Details
-
Bug
-
Status: Resolved
-
Resolution: Done
-
None
-
None
-
None
-
Operating System: All
Platform: All
-
2429
Description
In some of my testing I've discovered an external message and code path that will cause ODL to fail. If left unfixed, I am concerned that this could be used for a Denial of Service attack
Internally, we us 'monit' to ensure all core processes are up. The following line was added last month to our monit configuration:
if failed host 127.0.0.1 with port 6653 type TCP for 3 times within 3 cycles then restart
This line causes monit to connect to ODL (via the loop-back interface) and then disconnect. After this line was added, we discovered that our ODL installations would fail after a few days of running.
I opened https://bugs.opendaylight.org/show_bug.cgi?id=2394 to track a specific problem associated with this (OFHandshake threads building up).
When an external entity opens an OpenFlow connection, but does not complete the handshake, I see log messages along the lines of:
2014-11-24 15:17:42.200 UTC [OFHandshake-7-0] WARN o.o.o.o.m.c.ErrorHandlerSimpleImpl - exception -> FIRST HELLO sending failed because of connection issue., session -> null
org.opendaylight.openflowplugin.ConnectionException: FIRST HELLO sending failed because of connection issue.
at org.opendaylight.openflowplugin.openflow.md.core.HandshakeManagerImpl.sendHelloMessage(HandshakeManagerImpl.java:297) ~[bundlefile:na]
at org.opendaylight.openflowplugin.openflow.md.core.HandshakeManagerImpl.shake(HandshakeManagerImpl.java:95) ~[bundlefile:na]
at org.opendaylight.openflowplugin.openflow.md.core.HandshakeStepWrapper.run(HandshakeStepWrapper.java:47) [bundlefile:na]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) [na:1.7.0_71]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) [na:1.7.0_71]
at java.lang.Thread.run(Thread.java:745) [na:1.7.0_71]
Resources are not freed and ODL eventually locks up.
I've patched by code with my patch for 2394, but I am concerned that there are other code paths that I haven't investigated.