1*527238f8Sbluhm#!/usr/local/bin/python3 27cd47444Sbluhm 3*527238f8Sbluhmprint("ping6 fragment that overlaps the fist fragment with its tail") 47cd47444Sbluhm 57cd47444Sbluhm# |XXXX-----| 67cd47444Sbluhm# |---------| 77cd47444Sbluhm 87cd47444Sbluhmimport os 97cd47444Sbluhmfrom addr import * 107cd47444Sbluhmfrom scapy.all import * 117cd47444Sbluhm 127cd47444Sbluhmpid=os.getpid() 137cd47444Sbluhmeid=pid & 0xffff 14*527238f8Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 157cd47444Sbluhmpacket=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \ 167cd47444Sbluhm ICMPv6EchoRequest(id=eid, data=payload) 177cd47444Sbluhmfrag=[] 187cd47444Sbluhmfid=pid & 0xffffffff 19*527238f8Sbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/bytes(packet)[48:64]) 20*527238f8Sbluhmfrag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/bytes(packet)[40:56]) 217cd47444Sbluhmeth=[] 227cd47444Sbluhmfor f in frag: 237cd47444Sbluhm pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f 247cd47444Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt) 257cd47444Sbluhm 267cd47444Sbluhmif os.fork() == 0: 277cd47444Sbluhm time.sleep(1) 287cd47444Sbluhm sendp(eth, iface=LOCAL_IF) 297cd47444Sbluhm os._exit(0) 307cd47444Sbluhm 317cd47444Sbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 327cd47444Sbluhm "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6") 337cd47444Sbluhmfor a in ans: 347cd47444Sbluhm if a and a.type == ETH_P_IPV6 and \ 357cd47444Sbluhm ipv6nh[a.payload.nh] == 'ICMPv6' and \ 367cd47444Sbluhm icmp6types[a.payload.payload.type] == 'Echo Reply': 377cd47444Sbluhm id=a.payload.payload.id 38*527238f8Sbluhm print("id=%#x" % (id)) 397cd47444Sbluhm if id != eid: 40*527238f8Sbluhm print("WRONG ECHO REPLY ID") 417cd47444Sbluhm exit(2) 427cd47444Sbluhm data=a.payload.payload.data 43*527238f8Sbluhm print("payload=%s" % (data)) 447cd47444Sbluhm if data == payload: 45*527238f8Sbluhm print("ECHO REPLY") 467cd47444Sbluhm exit(1) 47*527238f8Sbluhm print("PAYLOAD!=%s" % (payload)) 487cd47444Sbluhm exit(2) 49*527238f8Sbluhmprint("no echo reply") 507cd47444Sbluhmexit(0) 51