Skip to content

Fix ICMPv6 RFC4884 extension length handling. #5222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
guedou wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix ICMPv6 RFC4884 extension length handling. #5222

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 26 additions & 2 deletions scapy/layers/inet6.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@
_ICMPExtensionField,
_ICMPExtensionPadField,
_ICMP_extpad_post_dissection,
ICMPExtension_Header,
IP,
IPTools,
TCP,
Expand Down Expand Up @@ -1448,6 +1449,14 @@ class _ICMPv6(Packet):

def post_build(self, p, pay):
p += pay
if (getattr(self, "ext", None) is not None and
getattr(self, "length", 0) == 0):
# RFC 4884: padded original datagram length, in 64-bit words.
datagram_len = len(p) - len(raw(self.ext)) - 8
if datagram_len > 0:
length = datagram_len // 8
if length <= 255:
p = p[:4] + chb(length) + p[5:]
if self.cksum is None:
chksum = in6_chksum(58, self.underlayer, p)
p = p[:2] + struct.pack("!H", chksum) + p[4:]
Expand Down Expand Up @@ -1475,6 +1484,21 @@ def guess_payload_class(self, p):
return IPerror6


class _ICMPv6ExtensionField(_ICMPExtensionField):

def getfield(self, pkt, s):
if pkt.length:
# RFC 4884: the extension starts after length * 8 bytes.
offset = 8 * pkt.length
if len(s) <= offset:
return s, None
data = s[offset:]
if checksum(data):
return s, None
return s[:offset], ICMPExtension_Header(data)
return super(_ICMPv6ExtensionField, self).getfield(pkt, s)


class ICMPv6Unknown(_ICMPv6):
name = "Scapy6 ICMPv6 fallback class"
fields_desc = [ByteEnumField("type", 1, icmp6types),
Expand All @@ -1497,7 +1521,7 @@ class ICMPv6DestUnreach(_ICMPv6Error):
ByteField("length", 0),
X3BytesField("unused", 0),
_ICMPExtensionPadField(),
_ICMPExtensionField()]
_ICMPv6ExtensionField()]
post_dissection = _ICMP_extpad_post_dissection


Expand All @@ -1518,7 +1542,7 @@ class ICMPv6TimeExceeded(_ICMPv6Error):
ByteField("length", 0),
X3BytesField("unused", 0),
_ICMPExtensionPadField(),
_ICMPExtensionField()]
_ICMPv6ExtensionField()]
post_dissection = _ICMP_extpad_post_dissection


Expand Down
5 changes: 5 additions & 0 deletions test/scapy/layers/inet6.uts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -368,6 +368,11 @@ a[ICMPv6PacketTooBig][TCPerror].chksum == b.chksum
# To be done but not critical. Same mechanisms and format as
# previous ones.

= ICMPv6TimeExceeded Class - RFC4884 extension length
pkt = Ether()/IPv6()/ICMPv6TimeExceeded(ext=ICMPExtension_Header())/IPv6()/ICMPv6EchoRequest()
decoded = Ether(raw(pkt))
decoded[ICMPv6TimeExceeded].length == 16 and isinstance(decoded[ICMPv6TimeExceeded].ext, ICMPExtension_Header)

########### ICMPv6ParamProblem Class ################################
# See previous note

Expand Down
Loading