SLIDE 1 Optimizing Horn Solvers for Network Repair
Hossein Hojjat1,4 Philipp R¨ ummer 2 Jedidiah McClurg3 Pavol ˇ Cern´ y3 Nate Foster 1
1Cornell University, 2Uppsala University, 3University of Colorado Boulder, 4Rochester Institute of Technology
16th International Conference on Formal Methods in Computer Aided Design
October 6th, 2016
SLIDE 2 Software-Defined Networking (SDN)
Software-Defined Networking (SDN): emerging network architecture SDN Controllers are the brains of network
◮ Determine how the switches and routers should handle network traffic ◮ Can update the forwarding tables of switches
1
SLIDE 3
H1 T1
T1
Host A1
A1
Aggregation T2
T2
ToR T3
T3
T4
T4
A3
A3
A4
A4
H2 H3 H4
not safe for H1 traffic
A2
A2
C1
C1
Core C2
C2
Down for Maintenance
filter(H1)
2
SLIDE 4
H1 T1
T1
Host A1
A1
Aggregation T2
T2
ToR T3
T3
T4
T4
A3
A3
A4
A4
H2 H3 H4
not safe for H1 traffic
A2
A2
C1
C1
Core C2
C2
Switch Online
filter(H1)
2
SLIDE 5
H1 T1
T1
Host A1
A1
Aggregation T2
T2
ToR T3
T3
T4
T4
A3
A3
A4
A4
H2 H3 H4
not safe for H1 traffic
A2
A2
C1
C1
Core C2
C2
Switch Online
filter(H1)
2
SLIDE 6 H1 T1
T1
Host A1
A1
Aggregation T2
T2
ToR T3
T3
T4
T4
A3
A3
A4
A4
H2 H3 H4
not safe for H1 traffic
A2
A2
C1
C1
Core C2
C2
Switch Online
filter(H1)
How can we return back to safety by adding filters on links? There are several possible repair solutions Interested in best solutions:
◮ e.g. the ones that touch minimal number of switches ◮ and maintain connectivity
2
SLIDE 7 H1 T1
T1
Host A1
A1
Aggregation T2
T2
ToR T3
T3
T4
T4
A3
A3
A4
A4
H2 H3 H4
not safe for H1 traffic
A2
A2
C1
C1
Core C2
C2
Switch Online
filter(H1)
How can we return back to safety by adding filters on links? There are several possible repair solutions Interested in best solutions:
◮ e.g. the ones that touch minimal number of switches ◮ and maintain connectivity
2
SLIDE 8 H1 T1
T1
Host A1
A1
Aggregation T2
T2
ToR T3
T3
T4
T4
A3
A3
A4
A4
H2 H3 H4
not safe for H1 traffic
A2
A2
C1
C1
Core C2
C2
Switch Online
filter(H1) filter(H1) filter(H1) filter(H1) filter(H1)
How can we return back to safety by adding filters on links? There are several possible repair solutions Interested in best solutions:
◮ e.g. the ones that touch minimal number of switches ◮ and maintain connectivity
2
SLIDE 9 H1 T1
T1
Host A1
A1
Aggregation T2
T2
ToR T3
T3
T4
T4
A3
A3
A4
A4
H2 H3 H4
not safe for H1 traffic
A2
A2
C1
C1
Core C2
C2
Switch Online
filter(H1) filter(H1)
How can we return back to safety by adding filters on links? There are several possible repair solutions Interested in best solutions:
◮ e.g. the ones that touch minimal number of switches ◮ and maintain connectivity
2
SLIDE 10 Contributions
1 Translation of network and its correctness conditions to Horn clauses 2 Repair unsatisfiable Horn clauses (i.e. buggy system violating
correctness)
3 New lattice-based optimization procedure for Horn clause repair
3
SLIDE 11 Repair Framework
Network Description
ϕ
Safety Description Horn Clauses:
∀¯
v) ∧ R1,0(¯ v) ∧ · · · ∧ Rn,0(¯ v) → R0,0(¯ v) ∀¯
v) ∧ R1,1(¯ v) ∧ · · · ∧ Rn,1(¯ v) → R0,1(¯ v) . . . ∀¯
v) ∧ R1,m(¯ v) ∧ · · · ∧ Rn,m(¯ v) → R0,m(¯ v)
HORN SOLVER
(Eldarica)
