1*8f79da2aSbluhm#!/usr/local/bin/python3 2*8f79da2aSbluhm 3*8f79da2aSbluhmprint("ping6 fragments in total larger than IP maximum packet") 4*8f79da2aSbluhm 5*8f79da2aSbluhm# |---------| 6*8f79da2aSbluhm# |--------| 7*8f79da2aSbluhm# ... ... 8*8f79da2aSbluhm# |--------| 9*8f79da2aSbluhm 10*8f79da2aSbluhmimport os 11*8f79da2aSbluhmfrom addr import * 12*8f79da2aSbluhmfrom scapy.all import * 13*8f79da2aSbluhm 14*8f79da2aSbluhmpid=os.getpid() 15*8f79da2aSbluhmeid=pid & 0xffff 16*8f79da2aSbluhmpayload=b"ABCDEFGHIJKLMNOP" 17*8f79da2aSbluhmpacket=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \ 18*8f79da2aSbluhm ICMPv6EchoRequest(id=eid, data=4095*payload) 19*8f79da2aSbluhmplen=IPv6(raw(packet)).plen 20*8f79da2aSbluhmprint("plen=%u" % (plen)) 21*8f79da2aSbluhmif plen != 0xfff8: 22*8f79da2aSbluhm print("PLEN!=%u" % (0xfff8)) 23*8f79da2aSbluhm exit(2) 24*8f79da2aSbluhmbytes=bytes(packet)+b"12345678" 25*8f79da2aSbluhm 26*8f79da2aSbluhmfrag=[] 27*8f79da2aSbluhmfid=pid & 0xffffffff 28*8f79da2aSbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/bytes[40:40+2**10]) 29*8f79da2aSbluhmoff=2**7 30*8f79da2aSbluhmwhile off < 2**13: 31*8f79da2aSbluhm frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=off)/ \ 32*8f79da2aSbluhm bytes[40+off*8:40+off*8+2**10]) 33*8f79da2aSbluhm off+=2**7 34*8f79da2aSbluhmeth=[] 35*8f79da2aSbluhmfor f in frag: 36*8f79da2aSbluhm pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f 37*8f79da2aSbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt) 38*8f79da2aSbluhm 39*8f79da2aSbluhmif os.fork() == 0: 40*8f79da2aSbluhm time.sleep(1) 41*8f79da2aSbluhm sendp(eth, iface=LOCAL_IF) 42*8f79da2aSbluhm os._exit(0) 43*8f79da2aSbluhm 44*8f79da2aSbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 45*8f79da2aSbluhm "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6") 46*8f79da2aSbluhmfor a in ans: 47*8f79da2aSbluhm print("type %d" % (a.payload.payload.type)) 48*8f79da2aSbluhm print("icmp %s" % (icmp6types[a.payload.payload.type])) 49*8f79da2aSbluhm if a and a.type == ETH_P_IPV6 and \ 50*8f79da2aSbluhm ipv6nh[a.payload.nh] == 'ICMPv6' and \ 51*8f79da2aSbluhm icmp6types[a.payload.payload.type] == 'Parameter problem': 52*8f79da2aSbluhm print("code=%u" % (a.payload.payload.code)) 53*8f79da2aSbluhm # 0: 'erroneous header field encountered' 54*8f79da2aSbluhm if a.payload.payload.code != 0: 55*8f79da2aSbluhm print("WRONG PARAMETER PROBLEM CODE") 56*8f79da2aSbluhm exit(1) 57*8f79da2aSbluhm ptr=a.payload.payload.ptr 58*8f79da2aSbluhm print("ptr=%u" % (ptr)) 59*8f79da2aSbluhm # 42: sizeof IPv6 header + offset in fragment header 60*8f79da2aSbluhm if ptr != 42: 61*8f79da2aSbluhm print("PTR!=%u" % (ptr)) 62*8f79da2aSbluhm exit(1) 63*8f79da2aSbluhm exit(0) 64*8f79da2aSbluhmprint("NO ICMP PARAMETER PROBLEM") 65*8f79da2aSbluhmexit(2) 66