Verified Configuration of Programmable Networks