Modular Safety Verification for Stateful Networks

ions for Safety of Networks of Middleboxes. We follow Velner et al. (2016) and abstract away the order of packets pending for each middlebox. is means that we may not be able to verify the safety of networks that rely on the order of received packets. Unfortunately, this abstraction does not suce for scalability. erefore, we suggest two further abstractions: (i) Abstract away correlations between the states of dierent middleboxes and dierent channels. is means that we verify the correctness of each middlebox against all possible reachable states of other middleboxes and channels. (ii) Abstract away correlations between the parts of the state of a single middlebox that determine the forwarding behavior of dierent packets. is abstraction means that we consider every forwarding behavior that is feasible for a packet at some middlebox state as feasible in all reachable states. Both of these abstractions can be seen as Cartesian abstractions that provide modularity: the rst at the level of the entire network, similarly to thread-modular analysis, and the second at the level of a single middlebox. Abstract Modeling Language. We dene a simple programming language for dening the eect of middleboxes (Sec. 3). e language is similar to OCCAM (Roscoe and Hoare 1988) and CSP (Hoare 1978). Each Middlebox maintains a state using uninterpreted relations and uses simple state queries to dene when a packet can be processed and its eect on the relations and the output packet(s). Our language also permits dening safety properties such as isolation. e language allows modeling many realistic middleboxes while hiding implementation details by using non-determinism. We do not yet address the question of proving that the actual (usually complex and proprietary) middlebox code implements the required eect. Our language — AMDL — provides a concise way to dene nite state transducers, usually with exponential savings. It is also designed to be topology independent. In particular, each middlebox type is modeled once. Fortunately, AMDL is expressive enough for networks and enables an ecient and fully automatic verication.Modeling Language. We dene a simple programming language for dening the eect of middleboxes (Sec. 3). e language is similar to OCCAM (Roscoe and Hoare 1988) and CSP (Hoare 1978). Each Middlebox maintains a state using uninterpreted relations and uses simple state queries to dene when a packet can be processed and its eect on the relations and the output packet(s). Our language also permits dening safety properties such as isolation. e language allows modeling many realistic middleboxes while hiding implementation details by using non-determinism. We do not yet address the question of proving that the actual (usually complex and proprietary) middlebox code implements the required eect. Our language — AMDL — provides a concise way to dene nite state transducers, usually with exponential savings. It is also designed to be topology independent. In particular, each middlebox type is modeled once. Fortunately, AMDL is expressive enough for networks and enables an ecient and fully automatic verication. Modular Safety Verication for Stateful Networks 3 (a) A middlebox chain with a correct topology. (b) A middlebox chain with a buggy topology. Fig. 1. A network topology with a middlebox chain. Summarizing Packet Eects. e network-level Cartesian abstraction leads to an abstract interpretation algorithm that is polynomial in the state space of each middlebox. However, the number of middlebox states can be exponential in the size of the network. For example, a rewall may record the set of trusted hosts and thus its states are subsets of hosts. erefore, network-level Cartesian abstraction leads to an algorithm that is exponential in the number of hosts and thus will not scale. In order to realize the middlebox-level Cartesian abstraction and reduce the complexity of abstract interpretation, we rst identify a bisimilar representation of middlebox states, which records the state queries in the AMDL code that match a given input packet. us, in this representation, each packet is mapped into its recorded behavior (packet state). Applying a middlebox-level Cartesian abstraction on this representation results in an abstract interpretation algorithm that enumerates, for each middlebox, the forwarding behavior of individual packets separately (based on their headers), instead of enumerating (entire) middlebox reachable states. We show that the abstract interpretation algorithm can be realized the with packet state representation in time that is polynomial in the size of the network and packet-header space, albeit exponential in the maximal number of distinct state queries in the AMDL code of an individual middlebox. State queries capture the dependency of the middlebox behavior on its state. For example, a state query could check whether the source of the current packet was seen in the past. We note that, even for complex middleboxes, our model requires a small number of distinct state queries. In all of our examples, the maximal number of state queries is 5. Empirical Evaluation. We have implemented our algorithm and applied it to several interesting topologies (Sec. 6). Our implementation was able to detect, for example, the safety violation described in Fig. 1. e gure shows an example of correct and incorrect middlebox chains. e safety property is: low security hosts (l1, . . . , lm ) do not receive packets from the Sh server. Fig. 1b contains an incorrect network conguration, where the cache may respond with a stored packet, bypassing the security policy enforced by the rewall. e rewall here records trusted hosts and permits forwarding packets from trusted hosts. Since our implementation is sound, it is guaranteed not to miss any error and in particular spots the error in Fig. 1b. More interestingly, it guarantees that the network shown in Fig. 1a is safe (even when unbounded number of packets are sent). We evaluate the scalability of our approach under two scenarios: (a) we vary the number of middleboxes in the network; and (b) we vary the number of hosts connected to a network. Our algorithm veried networks with thousands of hosts, and with hundreds of middleboxes in timescales of hours, suggesting that our approach can be used to verify safety in real-world examples. Reverting Network Semantics. One of the biggest hurdles in adapting abstract interpretation is false alarms. erefore, we identied a property that is applicable to many networks and which guarantees the absence of false alarms. A middlebox is reverting if from every state it can reset to its initial state. Notice that resets are similar to so network states (Lui et al. 2004), and could be triggered, e.g., by session timeouts or hardware failures. 4 Kalev Alpernas, Roman Manevich, Aurojit Panda, Mooly Sagiv, Sco Shenker, Sharon Shoham, and Yaron Velner We show that Cartesian abstraction does not incur a loss of precision on reverting networks. In other words, the only potential loss of precision by abstraction is due to ignoring the order of packet arrivals. Unfortunately, for non-reverting networks and safety properties, our method might be imprecise, e.g., when the safety property involves counting the number of packets and for temporal properties. Lower-Bounds. We show that our abstractions are essential for scalability by showing several lower bounds. First, we show that it is undecidable to check the safety of reverting networks when packet order is respected, i.e., channels have a FIFO behavior. is justies ignoring order of packet arrival, which is a simple and useful network abstraction. Second, we show that the complexity of checking safety in middleboxes is coNP-hard, even with unordered reverting semantics. Hence, the exponential dependency of the algorithm on the number of state queries is, in general, inevitable. Limitations. While our approach enables scalable verication for a variety of networks, it has a few limitations. First, our verication time grows exponentially with the number of state queries. is means that the running time grows exponentially with the amount of state that a middlebox must access. In practice, middleboxes access a limited amount of state per packet so as to minimize their working-set size. Hence, this does not signicantly limit our applicability. Second, we rely on abstract packet models; this limits the accuracy with which we can model middleboxes, e.g., intrusion detection systems that search for byte paerns in the packet payload, etc. Finally, for technical reasons, we model safety properties by middlebox. erefore, history-sensitive properties such as “a message with property x can only be sent aer a message with property y has been sent”, cannot always be proved with our method. We notice that for many properties, including network isolation, our method is precise (technically, our method is complete for the class of revert-robust properties (Sec. 5.3). We note that in practice, our analysis may still be able to prove safety, even in cases where the property is not revert-robust; our experiments include an example (enterprise network) where safety depends on a property that is not revert-robust, which our analysis is still able to prove. We defer proofs of key claims to the App. A .