Refinement types in Jolie

Tchitchigin Alexander; Safina Larisa; Elwakil Mohamed; Mazzara Manuel; Montesi Fabrizio; Rivera Victor

Refinement Types in Jolie

Alexander Tchitchigin <a.chichigin@innopolis.ru> Larisa Safina <l.safina@innopolis.ru> MohamedElwakil <m.elwakil@innopolis.ru> Manuel Mazzara <m. mazzara@innopolis. ru > Fabrizio Montesi <fmontesi@imada.sdu.dk> Victor Rivera <v.rivera@innopolis.ru> Innopolis University, Software Engineering Lab. 420500, Russia, Innopolis, Universitetskaya Str. 1

Abstract. Jolie is the first language for microservices and it is currently dynamically type checked. This paper considers the opportunity to integrate dynamic and static type checking with the introduction of refinement types, verified via an SMT solver. The integration of the two aspects allows a scenario where the static verification of internal services and the dynamic verification of (potentially malicious) external services cooperate in order to reduce testing effort and enhance security.

Refinement types are well-known technique for numeric, array and algebraic data types. They rely on corresponding SMT-theories. Recently SMT solvers got support for a theory of strings and regular expressions. In the paper, we describe possible application of the theory to string refinement types. We use Jolie programming language to illustrate feasibility and usefulness of such extension. First, because Jolie already has syntax extension to support string refinements. We build on top of that extension to provide static type checking. Second, because in the realm of microservices the need for improved checking of string data is much higher as most of external communication goes through text-based protocols.

We present simplified but real-world example from the domain of web-development. We intentionally introduce a bug in the example demonstrating how easily it can slip a conventional type system. Proposed solution is feasible, as it do not accept program with the bug. Complete solution will need enhancements in precision and error reporting.

Keywords: Microservices, Jolie, Refinement Types, SMT, SAT, Z3 DOI: 10.15514/ISPRAS-2016-28(2)-2

For citation: Tchitchigin Alexander, Safina Larisa, Elwakil Mohamed, Mazzara Manuel, Montesi Fabrizio, Rivera Victor. Refinement Types in Jolie. Trudy ISP RAN/Proc. ISP RAS, vol. 28, issue 2, 2016, pp. 33-44. DOI: 10.15514/ISPRAS-2016-28(2)-2

1. Introduction

"Stringly typed" is a new antipattern referring to an implementation that needlessly relies on strings, when other options are available. The problem of "string typing" appears often in service-oriented architecture and microservices on the border between a service and its clients (external interfaces) due to necessity to communicate over text-based protocols (like HTTP) and collaboration with clients written in dynamically-typed languages (like JavaScript). The solution to this problem can be found with refinement types, which are used to statically (or dynamically) check compatibility of a given value and refined type by means of predicates constraining the set of possible values. Though employment of numerical refinements is well-known in programming languages, string refinements are still rare. In this paper, we introduce a design for extending the Jolie programming language [24,3] and its type system. On top of previous extensions with choice type [27] and regular expressions, we introduce here string refinement type and we motivate the reasons for such extension. Section 2 recalls the basic of the Jolie language and its type system while Section 3 describes the open problem this paper attacks with clarifying examples. Section 4 discusses related work in the context of using SMT solvers for static typing of refinement types.

2. Jolie programming language

Jolie [24] is the first programming language based on the paradigm of microservices [17] : all components are autonomous services that can be deployed independently and operate by running parallel processes, programmed following the workflow approach. Microservices can be composed to obtain, in turn, other microservices. The language was originally developed in the context of a major formalization effort for workflow and services composition languages, the EU Project SENSORIA [1], which spawned many models for reasoning on the composition of services (e.g., [19,20]). Jolie comes with a formally-specified semantics [16,15,23]; on the more practical side it is inspired by standards for Serviceoriented Computing such as WS-BPEL [4]. The combination of theoretical and practical aspects in Jolie enabled its usage in research on correct-by-construction software (see, e.g., [26,9,21]).

Microservices work together by exchanging messages. In Jolie, messages are structured as trees [23] (a variant of the structures that can be found in XML or JSON). Communications are type checked at runtime, when messages are sent or received. Type checking of incoming messages is especially relevant, since it mitigates the effect of ill-behaved clients. The work in [25] presents a first attempt at formalizing a static type checker for the core fragment of Jolie. However, for the time being, the language is still dynamically type checked.

