draft-ietf-policy-pcim-ext-07.txt   draft-ietf-policy-pcim-ext-08.txt 
Policy Framework Working Group B. Moore Policy Framework Working Group B. Moore, Editor
INTERNET-DRAFT L. Rafalow INTERNET-DRAFT IBM
Updates: 3060 IBM Updates: RFC 3060 May, 2002
Category: Standards Track Y. Ramberg Category: Standards Track
Y. Snir
A. Westerinen
Cisco Systems
R. Chadha
Telcordia Technologies
M. Brunner
NEC
R. Cohen
Ntear LLC
J. Strassner
INTELLLIDEN, Inc.
February, 2002
Policy Core Information Model Extensions Policy Core Information Model Extensions
<draft-ietf-policy-pcim-ext-07.txt> <draft-ietf-policy-pcim-ext-08.txt>
Wednesday, February 27, 2002, 8:58 AM Tuesday, May 28, 2002, 8:03 AM
Status of this Memo Status of this Memo
This document is an Internet-Draft and is in full conformance with all This document is an Internet-Draft and is in full conformance with all
provisions of Section 10 of RFC2026. provisions of Section 10 of RFC2026.
Internet-Drafts are working documents of the Internet Engineering Task Internet-Drafts are working documents of the Internet Engineering Task
Force (IETF), its areas, and its working groups. Note that other groups Force (IETF), its areas, and its working groups. Note that other groups
may also distribute working documents as Internet-Drafts. may also distribute working documents as Internet-Drafts.
skipping to change at page 1, line 51 skipping to change at page 1, line 39
The list of Internet-Draft Shadow Directories can be accessed at The list of Internet-Draft Shadow Directories can be accessed at
http://www.ietf.org/shadow.html http://www.ietf.org/shadow.html
Copyright Notice Copyright Notice
Copyright (C) The Internet Society (2002). All Rights Reserved. Copyright (C) The Internet Society (2002). All Rights Reserved.
Abstract Abstract
This document proposes a number of changes to the Policy Core Information This document specifies a number of changes to the Policy Core
Model (PCIM, RFC 3060). These changes include both extensions of PCIM Information Model (PCIM, RFC 3060). Two types of changes are included.
into areas that it did not previously cover, and changes to the existing First, several completely new elements are introduced, for example,
PCIM classes and associations. Both sets of changes are done in a way classes for header filtering, that extend PCIM into areas that it did not
that, to the extent possible, preserves interoperability with previously cover. Second, there are cases where elements of PCIM (for
implementations of the original PCIM model. example, policy rule priorities) are deprecated, and replacement elements
are defined (in this case, priorities tied to associations that refer to
policy rules). Both types of changes are done in such a way that, to the
extent possible, interoperability with implementations of the original
PCIM model is preserved. This document updates RFC 3060.
Table of Contents Table of Contents
1. Introduction......................................................5 1. Introduction......................................................5
2. Overview of the Changes...........................................5 2. Changes since RFC 3060............................................5
2.1. How to Change an Information Model...........................5 3. Overview of the Changes...........................................6
2.2. List of Changes to the Model.................................6 3.1. How to Change an Information Model...........................6
2.2.1. Changes to PolicyRepository................................6 3.2. List of Changes to the Model.................................6
2.2.2. Additional Associations and Additional Reusable Elements...6 3.2.1. Changes to PolicyRepository................................6
2.2.3. Priorities and Decision Strategies.........................6 3.2.2. Additional Associations and Additional Reusable Elements...7
2.2.4. Policy Roles...............................................7 3.2.3. Priorities and Decision Strategies.........................7
2.2.5. CompoundPolicyConditions and CompoundPolicyActions.........7 3.2.4. Policy Roles...............................................7
2.2.6. Variables and Values.......................................7 3.2.5. CompoundPolicyConditions and CompoundPolicyActions.........8
2.2.7. Domain-Level Packet Filtering..............................8 3.2.6. Variables and Values.......................................8
2.2.8. Device-Level Packet Filtering..............................8 3.2.7. Domain-Level Packet Filtering..............................8
3. The Updated Class and Association Class Hierarchies...............8 3.2.8. Device-Level Packet Filtering..............................8
4. Areas of Extension to PCIM.......................................12 4. The Updated Class and Association Class Hierarchies...............9
4.1. Policy Scope................................................13 5. Areas of Extension to PCIM.......................................13
4.1.1. Levels of Abstraction: Domain- and Device-Level Policies..13 5.1. Policy Scope................................................14
4.1.2. Administrative and Functional Scopes......................13 5.1.1. Levels of Abstraction: Domain- and Device-Level Policies..14
4.2. Reusable Policy Elements....................................14 5.1.2. Administrative and Functional Scopes......................14
4.3. Policy Sets.................................................15 5.2. Reusable Policy Elements....................................15
4.4. Nested Policy Rules.........................................15 5.3. Policy Sets.................................................16
4.4.1. Usage Rules for Nested Rules..............................15 5.4. Nested Policy Rules.........................................16
4.4.2. Motivation................................................16 5.4.1. Usage Rules for Nested Rules..............................16
4.5. Priorities and Decision Strategies..........................17 5.4.2. Motivation................................................17
4.5.1. Structuring Decision Strategies...........................18 5.5. Priorities and Decision Strategies..........................18
4.5.2. Side Effects..............................................19 5.5.1. Structuring Decision Strategies...........................19
4.5.3. Multiple PolicySet Trees For a Resource...................20 5.5.2. Side Effects..............................................20
4.5.4. Deterministic Decisions...................................21 5.5.3. Multiple PolicySet Trees For a Resource...................21
4.6. Policy Roles................................................22 5.5.4. Deterministic Decisions...................................22
4.6.1. Comparison of Roles in PCIM with Roles in snmpconf........22 5.6. Policy Roles................................................23
4.6.2. Addition of PolicyRoleCollection to PCIMe.................22 5.6.1. Comparison of Roles in PCIM with Roles in snmpconf........23
4.6.3. Roles for PolicyGroups....................................23 5.6.2. Addition of PolicyRoleCollection to PCIMe.................23
4.7. Compound Policy Conditions and Compound Policy Actions......25 5.6.3. Roles for PolicyGroups....................................24
4.7.1. Compound Policy Conditions................................25 5.7. Compound Policy Conditions and Compound Policy Actions......26
4.7.2. Compound Policy Actions...................................25 5.7.1. Compound Policy Conditions................................26
4.8. Variables and Values........................................26 5.7.2. Compound Policy Actions...................................26
4.8.1. Simple Policy Conditions..................................26 5.8. Variables and Values........................................27
4.8.2. Using Simple Policy Conditions............................27 5.8.1. Simple Policy Conditions..................................27
4.8.3. The Simple Condition Operator.............................28 5.8.2. Using Simple Policy Conditions............................28
4.8.4. SimplePolicyActions.......................................31 5.8.3. The Simple Condition Operator.............................29
4.8.5. Policy Variables..........................................32 5.8.4. SimplePolicyActions.......................................32
4.8.6. Explicitly Bound Policy Variables.........................33 5.8.5. Policy Variables..........................................33
4.8.7. Implicitly Bound Policy Variables.........................34 5.8.6. Explicitly Bound Policy Variables.........................34
4.8.8. Structure and Usage of Pre-Defined Variables..............35 5.8.7. Implicitly Bound Policy Variables.........................35
