If ryu tries to parse segmented OF packets by the packet library,
the process becomes infinite loop, bacause Ryu tries to parse
OpenFlow header for the segmented packets,
which don't have OpenFlow header, they only have body.
This commit fixes this by stopping parsing OpenFlow header
when the result is invalid.
Signed-off-by: Satoshi Fujimoto <satoshi.fujimo...@gmail.com>
---
ryu/lib/packet/openflow.py | 2 ++
ryu/ofproto/ofproto_parser.py | 3 ++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/ryu/lib/packet/openflow.py b/ryu/lib/packet/openflow.py
index e211994..8dd12f3 100644
--- a/ryu/lib/packet/openflow.py
+++ b/ryu/lib/packet/openflow.py
@@ -46,6 +46,8 @@ class openflow(packet_base.PacketBase):
from ryu.ofproto import ofproto_protocol
(version, msg_type, msg_len, xid) = ofproto_parser.header(buf)
+ if version not in ofproto_protocol._versions or msg_len > len(buf):
+ raise struct.error
msg_parser = ofproto_parser._MSG_PARSERS.get(version)
if msg_parser is None:
diff --git a/ryu/ofproto/ofproto_parser.py b/ryu/ofproto/ofproto_parser.py
index e230055..1fb32e4 100644
--- a/ryu/ofproto/ofproto_parser.py
+++ b/ryu/ofproto/ofproto_parser.py
@@ -36,7 +36,8 @@ if six.PY3:
def header(buf):
- assert len(buf) >= ofproto_common.OFP_HEADER_SIZE
+ if len(buf) < ofproto_common.OFP_HEADER_SIZE:
+ raise struct.error
# LOG.debug('len %d bufsize %d', len(buf), ofproto.OFP_HEADER_SIZE)
return struct.unpack_from(ofproto_common.OFP_HEADER_PACK_STR,
six.binary_type(buf))
--
2.7.4
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Ryu-devel mailing list
Ryu-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ryu-devel
