hang when sending malformed event

[adferguson]

I attempted to send an event like this, thinking I needed a comma between different key=value pairs:

./notify.native atv_connect atv_mac=1, client_mac=3
Number args: 2
Arg: atv_mac -> 1,
Arg: client_mac -> 2
sending notification...

but that would hang, presumably waiting for a reply from FlowLog. FlowLog also seem to hang since later packet_in notifications did not trigger. FlowLog did seem to be processing properly:

received notification. type=atv_connect
atv_mac -> 1,
client_mac -> 3

(this was with -verbose 3) ... hence, I'm not sure where the bug was that caused FlowLog to hang. possibilities include the parser and XSB.

[tnelson]

My money is on XSB. Since comma is reserved, its probably throwing an error because it's receiving something like assert(atv_connect(1,,2)).

Likely we're missing a validation check in inc_event_to_formulas.

On Thu, Nov 7, 2013 at 4:46 PM, Andrew Ferguson notifications@github.comwrote:

I attempted to send an event like this, thinking I needed a comma between different key=value pairs:

./notify.native atv_connect atv_mac=1, client_mac=3 Number args: 2 Arg: atv_mac -> 1, Arg: client_mac -> 2 sending notification...

but that would hang, presumably waiting for a reply from FlowLog. FlowLog also seem to hang since later packet_in notifications did not trigger. FlowLog did seem to be processing properly:

received notification. type=atv_connect atv_mac -> 1, client_mac -> 3

(this was with -verbose 3) ... hence, I'm not sure where the bug was that caused FlowLog to hang. possibilities include the parser and XSB.

— Reply to this email directly or view it on GitHubhttps://github.com/tnelson/FlowLog/issues/23 .

[adferguson]

sounds plausible -- a bit like an SQL injection attack. :-)

would -verbose 10 cause me to see what is being sent to XSB in this case?

[adferguson]

more kinds of "malformed" input which we should handle properly:

./notify.native atv_connect atv_mac=2c:b4:3a:26:f5:f2 client_mac=b8:e8:56:1b:f7:02
./notify.native atv_connect atv_mac=0x2cb43a26f5f2 client_mac=0xb8e8561bf702

the only acceptable MAC address format turns out to be decimal :-(

./notify.native atv_connect atv_mac=49152581367282 client_mac=203308016596738