1527238f8Sbluhm#!/usr/local/bin/python3 2233b170eSbluhm 3527238f8Sbluhmprint("send 3 non-overlapping ping6 fragments in all possible orders") 4741f9993Sbluhm 5741f9993Sbluhm# |----| 6741f9993Sbluhm# |----| 7741f9993Sbluhm# |----| 8741f9993Sbluhm 9741f9993Sbluhmimport os 10741f9993Sbluhmfrom addr import * 11741f9993Sbluhmfrom scapy.all import * 12741f9993Sbluhm 13741f9993Sbluhmpermute=[] 14741f9993Sbluhmpermute.append([0,1,2]) 15741f9993Sbluhmpermute.append([0,2,1]) 16741f9993Sbluhmpermute.append([1,0,2]) 17741f9993Sbluhmpermute.append([2,0,1]) 18741f9993Sbluhmpermute.append([1,2,0]) 19741f9993Sbluhmpermute.append([2,1,0]) 20741f9993Sbluhm 219ae5678bSbluhmpid=os.getpid() 22527238f8Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 23741f9993Sbluhmfor p in permute: 24741f9993Sbluhm pid += 1 259ae5678bSbluhm eid=pid & 0xffff 267b3475a7Sbluhm packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \ 279ae5678bSbluhm ICMPv6EchoRequest(id=eid, data=payload) 28741f9993Sbluhm frag=[] 299ae5678bSbluhm fid=pid & 0xffffffff 3070d7d4e3Sbluhm frag.append(IPv6ExtHdrFragment(nh=58, id=fid, 3170d7d4e3Sbluhm m=1)/bytes(packet)[40:48]) 3270d7d4e3Sbluhm frag.append(IPv6ExtHdrFragment(nh=58, id=fid, 3370d7d4e3Sbluhm offset=1, m=1)/bytes(packet)[48:56]) 3470d7d4e3Sbluhm frag.append(IPv6ExtHdrFragment(nh=58, id=fid, 3570d7d4e3Sbluhm offset=2)/bytes(packet)[56:64]) 36741f9993Sbluhm eth=[] 37741f9993Sbluhm for i in range(3): 387b3475a7Sbluhm pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/frag[p[i]] 397b3475a7Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt) 40741f9993Sbluhm 41741f9993Sbluhm if os.fork() == 0: 42741f9993Sbluhm time.sleep(1) 437b3475a7Sbluhm sendp(eth, iface=LOCAL_IF) 44741f9993Sbluhm os._exit(0) 45741f9993Sbluhm 467b3475a7Sbluhm ans=sniff(iface=LOCAL_IF, timeout=3, filter= 477b3475a7Sbluhm "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6") 48741f9993Sbluhm for a in ans: 499c70e3bfSbluhm if a and a.type == ETH_P_IPV6 and \ 50741f9993Sbluhm ipv6nh[a.payload.nh] == 'ICMPv6' and \ 51741f9993Sbluhm icmp6types[a.payload.payload.type] == 'Echo Reply': 52741f9993Sbluhm id=a.payload.payload.id 53527238f8Sbluhm print("id=%#x" % (id)) 549ae5678bSbluhm if id != eid: 55527238f8Sbluhm print("WRONG ECHO REPLY ID") 56741f9993Sbluhm exit(2) 57741f9993Sbluhm data=a.payload.payload.data 58527238f8Sbluhm print("payload=%s" % (data)) 59741f9993Sbluhm if data == payload: 60741f9993Sbluhm break 61527238f8Sbluhm print("PAYLOAD!=%s" % (payload)) 62741f9993Sbluhm exit(1) 63741f9993Sbluhm else: 64527238f8Sbluhm print("NO ECHO REPLY") 65741f9993Sbluhm exit(2) 66*b30da243Sbluhmprint("permutation done") 67*b30da243Sbluhmexit(0) 68