Slide 1
Slide 1 text
SYMNET
Matei Popovici, Costin Raiciu, Radu Stoenescu
a static tool for
network verification
Slide 2
Slide 2 text
Network function virtualization
Slide 3
Slide 3 text
No content
Slide 4
Slide 4 text
No content
Slide 5
Slide 5 text
Hard to
reason about
Slide 6
Slide 6 text
Hard to
maintain
Hard to
reason about
Slide 7
Slide 7 text
No content
Slide 8
Slide 8 text
No content
Slide 9
Slide 9 text
Hardware
Slide 10
Slide 10 text
Hardware
// Change the following line to refer to
your interface's IP and Ethernet //
addresses. AddressInfo(the_interface
1.0.0.1 0:0:c0:8a:67:ef);
classifier :: Classifier(12/0800 /* IP packets
*/, 12/0806 20/0001 /* ARP requests */, -
/* everything else */); ip_classifier ::
IPClassifier(dst udp port 1234 /* relevant
UDP packets */, - /* everything else
Software
Slide 11
Slide 11 text
Hardware
// Change the following line to refer to
your interface's IP and Ethernet //
addresses. AddressInfo(the_interface
1.0.0.1 0:0:c0:8a:67:ef);
classifier :: Classifier(12/0800 /* IP packets
*/, 12/0806 20/0001 /* ARP requests */, -
/* everything else */); ip_classifier ::
IPClassifier(dst udp port 1234 /* relevant
UDP packets */, - /* everything else
Software
Click
Slide 12
Slide 12 text
Hardware
// Change the following line to refer to
your interface's IP and Ethernet //
addresses. AddressInfo(the_interface
1.0.0.1 0:0:c0:8a:67:ef);
classifier :: Classifier(12/0800 /* IP packets
*/, 12/0806 20/0001 /* ARP requests */, -
/* everything else */); ip_classifier ::
IPClassifier(dst udp port 1234 /* relevant
UDP packets */, - /* everything else
Software
Click
Slide 13
Slide 13 text
Hardware
// Change the following line to refer to
your interface's IP and Ethernet //
addresses. AddressInfo(the_interface
1.0.0.1 0:0:c0:8a:67:ef);
classifier :: Classifier(12/0800 /* IP packets
*/, 12/0806 20/0001 /* ARP requests */, -
/* everything else */); ip_classifier ::
IPClassifier(dst udp port 1234 /* relevant
UDP packets */, - /* everything else
Software
Click
ClickOS
Slide 14
Slide 14 text
Hardware
// Change the following line to refer to
your interface's IP and Ethernet //
addresses. AddressInfo(the_interface
1.0.0.1 0:0:c0:8a:67:ef);
classifier :: Classifier(12/0800 /* IP packets
*/, 12/0806 20/0001 /* ARP requests */, -
/* everything else */); ip_classifier ::
IPClassifier(dst udp port 1234 /* relevant
UDP packets */, - /* everything else
Software
Click
ClickOS
Slide 15
Slide 15 text
Hardware
// Change the following line to refer to
your interface's IP and Ethernet //
addresses. AddressInfo(the_interface
1.0.0.1 0:0:c0:8a:67:ef);
classifier :: Classifier(12/0800 /* IP packets
*/, 12/0806 20/0001 /* ARP requests */, -
/* everything else */); ip_classifier ::
IPClassifier(dst udp port 1234 /* relevant
UDP packets */, - /* everything else
Software
Click
ClickOS
Slide 16
Slide 16 text
Examples
Slide 17
Slide 17 text
Examples
Slide 18
Slide 18 text
Examples
