1527238f8Sbluhm#!/usr/local/bin/python3 2320944d6Sbluhm 3527238f8Sbluhmprint("ping6 fragment with mf=1 that overlaps fragment with mf=0 at the end") 4320944d6Sbluhm 5320944d6Sbluhm# |----| 67cd47444Sbluhm# |XXXXXXXXX| 77cd47444Sbluhm# |---------| 8320944d6Sbluhm 9320944d6Sbluhmimport os 10320944d6Sbluhmfrom addr import * 11320944d6Sbluhmfrom scapy.all import * 12320944d6Sbluhm 139ae5678bSbluhmpid=os.getpid() 149ae5678bSbluhmeid=pid & 0xffff 15527238f8Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 167b3475a7Sbluhmpacket=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \ 177b3475a7Sbluhm ICMPv6EchoRequest(id=eid, data=payload) 18320944d6Sbluhmfrag=[] 199ae5678bSbluhmfid=pid & 0xffffffff 20*51c2e16fSbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, 21*51c2e16fSbluhm offset=2)/bytes(packet)[56:64]) 22*51c2e16fSbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, 23*51c2e16fSbluhm offset=1, m=1)/bytes(packet)[48:64]) 24*51c2e16fSbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, 25*51c2e16fSbluhm m=1)/bytes(packet)[40:56]) 26320944d6Sbluhmeth=[] 27320944d6Sbluhmfor f in frag: 287b3475a7Sbluhm pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f 297b3475a7Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt) 30320944d6Sbluhm 31320944d6Sbluhmif os.fork() == 0: 32320944d6Sbluhm time.sleep(1) 337b3475a7Sbluhm sendp(eth, iface=LOCAL_IF) 34320944d6Sbluhm os._exit(0) 35320944d6Sbluhm 367b3475a7Sbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 377b3475a7Sbluhm "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6") 38320944d6Sbluhmfor a in ans: 39320944d6Sbluhm if a and a.type == ETH_P_IPV6 and \ 40320944d6Sbluhm ipv6nh[a.payload.nh] == 'ICMPv6' and \ 41320944d6Sbluhm icmp6types[a.payload.payload.type] == 'Echo Reply': 42320944d6Sbluhm id=a.payload.payload.id 43527238f8Sbluhm print("id=%#x" % (id)) 449ae5678bSbluhm if id != eid: 45527238f8Sbluhm print("WRONG ECHO REPLY ID") 46320944d6Sbluhm exit(2) 47320944d6Sbluhm data=a.payload.payload.data 48527238f8Sbluhm print("payload=%s" % (data)) 49320944d6Sbluhm if data == payload: 50527238f8Sbluhm print("ECHO REPLY") 51320944d6Sbluhm exit(1) 52527238f8Sbluhm print("PAYLOAD!=%s" % (payload)) 53320944d6Sbluhm exit(2) 54527238f8Sbluhmprint("no echo reply") 55320944d6Sbluhmexit(0) 56