Upload
silas-byron-daniel
View
227
Download
8
Tags:
Embed Size (px)
Citation preview
Network VerificationStar Wars amd The Empire Strikes Back
Long ago in a network far away, rebel forces began to claim that networking was a separate planet and required specialized verification engines . . . Early attempts to colonize networking using weapons from the Verification Empire such as Model Checking and SAT solvers resulted in these weapons blowing up . . . .
What is the problem? Who cares?
“It surprised me that forward rules are so complicated” - anonymous
4
Networks today 1001
P1
P2
10* P1 1* P2
,P2SQL
Drop SQL
Load balancing Access Control Lists (ACLs)
• Multiple Protocols: 6000 RFCs (MPLS, GRE . . .)• Multiple Vendors: Broadcom, Arista, Cisco, . . .• Manual Configurations: Additional arcane programs kept
working by “masters of complexity” (Shenker)• Crude tools: SNMP, NetFlow, TraceRoute, . . .
Motivation to do better
• Internal: > 1 hr customer visible outage/quarter (P. Patel)• Azure: 30,000 cores down 3 hrs, L2/L3 configuration bug• Bing: Entire data center, 8 hours, L2/L3 configuration bug
• External: (2012 NANOG Network Operator Survey):• 35% > 25 tickets per month, > 1 hour to resolve• Welsh: vast majority of Google “production failures” due to “bugs in configuration
settings”
As we migrate to services ($100B public cloud market), network failure a debilitating cost.
5
6
Networks Tomorrow
• Online services latency, cost sensitive• Merchant Silicon Build your own router• Rise of Data centers Custom networks• Software defined Networks (SDNs) custom design “routing
program”• P4 (next generation SDN) redefine hardware forwarding at runtime
Opportunity to custom design networks to optimize goal. Potential simplifications but hard to get right
What specific problems does this paper address?
Reachability, slicing, loops . . .
What specific problems does this paper not address?
Control Plane, Implementation errors, Dynamism, Synthesis . . .
What is model checking? Why is it different from proof assistants like Coq?
Why is it used in hardware design (Ana Klimovic?)
10
Model Checking
• Before model checking, Hoare style proofs: manual effort• Model checking: automatic search over state space to check property• Must tame “state space explosion” using compression. Clarke (2007)• Advances: symbolic model checking (BDDs), bounded model checking,
adding expressivity (e.g., real time model checking)
Why not use model checking for networks? Or SAT Solvers?
12
Standard model checkers work badly for networks
• So why not use standard model checking to check for reachability properties (S D) across all possible packets that could be sent?• Works poorly with network state-space explosion (120-bit headers,
millions of rules)• Also, networks need all headers that do not reach destination. Many
model checkers use SAT solvers that provide one solution, not all.
Central question: is Header Space Analysis just model checking?
14
Classical perspective
• “Model checking “ networks, so to speak• Conquers network state-space explosion (120-bit headers, 106 rules)• Difference 1: Abstraction of router forwarding compositional,
invertible semantics• Difference 2: Structure allows “difference of cubes” to compactly
represent header space. Different from Binary Decision Diagrams• Difference 2: All counterexamples not just one
Isn’t the HSA insight just that network forwarding can be represented by Match-Action, an SDN/OpenFlow idea?
Many forwarding flavors/ 1 essence
16
IP Router10010
ESSENTIAL INSIGHT FOR OPENFLOW. BUT HSA PAPER USES SAME INSIGHTFOR UNDERSTANDING EXISTING PROTOCOLS
10* P1 1* P2
MAC Bridge01A1A2 01A1A2 P1 . . .
PREFIX MATCH
EXACT MATCH
MPLS Switch5, 6 5 P1,Pop 5 . . .
INDEXED LOOKUP
Besides abstracting routers, what is the more general idea in the HSA paper?
Idea: Treat Network as a Program• Model header as point in high dimensional space and all networking
boxes as transformers of header space, so that . . .
18
PacketForwarding
1
2
3
0xx1..x1
Match+ Send to port 3
Rewrite with 1xx011..x1
Action11xx..0x + Send to port 2
Rewrite with 1x01xx..x1
ROUTER ABSTRACTED AS SET OF GUARDED COMMANDS . . NETWORK BECOMES A PROGRAM CAN USE PL METHODS
HSA is a form of semantics but there is not a single theorem in the paper? Are there implicit theorems
Yes: Composition, Inversion
T1(h, p)R1 R2 R3
• Theorem: Network behavior = composition of router transfer functions (Compositionality)
• Theorem: given header h at destination p, we can invert to find (h’,s): headers sent at source s’ to produce (h,p) (Inversion)
20
Why the stress on “real time” in NetPlumber
How is the dependency graph built (C.Z. Lee)?
22
Graph on rules not nodes, edge when range of rule R intersects domain of rule S
...
...
...
......
...
...
...
S
?
VERIFYING CHANGES BY SDN CONTROLLERS BEFORE THEY TAKE EFFECT
Incremental program verification is considered very hard. How did NetPlumber pull it off?
What can we learn from model checkers that is missing in the HAS/NetPlumber paper?
25
What we can learn from model checkers• Best existing network verification tools (Veriflow, NetPlumber) are
very fast and scale to large networks.• Existing model checkers are more expressive because they have a:• Specification Language: (e.g., Temporal Logic) to describe properties• A modelling language (e.g., Promela in SPIN) to model the network
• By contrast, in all existing work the network model is hardcoded and the specification language is minimal (except NetPlumber)
Wait a minute, NetPlumber has a policy language. What is it lacking?
Differential reachability . . . Needs negation
SPEED
From the viewpoint of verification
EXPRESSIVITY
Hassel, Veriflow
NetPlumber
Model checkers,SAT Solvers,Datalog
NSDI2015
The Empire Strikes Back
What other aspects of static checking?
Control Plane, Quantities, Dynamism, Specification Mining . . . c
NSDI 2015 Papers on Network Verification•Catching Protocol Implementation Bugs (Kevin
McKenzie): PIC•Catching routing configuration errors: Batfish•Doing reachability in Datalog to have a more
expressive policy language and more expressive network model: NoD
Is network verification used in practice (C. Shah)?
Network Verification in Practice
• SecGuru: a simpler form of NoD is used in production in Azure and catches roughly 1 bug a day•Veriflow Networks: from UIUC is commercializing
Veriflow• Forward Networks: from Stanford is commercializing
HAS/NetPlumber
How can we push the idea of treating networks as programs further?
What is the startup potential (Zak Stratton)?
33
Specification
Policy Language, Semantics Test PacketGeneration
Verification
Synthesis (e.g., Forwarding Rules)
Performance verification?
Network Design
Static checking (Local)
Wiring Checkers
Network Design Automation?
Early work
HOW MIGHT WE GO BEYOND EARLY WORK? WHAT NEW AREAS CAN WE TOUCH? JOIN THE PARTY!
Dynamic checkers/ debuggers