[PPT] - Software NFs The good: The fmexibility of software The software PowerPoint Presentation

SLIDE 1

Automated Synthesis of Adversarial Workloads for Network Functions

Luis Pedrosa, Rishabh Iyer, Arseniy Zaostrovnykh, Jonas Fietz, Katerina Argyraki

Network Architecture Laboratory

SLIDE 2

2

Software NFs

The good:

The fmexibility of software The software development cycle

The bad:

The reliability of software Inconsistent performance

The ugly:

Adversarial traffjc / DoS / Slowdowns

SLIDE 3

3

We need better tools...

Dynamic analysis: profjling

Reasons about known inputs Helps fjnd root cause / debug Only as good as the inputs used

SLIDE 4

4

WCET

We need better tools...

Static analysis

Reasons about potential inputs in abstract Over-approximating: WCET Under-approximating: adversarial inputs

MAX Latency (not to scale) Typical Adversarial

SLIDE 5

5

Statically analyze NF

Analyze code Generate PCAP fjle with adversarial workload

Exploit

The CPU cache hierarchy Algorithmic complexity

It works!

Increased NF latency up to 3×

CASTAN – Cycle Approximating Symbolic Timing Analysis for NFs

SLIDE 6

6

Outline

Introduction SymbEx in a Nutshell CASTAN Evaluation Conclusion

SLIDE 7

7

SymbEx in a Nutshell

Procedure Interpret code with symbolic values

1 : i n t v a r = i n p u t ( ) ; 2 : r e t u r n v a r + + ; / / α / / + 1 α

J. C. King, Symbolic Execution and Program Testing, 1976

SLIDE 8

8

SymbEx in a Nutshell

Procedure Interpret code with symbolic values

1 : i n t v a r = i n p u t ( ) ; / / α 2 : i f ( v a r > = ) { 3 : r e t u r n v a r ; 4 : } e l s e { 5 : r e t u r n

v

a r ; 6 : }

SLIDE 9

9

SymbEx in a Nutshell

Procedure Interpret code with symbolic values Fork execution on symbolic conditions Keep track of path constraints

1 : i n t v a r = i n p u t ( ) ; / / α 2 : i f ( v a r > = ) { 3 : r e t u r n v a r ; 4 : } e l s e { 5 : r e t u r n

v

a r ; 6 : } / / i f > = α α / /

i

f < α α

SLIDE 10

10

SymbEx in a Nutshell

Procedure Interpret code with symbolic values Fork execution on symbolic conditions Keep track of path constraints SMT solver fjnds concrete inputs

1 : i n t v a r = i n p u t ( ) ; / / α 2 : i f ( v a r > = ) { 3 : r e t u r n v a r ; 4 : } e l s e { 5 : r e t u r n

v

a r ; 6 : } / / i f > = α α / /

i

f < α α , e . g . = α , e . g . =

1

α

SLIDE 11

11

SymbEx in a Nutshell

Challenges

Path Explosion! T ypically exponential # of paths / branch Unbounded with loops Impractical to SymbEx exhaustively

SLIDE 12

12

SymbEx in a Nutshell

Mitigation

Can’t do everything: prioritize! Directed Symbolic Execution

Prioritize executing relevant paths over others Graph search with heuristic T ry to reach a bug / increase coverage / etc. Stop SEE when satisfjed (or impatient)

SLIDE 13

13

CASTAN

Overview

Generate adversarial NF workloads

Packet sequence ⇒ more CPU cycles / packet

Under-approximate: not WCET Largely automated

SLIDE 14

14

CASTAN

Approach

Exploits performance variation

1. CPU cache: +DRAM accesses
2. Algorithmic complexity: +instructions
3. Hashing: reverse to expose internals

SLIDE 15

15

CASTAN

Attacking the CPU Cache

Symbolic Pointers

Index into memory with packet: a r r a y [ p a c k e t . d s t _ a d d r ] Find packets ⇒ memory addresses ⇒ DRAM access

CPU Cache Model

Simple 1-tier model of the LLC Models contention, associativity, write-back Empirical contention set model

SLIDE 16

16

CASTAN

Attacking Algorithmic Complexity

Maximize Instructions / Packet

Find packets ⇒ longer code paths

Guide SymbEx with a Heuristic

Maximize cycles w/o inducing breadth-fjrst-search Estimate cycles / packet

Receive Packet Receive Packet

SLIDE 17

17

CASTAN

Attacking Algorithmic Complexity

CFG Distance Heuristic

max(successors)+cost<current> cost = cycles conservatively assuming an L1 hit

SLIDE 18

18

∞
∞
∞
∞
∞

CASTAN

Attacking Algorithmic Complexity

CFG Distance Heuristic

max(successors)+cost<current> cost = cycles conservatively assuming an L1 hit

SLIDE 19

19

∞
∞
∞
∞
∞

CASTAN

Attacking Algorithmic Complexity

CFG Distance Heuristic

max(successors)+cost<current> cost = cycles conservatively assuming an L1 hit 1 2