4.8.9. Rationale for Modeling Implicit Variables as Classes......36 5.8.8. Structure and Usage of Pre-Defined Variables..............36
4.8.10. Policy Values............................................37 5.8.9. Rationale for Modeling Implicit Variables as Classes......37
4.9. Packet Filtering............................................37 5.8.10. Policy Values............................................38
4.9.1. Domain-Level Packet Filters...............................38 5.9. Packet Filtering............................................38
4.9.2. Device-Level Packet Filters...............................39 5.9.1. Domain-Level Packet Filters...............................39
4.10. Conformance to PCIM and PCIMe..............................39 5.9.2. Device-Level Packet Filters...............................40
5. Class Definitions................................................40 5.10. Conformance to PCIM and PCIMe..............................40
5.1. The Abstract Class "PolicySet"..............................40 6. Class Definitions................................................41
5.2. Update PCIM's Class "PolicyGroup"...........................41 6.1. The Abstract Class "PolicySet"..............................41
5.3. Update PCIM's Class "PolicyRule"............................41 6.2. Update PCIM's Class "PolicyGroup"...........................42
5.4. The Class "SimplePolicyCondition"...........................42 6.3. Update PCIM's Class "PolicyRule"............................42
5.5. The Class "CompoundPolicyCondition".........................43 6.4. The Class "SimplePolicyCondition"...........................43
5.6. The Class "CompoundFilterCondition".........................43 6.5. The Class "CompoundPolicyCondition".........................44
5.7. The Class "SimplePolicyAction"..............................44 6.6. The Class "CompoundFilterCondition".........................44
5.8. The Class "CompoundPolicyAction"............................44 6.7. The Class "SimplePolicyAction"..............................45
5.9. The Abstract Class "PolicyVariable".........................46 6.8. The Class "CompoundPolicyAction"............................45
5.10. The Class "PolicyExplicitVariable".........................46 6.9. The Abstract Class "PolicyVariable".........................47
5.10.1. The Single-Valued Property "ModelClass"..................46 6.10. The Class "PolicyExplicitVariable".........................47
5.10.2. The Single-Valued Property ModelProperty.................47 6.10.1. The Single-Valued Property "ModelClass"..................47
5.11. The Abstract Class "PolicyImplicitVariable"................47 6.10.2. The Single-Valued Property ModelProperty.................48
5.11.1. The Multi-Valued Property "ValueTypes"...................47 6.11. The Abstract Class "PolicyImplicitVariable"................48
5.12. Subclasses of "PolicyImplicitVariable" Specified in PCIMe..48 6.11.1. The Multi-Valued Property "ValueTypes"...................48
5.12.1. The Class "PolicySourceIPv4Variable".....................48 6.12. Subclasses of "PolicyImplicitVariable" Specified in PCIMe..48
5.12.2. The Class "PolicySourceIPv6Variable".....................48 6.12.1. The Class "PolicySourceIPv4Variable".....................49
5.12.3. The Class "PolicyDestinationIPv4Variable"................48 6.12.2. The Class "PolicySourceIPv6Variable".....................49
5.12.4. The Class "PolicyDestinationIPv6Variable"................48 6.12.3. The Class "PolicyDestinationIPv4Variable"................49
5.12.5. The Class "PolicySourcePortVariable".....................49 6.12.4. The Class "PolicyDestinationIPv6Variable"................49
5.12.6. The Class "PolicyDestinationPortVariable"................49 6.12.5. The Class "PolicySourcePortVariable".....................50
5.12.7. The Class "PolicyIPProtocolVariable".....................50 6.12.6. The Class "PolicyDestinationPortVariable"................50
5.12.8. The Class "PolicyIPVersionVariable"......................50 6.12.7. The Class "PolicyIPProtocolVariable".....................50
5.12.9. The Class "PolicyIPToSVariable"..........................50 6.12.8. The Class "PolicyIPVersionVariable"......................51
5.12.10. The Class "PolicyDSCPVariable"..........................50 6.12.9. The Class "PolicyIPToSVariable"..........................51
5.12.11. The Class "PolicyFlowIdVariable"........................51 6.12.10. The Class "PolicyDSCPVariable"..........................51
5.12.12. The Class "PolicySourceMACVariable".....................51 6.12.11. The Class "PolicyFlowIdVariable"........................51
5.12.13. The Class "PolicyDestinationMACVariable"................51 6.12.12. The Class "PolicySourceMACVariable".....................52
5.12.14. The Class "PolicyVLANVariable"..........................51 6.12.13. The Class "PolicyDestinationMACVariable"................52
5.12.15. The Class "PolicyCoSVariable"...........................52 6.12.14. The Class "PolicyVLANVariable"..........................52
5.12.16. The Class "PolicyEthertypeVariable".....................52 6.12.15. The Class "PolicyCoSVariable"...........................52
5.12.17. The Class "PolicySourceSAPVariable".....................52 6.12.16. The Class "PolicyEthertypeVariable".....................53
5.12.18. The Class "PolicyDestinationSAPVariable"................52 6.12.17. The Class "PolicySourceSAPVariable".....................53
5.12.19. The Class "PolicySNAPOUIVariable".......................53 6.12.18. The Class "PolicyDestinationSAPVariable"................53
5.12.20. The Class "PolicySNAPTypeVariable"......................53 6.12.19. The Class "PolicySNAPOUIVariable".......................54
5.12.21. The Class "PolicyFlowDirectionVariable".................54 6.12.20. The Class "PolicySNAPTypeVariable"......................54
5.13. The Abstract Class "PolicyValue"...........................54 6.12.21. The Class "PolicyFlowDirectionVariable".................54
5.14. Subclasses of "PolicyValue" Specified in PCIMe.............54 6.13. The Abstract Class "PolicyValue"...........................55
5.14.1. The Class "PolicyIPv4AddrValue"..........................54 6.14. Subclasses of "PolicyValue" Specified in PCIMe.............55
5.14.2. The Class "PolicyIPv6AddrValue...........................55 6.14.1. The Class "PolicyIPv4AddrValue"..........................55
5.14.3. The Class "PolicyMACAddrValue"...........................56 6.14.2. The Class "PolicyIPv6AddrValue...........................56
5.14.4. The Class "PolicyStringValue"............................57 6.14.3. The Class "PolicyMACAddrValue"...........................57
5.14.5. The Class "PolicyBitStringValue".........................57 6.14.4. The Class "PolicyStringValue"............................58
5.14.6. The Class "PolicyIntegerValue"...........................58 6.14.5. The Class "PolicyBitStringValue".........................58
5.14.7. The Class "PolicyBooleanValue"...........................59 6.14.6. The Class "PolicyIntegerValue"...........................59
5.15. The Class "PolicyRoleCollection"...........................59 6.14.7. The Class "PolicyBooleanValue"...........................60
5.15.1. The Single-Valued Property "PolicyRole"..................60 6.15. The Class "PolicyRoleCollection"...........................60
5.16. The Class "ReusablePolicyContainer"........................60 6.15.1. The Single-Valued Property "PolicyRole"..................61
5.17. Deprecate PCIM's Class "PolicyRepository"..................60 6.16. The Class "ReusablePolicyContainer"........................61
5.18. The Abstract Class "FilterEntryBase".......................61 6.17. Deprecate PCIM's Class "PolicyRepository"..................61
5.19. The Class "IpHeadersFilter"................................61 6.18. The Abstract Class "FilterEntryBase".......................61
5.19.1. The Property HdrIpVersion................................61 6.19. The Class "IpHeadersFilter"................................62
5.19.2. The Property HdrSrcAddress...............................62 6.19.1. The Property HdrIpVersion................................62
5.19.3. The Property HdrSrcAddressEndOfRange.....................62 6.19.2. The Property HdrSrcAddress...............................63
5.19.4. The Property HdrSrcMask..................................62 6.19.3. The Property HdrSrcAddressEndOfRange.....................63
5.19.5. The Property HdrDestAddress..............................63 6.19.4. The Property HdrSrcMask..................................63
5.19.6. The Property HdrDestAddressEndOfRange....................63 6.19.5. The Property HdrDestAddress..............................64