Slide 19
Slide 19 text
Examples
Slide 20
Slide 20 text
Examples
Slide 21
Slide 21 text
Virtualization vs. configuration
12/0806 20/0001
Slide 22
Slide 22 text
Virtualization vs. configuration
access-list extended permit tcp host 192.168.1.1 any
12/0806 20/0001
Slide 23
Slide 23 text
Virtualization vs. configuration
access-list extended permit tcp host 192.168.1.1 any
12/0806 20/0001
Slide 24
Slide 24 text
Virtualization vs. configuration
access-list extended permit tcp host 192.168.1.1 any
in -> IPClassifier(„dst host 192.168.1.1 and tcp”) -> out
12/0806 20/0001
Slide 25
Slide 25 text
Virtualization vs. configuration
access-list extended permit tcp host 192.168.1.1 any
in -> IPClassifier(„dst host 192.168.1.1 and tcp”) -> out
12/0806 20/0001
in -> IPClassifier(„12/0806 20/0001”) -> out
Slide 26
Slide 26 text
Virtualization vs. configuration
access-list extended permit tcp host 192.168.1.1 any
in -> IPClassifier(„dst host 192.168.1.1 and tcp”) -> out
12/0806 20/0001
in -> IPClassifier(„12/0806 20/0001”) -> out
ARP req
Slide 27
Slide 27 text
Challenges
Slide 28
Slide 28 text
Challenges
• Debugging
Slide 29
Slide 29 text
Challenges
• Debugging
• Understanding the „software” topology
Slide 30
Slide 30 text
Challenges
• Debugging
• Understanding the „software” topology
• Offering guarantees that software
processing behaves as intended
Slide 31
Slide 31 text
Verifying network processing
Slide 32
Slide 32 text
Verifying network processing
formally
Slide 33
Slide 33 text
What is out there...
Slide 34
Slide 34 text
What is out there...
on
off
off
on
off
Slide 35
Slide 35 text
What is out there...
on
off
off
on
off
Slide 36
Slide 36 text
What is out there...
on
off
off
on
off
Slide 37
Slide 37 text
What is out there...
on
off
off
on
off
Slide 38
Slide 38 text
What is out there...
on
off
off
on
off
Slide 39
Slide 39 text
What is out there...
on
off
off
on
off
Model checking
Slide 40
Slide 40 text
What is out there...
on
off
off
on
off
Model checking
A(int x, int y) {
if (x == 2)
return A(x,x+y);
if (y == 1)
return A(x-1,y);
return x-y;
}
Slide 41
Slide 41 text
What is out there...
on
off
off
on
off
Model checking
A(int x, int y) {
if (x == 2)
return A(x,x+y);
if (y == 1)
return A(x-1,y);
return x-y;
}
-32767 < x < 32767
Slide 42
Slide 42 text
What is out there...
on
off
off
on
off
Model checking
A(int x, int y) {
if (x == 2)
return A(x,x+y);
if (y == 1)
return A(x-1,y);
return x-y;
}
-32767 < x < 32767 -32767 < y < 32767
Slide 43
Slide 43 text
What is out there...
on
off
off
on
off
Model checking
A(int x, int y) {
if (x == 2)
return A(x,x+y);
if (y == 1)
return A(x-1,y);
return x-y;
}
-32767 < x < 32767 -32767 < y < 32767
x =2
Slide 44
Slide 44 text
What is out there...
on
off
off
on
off
Model checking
A(int x, int y) {
if (x == 2)
return A(x,x+y);
if (y == 1)
return A(x-1,y);
return x-y;
}
-32767 < x < 32767 -32767 < y < 32767
x =2
y =1
Slide 45
Slide 45 text
What is out there...
