1#!/usr/local/bin/python2.7
2
3print "send 3 non-overlapping ping fragments in all possible orders"
4
5# |----|
6#      |----|
7#           |----|
8
9import os
10from addr import *
11from scapy.all import *
12
13permute=[]
14permute.append([0,1,2])
15permute.append([0,2,1])
16permute.append([1,0,2])
17permute.append([2,0,1])
18permute.append([1,2,0])
19permute.append([2,1,0])
20
21pid=os.getpid()
22payload="ABCDEFGHIJKLMNOP"
23for p in permute:
24	pid += 1
25	eid=pid & 0xffff
26	packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
27	    ICMP(type='echo-request', id=eid)/payload
28	frag=[]
29	fid=pid & 0xffff
30	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
31	    flags='MF')/str(packet)[20:28])
32	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
33	    frag=1, flags='MF')/str(packet)[28:36])
34	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
35	    frag=2)/str(packet)[36:48])
36	eth=[]
37	for i in range(3):
38		eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/frag[p[i]])
39
40	if os.fork() == 0:
41		time.sleep(1)
42		sendp(eth, iface=LOCAL_IF)
43		os._exit(0)
44
45	ans=sniff(iface=LOCAL_IF, timeout=3, filter=
46	    "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp")
47	for a in ans:
48		if a and a.type == ETH_P_IP and \
49		    a.payload.proto == 1 and \
50		    a.payload.frag == 0 and a.payload.flags == 0 and \
51		    icmptypes[a.payload.payload.type] == 'echo-reply':
52			id=a.payload.payload.id
53			print "id=%#x" % (id)
54			if id != eid:
55				print "WRONG ECHO REPLY ID"
56				exit(2)
57			data=a.payload.payload.payload.load
58			print "payload=%s" % (data)
59			if data == payload:
60				break
61			print "PAYLOAD!=%s" % (payload)
62			exit(1)
63	else:
64		print "NO ECHO REPLY"
65		exit(2)
66