1#!/usr/local/bin/python2.7 2# send ping6 fragment that overlaps the second fragment with the head 3 4# |----| 5# |----| 6# |XXXXXXXXX| 7# |----| 8 9import os 10from addr import * 11from scapy.all import * 12 13dstaddr=sys.argv[1] 14pid=os.getpid() 15payload="ABCDEFGHIJKLOMNO" 16dummy="0123456701234567" 17packet=IPv6(src=SRC_OUT6, dst=dstaddr)/ICMPv6EchoRequest(id=pid, data=payload) 18frag=[] 19frag.append(IPv6ExtHdrFragment(nh=58, id=pid, m=1)/str(packet)[40:48]) 20frag.append(IPv6ExtHdrFragment(nh=58, id=pid, offset=1, m=1)/str(packet)[48:56]) 21frag.append(IPv6ExtHdrFragment(nh=58, id=pid, offset=1)/dummy) 22frag.append(IPv6ExtHdrFragment(nh=58, id=pid, offset=2)/str(packet)[56:64]) 23eth=[] 24for f in frag: 25 pkt=IPv6(src=SRC_OUT6, dst=dstaddr)/f 26 eth.append(Ether(src=SRC_MAC, dst=DST_MAC)/pkt) 27 28if os.fork() == 0: 29 time.sleep(1) 30 sendp(eth, iface=SRC_IF) 31 os._exit(0) 32 33ans=sniff(iface=SRC_IF, timeout=3, filter= 34 "ip6 and src "+dstaddr+" and dst "+SRC_OUT6+" and icmp6") 35for a in ans: 36 if a and a.type == scapy.layers.dot11.ETHER_TYPES.IPv6 and \ 37 ipv6nh[a.payload.nh] == 'ICMPv6' and \ 38 icmp6types[a.payload.payload.type] == 'Echo Reply': 39 id=a.payload.payload.id 40 print "id=%#x" % (id) 41 if id != pid: 42 print "WRONG ECHO REPLY ID" 43 exit(2) 44 data=a.payload.payload.data 45 print "payload=%s" % (data) 46 if data == payload: 47 exit(0) 48 print "PAYLOAD!=%s" % (payload) 49 exit(1) 50print "NO ECHO REPLY" 51exit(2) 52