on
off
off
on
off
Model checking
A(int x, int y) {
if (x == 2)
return A(x,x+y);
if (y == 1)
return A(x-1,y);
return x-y;
}
-32767 < x < 32767 -32767 < y < 32767
x =2
y =1
Symbolic execution
Slide 46
Slide 46 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Slide 47
Slide 47 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Slide 48
Slide 48 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Trim ethernet
Slide 49
Slide 49 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Trim ethernet
TCP packet
Slide 50
Slide 50 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Trim ethernet
TCP packet
RW src IP and TCP
Slide 51
Slide 51 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Trim ethernet
TCP packet
RW src IP and TCP
Add ethernet header
Slide 52
Slide 52 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Trim ethernet
TCP packet UDP packet
RW src IP and TCP
Add ethernet header
Slide 53
Slide 53 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Trim ethernet
TCP packet UDP packet
RW src IP and TCP
Add ethernet header
Encapsulate in IP
Slide 54
Slide 54 text
Our setting
FromDevice(eth0)
->Strip(14)
->c :: IPClassifier(„tcp”,”udp”)[0]
->IPRewriter(„pattern 10.0.0.1 20 - -”)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth1)
c[1]
->IPEncap(4, 18.26.4.24, 140.247.60.147)
->EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2)
->ToDevice(eth2)
Arbitrary packet
Trim ethernet
TCP packet UDP packet
RW src IP and TCP
Add ethernet header
Encapsulate in IP
Add ethernet header
Slide 55
Slide 55 text
Arbitrary packet
Trim ethernet
TCP packet
UDP packet
RW src IP and TCP
Add ethernet header
Encapsulate in IP
Add ethernet header
Slide 56
Slide 56 text
Arbitrary packet
Trim ethernet
TCP packet
UDP packet
RW src IP and TCP
Add ethernet header
Encapsulate in IP
Add ethernet header
Slide 57
Slide 57 text
Our idea
Slide 58
Slide 58 text
Our idea
Symbolic
execution
Slide 59
Slide 59 text
Our idea
Symbolic
execution
...
Slide 60
Slide 60 text
Our idea
Symbolic
execution
on all
paths...
...
Slide 61
Slide 61 text
Treat sets of packets as n-dimensional spaces
Slide 62
Slide 62 text
Treat sets of packets as n-dimensional spaces
Source IP = 169.168.0.1
Source IP = 169.168.0.255
Slide 63
Slide 63 text
Treat sets of packets as n-dimensional spaces
Source IP = 169.168.0.1
Source IP = 169.168.0.255
IP proto = 6
IP proto = 17
Slide 64
Slide 64 text
Treat packet processing elements as functions
Slide 65
Slide 65 text
Treat packet processing elements as functions
Slide 66
Slide 66 text
Treat packet processing elements as functions
Slide 67
Slide 67 text
Treat packet processing elements as functions
Slide 68
Slide 68 text
Treat packet processing elements as functions
Filtering
function
Slide 69
Slide 69 text
Treat packet processing elements as functions
Filtering
function
Slide 70
Slide 70 text
Treat packet processing elements as functions
Filtering
function
Slide 71
Slide 71 text
Treat packet processing elements as functions
Filtering
function
Slide 72
Slide 72 text
Treat packet processing elements as functions
Filtering
function
Modify
function
Slide 73
Slide 73 text
Treat packet processing elements as functions
Filtering
function
Modify
function
Reunion, disjunction,
complement,
set difference
Slide 74
Slide 74 text
Compute reachability and loop detection
Slide 75
Slide 75 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 76
Slide 76 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 77
Slide 77 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 78
Slide 78 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 79
Slide 79 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 80
Slide 80 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 81
Slide 81 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 82
Slide 82 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 83
Slide 83 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Slide 84
Slide 84 text
... where functional programming
comes into play
Slide 85
Slide 85 text
Writing flow operations intuitively
Slide 86
Slide 86 text
Writing flow operations intuitively
(„IPSrc” .=. „192.168.0.1”) .>. nil
Slide 87
Slide 87 text
Writing flow operations intuitively
(„IPSrc” .=. „192.168.0.1”) .>. nil
(„proto” .=. „4”) .>. nil
Slide 88
Slide 88 text
Writing flow operations intuitively
(„IPSrc” .=. „192.168.0.1”) .>. nil
(„proto” .=. „4”) .>. nil
((„IPSrc” .=. „192.168.0.1”) .>. nil) `cup` ((„proto” .=. „4”) .>. nil)
Slide 89
Slide 89 text
Writing flow operations intuitively
(„IPSrc” .=. „192.168.0.1”) .>. nil
(„proto” .=. „4”) .>. nil
((„IPSrc” .=. „192.168.0.1”) .>. nil) `cup` ((„proto” .=. „4”) .>. nil)
(„DstPort” .=. „80”) .>. ((„IPSrc” .=. „192.168.0.1”) .>. nil) `cup`
((„proto” .=. „4”) .>. nil)
Slide 90
Slide 90 text
Hiding actual representation
Slide 91
Slide 91 text
Hiding actual representation
class AsExpression a where
(.=.) :: Var -> a -> VarBinding
Slide 92
Slide 92 text
Hiding actual representation
class AsExpression a where
(.=.) :: Var -> a -> VarBinding
instance AsExpression String where
v .=. s = ...