3. Extension of Jolie Type System

Safina et al [28] extended the basic type system of Jolie with type choices. The work had been then continued with the addition of regular expression types, a special case

of refinement types. In refinement types, types are decorated with logical predicates which further constrain the set of values described by the type and therefore represent the specification of invariant on values. Here, we extend this with the possibility of expressing invariants on string values in form of regular expressions. The integration of static and dynamic analysis allows considering "internal" services (native Jolie services) and calls from "external" services (potentially developed in other languages) in a complementary way. The first ones can be statically checked while the second ones, which could exhibit malicious behavior, still need a runtime validation.

The key idea behind service-oriented computing, and microservices in particular, is the ability to connect services developed in different programming languages and possibly running on different servers over standard communication protocols [18]. A common use case is the implementation of APIs for Web and mobile applications. In such scenarios, the de-facto standard communication protocol is HTTP(S), combined with standardized data formats (SOAP, JSON, etc.).

HTTP is a text-based protocol, where all data get serialized into strings1. Moreover, clients of a service (an application or another service) may have been developed in a language that does not support particular datatypes (e.g., JavaScript does not have a datatype for calendar dates or time of day), therefore relying on string representation for internal processing too. The same issue arises with key-value storage systems (e.g., Memcache and Redis), which support only string keys and string values. These factors make string handling an important part of a service application, especially at the boundary with external systems.

Not all strings are made equal. For example, GUIDs are often used to identify records in a store. GUIDs are represented as strings of hexadecimal digits with a particular structure. Currently, developers have to manually check the conformance of received values to the expected format. In such a scenario, a developer has to find her way in a narrow stream between the Scylla of forgetting to insert necessary checks and the Charybdis of inserting too many checks for data that has been already validated2. Description of the shape of expected string data (like GUID or e-mail address) is natural with regular expressions. Adding the description of this shape to the datatype definition allows the compiler to automatically insert the necessary dynamic checks (for public functions) and statically validate the conformance (for internal calls). This is the extension of refinement type to string type. The same techniques and tools used for static verification of conformance for numerical refinements [17, 12] can be used for strings. For the purposes of this paper we will use Z3 SMT solver by Microsoft Research [6], which recently got support for theory of strings and regular expressions in its development branch.

1 Jolie partially mitigates this aspect with automatic conversion of string serializations to structured data by following the interface definition of the service [23]. However, this does not solve the general problem addressed here.

2 Scylla and Charybdis are monsters of Greek mythology living on the two sides of a narrow channel so that sailors trying to avoid one would have fallen into the other.

35

3.1 Example: a news board

The approach to static checking of string refinements using Z3 SMT solver is illustrated here by a simple example, i.e. a service using refined datatype for GUIDs and the SMT constraints generated for it.

A news board is a simple service in charge of retrieving posts composed by a particular user of the system. The service receives user information via HTTP in a string format. String refinement types allow the definition of constraints on user IDs as an alternative to the implementation of the logic checking the constraint inside the posts retrieving operation.

type guid: string {" [A—F\\d]{8 ,8} — [A—F\\d] {4 ,4} — [A—F\\d] _{4,4}— [A—F\\d] {4,4} — [A—F\\d] {12 ,12}")

Types for storing user and posts information are also necessary3.

type user : void { .uid : guid .name: string .age: int(age>18) } type post-type: void { .pid : guid . owner : guid .content : string } 'type posts: void { .post*: post.type }

We leave service deployment information out of this paper due to its low relevance to the topic, the full code example can be found in [2]. The behavioral fragment of the news board demonstrates the post retrieval for a particular user. To get the information the right user has to be found (finduserbyname) and pass the GUID to get all users posts.

There are two definitions of the operation in the following code fragment: all_posts_by_user and all_posts_by_user2. In the first one the correct data is passed to getallusers_posts, i.e. user.uid; while in the second user.name is passed. Without string refinement a problem would arise. The code is syntactically correct. However, it's semantically incorrect since no information can be retrieved by user's name when user's ID is actually expected.

3 Please note that in Jolie we structure the variable's data as a tree, where the nodes contain values. Using the void type for the variable on the top of the tree, we show that it contains no data and is used as a container for its subtypes.

