Abstract:The popularity of the Rust language continues to explode; yet, many critical codebases remain authored in C, and cannot be realistically rewritten by hand. Automatically translating C to Rust is thus an appealing course of action. Several works have gone down this path, handling an ever-increasing subset of C through a variety of Rust features, such as unsafe. While the prospect of automation is appealing, producing code that relies on unsafe negates the memory safety guarantees offered by Rust, and therefore the main advantages of porting existing codebases to memory-safe languages. We instead explore a different path, and explore what it would take to translate C to safe Rust; that is, to produce code that is trivially memory safe, because it abides by Rust's type system without caveats. Our work sports several original contributions: a type-directed translation from (a subset of) C to safe Rust; a novel static analysis based on "split trees" that allows expressing C's pointer arithmetic using Rust's slices and splitting operations; an analysis that infers exactly which borrows need to be mutable; and a compilation strategy for C's struct types that is compatible with Rust's distinction between non-owned and owned allocations. We apply our methodology to existing formally verified C codebases: the HACL* cryptographic library, and binary parsers and serializers from EverParse, and show that the subset of C we support is sufficient to translate both applications to safe Rust. Our evaluation shows that for the few places that do violate Rust's aliasing discipline, automated, surgical rewrites suffice; and that the few strategic copies we insert have a negligible performance impact. Of particular note, the application of our approach to HACL* results in a 80,000 line verified cryptographic library, written in pure Rust, that implements all modern algorithms - the first of its kind.

Surveying the Rust Verification Landscape

A Mixed-Methods Study on the Implications of Unsafe Rust for Interoperation, Encapsulation, and Tooling

A hybrid approach to semi-automated Rust verification

Verifying Rust Programs with SMACK

Comprehensiveness, Automation and Lifecycle: A New Perspective for Rust Security

Understanding and Detecting Real-World Safety Issues in Rust

Is unsafe an Achilles' Heel? A Comprehensive Study of Safety Requirements in Unsafe Rust Programming

Is Rust Used Safely by Software Developers?

Refinement Proofs in Rust Using Ghost Locks

VERT: Verified Equivalent Rust Transpilation with Large Language Models as Few-Shot Learners

Fearless Unsafe. A More User-friendly Document for Unsafe Rust Programming Base on Refined Safety Properties

Rust: The Programming Language for Safety and Performance

KRust: A Formal Executable Semantics of Rust

Rustcheck: Safety Enhancement of Unsafe Rust Via Dynamic Program Analysis

Compiling C to Safe Rust, Formalized

Reasoning about Interior Mutability in Rust using Library-Defined Capabilities

CRUST: Towards a Unified Cross-Language Program Analysis Framework for Rust

Verification of a Rust Implementation of Knuth's Dancing Links using ACL2

Understanding Memory and Thread Safety Practices and Issues in Real-World Rust Programs

An Analysis of the Rust Programming Practice for Memory Safety Assurance.

Aeneas: Rust Verification by Functional Translation