Protocol Analysis / Analysis of Software Artifacts Kevin Bierhoff

Transcription

1 Protocol Anlysis / Anlysis of Softwre Artifcts Kevin Bierhoff

2 Tke-Awys Protocols define temporl ordering of events Cn often be cptured with stte mchines Protocol nlysis needs to py ttention to Interprocedurl control flow Alising of objects Disjoint sets nd cpbilities cn hndle lising correctly 2

3 Agend Exmple protocols Modeling protocols s stte mchines Protocol nlysis pproches Annottions vs. interprocedurl nlyses Alising chllenges Trcking lises in methods nd fields Protocol implementtion checking 3

4 Strems cn be red until they re closed public interfce InputStrem { public int red(); public void close(); } Strem smple client InputStrem f = new FileInputStrem( ); int c = f.red(); // red first chrcter while(c >= 0) { // do something with c c = f.red(); // red next chrcter } f.close(); Strem protocol stte mchine red() open close() closed 4

5 Sockets go through welldefined sequence of creted, connected, closed }) public clss Socket creted ) public creted, connected ) public void connect( connected ) public InputStrem getinputstrem() Jv Socket protocol creted connect( ) getinputstrem() connected connected ) public OutputStrem connected, closed ) public void close(); close() closed 5

6 Jv Applets hve funny bck edge Jv Applet protocol creted strt() init() initilized strt() running stop() stopped destroy() destroyed Exmple bsed on: G. Firbnks, D. Grln & W. Scherlis. Design frgments mke using frmeworks esier. In Proceedings of OOPSLA 06, pp ACM Press,

7 Crystl3 nlyses hve the sme bck edge creted Crystl3 method nlysis protocol beforeallmethods() nlyzemethod( ) running beforeallmethods() fterallmethods() done Unwreness of this bck edge cn led to outdted error reports 7

8 Protocols constrin temporl ordering of events Protocols define restrictions on which methods cn be clled when Clients hve to follow protocols in order to void runtime errors Protocols cn often be modeled s stte mchines 8

9 Protocol documenttion Protocols re informlly documented Exmple: jv.io.inputstrem Detiled Jvdoc for every method Exmple: jv.net.socket Exceptions describe when methods cnnot be clled Not lwys complete nd precise 9

10 formlized in vrious wys Formliztion Annottions on clsses nd methods Regulr expressions Stte mchine defined in one plce (similr to Metl) Socket creted, connected, closed }) public clss Socket creted ) public creted, connected ) public void connect( ) connect (getinputstrem getoutputstrem)* close creted : connect( ) -> connected connected : getinputstrem() -> connected close() -> closed We will use nnottions on clsses nd methods 10

12 Protocol nlysis trcks sttes of vribles Socket sock = new Socket(); sock.connect(new InetSocketAddress( " InputStrem in = sock.getinputstrem(); sock.close(); Post-stte Creted Connected Connected Closed Wht if sock is ssigned to nother vrible? Wht if sock is ssigned to field? Wht if sock is pssed to nother method? 12

13 Clling other methods public clss SocketClient { privte String redsocket(socket s) { InputStrem in = s.getinputstrem(); // red nd return string } public String redremotedt() { Socket sock = new Socket(); sock.connect(new InetSocketAddress( " String result = redsocket(sock); sock.close(); return result; } } Is this cll ok? Is this cll ok? Need to hndle inter-procedurl control flow 13

14 Interprocedurl nlysis techniques Need to hndle inter-procedurl control flow Every method cll could potentilly ffect nlysis results Need to figure out wht hppens in clled methods Some possible pproches Defult ssumptions Interprocedurl CFG More nnottions 14

15 Defults too inflexible for protocol nlysis Simple pproch: defult ssumptions Assumption bout method prmeters nd result Check tht cll nd return sites respect the defult Exmple: Mybe-null ssumption in null nlysis (HW6) Assume tht method prmeters my be null Check methods with tht ssumption All cll nd return sites utomticlly mybe-null No resonble defult for protocol nlysis Any stte too imprecise (lots of flse positives) Optimistic ssumption ( prticulr stte) might be wrong lot of the times 15

16 Interprocedurl CFG inlines method clls Interprocedurl CFG Pretend tht clled methods re prt of current method Every method ppers once Problem: sclbility One big CFG for the entire progrm BEGIN sock = new Socket(); sock.connect( ); redsocket(sock); sock.close(); BEGIN s.getinputstrem(); END END Interprocedurl CFG hrd to use t scle 16

17 Assume nd Check Annottions Annottions Strting dtflow vlue for ll prmeters Dtflow vlue for result Verifiction Initil info: strting vlue for prmeters Verify result nnottion result Ending vlue for result obeys nnottion Verify rg nnottion rg String connected ) Socket s) { InputStrem in = s.getinputstrem(); } Actul rguments obey nnottions on forml prmeter 17

19 Looks fmilir? Alising is problem tht you cn esily hve t1 t2 t3 SimpleProtocolTest t1 = new SimpleProtocolTest(); SimpleProtocolTest t2 = new SimpleProtocolTest(); -- SimpleProtocolTest t3 = t1; t1.tob(); b // t1 lis t3 in b, t2 in t1 = t2; // t3 in b, t1 lis t2 in t1.tob(); t3.btoc(); Spurious wrnings b b ERR t2.inb(); b ERR // t1 lis t2 in b, t3 in c Alising = multiple nmes for the sme thing 19

20 Trck locl lises s disjoint sets (k equivlence clsses) Trck lised vribles s disjoint sets Lttice informtion A = { S1,, Sn } S1,, Sn disjoint sets of vribles Copy instructions x = y Get y s lises S A where y S Add x to S (nd remove it from ny other set) Object lloctions x = new C( ) Remove x from existing sets A = A { x } (i.e., dd new set with just x) (Need to lso set initil stte for x) Trck stte for ech disjoint set Method clls x = y.m( ) Get y s lises S = { y1,, yn } where y S Updte S s stte ccording to m s spec 20