36

main {

all_posts_by_uscr (name) {

find_user_by_name@SelfOut (name) ( user) ; get-all-users-posts@SelfOut (user . uid) (posts) } ;

all. posts. by_user2 (name) {

find .user _by _name@ S elfOu t ( name) ( user ) ; //and here we pass the wrong field! get_all_users_posts@SelfOut (user . name) (posts) }

//find user by name definition

// gct_all_users_posts definition

}

Introducing string refinement allows Jolie to have both dynamic and static checking for strings. In case of dynamic checking, the string is verified at runtime when passed to the receiving service. The more interesting case is static checking by means of SMT. Here we present the most essential parts of the encoding, complete example can be found in [2].

: notions c: f typ^j , terms ft hi I typing relation (dcclarc—sort Type) f declnrc—sort Term)

(declare-fun HaaType (Tenia Tyiw} Honl)

; type of strings of ^ programming language (declare—fun string () Type)

translation from ZS built—in String, type to our String type and back (declare—fun BoxStrtuj; (String) Term) (declnrc-fun string—term—va| (Torai) String) (assert (forall ((str String))

(= (string—term—val (BorString str)) str))) (assert (for a II ({s String)}

(HaaType ( R^jtStriiifi s) at ring)})

; gnid type that refine* string type

(declare—fun fjiiiil () Type)

(define-fun guid—re () (RegEx String)

: tlie construction of the regular expression is omitted )

; refinement (liifii) itiou Tor guid trpo (assert (foraIL {(x Term)) (iff (HasType x guid)

{and {HasType x string)

(sir-in .re ( string—term-v&l x) guid-re ) ) ) ) ) ; we define type 'user'' through it 's projections (declare—fan user () Type) ( dcclarc-fun user . uid (Term) Term) (declare-fun iiier.Dunv (Term) Term) ( (k'tlnrii-fuil ilser , sgv (Turin) Teriti) ; typing rules for projections (assort (for a M ((t Tram)) (Implies (HasType t usur)

(and (HasType ( user. uid t) guid)

(HasType (user.name t) string) (HasType (user,age t) nnt))}))

( dleclare—fUa find. user, by .naine (Terni) Tenu)

find .user.by.name : string — > user (assert (fora 11 ((name Term) ) (implies (HasType name string)

(HasType ( find.user_by_niiine name) user))))

; type rhecking for atl.posts.by .user (assert (not (forall ({t Term)) (implies (HasType t string)

(HasType (user, uid ( find_user_by _namc t)) guid))))) : type checking for al 1_post s_by_user2 (assert (not (forall ((t Term)) (implies (HasType t string)

(HasType ( user . name ( find_user_by_name t)) guid)))))

Type checking is based on proving a theorem stating that a function is correctly typed. Technically, the opposite proposition is actually stated and the SMT solver is put in charge of finding a counterexample. A failure in such an attempt leads to the conclusion that the original theorem has to be true (proof by contradiction). The Z3 solver successfully proves the well-typedness theorem for the correct implementation of all posts by user, and fails to disprove the incorrect implementation (all_posts_by_user2) due to many simplifications to the presented SMT encoding for the sake of clarity and understandability. Employment of a more sophisticated encoding for the actual implementation of refinement constraints may mitigate this situation and is left as future work.

4. Related Work

Within the context of functional languages, type-checking of refined types by employing SMT solvers is not new. In [7], the authors present the design and implementation of the F7 enhanced type-checker for the functional language F# that verifies security properties of cryptographic protocols and access control mechanisms using Z3 [10]. The SAGE language [17] employs a hybrid approach [13] that performs both static and dynamic type-checking. During compilation time, the Simplify theorem prover [11] is used to check refinement types. If Simplify is not able to decide a particular subtyping relation, a proper type cast is inserted in the code and it is checked at runtime. If the type cast fails during runtime, this particular subtyping relation is inserted in a database of known failed casts. In contrast to checking syntactic subtyping as in F7 and SAGE, the authors of [8], introduce semantic subtyping checking for a subset of the M language [5] using the Z3 SMT solver.

5. Conclusions

The Jolie language is dynamically type-checked. This paper explores the possibility of integrated dynamic and static type checking with the introduction of refinement types, verified via an SMT solver. The integration of the two aspects allows a scenario where the static verification of internal services and the dynamic verification of (potentially malicious) external services cooperates in order to reduce testing effort and enhance security.

