sec_controller.py

# Copyright (C) 2011 Nippon Telegraph and Telephone Corporation.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#	http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied.
# See the License for the specific language governing permissions and
# limitations under the License.

from ryu.base import app_manager
from ryu.controller import ofp_event
from ryu.controller import dpset
from ryu.controller.handler import CONFIG_DISPATCHER, MAIN_DISPATCHER
from ryu.app.wsgi import ControllerBase, WSGIApplication, route
from ryu.controller.handler import set_ev_cls
from ryu.ofproto import ofproto_v1_3
from ryu.lib.packet import packet
from ryu.lib.packet import ethernet
from ryu.lib.packet import ether_types
from ryu.topology.api import get_switch, get_link, get_host, get_all_host
from ryu.topology import event, switches 
import networkx as nx
import json
import logging
import struct
from webob import Response
from ryu.lib.mac import haddr_to_bin
from ryu.lib.packet.packet import Packet
from ryu.lib.packet import arp
from ryu.lib.packet import ipv4
from ryu.lib.packet import tcp
from ryu.lib.packet import udp
from ryu.ofproto import ether
from ryu.app.ofctl.api import get_datapath

import msgpack
import hmac
import hashlib
import json
import socket
import hashlib
from scapy.all import Ether, IP, UDP, Raw
from os.path import expanduser


NUMBER_OF_SWITCH_PORTS = 3

conf_path = expanduser("~")+'/conf.json'


class ZodiacSwitch(app_manager.RyuApp):
    OFP_VERSIONS = [ofproto_v1_3.OFP_VERSION]
    _CONTEXTS = {'wsgi': WSGIApplication}

    def __init__(self, *args, **kwargs):
        super(ZodiacSwitch, self).__init__(*args, **kwargs)
        wsgi = kwargs['wsgi']
        self.topology_api_app = self
        self.net = nx.DiGraph()
        self.nodes = {}
        self.links = {}
        self.mac_to_port = {}
        self.mac_to_dpid = {}
        self.port_to_mac = {}
        self.ip_to_mac = {}
        self.port_occupied = {}
        self.GLOBAL_VARIABLE = 0

        # Define the margin for which the ctr is accepted
        self.ctr_margin = 5
        self.expected_ctr = 0
        self.client_shared_key = 0
         self.controller_shared_key = 0

         self.controller_mac = "4e:4e:4e:4e:4e:4e"
         self.controller_ip = "10.0.0.100"

         self.servers_ip = ['10.0.0.2']

         self.flows_expire_in = 30 # time taken to expire a flow (idle_timeout)

    @set_ev_cls(ofp_event.EventOFPSwitchFeatures, CONFIG_DISPATCHER)
    def switch_features_handler(self, ev):
        datapath = ev.msg.datapath
        ofproto = datapath.ofproto
        parser = datapath.ofproto_parser

        # install table-miss flow entry
        #
        # We specify NO BUFFER to max_len of the output action due to
        # OVS bug. At this moment, if we specify a lesser number, e.g.,
        # 128, OVS will send Packet-In with invalid buffer_id and
        # truncated packet data. In that case, we cannot output packets
        # correctly.  The bug has been fixed in OVS v2.1.0.
        match = parser.OFPMatch()
        actions = [parser.OFPActionOutput(ofproto.OFPP_CONTROLLER,
                                            ofproto.OFPCML_NO_BUFFER)]
        self.add_flow(datapath, 0, match, actions)

        # Send ARP Request to servers
        for server in self.servers_ip:
            self.send_arp(datapath, 1, self.controller_mac, self.controller_ip, 0, server, ofproto.OFPP_FLOOD)

    def add_flow(self, datapath, priority, match, actions, idle_timeout=0, buffer_id=None):
        ofproto = datapath.ofproto
        parser = datapath.ofproto_parser

        inst = [parser.OFPInstructionActions(ofproto.OFPIT_APPLY_ACTIONS,
                                                actions)]
        if buffer_id:
            mod = parser.OFPFlowMod(datapath=datapath, buffer_id=buffer_id,
                                    priority=priority, match=match, idle_timeout=idle_timeout,
                                    instructions=inst)
        else:
            mod = parser.OFPFlowMod(datapath=datapath, priority=priority, idle_timeout=idle_timeout,
                                    match=match, instructions=inst)
        datapath.send_msg(mod)

    def send_arp(self, datapath, opcode, srcMac, srcIp, dstMac, dstIp, outPort):
        # If it is an ARP request
        if opcode == 1:
            self.logger.info("\n[S"+str(datapath.id)+" SENT ARP REQUEST] From: " + srcIp + " Looking for: " + dstIp + "...\n")
            targetMac = "00:00:00:00:00:00"
            targetIp = dstIp
        # If it is an ARP reply
        elif opcode == 2:
            self.logger.info("\n[S"+str(datapath.id)+" SENT ARP REPLY] From: " + srcIp + " To: " + dstIp + "...\n")
            targetMac = dstMac
            targetIp = dstIp

        e = ethernet.ethernet(dstMac, srcMac, ether.ETH_TYPE_ARP)
        a = arp.arp(hwtype=1, proto=0x0800, hlen=6, plen=4, opcode=opcode, src_mac=srcMac, src_ip=srcIp, dst_mac=targetMac, dst_ip=targetIp)
        p = Packet()
        p.add_protocol(e)
        p.add_protocol(a)
        p.serialize()
    
        actions = [datapath.ofproto_parser.OFPActionOutput(outPort, 0)]
        out = datapath.ofproto_parser.OFPPacketOut(
                datapath=datapath,
                buffer_id=0xffffffff,
                in_port=datapath.ofproto.OFPP_CONTROLLER,
                actions=actions,
                data=p.data)
        datapath.send_msg(out)


    # Given the unpacked authentication message,
    # returns True if it is correct (it is a dict and contains at least the required fields),
    # False otherwise
    def is_req_auth_correct(self, auth_msg):
        correct = False
        
        expected_fields = set(['server', 'dport', 'ctr', 'tcp_udp', 'my_ip', 'hmac'])
        
        # check if it is a dictionary
        if type(auth_msg) is dict:
            # Check that it contains all the expected fields
            if expected_fields.issubset(auth_msg.keys()):
                correct = True

        return correct

    # Given the an auth request/reply message returns True if it is authenticated
    def is_msg_authenticated(self, rcv_message, hash_key):
        rcv_hmac = rcv_message['hmac']

        # Compute the HMAC of the modified authentication request (hmac=0)
        rcv_message['hmac'] = 0
        modified_json = msgpack.packb(rcv_message)
        print(hash_key.hexdigest())
        computed_hmac = hmac.new(key=hash_key.digest(), digestmod=hashlib.sha256)
        computed_hmac.update(modified_json)
        message_digest = computed_hmac.digest()

        # Compare the computed HMAC with the received one
        return hmac.compare_digest(rcv_hmac, message_digest)

    # Generate and returns an auth reply ready to be sent
    def make_auth_reply(self, code, expected_ctr, shared_key):
        # json request
        reply_data_dict = {
          'code': code,
          'expected_ctr': expected_ctr,
          'hmac': 0
        }

        # Serialize request_data_dict
        reply_data_raw = msgpack.packb(reply_data_dict)

        # Generate a message authentication code of request_data_raw based on 
        # the shared_key and secure hashing algorithm SHA256 using hmac module
        hmac1 = hmac.new(key=shared_key.digest(), digestmod=hashlib.sha256)
        hmac1.update(reply_data_raw)
        message_digest = hmac1.digest()
        
