Uploaded image for project: 'OpenFlowPlugin'
  1. OpenFlowPlugin
  2. OPNFLWPLUG-322

Need to close the ODL Denial of Service interface

    XMLWordPrintable

Details

    • Bug
    • Status: Resolved
    • Resolution: Done
    • None
    • None
    • General
    • None
    • Operating System: All
      Platform: All

    • 2429

    Description

      In some of my testing I've discovered an external message and code path that will cause ODL to fail. If left unfixed, I am concerned that this could be used for a Denial of Service attack

      Internally, we us 'monit' to ensure all core processes are up. The following line was added last month to our monit configuration:
      if failed host 127.0.0.1 with port 6653 type TCP for 3 times within 3 cycles then restart

      This line causes monit to connect to ODL (via the loop-back interface) and then disconnect. After this line was added, we discovered that our ODL installations would fail after a few days of running.

      I opened https://bugs.opendaylight.org/show_bug.cgi?id=2394 to track a specific problem associated with this (OFHandshake threads building up).

      When an external entity opens an OpenFlow connection, but does not complete the handshake, I see log messages along the lines of:

      2014-11-24 15:17:42.200 UTC [OFHandshake-7-0] WARN o.o.o.o.m.c.ErrorHandlerSimpleImpl - exception -> FIRST HELLO sending failed because of connection issue., session -> null
      org.opendaylight.openflowplugin.ConnectionException: FIRST HELLO sending failed because of connection issue.
      at org.opendaylight.openflowplugin.openflow.md.core.HandshakeManagerImpl.sendHelloMessage(HandshakeManagerImpl.java:297) ~[bundlefile:na]
      at org.opendaylight.openflowplugin.openflow.md.core.HandshakeManagerImpl.shake(HandshakeManagerImpl.java:95) ~[bundlefile:na]
      at org.opendaylight.openflowplugin.openflow.md.core.HandshakeStepWrapper.run(HandshakeStepWrapper.java:47) [bundlefile:na]
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_71]
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_71]
      at java.lang.Thread.run(Thread.java:745) [na:1.7.0_71]

      Resources are not freed and ODL eventually locks up.

      I've patched by code with my patch for 2394, but I am concerned that there are other code paths that I haven't investigated.

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            michal.rehak Michal Rehak
            jimw@a-bb.net Jim West
            Votes:
            0 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: