1#!/usr/local/bin/python2.7
2
3print "ping6 fragment that overlaps longer than the last fragment with m=0"
4
5#      |---------|
6#                |XXXX|
7# |----|
8
9import os
10from addr import *
11from scapy.all import *
12
13pid=os.getpid()
14eid=pid & 0xffff
15payload="ABCDEFGHIJKLMNOP"
16dummy="01234567"
17packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
18    ICMPv6EchoRequest(id=eid, data=payload)
19frag=[]
20fid=pid & 0xffffffff
21frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
22frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=3)/dummy)
23frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:48])
24eth=[]
25for f in frag:
26	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
27	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt)
28
29if os.fork() == 0:
30	time.sleep(1)
31	sendp(eth, iface=LOCAL_IF)
32	os._exit(0)
33
34ans=sniff(iface=LOCAL_IF, timeout=3, filter=
35    "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6")
36for a in ans:
37	if a and a.type == ETH_P_IPV6 and \
38	    ipv6nh[a.payload.nh] == 'ICMPv6' and \
39	    icmp6types[a.payload.payload.type] == 'Echo Reply':
40		id=a.payload.payload.id
41		print "id=%#x" % (id)
42		if id != eid:
43			print "WRONG ECHO REPLY ID"
44			exit(2)
45		data=a.payload.payload.data
46		print "payload=%s" % (data)
47		if data == payload:
48			print "ECHO REPLY"
49			exit(1)
50		print "PAYLOAD!=%s" % (payload)
51		exit(2)
52print "no echo reply"
53exit(0)
54