5.19.7. The Property HdrDestMask.................................63 6.19.6. The Property HdrDestAddressEndOfRange....................64
5.19.8. The Property HdrProtocolID...............................63 6.19.7. The Property HdrDestMask.................................64
5.19.9. The Property HdrSrcPortStart.............................64 6.19.8. The Property HdrProtocolID...............................64
5.19.10. The Property HdrSrcPortEnd..............................64 6.19.9. The Property HdrSrcPortStart.............................65
5.19.11. The Property HdrDestPortStart...........................64 6.19.10. The Property HdrSrcPortEnd..............................65
5.19.12. The Property HdrDestPortEnd.............................65 6.19.11. The Property HdrDestPortStart...........................65
5.19.13. The Property HdrDSCP....................................65 6.19.12. The Property HdrDestPortEnd.............................66
5.19.14. The Property HdrFlowLabel...............................65 6.19.13. The Property HdrDSCP....................................66
5.20. The Class "8021Filter".....................................65 6.19.14. The Property HdrFlowLabel...............................66
5.20.1. The Property 8021HdrSrcMACAddr...........................66 6.20. The Class "8021Filter".....................................66
5.20.2. The Property 8021HdrSrcMACMask...........................66 6.20.1. The Property 8021HdrSrcMACAddr...........................67
5.20.3. The Property 8021HdrDestMACAddr..........................66 6.20.2. The Property 8021HdrSrcMACMask...........................67
5.20.4. The Property 8021HdrDestMACMask..........................66 6.20.3. The Property 8021HdrDestMACAddr..........................67
5.20.5. The Property 8021HdrProtocolID...........................67 6.20.4. The Property 8021HdrDestMACMask..........................67
5.20.6. The Property 8021HdrPriorityValue........................67 6.20.5. The Property 8021HdrProtocolID...........................68
5.20.7. The Property 8021HdrVLANID...............................67 6.20.6. The Property 8021HdrPriorityValue........................68
5.21. The Class FilterList.......................................67 6.20.7. The Property 8021HdrVLANID...............................68
5.21.1. The Property Direction...................................68 6.21. The Class FilterList.......................................68
6. Association and Aggregation Definitions..........................68 6.21.1. The Property Direction...................................69
6.1. The Aggregation "PolicySetComponent"........................68 7. Association and Aggregation Definitions..........................69
6.2. Deprecate PCIM's Aggregation "PolicyGroupInPolicyGroup".....69 7.1. The Aggregation "PolicySetComponent"........................69
6.3. Deprecate PCIM's Aggregation "PolicyRuleInPolicyGroup"......69 7.2. Deprecate PCIM's Aggregation "PolicyGroupInPolicyGroup".....70
6.4. The Abstract Association "PolicySetInSystem"................70 7.3. Deprecate PCIM's Aggregation "PolicyRuleInPolicyGroup"......70
6.5. Update PCIM's Weak Association "PolicyGroupInSystem"........70 7.4. The Abstract Association "PolicySetInSystem"................71
6.6. Update PCIM's Weak Association "PolicyRuleInSystem".........71 7.5. Update PCIM's Weak Association "PolicyGroupInSystem"........71
6.7. The Abstract Aggregation "PolicyConditionStructure".........71 7.6. Update PCIM's Weak Association "PolicyRuleInSystem".........72
6.8. Update PCIM's Aggregation "PolicyConditionInPolicyRule".....72 7.7. The Abstract Aggregation "PolicyConditionStructure".........72
6.9. The Aggregation "PolicyConditionInPolicyCondition"..........72 7.8. Update PCIM's Aggregation "PolicyConditionInPolicyRule".....73
6.10. The Abstract Aggregation "PolicyActionStructure"...........72 7.9. The Aggregation "PolicyConditionInPolicyCondition"..........73
6.11. Update PCIM's Aggregation "PolicyActionInPolicyRule".......72 7.10. The Abstract Aggregation "PolicyActionStructure"...........73
6.12. The Aggregation "PolicyActionInPolicyAction"...............73 7.11. Update PCIM's Aggregation "PolicyActionInPolicyRule".......73
6.13. The Aggregation "PolicyVariableInSimplePolicyCondition"....73 7.12. The Aggregation "PolicyActionInPolicyAction"...............74
6.14. The Aggregation "PolicyValueInSimplePolicyCondition".......74 7.13. The Aggregation "PolicyVariableInSimplePolicyCondition"....74
6.15. The Aggregation "PolicyVariableInSimplePolicyAction".......74 7.14. The Aggregation "PolicyValueInSimplePolicyCondition".......75
6.16. The Aggregation "PolicyValueInSimplePolicyAction"..........75 7.15. The Aggregation "PolicyVariableInSimplePolicyAction".......75
6.17. The Association "ReusablePolicy"...........................76 7.16. The Aggregation "PolicyValueInSimplePolicyAction"..........76
6.18. Deprecate PCIM's "PolicyConditionInPolicyRepository".......76 7.17. The Association "ReusablePolicy"...........................77
6.19. Deprecate PCIM's "PolicyActionInPolicyRepository"..........76 7.18. Deprecate PCIM's "PolicyConditionInPolicyRepository".......77
6.20. The Association ExpectedPolicyValuesForVariable............76 7.19. Deprecate PCIM's "PolicyActionInPolicyRepository"..........77
6.21. The Aggregation "ContainedDomain"..........................77 7.20. The Association ExpectedPolicyValuesForVariable............77
6.22. Deprecate PCIM's "PolicyRepositoryInPolicyRepository"......77 7.21. The Aggregation "ContainedDomain"..........................78
6.23. The Aggregation "EntriesInFilterList"......................78 7.22. Deprecate PCIM's "PolicyRepositoryInPolicyRepository"......78
6.23.1. The Reference GroupComponent.............................78 7.23. The Aggregation "EntriesInFilterList"......................79
6.23.2. The Reference PartComponent..............................78 7.23.1. The Reference GroupComponent.............................79
6.23.3. The Property EntrySequence...............................79 7.23.2. The Reference PartComponent..............................79
6.24. The Aggregation "ElementInPolicyRoleCollection"............79 7.23.3. The Property EntrySequence...............................80
6.25. The Weak Association "PolicyRoleCollectionInSystem"........79 7.24. The Aggregation "ElementInPolicyRoleCollection"............80
7. Intellectual Property............................................80 7.25. The Weak Association "PolicyRoleCollectionInSystem"........80
8. Acknowledgements.................................................80 8. Intellectual Property............................................81
9. Security Considerations..........................................80 9. Acknowledgements.................................................81
10. References......................................................81 10. Contributors....................................................81
11. Authors' Addresses..............................................82 11. Security Considerations.........................................83
12. Full Copyright Statement........................................83 12. Normative References............................................83
13. Appendix A: Closed Issues.......................................84 13. Informative References..........................................83
14. Editor's Address................................................84
15. Full Copyright Statement........................................84
16. Appendix A: Closed Issues.......................................85
1. Introduction 1. Introduction
This document (PCIM Extensions, abbreviated here to PCIMe) proposes a This document specifies a number of changes to the Policy Core
number of changes to the Policy Core Information Model (PCIM, RFC 3060 Information Model (PCIM, RFC 3060 [1]). Two types of changes are
[3]). These changes include both extensions of PCIM into areas that it included. First, several completely new elements are introduced, for
did not previously cover, and changes to the existing PCIM classes and example, classes for header filtering, that extend PCIM into areas that
associations. Both sets of changes are done in a way that, to the extent it did not previously cover. Second, there are cases where elements of
possible, preserves interoperability with implementations of the original PCIM (for example, policy rule priorities) are deprecated, and
PCIM model. replacement elements are defined (in this case, priorities tied to
associations that refer to policy rules). Both types of changes are done
in such a way that, to the extent possible, interoperability with
implementations of the original PCIM model is preserved.
