frag6_overtail1.py revision 1.2 
1#!/usr/local/bin/python3
2
3print("ping6 fragment tail that overlaps the first fragment completely")
4
5#      |---------|
6#      |XXXX|
7# |----|
8
9import os
10from addr import *
11from scapy.all import *
12
13pid=os.getpid()
14eid=pid & 0xffff
15payload=b"ABCDEFGHIJKLMNOP"
16packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
17    ICMPv6EchoRequest(id=eid, data=payload)
18frag=[]
19fid=pid & 0xffffffff
20frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/bytes(packet)[48:64])
21frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/bytes(packet)[48:56])
22frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/bytes(packet)[40:48])
23eth=[]
24for f in frag:
25	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
26	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt)
27
28if os.fork() == 0:
29	time.sleep(1)
30	sendp(eth, iface=LOCAL_IF)
31	os._exit(0)
32
33ans=sniff(iface=LOCAL_IF, timeout=3, filter=
34    "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6")
35for a in ans:
36	if a and a.type == ETH_P_IPV6 and \
37	    ipv6nh[a.payload.nh] == 'ICMPv6' and \
38	    icmp6types[a.payload.payload.type] == 'Echo Reply':
39		id=a.payload.payload.id
40		print("id=%#x" % (id))
41		if id != eid:
42			print("WRONG ECHO REPLY ID")
43			exit(2)
44		data=a.payload.payload.data
45		print("payload=%s" % (data))
46		if data == payload:
47			print("ECHO REPLY")
48			exit(1)
49		print("PAYLOAD!=%s" % (payload))
50		exit(2)
51print("no echo reply")
52exit(0)
53