FALSE},
{PLV1_NAT_OA, 0, 2, TRUE, FALSE},
{PLV1_NAT_OA_DRAFT_00_03, 0, 2, TRUE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, TRUE, FALSE},
{PLV1_FRAGMENT, 0, 1, FALSE, TRUE},
};
@@ -796,8 +823,9 @@ static payload_order_t quick_mode_r_order[] = {
*/
static payload_rule_t transaction_payload_rules_v1[] = {
/* payload type min max encr suff */
- {PLV1_HASH, 0, 1, TRUE, FALSE},
- {PLV1_CONFIGURATION, 1, 1, FALSE, FALSE},
+ {PLV1_HASH, 0, 1, TRUE, FALSE},
+ {PLV1_CONFIGURATION, 1, 1, FALSE, FALSE},
+ {PL_UNKNOWN, 0, MAX_UNKNOWN_PAYLOADS, FALSE, FALSE},
};
/**