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119, reference [1]. document are to be interpreted as described in RFC 2119, reference [8].
2. Overview of the Changes 2. Changes since RFC 3060
2.1. How to Change an Information Model Section 3.2 contains a short discussion of the changes that this document
makes to the RFC 3060 information model. Here is a very brief list of
the changes:
1. Deprecate and replace PolicyRepository and its associations.
2. Clarify and expand the ways that PolicyRules and PolicyGroups are
aggregated.
3. Change how prioritization for PolicyRules is represented, and
introduce administrator-specified decision strategies for rule
evaluation.
4. Expand the role of PolicyRoles, and introduce a means of
associating a PolicyRole with a resource.
5. Introduce compound policy conditions and compound policy actions
into the model.
6. Introduce variables and values into the model.
7. Introduce variable and value subclasses for packet-header
filtering.
8. Introduce classes for device-level packet-header filtering.
3. Overview of the Changes
3.1. How to Change an Information Model
The Policy Core Information Model is closely aligned with the DMTF's CIM The Policy Core Information Model is closely aligned with the DMTF's CIM
Core Policy model. Since there is no separately documented set of rules Core Policy model. Since there is no separately documented set of rules
for specifying IETF information models such as PCIM, it is reasonable to for specifying IETF information models such as PCIM, it is reasonable to
look to the CIM specifications for guidance on how to modify and extend look to the CIM specifications for guidance on how to modify and extend
the model. Among the CIM rules for changing an information model are the the model. Among the CIM rules for changing an information model are the
following. Note that everything said here about "classes" applies to following. Note that everything said here about "classes" applies to
association classes (including aggregations) as well as to non- association classes (including aggregations) as well as to non-
association classes. association classes.
skipping to change at page 6, line 5 skipping to change at page 6, line 33
<feature-name>" is used to indicate that a feature has been <feature-name>" is used to indicate that a feature has been
deprecated, and to identify its replacement feature. deprecated, and to identify its replacement feature.
o Classes may be inserted into the inheritance hierarchy above o Classes may be inserted into the inheritance hierarchy above
existing classes, and properties from the existing classes may existing classes, and properties from the existing classes may
then be "pulled up" into the new classes. The net effect is that then be "pulled up" into the new classes. The net effect is that
the existing classes have exactly the same properties they had the existing classes have exactly the same properties they had
before, but the properties are inherited rather than defined before, but the properties are inherited rather than defined
explicitly in the classes. explicitly in the classes.
o New subclasses may be defined below existing classes. o New subclasses may be defined below existing classes.
2.2. List of Changes to the Model 3.2. List of Changes to the Model
The following subsections provide a very brief overview of the changes to The following subsections provide a very brief overview of the changes to
PCIM defined in PCIMe. In several cases, the origin of the change is PCIM defined in PCIMe. In several cases, the origin of the change is
noted, as QPIM [5], ICPM [6], or QDDIM [14]. noted, as QPIM [11], ICPM [12], or QDDIM [15].
2.2.1. Changes to PolicyRepository 3.2.1. Changes to PolicyRepository
Because of the potential for confusion with the Policy Framework Because of the potential for confusion with the Policy Framework
component Policy Repository (from the four-box picture: Policy Management component Policy Repository (from the four-box picture: Policy Management
Tool, Policy Repository, PDP, PEP), "PolicyRepository" is a bad name for Tool, Policy Repository, PDP, PEP), "PolicyRepository" is a bad name for
the PCIM class representing a container of reusable policy elements. the PCIM class representing a container of reusable policy elements.
Thus the class PolicyRepository is being replaced with the class Thus the class PolicyRepository is being replaced with the class
ReusablePolicyContainer. To accomplish this change, it is necessary to ReusablePolicyContainer. To accomplish this change, it is necessary to
deprecate the PCIM class PolicyRepository and its three associations, and deprecate the PCIM class PolicyRepository and its three associations, and
replace them with a new class ReusablePolicyContainer and new replace them with a new class ReusablePolicyContainer and new
associations. associations.
As a separate change, the associations for ReusablePolicyContainer are As a separate change, the associations for ReusablePolicyContainer are
being broadened, to allow a ReusablePolicyContainer to contain any being broadened, to allow a ReusablePolicyContainer to contain any
reusable policy elements. In PCIM, the only associations defined for a reusable policy elements. In PCIM, the only associations defined for a
PolicyRepository were for it to contain reusable policy conditions and PolicyRepository were for it to contain reusable policy conditions and
policy actions. policy actions.
2.2.2. Additional Associations and Additional Reusable Elements 3.2.2. Additional Associations and Additional Reusable Elements
The PolicyRuleInPolicyRule and PolicyGroupInPolicyRule aggregations have, The PolicyRuleInPolicyRule and PolicyGroupInPolicyRule aggregations have,
in effect, been imported from QPIM. ("In effect" because these two in effect, been imported from QPIM. ("In effect" because these two
aggregations, as well as PCIM'e two aggregations PolicyGroupInPolicyGroup aggregations, as well as PCIM'e two aggregations PolicyGroupInPolicyGroup
and PolicyRuleInPolicyGroup, are all being combined into a single and PolicyRuleInPolicyGroup, are all being combined into a single
aggregation PolicySetComponent.) These aggregations make it possible to aggregation PolicySetComponent.) These aggregations make it possible to
define larger "chunks" of reusable policy to place in a define larger "chunks" of reusable policy to place in a
ReusablePolicyContainer. These aggregations also introduce new semantics ReusablePolicyContainer. These aggregations also introduce new semantics
representing the contextual implications of having one PolicyRule representing the contextual implications of having one PolicyRule
executing within the scope of another PolicyRule. executing within the scope of another PolicyRule.
