Commit b345d4311a for strongswan.org

commit b345d4311a42388a7e36d92d21bf773ca27f650e
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Mon Jun 8 09:18:59 2026 +0200

    message: Limit number of unknown payloads per message

diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c
index a4bf9cb26b..3037788bc5 100644
--- a/src/libcharon/encoding/message.c
+++ b/src/libcharon/encoding/message.c
@@ -68,6 +68,11 @@
  */
 #define MAX_NAT_D_PAYLOADS 10

+/**
+ * Max number of unknown payloads per message
+ */
+#define MAX_UNKNOWN_PAYLOADS 5
+
 /**
  * A payload rule defines the rules for a payload
  * in a specific message rule. It defines if and how
@@ -129,6 +134,7 @@ static payload_rule_t ike_sa_init_i_rules[] = {
 	{PLV2_KEY_EXCHANGE,				1,	1,						FALSE,	FALSE},
 	{PLV2_NONCE,					1,	1,						FALSE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 };

 /**
@@ -157,6 +163,7 @@ static payload_rule_t ike_sa_init_r_rules[] = {
 	{PLV2_NONCE,					1,	1,						FALSE,	FALSE},
 	{PLV2_CERTREQ,					0,	MAX_CERTREQ_PAYLOADS,	FALSE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 };

 /**
@@ -199,6 +206,7 @@ static payload_rule_t ike_auth_i_rules[] = {
 #endif /* ME */
 	{PLV2_CONFIGURATION,			0,	1,						TRUE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -247,6 +255,7 @@ static payload_rule_t ike_auth_r_rules[] = {
 	{PLV2_TS_RESPONDER,				0,	1,						TRUE,	FALSE},
 	{PLV2_CONFIGURATION,			0,	1,						TRUE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -286,6 +295,7 @@ static payload_rule_t informational_i_rules[] = {
 	{PLV2_CONFIGURATION,			0,	1,						TRUE,	FALSE},
 	{PLV2_DELETE,					0,	MAX_DELETE_PAYLOADS,	TRUE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -313,6 +323,7 @@ static payload_rule_t informational_r_rules[] = {
 	{PLV2_CONFIGURATION,			0,	1,						TRUE,	FALSE},
 	{PLV2_DELETE,					0,	MAX_DELETE_PAYLOADS,	TRUE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -344,6 +355,7 @@ static payload_rule_t create_child_sa_i_rules[] = {
 	{PLV2_TS_RESPONDER,				0,	1,						TRUE,	FALSE},
 	{PLV2_CONFIGURATION,			0,	1,						TRUE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -379,6 +391,7 @@ static payload_rule_t create_child_sa_r_rules[] = {
 	{PLV2_TS_RESPONDER,				0,	1,						TRUE,	FALSE},
 	{PLV2_CONFIGURATION,			0,	1,						TRUE,	FALSE},
 	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -408,6 +421,7 @@ static payload_rule_t ike_intermediate_i_rules[] = {
 	{PLV2_FRAGMENT,					0,	1,						TRUE,	TRUE},
 	{PLV2_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{PLV2_KEY_EXCHANGE,				0,	1,						TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -428,6 +442,7 @@ static payload_rule_t ike_intermediate_r_rules[] = {
 	{PLV2_FRAGMENT,					0,	1,						TRUE,	TRUE},
 	{PLV2_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{PLV2_KEY_EXCHANGE,				0,	1,						TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -448,6 +463,7 @@ static payload_rule_t ike_followup_ke_i_rules[] = {
 	{PLV2_FRAGMENT,					0,	1,						TRUE,	TRUE},
 	{PLV2_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{PLV2_KEY_EXCHANGE,				1,	1,						TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -468,6 +484,7 @@ static payload_rule_t ike_followup_ke_r_rules[] = {
 	{PLV2_FRAGMENT,					0,	1,						TRUE,	TRUE},
 	{PLV2_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{PLV2_KEY_EXCHANGE,				1,	1,						TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -488,7 +505,8 @@ static payload_rule_t me_connect_i_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{PLV2_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
 	{PLV2_ID_PEER,					1,	1,						TRUE,	FALSE},
-	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE}
+	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -507,7 +525,8 @@ static payload_order_t me_connect_i_order[] = {
 static payload_rule_t me_connect_r_rules[] = {
 /*	payload type					min	max						encr	suff */
 	{PLV2_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	TRUE},
-	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE}
+	{PLV2_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 };

