1*973a6851Sbluhm#!/usr/local/bin/python3 2*973a6851Sbluhm 3*973a6851Sbluhmprint("ping fragment at index boundary that cannot be requeued") 4*973a6851Sbluhm 5*973a6851Sbluhm# index boundary 4096 | 6*973a6851Sbluhm# |--------------| 7*973a6851Sbluhm# .... 8*973a6851Sbluhm# |--------------| 9*973a6851Sbluhm# |--------------| 10*973a6851Sbluhm# ....----| 11*973a6851Sbluhm# |XXXX-----| 12*973a6851Sbluhm# |--------------| 13*973a6851Sbluhm 14*973a6851Sbluhm# this should trigger "fragment requeue limit exceeded" log in kernel 15*973a6851Sbluhm 16*973a6851Sbluhmimport os 17*973a6851Sbluhmfrom itertools import chain 18*973a6851Sbluhmfrom addr import * 19*973a6851Sbluhmfrom scapy.all import * 20*973a6851Sbluhm 21*973a6851Sbluhmpid=os.getpid() 22*973a6851Sbluhmeid=pid & 0xffff 23*973a6851Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 24*973a6851Sbluhmdummy=b"01234567" 25*973a6851Sbluhmfragsize=64 26*973a6851Sbluhmboundary=4096 27*973a6851Sbluhmfragnum=int(boundary/fragsize) 28*973a6851Sbluhmpacket=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \ 29*973a6851Sbluhm ICMP(type='echo-request', id=eid)/ \ 30*973a6851Sbluhm (int((boundary+boundary)/len(payload)) * payload) 31*973a6851Sbluhmfrag=[] 32*973a6851Sbluhmfid=pid & 0xffff 33*973a6851Sbluhmfor i in chain(range(fragnum-1), range(fragnum, fragnum+fragnum-1)): 34*973a6851Sbluhm frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 35*973a6851Sbluhm frag=(i*fragsize)>>3, flags='MF')/ 36*973a6851Sbluhm bytes(packet)[20+i*fragsize:20+(i+1)*fragsize]) 37*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 38*973a6851Sbluhm frag=(boundary+boundary-fragsize)>>3)/ 39*973a6851Sbluhm bytes(packet)[20+boundary+boundary-fragsize:]) 40*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 41*973a6851Sbluhm frag=(boundary-8)>>3, flags='MF')/ 42*973a6851Sbluhm (dummy+bytes(packet)[20+boundary:20+boundary+8])) 43*973a6851Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, 44*973a6851Sbluhm frag=(boundary-fragsize)>>3, flags='MF')/ 45*973a6851Sbluhm bytes(packet)[20+boundary-fragsize:20+boundary]) 46*973a6851Sbluhmeth=[] 47*973a6851Sbluhmfor f in frag: 48*973a6851Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f) 49*973a6851Sbluhm 50*973a6851Sbluhmif os.fork() == 0: 51*973a6851Sbluhm time.sleep(1) 52*973a6851Sbluhm for e in eth: 53*973a6851Sbluhm sendp(e, iface=LOCAL_IF) 54*973a6851Sbluhm time.sleep(0.001) 55*973a6851Sbluhm os._exit(0) 56*973a6851Sbluhm 57*973a6851Sbluhmans=sniff(iface=LOCAL_IF, timeout=10, filter= 58*973a6851Sbluhm "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp") 59*973a6851Sbluhmfor a in ans: 60*973a6851Sbluhm if a and a.type == ETH_P_IP and \ 61*973a6851Sbluhm a.payload.proto == 1 and \ 62*973a6851Sbluhm a.payload.frag == 0 and \ 63*973a6851Sbluhm icmptypes[a.payload.payload.type] == 'echo-reply': 64*973a6851Sbluhm id=a.payload.payload.id 65*973a6851Sbluhm print("id=%#x" % (id)) 66*973a6851Sbluhm if id != eid: 67*973a6851Sbluhm print("WRONG ECHO REPLY ID") 68*973a6851Sbluhm exit(2) 69*973a6851Sbluhm print("ECHO REPLY") 70*973a6851Sbluhm exit(1) 71*973a6851Sbluhmprint("no echo reply") 72*973a6851Sbluhmexit(0) 73