Weaken Clauses Strengthen Clauses
(Optimizer) Translate Repair Back 4
SLIDE 12
Our Repair Approach
∀¯ v. ψ0(¯ v) ∧ R1,0(¯ v) ∧ · · · ∧ Rn,0(¯ v) → R0,0(¯ v) ∀¯ v. ψ1(¯ v) ∧ R1,1(¯ v) ∧ · · · ∧ Rn,1(¯ v) → R0,1(¯ v) . . . ∀¯ v. ψm(¯ v) ∧ R1,m(¯ v) ∧ · · · ∧ Rn,m(¯ v) → R0,m(¯ v) ∀¯ v. φm′(¯ v) ∧ R1,m′(¯ v) ∧ · · · ∧ Rn,m′(¯ v) → false
| = false
5
SLIDE 13 Our Repair Approach
∀¯
v) ∧ ψ0(¯ v) ∧ R1,0(¯ v) ∧ · · · ∧ Rn,0(¯ v) → R0,0(¯ v) ∀¯
v) ∧ ψ1(¯ v) ∧ R1,1(¯ v) ∧ · · · ∧ Rn,1(¯ v) → R0,1(¯ v) . . . ∀¯
v) ∧ ψm(¯ v) ∧ R1,m(¯ v) ∧ · · · ∧ Rn,m(¯ v) → R0,m(¯ v) ∀¯
v)∧ φm′(¯ v) ∧ R1,m′(¯ v) ∧ · · · ∧ Rn,m′(¯ v) → false
| = false
Weaken
Conjoin fresh relation symbols R∗
i to the bodies of Horn clauses 5
SLIDE 14 Our Repair Approach
∀¯
v) ∧ ψ0(¯ v) ∧ R1,0(¯ v) ∧ · · · ∧ Rn,0(¯ v) → R0,0(¯ v) ∀¯
v) ∧ ψ1(¯ v) ∧ R1,1(¯ v) ∧ · · · ∧ Rn,1(¯ v) → R0,1(¯ v) . . . ∀¯
v) ∧ ψm(¯ v) ∧ R1,m(¯ v) ∧ · · · ∧ Rn,m(¯ v) → R0,m(¯ v) ∀¯
v)∧ φm′(¯ v) ∧ R1,m′(¯ v) ∧ · · · ∧ Rn,m′(¯ v) → false
| = false
Weaken
Conjoin fresh relation symbols R∗
i to the bodies of Horn clauses
Weaker system is satisfiable, may have undesirable solutions Any of the new relation symbols can be false
◮ (effectively removing the clause)
5
SLIDE 15 Our Repair Approach
∀¯
v) ∧ ψ0(¯ v) ∧ R1,0(¯ v) ∧ · · · ∧ Rn,0(¯ v) → R0,0(¯ v) ∀¯
v) ∧ ψ1(¯ v) ∧ R1,1(¯ v) ∧ · · · ∧ Rn,1(¯ v) → R0,1(¯ v) . . . ∀¯
v) ∧ ψm(¯ v) ∧ R1,m(¯ v) ∧ · · · ∧ Rn,m(¯ v) → R0,m(¯ v) ∀¯
v)∧ φm′(¯ v) ∧ R1,m′(¯ v) ∧ · · · ∧ Rn,m′(¯ v) → false
| = false
Weaken
Conjoin fresh relation symbols R∗
i to the bodies of Horn clauses
Weaker system is satisfiable, may have undesirable solutions Any of the new relation symbols can be false
◮ (effectively removing the clause)
Strengthen
Add more constraints to rule out undesirable solutions User can select the “best” repairs (e.g. reject false solutions,if possible)
5
SLIDE 16
Goal: find solutions for set of Horn clauses subject to objective function
Space of all interpretations of relation symbols
6
SLIDE 17
Goal: find solutions for set of Horn clauses subject to objective function
Space of all interpretations of relation symbols Solutions Best Solutions
6
SLIDE 18
Goal: find solutions for set of Horn clauses subject to objective function
Space of all interpretations of relation symbols Solutions Best Solutions
6
SLIDE 19
Goal: find solutions for set of Horn clauses subject to objective function
Space of all interpretations of relation symbols Solutions Best Solutions 1 2 3 4 · · · · · ·
∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
6
SLIDE 20
Goal: find solutions for set of Horn clauses subject to objective function
Space of all interpretations of relation symbols Solutions Best Solutions 1 2 3 4 · · · · · ·
∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
6
SLIDE 21
Goal: find solutions for set of Horn clauses subject to objective function
Space of all interpretations of relation symbols Solutions Best Solutions 1 2 3 4 · · · · · ·
∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
6
SLIDE 22
Goal: find solutions for set of Horn clauses subject to objective function
Space of all interpretations of relation symbols Solutions Best Solutions 1 2 3 4 · · · · · ·
∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
6
SLIDE 23
Goal: find solutions for set of Horn clauses subject to objective function
Objective function: Rank nodes of lattice monotonically ∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
Feasibility Frontier 6
SLIDE 24
Goal: find solutions for set of Horn clauses subject to objective function
Objective function: Rank nodes of lattice monotonically Search Algorithm: Walk smartly in the lattice to find the best solution: inside the feasibility cone has maximum ranking ∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
Feasibility Frontier 6
SLIDE 25 Goal: find solutions for set of Horn clauses subject to objective function
Objective function: Rank nodes of lattice monotonically Search Algorithm: Walk smartly in the lattice to find the best solution: inside the feasibility cone has maximum ranking
1 Pick a feasible node and walk until
reach frontier ∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
Feasibility Frontier 6
SLIDE 26 Goal: find solutions for set of Horn clauses subject to objective function
Objective function: Rank nodes of lattice monotonically Search Algorithm: Walk smartly in the lattice to find the best solution: inside the feasibility cone has maximum ranking
1 Pick a feasible node and walk until
reach frontier
2 Pick a lower rank incomparable
node and walk again ∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
Feasibility Frontier 6
SLIDE 27 Goal: find solutions for set of Horn clauses subject to objective function
Objective function: Rank nodes of lattice monotonically Search Algorithm: Walk smartly in the lattice to find the best solution: inside the feasibility cone has maximum ranking
1 Pick a feasible node and walk until
reach frontier
2 Pick a lower rank incomparable
node and walk again Use feasibility bounds as heuristic to prune search ∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
Feasibility Frontier 6
SLIDE 28 Goal: find solutions for set of Horn clauses subject to objective function
Objective function: Rank nodes of lattice monotonically Search Algorithm: Walk smartly in the lattice to find the best solution: inside the feasibility cone has maximum ranking
1 Pick a feasible node and walk until
reach frontier
2 Pick a lower rank incomparable
node and walk again Use feasibility bounds as heuristic to prune search ∅ 2 3 4 1 · · · · · · 1 ∪ 2 2 ∪ 3 3 ∪ 4 · · · · · ·
all interpretations all interpretations
⊆ · · ·
Feasibility Frontier 6
SLIDE 29
Example: Interval Lattice
(−∞, 2] [2, 2] (−∞, 3] [2, 3] [2, 3] (−∞, 4] (−∞, 4] ∅ [3, 3] [2, 4] [2, 4] (−∞, +∞) (−∞, +∞) [3, 4] [2, +∞) [2, +∞) [4, 4] [3, +∞) [3, +∞) [4, +∞) [4, +∞) Interval lattices are useful to filter out a range of packets
7
Interval lattice f(x) for {2, 4}
SLIDE 30 Example: Interval Lattice
(−∞, 2] [2, 2] (−∞, 3] [2, 3] [2, 3] (−∞, 4] (−∞, 4] ∅ [3, 3] [2, 4] [2, 4] (−∞, +∞) (−∞, +∞) [3, 4] [2, +∞) [2, +∞) [4, 4] [3, +∞) [3, +∞) [4, +∞) [4, +∞) Interval lattices are useful to filter out a range of packets Example: TTL scoping (for network details see paper)
1 if I = [x, y] or I = (−∞, y] −∞ if I = [x, ∞) or I = (−∞, ∞) ∞ if I = ∅
