Link regress/sys/netinet/frag to build. Get IPv4 and IPv6 fragment

tests into common shape.  Add some missing test cases.

29 files changed, 371 insertions, 113 deletions

diff --git a/regress/sys/netinet/Makefile b/regress/sys/netinet/Makefile
index 464b0fc946d..9ca134c9619 100644
--- a/regress/sys/netinet/Makefile
+++ b/regress/sys/netinet/Makefile
@@ -1,5 +1,5 @@
-#	$OpenBSD: Makefile,v 1.4 2017/02/06 21:56:19 bluhm Exp $
+#	$OpenBSD: Makefile,v 1.5 2017/09/07 19:00:26 bluhm Exp $
 
-SUBDIR =	arp autoport ipsec pmtu
+SUBDIR =	arp autoport frag ipsec pmtu
 
 .include <bsd.subdir.mk>
diff --git a/regress/sys/netinet/frag/frag.py b/regress/sys/netinet/frag/frag.py
index 9effca15ccc..17febd8f63e 100644
--- a/regress/sys/netinet/frag/frag.py
+++ b/regress/sys/netinet/frag/frag.py
@@ -16,10 +16,10 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:36])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:44])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_mf0long.py b/regress/sys/netinet/frag/frag_mf0long.py
index 6f45a27b8aa..c3a3b3782b0 100644
--- a/regress/sys/netinet/frag/frag_mf0long.py
+++ b/regress/sys/netinet/frag/frag_mf0long.py
@@ -3,7 +3,7 @@
 print "ping fragment that overlaps longer than the last fragment without MF"
 
 #      |---------|
-#           |XXXXXXXXX|
+#                |XXXX|
 # |----|
 
 import os
@@ -13,17 +13,17 @@ from scapy.all import *
 pid=os.getpid()
 eid=pid & 0xffff
 payload="ABCDEFGHIJKLMNOP"
-dummy="0123456701234567"
+dummy="01234567"
 packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=1)/ \
-    str(packet)[28:44])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    dummy)
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:28])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=1)/str(packet)[28:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=3)/dummy)
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:28])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_mf0middle.py b/regress/sys/netinet/frag/frag_mf0middle.py
index 012ed81e3d3..e8cf64fc755 100644
--- a/regress/sys/netinet/frag/frag_mf0middle.py
+++ b/regress/sys/netinet/frag/frag_mf0middle.py
@@ -18,12 +18,12 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:36])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=1)/ \
-    dummy)
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=1)/dummy)
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:44])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_mf0short.py b/regress/sys/netinet/frag/frag_mf0short.py
index 5ad6d3e703e..b072d596009 100644
--- a/regress/sys/netinet/frag/frag_mf0short.py
+++ b/regress/sys/netinet/frag/frag_mf0short.py
@@ -18,12 +18,12 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:52])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=1)/ \
-    dummy)
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:52])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=1)/dummy)
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_mf1end.py b/regress/sys/netinet/frag/frag_mf1end.py
index 446c3f9f03e..27713bba740 100644
--- a/regress/sys/netinet/frag/frag_mf1end.py
+++ b/regress/sys/netinet/frag/frag_mf1end.py
@@ -18,12 +18,12 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:44])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=1, \
-    flags='MF')/dummy)
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=1, flags='MF')/dummy)
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_opt.py b/regress/sys/netinet/frag/frag_opt.py
index 824b7481240..877b57f3bf2 100644
--- a/regress/sys/netinet/frag/frag_opt.py
+++ b/regress/sys/netinet/frag/frag_opt.py
@@ -2,8 +2,8 @@
 
 print "ping fragments with IP option"
 