21 Disjoint sets correctly hndle locl lises in exmple lising t1 t2 t3 SimpleProtocolTest t1 = new SimpleProtocolTest(); {t1} SimpleProtocolTest t2 = new SimpleProtocolTest(); {t1}, {t2} -- SimpleProtocolTest t3 = t1; {t1,t3}, {t2} t1.tob(); {t1,t3}, {t2} b b // t1 lis t3 in b, t2 in t1 = t2; {t1,t2}, {t3} b // t3 in b, t1 lis t2 in t1.tob(); {t1,t2}, {t3} b b b t3.btoc(); {t1,t2}, {t3} b b c t2.inb(); {t1,t2}, {t3} b b c // t1 lis t2 in b, t3 in c Sttes of lised vribles re updted correctly 21

22 Clling other methods cn ffect fields public clss AlisingFun() b ) privte SimpleProtocolTest t2; Our pproch so fr does not issue ny wrnings privte void cllfield() { t2.inb(); Field nnottion mkes this cll go through } public void lisingfun() { SimpleProtocolTest t1 = new t2 is SimpleProtocolTest(); ctully in c when clled t1.tob(); internl(t1); This cll violtes t2 s nnottion t1.btoc(); cllfield(); privte void internl(@instte( b ) SimpleProtocolTest t) { t2 = t; t2 lises t nd t1 } } Fields hold on to objects beyond durtion of methods 22

23 Alising through fields different from locl vribles Alising in locl vribles ffects current method only We cn hndle tht with disjoint sets Fields hold on to objects Assignment to field in one method cn ffect other methods Chnging stte of locl vrible cn indvertently chnge stte of field Other situtions with similr problems? 23

24 Cpbilities trck whether n object is ccessible Cpbilities: Access objects only if not stored in field Exctly one cpbility for ech object Cn cll methods only if cpbility vilble x.m( ) only vlid if cller hs cpbility for x Cpbility creted with new Field ssignments x.f = y Cpture cpbility for y Annotte methods with if cpbility needed but not if cpbility needed nd returned 24

25 Cpbilities correctly hndle field ssignments nd method clls public clss AlisingFun() b ) privte SimpleProtocolTest t; privte void cllfield() { t.inb(); } public void lisingfun() { SimpleProtocolTest t1 = new SimpleProtocolTest(); } t1.tob(); internl(t1); t1.btoc(); cllfield(); Error: No cpbility for t1 privte void internl(@borrowed SimpleProtocolTest t) { } privte void internl(@cptured SimpleProtocolTest t) { t2 = t; } 25

26 Disjoint sets nd cpbilities cn hndle lising correctly Trck disjoint sets of locl lises Hndle copies between locl vribles One cpbility for ech object Hndle ssignments to fields Cpbility nnottions on methods Hndle lising during method clls F. Smith, D. Wlker & G. Morrisett. Alis types. In Europen Symposium on Progrmming, pges Springer, R. DeLine & M. Fähndrich. Enforcing high-level protocols in low-level softwre. In ACM Conference on Progrmming Lnguge Design nd Implementtion, pges 59-69,

27 Cpbilities re sometimes not enough Source clls receive(byte) to deposit chrcters ReceivedLst() signls no more chrcters in in Pipe out out Reder clls red() to retrieve chrcters Reder clls close() to close the pipe Unsfe to cll close() before source finished within eof closed red() returns -1 Pipe is modified through two independent lises 27

28 Permissions for shred ccess Permissions generlize cpbilities Permission required for ll object ccess Mny permissions to the sme object cn exist But keep trck of how mny permissions there re Unique(x) is the only existing permission for object referenced by x Similr to cpbility for x Hlf(x) is one of two permissions for x Hlf(x) + Hlf(x) = Unique(x) 28

29 Permissions in pipe exmple Source clls receive(byte) to deposit chrcters ReceivedLst() signls no more chrcters Hlf(snk) in in Pipe out out Reder clls red() to retrieve chrcters Reder clls close() to close the pipe Unsfe to cll close() before source finished Hlf(s) Unique(s) Hlf + Hlf => Unique Hlf(this) within eof closed red() returns -1 Chnge to eof with Hlf permission Unique permission needed to close the pipe 29

31 Implementtion checking trcks chnges to fields So fr we looked t clients Code clling methods on sockets etc. Assumed tht declred protocol ws right Checking protocol implementtions Does this chnge stte s declred? Stte chnges = field mnipultions Protocols ensure tht something hppened lredy (or hs not hppened yet) Something cn (only) be recorded in fields 31

32 Stte invrints define sttes in terms of fields client Buffered strem public clss BufferedInputStrem { privte InputStrem in; privte byte[] buffer; privte int pos, count; // open: in instte (within eof) && buffer!= null && 0 pos count && count buffer.length // closed: in == null && buffer == null in Underlying strem Stte invrints constrin fields Constrints on field vlues E.g., greter thn zero or non-null Expected stte of referenced object E.g., underlying strem should be within or eof but only while in prticulr stte close() will chnge fields ccordingly 32

33 Don t forget lising! client Buffered strem in Underlying strem public clss BufferedInputStrem { privte InputStrem in; privte byte[] buffer; privte int pos, count; // open: in instte (within eof) && buffer!= null && 0 pos count && count buffer.length // closed: in == null && buffer == null Wht hppens when the underlying strem clls bck to the buffer? As it turns out, such re-entrnt cllbck cn violte count s invrint, leding to n ccess to buffer outside its bounds. 33