Design and Verification of Software Middleboxes using Gravel

Middleboxes play a critical role in modern networks, yet providing bug-free middleboxes implementations remains challenging. This paper presents Gravel, a framework for building formally verified middleboxes. Gravel allows developers to specify high-level middlebox-specific properties, as opposed to generic robustness and liveness conditions, and checks correctness in low-level implementations without manual proofs. Further, Gravel reduces the proof burden by breaking down middlebox functionalities into smaller packet processing elements that can be independently verified. We build a NAT, a load balancer, and a firewall with Gravel and then verify their correctness. Our evaluation shows that middleboxes built with Gravel avoid bugs similar to those found in today’s middleboxes and achieve similar performance to their unverified counterparts.