        # Insert the computed HMAC in hmac value of the request dictionary
        reply_data_dict['hmac'] = message_digest
        
        # Serialize request_data_dict with the updated HMAC
        auth_reply = msgpack.packb(reply_data_dict)
        
        return auth_reply


    @set_ev_cls(ofp_event.EventOFPPacketIn, MAIN_DISPATCHER)
    def _packet_in_handler(self, ev):
        # If you hit this you might want to increase
        # the "miss_send_length" of your switch
        if ev.msg.msg_len < ev.msg.total_len:
            self.logger.debug("packet truncated: only %s of %s bytes",
                        ev.msg.msg_len, ev.msg.total_len)
        msg = ev.msg
        datapath = msg.datapath
        ofproto = datapath.ofproto
        parser = datapath.ofproto_parser
        in_port = msg.match['in_port']

        pkt = packet.Packet(msg.data)
        eth = pkt.get_protocols(ethernet.ethernet)[0]

        if eth.ethertype == ether_types.ETH_TYPE_LLDP:
            # ignore lldp packet
            return
        dst = eth.dst
        src = eth.src
        dpid_src = datapath.id
        
        
        # TOPOLOGY DISCOVERY------------------------------------------

        switch_list = get_switch(self.topology_api_app, None)   
        switches=[switch.dp.id for switch in switch_list]
        if self.GLOBAL_VARIABLE == 0:
            for s in switches:
                for switch_port in range(1, NUMBER_OF_SWITCH_PORTS+1):
                    self.port_occupied.setdefault(s, {})
                    self.port_occupied[s][switch_port] = 0
        self.net.add_nodes_from(switches)
        links_list = get_link(self.topology_api_app, None)
        links=[(link.src.dpid,link.dst.dpid,{'port':link.src.port_no}) for link in links_list]
        self.net.add_edges_from(links)
        links=[(link.dst.dpid,link.src.dpid,{'port':link.dst.port_no}) for link in links_list]
        self.net.add_edges_from(links)
        links_=[(link.dst.dpid,link.src.dpid,link.dst.port_no) for link in links_list]
        for l in links_:
            if l[0] in self.port_occupied.keys():
                if l[2] in self.port_occupied[l[0]].keys():
                    self.port_occupied[l[0]][l[2]] = 1
            
    # MAC LEARNING-------------------------------------------------
        
        self.mac_to_port.setdefault(dpid_src, {})
        self.port_to_mac.setdefault(dpid_src, {})
        self.mac_to_port[dpid_src][src] = in_port
        self.mac_to_dpid[src] = dpid_src
        self.port_to_mac[dpid_src][in_port] = src

    # HANDLE ARP PACKETS--------------------------------------------
           
        if eth.ethertype == ether_types.ETH_TYPE_ARP:

            arp_packet = pkt.get_protocol(arp.arp)
            arp_dst_ip = arp_packet.dst_ip
            arp_src_ip = arp_packet.src_ip

            # self.logger.info("It is an ARP packet")	
            # If it is an ARP request
            if arp_packet.opcode == 1:
                self.logger.info("\n[S"+str(dpid_src)+" RCV ARP REQUEST] From: " + arp_src_ip + " Looking for: " + arp_dst_ip + "...\n")

                # if sent by controller itself drop
                if arp_src_ip == self.controller_ip:
                    return

                if arp_dst_ip == self.controller_ip:
                    srcIp = arp_dst_ip
                    dstIp = arp_src_ip
                    srcMac = self.controller_mac
                    dstMac = src
                    outPort = in_port
                    opcode = 2

                    self.send_arp(datapath, opcode, srcMac, srcIp, dstMac, dstIp, outPort)

                elif arp_dst_ip in self.ip_to_mac:
                    # self.logger.info("The address is inside the IP TO MAC table")
                    srcIp = arp_dst_ip
                    dstIp = arp_src_ip
                    srcMac = self.ip_to_mac[arp_dst_ip]
                    dstMac = src
                    outPort = in_port
                    opcode = 2
                    self.send_arp(datapath, opcode, srcMac, srcIp, dstMac, dstIp, outPort)
                    # self.logger.info("packet in %s %s %s %s", srcMac, srcIp, dstMac, dstIp)
                else:
                    # self.logger.info("The address is NOT inside the IP TO MAC table")
                    srcIp = arp_src_ip
                    dstIp = arp_dst_ip
                    srcMac = src
                    dstMac = dst
                    # learn the new IP address
                    self.ip_to_mac.setdefault(srcIp, {})
                    self.ip_to_mac[srcIp] = srcMac
                    # Send and ARP request to all the switches
                    opcode = 1
                    for id_switch in switches:
                        #if id_switch != dpid_src:
                        datapath_dst = get_datapath(self, id_switch)
                        for po in range(1,len(self.port_occupied[id_switch])+1):
                            if self.port_occupied[id_switch][po] == 0:
                                outPort = po
                                if id_switch == dpid_src:
                                    if outPort != in_port:
                                        self.send_arp(datapath_dst, opcode, srcMac, srcIp, dstMac, dstIp, outPort)
                                else:
                                    self.send_arp(datapath_dst, opcode, srcMac, srcIp, dstMac, dstIp, outPort)
    
