Open Daylight Controller with SSL and Mininet

May 8, 2014 Leave a comment

In a previous post, I discussed how to run Open vSwtich using SSL for the control traffic using Mininet and also how to start the Open vSwitch test controller (ovs-controller) to listen with SSL. In this post I show how to use Open Daylight as the controller using SSL.

First, go to ODL directory and create a directory we’ll work in. You could use the ‘configuration’ directory. I’m going to create a directory called ssl.

cd /home/odl/controller/opendaylight/distribution/opendaylight/target/distribution.opendaylight-osgipackage/opendaylight
mkdir ssl
cd ssl

Get keys and certs from Mininet VM described in other post and put them in your ssl directory.

Get the controller keys.
/etc/openvswitch/ctl-privkey.pem
/etc/openvswitch/ctl-cert.pem
Get the switch cacert.
/var/lib/openvswitch/pki/switchca/cacert.pem  -> and rename to sw-cacert.pem

Create controller key store for ODL using the keys.

cat ctl-privkey.pem ctl-cert.pem > ctl.pem
openssl pkcs12 -export -out ctl.p12 -in ctl.pem
  # when asked for passwords, just enter 'mininet', as an example.
keytool -importkeystore -srckeystore ctl.p12 -srcstoretype pkcs12 -destkeystore ctlKeyStore -deststoretype jks
  # when asked for passwords, just enter 'mininet', as an example.

Add switch CA to controller trust store.

keytool -import -alias swca1 -file sw-cacert.pem -keystore ctlTrustStore
  # when asked for passwords, just enter 'mininet', as an example.

Edit opendaylight/configuration/config.ini to enable SSL and set properties for store location and password.

secureChannelEnabled=true
controllerKeyStore=./ssl/ctlKeyStore
controllerKeyStorePassword=mininet
controllerTrustStore=./ssl/ctlTrustStore
controllerTrustStorePassword=mininet

Now you can start the ODL controller.

./run.sh

Then, back in your Mininet VM, run the same script used in the other post to start Mininet using SSL.

Hope you find this useful.

This post ‘Open Daylight Controller with SSL and Mininet’ first appeared on https://techandtrains.com/.

Advertisement

Filed under Mininet, SDN

Starting OVS Controller with SSL inside Mininet

May 3, 2014 3 Comments

To continue with my previous post about using SSL, I thought I would pass along another alternative way to start the test OVS Controller. In the other post, we start the ovs-controller manually and set the Mininet script to use a RemoteController. But if you want to start the ovs-controller from your script, we just replace the RemoteController with OVSController and also pass in the parameters to start the controller listening on SSL. Below is the same script as my last post but with the changes I just mentioned.

#!/usr/bin/python
from mininet.net import Mininet
from mininet.node import Controller, RemoteController, OVSController
from mininet.cli import CLI
from mininet.log import setLogLevel, info

def emptyNet():
    net = Mininet( controller=OVSController)
    net.addController( 'c0', cargs='-v pssl:%d -p /etc/openvswitch/ctl-privkey.pem \
     -c /etc/openvswitch/ctl-cert.pem \
     -C /var/lib/openvswitch/pki/switchca/cacert.pem' )
    h1 = net.addHost( 'h1' )
    h2 = net.addHost( 'h2' )
    s1 = net.addSwitch( 's1' )
    net.addLink( h1, s1 )
    net.addLink( h2, s1 )

    net.start()
    s1.cmd('ovs-vsctl set-controller s1 ssl:127.0.0.1:6633')

    net.pingAll()
    CLI( net )
    net.stop()

if __name__ == '__main__':
    setLogLevel( 'info' )
    emptyNet()

This post ‘Starting OVS Controller with SSL inside Mininet’ first appeared on https://gregorygee.wordpress.com/.

Filed under Mininet, SDN Tagged with , , ,