1*527238f8Sbluhm#!/usr/local/bin/python3 29e5c34cfSbluhm 3*527238f8Sbluhmprint("send ping6 fragment that ends behind ipv6 max packet size") 49e5c34cfSbluhm 59e5c34cfSbluhm# IPV6_MAXPACKET | 69e5c34cfSbluhm# |--------| 79e5c34cfSbluhm# |----| 89e5c34cfSbluhm# |----| 99e5c34cfSbluhm 109e5c34cfSbluhmimport os 119e5c34cfSbluhmfrom addr import * 129e5c34cfSbluhmfrom scapy.all import * 139e5c34cfSbluhm 149e5c34cfSbluhmpid=os.getpid() 159e5c34cfSbluhmeid=pid & 0xffff 16*527238f8Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 179e5c34cfSbluhmpacket=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \ 189e5c34cfSbluhm ICMPv6EchoRequest(id=eid, data=payload) 199e5c34cfSbluhmfrag=[] 209e5c34cfSbluhmfid=pid & 0xffffffff 21*527238f8Sbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/bytes(packet)[40:56]) 22*527238f8Sbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=8191)/bytes(packet)[56:64]) 23*527238f8Sbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/bytes(packet)[56:64]) 249e5c34cfSbluhmeth=[] 259e5c34cfSbluhmfor f in frag: 269e5c34cfSbluhm pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f 279e5c34cfSbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt) 289e5c34cfSbluhm 299e5c34cfSbluhmif os.fork() == 0: 309e5c34cfSbluhm time.sleep(1) 319e5c34cfSbluhm sendp(eth, iface=LOCAL_IF) 329e5c34cfSbluhm os._exit(0) 339e5c34cfSbluhm 349e5c34cfSbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 359e5c34cfSbluhm "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6") 369e5c34cfSbluhmfor a in ans: 379e5c34cfSbluhm if a and a.type == ETH_P_IPV6 and \ 389e5c34cfSbluhm ipv6nh[a.payload.nh] == 'ICMPv6' and \ 399e5c34cfSbluhm icmp6types[a.payload.payload.type] == 'Echo Reply': 409e5c34cfSbluhm id=a.payload.payload.id 41*527238f8Sbluhm print("id=%#x" % (id)) 429e5c34cfSbluhm if id != eid: 43*527238f8Sbluhm print("WRONG ECHO REPLY ID") 449e5c34cfSbluhm exit(2) 459e5c34cfSbluhm data=a.payload.payload.data 46*527238f8Sbluhm print("payload=%s" % (data)) 479e5c34cfSbluhm if data == payload: 489e5c34cfSbluhm exit(0) 49*527238f8Sbluhm print("PAYLOAD!=%s" % (payload)) 509e5c34cfSbluhm exit(1) 51*527238f8Sbluhmprint("NO ECHO REPLY") 529e5c34cfSbluhmexit(2) 53