A pool-operator can cause a complete network denial of service on any OVS bridge by setting Network.other_config:vswitch-controller-fail-mode to "secure". In secure fail mode, OVS drops ALL packets when the SDN controller is unreachable. In the common case where no SDN controller is configured - which is the default for most XAPI deployments - this immediately drops all traffic on the bridge, affecting every VM and management connection on that network. The key has no map_keys_roles protection and requires a single API call with no validation.
Network.other_config is a Map(String, String) field writable by pool-operator. The vswitch-controller-fail-mode key controls how Open vSwitch handles the absence of an SDN controller. The value flows through XAPI via the openvswitch-config-update script to the OVS bridge configuration.
pool-operator calls Network.add_to_other_config(net, "vswitch-controller-fail-mode", "secure")
-> openvswitch-config-update reads Network.other_config
-> ovs-vsctl set-fail-mode <bridge> secure
-> OVS enters secure fail mode
-> No SDN controller configured (common case) -> ALL packets dropped
-> Complete network outage for all VMs and host management on the bridge
OVS supports two fail modes:
standalone (default): OVS acts as a normal learning switch when no controller is connectedsecure: OVS drops all traffic that does not match a flow rule installed by a controllerIn the common deployment scenario where no SDN controller exists, setting secure causes immediate and complete traffic loss on the bridge.
Missing RBAC protection. Network.other_config has zero map_keys_roles entries for infrastructure keys. The vswitch-controller-fail-mode key is writable by pool-operator.
Missing pre-condition validation. No check verifies that an SDN controller is actually configured before allowing secure fail mode. Setting secure without a controller is always destructive.
Immediate effect. The configuration change takes effect immediately on the OVS bridge - no confirmation, no grace period, no rollback mechanism.
| Scenario | Impact | Pre-conditions | Status |
|---|---|---|---|
| Per-network DoS | All traffic dropped on targeted bridge | OVS bridge, no SDN controller | Modeled (code-traced, OVS behavior confirmed) |
| Management network DoS | Host becomes unreachable | Management traffic on OVS bridge | Modeled |
| Storage network DoS | All VM I/O stops | Storage traffic on OVS bridge | Modeled |
| BOC-1 chain | vm-admin escalates to pool-operator via BOC-1 S3, then triggers OVS DoS | BOC-1 available | Modeled (two-step chain) |
Network.other_config for writes to vswitch-controller-fail-modevswitch-controller-fail-mode=secure when no SDN controller is configured for the poolovs-vsctl get-fail-mode <bridge> on all hostsdisclosure/vendor-detection-guidance.mdNetwork.other_config records for unexpected vswitch-controller-fail-mode valuespool-operator role to trusted administratorsRBAC restriction. Add map_keys_roles entry for vswitch-controller-fail-mode in datamodel.ml requiring _R_POOL_ADMIN.
Pre-condition validation. Before accepting secure fail mode, validate that an SDN controller is configured and reachable. Reject secure when no controller exists.
Upstream patches exist. They are held privately pending coordinated disclosure.
Disclosure:
openvswitch-config-update (fail mode application), datamodel.ml (Network field definition)disclosure/advisories/noc-security-advisory.md (NOC-2)research/investigations/network-other-config.mdDiscovered and reported by Jakob Wolffhechel, Moksha.