Skip to content

IP.fragment_by_list() crashes when payload is Data (protocol is None) #2095

@L1-0

Description

@L1-0

Configuration

impacket version: master (source)
Python version: 3.11.2
Target OS: Linux x86_64

Debug Output With Command String

python -c "import sys,traceback; sys.path.insert(0,'./'); from impacket.ImpactPacket import IP,Data; ip=IP(); ip.contains(Data(b'HELLO WORLD')); ip.fragment_by_list([8])"

Observed output:

Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "./impacket/ImpactPacket.py", line 985, in fragment_by_list
    ip.set_ip_p(proto)
  File "./impacket/ImpactPacket.py", line 1049, in set_ip_p
    self.set_byte(9, value)
TypeError: 'NoneType' object cannot be interpreted as an integer

PCAP

N/A

Additional context

Header.protocol defaults to None. Data inherits it, so self.child().protocol can be None, which then gets written into the IPv4 protocol field.

Suggested fix:
Fallback to the current IP header protocol when child protocol is missing:

if self.child() and getattr(self.child(), 'protocol', None) is not None:
    proto = self.child().protocol
else:
    proto = self.get_ip_p()

Metadata

Metadata

Labels

bugUnexpected problem or unintended behavior

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions