Comments (2)
Thank you for sharing your valuable contribution. I believe it would make a very nice addition to the collection of TLA+ specifications.
A few comments on how you could improve your spec, in roughly decreasing order of importance:
- Consider replacing certain CHOOSE expressions by existential quantification so that all possible matches will be considered when model checking. Here is a concrete example of how I'd define one of the actions in your spec, but there are several similar patterns:
FwProcAclTimeOut == \E r \in AclRuleSet : *aging and deleted randomly,remove from current rule table
/\ r.sPort = MATCH_ANY
/\ FwState = "Work"
/\ AclRuleSet # {} * --- actually superfluous because we require r \in AclRuleSet
/\ AclRuleSet' = AclRuleSet \ {r}
/\ AgedRuleSet' = AgedRuleSet \cup {r} * record aged rule into log.
/\ UNCHANGED user_vars
/\ UNCHANGED sdpsvr_vars
/\ UNCHANGED attacker_vars
/\ UNCHANGED <<FwState,DropPackets>>
/\ UNCHANGED server_vars
/\ UNCHANGED Public_vars
As a rule of thumb, CHOOSE should be used only if there is exactly one value that matches the predicate.
-
I understand that your Encrypt / Decrypt operators are only approximations of the real functions, but do you actually need such a concrete representation? My understanding is that you work in the Dolev-Yao model, and there one typically abstracts these operations as uninterpreted terms that only ensure that Decrypt(Encrypt(d,k), k) = d while Decrypt(Encrypt(d,k), k') gives a meaningless result when k' # k.
-
Introduce LET definitions to eliminate common subexpressions in order to make definitions more readable, for example
UsrRcvSynAck ==
/\ uState = "Connecting"
/\ uTCPLinkSet # {}
/\ uChannel # <<>>
/\ Head(uChannel).Flg = "TCP_SYN_ACK"
/\ Head(uChannel).Type = "User"
/\ HasMatchLink(Head(uChannel),uTCPLinkSet) * Receive TCP_SYN_ACK from target server and match the connecting TCP socket
/\ LET l == GetMatchLink(Head(uChannel),uTCPLinkSet)
IN uTCPLinkSet' = (uTCPLinkSet \ {l})
\cup { [sIP |-> l.sIP,
sPort |-> l.sPort,
dIP |-> l.dIP,
dPort |-> l.dPort,
State |-> "ESTABLISHED" * Updata TCP link status to established
]
}
/\ uState' = "Connected" * The user successfully access the target server
/\ uChannel' = Tail(uChannel) *Send TCP ACK packet (the last step of hand shake) to target server
/\ FwDataChannel' = Append(FwDataChannel, EndPointBulidTcpAckPkt(Head(uChannel),"User"))
/\ UNCHANGED <<uIP, uID, Key, uTstamp, uSDPSvrInfo, uSvrInfo, uAuthSession>>
/\ UNCHANGED sdpsvr_vars
/\ UNCHANGED fw_vars
/\ UNCHANGED attacker_vars
/\ UNCHANGED server_vars
/\ UNCHANGED <<AuthChannel,FwCtlChannel,aChannel,sChannel>>
- Replace IF ... THEN ... ELSE expressions that return TRUE or FALSE by formulas. Two examples:
FindAntiReplay(msg,wnd) ==
\E r \in wnd : (msg.ClientID = r.ClientID /\ msg.Tstamp = r.Tstamp)
NewLink(p,LinkSet) ==
/ LinkSet = {} * -- in fact, this disjunct is superfluous because \A x \in {} : ... is TRUE
/ \A x \in LinkSet: ( *without matching TCB (TCP Control Block)
/ x.sIP # p.sIP
/ x.dIP # p.dIP
/ x.sPort # p.sPort
/ x.dPort # p.dPort )
-
Parentheses around properly aligned conjunction / disjunction lists are superfluous.
-
Make use of operators defined in the Community Modules. In particular, you include a copy of module Bitwise, which is part of the community modules. (But perhaps you don't need those operators at all, see above remark, and I am not even sure if you currently use them in your spec, given that you define your own XOR?) Also, your operator Seq2Set could be replaced by either ToSet from module SequencesExt or Range from module Functions.
-
While you are at it, try to reduce the number of typos, for example replace UsrBulidTcpSynPkt by UsrBuildTcpSynPkt, and improve the clarity of comments, for example I don't really know how to interpret "If a data access link with an invalid authentication session ID, it means we don't know the data access is resulted by which Auth session".
When you are satisfied with your spec, please open a pull request so that we can merge it into the collection.
Thanks again!
Stephan
from examples.
Merged with d4c01e9
from examples.
Related Issues (20)
- Submodules vs. copying specs into the repo HOT 2
- `ctl[p]` is never equal `"req"` in specifications/SpecifyingSystems/Liveness properties HOT 6
- GitPod & Codespaces - make sure bitrot hasn't set in
- Add TLC models for all specs for which it's viable
- Add some Apalache models HOT 5
- Bakery-Boulangerie specs don't satisfy `DeadlockFree` or `StarvationFree` liveness properties HOT 1
- Can't come up with working model for cbc_max or spanning HOT 1
- Liveness and Safety properties fail in SpanTreeRandom.tla HOT 11
- Deactivate macOS CI runners? HOT 3
- Add optional fields to manifest.json recording total and unique states for each model
- Add proof checking time to manifest details
- EWD998 model checking failure when running TLC from outside tlaplus/examples repo HOT 5
- Parameterize version of TLA+ tools used during CI run HOT 2
- Question about the specification of reliable broadcast algorithm by Bracha & Toueg (1985) HOT 8
- CI workflow fails on ubuntu HOT 7
- Do not suppress TLC output HOT 3
- Possible TLC regression on specifications/ewd998/EWD998ChanID.cfg HOT 7
- ERROR in specifications/SpecifyingSystems/Composing/CompositeFIFO.tla: In evaluation, the identifier in is either undefined or not an operator. HOT 1
- Remove deadlock flag in manifest.json in favor of `CHECK_DEADLOCK` in config file HOT 4
- Install TLA+ unicode converter into gitpod and codespaces HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from examples.