In this work, we motivate the usefulness and feasibility of string refinement types using an example. Naturally, we need to integrate this extension with an actual type-checker employing a more advanced SMT-encoding. Not only for strings but for numerical types too which is well-known and useful tool for correctness enhancement.

When we have a type-checker for refinement types, an interesting empirical study would be checking of existing programs augmented with refined types to discover whether this technique can uncover bugs caused by a developer's oversight.

References

[1]. EU Project SENSORIA. Accessed April 2016. http://www.sensoria-ist.eu/.

[2]. Gist of SMT constraints for the example. Accessed April 2016. https://gist.github.com/gabriel-fallen/a04c3 3860e2157201fa8.

[3]. Jolie Programming Language. Accessed April 2016. http://www.jolie-lang.org/.

[4]. WS-BPEL OASIS Web Services Business Process Execution Language. accessed April 2016. http://docs.oasis-open.org/wsbpel/2.0/wsbpel-specification-draft.html.

[5]. Power Query formula reference. Technical Report, August 2015.

[6]. Microsoft Research. Accessed April 2016. Z3. https://github.com/Z3Prover/z3.

[7]. Jesper Bengtson, Karthikeyan Bhargavan, Cédric Fournet, Andrew D. Gordon, and Sergio Maffeis. Refinement types for secure implementations. ACM Trans. Program. Lang. Syst., 33(2):8:1-8:45, February 2011.

[8]. Gavin M. Bierman, Andrew D. Gordon, Catalin Hritcu, and David Langworthy. Semantic subtyping with an SMT solver. In Proceedings of the 15th ACM SIGPLAN International Conference on Functional Programming, ICFP '10, pages 105-116, New York, NY, USA, 2010. ACM.

[9]. Marco Carbone and Fabrizio Montesi. Deadlock-freedom-by-design: multiparty asynchronous global programming. In POPL, pages 263-274, 2013.

[10]. Leonardo De Moura and Nikolaj Bj0rner. Z3: An efficient SMT solver. In Proc. of 14th International Conference on Tools and Algorithms for the Construction and Analysis of Systems, TACAS'08/ETAPS'08, pages 337-340, Berlin, Heidelberg, 2008. SpringerVerlag.

[11]. David Detlefs, Greg Nelson, and James B. Saxe. Simplify: A theorem prover for program checking. J. ACM, 52(3):365-473, May 2005.

[12]. Joshua Dunfield. A unified system of type refinements. PhD thesis, Air Force Research Laboratory, 2007.

[13]. Cormac Flanagan. Hybrid type checking. In Conference Record of the 33rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL '06, pages 245-256, New York, NY, USA, 2006. ACM.

[14]. Tim Freeman and Frank Pfenning. Refinement types for ML. SIGPLAN Not., 26(6):268-277, May 1991.

[15]. Claudio Guidi, Ivan Lanese, Fabrizio Montesi, and Gianluigi Zavattaro. Dynamic error handling in service oriented applications. Fundam. Inform., 95(1):73-102, 2009.

[16]. Claudio Guidi, Roberto Lucchi, Gianluigi Zavattaro, Nadia Busi, and Roberto Gorrieri. Sock: a calculus for service oriented computing. In ICSOC, volume 4294 of LNCS, pages 327-338. Springer, 2006.

[17]. Kenneth Knowles, Aaron Tomb, Jessica Gronski, Stephen N Freund, and Cormac Flanagan. Sage: Unified hybrid checking for first-class types, general refinement types, and dynamic (extended report), 2006.

[18]. James Lewis and Martin Fowler. Microservices: a definition of this new architectural term. Accessed April 2016. http://martinfowler.com/articles/microservices.htm.

[19]. Roberto Lucchi and Manuel Mazzara. A pi-calculus based semantics for WS-BPEL. J. Log. Algebr. Program., 70(1):96-118, 2007.

[20]. Manuel Mazzara, Faisal Abouzaid, Nicola Dragoni, and Anirban Bhattacharyya. Toward design, modelling and analysis of dynamic workflow reconfigurations - A process algebra perspective. In Web Services and Formal Methods - 8th International Workshop, WS-FM, pages 64-78, 2011.

[21]. Robin Milner, Joachim Parrow, and David Walker. A calculus of mobile processes, I and II. Information and Computation, 100(1):1-40,41-77, September 1992.

