ModularSDNProgrammingwithPyreticJoshuaReich,ChristopherMonsanto,NateFoster,JenniferRexford,andDavidWalkerUSENIX,2013PresentedbyYeTianforCourseCS05112PyreticControllerOnememberoftheFreneticfamilyofSDNprogramminglanguages.BasedonPythonProgrammerfriendlyReference/TutorialDocumentationRunningPyreticRunPyreticusing“pyretic.py”O(jiān)ptions-mMODEi|r0|p0-vVERBOSITYlow|high$pyretic.py–vhigh–mp0pyretic.examples.pyretic_switchRunningPyreticMODEi:everypacketisprocessedinthecontrollerruntime.Unsurpsinglyslow,butusefulfordebugging.r0:rulesarereactivelypushedtoswitchesbasedonthePyreticpolicyandthepacketsseen.f0:rulesareproactivelypushedtoswitchesbasedonthePyreticpolicy.Generallythehighestperformancemodecurrentlyavailable.MainMethodEveryPyreticprogrammusthaveamainmethodImportatminimumthePyreticcorelibrary.MainMethodImportinthemainfunctionPacketModelApacketcontainsalltheOpenFlowrecognizedfieldssrcmac,dstmac,ethertype,srcip,dstip,…Apacketalsocontainsotherinformation,switchinportoutport…LanguageBasics:PolicyApolicyisafunctionthattakesapacketasinputandreturnsasetofpackets.Describeswhatthenetworkswitchesshoulddowithincomingpackets.Example:Afunctionthattakesanypacketandreturnstheemptyset,causethenetworktodropallpackets.Afunctionthattakesanypacketarrivingatagivenlocation(switchandport)andreturnsthesetofidenticalpacketsbutlocatedrespectivelyattheportsatthatswitchwhichlieonthenetworkspanningtree,causethenetworktofloodallpackets.(modifyoutport)LanguageBasics:PolicyPOLICYSYNTAXSEMANTICSEXAMPLEmatchmatch(f=v)returnssetcontainingpacketifpacket'sfieldfmatchesvaluev,emptysetotherwisematch(dstmac=EthAddr('00:00:00:00:00:01'))dropdropreturnsemptysetdropidentityidentityreturnssetcontainingcopyofpacketidentitymodifymodify(f=v)returnssetcontainingcopyofpacketwherefieldfissettovaluevmodify(srcmac=EthAddr('00:00:00:00:00:01'))LanguageBasics:PolicyPOLICYSYNTAXSEMANTICSEXAMPLEforwardfwd(a)returnssetcontainingcopyofpacketwhereoutportfieldissettoafwd(1)(equalstomodify(outport=1))floodflood()returnssetcontainingonecopyofpacketforeachportonthespanningtreeflood()parallelcompositionA+BreturnstheunionofA'soutputandB'soutputfwd(1)+fwd(2)LanguageBasics:PolicyPOLICYSYNTAXSEMANTICSEXAMPLEsequentialcompositionA>>BreturnsB'soutputwhereA'soutputisB'sinputmodify(dstip=IPAddr())>>fwd(2)match(switch=1)>>flood()negation~Areturnslogicalnegationoffilter

policies~match(switch=1)LanguageBasics:FilterPolicyFilterpoliciesarepoliciesthatdon'tchangethepacket-eitherasetcontainingjustthepacketisreturnedortheemptysetisreturned.match,drop,identitynegation(~),conjunction(&),anddisjunction(|)areonlydefinedonfilterpoliciesLanguageBasics:FilterPolicyAfilterpolicyApolicy~condition2typeerror~condition1OKcondition1=match(dstmac=EthAddr(00:00:00:00:00:01))&match(srcmac=EthAddr(00:00:00:00:00:02))condition2=match(dstmac=EthAddr(00:00:00:00:00:01))>>match(srcmac=EthAddr(00:00:00:00:00:02))LanguageBasics:ConditionalExecutionUsefiltersforconditionalexecutionorsplit=(match(dstip=IPAddr(''))>>fwd(1))+(~match(dstip=IPAddr(''))>>fwd(2))split=if_(match(dstip=IPAddr('')),fwd(1),fwd(2))QueryPolicyNetworkmonitorsarejustanothersimpletypeofpolicythatmaybeconjoinedtoanyoftheotherpoliciesSyntaxSummarypackets(limit=n,group_by=[f1,f2,...])callbackoneverypacketreceivedforuptonpacketsidenticalonfieldsf1,f2,...count_packets(interval=t,group_by=[f1,f2,...])counteverypacketreceived,callbackeverytsecondsprovidingcountforeachgroupcount_bytes(interval=t,group_by=[f1,f2,...])counteverybytereceived,callbackeverytsecondsprovidingcountforeachgroupQueryPolicyForexample,createanewqueryforthefirstpacketarrivingfromeachuniquesourceIP

andrestrictittoweb-trafficrequestsToprinteachpacketthatarrivesatQ,registersacallbackroutinetohandleQ'scallback,Q=packets(limit=1,group_by=['srcip'])match(dstport=80)>>Qdefprinter(pkt):printpktQ.register_callback(printer)DynamicPolicyQuerypoliciesareoftenusedtodrivechangestootherdynamicpolicies.Dynamicpolicieshavebehavior(definedbyself.policy)thatchangesovertime,accordingtotheprogrammer'sspecification.DynamicPolicyForexample,theroutineround_robintakesthefirstpacketfromanewclient(sourceIPaddress)andupdatesthepolicy'sbehavior(byassigningself.policytoanewvalue)soallfuturepacketsfromthissourceareassignedtothenextserverinthesequence(byrewritingthedestinationIPaddress);DynamicPolicyPacketsfromallotherclientsaretreatedasbefore.Afterupdatingthepolicy,round_robin

alsomovesthe"currentlyup"servertothenextserverinthelist.defround_robin(self,pkt):self.policy=if_(match(srcip=pkt['srcip']),modify(dstip=self.server),self.policy)self.client+=1self.server=self.servers[self.client%m]DynamicPolicyCreatesanew``round-robinloadbalancer''dynamicpolicyclassrrlbbysubclassingDynamicPolicyandprovidinganinitializationmethodthatregistersround_robinasacallbackroutine:classrrlb(DynamicPolicy):def__init__(self,s,servers):self.switch=