BUZZ: testing context-dependent policies in stateful networks

摘要: Checking whether a network correctly implements intended policies is challenging even for basic reachability (Can X talk to Y?) in simple stateless networks with L2/L3 devices. In practice, operators implement more complex context-dependent by composing stateful functions; e.g., if the IDS flags sending too many failed connections, then subsequent packets from must be sent deep-packet inspection device. Unfortunately, existing approaches verification have fundamental expressiveness and scalability challenges handling such scenarios. To bridge this gap, we present BUZZ, practical model-based testing framework. BUZZ's design makes two key contributions: (1) Expressive scalable models of data plane, using novel high-level traffic unit abstraction modeling functions as an ensemble finite-state machines; (2) A application symbolic execution tackle state-space explosion. We show that BUZZ generates test cases hundreds within minutes (five orders magnitude faster than alternative designs). also uncovers range both new known policy violations SDN/NFV systems.