[ovs-git] [openvswitch/ovs] 2577b9: mac-learning: Implement per-port MAC learning fair...

[GitHub]

  Branch: refs/heads/branch-2.0
  Home:   https://github.com/openvswitch/ovs
  Commit: 2577b9346b9b77feb94b34398b54b8f19fcff4bd
      https://github.com/openvswitch/ovs/commit/2577b9346b9b77feb94b34398b54b8f19fcff4bd
  Author: Ben Pfaff <blp at nicira.com>
  Date:   2015-02-13 (Fri, 13 Feb 2015)

  Changed paths:
    M AUTHORS
    M NEWS
    M lib/learning-switch.c
    M lib/mac-learning.c
    M lib/mac-learning.h
    M ofproto/ofproto-dpif-xlate.c
    M ofproto/ofproto-dpif.c
    M tests/ofproto-dpif.at

  Log Message:
  -----------
  mac-learning: Implement per-port MAC learning fairness.

In "MAC flooding", an attacker transmits an overwhelming number of frames
with unique Ethernet source address on a switch port.  The goal is to
force the switch to evict all useful MAC learning table entries, so that
its behavior degenerates to that of a hub, flooding all traffic.  In turn,
that allows an attacker to eavesdrop on the traffic of other hosts attached
to the switch, with all the risks that that entails.

Before this commit, the Open vSwitch "normal" action that implements its
standalone switch behavior (and that can be used by OpenFlow controllers
as well) was vulnerable to MAC flooding attacks.  This commit fixes the
problem by implementing per-port fairness for MAC table entries: when
the MAC table is at its maximum size, MAC table eviction always deletes an
entry from the port with the most entries.  Thus, MAC entries will never
be evicted from ports with only a few entries if a port with a huge number
of entries exists.

Controllers could introduce their own MAC flooding vulnerabilities into
OVS.  For a controller that adds destination MAC based flows to an OpenFlow
flow table as a reaction to "packet-in" events, such a bug, if it exists,
would be in the controller code itself and would need to be fixed in the
controller.  For a controller that relies on the Open vSwitch "learn"
action to add destination MAC based flows, Open vSwitch has existing
support for eviction policy similar to that implemented in this commit
through the "groups" column in the Flow_Table table documented in
ovs-vswitchd.conf.db(5); we recommend that users of "learn" not already
familiar with eviction groups to read that documentation.

In addition to implementation of per-port MAC learning fairness,
this commit includes some closely related changes:

    - Access to client-provided "port" data in struct mac_entry
      is now abstracted through helper functions, which makes it
      easier to ensure that the per-port data structures are maintained
      consistently.

    - The mac_learning_changed() function, which had become trivial,
      vestigial, and confusing, was removed.  Its functionality was folded
      into the new function mac_entry_set_port().

    - Many comments were added and improved; there had been a lot of
      comment rot in previous versions.

CERT: VU#784996
Reported-by: "Ronny L. Bull - bullrl" <bullrl at clarkson.edu>
Reported-at: http://www.irongeek.com/i.php?page=videos/derbycon4/t314-exploring-layer-2-network-security-in-virtualized-environments-ronny-l-bull-dr-jeanna-n-matthews
Signed-off-by: Ben Pfaff <blp at nicira.com>
Acked-by: Ethan Jackson <ethan at nicira.com>