            else: # ARP REPLY
                self.logger.info("\n[S"+str(dpid_src)+" RCV ARP REPLY] From: " + arp_src_ip + "\n")

                srcIp = arp_src_ip
                dstIp = arp_dst_ip
                srcMac = src
                dstMac = dst
                if arp_dst_ip in self.ip_to_mac:
                    # learn the new IP address
                    self.ip_to_mac.setdefault(srcIp, {})
                    self.ip_to_mac[srcIp] = srcMac
                            # Send and ARP reply to the switch
                opcode = 2
                outPort = self.mac_to_port[self.mac_to_dpid[dstMac]][dstMac]
                datapath_dst = get_datapath(self, self.mac_to_dpid[dstMac])
                self.send_arp(datapath_dst, opcode, srcMac, srcIp, dstMac, dstIp, outPort)
                     
                   
        # HANDLE IP PACKETS-----------------------------------------------
            
        ip4_pkt = pkt.get_protocol(ipv4.ipv4)
        if ip4_pkt:


            src_ip = ip4_pkt.src
            dst_ip = ip4_pkt.dst
            src_MAC = src
            dst_MAC = dst

            # Learn IP to MAC association of the src
            self.ip_to_mac[ip4_pkt.src] = src

            proto  = str(ip4_pkt.proto)
            sport = "0"
            dport = "0" 
            if proto == "6":
                tcp_pkt = pkt.get_protocol(tcp.tcp)
                sport = str(tcp_pkt.src_port)
                dport = str(tcp_pkt.dst_port)
                   
            if proto == "17":
                udp_pkt = pkt.get_protocol(udp.udp)
                sport = str(udp_pkt.src_port)
                dport = str(udp_pkt.dst_port)
                    
            self.logger.info("Packet in switch: %s, source IP: %s, destination IP: %s, From the port: %s", dpid_src, src_ip, dst_ip, in_port)
            # self.logger.info("Packet in switch: %s, source MAC: %s, destination MAC: %s, From the port: %s", dpid_src, src, dst, in_port)
            
            # --------------------------------------------------------------------- AUTH CONTROL ---
            authorised = False
            if src_ip not in self.servers_ip and proto == "17":
                auth_request = pkt.protocols[-1]

                # ----- Analyze the received packet -----
                # Unpack the received auth message
                unpacked_auth_request = msgpack.unpackb(auth_request)

                # Check its correctness (it is a json with all the required fields)
                correct = self.is_req_auth_correct(unpacked_auth_request)

                

                rcv_ctr = unpacked_auth_request['ctr']

                if correct:
                    authenticated = self.is_msg_authenticated(unpacked_auth_request, client_shared_key)
                    if authenticated:
                        print('Authenticated message:')
                        #print("\t", unpacked_auth_request)
                        print(rcv_ctr, self.expected_ctr)
                        # Check if ctr is valid
                        if rcv_ctr in range(self.expected_ctr, self.expected_ctr + self.ctr_margin):
                            code = '202 Authentication Accepted'
                            self.expected_ctr = rcv_ctr + 1
                            authorised = True
                        else: # authenticated but not valid ctr -> not accepted
                            code = '449 Retry With'
                    else: # message not authenticated
                        code = '401 Unauthorized'
                else: # received message not correct 
                    code = '400 Bad Request'
                
                print('Code: {}'.format(code))    
                # ----- Send the auth reply -----
                # Generate auth reply
                auth_reply = self.make_auth_reply(code, self.expected_ctr, controller_shared_key)