-# |OOOO--------|
-#              |----|
+# OO|--------|
+#          OO|----|
 
 import os
 from addr import *
@@ -16,10 +16,10 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF',
-    options=IPOption_NOP())/str(packet)[20:36])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF', options=IPOption_NOP())/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2, options=IPOption_NOP())/str(packet)[36:44])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_overhead.py b/regress/sys/netinet/frag/frag_overhead.py
index dfcae30a02a..43cb8c1b7c5 100644
--- a/regress/sys/netinet/frag/frag_overhead.py
+++ b/regress/sys/netinet/frag/frag_overhead.py
@@ -21,7 +21,7 @@ fid=pid & 0xffff
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
     flags='MF')/str(packet)[20:28])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
-    flags='MF', frag=1)/str(packet)[28:36])
+    frag=1, flags='MF')/str(packet)[28:36])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
     frag=1)/(dummy+str(packet)[36:44]))
 eth=[]
diff --git a/regress/sys/netinet/frag/frag_overhead1.py b/regress/sys/netinet/frag/frag_overhead1.py
new file mode 100644
index 00000000000..d7ab1f17884
--- /dev/null
+++ b/regress/sys/netinet/frag/frag_overhead1.py
@@ -0,0 +1,55 @@
+#!/usr/local/bin/python2.7
+
+print "ping fragment head that overlaps the first fragment completely"
+
+# |---------|
+#      |XXXX|
+#           |----|
+
+import os
+from addr import *
+from scapy.all import *
+
+pid=os.getpid()
+eid=pid & 0xffff
+payload="ABCDEFGHIJKLMNOP"
+dummy="01234567"
+packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
+    ICMP(type='echo-request', id=eid)/payload
+frag=[]
+fid=pid & 0xffff
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=1, flags='MF')/dummy)
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:44])
+eth=[]
+for f in frag:
+	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
+
+if os.fork() == 0:
+	time.sleep(1)
+	sendp(eth, iface=LOCAL_IF)
+	os._exit(0)
+
+ans=sniff(iface=LOCAL_IF, timeout=3, filter=
+    "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp")
+for a in ans:
+	if a and a.type == ETH_P_IP and \
+	    a.payload.proto == 1 and \
+	    a.payload.frag == 0 and a.payload.flags == 0 and \
+	    icmptypes[a.payload.payload.type] == 'echo-reply':
+		id=a.payload.payload.id
+		print "id=%#x" % (id)
+		if id != eid:
+			print "WRONG ECHO REPLY ID"
+			exit(2)
+		data=a.payload.payload.payload.load
+		print "payload=%s" % (data)
+		if data == payload:
+			exit(0)
+		print "PAYLOAD!=%s" % (payload)
+		exit(1)
+print "NO ECHO REPLY"
+exit(2)
diff --git a/regress/sys/netinet/frag/frag_overtail.py b/regress/sys/netinet/frag/frag_overtail.py
index 06175e45f6d..1052aa32e38 100644
--- a/regress/sys/netinet/frag/frag_overtail.py
+++ b/regress/sys/netinet/frag/frag_overtail.py
@@ -21,7 +21,7 @@ fid=pid & 0xffff
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
     frag=2)/str(packet)[36:44])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
-    flags='MF', frag=1)/dummy)
+    frag=1, flags='MF')/dummy)
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
     flags='MF')/str(packet)[20:36])
 eth=[]
diff --git a/regress/sys/netinet/frag/frag_overtail1.py b/regress/sys/netinet/frag/frag_overtail1.py
new file mode 100644
index 00000000000..8f37e350ca4
--- /dev/null
+++ b/regress/sys/netinet/frag/frag_overtail1.py
@@ -0,0 +1,55 @@
+#!/usr/local/bin/python2.7
+
+print "ping fragment tail that overlaps the first fragment completely"
+
+#      |---------|
+#      |XXXX|
+# |----|
+
+import os
+from addr import *
+from scapy.all import *
+
+pid=os.getpid()
+eid=pid & 0xffff
+payload="ABCDEFGHIJKLMNOP"
+dummy="01234567"
+packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
+    ICMP(type='echo-request', id=eid)/payload
+frag=[]
+fid=pid & 0xffff
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=1)/str(packet)[28:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=1, flags='MF')/dummy)
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:28])
+eth=[]
+for f in frag:
+	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
+
+if os.fork() == 0:
+	time.sleep(1)
+	sendp(eth, iface=LOCAL_IF)
+	os._exit(0)
+
+ans=sniff(iface=LOCAL_IF, timeout=3, filter=
+    "ip and src "+REMOTE_ADDR+" and dst "+LOCAL_ADDR+" and icmp")
+for a in ans:
+	if a and a.type == ETH_P_IP and \
+	    a.payload.proto == 1 and \
+	    a.payload.frag == 0 and a.payload.flags == 0 and \
+	    icmptypes[a.payload.payload.type] == 'echo-reply':
+		id=a.payload.payload.id
+		print "id=%#x" % (id)
+		if id != eid:
+			print "WRONG ECHO REPLY ID"
+			exit(2)
+		data=a.payload.payload.payload.load
+		print "payload=%s" % (data)
+		if data == payload:
+			exit(0)
+		print "PAYLOAD!=%s" % (payload)
+		exit(1)
+print "NO ECHO REPLY"
+exit(2)
diff --git a/regress/sys/netinet/frag/frag_padding.py b/regress/sys/netinet/frag/frag_padding.py
index 8fc2af0932c..f6117ff7afb 100644
--- a/regress/sys/netinet/frag/frag_padding.py
+++ b/regress/sys/netinet/frag/frag_padding.py
@@ -17,10 +17,10 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:36])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:44])
 eth=[]
 for f in frag:
 	pkt=str(f) + padding
diff --git a/regress/sys/netinet/frag/frag_permute.py b/regress/sys/netinet/frag/frag_permute.py
index 0596a231e08..d3a1cc02efc 100644
--- a/regress/sys/netinet/frag/frag_permute.py
+++ b/regress/sys/netinet/frag/frag_permute.py
@@ -27,11 +27,11 @@ for p in permute:
 	    ICMP(type='echo-request', id=eid)/payload
 	frag=[]
 	fid=pid & 0xffff
-	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, \
+	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
 	    flags='MF')/str(packet)[20:28])
-	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, \
-	    flags='MF', frag=1)/str(packet)[28:36])
-	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, \
+	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+	    frag=1, flags='MF')/str(packet)[28:36])
+	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
 	    frag=2)/str(packet)[36:48])
 	eth=[]
 	for i in range(3):
diff --git a/regress/sys/netinet/frag/frag_refrag.py b/regress/sys/netinet/frag/frag_refrag.py
index 519cbb7a1c5..2fdff6d0e09 100644
--- a/regress/sys/netinet/frag/frag_refrag.py
+++ b/regress/sys/netinet/frag/frag_refrag.py
@@ -27,11 +27,11 @@ offset=2
 chunk=4
 while 40+8*(offset+chunk) < len(payload):
 	frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
-	    flags='MF', frag=offset)/
+	    frag=offset, flags='MF')/
 	    str(packet)[20+(8*offset):20+8*(offset+chunk)])
 	offset+=chunk
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=offset)/
-    str(packet)[20+(8*offset):])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+	frag=offset)/str(packet)[20+(8*offset):])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_timeout.py b/regress/sys/netinet/frag/frag_timeout.py
index 1ef9411d720..e33af304cc0 100644
--- a/regress/sys/netinet/frag/frag_timeout.py
+++ b/regress/sys/netinet/frag/frag_timeout.py
@@ -23,13 +23,13 @@ fid=pid & 0xffff
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
     flags='MF')/str(packet)[20:28])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
-    flags='MF', frag=1)/str(packet)[28:36])
+    frag=1, flags='MF')/str(packet)[28:36])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
-    flags='MF', frag=2)/str(packet)[36:44])
+    frag=2, flags='MF')/str(packet)[36:44])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
-    flags='MF', frag=3)/str(packet)[44:52])
+    frag=3, flags='MF')/str(packet)[44:52])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
-    flags='MF', frag=4)/str(packet)[52:60])
+    frag=4, flags='MF')/str(packet)[52:60])
 frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
     frag=5)/str(packet)[60:68])
 eth=[]
@@ -38,9 +38,9 @@ for f in frag:
 