2.2.3. Priorities and Decision Strategies 3.2.3. Priorities and Decision Strategies
Drawing from both QPIM and ICPM, the Priority property has been Drawing from both QPIM and ICPM, the Priority property has been
deprecated in PolicyRule, and placed instead on the aggregation deprecated in PolicyRule, and placed instead on the aggregation
PolicySetComponent. The QPIM rules for resolving relative priorities PolicySetComponent. The QPIM rules for resolving relative priorities
across nested PolicyGroups and PolicyRules have been incorporated into across nested PolicyGroups and PolicyRules have been incorporated into
PCIMe as well. With the removal of the Priority property from PCIMe as well. With the removal of the Priority property from
PolicyRule, a new modeling dependency is introduced. In order to PolicyRule, a new modeling dependency is introduced. In order to
prioritize a PolicyRule/PolicyGroup relative to other prioritize a PolicyRule/PolicyGroup relative to other
PolicyRules/PolicyGroups, the elements being prioritized must all reside PolicyRules/PolicyGroups, the elements being prioritized must all reside
in one of three places: in a common PolicyGroup, in a common PolicyRule, in one of three places: in a common PolicyGroup, in a common PolicyRule,
skipping to change at page 7, line 15 skipping to change at page 7, line 44
PolicyRule classes. This property allows policy administrator to select PolicyRule classes. This property allows policy administrator to select
one of two behaviors with respect to rule evaluation: either perform the one of two behaviors with respect to rule evaluation: either perform the
actions for all PolicyRules whose conditions evaluate to TRUE, or perform actions for all PolicyRules whose conditions evaluate to TRUE, or perform
the actions only for the highest-priority PolicyRule whose conditions the actions only for the highest-priority PolicyRule whose conditions
evaluate to TRUE. (This is accomplished by placing the evaluate to TRUE. (This is accomplished by placing the
PolicyDecisionStrategy property in an abstract class PolicySet, from PolicyDecisionStrategy property in an abstract class PolicySet, from
which PolicyGroup and PolicyRule are derived.) The QPIM rules for which PolicyGroup and PolicyRule are derived.) The QPIM rules for
applying decision strategies to a nested set of PolicyGroups and applying decision strategies to a nested set of PolicyGroups and
PolicyRules have also been imported. PolicyRules have also been imported.
2.2.4. Policy Roles 3.2.4. Policy Roles
The concept of policy roles is added to PolicyGroups (being present The concept of policy roles is added to PolicyGroups (being present
already in the PolicyRule class). This is accomplished via a new already in the PolicyRule class). This is accomplished via a new
superclass for both PolicyRules and PolicyGroups - PolicySet. For nested superclass for both PolicyRules and PolicyGroups - PolicySet. For nested
PolicyRules and PolicyGroups, any roles associated with the outer rule or PolicyRules and PolicyGroups, any roles associated with the outer rule or
group are automatically "inherited" by the nested one. Additional roles group are automatically "inherited" by the nested one. Additional roles
may be added at the level of a nested rule or group. may be added at the level of a nested rule or group.
It was also observed that there is no mechanism in PCIM for assigning It was also observed that there is no mechanism in PCIM for assigning
roles to resources. For example, while it is possible in PCIM to roles to resources. For example, while it is possible in PCIM to
associate a PolicyRule with the role "FrameRelay&&WAN", there is no way associate a PolicyRule with the role "FrameRelay&&WAN", there is no way
to indicate which interfaces match this criterion. A new to indicate which interfaces match this criterion. A new
PolicyRoleCollection class has been defined in PCIMe, representing the PolicyRoleCollection class has been defined in PCIMe, representing the
collection of resources associated with a particular role. The linkage collection of resources associated with a particular role. The linkage
between a PolicyRule or PolicyGroup and a set of resources is then between a PolicyRule or PolicyGroup and a set of resources is then
represented by an instance of PolicyRoleCollection. Equivalent values represented by an instance of PolicyRoleCollection. Equivalent values
should be defined in the PolicyRoles property of PolicyRules and should be defined in the PolicyRoles property of PolicyRules and
PolicyGroups, and in the PolicyRole property in PolicyRoleCollection. PolicyGroups, and in the PolicyRole property in PolicyRoleCollection.
2.2.5. CompoundPolicyConditions and CompoundPolicyActions 3.2.5. CompoundPolicyConditions and CompoundPolicyActions
The concept of a CompoundPolicyCondition has also been imported into The concept of a CompoundPolicyCondition has also been imported into
PCIMe from QPIM, and broadened to include a parallel PCIMe from QPIM, and broadened to include a parallel
CompoundPolicyAction. In both cases the idea is to create reusable CompoundPolicyAction. In both cases the idea is to create reusable
"chunks" of policy that can exist as named elements in a "chunks" of policy that can exist as named elements in a
ReusablePolicyContainer. The "Compound" classes and their associations ReusablePolicyContainer. The "Compound" classes and their associations
incorporate the condition and action semantics that PCIM defined at the incorporate the condition and action semantics that PCIM defined at the
PolicyRule level: DNF/CNF for conditions, and ordering for actions. PolicyRule level: DNF/CNF for conditions, and ordering for actions.
Compound conditions and actions are defined to work with any component Compound conditions and actions are defined to work with any component
conditions and actions. In other words, while the components may be conditions and actions. In other words, while the components may be
instances, respectively, of SimplePolicyCondition and SimplePolicyAction instances, respectively, of SimplePolicyCondition and SimplePolicyAction
(discussed immediately below), they need not be. (discussed immediately below), they need not be.
2.2.6. Variables and Values 3.2.6. Variables and Values
The SimplePolicyCondition / PolicyVariable / PolicyValue structure has The SimplePolicyCondition / PolicyVariable / PolicyValue structure has
been imported into PCIMe from QPIM. A list of PCIMe-level variables is been imported into PCIMe from QPIM. A list of PCIMe-level variables is
defined, as well as a list of PCIMe-level values. Other variables and defined, as well as a list of PCIMe-level values. Other variables and
values may, if necessary, be defined in submodels of PCIMe. For example, values may, if necessary, be defined in submodels of PCIMe. For example,
QPIM defines a set of implicit variables corresponding to fields in RSVP QPIM defines a set of implicit variables corresponding to fields in RSVP
flows. flows.
A corresponding SimplePolicyAction / PolicyVariable / PolicyValue A corresponding SimplePolicyAction / PolicyVariable / PolicyValue
structure is also defined. While the semantics of a structure is also defined. While the semantics of a
SimplePolicyCondition are "variable matches value", a SimplePolicyAction SimplePolicyCondition are "variable matches value", a SimplePolicyAction
has the semantics "set variable to value". has the semantics "set variable to value".
2.2.7. Domain-Level Packet Filtering 3.2.7. Domain-Level Packet Filtering
For packet filtering specified at the domain level, a set of For packet filtering specified at the domain level, a set of
PolicyVariables and PolicyValues are defined, corresponding to the fields PolicyVariables and PolicyValues are defined, corresponding to the fields
in an IP packet header plus the most common Layer 2 frame header fields. in an IP packet header plus the most common Layer 2 frame header fields.
It is expected that domain-level policy conditions that filter on these It is expected that domain-level policy conditions that filter on these
header fields will be expressed in terms of CompoundPolicyConditions header fields will be expressed in terms of CompoundPolicyConditions
built up from SimplePolicyConditions that use these variables and values. built up from SimplePolicyConditions that use these variables and values.