Slide 93
Slide 93 text
Hiding actual representation
class AsExpression a where
(.=.) :: Var -> a -> VarBinding
instance AsExpression String where
v .=. s = ...
instance AsExpression Integer where
v .=. i =
Slide 94
Slide 94 text
Hiding actual representation
class AsExpression a where
(.=.) :: Var -> a -> VarBinding
instance AsExpression String where
v .=. s = ...
instance AsExpression Integer where
v .=. i =
instance AsExpression Expr where
v .=. e = v `Bind` e
Slide 95
Slide 95 text
Hiding actual representation
class AsExpression a where
(.=.) :: Var -> a -> VarBinding
instance AsExpression String where
v .=. s = ...
instance AsExpression Integer where
v .=. i =
instance AsExpression Expr where
v .=. e = v `Bind` e
data VarBinding = Bind Var Expr
Slide 96
Slide 96 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Slide 97
Slide 97 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Slide 98
Slide 98 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Should I process
this flow?
Slide 99
Slide 99 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Should I process
this flow?
Slide 100
Slide 100 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Should I process
this flow?
How should I
modify the flow?
Slide 101
Slide 101 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Should I process
this flow?
How should I
modify the flow?
(m,a) `comp` (m',a') =
let mfin f = (m f) && (m' f)
afin = a . a'
in (mfin, afin)
Slide 102
Slide 102 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Should I process
this flow?
How should I
modify the flow?
(m,a) `comp` (m',a') =
let mfin f = (m f) && (m' f)
afin = a . a'
in (mfin, afin)
(m,a) `comp` (m',a') =
let mfin f = (m f) && (m' (a f))
afin = a . a'
in (mfin, afin)
Slide 103
Slide 103 text
Processing elements as functions
type Rule = (Flow -> Bool, Flow -> Flow)
Should I process
this flow?
How should I
modify the flow?
(m,a) `comp` (m',a') =
let mfin f = (m f) && (m' f)
afin = a . a'
in (mfin, afin)
(m,a) `comp` (m',a') =
let mfin f = (m f) && (m' (a f))
afin = a . a'
in (mfin, afin)
Building more sofisticated
processing from simpler one
Slide 104
Slide 104 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
„Object-oriented” style
Slide 105
Slide 105 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Slide 106
Slide 106 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Visitor
Slide 107
Slide 107 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Visitor
Visitor
Slide 108
Slide 108 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Visitor
Visitor
Slide 109
Slide 109 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Visitor
Visitor
Slide 110
Slide 110 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Visitor
Slide 111
Slide 111 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Visitor
Slide 112
Slide 112 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
Visitable
„Object-oriented” style
Visitable
Visitable
Visitable
Visitable
Visitable
Visitor
Slide 113
Slide 113 text
How the code looks like...
Slide 114
Slide 114 text
How the code looks like...
abstract class Element {
Slide 115
Slide 115 text
How the code looks like...
abstract class Element {
public boolean match(Flow f);
Slide 116
Slide 116 text
How the code looks like...
abstract class Element {
public boolean match(Flow f);
public Map apply(Flow f);
Slide 117
Slide 117 text
How the code looks like...
abstract class Element {
public boolean match(Flow f);
public Map apply(Flow f);
}
Slide 118
Slide 118 text
How the code looks like...
abstract class Element {
public boolean match(Flow f);
public Map apply(Flow f);
public void accept(Visitor v){
...
}
}
Slide 119
Slide 119 text
How the code looks like...
abstract class Visitor {
private Flow currentFlow();
public Set visit(Element e){
...