                # Create the packet ready to be sent
                reply_pkt = Ether(src=dst, dst=src)/IP(src=dst_ip, dst=src_ip) / UDP(sport=int(dport), dport=int(sport)) / Raw(load=auth_reply)
                reply_pkt.build()
                # send the reply back to the client
                actions = [datapath.ofproto_parser.OFPActionOutput(in_port, 0)]
                out = datapath.ofproto_parser.OFPPacketOut(
                        datapath=datapath,
                        buffer_id=0xffffffff,
                        in_port=datapath.ofproto.OFPP_CONTROLLER,
                        actions=actions,
                        data=bytes(reply_pkt)
                        )
                
                datapath.send_msg(out)

            # Servers in the network are authorised to communicate
            if src_ip in self.servers_ip:
                print('Packet from server -> authorised')
                authorised = True

            # if authorised install the path
            if authorised:
                # if dst_MAC == 'ff:ff:ff:ff:ff:ff':
                # 	return
                try:
                    if src_ip not in self.servers_ip:
                        datapath_dst = get_datapath(self, self.mac_to_dpid[self.ip_to_mac[unpacked_auth_request['server']]])	
                        
                    else:
                        datapath_dst = get_datapath(self, self.mac_to_dpid[dst])	
                    
                except:
                    self.logger.info(" --- No informations on how to reach %s", unpacked_auth_request['server'])
                    return

                dpid_dst = datapath_dst.id				
                self.logger.info(" --- Destination present on switch: %s", dpid_dst)
                    
                # Shortest path computation
                path = nx.shortest_path(self.net,dpid_src,dpid_dst)
                self.logger.info(" --- Shortest path: %s", path)
                    
                # Set the flows for different cases
                if src_ip not in self.servers_ip:
                    dst_ip = unpacked_auth_request['server']
                    dst_MAC = self.ip_to_mac[unpacked_auth_request['server']]
                if len(path) == 1:
                    In_Port = self.mac_to_port[dpid_src][src]
                    Out_Port = self.mac_to_port[dpid_dst][dst_MAC]	
                    actions_1 = [datapath.ofproto_parser.OFPActionOutput(Out_Port)]
                    actions_2 = [datapath.ofproto_parser.OFPActionOutput(In_Port)]
                    # restrict the access only to specific port asked
                    if src_ip not in self.servers_ip:
                        if unpacked_auth_request['tcp_udp'] == 'tcp':
                            match_1 = parser.OFPMatch(in_port=In_Port, eth_dst=dst_MAC, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip, ip_proto=6, tcp_dst=unpacked_auth_request['dport'])
                            match_2 = parser.OFPMatch(in_port=Out_Port, eth_dst=src, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip, ip_proto=6, tcp_src=unpacked_auth_request['dport'])
                        else:
                            match_1 = parser.OFPMatch(in_port=In_Port, eth_dst=dst_MAC, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip, ip_proto=17, udp_dst=unpacked_auth_request['dport'])
                            match_2 = parser.OFPMatch(in_port=Out_Port, eth_dst=src, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip, ip_proto=17, udp_src=unpacked_auth_request['dport'])
                    else:
                        match_1 = parser.OFPMatch(in_port=In_Port, eth_dst=dst_MAC)
                        match_2 = parser.OFPMatch(in_port=Out_Port, eth_dst=src)
                    self.add_flow(datapath, 1, match_1, actions_1, idle_timeout=self.flows_expire_in)
                    self.add_flow(datapath, 1, match_2, actions_2, idle_timeout=self.flows_expire_in)

