1*f4a9118aSbluhm#!/usr/local/bin/python3 2640fbc9dSbluhm# send 2 non-overlapping ping6 fragments 3640fbc9dSbluhm 4640fbc9dSbluhmimport os 51eb14a7bSbluhmimport threading 6640fbc9dSbluhmfrom addr import * 7640fbc9dSbluhmfrom scapy.all import * 8640fbc9dSbluhm 91eb14a7bSbluhmclass Sniff1(threading.Thread): 101eb14a7bSbluhm filter = None 111eb14a7bSbluhm captured = None 121eb14a7bSbluhm packet = None 131eb14a7bSbluhm def run(self): 141eb14a7bSbluhm self.captured = sniff(iface=SRC_IF, filter=self.filter, 151eb14a7bSbluhm count=1, timeout=3) 161eb14a7bSbluhm if self.captured: 171eb14a7bSbluhm self.packet = self.captured[0] 181eb14a7bSbluhm 19640fbc9dSbluhmdstaddr=sys.argv[1] 209ae5678bSbluhmpid=os.getpid() 219ae5678bSbluhmeid=pid & 0xffff 22*f4a9118aSbluhmpayload=b"ABCDEFGHIJKLOMNO" 239ae5678bSbluhmpacket=IPv6(src=SRC_OUT6, dst=dstaddr)/ICMPv6EchoRequest(id=eid, data=payload) 249ae5678bSbluhmfid=pid & 0xffffffff 25*f4a9118aSbluhmfrag0=IPv6ExtHdrFragment(nh=58, id=fid, m=1)/bytes(packet)[40:56] 26*f4a9118aSbluhmfrag1=IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/bytes(packet)[56:64] 27640fbc9dSbluhmpkt0=IPv6(src=SRC_OUT6, dst=dstaddr)/frag0 28640fbc9dSbluhmpkt1=IPv6(src=SRC_OUT6, dst=dstaddr)/frag1 29640fbc9dSbluhmeth=[] 30640fbc9dSbluhmeth.append(Ether(src=SRC_MAC, dst=PF_MAC)/pkt0) 31640fbc9dSbluhmeth.append(Ether(src=SRC_MAC, dst=PF_MAC)/pkt1) 32640fbc9dSbluhm 331eb14a7bSbluhmsniffer = Sniff1(); 341eb14a7bSbluhmsniffer.filter = "ip6 and src %s and dst %s and icmp6" % (dstaddr, SRC_OUT6) 351eb14a7bSbluhmsniffer.start() 369a7ee091Sbluhmtime.sleep(1) 37640fbc9dSbluhmsendp(eth, iface=SRC_IF) 381eb14a7bSbluhmsniffer.join(timeout=5) 391eb14a7bSbluhma = sniffer.packet 40640fbc9dSbluhm 419c70e3bfSbluhmif a and a.type == ETH_P_IPV6 and \ 42640fbc9dSbluhm ipv6nh[a.payload.nh] == 'ICMPv6' and \ 43640fbc9dSbluhm icmp6types[a.payload.payload.type] == 'Echo Reply': 44640fbc9dSbluhm id=a.payload.payload.id 45*f4a9118aSbluhm print("id=%#x" % (id)) 469ae5678bSbluhm if id != eid: 47*f4a9118aSbluhm print("WRONG ECHO REPLY ID") 48640fbc9dSbluhm exit(2) 49640fbc9dSbluhm data=a.payload.payload.data 50*f4a9118aSbluhm print("payload=%s" % (data)) 51640fbc9dSbluhm if data == payload: 52640fbc9dSbluhm exit(0) 53*f4a9118aSbluhm print("PAYLOAD!=%s" % (payload)) 54640fbc9dSbluhm exit(1) 55*f4a9118aSbluhmprint("NO ECHO REPLY") 56640fbc9dSbluhmexit(2) 57