Probabilistic Profiling of Stateful Data Planes for Adversarial Testing (Extended Abstract)

Our work is motivated by the design of programmable data planes [7] in recent switch models, which in turn has sparked significant interest in customizing program analysis and profiling techniques for data plane programs written in P4 [39, 32, 15, 33, 12, 11, 37]. Programmable data planes. Traditional network devices are hardwired for a fixed set of protocols. Recently, emerging network hardware is reprogrammable in high-level languages like P4 [7] to customize protocols and processing behaviors for each network and device. For instance, programmable data planes can support customized header fields and protocol types, enabling new protocols to be deployed without hardware upgrades. They can perform sophisticated operations over header fields, enabling task offloading to the switches. They can also implement stateful data structures in hardware, making it possible for the network to adapt its behavior based on past events. Commercial off-the-shelf switch models include Intel FlexPipe [4], Barefoot Tofino [1], Broadcom Trident 4 [2], and Cisco Silicon One [3]. Innovations with programmable data planes have quickly evolved from implementing forwarding programs (e.g., IP forwarding, MPLS, or customized network protocols) to supporting far more sophisticated processing inside the network— in this paper, we call these second-generation P4 programs data plane systems. Example systems in this category include key/value caching [24], load balancing [26, 21], link failure detection [19], access control [25], covert channel detection [43], likely with many more to come. Data plane systems have more complex program behaviors than forwarding programs, because they perform stateful processing. Consider the Blink link failure detector [19]: it randomly samples a set of TCP flows, tracks per-flow retransmissions, keeps a sliding window for monitoring, and activates rerouting to backup paths in a round-robin manner. Historical traffic patterns will directly influence future processing decisions. In contrast, forwarding programs contain no or little state, so their program behaviors do not change based on past traffic patterns. Program profiling and analysis. Observing that programmable data planes are essentially “complex programs”, researchers have been actively adapting program analysis, profiling, and verification techniques [39, 33, 12, 32, 37, 11] for P4 programs. Our work is particularly related to symbolic execution tools for P4 programs [39, 33, 12] . Symbolic execution (symbex) [29] is a principled program profiling technique that aims to systematically explore all program execution paths, analyze which types of inputs would exercise what execution paths, and produce concrete test inputs for validation. However, existing symbex tools for P4 programs [39, 33, 12] are restricted to stateless forwarding program analysis, and they cannot support the second generation of data plane systems. As motivated earlier, as the trend of in-network offloading continues, many recent P4 programs have increasingly complex state; exercising these stateful execution paths requires identifying a precise sequence of packets. But today’s P4 profilers [39, 33, 12] can only generate single-packet test cases regardless of program state. This falls short in analyzing stateful program behaviors that are driven by historical traffic inputs. Our work fills this gap and develops support to analyze stateful data plane systems. Concurrently, our work is driven by another fundamental observation made by the program analysis community—network behaviors are inherently probabilistic. Depending on the properties of interest, stochastic traffic patterns, random failures, load balancing decisions, and many other factors would contribute to this inherent non-determinism. In other words, analyzing network programs as if all properties are deterministic— as early work in this space did [14, 17, 13]—simply does not match the reality of complex networks. A promising line of work has developed support for probabilistic network analysis [41, 16, 36, 35, 38], but so far they only focus on analyzing network configurations [41, 38], or designing new probabilistic network programming languages [16, 36, 35]. Our work shares the same motivation with these work, but it is the first to enable probabilistic profiling of data plane systems. Our application: Adversarial testing. We discuss several applications in the main paper, but focus on demonstrating one use case in depth: adversarial testing. In contrast to basic program testing, adversarial testing distinguishes and specifically focuses on edge cases, as they may likely lead to unexpected behaviors. This is motivated by a long body of work that automates the finding of adversarial inputs for different types of systems and scenarios [34, 8, 42, 28, 31, 5, 23, 30, 20, 22, 18]. The most related work includes a) using machine learning techniques to find adversarial inputs for network protocols [18], and using execution cost aware symbolic execution to find high-cost test packet traces [34]. Compared to these work, P4wn contributes a new approach to adversarial testing that identifies edge cases by their probabilities.