In an SDN controller, when a new packet arrived to an OpenFlow-based router or switch and does not find a match flow entry in the OpenFlow flow tables, what does the SDN controller do? Does it just forward that packet to the destination and install its corresponding flow entry in the flow table? If so, why not just drop it for security reasons?
When a packet is received at an SDN switch that doesn't have a rule associated with it, it gets forwarded to the controller. Now, the controller may choose to drop it, or do something special (like log it and then forward). This behavior is key to implementing many Openflow features, like learning switches.
The Controller doesn't do anything right away - it does not know this event has occurred. The initial decision to be made has to be made by the device that received the packet it can't match. It may decide (due to configuration) to send that packet to the Controller, but simple math indicates that this doesn't scale (the management interface is very slow compared to the aggregate front-panel throughput of the device) and so by default unmatched packets are dropped.
If the device sends the packet to the Controller (or, more likely, just the first hundred bytes or so) then of course the Controller is free to do anything it likes with this data.