MiniEdit 2.1.0.9

It’s been a little while since I published an update.  Here are a few enhancements and bug fixes.

  • Export Script fixes
    • Link class was not getting set properly for TCLink
    • Now also exports the sFlow and NetFlow configuration you setup in MiniEdit
  • Fix loading saved MiniEdit topologies JSON parsing problem.  Now parses properly back into Python
  • Improve importTopo to support TCLink. Note that MiniEdit does not support all the TCLink parameters at this time.
    sudo ./miniedit-2.1.0.9.py –custom mytopo.py –topo mytopo –link tc
  • Hosts and OF Switches now have text field for user defined shell command/script to run during node startup and shutdown.
    • Start and Stop commands are on the Host and OF switch properties.
    • The Start command is run after all nodes have started(net.start()).
    • The Stop command is the first thing run before the nodes are stopped (net.stop())

Download MiniEdit 2.1.0.9 here.

This will probably be the last release I make using the Mininet 2.1.0 code base.  My next release will be realigned to use the latest code from Mininet to pick up new features introduced after 2.1.0.

Hope everyone enjoys and is having a good summer so far.

This post ‘MiniEdit 2.1.0.9’ first appeared on https://techandtrains.com/.

Starting OVS Controller with SSL inside Mininet

To continue with my previous post about using SSL, I thought I would pass along another alternative way to start the test OVS Controller. In the other post, we start the ovs-controller manually and set the Mininet script to use a RemoteController. But if you want to start the ovs-controller from your script, we just replace the RemoteController with OVSController and also pass in the parameters to start the controller listening on SSL. Below is the same script as my last post but with the changes I just mentioned.

#!/usr/bin/python
from mininet.net import Mininet
from mininet.node import Controller, RemoteController, OVSController
from mininet.cli import CLI
from mininet.log import setLogLevel, info

def emptyNet():
    net = Mininet( controller=OVSController)
    net.addController( 'c0', cargs='-v pssl:%d -p /etc/openvswitch/ctl-privkey.pem \
     -c /etc/openvswitch/ctl-cert.pem \
     -C /var/lib/openvswitch/pki/switchca/cacert.pem' )
    h1 = net.addHost( 'h1' )
    h2 = net.addHost( 'h2' )
    s1 = net.addSwitch( 's1' )
    net.addLink( h1, s1 )
    net.addLink( h2, s1 )

    net.start()
    s1.cmd('ovs-vsctl set-controller s1 ssl:127.0.0.1:6633')

    net.pingAll()
    CLI( net )
    net.stop()

if __name__ == '__main__':
    setLogLevel( 'info' )
    emptyNet()

This post ‘Starting OVS Controller with SSL inside Mininet’ first appeared on https://gregorygee.wordpress.com/.

Open vSwitch with SSL and Mininet

By default, Mininet uses the unencrypted port in Open vSwitch for OpenFlow. This makes total sense since the purpose of Mininet is a research tool, so encryption isn’t usually needed and using unencrypted control traffic allows for the use of tools like Wireshark to see the OpenFlow packets. But there are times when you might want to try and use OpenFlow over SSL. So I did a little research and as usual, doing my brain dump here to keep a record for myself.

To try it out, Mininet comes with the OpenFlow reference controller and the ovs-controller. I looked at the OpenFlow reference, but it doesn’t seem to support SSL.

mininet@mininet:~$ controller --help
controller: OpenFlow controller
usage: controller [OPTIONS] METHOD
where METHOD is any OpenFlow connection method.

Active OpenFlow connection methods:
  nl:DP_IDX               local datapath DP_IDX
  tcp:HOST[:PORT]         PORT (default: 6633) on remote TCP HOST
  unix:FILE               Unix domain socket named FILE
  fd:N                    File descriptor N
Passive OpenFlow connection methods:
  ptcp:[PORT]             listen to TCP PORT (default: 6633)
  punix:FILE              listen on Unix domain socket FILE

But it seems that the ovs-controller supports SSL.

mininet@mininet:~$ ovs-controller --help
ovs-controller: OpenFlow controller
usage: ovs-controller [OPTIONS] METHOD
where METHOD is any OpenFlow connection method.

Active OpenFlow connection methods:
  tcp:IP[:PORT]           PORT (default: 6633) at remote IP
  ssl:IP[:PORT]           SSL PORT (default: 6633) at remote IP
  unix:FILE               Unix domain socket named FILE
Passive OpenFlow connection methods:
  ptcp:[PORT][:IP]        listen to TCP PORT (default: 6633) on IP
  pssl:[PORT][:IP]        listen for SSL on PORT (default: 6633) on IP
  punix:FILE              listen on Unix domain socket FILE
PKI configuration (required to use SSL):
  -p, --private-key=FILE  file with private key
  -c, --certificate=FILE  file with certificate for private key
  -C, --ca-cert=FILE      file with peer CA certificate

So for this little experiment, I just used ovs-controller. Other controllers like RYU can also be used as mentioned in this post that helped me work out some issues. So lets get started.

Create all the keys for both OVS and the ovs-controller we will use and set the SSL parameters for OVS.

cd /etc/openvswitch
sudo ovs-pki req+sign ctl controller
sudo ovs-pki req+sign sc switch
sudo ovs-vsctl set-ssl \
    /etc/openvswitch/sc-privkey.pem \
    /etc/openvswitch/sc-cert.pem \
    /var/lib/openvswitch/pki/controllerca/cacert.pem

The above might not be the most secure way to manage the keys, but again, this is for research and experimentation.

In one window, let’s start the ovs-controller with SSL support.

sudo ovs-controller -v pssl:6633 \
     -p /etc/openvswitch/ctl-privkey.pem \
     -c /etc/openvswitch/ctl-cert.pem \
     -C /var/lib/openvswitch/pki/switchca/cacert.pem

Next, below is the Mininet Python script I used. Run this Mininet script that creates a simple single switch tology and sets the controller to SSL.

#!/usr/bin/python
from mininet.net import Mininet
from mininet.node import Controller, RemoteController
from mininet.cli import CLI
from mininet.log import setLogLevel, info

def emptyNet():
    net = Mininet( controller=RemoteController )
    net.addController( 'c0' )
    h1 = net.addHost( 'h1' )
    h2 = net.addHost( 'h2' )
    s1 = net.addSwitch( 's1' )
    net.addLink( h1, s1 )
    net.addLink( h2, s1 )
    
    net.start()
    s1.cmd('ovs-vsctl set-controller s1 ssl:127.0.0.1:6633')
    
    net.pingAll()
    CLI( net )
    net.stop()
    
if __name__ == '__main__':
    setLogLevel( 'info' )
    emptyNet()

When you run the script, you will see that a PingAll test ran and passed. You can also check and see that switch is connected using SSL.

mininet@mininet:~$ sudo ovs-vsctl show
902d6aa3-6a0a-4708-a286-3301c8b36430
    Bridge "s1"
        Controller "ssl:127.0.0.1:6633"
            is_connected: true
        fail_mode: secure
        Port "s1"
            Interface "s1"
                type: internal
        Port "s1-eth1"
            Interface "s1-eth1"
        Port "s1-eth2"
            Interface "s1-eth2"
    ovs_version: "2.0.1"

This post ‘Open vSwitch with SSL and Mininet’ first appeared on https://gregorygee.wordpress.com/.