Scapy and DHCP security testing

Question

I got a question about Scapy in order with dhcp. There is no problem with sending a dhcp solicit message and got a answer but what i really need is to program:

1. Scapy sends a DHCP solicit packet
2. It receives an advertise packet, so far ok.
3. I need to send a request with some information that I got out of the advertise packet..

here is the part of the code, i hope you will understand it what im trying to achieve. (most irrelevant and the values not written here)

sol = DHCP6_Solicit()
opreq = DHCP6OptOptReq()
et= DHCP6OptElapsedTime()
cid = DHCP6OptClientId()
iana = DHCP6OptIA_NA()
optiana = DHCP6OptIAAddress()

l2 = Ether (src = RandMAC())
l3 = IPv6(dst= dstt, src=srcc)
addr = raw_input("Give Option Address: ")
optiana.addr = str(RandIP6(addr))
pkt = l2/l3/l4/sol/cid/opreq/et/iana/optiana
sendp(pkt, iface='eth0')

When I sent this solicit packet, I got a nice answer advertise of the dhcpv6 server. In the advertise pack you have, the binding initials, server-ID and some more.

(1) what I want is that, to use that information out of the advertise package, and put it in a request packet. But this all, in sort of a loop, so that it will be possible to BIND all the advertises I can send(like thousands). This also implies to the PrefixDelegation. Therefore, I can test the dhcp server for security reasons.

(2) when I add address to the IA_NA, I got a DHCP OPTION 0 after the IA_address in the Packet

http://i41.tinypic.com/154ulmp.png

What can I do about this? Because in a valid solicit message, we can see that the IA-address is inside the IA_NA.

I tried this also:

addr = raw_input("Give Option Address: ")
optiana.addr = str(RandIP6(addr))
optiana.preflft = 7200
optiana.validlft = 9200
iana.ianaopts = optiana 
pkt = l2/l3/l4/sol/cid/opreq/et/iana

But then there happends something with the packet, it adds, zeros at the end. http://i44.tinypic.com/2ih09k3.png

we can see here that scapy sends the packet, as it needs to send, right? http://i44.tinypic.com/309pohj.png

(3) One more thing: I think, there is something wrong with PD, because when I give options to a PD, like address, the package stops there(see that in wireshark) when I add other PD. But if I only add PD's without options, it works.

http://i41.tinypic.com/24zg390.png

code of PD

optiapd = DHCP6OptIA_PD()
iapd = DHCP6OptIAPrefix()
opreq = DHCP6OptOptReq()
et= DHCP6OptElapsedTime()
cid = DHCP6OptClientId()

l2 = Ether (src = RandMAC())
l3 = IPv6(dst= dstt, src=srcc)
addr = raw_input("Give Option Address: ")
iapd.prefix = str(RandIP6(addr))
pkt = l2/l3/l4/sol/cid/opreq/et/optiapd/iapd       # (adding more...../optiapd/iapd....wont work)
sendp(pkt, iface='eth0')

Also I came across DHCPv6_am(AnsweringMachine) in the /scapy/layers/dhcp6.py!!! How is it possible to use the reply mechanism for every packet when having all the packets in a array?

Answer 1

Problem(1) has been solved :)

I just wrote another script, that would sniff and read out the packets :) another way of doing this.

Problem(2)

After hours of testing, I came with the conclusion that the DHCP Option 0 will be there in Wireshark because:

DHCP6 IA Address Option, has a subvalue IA-ID. when i fill this in, i can see that it is the came of the value that comes in the DHCP option 0.

I think that this is some programming error in Scapy.

After a look in, RFC 3315 DHCP for IPv6 suboption 22.6 There is no IAID assigned to DHCP6 IA Address Option.

So what i did is just adjust and search for the line and commentated it out.

Problem (3)

Scapy is not Ready for PD, i think. After everything i try, it doesnt work.