From 1e1dd2976dd996a7a86cdd5ebe38ec444ba81a86 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 23 Mar 2026 18:58:18 +0100 Subject: [PATCH] message: Drop fragments with total fragment count lower than before The RFC only allows that the number of fragments increases (if the sender reduces the MTU). Not enforcing this before could cause early reassembly as the trigger was that the number of received fragments matches the total count of the current packet (which was a bit weird anyway). Only an active MITM could trigger this as individual fragments are encrypted and authenticated. --- src/libcharon/encoding/message.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/libcharon/encoding/message.c b/src/libcharon/encoding/message.c index 634cba98f..8da9a1d71 100644 --- a/src/libcharon/encoding/message.c +++ b/src/libcharon/encoding/message.c @@ -3054,6 +3054,10 @@ METHOD(message_t, add_fragment_v2, status_t, this->frag->last = total; this->fragments = array_create(0, total); } + else if (total < this->frag->last) + { /* drop these silently as mandated by RFC 7383, section 2.6 */ + return INVALID_ARG; + } num = encrypted_fragment->get_fragment_number(encrypted_fragment); data = encrypted_fragment->get_content(encrypted_fragment); status = add_fragment(this, num, data); @@ -3080,11 +3084,11 @@ METHOD(message_t, add_fragment_v2, status_t, enumerator->destroy(enumerator); } - if (array_count(this->fragments) != total) + if (array_count(this->fragments) != this->frag->last) { /* there are some fragments missing */ DBG1(DBG_ENC, "received fragment #%hu of %hu, waiting for complete IKE " - "message", num, total); + "message", num, this->frag->last); return NEED_MORE; }