1#!/usr/local/bin/python2.7
2
3print "ping fragment that overlaps the first fragment with its tail"
4
5#      |XXXX-----|
6# |---------|
7
8import os
9from addr import *
10from scapy.all import *
11
12pid=os.getpid()
13eid=pid & 0xffff
14payload="ABCDEFGHIJKLMNOP"
15dummy="01234567"
16packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
17    ICMP(type='echo-request', id=eid)/payload
18frag=[]
19fid=pid & 0xffff
20frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
21    frag=1)/(dummy+str(packet)[36:44]))
22frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
23    flags='MF')/str(packet)[20:36])
24eth=[]
25for f in frag:
26	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
27
28if os.fork() == 0:
29	time.sleep(1)
30	sendp(eth, iface=LOCAL_IF)
31	os._exit(0)
32
33ans=sniff(iface=LOCAL_IF, timeout=3, filter=
34    "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp")
35for a in ans:
36	if a and a.type == ETH_P_IP and \
37	    a.payload.proto == 1 and \
38	    a.payload.frag == 0 and a.payload.flags == 0 and \
39	    icmptypes[a.payload.payload.type] == 'echo-reply':
40		id=a.payload.payload.id
41		print "id=%#x" % (id)
42		if id != eid:
43			print "WRONG ECHO REPLY ID"
44			exit(2)
45		data=a.payload.payload.payload.load
46		print "payload=%s" % (data)
47		if data == payload:
48			exit(0)
49		print "PAYLOAD!=%s" % (payload)
50		exit(1)
51print "NO ECHO REPLY"
52exit(2)
53