LOG = logging.getLogger('app.openstate.portknock')""" Last port is the one to be opened after knocking all the others """
port_list = [10, 11, 12, 13, 22]
final_port = port_list[-1]
second_last_port =  port_list[-2]LOG.info("Port knock sequence is %s" % port_list[0:-1])
LOG.info("Final port to open is %s" % port_list[-1])class OpenStatePortKnocking(app_manager.RyuApp):def __init__(self, *args, **kwargs):super(OpenStatePortKnocking, self).__init__(*args, **kwargs)@set_ev_cls(ofp_event.EventOFPSwitchFeatures, CONFIG_DISPATCHER)def switch_features_handler(self, ev):msg = ev.msgdatapath = msg.datapathLOG.info("Configuring switch %d..." % datapath.id)""" Set table 0 as stateful """req = osparser.OFPExpMsgConfigureStatefulTable(datapath=datapath,table_id=0,stateful=1)datapath.send_msg(req)""" Set lookup extractor = {ip_src} """req = osparser.OFPExpMsgKeyExtract(datapath=datapath,command=osproto.OFPSC_EXP_SET_L_EXTRACTOR,fields=[ofproto.OXM_OF_IPV4_SRC],table_id=0)datapath.send_msg(req)""" Set update extractor = {ip_src} (same as lookup) """req = osparser.OFPExpMsgKeyExtract(datapath=datapath,command=osproto.OFPSC_EXP_SET_U_EXTRACTOR,fields=[ofproto.OXM_OF_IPV4_SRC],table_id=0)datapath.send_msg(req)""" ARP packets flooding """match = ofparser.OFPMatch(eth_type=0x0806)actions = [ofparser.OFPActionOutput(ofproto.OFPP_FLOOD)]self.add_flow(datapath=datapath, table_id=0, priority=100,match=match, actions=actions)# 提前下发状态表""" Flow entries for port knocking """for i in range(len(port_list)):match = ofparser.OFPMatch(eth_type=0x0800, ip_proto=17,state=i, udp_dst=port_list[i])if port_list[i] != final_port and port_list[i] != second_last_port:# If state not OPEN, set state and drop (implicit)actions = [osparser.OFPExpActionSetState(state=i+1, table_id=0, idle_timeout=5)]        elif port_list[i] == second_last_port:# In the transaction to the OPEN state, the timeout is set to 10 secactions = [osparser.OFPExpActionSetState(state=i+1, table_id=0, idle_timeout=10)]else:actions = [ofparser.OFPActionOutput(2)]self.add_flow(datapath=datapath, table_id=0, priority=10,match=match, actions=actions)""" Get back to DEFAULT if wrong knock (UDP match, lowest priority) """match = ofparser.OFPMatch(eth_type=0x0800, ip_proto=17)actions = [osparser.OFPExpActionSetState(state=0, table_id=0)]self.add_flow(datapath=datapath, table_id=0, priority=0,match=match, actions=actions)""" Test port 1300, always forward on port 2 """match = ofparser.OFPMatch(eth_type=0x0800, ip_proto=17, udp_dst=1300)actions = [ofparser.OFPActionOutput(2)]self.add_flow(datapath=datapath, table_id=0, priority=10,match=match, actions=actions)def add_flow(self, datapath, table_id, priority, match, actions):inst = [ofparser.OFPInstructionActions(ofproto.OFPIT_APPLY_ACTIONS, actions)]mod = ofparser.OFPFlowMod(datapath=datapath, table_id=table_id,priority=priority, match=match, instructions=inst)datapath.send_msg(mod)

上面是用来进行端口学习的，乍看还是有点难懂。他最大的好处就是不用和控制器进行交互，提前预下发流表，然后在交换机内部根据状态信息进行学习。
重要的还是对状态表的查询和更新的理解。对每一条流有一个状态，流进入交换机会进行查询操作，查询字段为目的地址；查询到相应状态并进行匹配流表和实施action后，会进行更新操作，更新字段是源地址，也就是说对到来的数据会记录其IP与端口号（用状态表示）。
主要思想如下：
第一步：给所有的（假设n个）端口下发n+1个带状态的流表。如4口交换机则端口1就有生成5个匹配流表，匹配项为入端口号和state值，action为outport，出端口值就是非0的state值，state为0表示泛洪。
但交换机又是如何学习的呢，一条数据流进入，首先通过lookup查询当前流的状态，当没有学习到目的地址时，state值还是为0，泛洪。同时，因为update以源MAC地址更新，匹配到流表后会取出源MAC地址，更新state为进端口号，osparser.OFPExpActionSetState(state=i, table_id=0, hard_timeout=10)
所以下次当有该目的MAC地址来世，查询到的state也就是出端口号。设计的有点反常识，但还是证明stateful 数据平面确实是挺强大的，可以在交换机内部完成一些简单的操作。
stateful openflow 最大的问题就是需要下发的流表太多，在实际应用场景中会有很大的限制。