7
Interval lattice f(x) for {2, 4}
SLIDE 31 Example: Interval Lattice
(−∞, 2] [2, 2] (−∞, 3] [2, 3] [2, 3] (−∞, 4] (−∞, 4] ∅ [3, 3] [2, 4] [2, 4] (−∞, +∞) (−∞, +∞) [3, 4] [2, +∞) [2, +∞) [4, 4] [3, +∞) [3, +∞) [4, +∞) [4, +∞) Interval lattices are useful to filter out a range of packets Example: TTL scoping (for network details see paper)
1 if I = [x, y] or I = (−∞, y] −∞ if I = [x, ∞) or I = (−∞, ∞) ∞ if I = ∅
7
Interval lattice f(x) for {2, 4}
SLIDE 32 Example: Interval Lattice
(−∞, 2] [2, 2] (−∞, 3] [2, 3] [2, 3] (−∞, 4] (−∞, 4] ∅ [3, 3] [2, 4] [2, 4] (−∞, +∞) (−∞, +∞) [3, 4] [2, +∞) [2, +∞) [4, 4] [3, +∞) [3, +∞) [4, +∞) [4, +∞) Interval lattices are useful to filter out a range of packets Example: TTL scoping (for network details see paper)
1 if I = [x, y] or I = (−∞, y] −∞ if I = [x, ∞) or I = (−∞, ∞) ∞ if I = ∅
7
Interval lattice f(x) for {2, 4}
SLIDE 33 Example: Interval Lattice
(−∞, 2] [2, 2] (−∞, 3] [2, 3] [2, 3] (−∞, 4] (−∞, 4] ∅ [3, 3] [2, 4] [2, 4] (−∞, +∞) (−∞, +∞) [3, 4] [2, +∞) [2, +∞) [4, 4] [3, +∞) [3, +∞) [4, +∞) [4, +∞) Interval lattices are useful to filter out a range of packets Example: TTL scoping (for network details see paper)
1 if I = [x, y] or I = (−∞, y] −∞ if I = [x, ∞) or I = (−∞, ∞) ∞ if I = ∅
7
Interval lattice f(x) for {2, 4}
Local Maximum
SLIDE 34 Example: Interval Lattice
(−∞, 2] [2, 2] (−∞, 3] [2, 3] [2, 3] (−∞, 4] (−∞, 4] ∅ [3, 3] [2, 4] [2, 4] (−∞, +∞) (−∞, +∞) [3, 4] [2, +∞) [2, +∞) [4, 4] [3, +∞) [3, +∞) [4, +∞) [4, +∞) Interval lattices are useful to filter out a range of packets Example: TTL scoping (for network details see paper)
1 if I = [x, y] or I = (−∞, y] −∞ if I = [x, ∞) or I = (−∞, ∞) ∞ if I = ∅
7
Interval lattice f(x) for {2, 4}
Local Maximum Pick a minimal incomparable node
SLIDE 35 Example: Interval Lattice
(−∞, 2] [2, 2] (−∞, 3] [2, 3] [2, 3] (−∞, 4] (−∞, 4] ∅ [3, 3] [2, 4] [2, 4] (−∞, +∞) (−∞, +∞) [3, 4] [2, +∞) [2, +∞) [4, 4] [3, +∞) [3, +∞) [4, +∞) [4, +∞) Interval lattices are useful to filter out a range of packets Example: TTL scoping (for network details see paper)
1 if I = [x, y] or I = (−∞, y] −∞ if I = [x, ∞) or I = (−∞, ∞) ∞ if I = ∅
7
Interval lattice f(x) for {2, 4}
Local Maximum Pick a minimal incomparable node
SLIDE 36 Heuristic (Feasibility Bound)
[x + 1, y − 1] [x, y − 1] [x, y − 2] [x + 1, y] : infeasible [x, x] [x, y] : feasible x x + 1 y infeasible Every feasible interval I above [x, y] must be below (or equal to) [x, x]
◮ Feasibility is anti-monotonic
8
SLIDE 37 Correctness
Search algorithm is guaranteed to terminate on finite lattices
Theorem
Optimization algorithm is sound and complete
◮ Always finds the global optimum
Proof
Induction on lattice structure
◮ use monotonicity of feasibility and objective function
9
SLIDE 38 Horn Clauses for Network
H1 T1 t1 Host A1 a1 Aggregation T2 t2 ToR T3 t3 T4 t4 A3 a3 A4 a4 H2 H3 H4
not safe for H1 traffic
A2 a2 C1 c1 Core C2 c2
filter(H1)
- Ingress. H1 sends out the special traffic type 0
(typ = 0 ∧ dst ∈ {2, 3, 4}) → t1(dst, typ) (typ > 0 ∧ typ < 8 ∧ dst ∈ {1, 3, 4}) → t2(dst, typ) (typ > 0 ∧ typ < 8 ∧ dst ∈ {1, 2, 4}) → t3(dst, typ) (typ > 0 ∧ typ < 8 ∧ dst ∈ {1, 2, 3}) → t4(dst, typ)
