"""

Not strictly an ARP entry.

We use the port to determine which port to forward traffic out of.

We use the MAC to answer ARP replies.

We use the timeout so that if an entry is older than ARP_TIMEOUT, we

flood the ARP request rather than try to answer it ourselves.

"""

def __init__(self, port, mac):

self.timeout = time.time() + ARP_TIMEOUT

self.port = port

self.mac = mac

def __eq__(self, other):

if type(other) == tuple:

return (self.port, self.mac) == other

else:

return (self.port, self.mac) == (other.port, other.mac)

def __ne__(self, other):

return not self.__eq__(other)

def isExpired(self):

if self.port == of.OFPP_NONE: return False

def __init__(self, fakeways=[], arp_for_unknowns=False, wide=False):

# These are "fake gateways" -- we'll answer ARPs for them with MAC

# of the switch they're connected to.

self.fakeways = set(fakeways)

# If True, we create "wide" matches. Otherwise, we create "narrow"

# (exact) matches.

self.wide = wide

# If this is true and we see a packet for an unknown

# host, we'll ARP for it.

self.arp_for_unknowns = arp_for_unknowns

# (dpid,IP) -> expire_time

# We use this to keep from spamming ARPs

self.outstanding_arps = {}

# (dpid,IP) -> [(expire_time,buffer_id,in_port), ...]

# These are buffers we've gotten at this datapath for this IP which

# we can't deliver because we don't know where they go.

self.lost_buffers = {}

# For each switch, we map IP addresses to Entries

self.arpTable = {}

# This timer handles expiring stuff

self._expire_timer = Timer(5, self._handle_expiration, recurring=True)

core.listen_to_dependencies(self)

def _handle_expiration(self):

# Called by a timer so that we can remove old items.

empty = []

for k, v in self.lost_buffers.iteritems():

dpid, ip = k

for item in list(v):

expires_at, buffer_id, in_port = item

if expires_at < time.time():

# This packet is old. Tell this switch to drop it.

v.remove(item)

po = of.ofp_packet_out(buffer_id=buffer_id, in_port=in_port)

core.openflow.sendToDPID(dpid, po)

if len(v) == 0: empty.append(k)

# Remove empty buffer bins

for k in empty:

del self.lost_buffers[k]

def _send_lost_buffers(self, dpid, ipaddr, macaddr, port):

"""

We may have "lost" buffers -- packets we got but didn't know

where to send at the time. We may know now. Try and see.

"""

if (dpid, ipaddr) in self.lost_buffers:

# Yup!

bucket = self.lost_buffers[(dpid, ipaddr)]

del self.lost_buffers[(dpid, ipaddr)]

log.debug("Sending %i buffered packets to %s from %s"

% (len(bucket), ipaddr, dpid_to_str(dpid)))

for _, buffer_id, in_port in bucket:

po = of.ofp_packet_out(buffer_id=buffer_id, in_port=in_port)

po.actions.append(of.ofp_action_dl_addr.set_dst(macaddr))

po.actions.append(of.ofp_action_output(port=port))

core.openflow.sendToDPID(dpid, po)

def _handle_openflow_PacketIn(self, event):

global packets

global dpids

dpid = event.connection.dpid

inport = event.port

packet = event.parsed

if not packet.parsed:

log.warning("%i %i ignoring unparsed packet", dpid, inport)

return

if dpid not in self.arpTable:

# New switch -- create an empty table

self.arpTable[dpid] = {}

for fake in self.fakeways:

self.arpTable[dpid][IPAddr(fake)] = Entry(of.OFPP_NONE,

dpid_to_mac(dpid))

if packet.type == ethernet.LLDP_TYPE:

# Ignore LLDP packets

return

if isinstance(packet.next, ipv4):

print "dpid and port: (", event.connection.dpid, event.port, ")"

log.debug("%i %i IP %s => %s", dpid, inport,

packet.next.srcip, packet.next.dstip)