An additional PolicyVariable, PacketDirection, is also defined, to An additional PolicyVariable, PacketDirection, is also defined, to
indicate whether a packet being filtered is traveling inbound or outbound indicate whether a packet being filtered is traveling inbound or outbound
on an interface. on an interface.
2.2.8. Device-Level Packet Filtering 3.2.8. Device-Level Packet Filtering
For packet filtering expressed at the device level, including the packet For packet filtering expressed at the device level, including the packet
classifier filters modeled in QDDIM, the variables and values discussed classifier filters modeled in QDDIM, the variables and values discussed
in Section 2.2.7 need not be used. Filter classes derived from the CIM in Section 3.2.7 need not be used. Filter classes derived from the CIM
FilterEntryBase class hierarchy are available for use in these contexts. FilterEntryBase class hierarchy are available for use in these contexts.
These latter classes have two important differences from the domain-level These latter classes have two important differences from the domain-level
classes: classes:
o They support specification of filters for all of the fields in a o They support specification of filters for all of the fields in a
particular protocol header in a single object instance. With the particular protocol header in a single object instance. With the
domain-level classes, separate instances are needed for each domain-level classes, separate instances are needed for each
header field. header field.
o They provide native representations for the filter values, as o They provide native representations for the filter values, as
opposed to the string representation used by the domain-level opposed to the string representation used by the domain-level
classes. classes.
Device-level filter classes for the IP-related headers (IP, UDP, and TCP) Device-level filter classes for the IP-related headers (IP, UDP, and TCP)
and the 802 MAC headers are defined, respectively, in sections 5.19 and and the 802 MAC headers are defined, respectively, in Sections 6.19 and
5.20. 6.20.
3. The Updated Class and Association Class Hierarchies 4. The Updated Class and Association Class Hierarchies
The following figure shows the class inheritance hierarchy for PCIMe. The following figure shows the class inheritance hierarchy for PCIMe.
Changes from the PCIM hierarchy are noted parenthetically. Changes from the PCIM hierarchy are noted parenthetically.
ManagedElement (abstract) ManagedElement (abstract)
| |
+--Policy (abstract) +--Policy (abstract)
| | | |
| +---PolicySet (abstract -- new - 4.3) | +---PolicySet (abstract -- new - 5.3)
| | | | | |
| | +---PolicyGroup (moved - 4.3) | | +---PolicyGroup (moved - 5.3)
| | | | | |
| | +---PolicyRule (moved - 4.3) | | +---PolicyRule (moved - 5.3)
| | | |
| +---PolicyCondition (abstract) | +---PolicyCondition (abstract)
| | | | | |
| | +---PolicyTimePeriodCondition | | +---PolicyTimePeriodCondition
| | | | | |
| | +---VendorPolicyCondition | | +---VendorPolicyCondition
| | | | | |
| | +---SimplePolicyCondition (new - 4.8.1) | | +---SimplePolicyCondition (new - 5.8.1)
| | | | | |
| | +---CompoundPolicyCondition (new - 4.7.1) | | +---CompoundPolicyCondition (new - 5.7.1)
| | | | | |
| | +---CompoundFilterCondition (new - 4.9) | | +---CompoundFilterCondition (new - 5.9)
| | | |
| +---PolicyAction (abstract) | +---PolicyAction (abstract)
| | | | | |
| | +---VendorPolicyAction | | +---VendorPolicyAction
| | | | | |
| | +---SimplePolicyAction (new - 4.8.4) | | +---SimplePolicyAction (new - 5.8.4)
| | | | | |
| | +---CompoundPolicyAction (new - 4.7.2) | | +---CompoundPolicyAction (new - 5.7.2)
| | | |
| +---PolicyVariable (abstract -- new - 4.8.5) | +---PolicyVariable (abstract -- new - 5.8.5)
| | | | | |
| | +---PolicyExplicitVariable (new - 4.8.6) | | +---PolicyExplicitVariable (new - 5.8.6)
| | | | | |
| | +---PolicyImplicitVariable (abstract -- new - 4.8.7) | | +---PolicyImplicitVariable (abstract -- new - 5.8.7)
| | | | | |
| | +---(subtree of more specific classes -- new - 5.12) | | +---(subtree of more specific classes -- new - 6.12)
| | | |
| +---PolicyValue (abstract -- new - 4.8.10) | +---PolicyValue (abstract -- new - 5.8.10)
| | | |
| +---(subtree of more specific classes -- new - 5.14) | +---(subtree of more specific classes -- new - 6.14)
| |
+--Collection (abstract -- newly referenced) +--Collection (abstract -- newly referenced)
| | | |
| +--PolicyRoleCollection (new - 4.6.2) | +--PolicyRoleCollection (new - 5.6.2)
(continued on following page) (continued on following page)
(continued from previous page) (continued from previous page)
ManagedElement(abstract) ManagedElement(abstract)
| |
+--ManagedSystemElement (abstract) +--ManagedSystemElement (abstract)
| |
+--LogicalElement (abstract) +--LogicalElement (abstract)
| |
+--System (abstract) +--System (abstract)
| | | |
| +--AdminDomain (abstract) | +--AdminDomain (abstract)
| | | |
| +---ReusablePolicyContainer (new - 4.2) | +---ReusablePolicyContainer (new - 5.2)
| | | |
| +---PolicyRepository (deprecated - 4.2) | +---PolicyRepository (deprecated - 5.2)
| |
+--FilterEntryBase (abstract -- new - 5.18) +--FilterEntryBase (abstract -- new - 6.18)
| | | |
| +--IpHeadersFilter (new - 5.19) | +--IpHeadersFilter (new - 6.19)
| | | |
| +--8021Filter (new - 5.20) | +--8021Filter (new - 6.20)
| |
+--FilterList (new - 5.21) +--FilterList (new - 6.21)
Figure 1. Class Inheritance Hierarchy for PCIMe Figure 1. Class Inheritance Hierarchy for PCIMe
The following figure shows the association class hierarchy for PCIMe. As The following figure shows the association class hierarchy for PCIMe. As
before, changes from PCIM are noted parenthetically. before, changes from PCIM are noted parenthetically.
