1#!/usr/local/bin/python2.7
2
3print "ping fragment head that overlaps the first fragment completely"
4
5# |---------|
6#      |XXXX|
7#           |----|
8
9import os
10from addr import *
11from scapy.all import *
12
13pid=os.getpid()
14eid=pid & 0xffff
15payload="ABCDEFGHIJKLMNOP"
16dummy="01234567"
17packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
18    ICMP(type='echo-request', id=eid)/payload
19frag=[]
20fid=pid & 0xffff
21frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
22    flags='MF')/str(packet)[20:36])
23frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
24    frag=1, flags='MF')/dummy)
25frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
26    frag=2)/str(packet)[36:44])
27eth=[]
28for f in frag:
29	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
30
31if os.fork() == 0:
32	time.sleep(1)
33	sendp(eth, iface=LOCAL_IF)
34	os._exit(0)
35
36ans=sniff(iface=LOCAL_IF, timeout=3, filter=
37    "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp")
38for a in ans:
39	if a and a.type == ETH_P_IP and \
40	    a.payload.proto == 1 and \
41	    a.payload.frag == 0 and a.payload.flags == 0 and \
42	    icmptypes[a.payload.payload.type] == 'echo-reply':
43		id=a.payload.payload.id
44		print "id=%#x" % (id)
45		if id != eid:
46			print "WRONG ECHO REPLY ID"
47			exit(2)
48		data=a.payload.payload.payload.load
49		print "payload=%s" % (data)
50		if data == payload:
51			exit(0)
52		print "PAYLOAD!=%s" % (payload)
53		exit(1)
54print "NO ECHO REPLY"
55exit(2)
56