Engineering with logic: HOL specification and symbolic-evaluation testing for TCP implementations

  • Authors:

  • Steve Bishop;Matthew Fairbairn;Michael Norrish;Peter Sewell;Michael Smith;Keith Wansbrough

  • Affiliations:

  • University of Cambridge Computer Laboratory;University of Cambridge Computer Laboratory;NICTA, Canberra;University of Cambridge Computer Laboratory;University of Cambridge Computer Laboratory;University of Cambridge Computer Laboratory

  • Venue:
  • Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

The TCP/IP protocols and Sockets API underlie much of modern computation, but their semantics have historically been very complex and ill-defined. The real standard is the de facto one of the common implementations, including, for example, the 15,000--20,000 lines of C in the BSD implementation. Dealing rigorously with the behaviour of such bodies of code is challenging.We have recently developed a post-hoc specification of TCP, UDP, and Sockets that is rigorous, detailed, readable, has broad coverage, and is remarkably accurate. In this paper we describe the novel techniques that were required.Working within a general-purpose proof assistant (HOL), we developed language idioms (within higher-order logic) in which to write the specification: operational semantics with nondeterminism, time, system calls, monadic relational programming, etc. We followed an experimental semantics approach, validating the specification against several thousand traces captured from three implementations (FreeBSD, Linux, and WinXP). Many differences between these were identified, and a number of bugs. Validation was done using a special-purpose symbolic model checker programmed above HOL.We suggest that similar logic engineering techniques could be applied to future critical software infrastructure at design time, leading to cleaner designs and (via specification-based testing using a similar checker) more predictable implementations.