denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

message: Drop fragments with total fragment count lower than before

Browse Source 
The RFC only allows that the number of fragments increases (if the
sender reduces the MTU).

Not enforcing this before could cause early reassembly as the trigger was
that the number of received fragments matches the total count of the
current packet (which was a bit weird anyway).  Only an active MITM could
trigger this as individual fragments are encrypted and authenticated.
This commit is contained in:
Tobias Brunner
2026-04-02 08:17:04 +02:00
parent 06e5462a4b
commit 1e1dd2976d
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/encoding/message.c
+6 -2
View File
@@ -3054,6 +3054,10 @@ METHOD(message_t, add_fragment_v2, status_t,
this->frag->last = total;
this->fragments = array_create(0, total);
}
else if (total < this->frag->last)
{ /* drop these silently as mandated by RFC 7383, section 2.6 */
return INVALID_ARG;
}
num = encrypted_fragment->get_fragment_number(encrypted_fragment);
data = encrypted_fragment->get_content(encrypted_fragment);
status = add_fragment(this, num, data);
@@ -3080,11 +3084,11 @@ METHOD(message_t, add_fragment_v2, status_t,
enumerator->destroy(enumerator);
}
if (array_count(this->fragments) != total)
if (array_count(this->fragments) != this->frag->last)
{
/* there are some fragments missing */
DBG1(DBG_ENC, "received fragment #%hu of %hu, waiting for complete IKE "
"message", num, total);
"message", num, this->frag->last);
return NEED_MORE;
}