Engineering with logic: Rigorous test-oracle specification and validation for TCP/IP and the Sockets API
View / Open Files
Authors
Bishop, S
Fairbairn, M
Mehnert, H
Norrish, M
Ridge, T
Sewell, Peter
Smith, M
Wansbrough, K
Publication Date
2019-01Journal Title
Journal of the ACM
ISSN
0004-5411
Publisher
Association for Computing Machinery (ACM)
Volume
66
Issue
1
Type
Article
This Version
AM
Metadata
Show full item recordCitation
Bishop, S., Fairbairn, M., Mehnert, H., Norrish, M., Ridge, T., Sewell, P., Smith, M., & et al. (2019). Engineering with logic: Rigorous test-oracle specification and validation for TCP/IP and the Sockets API. Journal of the ACM, 66 (1) https://doi.org/10.1145/3243650
Abstract
<jats:p>Conventional computer engineering relies on test-and-debug development processes, with the behavior of common interfaces described (at best) with prose specification documents. But prose specifications cannot be used in test-and-debug development in any automated way, and prose is a poor medium for expressing complex (and loose) specifications.</jats:p>
<jats:p>The TCP/IP protocols and Sockets API are a good example of this: they play a vital role in modern communication and computation, and interoperability between implementations is essential. But what exactly they are is surprisingly obscure: their original development focused on “rough consensus and running code,” augmented by prose RFC specifications that do not precisely define what it means for an implementation to be correct. Ultimately, the actual standard is the de facto one of the common implementations, including, for example, the 15 000 to 20 000 lines of the BSD implementation—optimized and multithreaded C code, time dependent, with asynchronous event handlers, intertwined with the operating system, and security critical.</jats:p>
<jats:p>
This article reports on work done in the
<jats:italic>Netsem</jats:italic>
project to develop lightweight mathematically rigorous techniques that can be applied to such systems: to specify their behavior precisely (but loosely enough to permit the required implementation variation) and to test whether these specifications and the implementations correspond with specifications that are
<jats:italic>executable as test oracles</jats:italic>
. We developed post hoc specifications of TCP, UDP, and the Sockets API, both of the service that they provide to applications (in terms of TCP bidirectional stream connections) and of the internal operation of the protocol (in terms of TCP segments and UDP datagrams), together with a testable abstraction function relating the two. These specifications are rigorous, detailed, readable, with broad coverage, and rather accurate. Working within a general-purpose proof assistant (HOL4), we developed
<jats:italic>language idioms</jats:italic>
(within higher-order logic) in which to write the specifications: operational semantics with nondeterminism, time, system calls, monadic relational programming, and so forth. We followed an
<jats:italic>experimental semantics</jats:italic>
approach, validating the specifications against several thousand traces captured from three implementations (FreeBSD, Linux, and WinXP). Many differences between these were identified, as were a number of bugs. Validation was done using a special-purpose
<jats:italic>symbolic model checker</jats:italic>
programmed above HOL4.
</jats:p>
<jats:p>Having demonstrated that our logic-based engineering techniques suffice for handling real-world protocols, we argue that similar techniques could be applied to future critical software infrastructure at design time, leading to cleaner designs and (via specification-based testing) more robust and predictable implementations. In cases where specification looseness can be controlled, this should be possible with lightweight techniques, without the need for a general-purpose proof assistant, at relatively little cost.</jats:p>
Sponsorship
EPSRC Programme Grant EP/K008528/1 REMS: Rigorous Engineering for Mainstream Systems
EPSRC Leadership Fellowship EP/H005633 (Sewell)
Royal Society University Research Fellowship (Sewell)
St Catharine's College Heller Research Fellowship (Wansbrough),
EPSRC grant GR/N24872 Wide-area programming: Language, Semantics and Infrastructure Design
EPSRC grant EP/C510712 NETSEM: Rigorous Semantics for Real
Systems
EC FET-GC project IST-2001-33234 PEPITO Peer-to-Peer Computing: Implementation and Theory
CMI UROP internship support (Smith)
EC Thematic Network IST-2001-38957 APPSEM 2
NICTA was funded by the Australian Government's Backing Australia's Ability initiative, in part through the Australian Research Council.
Funder references
Engineering and Physical Sciences Research Council (EP/H005633/1)
Royal Society (516002K5921/KK)
EPSRC (532)
Engineering and Physical Sciences Research Council (EP/K008528/1)
European Research Council (789108)
Identifiers
External DOI: https://doi.org/10.1145/3243650
This record's URL: https://www.repository.cam.ac.uk/handle/1810/287587
Rights
Licence:
http://www.rioxx.net/licenses/all-rights-reserved
Statistics
Total file downloads (since January 2020). For more information on metrics see the
IRUS guide.