 if os.fork() == 0:
 	time.sleep(1)
-        for e in eth:
-                sendp(e, iface=LOCAL_IF)
-                time.sleep(15)
+	for e in eth:
+		sendp(e, iface=LOCAL_IF)
+		time.sleep(15)
 	os._exit(0)
 
 ans=sniff(iface=LOCAL_IF, timeout=90, filter=
diff --git a/regress/sys/netinet/frag/frag_udpheader.py b/regress/sys/netinet/frag/frag_udpheader.py
index 8761810d55a..f187b1f92ab 100644
--- a/regress/sys/netinet/frag/frag_udpheader.py
+++ b/regress/sys/netinet/frag/frag_udpheader.py
@@ -19,10 +19,10 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     UDP(sport=uport, dport=7)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid, flags='MF')/ \
-    str(packet)[20:28])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid, frag=1)/ \
-    str(packet)[28:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid,
+    flags='MF')/str(packet)[20:28])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid,
+    frag=1)/str(packet)[28:44])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_udppayload.py b/regress/sys/netinet/frag/frag_udppayload.py
index f0ca45a60fe..97cc4eb3427 100644
--- a/regress/sys/netinet/frag/frag_udppayload.py
+++ b/regress/sys/netinet/frag/frag_udppayload.py
@@ -19,10 +19,10 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     UDP(sport=uport, dport=7)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid, flags='MF')/ \
-    str(packet)[20:36])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid, frag=2)/ \
-    str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid,
+    flags='MF')/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=17, id=fid,
+    frag=2)/str(packet)[36:44])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_zerofirst.py b/regress/sys/netinet/frag/frag_zerofirst.py
index 287e77f92a4..2a5991fd2db 100644
--- a/regress/sys/netinet/frag/frag_zerofirst.py
+++ b/regress/sys/netinet/frag/frag_zerofirst.py
@@ -17,11 +17,12 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF'))
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:36])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF'))
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:44])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet/frag/frag_zerosecond.py b/regress/sys/netinet/frag/frag_zerosecond.py
index d088a22ed95..4522ee2e435 100644
--- a/regress/sys/netinet/frag/frag_zerosecond.py
+++ b/regress/sys/netinet/frag/frag_zerosecond.py
@@ -17,11 +17,12 @@ packet=IP(src=LOCAL_ADDR, dst=REMOTE_ADDR)/ \
     ICMP(type='echo-request', id=eid)/payload
 frag=[]
 fid=pid & 0xffff
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF')/ \
-    str(packet)[20:36])
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, flags='MF'))
-frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid, frag=2)/ \
-    str(packet)[36:44])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF')/str(packet)[20:36])
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    flags='MF'))
+frag.append(IP(src=LOCAL_ADDR, dst=REMOTE_ADDR, proto=1, id=fid,
+    frag=2)/str(packet)[36:44])
 eth=[]
 for f in frag:
 	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/f)
diff --git a/regress/sys/netinet6/frag6/frag6_mf0long.py b/regress/sys/netinet6/frag6/frag6_mf0long.py
index e168c2d5118..b2dd9895b6e 100644
--- a/regress/sys/netinet6/frag6/frag6_mf0long.py
+++ b/regress/sys/netinet6/frag6/frag6_mf0long.py
@@ -3,7 +3,7 @@
 print "ping6 fragment that overlaps longer than the last fragment with m=0"
 
 #      |---------|
-#           |XXXXXXXXX|
+#                |XXXX|
 # |----|
 
 import os
@@ -19,8 +19,7 @@ packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
 frag=[]
 fid=pid & 0xffffffff
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/ \
-    (str(packet)+dummy)[56:72])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=3)/dummy)
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:48])
 eth=[]
 for f in frag:
diff --git a/regress/sys/netinet6/frag6/frag6_mf0short.py b/regress/sys/netinet6/frag6/frag6_mf0short.py
index 8db27c2b08d..a041abcac34 100644
--- a/regress/sys/netinet6/frag6/frag6_mf0short.py
+++ b/regress/sys/netinet6/frag6/frag6_mf0short.py
@@ -2,9 +2,9 @@
 
 print "ping6 fragment with m=0 that overlaps the last fragment at beginning"
 
