Software-Defined Networking (SDN) enables network operators the flexibility to program their own forwarding rules, providing more than one way to achieve the same behaviour. Verifying equivalence between rulesets is a fundamental analysis and verification building block for SDN as it can be used to: (1) confirm a ruleset optimised for power efficiency or table occupancy remains equivalent, (2) verify a ruleset modified for new hardware, (3) regression test an SDN application to detect bugs early.We present a practical and novel canonical Multi-Terminal Binary Decision Diagram (MTBDD) representation of Open-Flow 1.3 ruleset forwarding behaviour which can be trivially compared for equivalence. Basing our representation on an MTBDD provides a proven canonical form which is also compact. In this paper, we present the algorithms required to correctly flatten multi-table pipelines into an equivalent single-table, resolve equivalences in OpenFlow actions, and build the final MTBDD representation from a priority ordered ruleset. OpenFlow rulesets can typically be converted to an MTBDD within tens of seconds. We release our opensource implementation to the SDN community. CCS CONCEPTS• Networks → Programmable networks; • Computing methodologies → Model verification and validation. INTRODUCTIONSoftware-Defined Networking (SDN) offers fine-grained network control by providing the ability to program low-level packet forwarding rules directly into network hardware. This

OpenFlow feature support differs between devices due to devicespecific hardware constraints. OpenFlow places the burden of addressing these differences on the controller, which increases development cost and restricts device interoperability. This paper investigates reducing this burden by algorithmically transforming an existing ruleset to fit an incompatible fixed-function pipeline to improve device interoperability. Existing rule-fitting schemes in the literature require metadata to link rules between tables into a path through the pipeline, but not all pipelines support metadata. We developed a novel approach that does not rely on any particular pipeline features, like metadata, and considers the pipeline's constraints, including both the matches and actions available. This paper presents our implementation, including ruleset preprocessing techniques, methods of transforming rules, and how we use a partially constrained boolean satisfiability problem to select from these transformations and build the final ruleset. While future work remains towards real-world deployment, our approach demonstrates fitting rulesets to fixed-function pipelines without metadata is feasible, and our techniques to reduce the size of the problem are beneficial. CCS CONCEPTS• Networks → Programming interfaces; Programmable networks; • Theory of computation → Constraint and logic programming.

No abstract