[OPNFLWPLUG-559] Openflow allows semi-valid input before handshake completion

Mon, 27 Sep 2021 09:01:39 +0000

Usually, any violation of the "handshake order" is considered an attack attempt or invalid input and the protocol handler should immediately close the connection. This is the standard best practice (mostly for security reasons).

ODL Openflow does not comply to this best practice. If you send a message with valid framing before the HELLO + FEATURES handshake is complete the connection is not closed.

Example - send an Echo, PacketIn as a first message from switch before the FEATURES_REPLY. The controller will proceed oblivious to the fact that the client has obviously tried to feed garbage input.

OpenDaylight JIRA

[OPNFLWPLUG-559] Openflow allows semi-valid input before handshake completion