1*527238f8Sbluhm#!/usr/local/bin/python3 2233b170eSbluhm 3*527238f8Sbluhmprint("ping6 fragments with missplaced hop-by-hop extension header") 45c955934Sbluhm 55c955934Sbluhm# |HHHH----------| 65c955934Sbluhm# |----| 75c955934Sbluhm 85c955934Sbluhmimport os 95c955934Sbluhmfrom addr import * 105c955934Sbluhmfrom scapy.all import * 115c955934Sbluhm 129ae5678bSbluhmpid=os.getpid() 139ae5678bSbluhmeid=pid & 0xffff 14*527238f8Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 157b3475a7Sbluhmpacket=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/IPv6ExtHdrHopByHop()/ \ 169ae5678bSbluhm ICMPv6EchoRequest(id=eid, data=payload) 175c955934Sbluhmfrag=[] 189ae5678bSbluhmfid=pid & 0xffffffff 19*527238f8Sbluhmfrag.append(IPv6ExtHdrFragment(nh=0, id=fid, m=1)/bytes(packet)[40:64]) 20*527238f8Sbluhmfrag.append(IPv6ExtHdrFragment(nh=0, id=fid, offset=3)/bytes(packet)[64:72]) 215c955934Sbluhmeth=[] 225c955934Sbluhmfor f in frag: 237b3475a7Sbluhm pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f 247b3475a7Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt) 255c955934Sbluhm 265c955934Sbluhmif os.fork() == 0: 275c955934Sbluhm time.sleep(1) 287b3475a7Sbluhm sendp(eth, iface=LOCAL_IF) 295c955934Sbluhm os._exit(0) 305c955934Sbluhm 317b3475a7Sbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 327b3475a7Sbluhm "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6") 335c955934Sbluhmfor a in ans: 345c955934Sbluhm if a and a.type == ETH_P_IPV6 and \ 355c955934Sbluhm ipv6nh[a.payload.nh] == 'ICMPv6' and \ 365c955934Sbluhm icmp6types[a.payload.payload.type] == 'Echo Reply': 375c955934Sbluhm id=a.payload.payload.id 38*527238f8Sbluhm print("id=%#x" % (id)) 399ae5678bSbluhm if id != eid: 40*527238f8Sbluhm print("WRONG ECHO REPLY ID") 415c955934Sbluhm exit(2) 425c955934Sbluhm data=a.payload.payload.data 43*527238f8Sbluhm print("payload=%s" % (data)) 445c955934Sbluhm if data == payload: 45*527238f8Sbluhm print("ECHO REPLY") 465c955934Sbluhm exit(1) 47*527238f8Sbluhm print("PAYLOAD!=%s" % (payload)) 485c955934Sbluhm exit(2) 49*527238f8Sbluhmprint("no echo reply") 505c955934Sbluhmexit(0) 51