Search papers, labs, and topics across Lattice.
This paper introduces GapFuzz, a stateful concurrency fuzzer designed to identify and exploit replication races in distributed Software-Defined Networking (SDN) clusters. By injecting contradictory Northbound requests with controlled timing on non-master nodes, GapFuzz effectively reconstructs the global state and detects divergences between the authoritative state and the kernel datapath. The method achieved an impressive 81.7% divergence detection rate in a three-node ONOS 2.7 cluster, highlighting the critical vulnerabilities in SDN systems that existing fuzzers overlook.
GapFuzz uncovers a staggering 81.7% of divergence cases in SDN clusters, revealing a hidden fault that could compromise network integrity.
Distributed Software-Defined Networking (SDN) clusters replicate flow state asynchronously between a master node and its backups, leaving a window during which two backup nodes can each commit a contradictory rule, the master can serialize both into the data plane, and the kernel datapath can latch onto an action that no node believes authoritative. Existing SDN fuzzers miss this fault: they confine their oracle to the control plane, target a single controller, or do not steer concurrency to provoke replication races. We present GapFuzz, a stateful concurrency fuzzer for distributed SDN clusters. GapFuzz injects pairs of contradictory Northbound requests on two non-master nodes with controlled inter-injection delay $螖t$, and reconstructs the global cross-plane state by querying every replica and the kernel-datapath action through ovs-appctl ofproto/trace. A two-phase timing search detects whether a divergence exists, then doubles and bisects on $螖t$ to bound the injection-time window; a lifetime probe labels each verdict transient or persistent and assigns it to one of four cross-plane state classes derived from the ONOS 2.7 source. On a three-node ONOS 2.7 cluster, GapFuzz produces a divergent verdict in 81.7% of attempts ($N=50$, Wilson 95% CI $[77.3, 85.4]$%); every divergence sits between the cluster's authoritative state and the kernel datapath. Phase 2 separates a 5 ms race window for one template from a doubling-cap regime ($螖t_{\max}=10.24$ s) for six others, and 99.4% of divergences persist past 30 s. Replacing the kernel-datapath probe with the OpenFlow user-space probe used by prior fuzzers drops detection by 26.6 percentage points overall and by 46.5 points after excluding canonicalization-forced verdicts.