-#      |---------|
-#      |XXXX|
-# |----|
+#           |---------|
+#      |XXXXXXXXX|
+# |---------|
 
 import os
 from addr import *
@@ -12,14 +12,14 @@ from scapy.all import *
 
 pid=os.getpid()
 eid=pid & 0xffff
-payload="ABCDEFGHIJKLMNOP"
+payload="ABCDEFGHIJKLMNOPQRSTUVWX"
 packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
     ICMPv6EchoRequest(id=eid, data=payload)
 frag=[]
 fid=pid & 0xffffffff
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/str(packet)[56:72])
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:56])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:48])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:56])
 eth=[]
 for f in frag:
 	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
diff --git a/regress/sys/netinet6/frag6/frag6_mf1end.py b/regress/sys/netinet6/frag6/frag6_mf1end.py
index 0edd4d1c235..bae5eed31ef 100644
--- a/regress/sys/netinet6/frag6/frag6_mf1end.py
+++ b/regress/sys/netinet6/frag6/frag6_mf1end.py
@@ -2,9 +2,9 @@
 
 print "ping6 fragment with mf=1 that overlaps fragment with mf=0 at the end"
 
-#      |---------|
-#           |XXXX|
-# |----|
+#           |----|
+#      |XXXXXXXXX|
+# |---------|
 
 import os
 from addr import *
@@ -17,9 +17,9 @@ packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
     ICMPv6EchoRequest(id=eid, data=payload)
 frag=[]
 fid=pid & 0xffffffff
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1, offset=2)/str(packet)[56:64])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:48])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/str(packet)[56:64])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/str(packet)[48:64])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:56])
 eth=[]
 for f in frag:
 	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
diff --git a/regress/sys/netinet6/frag6/frag6_overhead.py b/regress/sys/netinet6/frag6/frag6_overhead.py
index 8a9c23c961b..c42da517bf0 100644
--- a/regress/sys/netinet6/frag6/frag6_overhead.py
+++ b/regress/sys/netinet6/frag6/frag6_overhead.py
@@ -1,11 +1,10 @@
 #!/usr/local/bin/python2.7
 
-print "ping6 fragment that overlaps the second fragment with the head"
+print "ping6 fragment that overlaps the second fragment with its head"
 
 # |----|
 #      |----|
-#      |XXXXXXXXX|
-#           |----|
+#      |XXXX-----|
 
 import os
 from addr import *
@@ -14,15 +13,13 @@ from scapy.all import *
 pid=os.getpid()
 eid=pid & 0xffff
 payload="ABCDEFGHIJKLMNOP"
-dummy="0123456701234567"
 packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
     ICMPv6EchoRequest(id=eid, data=payload)
 frag=[]
 fid=pid & 0xffffffff
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:48])
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/str(packet)[48:56])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/dummy)
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/str(packet)[56:64])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
 eth=[]
 for f in frag:
 	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
diff --git a/regress/sys/netinet6/frag6/frag6_overhead0.py b/regress/sys/netinet6/frag6/frag6_overhead0.py
index 9e89165ed8f..190e9177bf8 100644
--- a/regress/sys/netinet6/frag6/frag6_overhead0.py
+++ b/regress/sys/netinet6/frag6/frag6_overhead0.py
@@ -1,10 +1,9 @@
 #!/usr/local/bin/python2.7
 
-print "ping6 fragment that overlaps the first fragment with the head"
+print "ping6 fragment that overlaps the first fragment with its head"
 
