A Coalgebraic Decision Procedure for NetKAT

Abstract

Program equivalence is a fundamental problem that has practical applications across a variety of areas of computing including compilation, optimization, software synthesis, formal verification, and many others. Equivalence is undecidable in general, but in certain settings it is possible to develop domain-specific languages that are expressive enough to be practical and yet sufficiently restricted so that equivalence remains decidable.In previous work we introduced NetKAT, a domain-specific language for specifying and verifying network packet-processing functions. NetKAT provides familiar constructs such as tests, assignments, union, sequential composition, and iteration as well as custom primitives for modifying packet headers and encoding network topologies. Semantically, NetKAT is based on Kleene algebra with tests (KAT) and comes equipped with a sound and complete equational theory. Although NetKAT equivalence is decidable, the best known algorithm is hardly practical-it uses Savitch's theorem to determinize a PSPACE algorithm and requires quadratic space. This paper presents a new algorithm for deciding NetKAT equivalence. This algorithm is based on finding bisimulations between finite automata constructed from NetKAT programs. We investigate the coalgebraic theory of NetKAT, generalize the notion of Brzozowski derivatives to NetKAT, develop efficient representations of NetKAT automata in terms of spines and sparse matrices, and discuss the highlights of our prototype implementation.

Verifying the configuration of virtualized network functions in software defined networks

“…We can cite Ansible 1 , Chef 2 , Puppet 3 , Docker Compose 4 , etc. Currently to the best of our knowledge, only openMANO and of course the SONATA NFV service platform propose a way to declare network configuration assumptions, that has to be declared before the deployment 5 .…”

“…This means that with KAT axioms and the NetKAT axioms (see Section 2 of [5]), every equivalence provable by using NetKAT axioms also holds in the equational model (soundness) and conversely, every equivalence in the equational model is provable with NetKAT axioms (completeness); these two statements are proved in Section 4 of [4].…”

Nominal Kleene Coalgebra

“…The bound variable need not be a, but it should be possible to change it to a by α-conversion. For example, for b = a, Examples 4 and 5 do not arise in our coalgebraic semantics, since δ νa may only be applied to A for which a is fresh due to the domain restriction in (7). If there are free occurrences of a, one cannot α-convert to obtain a string of the form νa.am, since those free occurrences would be captured.…”

“…Despite the high complexity of the worst-case upper bound, much like the bisimulation-based algorithms for other KA-based systems [4,5,7,22,23], the situation may not be so bad in practice. To actually attain the worst-case bound would seem to require highly pathological examples that would be unlikely to arise in practice.…”

“…The data representation is similar to that used in [7,14] and also related to constructions of [2,25], but extended to handle the binding operator. The advantage of this representation is that data representing repeated derivatives can be calculated once and for all in a preprocessing step; thereafter, the derivatives are easily computed by table lookup.…”