ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=5269

        while rest:
            p, rest = OFPTableFeatureProp.parse(rest)
            props.append(p)
        table_features.properties = props

The rest variable here is obtained through the following code:

ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=139

class OFPHello(MsgBase):
...
    @classmethod
    def parser(cls, datapath, version, msg_type, msg_len, xid, buf):
        msg = super(OFPHello, cls).parser(datapath, version, msg_type,
                                          msg_len, xid, buf)

        offset = ofproto.OFP_HELLO_HEADER_SIZE

ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=3607

class OFPBucket(StringifyMixin):
    @classmethod
    def parser(cls, buf, offset):
        (len_, weight, watch_port, watch_group) = struct.unpack_from(
            ofproto.OFP_BUCKET_PACK_STR, buf, offset)
        ....
        while length < msg.len:

ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=4685

class OFPGroupDescStats(StringifyMixin):
    @classmethod
    def parser(cls, buf, offset):
    ....
        while length < stats.length:
            bucket = OFPBucket.parser(buf, offset)
            stats.buckets.append(bucket)

ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=4083

class OFPFlowStats(StringifyMixin):
        while inst_length > 0:
            inst = OFPInstruction.parser(buf, offset)
            instructions.append(inst)
            offset += inst.len
            inst_length -= inst.len

ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=3943

class OFPMultipartReply(MsgBase):
    _STATS_MSG_TYPES = {}
    ....
    @classmethod
    def parser(cls, datapath, version, msg_type, msg_len, xid, buf):
    ....
            while offset < msg_len:

ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=6026

class OFPPacketQueue(StringifyMixin):
....
    @classmethod
    def parser(cls, buf, offset):
    ....
        while length < len_:
 queue_prop = OFPQueueProp.parser(buf, offset)

ErodedElk

in /ryu/ofproto/ofproto_v1_3_parser.py about line=5269

        while rest:
            p, rest = OFPTableFeatureProp.parse(rest)
            props.append(p)
        table_features.properties = props

The rest variable here is obtained through the following code:

ErodedElk

CVE-2024-29461

Describe the bug

After the controller establishes a connection with the switch, if the malicious switch sets its datapath ID to be the same as the ID of the existing switch, the controller will disconnect the previous switch.

To Reproduce

Steps to reproduce the behavior:

ErodedElk

CVE-2024-28732

in /ryu/ofproto/ofproto_v1_3_parser.py about line=1050

class OFPFlowMod(MsgBase):
....
        while offset < msg_len:
            i = OFPInstruction.parser(buf, offset)
 instructions.append(i)