-# |--------|
-#      |XXXXXXXX|
-#          |----|
+# |---------|
+#      |XXXX-----|
 
 import os
 from addr import *
@@ -13,14 +12,12 @@ from scapy.all import *
 pid=os.getpid()
 eid=pid & 0xffff
 payload="ABCDEFGHIJKLMNOP"
-dummy="0123456701234567"
 packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
     ICMPv6EchoRequest(id=eid, data=payload)
 frag=[]
 fid=pid & 0xffffffff
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:56])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/dummy)
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/str(packet)[56:64])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
 eth=[]
 for f in frag:
 	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
diff --git a/regress/sys/netinet6/frag6/frag6_overhead1.py b/regress/sys/netinet6/frag6/frag6_overhead1.py
new file mode 100644
index 00000000000..31483b1f09d
--- /dev/null
+++ b/regress/sys/netinet6/frag6/frag6_overhead1.py
@@ -0,0 +1,52 @@
+#!/usr/local/bin/python2.7
+
+print "ping6 fragment head that overlaps the first fragment completely"
+
+# |---------|
+#      |XXXX|
+#           |----|
+
+import os
+from addr import *
+from scapy.all import *
+
+pid=os.getpid()
+eid=pid & 0xffff
+payload="ABCDEFGHIJKLMNOP"
+packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
+    ICMPv6EchoRequest(id=eid, data=payload)
+frag=[]
+fid=pid & 0xffffffff
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:56])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/str(packet)[48:56])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/str(packet)[56:64])
+eth=[]
+for f in frag:
+	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
+	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt)
+
+if os.fork() == 0:
+	time.sleep(1)
+	sendp(eth, iface=LOCAL_IF)
+	os._exit(0)
+
+ans=sniff(iface=LOCAL_IF, timeout=3, filter=
+    "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6")
+for a in ans:
+	if a and a.type == ETH_P_IPV6 and \
+	    ipv6nh[a.payload.nh] == 'ICMPv6' and \
+	    icmp6types[a.payload.payload.type] == 'Echo Reply':
+		id=a.payload.payload.id
+		print "id=%#x" % (id)
+		if id != eid:
+			print "WRONG ECHO REPLY ID"
+			exit(2)
+		data=a.payload.payload.data
+		print "payload=%s" % (data)
+		if data == payload:
+			print "ECHO REPLY"
+			exit(1)
+		print "PAYLOAD!=%s" % (payload)
+		exit(2)
+print "no echo reply"
+exit(0)
diff --git a/regress/sys/netinet6/frag6/frag6_overtail.py b/regress/sys/netinet6/frag6/frag6_overtail.py
index 44991e5d043..4c6dba0fa9d 100644
--- a/regress/sys/netinet6/frag6/frag6_overtail.py
+++ b/regress/sys/netinet6/frag6/frag6_overtail.py
@@ -1,10 +1,10 @@
 #!/usr/local/bin/python2.7
 
-print "ping6 fragment that overlaps the last fragment with the tail"
+print "ping6 fragment that overlaps the last fragment with its tail"
 