                    actions = [datapath.ofproto_parser.OFPActionOutput(Out_Port)]
                    data = msg.data
                    pkt = packet.Packet(data)
                    eth = pkt.get_protocols(ethernet.ethernet)[0]
                    # self.logger.info(" --- Changing destination mac to %s" % (eth.dst))
                    pkt.serialize()
                    out = datapath.ofproto_parser.OFPPacketOut(
                        datapath=datapath, buffer_id=0xffffffff, in_port=datapath.ofproto.OFPP_CONTROLLER,
                        actions=actions, data=pkt.data)
                    datapath.send_msg(out)
                                    
                elif len(path) >= 2:
                    datapath_src = get_datapath(self, path[0])
                    datapath_dst = get_datapath(self, path[len(path)-1])
                    dpid_src = datapath_src.id
                    #self.logger.info("dpid_src  %s", dpid_src)
                    dpid_dst = datapath_dst.id
                    #self.logger.info("dpid_dst  %s", dpid_dst)
                    In_Port_src = self.mac_to_port[dpid_src][src]
                    #self.logger.info("In_Port_src  %s", In_Port_src)
                    In_Port_dst = self.mac_to_port[dpid_dst][dst_MAC]
                    #self.logger.info("In_Port_dst  %s", In_Port_dst)
                    Out_Port_src = self.net[path[0]][path[1]]['port']
                    #self.logger.info("Out_Port_src  %s", Out_Port_src)
                    Out_Port_dst = self.net[path[len(path)-1]][path[len(path)-2]]['port']
                    #self.logger.info("Out_Port_dst  %s", Out_Port_dst)
                    
                    actions_1_src = [datapath.ofproto_parser.OFPActionOutput(Out_Port_src)]
                    # restrict the access only to specific port asked
                    if src_ip not in self.servers_ip:
                        if unpacked_auth_request['tcp_udp'] == 'tcp':
                            match_1_src = parser.OFPMatch(in_port=In_Port_src, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip, ip_proto=6, tcp_dst=unpacked_auth_request['dport'])
                        else:
                            match_1_src = parser.OFPMatch(in_port=In_Port_src, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip, ip_proto=17, udp_dst=unpacked_auth_request['dport'])
                    else:
                        match_1_src = parser.OFPMatch(in_port=In_Port_src, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip)
                    self.add_flow(datapath_src, 1, match_1_src, actions_1_src, idle_timeout=self.flows_expire_in)
                    
                    actions_2_src = [datapath.ofproto_parser.OFPActionOutput(In_Port_src)]
                    # restrict the access only to specific port asked
                    if src_ip not in self.servers_ip:
                        if unpacked_auth_request['tcp_udp'] == 'tcp':
                            match_2_src = parser.OFPMatch(in_port=Out_Port_src, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip, ip_proto=6, tcp_src=unpacked_auth_request['dport'])
                        else:
                            match_2_srcc = parser.OFPMatch(in_port=Out_Port_src, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip, ip_proto=17, udp_src=unpacked_auth_request['dport'])
                    else:
                        match_2_src = parser.OFPMatch(in_port=Out_Port_src, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip)
                    self.add_flow(datapath_src, 1, match_2_src, actions_2_src, idle_timeout=self.flows_expire_in)
                    self.logger.info("Install the flow on switch %s", path[0])
                    
                    actions_1_dst = [datapath.ofproto_parser.OFPActionOutput(Out_Port_dst)]
                    
                    match_1_dst = parser.OFPMatch(in_port=In_Port_dst, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip)
                    self.add_flow(datapath_dst, 1, match_1_dst, actions_1_dst, idle_timeout=self.flows_expire_in)
                    
                    actions_2_dst = [datapath.ofproto_parser.OFPActionOutput(In_Port_dst)]
                    match_2_dst = parser.OFPMatch(in_port=Out_Port_dst, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip)
                    self.add_flow(datapath_dst, 1, match_2_dst, actions_2_dst, idle_timeout=self.flows_expire_in)
                    self.logger.info("Install the flow on switch %s", path[len(path)-1])
                    
