1f74e6e49SBjoern A. Zeeb#!/usr/bin/env python 2f74e6e49SBjoern A. Zeeb#- 3f74e6e49SBjoern A. Zeeb# SPDX-License-Identifier: BSD-2-Clause 4f74e6e49SBjoern A. Zeeb# 5f74e6e49SBjoern A. Zeeb# Copyright (c) 2019 Netflix, Inc. 6f74e6e49SBjoern A. Zeeb# 7f74e6e49SBjoern A. Zeeb# Redistribution and use in source and binary forms, with or without 8f74e6e49SBjoern A. Zeeb# modification, are permitted provided that the following conditions 9f74e6e49SBjoern A. Zeeb# are met: 10f74e6e49SBjoern A. Zeeb# 1. Redistributions of source code must retain the above copyright 11f74e6e49SBjoern A. Zeeb# notice, this list of conditions and the following disclaimer. 12f74e6e49SBjoern A. Zeeb# 2. Redistributions in binary form must reproduce the above copyright 13f74e6e49SBjoern A. Zeeb# notice, this list of conditions and the following disclaimer in the 14f74e6e49SBjoern A. Zeeb# documentation and/or other materials provided with the distribution. 15f74e6e49SBjoern A. Zeeb# 16f74e6e49SBjoern A. Zeeb# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 17f74e6e49SBjoern A. Zeeb# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18f74e6e49SBjoern A. Zeeb# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19f74e6e49SBjoern A. Zeeb# ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 20f74e6e49SBjoern A. Zeeb# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21f74e6e49SBjoern A. Zeeb# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22f74e6e49SBjoern A. Zeeb# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23f74e6e49SBjoern A. Zeeb# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24f74e6e49SBjoern A. Zeeb# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25f74e6e49SBjoern A. Zeeb# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26f74e6e49SBjoern A. Zeeb# SUCH DAMAGE. 27f74e6e49SBjoern A. Zeeb# 28f74e6e49SBjoern A. Zeeb# 29f74e6e49SBjoern A. Zeeb 30f74e6e49SBjoern A. Zeebimport argparse 31a26e895fSKristof Provostimport logging 32a26e895fSKristof Provostlogging.getLogger("scapy").setLevel(logging.CRITICAL) 33f74e6e49SBjoern A. Zeebimport scapy.all as sp 34f74e6e49SBjoern A. Zeebimport socket 35f74e6e49SBjoern A. Zeebimport sys 36f74e6e49SBjoern A. Zeebfrom sniffer import Sniffer 37f74e6e49SBjoern A. Zeebfrom time import sleep 38f74e6e49SBjoern A. Zeeb 39f74e6e49SBjoern A. Zeebdef check_icmp6_error(args, packet): 40f74e6e49SBjoern A. Zeeb ip6 = packet.getlayer(sp.IPv6) 41f74e6e49SBjoern A. Zeeb if not ip6: 42f74e6e49SBjoern A. Zeeb return False 43f74e6e49SBjoern A. Zeeb oip6 = sp.IPv6(src=args.src[0], dst=args.to[0]) 44f74e6e49SBjoern A. Zeeb if ip6.dst != oip6.src: 45f74e6e49SBjoern A. Zeeb return False 46f74e6e49SBjoern A. Zeeb icmp6 = packet.getlayer(sp.ICMPv6TimeExceeded) 47f74e6e49SBjoern A. Zeeb if not icmp6: 48f74e6e49SBjoern A. Zeeb return False 49f74e6e49SBjoern A. Zeeb # ICMP6_TIME_EXCEED_REASSEMBLY 1 50f74e6e49SBjoern A. Zeeb if icmp6.code != 1: 51f74e6e49SBjoern A. Zeeb return False 52f74e6e49SBjoern A. Zeeb # Should we check the payload as well? 53f74e6e49SBjoern A. Zeeb # We are running in a very isolated environment and nothing else 54f74e6e49SBjoern A. Zeeb # should trigger an ICMPv6 Time Exceeded / Frag reassembly so leave it. 55f74e6e49SBjoern A. Zeeb #icmp6.display() 56f74e6e49SBjoern A. Zeeb return True 57f74e6e49SBjoern A. Zeeb 58f74e6e49SBjoern A. Zeeb 59f74e6e49SBjoern A. Zeebdef main(): 60f74e6e49SBjoern A. Zeeb parser = argparse.ArgumentParser("frag6.py", 61f74e6e49SBjoern A. Zeeb description="IPv6 fragementation test tool") 62f74e6e49SBjoern A. Zeeb parser.add_argument('--sendif', nargs=1, 63f74e6e49SBjoern A. Zeeb required=True, 64f74e6e49SBjoern A. Zeeb help='The interface through which the packet will be sent') 65f74e6e49SBjoern A. Zeeb parser.add_argument('--recvif', nargs=1, 66f74e6e49SBjoern A. Zeeb required=True, 67f74e6e49SBjoern A. Zeeb help='The interface on which to check for the packet') 68f74e6e49SBjoern A. Zeeb parser.add_argument('--src', nargs=1, 69f74e6e49SBjoern A. Zeeb required=True, 70f74e6e49SBjoern A. Zeeb help='The source IP address') 71f74e6e49SBjoern A. Zeeb parser.add_argument('--to', nargs=1, 72f74e6e49SBjoern A. Zeeb required=True, 73f74e6e49SBjoern A. Zeeb help='The destination IP address') 74f74e6e49SBjoern A. Zeeb parser.add_argument('--debug', 75f74e6e49SBjoern A. Zeeb required=False, action='store_true', 76f74e6e49SBjoern A. Zeeb help='Enable test debugging') 77f74e6e49SBjoern A. Zeeb 78f74e6e49SBjoern A. Zeeb args = parser.parse_args() 79f74e6e49SBjoern A. Zeeb 80f74e6e49SBjoern A. Zeeb 81f74e6e49SBjoern A. Zeeb # Start sniffing on recvif 82f74e6e49SBjoern A. Zeeb sniffer = Sniffer(args, check_icmp6_error) 83f74e6e49SBjoern A. Zeeb 84f74e6e49SBjoern A. Zeeb 85f74e6e49SBjoern A. Zeeb ######################################################################## 86f74e6e49SBjoern A. Zeeb # 87f74e6e49SBjoern A. Zeeb # A single start fragment with payload. 88f74e6e49SBjoern A. Zeeb # 89f74e6e49SBjoern A. Zeeb # A: Waiting for more data. 90f74e6e49SBjoern A. Zeeb # R: Timeout / Expiry. 91f74e6e49SBjoern A. Zeeb # 92f74e6e49SBjoern A. Zeeb data = "6" * 1280 93f74e6e49SBjoern A. Zeeb ip6f01 = sp.Ether() / \ 94f74e6e49SBjoern A. Zeeb sp.IPv6(src=args.src[0], dst=args.to[0]) / \ 95f74e6e49SBjoern A. Zeeb sp.IPv6ExtHdrFragment(offset=0, m=1, id=3) / \ 96f74e6e49SBjoern A. Zeeb sp.UDP(dport=3456, sport=6543) / \ 97f74e6e49SBjoern A. Zeeb data 98f74e6e49SBjoern A. Zeeb if args.debug : 99f74e6e49SBjoern A. Zeeb ip6f01.display() 100f74e6e49SBjoern A. Zeeb sp.sendp(ip6f01, iface=args.sendif[0], verbose=False) 101f74e6e49SBjoern A. Zeeb 102f74e6e49SBjoern A. Zeeb # Wait for ICMPv6 error generation on timeout. 103*e32221a1SAlexander V. Chernikov sleep(3) 104f74e6e49SBjoern A. Zeeb sniffer.setEnd() 105f74e6e49SBjoern A. Zeeb sniffer.join() 106f74e6e49SBjoern A. Zeeb if not sniffer.foundCorrectPacket: 107f74e6e49SBjoern A. Zeeb sys.exit(1) 108f74e6e49SBjoern A. Zeeb 109f74e6e49SBjoern A. Zeeb sys.exit(0) 110f74e6e49SBjoern A. Zeeb 111f74e6e49SBjoern A. Zeebif __name__ == '__main__': 112f74e6e49SBjoern A. Zeeb main() 113