scapy icon indicating copy to clipboard operation
scapy copied to clipboard

IKEv2_Notify Redirect - Wrong Condition for IPv6 Address

Open Hitalot opened this issue 1 year ago • 1 comments

Brief description

Heyho, long time scapy user but first created issue ever so i hope there no mistakes / missing informations.

In the actual implementation of the IKEv2_Notify Class. There is a bug when it comes to dissecting REDIRECT Payloads. MultipleTypeField( [ (IPField("gw_id", "127.0.0.1"), lambda x: x.gw_id_type == 1), (IP6Field("gw_id", "::1"), lambda x: x.gw_id_type == 5), ], StrLenField("gw_id", "", length_from=lambda x: x.gw_id_len)

The gw_id_type == 5 should be == 2. See https://datatracker.ietf.org/doc/html/rfc5685 Section 9.

Should i open a PR for that?

Scapy version

master

Python version

All

Operating system

All

Additional environment information

No response

How to reproduce

Just build a packet in binary and try to dissect it in scapy. from scapy.contrib.ikev2 import IKEv2_Notify h = bytes.fromhex("0000003a000040170210fc000db900000000000000000000000313448ab286ac526e8eb501547cd666d36eaa030dd812bbd8a03b043b6c6bc95c") IKEv2_Notify(h).show()

Actual result

###[ IKEv2 Notify ]### next_payload= None flags = length = 58 proto = Reserved SPIsize = 0 type = REDIRECT SPI = gw_id_type= IPv6_addr gw_id_len = 16 gw_id = b'\xfc\x00\r\xb9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03' nonce = 13448ab286ac526e8eb501547cd666d36eaa030dd812bbd8a03b043b6c6bc95c

Expected result

from scapy.contrib.ikev2 import IKEv2_Notify h = bytes.fromhex("0000003a000040170210fc000db900000000000000000000000313448ab286ac526e8eb501547cd666d36eaa030dd812bbd8a03b043b6c6bc95c") IKEv2_Notify(h).show() ###[ IKEv2 Notify ]### next_payload= None flags = length = 58 proto = Reserved SPIsize = 0 type = REDIRECT SPI = gw_id_type= IPv6_addr gw_id_len = 16 gw_id = fc00:db9::3 nonce = 13448ab286ac526e8eb501547cd666d36eaa030dd812bbd8a03b043b6c6bc95c

Related resources

No response

Hitalot avatar Jul 31 '24 13:07 Hitalot

You appear to be correct, thanks for the report ! Feel free to open a PR yeah :P

gpotter2 avatar Jul 31 '24 17:07 gpotter2