1*973a6851Sbluhm#!/usr/local/bin/python3 2*973a6851Sbluhm 3*973a6851Sbluhmprint("ping fragment that overlaps the first fragment at index boundary") 4*973a6851Sbluhm 5*973a6851Sbluhm# index boundary 4096 | 6*973a6851Sbluhm# |--------------| 7*973a6851Sbluhm# .... 8*973a6851Sbluhm# |--------------| 9*973a6851Sbluhm# |XXXX-----| 10*973a6851Sbluhm# |--------------| 11*973a6851Sbluhm 12*973a6851Sbluhm# this should trigger "frag index %d, new %d" log in kernel 13*973a6851Sbluhm 14*973a6851Sbluhmimport os 15*973a6851Sbluhmfrom addr import * 16*973a6851Sbluhmfrom scapy.all import * 17*973a6851Sbluhm 18*973a6851Sbluhmpid=os.getpid() 19*973a6851Sbluhmeid=pid & 0xffff 20*973a6851Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 21*973a6851Sbluhmdummy=b"01234567" 22*973a6851Sbluhmfragsize=64 23*973a6851Sbluhmboundary=4096 24*973a6851Sbluhmfragnum=int(boundary/fragsize) 25*973a6851Sbluhmpacket=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \ 26*973a6851Sbluhm ICMP(type='echo-request', id=eid)/ \ 27*973a6851Sbluhm (int((boundary+8)/len(payload)) * payload) 28*973a6851Sbluhmfrag=[] 29*973a6851Sbluhmfid=pid & 0xffff 30*973a6851Sbluhmfor i in range(fragnum-1): 31*973a6851Sbluhm frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 32*973a6851Sbluhm frag=(i*fragsize)>>3, flags='MF')/ 33*973a6851Sbluhm bytes(packet)[20+i*fragsize:20+(i+1)*fragsize]) 34*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 35*973a6851Sbluhm frag=(boundary-8)>>3)/ 36*973a6851Sbluhm (dummy+bytes(packet)[20+boundary:20+boundary+8])) 37*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 38*973a6851Sbluhm frag=(boundary-fragsize)>>3, flags='MF')/ 39*973a6851Sbluhm bytes(packet)[20+boundary-fragsize:20+boundary]) 40*973a6851Sbluhmeth=[] 41*973a6851Sbluhmfor f in frag: 42*973a6851Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f) 43*973a6851Sbluhm 44*973a6851Sbluhmif os.fork() == 0: 45*973a6851Sbluhm time.sleep(1) 46*973a6851Sbluhm for e in eth: 47*973a6851Sbluhm sendp(e, iface=LOCAL_IF) 48*973a6851Sbluhm time.sleep(0.001) 49*973a6851Sbluhm os._exit(0) 50*973a6851Sbluhm 51*973a6851Sbluhmans=sniff(iface=LOCAL_IF, timeout=5, filter= 52*973a6851Sbluhm "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp") 53*973a6851Sbluhmfor a in ans: 54*973a6851Sbluhm if a and a.type == ETH_P_IP and \ 55*973a6851Sbluhm a.payload.proto == 1 and \ 56*973a6851Sbluhm a.payload.frag == 0 and \ 57*973a6851Sbluhm icmptypes[a.payload.payload.type] == 'echo-reply': 58*973a6851Sbluhm id=a.payload.payload.id 59*973a6851Sbluhm print("id=%#x" % (id)) 60*973a6851Sbluhm if id != eid: 61*973a6851Sbluhm print("WRONG ECHO REPLY ID") 62*973a6851Sbluhm exit(2) 63*973a6851Sbluhm exit(0) 64*973a6851Sbluhmprint("NO ECHO REPLY") 65*973a6851Sbluhmexit(1) 66