Training courses

Kernel and Embedded Linux

Bootlin training courses

Embedded Linux, kernel,
Yocto Project, Buildroot, real-time,
graphics, boot time, debugging...

Bootlin logo

Elixir Cross Referencer

Open Menu /tests/sys/netpfil/pf/CVE-2019-5598.py 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
#!/usr/local/bin/python2.7

import argparse
import scapy.all as sp
import sys
from sniffer import Sniffer

def check_icmp_error(args, packet):
	ip = packet.getlayer(sp.IP)
	if not ip:
		return False
	if ip.dst != args.to[0]:
		return False

	icmp = packet.getlayer(sp.ICMP)
	if not icmp:
		return False
	if icmp.type != 3 or icmp.code != 3:
		return False

	return True

def main():
	parser = argparse.ArgumentParser("CVE-2019-icmp.py",
		description="CVE-2019-icmp test tool")
	parser.add_argument('--sendif', nargs=1,
		required=True,
		help='The interface through which the packet will be sent')
	parser.add_argument('--recvif', nargs=1,
		required=True,
		help='The interface on which to check for the packet')
	parser.add_argument('--src', nargs=1,
		required=True,
		help='The source IP address')
	parser.add_argument('--to', nargs=1,
		required=True,
		help='The destination IP address')

	args = parser.parse_args()

        # Send the allowed packet to establish state
        udp = sp.Ether() / \
            sp.IP(src=args.src[0], dst=args.to[0]) / \
            sp.UDP(dport=53, sport=1234)
        sp.sendp(udp, iface=args.sendif[0], verbose=False)

	# Start sniffing on recvif
	sniffer = Sniffer(args, check_icmp_error)

	# Send the bad error packet
	icmp_reachable = sp.Ether() / \
            sp.IP(src=args.src[0], dst=args.to[0]) / \
	    sp.ICMP(type=3, code=3) / \
	    sp.IP(src="4.3.2.1", dst="1.2.3.4") / \
	    sp.UDP(dport=53, sport=1234)
	sp.sendp(icmp_reachable, iface=args.sendif[0], verbose=False)

	sniffer.join()
	if sniffer.foundCorrectPacket:
		sys.exit(1)

	sys.exit(0)

if __name__ == '__main__':
	main()
#!/usr/local/bin/python2.7

import argparse
import scapy.all as sp
import sys
from sniffer import Sniffer

def check_icmp_error(args, packet):
	ip = packet.getlayer(sp.IP)
	if not ip:
		return False
	if ip.dst != args.to[0]:
		return False

	icmp = packet.getlayer(sp.ICMP)
	if not icmp:
		return False
	if icmp.type != 3 or icmp.code != 3:
		return False

	return True

def main():
	parser = argparse.ArgumentParser("CVE-2019-icmp.py",
		description="CVE-2019-icmp test tool")
	parser.add_argument('--sendif', nargs=1,
		required=True,
		help='The interface through which the packet will be sent')
	parser.add_argument('--recvif', nargs=1,
		required=True,
		help='The interface on which to check for the packet')
	parser.add_argument('--src', nargs=1,
		required=True,
		help='The source IP address')
	parser.add_argument('--to', nargs=1,
		required=True,
		help='The destination IP address')

	args = parser.parse_args()

        # Send the allowed packet to establish state
        udp = sp.Ether() / \
            sp.IP(src=args.src[0], dst=args.to[0]) / \
            sp.UDP(dport=53, sport=1234)
        sp.sendp(udp, iface=args.sendif[0], verbose=False)

	# Start sniffing on recvif
	sniffer = Sniffer(args, check_icmp_error)

	# Send the bad error packet
	icmp_reachable = sp.Ether() / \
            sp.IP(src=args.src[0], dst=args.to[0]) / \
	    sp.ICMP(type=3, code=3) / \
	    sp.IP(src=args.src[0], dst=args.to[0]) / \
	    sp.UDP(dport=53, sport=1234)
	sp.sendp(icmp_reachable, iface=args.sendif[0], verbose=False)

	sniffer.join()
	if sniffer.foundCorrectPacket:
		sys.exit(1)

	sys.exit(0)

if __name__ == '__main__':
	main()