                    if len(path) > 2:
                        for i in range(1, len(path)-1):
                            self.logger.info("Install the flow on switch %s", path[i])
                            In_Port_temp = self.net[path[i]][path[i-1]]['port']
                            Out_Port_temp = self.net[path[i]][path[i+1]]['port']
                            dp = get_datapath(self, path[i])
                            actions_1 = [dp.ofproto_parser.OFPActionOutput(Out_Port_temp)]
                            actions_2 = [dp.ofproto_parser.OFPActionOutput(In_Port_temp)]
                            if src_ip not in self.servers_ip:
                                if unpacked_auth_request['tcp_udp'] == 'tcp':
                                    match_1 = parser.OFPMatch(in_port=In_Port_temp, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip, ip_proto=6, tcp_dst=unpacked_auth_request['dport'])
                                    match_2 = parser.OFPMatch(in_port=Out_Port_temp, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip, ip_proto=6, tcp_src=unpacked_auth_request['dport'])
                                else:
                                    match_1 = parser.OFPMatch(in_port=In_Port_temp, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip, ip_proto=17, udp_dst=unpacked_auth_request['dport'])
                                    match_2 = parser.OFPMatch(in_port=Out_Port_temp, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip, ip_proto=17, udp_src=unpacked_auth_request['dport'])

                            else:
                                match_1 = parser.OFPMatch(in_port=In_Port_temp, eth_type = 0x0800, ipv4_src=src_ip, ipv4_dst=dst_ip)
                                match_2 = parser.OFPMatch(in_port=Out_Port_temp, eth_type = 0x0800, ipv4_src=dst_ip, ipv4_dst=src_ip)
                            self.add_flow(dp, 1, match_1, actions_1, idle_timeout=self.flows_expire_in)
                            self.add_flow(dp, 1, match_2, actions_2, idle_timeout=self.flows_expire_in)

                # Send the packet to the original switch if coming from server
                if src_ip in self.servers_ip:
                    path_port = self.net[path[0]][path[1]]['port']
                    actions = [datapath.ofproto_parser.OFPActionOutput(path_port)]
                    data = msg.data
                    pkt = packet.Packet(data)
                    eth = pkt.get_protocols(ethernet.ethernet)[0]
                    # change the mac address of packet
                    eth.src = self.ip_to_mac[src_ip] 
                    eth.dst = self.ip_to_mac[dst_ip] 
                    # self.logger.info(" --- Changing destination mac to %s" % (eth.dst))
                    pkt.serialize()
                    out = datapath.ofproto_parser.OFPPacketOut(
                    datapath=datapath, buffer_id=0xffffffff, in_port=datapath.ofproto.OFPP_CONTROLLER,
                        actions=actions, data=pkt.data)
                    datapath.send_msg(out)

                else:
                    if not authorised:
                        self.logger.info("Packet not authorised from %s to %s", src_ip, dst_ip)


    @set_ev_cls(event.EventSwitchEnter)
    def get_topology_data(self, ev):
        switch_list = get_switch(self.topology_api_app, None)
        switches=[switch.dp.id for switch in switch_list]
        self.net.add_nodes_from(switches)
        links_list = get_link(self.topology_api_app, None)
        links=[(link.src.dpid,link.dst.dpid,{'port':link.src.port_no}) for link in links_list]
        self.net.add_edges_from(links)
        links=[(link.dst.dpid,link.src.dpid,{'port':link.dst.port_no}) for link in links_list]
        self.net.add_edges_from(links)	
        

app_manager.require_app('ryu.app.ws_topology')
app_manager.require_app('ryu.app.ofctl_rest')
app_manager.require_app('ryu.app.gui_topology.gui_topology')	


# Get master key and counter values from conf.json
with open(conf_path, 'r') as config_file:
    config_json = json.load(config_file)
    master_key = config_json["master_key"]
    expected_ctr = config_json["next_ctr"]

# Get shared keys from master key
client_shared_key = hashlib.sha256(str.encode(str(master_key+'0')))
controller_shared_key = hashlib.sha256(str.encode(str(master_key+'1')))
print("Obtained the following shared keys:\n\tclient {}\n\tcontroller {}".format(client_shared_key.hexdigest(), controller_shared_key.hexdigest()))