Narcissus: Deriving Correct-By-Construction Decoders and Encoders from Binary Formats

TL;DR

This paper presents Narcissus, a method using Coq to automatically derive correct-by-construction decoders and encoders for complex binary formats, including Internet protocols, ensuring they are inverses and reducing redundancy.

Contribution

It introduces a novel approach to generate correct-by-construction, inverse binary format parsers and serializers from natural specifications using Coq tactics, applicable to real-world network formats.

Findings

Successfully applied to Internet protocol stack packet formats.

Generated decoders and encoders with formal correctness guarantees.

Minimal performance impact when integrated into MirageOS.

Abstract

It is a neat result from functional programming that libraries of parser combinators can support rapid construction of decoders for quite a range of formats. With a little more work, the same combinator program can denote both a decoder and an encoder. Unfortunately, the real world is full of gnarly formats, as with the packet formats that make up the standard Internet protocol stack. Most past parser-combinator approaches cannot handle these formats, and the few exceptions require redundancy -- one part of the natural grammar needs to be hand-translated into hints in multiple parts of a parser program. We show how to recover very natural and nonredundant format specifications, covering all popular network packet formats and generating both decoders and encoders automatically. The catch is that we use the Coq proof assistant to derive both kinds of artifacts using tactics, automatically, in a way that guarantees that they form inverses of each other. We used our approach to reimplement packet processing for a full Internet protocol stack, inserting our replacement into the OCaml-based MirageOS unikernel, resulting in minimal performance degradation.

Figures