Model Checking Dynamic Datapaths Aurojit Panda, Katerina Argyraki, - - PowerPoint PPT Presentation

▶
model checking dynamic datapaths
SMART_READER_LITE
LIVE PREVIEW

Model Checking Dynamic Datapaths Aurojit Panda, Katerina Argyraki, - - PowerPoint PPT Presentation

Oct 27, 2023 156 likes •587 views

Model Checking Dynamic Datapaths Aurojit Panda, Katerina Argyraki, Scott Shenker UC Berkeley, ICSI, EPFL Networks: Not Just for Delivery Enforce a variety of invariants: Packet Isolation: Packets from A can not reach B Content

slide-1
SLIDE 1

Model Checking Dynamic Datapaths

Aurojit Panda, Katerina Argyraki, Scott Shenker

UC Berkeley, ICSI, EPFL

slide-2
SLIDE 2

Networks: Not Just for Delivery

  • Enforce a variety of invariants:
  • Packet Isolation: Packets from A can not reach B
  • Content Isolation: Content X never accessible by A.
  • Rate Limiting: B limited to M requests per second.
slide-3
SLIDE 3

Invariants are Global

  • Existing work on verifying global invariants
  • Anteater, HSA, VeriFlow.
  • Key assumption
  • Forwarding state dictated by control plane.
slide-4
SLIDE 4

Many Datapaths are "Dynamic"

  • Dynamic: Forwarding State affected by traffic.
  • Examples
  • Middle boxes
  • Learning switches
  • Loose Source Record Route IP option.
slide-5
SLIDE 5

Dynamic Behavior can Violate Invariants

Firewall 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

deny: 10.0.0.1-> 10.0.1.1

10.0.0.1 > 10.0.1.1

slide-6
SLIDE 6

Dynamic Behavior can Violate Invariants

Firewall 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

deny: 10.0.0.1-> 10.0.1.1

slide-7
SLIDE 7

Dynamic Behavior can Violate Invariants

Firewall 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

deny: 10.0.0.1-> 10.0.1.1

slide-8
SLIDE 8

Dynamic Behavior can Violate Invariants

Proxy 10.1.0.1 Firewall 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

deny: 10.0.0.1-> 10.0.1.1

10.0.0.1 > 10.0.1.1

slide-9
SLIDE 9

Dynamic Behavior can Violate Invariants

Proxy 10.1.0.1 Firewall 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

deny: 10.0.0.1-> 10.0.1.1

10.1.0.1 > 10.0.1.1

slide-10
SLIDE 10

Another Example

Compression Middlebox IDS 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

if BAD send to 10.0.1.2

10.0.0.1 > 10.0.1.1 BAD

slide-11
SLIDE 11

Another Example

Compression Middlebox IDS 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

if BAD send to 10.0.1.2

10.0.0.1 > 10.0.1.1 gzip(BAD)

slide-12
SLIDE 12

Another Example

Compression Middlebox IDS 10.0.0.1 10.0.0.2 10.0.1.1 10.0.1.2

if BAD send to 10.0.1.2

10.0.0.1 > 10.0.1.1 gzip(BAD)

slide-13
SLIDE 13

Why is this a Problem in the Real World?

  • Networks are complex and enforce many invariants.
  • Hard for administrators to keep global image in head.
  • NFV: Easier to make changes that violate invariants.
  • Goal:
  • Check invariants for networks with dynamic elements.
slide-14
SLIDE 14

Focusing on Middleboxes for this talk.

slide-15
SLIDE 15

High-Level Solution

  • Treat network as a large program.
  • Middleboxes are functions in this program.
  • Use model checking to check the network.
  • Naive implementation intractable
  • Challenge:
  • Network → Program so model checking is tractable.
slide-16
SLIDE 16

Scaling through Modularity

  • Three techniques
  • Middlebox models (what to model?)
  • Leverage service chaining.
  • Policy choices that speedup analysis.
slide-17
SLIDE 17

Consider a DPI Middlebox

Receive packet Lookup flow state

...

Labeled Harmful Labeled Benign

Many steps to analyze traffic

Real processing pipeline Expensive to combine: Exponential growth

Send packet

slide-18
SLIDE 18

Consider a DPI Middlebox

Receive packet Lookup flow state

...

Labeled Harmful Labeled Benign

Many steps to analyze traffic

Important for Global Properties

Send packet

slide-19
SLIDE 19

The DPI Model in Math

∀send(d, e, p) = ⇒ ∃e0 : recv(e0, d, p) ∧ (d.label(p) = harmful ∨ d.label(p) = benign) ∧ rtime(d, p) < stime(d, p)

For any packet p sent by DPI box d p was received by d p was marked harmful

  • r benign

also p was received before being sent

slide-20
SLIDE 20

Model Globally Significant Behavior

  • Checking model accuracy?
  • Verify code against model.
  • Enforce model.
slide-21
SLIDE 21

Simple Models not Enough

Networks with 25 middleboxes take 32.2 seconds.