-#          |----|
-#      |XXXXXXXX|
-# |--------|
+#           |----|
+#      |XXXX|
+# |---------|
 
 import os
 from addr import *
@@ -13,13 +13,12 @@ from scapy.all import *
 pid=os.getpid()
 eid=pid & 0xffff
 payload="ABCDEFGHIJKLMNOP"
-dummy="0123456701234567"
 packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
     ICMPv6EchoRequest(id=eid, data=payload)
 frag=[]
 fid=pid & 0xffffffff
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/str(packet)[56:64])
-frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/dummy)
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/str(packet)[48:56])
 frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:56])
 eth=[]
 for f in frag:
diff --git a/regress/sys/netinet6/frag6/frag6_overtail0.py b/regress/sys/netinet6/frag6/frag6_overtail0.py
new file mode 100644
index 00000000000..a627fe9de3b
--- /dev/null
+++ b/regress/sys/netinet6/frag6/frag6_overtail0.py
@@ -0,0 +1,50 @@
+#!/usr/local/bin/python2.7
+
+print "ping6 fragment that overlaps the fist fragment with its tail"
+
+#      |XXXX-----|
+# |---------|
+
+import os
+from addr import *
+from scapy.all import *
+
+pid=os.getpid()
+eid=pid & 0xffff
+payload="ABCDEFGHIJKLMNOP"
+packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
+    ICMPv6EchoRequest(id=eid, data=payload)
+frag=[]
+fid=pid & 0xffffffff
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:56])
+eth=[]
+for f in frag:
+	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
+	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt)
+
+if os.fork() == 0:
+	time.sleep(1)
+	sendp(eth, iface=LOCAL_IF)
+	os._exit(0)
+
+ans=sniff(iface=LOCAL_IF, timeout=3, filter=
+    "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6")
+for a in ans:
+	if a and a.type == ETH_P_IPV6 and \
+	    ipv6nh[a.payload.nh] == 'ICMPv6' and \
+	    icmp6types[a.payload.payload.type] == 'Echo Reply':
+		id=a.payload.payload.id
+		print "id=%#x" % (id)
+		if id != eid:
+			print "WRONG ECHO REPLY ID"
+			exit(2)
+		data=a.payload.payload.data
+		print "payload=%s" % (data)
+		if data == payload:
+			print "ECHO REPLY"
+			exit(1)
+		print "PAYLOAD!=%s" % (payload)
+		exit(2)
+print "no echo reply"
+exit(0)
diff --git a/regress/sys/netinet6/frag6/frag6_overtail1.py b/regress/sys/netinet6/frag6/frag6_overtail1.py
new file mode 100644
index 00000000000..eb2460dc3c7
--- /dev/null
+++ b/regress/sys/netinet6/frag6/frag6_overtail1.py
@@ -0,0 +1,52 @@
+#!/usr/local/bin/python2.7
+
+print "ping6 fragment tail that overlaps the first fragment completely"
+
+#      |---------|
+#      |XXXX|
+# |----|
+
+import os
+from addr import *
+from scapy.all import *
+
+pid=os.getpid()
+eid=pid & 0xffff
+payload="ABCDEFGHIJKLMNOP"
+packet=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/ \
+    ICMPv6EchoRequest(id=eid, data=payload)
+frag=[]
+fid=pid & 0xffffffff
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1)/str(packet)[48:64])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/str(packet)[48:56])
+frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/str(packet)[40:48])
+eth=[]
+for f in frag:
+	pkt=IPv6(src=LOCAL_ADDR6, dst=REMOTE_ADDR6)/f
+	eth.append(Ether(src=LOCAL_MAC, dst=REMOTE_MAC)/pkt)
+
+if os.fork() == 0:
+	time.sleep(1)
+	sendp(eth, iface=LOCAL_IF)
+	os._exit(0)
+
+ans=sniff(iface=LOCAL_IF, timeout=3, filter=
+    "ip6 and src "+REMOTE_ADDR6+" and dst "+LOCAL_ADDR6+" and icmp6")
+for a in ans:
+	if a and a.type == ETH_P_IPV6 and \
+	    ipv6nh[a.payload.nh] == 'ICMPv6' and \
+	    icmp6types[a.payload.payload.type] == 'Echo Reply':
+		id=a.payload.payload.id
+		print "id=%#x" % (id)
+		if id != eid:
+			print "WRONG ECHO REPLY ID"
+			exit(2)
+		data=a.payload.payload.data
+		print "payload=%s" % (data)
+		if data == payload:
+			print "ECHO REPLY"
+			exit(1)
+		print "PAYLOAD!=%s" % (payload)
+		exit(2)
+print "no echo reply"
+exit(0)
diff --git a/regress/sys/netinet6/frag6/frag6_permute.py b/regress/sys/netinet6/frag6/frag6_permute.py
index f55c98220c4..de3973ef5ba 100644
--- a/regress/sys/netinet6/frag6/frag6_permute.py
+++ b/regress/sys/netinet6/frag6/frag6_permute.py
@@ -27,11 +27,11 @@ for p in permute:
 	    ICMPv6EchoRequest(id=eid, data=payload)
 	frag=[]
 	fid=pid & 0xffffffff
-	frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/ \
+	frag.append(IPv6ExtHdrFragment(nh=58, id=fid, m=1)/
 	    str(packet)[40:48])
-	frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/ \
+	frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=1, m=1)/
 	    str(packet)[48:56])
-	frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/ \
+	frag.append(IPv6ExtHdrFragment(nh=58, id=fid, offset=2)/
 	    str(packet)[56:64])
 	eth=[]
 	for i in range(3):