Verify OpenFlow version number in vconn_recv().

diff --git a/lib/vconn.c b/lib/vconn.c
index 69fe7f8ec6de1d5f6a155ec7450b552bfce73a35..99a2eb016062390c14eaf78789121a9febb7ff5a 100644 (file)
--- a/lib/vconn.c
+++ b/lib/vconn.c
@@ -266,10 +266,24 @@ vconn_recv(struct vconn *vconn, struct buffer **msgp)
     int retval = vconn_connect(vconn);
     if (!retval) {
         retval = (vconn->class->recv)(vconn, msgp);
-        if (VLOG_IS_DBG_ENABLED() && !retval) {
-            char *s = ofp_to_string((*msgp)->data, (*msgp)->size, 1);
-            VLOG_DBG("received: %s", s);
-            free(s);
+        if (!retval) {
+            struct ofp_header *oh;
+
+            if (VLOG_IS_DBG_ENABLED()) {
+                char *s = ofp_to_string((*msgp)->data, (*msgp)->size, 1);
+                VLOG_DBG("received: %s", s);
+                free(s);
+            }
+
+            oh = buffer_at_assert(*msgp, 0, sizeof *oh);
+            if (oh->version != OFP_VERSION) {
+                VLOG_ERR("received OpenFlow version %02"PRIx8" "
+                         "!= expected %02x",
+                         oh->version, OFP_VERSION);
+                buffer_delete(*msgp);
+                *msgp = NULL;
+                return EPROTO;
+            }
         }
     }
     if (retval) {

diff --git a/switch/datapath.c b/switch/datapath.c
index fb688af60e2bfb3c13c987e2b69e38e3246f7b55..505ebf326b1245239771481a1f00c8028503fe60 100644 (file)
--- a/switch/datapath.c
+++ b/switch/datapath.c
@@ -1522,8 +1522,8 @@ fwd_control_input(struct datapath *dp, const struct sender *sender,
     struct ofp_header *oh;
 
     oh = (struct ofp_header *) msg;
-    if (oh->version != OFP_VERSION || oh->type >= ARRAY_SIZE(packets)
-        || ntohs(oh->length) > length)
+    assert(oh->version == OFP_VERSION);
+    if (oh->type >= ARRAY_SIZE(packets) || ntohs(oh->length) > length)
         return -EINVAL;
 
     pkt = &packets[oh->type];