Firewall 10.0.0.1 10.0.0.2 Firewall Firewall Firewall Firewall Firewall

slide-22
SLIDE 22
  • Modeling middleboxes
  • Leverage service chaining
  • Policies for scalability
slide-23
SLIDE 23

Networks of Middleboxes

WAN Opt IDS Proxy Web Server Load Balancer Web Server Web Server Web Server Web Server

Network

slide-24
SLIDE 24

Networks of Middleboxes

WAN Opt IDS Proxy Web Server Load Balancer Web Server Web Server Web Server Web Server

Network

Also provide annotations on when paths are taken.

slide-25
SLIDE 25

Networks of Middleboxes

WAN Opt IDS Proxy Web Server Load Balancer Web Server Web Server Web Server Web Server

Network

Also provide annotations on when paths are taken.

slide-26
SLIDE 26

Networks of Middleboxes

WAN Opt IDS Proxy Web Server Load Balancer Web Server Web Server Web Server Web Server

Network

Also provide annotations on when paths are taken.

slide-27
SLIDE 27

Service Chaining

  • Solutions to implement such chaining.
  • Limits middlebox states to be checked.
  • Middlebox state depends on past traffic.
  • Chaining policy defines sources of traffic.
  • Network path: set of middleboxes traversed.
slide-28
SLIDE 28
  • Modeling middleboxes
  • Leverage service chaining
  • Policies for scalability
slide-29
SLIDE 29

How much of the Network to Consider?

M0 M4 M12 M8 M1 M5 M9 M13 M2 M6 M10 M14 M3 M7 M11 M15 A B

Prove A isolated from B. Network Path is set of Middleboxes Traversed.

slide-30
SLIDE 30

How much of the Network to Consider?

M0 M4 M12 M8 M1 M5 M9 M13 M2 M6 M10 M14 M3 M7 M11 M15 A B

Prove A isolated from B. Network Path is set of Middleboxes Traversed.

slide-31
SLIDE 31

How much of the Network to Consider?

M0 M4 M12 M8 M1 M5 M9 M13 M2 M6 M10 M14 M3 M7 M11 M15 A B

Prove A isolated from B. Network Path is set of Middleboxes Traversed.

slide-32
SLIDE 32

Consider Only Network Path

  • Pro: Scales with path length not size of network
  • Con: Not generally applicable
  • Allows scaling to 10000s of nodes.
  • Trivial test (2 endhosts, 1 firewall, no ACLs)
  • With pruning 0.11 seconds (with 25000 mboxes)
  • Without pruning 32.2 seconds (with 25 mboxes)
slide-33
SLIDE 33

When can we Prune Part of the Network?

  • Path Independence
  • Model checking behavior: Enables pruning.
  • Robustness: Network changes remain local

Proxy Application Firewall 10.0.0.2 Web Server 10.0.0.1 Application Firewall

slide-34
SLIDE 34

Achieving Path Independence

  • Solution depends on invariant and network.

Proxy Application Firewall 10.0.0.2 Web Server 10.0.0.1 Application Firewall

slide-35
SLIDE 35

Achieving Path Independence

  • Solution depends on invariant and network.
  • Add a firewall before the proxy.

Proxy Application Firewall 10.0.0.2 Web Server 10.0.0.1 Application Firewall Application Firewall

slide-36
SLIDE 36

Achieving Path Independence

  • Solution depends on invariant and network.
  • Add a firewall before the proxy.
  • Change proxy to enforce access invariants.

Proxy

Application Firewall 10.0.0.2 Web Server 10.0.0.1 Application Firewall

slide-37
SLIDE 37

Achieving Path Independence

  • Solution depends on invariant and network.
  • Add a firewall before the proxy.
  • Change proxy to enforce access invariants.
  • Can automatically check path independence.

Proxy Application Firewall 10.0.0.2 Web Server 10.0.0.1 Application Firewall

slide-38
SLIDE 38

Achieving Path Independence

  • Solution depends on invariant and network.
  • Add a firewall before the proxy.
  • Change proxy to enforce access invariants.
  • Can automatically check path independence.

Proxy Application Firewall 10.0.0.2 Web Server 10.0.0.1 Application Firewall

slide-39
SLIDE 39

Tools for Checking Invariants

  • We have implemented a tool with these optimizations.
  • Leverages Z3, a SMT solver from Microsoft.
  • Implemented in about 3700 lines of Python code
  • The models themselves are less than 1500 lines.
  • Models about 10 different middlebox kinds.
  • Much of the space: Expressing math in Python.
slide-40
SLIDE 40

Early Results from Tools

10.0.0.1 10.0.1.1 IP Router 10.1.0.1 ACL Firewall

deny: 10.0.0.1-> 10.0.1.1

IP Router 10.1.0.2 10.0.0.1 > 10.1.0.1

  • Use Loose Source Routing to circumvent firewall
  • Invariant: No packets from 10.0.0.1 to 10.0.1.1
  • We can verify this in 0.39 seconds.
slide-41
SLIDE 41

Early Results from Tools

10.0.0.1 10.0.1.1 IP Router 10.1.0.1 ACL Firewall

deny: 10.0.0.1-> 10.0.1.1

IP Router 10.1.0.2 10.1.0.1 > 10.0.1.1

  • Use Loose Source Routing to circumvent firewall
  • Invariant: No packets from 10.0.0.1 to 10.0.1.1
  • We can verify this in 0.39 seconds.
slide-42
SLIDE 42

Summary

  • Path independent policies and invariants:
  • Easy to maintain, easy to check.
  • Check if policies + invariants are path independent.
  • Check if those invariants hold.
  • Offline but quick verification possible.