[22]. Fabrizio Montesi. JOLIE: a Service-oriented Programming Language. Master's thesis, University of Bologna, 2010.

[23]. Fabrizio Montesi. Process-aware web programming with Jolie. In Proceedings of the 28th Annual ACM Symposium on Applied Computing, SAC '13, pages 761-763, New York, NY, USA, 2013. ACM.

[24]. Fabrizio Montesi and Marco Carbone. Programming Services with Correlation Sets. In Proc. of Service-Oriented Computing - 9th International Conference, ICSOC, pages 125141, 2011.

[25]. Fabrizio Montesi, Claudio Guidi, and Gianluigi Zavattaro. Service-oriented programming with jolie. In Web Services Foundations, pages 81-107. 2014.

[26]. J. M. Nielsen. A Type System for the Jolie Language. Master's thesis, Technical University of Denmark, 2013.

[27]. Mila Dalla Preda, Saverio Giallorenzo, Ivan Lanese, Jacopo Mauro, and Maurizio Gabbrielli. AIOCJ: A choreographic framework for safe adaptive distributed applications. In Software Language Engineering - 7th International Conference, SLE 2014, Västeras, Sweden, September 15-16, 2014. Proceedings, pages 161-170, 2014.

[28]. Larisa Safina, Manuel Mazzara, Fabrizio Montesi, and Victor Rivera. Data-driven workflows for microservices (genericity in jolie). In Proc. of 30th IEEE International Conference on Advanced Information Networking and Applications (AINA), 2016.

Refinement типы для языка Jolie

Александр Чичигин <a.chichigin@innopolis.ru>

Лариса Сафина <l.safina@innopolis.ru> Мохамед Эльвакиль <m.elwakil@innopolis.ru> Мануэль Маццара <m.mazzara@innopolis.ru> Фабрицио Монтези <fmontesi@imada.sdu.dk> Виктор Ривера <v.rivera@innopolis.ru> Университет Иннополис, 420500, Россия, респ. Татарстан, г. Иннополис, ул. Университетская, д.1.

Аннотация. Jolie — язык программирования для разработки микросервисов и на текущий момент является динамически проверяемым. В статье рассматривается возможность объединить динамическую и статическую проверку типов с помощью refinement типов, проверяемых SMT-решателем. Соединение этих двух аспектов делает возможным сценарий, когда статическая верификация внутренних сервисов и динамическая проверка (потенциально злонамеренных) внешних сервисов совместно снижают объёмы необходимого тестирования и увеличивают безопасность системы. Refinement типы хорошо известны применительно к числовым типам данных, алгебраическим типам данных и массивам. Они основываются на соответствующих SMT теориях. Недавно SMT-решатели получили поддержку теории строк и регулярных выражений. В статье описывается возможность применения этой теории к строковым refinement типам. Мы используем язык программирования Jolie чтобы продемонстрировать целесообразность и полезность такого расширения. В первую очередь, потому что Jolie уже содержит синтаксическое расширение для строковых refinement типов. Мы развиваем указанное расширение, предоставляя статическую проверку типов. Во-вторых, поскольку в области микросервисов значение улучшенной проверки строковых данных гораздо выше, так как большинство коммуникаций с внешними системами происходит по текстовым протоколам.

iНе можете найти то, что вам нужно? Попробуйте сервис подбора литературы.

Мы демонстрируем упрощённый, но реалистичный пример системы из области web-разработки. В пример преднамеренно внесена ошибка, показывая, как легко она ускользает от традиционной системы типов. Предложенное расширение целесообразно, поскольку оно не пропускает программу с ошибкой. Полноценное решение потребует доработки в части точности проверки и качества сообщений об ошибках.

Ключевые слова: Микросервисы, Jolie, Refinement типы, SMT, SAT, Z3

DOI: 10.15514/ISPRAS-2016-28(2)-2

Для цитирования: Чичигин Александр, Сафина Лариса, Эльвакиль Мохамед, Маццара

Мануэль, Монтези Фабрицио, Ривера Виктор. Refinement типы для языка Jolie. Труды

ИСП РАН, том 28, вып. 2, 2016 г., стр. 33-44 (на английском). DOI: 10.15514/ISPRAS-

2016-28(2)-2

Список литературы