# ['frame.len', 'ip.hdr_len',

# 'ip.len', 'ip.flags.rb', 'ip.flags.df', 'p.flags.mf', 'ip.frag_offset',

# 'ip.ttl', 'ip.proto', 'tcp.srcport', 'tcp.dstport',

# 'tcp.len', 'tcp.ack', 'tcp.flags.res', 'tcp.flags.ns', 'tcp.flags.cwr',

# 'tcp.flags.ecn', 'tcp.flags.urg', 'tcp.flags.ack', 'tcp.flags.push',

# 'tcp.flags.reset', 'tcp.flags.syn', 'tcp.flags.fin', 'tcp.window_size',

# 'tcp.time_delta']

x_test = [len(packet), packet.next.hl, packet.next.iplen, 0, packet.next.flags == 1, packet.next.flags == 2,

packet.next.frag, packet.next.ttl, packet.next.protocol,

packet.next.next.srcport, packet.next.next.dstport, len(packet.next.next),

packet.next.next.ACK, 0, 0, 0, 0, 0,

packet.next.next.flags == 16, packet.next.next.flags == 8, packet.next.next.flags == 4,

packet.next.next.flags == 2,

packet.next.next.flags == 1, packet.next.next.win, 0]

defender = Detector()

packets.append(x_test)

dpids.append(event.connection.dpid)

if len(packets) >= 25:

normal = defender.predictResult(packets)

print "value: ", normal

if int(normal[0][0] + 0.5):

print '~~~~~~~~~~~~~~~~~~~~~~~~~~~~normal~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~'

packets.pop(0)

dpids.pop(0)

if not int(normal[0][0] + 0.5):

print '--------------- -------------------Warning!! DDoS detected! -----------------------------------------------'

print 'the prediction from LSTM DL model: ', normal[0][0], '(1: normal, 0: attack)'

print 'blocking the malicious attack.......................................'

print 'event.connection.dpid: ', event.connection.dpid

print '---------------------------------------------------------------------------------------------------------'

for i, dpid in enumerate(dpids):

# print "inport, dstport: ", packets[i][9], packets[i][10]

msg = of.ofp_packet_out(in_port=packets[i][9] + 25)

core.openflow.sendToDPID(dpid, msg)

packets.pop(0)

dpids.pop(0)

os._exit(0)

# Send any waiting packets...

self._send_lost_buffers(dpid, packet.next.srcip, packet.src, inport)

# Learn or update port/MAC info

if packet.next.srcip in self.arpTable[dpid]:

if self.arpTable[dpid][packet.next.srcip] != (inport, packet.src):

log.info("%i %i RE-learned %s", dpid, inport, packet.next.srcip)

if self.wide:

# Make sure we don't have any entries with the old info...

msg = of.ofp_flow_mod(command=of.OFPFC_DELETE)

msg.match.nw_dst = packet.next.srcip

msg.match.dl_type = ethernet.IP_TYPE

event.connection.send(msg)

else:

log.debug("%i %i learned %s", dpid, inport, packet.next.srcip)

self.arpTable[dpid][packet.next.srcip] = Entry(inport, packet.src)

print "forwarding"

# Try to forward

dstaddr = packet.next.dstip

if dstaddr in self.arpTable[dpid]:

# We have info about what port to send it out on...

prt = self.arpTable[dpid][dstaddr].port

mac = self.arpTable[dpid][dstaddr].mac

if prt == inport:

log.warning("%i %i not sending packet for %s back out of the "

"input port" % (dpid, inport, dstaddr))

else:

log.debug("%i %i installing flow for %s => %s out port %i"

% (dpid, inport, packet.next.srcip, dstaddr, prt))

actions = []

actions.append(of.ofp_action_dl_addr.set_dst(mac))

actions.append(of.ofp_action_output(port=prt))

if self.wide:

match = of.ofp_match(dl_type=packet.type, nw_dst=dstaddr)

else:

match = of.ofp_match.from_packet(packet, inport)

msg = of.ofp_flow_mod(command=of.OFPFC_ADD,

idle_timeout=FLOW_IDLE_TIMEOUT,

hard_timeout=of.OFP_FLOW_PERMANENT,

buffer_id=event.ofp.buffer_id,

actions=actions,

match=match)

event.connection.send(msg.pack())

elif self.arp_for_unknowns:

# We don't know this destination.

# First, we track this buffer so that we can try to resend it later

# if we learn the destination, second we ARP for the destination,

# which should ultimately result in it responding and us learning

# where it is

# Add to tracked buffers

if (dpid, dstaddr) not in self.lost_buffers:

self.lost_buffers[(dpid, dstaddr)] = []

bucket = self.lost_buffers[(dpid, dstaddr)]

entry = (time.time() + MAX_BUFFER_TIME, event.ofp.buffer_id, inport)

bucket.append(entry)

while len(bucket) > MAX_BUFFERED_PER_IP: del bucket[0]

# Expire things from our outstanding ARP list...

self.outstanding_arps = {k: v for k, v in

self.outstanding_arps.iteritems() if v > time.time()}

# Check if we've already ARPed recently

if (dpid, dstaddr) in self.outstanding_arps:

# Oop, we've already done this one recently.

return

# And ARP...

self.outstanding_arps[(dpid, dstaddr)] = time.time() + 4

r = arp()

r.hwtype = r.HW_TYPE_ETHERNET

r.prototype = r.PROTO_TYPE_IP

r.hwlen = 6

r.protolen = r.protolen

r.opcode = r.REQUEST

r.hwdst = ETHER_BROADCAST

r.protodst = dstaddr

r.hwsrc = packet.src

r.protosrc = packet.next.srcip

e = ethernet(type=ethernet.ARP_TYPE, src=packet.src,

dst=ETHER_BROADCAST)

e.set_payload(r)

log.debug("%i %i ARPing for %s on behalf of %s" % (dpid, inport,

r.protodst, r.protosrc))

msg = of.ofp_packet_out()

msg.data = e.pack()

msg.actions.append(of.ofp_action_output(port=of.OFPP_FLOOD))

msg.in_port = inport

event.connection.send(msg)

elif isinstance(packet.next, arp):

a = packet.next

log.debug("%i %i ARP %s %s => %s", dpid, inport,

{arp.REQUEST: "request", arp.REPLY: "reply"}.get(a.opcode,

'op:%i' % (a.opcode,)), a.protosrc, a.protodst)

if a.prototype == arp.PROTO_TYPE_IP:

if a.hwtype == arp.HW_TYPE_ETHERNET:

if a.protosrc != 0:

# Learn or update port/MAC info

if a.protosrc in self.arpTable[dpid]:

if self.arpTable[dpid][a.protosrc] != (inport, packet.src):

log.info("%i %i RE-learned %s", dpid, inport, a.protosrc)

if self.wide:

# Make sure we don't have any entries with the old info...

msg = of.ofp_flow_mod(command=of.OFPFC_DELETE)

msg.match.dl_type = ethernet.IP_TYPE

msg.match.nw_dst = a.protosrc

event.connection.send(msg)

else:

log.debug("%i %i learned %s", dpid, inport, a.protosrc)

self.arpTable[dpid][a.protosrc] = Entry(inport, packet.src)

# Send any waiting packets...

self._send_lost_buffers(dpid, a.protosrc, packet.src, inport)

if a.opcode == arp.REQUEST:

# Maybe we can answer

if a.protodst in self.arpTable[dpid]:

# We have an answer...

if not self.arpTable[dpid][a.protodst].isExpired():

# .. and it's relatively current, so we'll reply ourselves

r = arp()

r.hwtype = a.hwtype

r.prototype = a.prototype

r.hwlen = a.hwlen

r.protolen = a.protolen

r.opcode = arp.REPLY

r.hwdst = a.hwsrc

r.protodst = a.protosrc

r.protosrc = a.protodst

r.hwsrc = self.arpTable[dpid][a.protodst].mac

e = ethernet(type=packet.type, src=dpid_to_mac(dpid),

dst=a.hwsrc)

e.set_payload(r)

log.debug("%i %i answering ARP for %s" % (dpid, inport,

r.protosrc))

msg = of.ofp_packet_out()

msg.data = e.pack()

msg.actions.append(of.ofp_action_output(port=

of.OFPP_IN_PORT))

msg.in_port = inport

event.connection.send(msg)

return

# Didn't know how to answer or otherwise handle this ARP, so just flood it

log.debug("%i %i flooding ARP %s %s => %s" % (dpid, inport,

{arp.REQUEST: "request", arp.REPLY: "reply"}.get(a.opcode,

'op:%i' % (

a.opcode,)),

a.protosrc, a.protodst))

msg = of.ofp_packet_out(in_port=inport, data=event.ofp,

action=of.ofp_action_output(port=of.OFPP_FLOOD))

fakeways = fakeways.replace(",", " ").split()

fakeways = [IPAddr(x) for x in fakeways]

if arp_for_unknowns is None:

arp_for_unknowns = len(fakeways) > 0

else:

arp_for_unknowns = str_to_bool(arp_for_unknowns)