[unrooted] [unrooted]
| |
+---PolicyComponent (abstract) +---PolicyComponent (abstract)
| | | |
| +---PolicySetComponent (new - 4.3) | +---PolicySetComponent (new - 5.3)
| | | |
| +---PolicyGroupInPolicyGroup (deprecated - 4.3) | +---PolicyGroupInPolicyGroup (deprecated - 5.3)
| | | |
| +---PolicyRuleInPolicyGroup (deprecated - 4.3) | +---PolicyRuleInPolicyGroup (deprecated - 5.3)
| | | |
| +---PolicyConditionStructure (abstract -- new - 4.7.1) | +---PolicyConditionStructure (abstract -- new - 5.7.1)
| | | | | |
| | +---PolicyConditionInPolicyRule (moved - 4.7.1) | | +---PolicyConditionInPolicyRule (moved - 5.7.1)
| | | | | |
| | +---PolicyConditionInPolicyCondition (new - 4.7.1) | | +---PolicyConditionInPolicyCondition (new - 5.7.1)
| | | |
| +---PolicyRuleValidityPeriod | +---PolicyRuleValidityPeriod
| | | |
| +---PolicyActionStructure (abstract -- new - 4.7.2) | +---PolicyActionStructure (abstract -- new - 5.7.2)
| | | | | |
| | +---PolicyActionInPolicyRule (moved - 4.7.2) | | +---PolicyActionInPolicyRule (moved - 5.7.2)
| | | | | |
| | +---PolicyActionInPolicyAction (new - 4.7.2) | | +---PolicyActionInPolicyAction (new - 5.7.2)
| | | |
| +---PolicyVariableInSimplePolicyCondition (new - 4.8.2) | +---PolicyVariableInSimplePolicyCondition (new - 5.8.2)
| | | |
| +---PolicyValueInSimplePolicyCondition (new - 4.8.2) | +---PolicyValueInSimplePolicyCondition (new - 5.8.2)
| | | |
| +---PolicyVariableInSimplePolicyAction (new - 4.8.4) | +---PolicyVariableInSimplePolicyAction (new - 5.8.4)
| | | |
| +---PolicyValueInSimplePolicyAction (new - 4.8.4) | +---PolicyValueInSimplePolicyAction (new - 5.8.4)
(continued on following page) (continued on following page)
(continued from previous page) (continued from previous page)
[unrooted] [unrooted]
| |
+---Dependency (abstract) +---Dependency (abstract)
| | | |
| +---PolicyInSystem (abstract) | +---PolicyInSystem (abstract)
| | | | | |
| | +---PolicySetInSystem (abstract, new - 4.3) | | +---PolicySetInSystem (abstract, new - 5.3)
| | | | | | | |
| | | +---PolicyGroupInSystem | | | +---PolicyGroupInSystem
| | | | | | | |
| | | +---PolicyRuleInSystem | | | +---PolicyRuleInSystem
| | | | | |
| | +---ReusablePolicy (new - 4.2) | | +---ReusablePolicy (new - 5.2)
| | | | | |
| | +---PolicyConditionInPolicyRepository (deprecated - 4.2) | | +---PolicyConditionInPolicyRepository (deprecated - 5.2)
| | | | | |
| | +---PolicyActionInPolicyRepository (deprecated - 4.2) | | +---PolicyActionInPolicyRepository (deprecated - 5.2)
| | | |
| +---ExpectedPolicyValuesForVariable (new - 4.8) | +---ExpectedPolicyValuesForVariable (new - 5.8)
| | | |
| +---PolicyRoleCollectionInSystem (new - 4.6.2) | +---PolicyRoleCollectionInSystem (new - 5.6.2)
| |
+---Component (abstract) +---Component (abstract)
| | | |
| +---SystemComponent | +---SystemComponent
| | | | | |
| | +---ContainedDomain (new - 4.2) | | +---ContainedDomain (new - 5.2)
| | | | | |
| | +---PolicyRepositoryInPolicyRepository (deprecated - 4.2) | | +---PolicyRepositoryInPolicyRepository (deprecated - 5.2)
| | | |
| +---EntriesInFilterList (new - 6.23) | +---EntriesInFilterList (new - 7.23)
| |
+---MemberOfCollection (newly referenced) +---MemberOfCollection (newly referenced)
| |
+--- ElementInPolicyRoleCollection (new - 4.6.2) +--- ElementInPolicyRoleCollection (new - 5.6.2)
Figure 2. Association Class Inheritance Hierarchy for PCIMe Figure 2. Association Class Inheritance Hierarchy for PCIMe
In addition to these changes that show up at the class and association In addition to these changes that show up at the class and association
class level, there are other changes from PCIM involving individual class class level, there are other changes from PCIM involving individual class
properties. In some cases new properties are introduced into existing properties. In some cases new properties are introduced into existing
classes, and in other cases existing properties are deprecated (without classes, and in other cases existing properties are deprecated (without
deprecating the classes that contain them). deprecating the classes that contain them).
4. Areas of Extension to PCIM 5. Areas of Extension to PCIM
The following subsections describe each of the areas for which PCIM The following subsections describe each of the areas for which PCIM
extensions are being defined. extensions are being defined.
4.1. Policy Scope 5.1. Policy Scope
Policy scopes may be thought of in two dimensions: 1) the level of Policy scopes may be thought of in two dimensions: 1) the level of
abstraction of the policy specification and 2) the applicability of abstraction of the policy specification and 2) the applicability of
policies to a set of managed resources. policies to a set of managed resources.
4.1.1. Levels of Abstraction: Domain- and Device-Level Policies 5.1.1. Levels of Abstraction: Domain- and Device-Level Policies
Policies vary in level of abstraction, from the business-level expression Policies vary in level of abstraction, from the business-level expression
of service level agreements (SLAs) to the specification of a set of rules of service level agreements (SLAs) to the specification of a set of rules
that apply to devices in a network. Those latter policies can, that apply to devices in a network. Those latter policies can,
themselves, be classified into at least two groups: those policies themselves, be classified into at least two groups: those policies
consumed by a Policy Decision Point (PDP) that specify the rules for an consumed by a Policy Decision Point (PDP) that specify the rules for an
administrative and functional domain, and those policies consumed by a administrative and functional domain, and those policies consumed by a
Policy Enforcement Point (PEP) that specify the device-specific rules for Policy Enforcement Point (PEP) that specify the device-specific rules for
a functional domain. The higher-level rules consumed by a PDP, called a functional domain. The higher-level rules consumed by a PDP, called
domain-level policies, may have late binding variables unspecified, or domain-level policies, may have late binding variables unspecified, or
skipping to change at page 13, line 40 skipping to change at page 14, line 40
develops a programmatic rule specification. The relationship between the develops a programmatic rule specification. The relationship between the
domain-level policy and the device-level policy may be thought of as domain-level policy and the device-level policy may be thought of as
analogous to that of a compiler and linkage editor that translates the analogous to that of a compiler and linkage editor that translates the
rules into specific instructions that can be executed on a specific type rules into specific instructions that can be executed on a specific type
of platform. of platform.
PCIM and PCIMe may be used to specify rules at any and all of these PCIM and PCIMe may be used to specify rules at any and all of these
levels of abstraction. However, at different levels of abstraction, levels of abstraction. However, at different levels of abstraction,
different mechanisms may be more or less appropriate. different mechanisms may be more or less appropriate.
4.1.2. Administrative and Functional Scopes 5.1.2. Administrative and Functional Scopes
Administrative scopes for policy are represented in PCIM and in these Administrative scopes for policy are represented in PCIM and in these
extensions to PCIM as System subclass instances. Typically, a domain- extensions to PCIM as System subclass instances. Typically, a domain-
level policy would be scoped by an AdminDomain instance (or by a level policy would be scoped by an AdminDomain instance (or by a
hierarchy of AdminDomain instances) whereas a device-level policy might hierarchy of AdminDomain instances) whereas a device-level policy might
be scoped by a System instance that represents the PEP (e.g., an instance be scoped by a System instance that represents the PEP (e.g., an instance
of ComputerSystem, see CIM [4]). In addition to collecting policies into of ComputerSystem, see CIM [2]). In addition to collecting policies into
an administrative domain, these System classes may also aggregate the an administrative domain, these System classes may also aggregate the
resources to which the policies apply. resources to which the policies apply.
