Skip to content

IP.fragment_by_list() crashes when payload is Data (protocol is None) #2095

@L1-0

Description

@L1-0

Configuration

impacket version: master (source)
Python version: 3.11.2
Target OS: Linux x86_64

Debug Output With Command String

python -c "import sys,traceback; sys.path.insert(0,'./'); from impacket.ImpactPacket import IP,Data; ip=IP(); ip.contains(Data(b'HELLO WORLD')); ip.fragment_by_list([8])"

Observed output:

Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "./impacket/ImpactPacket.py", line 985, in fragment_by_list
    ip.set_ip_p(proto)
  File "./impacket/ImpactPacket.py", line 1049, in set_ip_p
    self.set_byte(9, value)
TypeError: 'NoneType' object cannot be interpreted as an integer

PCAP

N/A

Additional context

Header.protocol defaults to None. Data inherits it, so self.child().protocol can be None, which then gets written into the IPv4 protocol field.

Suggested fix:
Fallback to the current IP header protocol when child protocol is missing:

if self.child() and getattr(self.child(), 'protocol', None) is not None:
    proto = self.child().protocol
else:
    proto = self.get_ip_p()

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions