diff --git a/ryu/lib/packet/bgp.py b/ryu/lib/packet/bgp.py
index <HASH>..<HASH> 100644
--- a/ryu/lib/packet/bgp.py
+++ b/ryu/lib/packet/bgp.py
@@ -2661,11 +2661,12 @@ class _FlowSpecOperatorBase(_FlowSpecComponentBase):
         return cls(operator, value), rest
 
     def serialize_body(self):
-        length = (self.value.bit_length() + 7) // 8 or 1
-        self.operator |= int(math.log(length, 2)) << 4
+        byte_length = (self.value.bit_length() + 7) // 8 or 1
+        length = int(math.ceil(math.log(byte_length, 2)))
+        self.operator |= length << 4
         buf = struct.pack(self._OPE_PACK_STR, self.operator)
-        value_type = type_desc.IntDescr(length)
-        buf += struct.pack(self._VAL_PACK_STR % length,
+        value_type = type_desc.IntDescr(1 << length)
+        buf += struct.pack(self._VAL_PACK_STR % (1 << length),
                            value_type.from_user(self.value))
 
         return buf
packet/bgp: Properly calculate length for FlowSpec

RFC <I> says the 'len' field in numeric or bitmask operators
represents that the length of the value field is [1 << 'len'].
But, in serializing FlowSpec messages, the packet library uses
the `len` field as the length of the value field itself.
This patch fixes it to serialize FlowSpec messages properly.