}
}
Slide 120
Slide 120 text
How the code looks like...
abstract class Visitor {
private Flow currentFlow();
public Set visit(Element e){
Map m = ...
if (e.match(currentFlow()){
m = e.apply(currentFlow());
// process m
}
return m.keySet();
}
}
Slide 121
Slide 121 text
How the code looks like...
abstract class Element {
public boolean match(Flow f);
public Map apply(Flow f);
public void accept(Visitor v){
for (Element e:v.visit(this)){
e.accept(v);
}
}
Slide 122
Slide 122 text
Compute reachability and loop detection
„Functional” style
Slide 123
Slide 123 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
„Functional” style
Slide 124
Slide 124 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
„Functional” style
(match,apply)
(match,apply)
(match,apply)
(match,apply)
Slide 125
Slide 125 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
„Functional” style
(match,apply)
(match,apply)
(match,apply)
(match,apply)
Push ports into the flow
Slide 126
Slide 126 text
Compute reachability and loop detection
Src FW
R1
R2
R3 Dst
„Functional” style
(match,apply)
(match,apply)
(match,apply)
(match,apply)
Push ports into the flow
Slide 127
Slide 127 text
Compute reachability and loop detection
FW
R1
R2
R3
„Functional” style
(match,apply)
(match,apply)
(match,apply)
(match,apply)
Network Function F
Slide 128
Slide 128 text
How the code looks like...
F :: [Flow] -> [Flow]
Slide 129
Slide 129 text
How the code looks like...
F :: [Flow] -> [Flow]
F [] = [„the initial flow, with it’s corresponding port” ]
Slide 130
Slide 130 text
How the code looks like...
F :: [Flow] -> [Flow]
F [] = [„the initial flow, with it’s corresponding port” ]
F X = map (\(f,r) -> apply f r) $
[(f,r) | f <- X , r <- ruleList, match f r]
Slide 131
Slide 131 text
How the code looks like...
F :: [Flow] -> [Flow]
F [] = [„the initial flow, with it’s corresponding port” ]
F X = map (\(f,r) -> apply f r) $
[(f,r) | f <- X , r <- ruleList, match f r]
What happens
next?
Slide 132
Slide 132 text
We compute...
Slide 133
Slide 133 text
We compute...
F [] = F0
Slide 134
Slide 134 text
We compute...
F [] = F0
F F0 = F1
Slide 135
Slide 135 text
We compute...
F [] = F0
F F0 = F1
...
Slide 136
Slide 136 text
We compute...
F [] = F0
F F0 = F1
...
F Fn = Fn+1
Slide 137
Slide 137 text
We compute...
F [] = F0
F F0 = F1
...
F Fn = Fn+1
...
Slide 138
Slide 138 text
We compute...
F [] = F0
F F0 = F1
...
F Fn = Fn+1
...
The sequence
stabilises eventually
Slide 139
Slide 139 text
We compute...
F [] = F0
F F0 = F1
...
F Fn = Fn+1
...
lfp :: ([Flow] -> [Flow]) -> [Flow]
lfp F = let g x y =
if x == x ++ y then x else g (x++y) (F y)
in g [] (F [])
The sequence
stabilises eventually
Slide 140
Slide 140 text
Final remarks
Slide 141
Slide 141 text
Final remarks
• The code on the slides will not compile
Slide 142
Slide 142 text
Final remarks
• The code on the slides will not compile
• Many ideas are due:
– Kazemian et al. Header Space Analysis: Static Checking For
Networks
Slide 143
Slide 143 text
Final remarks
• The code on the slides will not compile
• Many ideas are due:
– Kazemian et al. Header Space Analysis: Static Checking For
Networks
• One of our contributions is in modelling packet state,
by pushing it in the flow
Slide 144
Slide 144 text
Final remarks
• The code on the slides will not compile
• Many ideas are due:
– Kazemian et al. Header Space Analysis: Static Checking For
Networks
• One of our contributions is in modelling packet state,
by pushing it in the flow
• Does the functional style beat the object oriented one?