1#!/usr/local/bin/python3
2
3print("send 3 non-overlapping ping6 fragments in all possible orders")
4
5# |----|
6#      |----|
7#           |----|
8
9import os
10from addr import *
11from scapy.all import *
12
13permute=[]
14permute.append([0,1,2])
15permute.append([0,2,1])
16permute.append([1,0,2])
17permute.append([2,0,1])
18permute.append([1,2,0])
19permute.append([2,1,0])
20
21pid=os.getpid()
22payload=b"ABCDEFGHIJKLMNOP"
23for p in permute:
24	pid += 1
25	eid=pid & 0xffff
26	packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
27	    ICMPv6EchoRequest(id=eid, data=payload)
28	frag=[]
29	fid=pid & 0xffffffff
30	frag.append(IPv6ExtHdrFragment(nh=58, id=fid,
31	    m=1)/bytes(packet)[40:48])
32	frag.append(IPv6ExtHdrFragment(nh=58, id=fid,
33	    offset=1, m=1)/bytes(packet)[48:56])
34	frag.append(IPv6ExtHdrFragment(nh=58, id=fid,
35	    offset=2)/bytes(packet)[56:64])
36	eth=[]
37	for i in range(3):
38		pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/frag[p[i]]
39		eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt)
40
41	if os.fork() == 0:
42		time.sleep(1)
43		sendp(eth, iface=LOCAL_IF)
44		os._exit(0)
45
46	ans=sniff(iface=LOCAL_IF, timeout=3, filter=
47	    "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6")
48	for a in ans:
49		if a and a.type == ETH_P_IPV6 and \
50		    ipv6nh[a.payload.nh] == 'ICMPv6' and \
51		    icmp6types[a.payload.payload.type] == 'Echo Reply':
52			id=a.payload.payload.id
53			print("id=%#x" % (id))
54			if id != eid:
55				print("WRONG ECHO REPLY ID")
56				exit(2)
57			data=a.payload.payload.data
58			print("payload=%s" % (data))
59			if data == payload:
60				break
61			print("PAYLOAD!=%s" % (payload))
62			exit(1)
63	else:
64		print("NO ECHO REPLY")
65		exit(2)
66print("permutation done")
67exit(0)
68