Language Basics

POLICY	SYNTAX	SEMANTICS	EXAMPLE
match	match(f=v)	returns set containing packet if packet's field f matches value v, empty set otherwise	match(dstmac=MAC('00:00:00:00:00:01'))
drop	drop	returns empty set	drop
identity	identity	returns set containing copy of packet	identity
modify	modify(f=v)	returns set containing copy of packet where field f is set to value v	modify(srcmac=MAC('00:00:00:00:00:01'))
forward	fwd(a)	returns set containing copy of packet where outport field is set to a	fwd(1)
flood	flood()	returns set containing one copy of packet for each port on the spanning tree	flood()
parallel composition	A + B	returns the union of A's output and B's output	fwd(1) + fwd(2)
sequential composition	A >> B	returns B's output where A's output is B's input	modify(dstip=IP(10.0.0.2)) >> fwd(2) match(switch=1) >> flood()
negation	~A	returns logical negation of filter* policies	~match(switch=1)

* Filter policies are policies that don't change the packet - either a set containing just the packet is returned or the empty set is returned. match, drop, and identity are filters. The negation (~), conjunction (&), and disjunction (|) are only defined on filter policies - you will get a type error if you attempt to write something like "match(switch=1) & fwd(1)" or "~flood()". Negation is defined above. Conjunction (&) and disjunction (|) evaluate in exactly the same way as the sequential (>>) and parallel (+) composition operators, respectively. The only difference between ``` condition1 = match(dstmac=MAC(00:00:00:00:00:01)) & match(srcmac=MAC(00:00:00:00:00:02)) ``` and ``` condition2 = match(dstmac=MAC(00:00:00:00:00:01)) >> match(srcmac=MAC(00:00:00:00:00:02)) ``` is that the outport of the former (condition1) is a FilterPolicy and the output of the later (condition2) is just a Policy. condition1 and condition2 will produce identical output, but since condition2 isn't a subclass of FilterPolicy writing ``` ~condition2 ``` will result in a type error, while writing ``` ~condition1 ``` will work out just fine. * Note: unlike other basic policy types, drop and identity don't require a constructor call "()". This is because they are singletons - there is only one drop policy and only one identity policy - unlike say the fwd policy type which can have many different policy instantiations [e.g., fwd(1), fwd(2), …].