SeqFuzzSDN

Abstract

Controllers for software-defined networks (SDNs) are centralised software components that enable advanced network functionalities, such as dynamic traffic engineering and network virtualisation. However, these functionalities increase the complexity of SDN controllers, making thorough testing crucial. Unlike traditional network components (e.g., switches), SDN controllers are stateful, maintaining a holistic view of the network and interacting with multiple network devices through sequences of control messages. Identifying stateful failures in an SDN controller is challenging due to the infinite possible sequences of control messages, which result in an unbounded number of stateful interactions between the controller and network devices. In this article, we propose SeqFuzzSDN, a learning-guided fuzzing method for testing stateful SDN controllers. SeqFuzzSDN aims to:

1. efficiently explore the state space of the SDN controller under test,
2. generate effective and diverse tests (i.e., control message sequences) to uncover failures, and
3. infer accurate failure-inducing models that characterise the sequences of control messages leading to failures.

In addition, we compare SeqFuzzSDN with three extensions of state-of-the-art (SOTA) methods for fuzzing SDNs, as none of them are directly comparable to SeqFuzzSDN. Our findings show that, compared to the extended SOTA methods, SeqFuzzSDN (1) generates more diverse message sequences (i.e., diverse stateful behaviours) that lead to failures within the same time budget, and (2) produces more accurate failure-inducing models, significantly outperforming the other extended SOTA methods in terms of sensitivity.

Prerequisite

---

In order to build and install SeqFuzzSDN, the following tools are required:

• Python >= 3.9
• Maven >= 3.9
• Java JDK >= 11
• Mininet

---

Build

The source codes of the SeqFuzzSDN are implemented using Python3.9+ and Java11+. They can be compiled on any Linux distribution that supports Python3.9+ and Java11+, and the dependency libraries cited above.

To compile the sources, the following steps are required:

$ cd src/leafsdn
$ git clone <link to the repository>
$ make clean build

After compilation, the python wheel of the application and the jar file of the fuzzer will be available under the folder <leafsdn_root>/dist/.

Deploy

To install the application and the fuzzer, run the following command:

$ make deploy

The executable files will be installed under the folder $XDG_HOME_BIN (By default ~/.local/bin). The configuration files will be installed under the folder $XDG_CONFIG_HOME (By default ~/.config).

Usage

1. To run a fuzzing campaign

usage: leafsdn run [-h] [--list-scenarios] [--failure FAILURE] [--log-level {trace,debug,info,warning,error}] [--fuzzer-jar-path FUZZER_JAR_PATH] [--fuzzer-socket-address FUZZER_SOCKET_ADDRESS] [--resume ITERATION PHASE]
                   name {onos} scenario iterations exec_per_iter

Run fuzzing experiments on SDN controllers

positional arguments:
  name                  Name of the campaign to run
  {onos}                Name of the controller to use for the campaign
  scenario              Name of the scenario to run for the experiment. Run "leafsdn run --list-scenarios" to list the available scenarios.
  iterations            Number of iterations to run for the experiment
  exec_per_iter         Number of executions per iteration to run for the experiment

optional arguments:
  -h, --help            Show this help message and exit
  --list-scenarios      List the available scenarios and exit
  --failure FAILURE, -f FAILURE
                        Which failure to focus in the campaign. Default is `None`.
  --log-level {trace,debug,info,warning,error}
                        Set the log level
  --fuzzer-jar-path FUZZER_JAR_PATH
                        Override the path to the fuzzer jar file
  --fuzzer-socket-address FUZZER_SOCKET_ADDRESS
                        Override the socket address of the fuzzer.
  --resume ITERATION PHASE
                        Resume the experiment from the specified iteration and phase

2. To evaluate a fuzzing campaign

usage: leafsdn evaluation [-h] [--if-summary-exists] [--skip-plot  [...]] campaign

Evaluate a fuzzing campaign from SeqFuzzSDN

positional arguments:
  campaign              Name of the campaign to evaluate

optional arguments:
  -h, --help            show this help message and exit
  --if-summary-exists   What to do if the campaign has already been evaluated. Valid options are "update", "skip", or "error". Default is "error".
  --skip-plot  [ ...]   Skip the evaluation of certain parts of the campaign. Allowed values are "all" or any of the following: "data_models_performance", "efsm_sensitivity", "entropy_of_efsm_state_exercises", "error_rate", "pareto_front",
                        "traces_diversity_increase"

---

Data Availability

The raw data that were generated during the experiments are not available in this artifact due to their large size (over 100GB, compressed). The treated data are however available in this artifact. To access those data or re-run the evaluation,

To access the raw data, please contact the authors of SeqFuzzSDN.

Licensing

This software is © University of Luxembourg and is licensed under the GPLv3 license. See the LICENSE file.