with Dynamic Information Flow Analysis Mona Attariyan Jason Flinn - PowerPoint PPT Presentation

Automating Configuration Troubleshooting with Dynamic Information Flow Analysis Mona Attariyan Jason Flinn University of Michigan

Configuration Troubleshooting Is Difficult Software systems Users make mistakes difficult to configure Mona Attariyan - University of Michigan 2

Configuration Troubleshooting Is Difficult Software systems Users make mistakes difficult to configure Misconfigurations happen Mona Attariyan - University of Michigan 3

Configuration Troubleshooting Is Difficult Mona Attariyan - University of Michigan 4

What To Do With Misconfiguration? Ask colleagues config file …… Search manual, FAQ, …… &$%#! online forums ….. ….. Look at the code if available Mona Attariyan - University of Michigan 5

What To Do With Misconfiguration? A tool that automatically finds the root cause of the misconfiguration in applications? Mona Attariyan - University of Michigan 6

ConfAid Insight Application code has enough information to lead us to the root cause How? Dynamic information flow analysis on application binaries Mona Attariyan - University of Michigan 7

How to Use ConfAid? config file Application …… …… …… error Mona Attariyan - University of Michigan 8

How to Use ConfAid? ConfAid config file Application …… …… …… error Mona Attariyan - University of Michigan 9

How to Use ConfAid? ConfAid config file Application …… …… …… error Mona Attariyan - University of Michigan 10

How to Use ConfAid? ConfAid config file Application …… …… …… likely root causes 1)… 2)… error 3)… …… Mona Attariyan - University of Michigan 11

Outline • Motivation • How ConfAid runs • Information flow analysis algorithms • Embracing imprecise analysis • Evaluation • Conclusion Mona Attariyan - University of Michigan 12

How Developers Find Root Cause Application Config file file = open(config file) ExecCGI token = read_token(file) if (token equals “ ExecCGI ”) execute_cgi = 1 … if (execute_cgi == 1) ERROR() Mona Attariyan - University of Michigan 13

How Developers Find Root Cause Application Config file file = open(config file) ExecCGI token = read_token(file) if (token equals “ ExecCGI ”) execute_cgi = 1 … if (execute_cgi == 1) ERROR() Mona Attariyan - University of Michigan 14

How ConfAid Finds Root Cause • ConfAid uses taint tracking Config file file = open(config file) ExecCGI token = read_token(file) if (token equals “ ExecCGI ”) execute_cgi = 1 … if (execute_cgi == 1) ERROR() Mona Attariyan - University of Michigan 15

How ConfAid Finds Root Cause • ConfAid uses taint tracking Config file file = open(config file) ExecCGI token = read_token(file) if (token equals “ ExecCGI ”) execute_cgi = 1 … if (execute_cgi == 1) ERROR() Mona Attariyan - University of Michigan 16

How to Avoid Error? if (a) if (b) if (c) 17

How to Avoid Error? if (a) if (b) if (c) 18

How to Avoid Error? if (a) This path ends before the error happens if (b) if (c) 19

How to Avoid Error? if (a) This path ends before the error happens if (b) This path leads to some other error if (c) 20

How to Avoid Error? if (a) This path ends before the error happens if (b) This path leads to some other error if (c) This path successfully avoids the error 21

How to Avoid Error? if (a) This path ends before the error happens if (b) This path leads to some other error likely root if (c) cause This path successfully avoids the error 22

How to Avoid Error? if (a) This path ends before the error happens if (b) This path leads to some other error likely root if (c) cause This path successfully avoids the error 23

Outline • Motivation • How ConfAid runs • Information flow analysis algorithms • Embracing imprecise analysis • Evaluation • Conclusion Mona Attariyan - University of Michigan 24

Data Flow Analysis value of x might change, T x = { , } if tokens or change Taint propagates via data flow and control flow x = y + z , T y = { , } T x = { , , } T z = { , } T y  T z Mona Attariyan - University of Michigan 25

Control Flow Analysis T c = { } T a = { } /* c = 0 */ T x = { } /* x is read from file*/ if (c == 0) { , ,( T x = { ) } Ʌ x = a } What could cause Data flow Control flow x to be different ? Mona Attariyan - University of Michigan 26

Alternate Path Exploration /* c = 1*/ /* y is read from file*/ if(c) if (c) { /*taken path*/ … } else { y = a } y depends on c Mona Attariyan - University of Michigan 27

Alternate Path Exploration /* c = 1*/ /* y is read from file*/ if(c) if (c) { /*taken path*/ … } else { y = a } y depends on c Mona Attariyan - University of Michigan 28

Alternate Path Exploration /* c = 1*/ /* y is read from file*/ ckpt if(c) if(!c) if (c) { /*taken path*/ … } else { y = a } y depends on c Mona Attariyan - University of Michigan 29

Alternate Path Exploration /* c = 1*/ /* y is read from file*/ ckpt if(c) if(!c) if (c) { /*taken path*/ y = a … } else { y = a } y depends on c Mona Attariyan - University of Michigan 30

Alternate Path Exploration /* c = 1*/ /* y is read from file*/ ckpt if(c) if(!c) if (c) { /*taken path*/ … } else { y = a } y depends on c Mona Attariyan - University of Michigan 31

Alternate Path Exploration /* c = 1*/ /* y is read from file*/ if(c) if (c) { /*taken path*/ … } else { y = a } y depends on c Mona Attariyan - University of Michigan 32

Alternate Path Exploration /* c = 1*/ /* y is read from file*/ if(c) if (c) { /*taken path*/ … } else { y = a } y depends on c Mona Attariyan - University of Michigan 33

Effect of Alternate Path Exploration /* c = 1*/ T c = { } T a = { } /* y is from file*/ T y = { } if (c) { … , ,( T y = { ) } Ʌ } else { y = a Alternate path Alternate path } + Data flow exploration What could cause y to be different? Mona Attariyan - University of Michigan 34

Outline • Motivation • How ConfAid runs • Information flow analysis algorithms • Embracing imprecise analysis • Evaluation • Conclusion Mona Attariyan - University of Michigan 35

Embracing Imprecise Analysis • Complete and sound analysis leads to: – poor performance – high false positive rate Bounded horizon heuristic • To improve performance Single mistake heuristic • To reduce false positives Weighting heuristic Mona Attariyan - University of Michigan 36

Bounded Horizon Heuristic • Bounded horizon prevents path explosion • Alternate path runs a fixed # of instructions if (b) likely root max reached, if (c) causes abort exploration 37

Single Mistake Heuristic • Configuration file contains a single mistake • Reduces amount of taint and # of explored paths /* x=1, c=0*/ T x = { } T x = { , , ( Ʌ )} T c = { } if (c == 0) { x = a T a = { } } Mona Attariyan - University of Michigan 38

Single Mistake Heuristic • Configuration file contains a single mistake • Reduces amount of taint and # of explored paths /* x=1, c=0*/ T x = { } T x = { , , ( Ʌ )} T c = { } if (c == 0) { x = a T a = { } } Mona Attariyan - University of Michigan 39

Weighting Heuristic • Insufficient to treat all taint propagations equally – Data flow introduces stronger dependency than ctrl flow – Branches closer to error stronger than farther branches • Assign weights to taints to represent strength level – Data flow taint gets a higher weight than ctrl flow taint – Branches closer to error get higher weight than farther Mona Attariyan - University of Michigan 40

Example of Weighting Heuristic if (x) { … if (y) { … likely root if (z) { causes ERROR() } } } Mona Attariyan - University of Michigan 41

Heuristics: Pros and Cons Bounded Single mistake Weighting horizon Simplify control  flow analysis Improve   performance Reduce FP   Increase FP Increase FN FP = False Positive, FN = False Negative 42

ConfAid and Multi-process Apps • ConfAid propagates taints between processes – Intercepts IPC system calls – Sends taint along with the data • ConfAid currently supports communication via: – Unix sockets, pipes, TCP and UDP sockets – Regular files Mona Attariyan - University of Michigan 43

Outline • Motivation • How ConfAid runs • Information flow analysis algorithms • Embracing imprecise analys is • Evaluation • Conclusion Mona Attariyan - University of Michigan 44

Evaluation • ConfAid debugs misconfiguration in: – OpenSSH 5.1 (2 processes) – Apache HTTP server 2.2.14 (1 process) – Postfix mail transfer agent 2.7 (up to 6 processes) • Manually inject errors to configuration files • Evaluation metrics: – The ranking of the correct root cause – The time to execute the application with ConfAid Mona Attariyan - University of Michigan 45