 /**
@@ -534,6 +553,7 @@ static payload_rule_t id_prot_i_rules[] = {
 	{PLV1_CERTREQ,					0,	MAX_CERTREQ_PAYLOADS,	FALSE,	FALSE},
 	{PLV1_NAT_D,					0,	MAX_NAT_D_PAYLOADS,		FALSE,	FALSE},
 	{PLV1_NAT_D_DRAFT_00_03,		0,	MAX_NAT_D_PAYLOADS,		FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 	{PLV1_ID,						0,	1,						TRUE,	FALSE},
 	{PLV1_CERTIFICATE,				0,	MAX_CERT_PAYLOADS,		TRUE,	FALSE},
 	{PLV1_SIGNATURE,				0,	1,						TRUE,	FALSE},
@@ -574,6 +594,7 @@ static payload_rule_t id_prot_r_rules[] = {
 	{PLV1_CERTREQ,					0,	MAX_CERTREQ_PAYLOADS,	FALSE,	FALSE},
 	{PLV1_NAT_D,					0,	MAX_NAT_D_PAYLOADS,		FALSE,	FALSE},
 	{PLV1_NAT_D_DRAFT_00_03,		0,	MAX_NAT_D_PAYLOADS,		FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 	{PLV1_ID,						0,	1,						TRUE,	FALSE},
 	{PLV1_CERTIFICATE,				0,	MAX_CERT_PAYLOADS,		TRUE,	FALSE},
 	{PLV1_SIGNATURE,				0,	1,						TRUE,	FALSE},
@@ -615,6 +636,7 @@ static payload_rule_t aggressive_i_rules[] = {
 	{PLV1_NAT_D,					0,	MAX_NAT_D_PAYLOADS,		FALSE,	FALSE},
 	{PLV1_NAT_D_DRAFT_00_03,		0,	MAX_NAT_D_PAYLOADS,		FALSE,	FALSE},
 	{PLV1_ID,						0,	1,						FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 	{PLV1_CERTIFICATE,				0,	MAX_CERT_PAYLOADS,		TRUE,	FALSE},
 	{PLV1_SIGNATURE,				0,	1,						TRUE,	FALSE},
 	{PLV1_HASH,						0,	1,						TRUE,	FALSE},
@@ -658,6 +680,7 @@ static payload_rule_t aggressive_r_rules[] = {
 	{PLV1_CERTIFICATE,				0,	MAX_CERT_PAYLOADS,		FALSE,	FALSE},
 	{PLV1_SIGNATURE,				0,	1,						FALSE,	FALSE},
 	{PLV1_HASH,						0,	1,						FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 	{PLV1_FRAGMENT,					0,	1,						FALSE,	TRUE},
 };

@@ -687,6 +710,7 @@ static payload_order_t aggressive_r_order[] = {
 static payload_rule_t informational_i_rules_v1[] = {
 /*	payload type					min	max						encr	suff */
 	{PLV1_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 	{PLV1_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{PLV1_DELETE,					0,	MAX_DELETE_PAYLOADS,	TRUE,	FALSE},
 	{PLV1_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
@@ -708,6 +732,7 @@ static payload_order_t informational_i_order_v1[] = {
 static payload_rule_t informational_r_rules_v1[] = {
 /*	payload type					min	max						encr	suff */
 	{PLV1_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 	{PLV1_NOTIFY,					0,	MAX_NOTIFY_PAYLOADS,	TRUE,	FALSE},
 	{PLV1_DELETE,					0,	MAX_DELETE_PAYLOADS,	TRUE,	FALSE},
 	{PLV1_VENDOR_ID,				0,	MAX_VID_PAYLOADS,		TRUE,	FALSE},
@@ -737,6 +762,7 @@ static payload_rule_t quick_mode_i_rules[] = {
 	{PLV1_ID,						0,	2,						TRUE,	FALSE},
 	{PLV1_NAT_OA,					0,	2,						TRUE,	FALSE},
 	{PLV1_NAT_OA_DRAFT_00_03,		0,	2,						TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 	{PLV1_FRAGMENT,					0,	1,						FALSE,	TRUE},
 };

@@ -771,6 +797,7 @@ static payload_rule_t quick_mode_r_rules[] = {
 	{PLV1_ID,						0,	2,						TRUE,	FALSE},
 	{PLV1_NAT_OA,					0,	2,						TRUE,	FALSE},
 	{PLV1_NAT_OA_DRAFT_00_03,		0,	2,						TRUE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   TRUE,   FALSE},
 	{PLV1_FRAGMENT,					0,	1,						FALSE,	TRUE},
 };

@@ -796,8 +823,9 @@ static payload_order_t quick_mode_r_order[] = {
  */
 static payload_rule_t transaction_payload_rules_v1[] = {
 /*	payload type					min	max	encr	suff */
-	{PLV1_HASH,						0,	1,	TRUE,	FALSE},
-	{PLV1_CONFIGURATION,			1,	1,	FALSE,	FALSE},
+	{PLV1_HASH,						0,	1,						TRUE,	FALSE},
+	{PLV1_CONFIGURATION,			1,	1,						FALSE,	FALSE},
+	{PL_UNKNOWN,					0,  MAX_UNKNOWN_PAYLOADS,   FALSE,  FALSE},
 };

 /**