1*647ac401Sbluhm#!/usr/local/bin/python3 23fe81ad4Sbluhm 3*647ac401Sbluhmprint("udp fragments splitted after udp header") 43fe81ad4Sbluhm 53fe81ad4Sbluhm# |----| 63fe81ad4Sbluhm# |--------| 73fe81ad4Sbluhm 83fe81ad4Sbluhmimport os 93fe81ad4Sbluhmfrom addr import * 103fe81ad4Sbluhmfrom scapy.all import * 113fe81ad4Sbluhm 123fe81ad4Sbluhmpid=os.getpid() 133fe81ad4Sbluhmuport=pid & 0xffff 143fe81ad4Sbluhm# inetd ignores UDP packets from privileged port or nfs 153fe81ad4Sbluhmif uport < 1024 or uport == 2049: 163fe81ad4Sbluhm uport+=1024 17*647ac401Sbluhmpayload=b"ABCDEFGHIJKLMNOP" 183fe81ad4Sbluhmpacket=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \ 193fe81ad4Sbluhm UDP(sport=uport, dport=7)/payload 203fe81ad4Sbluhmfrag=[] 213fe81ad4Sbluhmfid=pid & 0xffff 227cd47444Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid, 23*647ac401Sbluhm flags='MF')/bytes(packet)[20:28]) 247cd47444Sbluhmfrag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid, 25*647ac401Sbluhm frag=1)/bytes(packet)[28:44]) 263fe81ad4Sbluhmeth=[] 273fe81ad4Sbluhmfor f in frag: 283fe81ad4Sbluhm eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f) 293fe81ad4Sbluhm 303fe81ad4Sbluhmif os.fork() == 0: 313fe81ad4Sbluhm time.sleep(1) 323fe81ad4Sbluhm sendp(eth, iface=LOCAL_IF) 333fe81ad4Sbluhm os._exit(0) 343fe81ad4Sbluhm 353fe81ad4Sbluhmans=sniff(iface=LOCAL_IF, timeout=3, filter= 363fe81ad4Sbluhm "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and udp") 373fe81ad4Sbluhmfor a in ans: 383fe81ad4Sbluhm if a and a.type == ETH_P_IP and \ 393fe81ad4Sbluhm a.payload.proto == 17 and \ 403fe81ad4Sbluhm a.payload.frag == 0 and a.payload.flags == 0 and \ 413fe81ad4Sbluhm a.payload.payload.sport == 7: 423fe81ad4Sbluhm port=a.payload.payload.dport 43*647ac401Sbluhm print("port=%d" % (port)) 443fe81ad4Sbluhm if port != uport: 45*647ac401Sbluhm print("WRONG UDP ECHO REPLY PORT") 463fe81ad4Sbluhm exit(2) 473fe81ad4Sbluhm data=a.payload.payload.payload.load 48*647ac401Sbluhm print("payload=%s" % (data)) 493fe81ad4Sbluhm if data == payload: 503fe81ad4Sbluhm exit(0) 51*647ac401Sbluhm print("PAYLOAD!=%s" % (payload)) 523fe81ad4Sbluhm exit(1) 53*647ac401Sbluhmprint("NO UDP ECHO REPLY") 543fe81ad4Sbluhmexit(2) 55