∞

3

∞

SLIDE 20

20

∞
∞
∞
∞
∞

CASTAN

Attacking Algorithmic Complexity

CFG Distance Heuristic

max(successors)+cost<current> cost = cycles conservatively assuming an L1 hit 1 2

∞

3

∞

1 2 4 3 5

SLIDE 21

21

CASTAN

Attacking Algorithmic Complexity

Handling Loops

Distance vector algorithm Limit repeats to 2 (unrolls loops once)

SLIDE 22

22

CASTAN

Attacking Algorithmic Complexity

Handling Loops

Distance vector algorithm Limit repeats to 2 (unrolls loops once)

∞
∞
∞
∞
∞

SLIDE 23

23

CASTAN

Attacking Algorithmic Complexity

Handling Loops

Distance vector algorithm Limit repeats to 2 (unrolls loops once)

∞
∞
∞
∞
∞

1 4 2 3 3

SLIDE 24

24

CASTAN

Attacking Algorithmic Complexity

Handling Loops

Distance vector algorithm Limit repeats to 2 (unrolls loops once)

∞
∞
∞
∞
∞

1 4 2 3 3

SLIDE 25

25

CASTAN

Attacking Algorithmic Complexity

Handling Loops

Distance vector algorithm Limit repeats to 2 (unrolls loops once)

∞
∞
∞
∞
∞

1 4 2 3 3 5 8 6 7 7

SLIDE 26

26

CASTAN

Handling Hash Functions

SymbExing hash functions is hard

Complex expression / Path explosion Reason about hash value, without computing it?

SLIDE 27

27

CASTAN

Handling Hash Functions

SymbExing hash functions is hard

Complex expression / Path explosion Reason about hash value, without computing it?

Havocing

Annotate and disable hash function Assign hash value a new symbol Analyze data structure internals unencumbered Find packet ⇒ hash value ⇒ expected behavior

SLIDE 28

28

CASTAN

Handling Hash Functions Packets Hash Inputs Hashes Solve Hashes Reverse Hashes Solve Packets

✘

SLIDE 29

29

Evaluation

Setup

Network Measurement Campaign

E2E Latency / Throughput Intel Xeon E5-2667v2 3.3GHz

25.6MB LLC / 32GB RAM

Intel 82599ES 10Gb NICs

Tester DUT

SLIDE 30

30

Evaluation

NFs

11 NF Implementations

3 types, difgerent data structures

NAT LB LPM Unbalanced Tree

Red-Black Tree
Hash Ring
Hash Table
Hierarchical Lookup (DPDK)
Single Lookup
Patricia Trie

SLIDE 31

31

Evaluation

NFs

11 NF Implementations

3 types, difgerent data structures

NAT LB LPM Unbalanced Tree

Red-Black Tree
Hash Ring
Hash Table
Hierarchical Lookup (DPDK)
Single Lookup
Patricia Trie
Algorithmic

Complexity Cache

SLIDE 32

32

Evaluation

Workloads

Baseline

NOP

Adversarial

CASTAN (~50 fmows), Manual (~50 fmows)

Random

UniRand (1Mfmows) Zipf (100kpkts, 6.7kfmows) UniRand CASTAN (# fmows = CASTAN)

SLIDE 33

33

Evaluation

LPM / Single Lookup Table

3× 3×

CDF

SLIDE 34

34

Evaluation

LPM / Single Lookup Table

3× 3×

CDF

CASTAN induces DRAM accesses 3× Latency ≃ UniRand; 2×105 fewer flows

SLIDE 35

35

Evaluation

LPM / Single Lookup Table

19%
19%

SLIDE 36

36

Evaluation

NAT / Unbalanced Tree

1.7× 1.7×

CDF

SLIDE 37

37

Evaluation

NAT / Unbalanced Tree

1.7× 1.7×

CDF

CASTAN skews the tree +70% Latency / -7% Throughput ≃ Manual; without intuition

SLIDE 38

38

Conclusion

CASTAN

Attacks complexity, CPU cache, hash functions Little developer input

Adversarial Workloads

≃ Manual when available > Uniform random for same number of fmows Up to +201% latency / -19% throughput

SLIDE 39

39

Find out more!

Look for our poster! Get the source and more: https://pedrosa.2y.net/Projects/CASTAN

SLIDE 40

40

Backup Slides

SLIDE 41

41

Cache Structure

3 bits 6 bits 6 bits 15 bits byte offset L1d line L2 line L3 slice 34 bits 1GB page offset 1GB page index

SLIDE 42

42

Latency Deviation from NOP

SLIDE 43

43

Throughput

SLIDE 44

44

LPM / Single Lookup Table

SLIDE 45

45

NAT / Unbalanced Tree

SLIDE 46

46

NAT / Hash Ring

SLIDE 47

47

NAT / Red-Black Tree

SLIDE 48

48

NAT / Hash Table

SLIDE 49

49

LPM / Hierarchical Lookup (DPDK)

SLIDE 50

50

LPM / Patricia Trie

SLIDE 51

51

LB / Unbalanced Tree

SLIDE 52

52

LB / Red-Black Tree

SLIDE 53

53

LB / Hash Ring

SLIDE 54

54

LB / Hash Table