Network Verification Star Wars amd The Empire Strikes Back

Long ago in a network far away, rebel forces began to claim that networking was a separate planet and required specialized verification engines... Early attempts to colonize networking using weapons from the Verification Empire such as Model Checking and SAT solvers resulted in these weapons blowing up....

What is the problem? Who cares? “It surprised me that forward rules are so complicated” - anonymous

Networks today P1 P2 10*  P1 1*  P2,P2 SQL Drop SQL Load balancing Access Control Lists (ACLs) Multiple Protocols: 6000 RFCs (MPLS, GRE...) Multiple Vendors: Broadcom, Arista, Cisco,... Manual Configurations: Additional arcane programs kept working by “masters of complexity” (Shenker) Crude tools: SNMP, NetFlow, TraceRoute,...

Motivation to do better Internal: > 1 hr customer visible outage/quarter (P. Patel) Azure: 30,000 cores down 3 hrs, L2/L3 configuration bug Bing: Entire data center, 8 hours, L2/L3 configuration bug External: (2012 NANOG Network Operator Survey): 35% > 25 tickets per month, > 1 hour to resolve Welsh: vast majority of Google “production failures” due to “bugs in configuration settings” As we migrate to services ($100B public cloud market), network failure a debilitating cost. 5

Networks Tomorrow Online services  latency, cost sensitive Merchant Silicon  Build your own router Rise of Data centers  Custom networks Software defined Networks (SDNs)  custom design “routing program” P4 (next generation SDN)  redefine hardware forwarding at runtime 6 Opportunity to custom design networks to optimize goal. Potential simplifications but hard to get right

What specific problems does this paper address? Reachability, slicing, loops...

What specific problems does this paper not address? Control Plane, Implementation errors, Dynamism, Synthesis...

What is model checking? Why is it different from proof assistants like Coq? Why is it used in hardware design (Ana Klimovic?)

Model Checking Before model checking, Hoare style proofs:  manual effort Model checking: automatic search over state space to check property Must tame “state space explosion” using compression. Clarke (2007) Advances: symbolic model checking (BDDs), bounded model checking, adding expressivity (e.g., real time model checking) 10

Why not use model checking for networks? Or SAT Solvers?

Standard model checkers work badly for networks So why not use standard model checking to check for reachability properties (S  D) across all possible packets that could be sent? Works poorly with network state-space explosion (120-bit headers, millions of rules) Also, networks need all headers that do not reach destination. Many model checkers use SAT solvers that provide one solution, not all. 12

Central question: is Header Space Analysis just model checking?

Classical perspective “Model checking “ networks, so to speak Conquers network state-space explosion (120-bit headers, 10 6 rules) Difference 1: Abstraction of router forwarding  compositional, invertible semantics Difference 2: Structure allows “difference of cubes” to compactly represent header space. Different from Binary Decision Diagrams Difference 2: All counterexamples not just one 14

Isn’t the HSA insight just that network forwarding can be represented by Match- Action, an SDN/OpenFlow idea?

Many forwarding flavors/ 1 essence 16 IP Router ESSENTIAL INSIGHT FOR OPENFLOW. BUT HSA PAPER USES SAME INSIGHT FOR UNDERSTANDING EXISTING PROTOCOLS 10*  P1 1*  P2 MAC Bridge 01A1A2 01A1A2  P1... PREFIX MATCH EXACT MATCH MPLS Switch 5, 6 5  P1,Pop 5... INDEXED LOOKUP

Besides abstracting routers, what is the more general idea in the HSA paper?

Idea: Treat Network as a Program Model header as point in high dimensional space and all networking boxes as transformers of header space, so that Packet Forwarding xx1..x1 Match + Send to port 3 Rewrite with 1xx011..x1 Action 11xx..0x + Send to port 2 Rewrite with 1x01xx..x1 ROUTER ABSTRACTED AS SET OF GUARDED COMMANDS.. NETWORK BECOMES A PROGRAM  CAN USE PL METHODS

HSA is a form of semantics but there is not a single theorem in the paper? Are there implicit theorems

Yes: Composition, Inversion T 1 (h, p) R1R2R3 Theorem: Network behavior = composition of router transfer functions (Compositionality) Theorem: given header h at destination p, we can invert to find (h’,s): headers sent at source s’ to produce (h,p) (Inversion) 20

Why the stress on “real time” in NetPlumber How is the dependency graph built (C.Z. Lee)?

Graph on rules not nodes, edge when range of rule R intersects domain of rule S S ? VERIFYING CHANGES BY SDN CONTROLLERS BEFORE THEY TAKE EFFECT

Incremental program verification is considered very hard. How did NetPlumber pull it off?

What can we learn from model checkers that is missing in the HAS/NetPlumber paper?

What we can learn from model checkers Best existing network verification tools (Veriflow, NetPlumber) are very fast and scale to large networks. Existing model checkers are more expressive because they have a: Specification Language: (e.g., Temporal Logic) to describe properties A modelling language (e.g., Promela in SPIN) to model the network By contrast, in all existing work the network model is hardcoded and the specification language is minimal (except NetPlumber) 25

Wait a minute, NetPlumber has a policy language. What is it lacking? Differential reachability... Needs negation

SPEED From the viewpoint of verification EXPRESSIVITY Hassel, Veriflow NetPlumber  Model checkers, SAT Solvers, Datalog NSDI 2015 The Empire Strikes Back

What other aspects of static checking? Control Plane, Quantities, Dynamism, Specification Mining... c

NSDI 2015 Papers on Network Verification Catching Protocol Implementation Bugs (Kevin McKenzie): PIC Catching routing configuration errors: Batfish Doing reachability in Datalog to have a more expressive policy language and more expressive network model: NoD

Is network verification used in practice (C. Shah)?

Network Verification in Practice SecGuru: a simpler form of NoD is used in production in Azure and catches roughly 1 bug a day Veriflow Networks: from UIUC is commercializing Veriflow Forward Networks: from Stanford is commercializing HAS/NetPlumber

How can we push the idea of treating networks as programs further? What is the startup potential (Zak Stratton)?

33 Specificatio n Policy Language, Semantics Test Packet Generation Verification Synthesis (e.g., Forwarding Rules) Performance verification? Network Design Static checking (Local) Wiring Checkers Network Design Automation? Early work HOW MIGHT WE GO BEYOND EARLY WORK? WHAT NEW AREAS CAN WE TOUCH? JOIN THE PARTY! Dynamic checkers/ debuggers