10
SLIDE 39 Horn Clauses for Network
H1 T1 t1 Host A1 a1 Aggregation T2 t2 ToR T3 t3 T4 t4 A3 a3 A4 a4 H2 H3 H4
not safe for H1 traffic
A2 a2 C1 c1 Core C2 c2
filter(H1)
We use a special relation symbol D for dropping a packet t1(dst, typ) ∧ (dst = 1) → a1(dst, typ) t1(dst, typ) ∧ (dst = 1) → a2(dst, typ) t1(dst, typ) ∧ ¬
(dst ≤ 4) ∧ (typ ≥ 0) ∧ (typ ≤ 7)
D(dst, typ)
10
SLIDE 40 Horn Clauses for Network
H1 T1 t1 Host A1 a1 Aggregation T2 t2 ToR T3 t3 T4 t4 A3 a3 A4 a4 H2 H3 H4
not safe for H1 traffic
A2 a2 C1 c1 Core C2 c2
filter(H1)
- Properties. Flow 0 should not reach destination 4 or the drop state
t4(dst, typ) ∧ (typ = 0) → false D(dst, typ) ∧ (typ = 0) → false
10
SLIDE 41
Bandwidth Repair
H1 H2 H3 S1 s1 S2 s2 S3 s3 S4 s4 buffer size=10 S5 s5 S6 s6 Not safe for green. S7 s7 S8 s8 S9 s9 H4 H5 H6 10 15 5 5 5 5 5 5 5 5 5 5 5 We use tokens to represent the sizes of the flows C(r1, b2, g3, r4, b4, g4, r5, b5, g5, r6, b6, g6, q7, q8, q9) ∧ (r′
1 > 0) ∧ (r1 ≥ r′ 1)
∧ (r1 − r′
1 = r′ 4 − r4) ∧ (r′ 4 + b4 + g4 ≤ 10) →
C(r′
1, b2, g3, r′ 4, b4, g4, r5, b5, g5, r6, b6, g6, q7, q8, q9) 11
SLIDE 42
Implementation and Experiments
We use Internet Topology Zoo - real world topologies Randomly generate forwarding tables to connect hosts Make a set of nodes unsafe for certain types of traffics Repair the buggy network with updating a minimal number of switches
12
SLIDE 43
Implementation and Experiments
Benchmarks #Nodes#Links #Rels. #Lattice #Eld Time(s) Cesnet200304 29 33 3 2.22×1010 145 4.98 Arpanet19706 9 10 3 2.22×1010 91 2.98 Oxford 20 26 8 3.89×1027 664 16.70 Garr200902 54 71 6 4.92×1020 3045 107.62 Getnet 7 8 2 7.90×106 61 1.45 Surfnet 50 73 3 2.22×1010 101 3.49 Itnet 11 10 1 2.81×103 17 0.18 Garr199904 23 25 1 2.81×103 19 0.33 Darkstrand 28 31 5 1.75×1017 425 14.81 Carnet 44 43 2 7.90×106 37 0.49 Atmnet 21 22 1 2.81×103 15 0.67 HiberniaCanada 13 14 11 8.63×1037 1795 84.56 Evolink 37 45 1 2.81×103 14 0.20 Ernet 30 32 4 6.23×1013 140 4.94 Bren 37 38 6 4.92×1020 974 25.14
13
SLIDE 44
Related Work
Nikolaj Bjørner, Arie Gurfinkel, Ken McMillan, and Andrey Rybalchenko: “ Horn clause solvers for program verification”, 2015. Shambwaditya Saha, M. Prabhu, P. Madhusudan: “NETGEN: Synthesizing Data-plane configurations for Network Policies”, SOSR 2015. Aws Albarghouthi, Yi Li, Arie Gurfinkel, Marsha Chechik: “UFO: A Framework for Abstraction- and Interpolation-Based Software Verification”, CAV 2012. Sergey Grebenshchikov, Nuno P. Lopes, Corneliu Popeea, Andrey Rybalchenko: “Synthesizing Software Verifiers from Proof Rules”, PLDI 2012. Anvesh Komuravelli, Arie Gurfinkel, Sagar Chaki and Edmund M. Clarke: “Automated Abstraction in SMT-Based Unbounded Software Model Checking”, CAV 2013
14
SLIDE 45 Summary
Conservative repair procedure: Does not add new clauses Does not change the structure of the relation symbols Can only add constraints to the bodies of clauses Pros: Relation symbols have normally a specific interpretation in the problem domain Translation of the repair solution back to the domain is easy There are many applications
◮ e.g. in software defined networking
15
