Combining Static Model Checking with Dynamic Enforcement Using the Statecall Policy Language

Abstract

Abstract. Internet protocols encapsulate a significant amount of state, making implementing the host software complex. In this paper, we define the Statecall Policy Language (SPL) which provides a usable middle ground between ad-hoc coding and formal reasoning. It enables programmers to embed automata in their code which can be statically modelchecked using SPIN and dynamically enforced. The performance overheads are minimal, and the automata also provide higher-level debugging capabilities. We also describe some practical uses of SPL by describing the automata used in an SSH server written entirely in OCaml/SPL.Constructing modern Internet servers is a difficult proposition, since the software must encapsulate a significant amount of state and deal with a variety of incoming packet types, complex configurations and versioning inconsistencies. Network applications are also expected to be liberal in interpreting received data packets and must reliably deal with timing and ordering issues arising from the "best-effort" nature of Internet data traffic.Due to this complexity, mechanical verification techniques are very useful to guarantee safety, security and reliability properties. One mature formal method used to verify properties about systems is model checking. Software modelchecking involves: (i ) creating an abstract model of a complex application; (ii ) validating this model against the application; and (iii ) checking safety properties against the abstract model. To non-experts, steps (i ) and (ii ) are often the most daunting. How does one decide which aspects of the application to include in the abstract model? How does one determine whether the abstraction inadvertently "hides" critical bugs? If a counter-example is found, how does one determine whether this is a genuine bug or just a modeling artifact?In this paper, we present the Statecall Policy Language (SPL) which simplifies the model specification and validation tasks with a view to making model checking more accessible to regular programmers. SPL is a high-level modelling language which enables developers to specify models in terms of allowable program events (e.g. valid sequences of received network packets). We have implemented a compiler that translates SPL into both Promela and a generalpurpose programming language (e.g. OCaml). The generated Promela can be used with SPIN [1] in order to check static properties of the model. The OCaml code provides an executable model in the form of a safety monitor . A developer

Generating Optimised and Formally Checked Packet Parsing Code

“…For instance, with the Statecall Policy Language presented by Madhavapeddy et al [14], one can describe statefull automatons which are compiled into three different targets: OCaml code to embed in an application, Promela code to check temporal properties with the SPIN 8 model checker, and HTML/Ajax code for real-time monitoring of the application. Another example is the declarative sensor networks (DSN) platform (Chu et al [7]).…”

Multiscale not Multicore: Efficient Heterogeneous Cloud Computing

“…Any blocking function can be macro-expanded at compile-time to block more often, for example with a high-level debugger. We have previously explored these ideas while integrating modelchecking into server applications [25] and are now prototyping a web-based debugger specially designed to find problems in Mirage code.…”

“…We have the first revision of Mirage running, 12 targeting Xen cloud systems and desktop operating systems, and are working on retargeting for ARM-based handhelds. There are many "bare-metal" optimizations in progress for the cloud target which promise improved performance, as well as integrating improved versions of our previous work on fast, type-safe network parsing [26] and model-checking [25]. Even unoptimised, the runtime library for a cloud backend is around 1MB in size, in contrast to Linux distributions which are difficult to squeeze below 16MB and Windows which runs into hundreds of megabytes.…”

Validating Key-value Based Implementations of the Raft Consensus Algorithm for Distributed Systems

“…Overall architecture of the simulator [3]The state transition models of Raft were encoded using the Statecall Policy Language (SPL)[4,5]. They used OCaml to build their simulator, instead of the original implementation of Raft which was done in C++ because OCaml provided static typing and a powerful module system.Their implementation could also test and detect bugs in the implementation.To test the Raft protocol across diverse network environments, they built a message level network simulation function.…”