Functional scopes (sometimes referred to as functional domains) are Functional scopes (sometimes referred to as functional domains) are
generally defined by the submodels derived from PCIM and PCIMe, and generally defined by the submodels derived from PCIM and PCIMe, and
correspond to the service or services to which the policies apply. So, correspond to the service or services to which the policies apply. So,
for example, Quality of Service may be thought of as a functional scope, for example, Quality of Service may be thought of as a functional scope,
or Diffserv and Intserv may each be thought of as functional scopes. or Diffserv and Intserv may each be thought of as functional scopes.
These scoping decisions are represented by the structure of the submodels These scoping decisions are represented by the structure of the submodels
derived from PCIM and PCIMe, and may be reflected in the number and types derived from PCIM and PCIMe, and may be reflected in the number and types
of PEP policy client(s), services, and the interaction between policies. of PEP policy client(s), services, and the interaction between policies.
Policies in different functional scopes are organized into disjoint sets Policies in different functional scopes are organized into disjoint sets
of policy rules. Different functional domains may share some roles, some of policy rules. Different functional domains may share some roles, some
conditions, and even some actions. The rules from different functional conditions, and even some actions. The rules from different functional
domains may even be enforced at the same managed resource, but for the domains may even be enforced at the same managed resource, but for the
purposes of policy evaluation they are separate. See section 4.5.3 for purposes of policy evaluation they are separate. See section 5.5.3 for
more information. more information.
The functional scopes MAY be reflected in administrative scopes. That The functional scopes MAY be reflected in administrative scopes. That
is, deployments of policy may have different administrative scopes for is, deployments of policy may have different administrative scopes for
different functional scopes, but there is no requirement to do so. different functional scopes, but there is no requirement to do so.
4.2. Reusable Policy Elements 5.2. Reusable Policy Elements
In PCIM, a distinction was drawn between reusable PolicyConditions and In PCIM, a distinction was drawn between reusable PolicyConditions and
PolicyActions and rule-specific ones. The PolicyRepository class was PolicyActions and rule-specific ones. The PolicyRepository class was
also defined, to serve as a container for these reusable elements. The also defined, to serve as a container for these reusable elements. The
name "PolicyRepository" has proven to be an unfortunate choice for the name "PolicyRepository" has proven to be an unfortunate choice for the
class that serves as a container for reusable policy elements. This term class that serves as a container for reusable policy elements. This term
is already used in documents like the Policy Framework, to denote the is already used in documents like the Policy Framework, to denote the
location from which the PDP retrieves all policy specifications, and into location from which the PDP retrieves all policy specifications, and into
which the Policy Management Tool places all policy specifications. which the Policy Management Tool places all policy specifications.
Consequently, the PolicyRepository class is being deprecated, in favor of Consequently, the PolicyRepository class is being deprecated, in favor of
skipping to change at page 14, line 42 skipping to change at page 15, line 42
PolicyConditionInPolicyRepository and PolicyActionInPolicyRepository, as PolicyConditionInPolicyRepository and PolicyActionInPolicyRepository, as
well as for the aggregation PolicyRepositoryInPolicyRepository. In well as for the aggregation PolicyRepositoryInPolicyRepository. In
addition to renaming the PolicyRepository class to addition to renaming the PolicyRepository class to
ReusablePolicyContainer, however, PCIMe is also broadening the types of ReusablePolicyContainer, however, PCIMe is also broadening the types of
policy elements that can be reusable. Consequently, rather than policy elements that can be reusable. Consequently, rather than
providing one-for-one replacements for the two associations, a single providing one-for-one replacements for the two associations, a single
higher-level association ReusablePolicy is defined. This new association higher-level association ReusablePolicy is defined. This new association
allows any policy element (that is, an instance of any subclass of the allows any policy element (that is, an instance of any subclass of the
abstract class Policy) to be placed in a ReusablePolicyContainer. abstract class Policy) to be placed in a ReusablePolicyContainer.
Summarizing, the following changes in Sections 5 and 6 are the result of Summarizing, the following changes in Sections 6 and 7 are the result of
this item: this item:
o The class ReusablePolicyContainer is defined. o The class ReusablePolicyContainer is defined.
o PCIM's PolicyRepository class is deprecated. o PCIM's PolicyRepository class is deprecated.
o The association ReusablePolicy is defined. o The association ReusablePolicy is defined.
o PCIM's PolicyConditionInPolicyRepository association is deprecated. o PCIM's PolicyConditionInPolicyRepository association is deprecated.
o PCIM's PolicyActionInPolicyRepository association is deprecated. o PCIM's PolicyActionInPolicyRepository association is deprecated.
o The aggregation ContainedDomain is defined. o The aggregation ContainedDomain is defined.
o PCIM's PolicyRepositoryInPolicyRepository aggregation is deprecated. o PCIM's PolicyRepositoryInPolicyRepository aggregation is deprecated.
4.3. Policy Sets 5.3. Policy Sets
A "policy" can be thought of as a coherent set of rules to administer, A "policy" can be thought of as a coherent set of rules to administer,
manage, and control access to network resources ("Policy Terminology", manage, and control access to network resources ("Policy Terminology",
reference [12]). The structuring of these coherent sets of rules into reference [10]). The structuring of these coherent sets of rules into
subsets is enhanced in this document. In Section 4.4, we discuss the new subsets is enhanced in this document. In Section 5.4, we discuss the new
options for the nesting of policy rules. options for the nesting of policy rules.
A new abstract class, PolicySet, is introduced to provide an abstraction A new abstract class, PolicySet, is introduced to provide an abstraction
for a set of rules. It is derived from Policy, and it is inserted into for a set of rules. It is derived from Policy, and it is inserted into
the inheritance hierarchy above both PolicyGroup and PolicyRule. This the inheritance hierarchy above both PolicyGroup and PolicyRule. This
reflects the additional structural flexibility and semantic capability of reflects the additional structural flexibility and semantic capability of
both subclasses. both subclasses.
Two properties are defined in PolicySet: PolicyDecisionStrategy and Two properties are defined in PolicySet: PolicyDecisionStrategy and
PolicyRoles. The PolicyDecisionStrategy property is included in PolicyRoles. The PolicyDecisionStrategy property is included in
PolicySet to define the evaluation relationship among the rules in the PolicySet to define the evaluation relationship among the rules in the
policy set. See Section 4.5 for more information. The PolicyRoles policy set. See Section 5.5 for more information. The PolicyRoles
property is included in PolicySet to characterize the resources to which property is included in PolicySet to characterize the resources to which
the PolicySet applies. See Section 4.6 for more information. the PolicySet applies. See Section 5.6 for more information.
Along with the definition of the PolicySet class, a new concrete Along with the definition of the PolicySet class, a new concrete
aggregation class is defined that will also be discussed in the following aggregation class is defined that will also be discussed in the following
sections. PolicySetComponent is defined as a subclass of sections. PolicySetComponent is defined as a subclass of
PolicyComponent; it provides the containment relationship for a PolicySet PolicyComponent; it provides the containment relationship for a PolicySet
in a PolicySet. PolicySetComponent replaces the two PCIM aggregations in a PolicySet. PolicySetComponent replaces the two PCIM aggregations
PolicyGroupInPolicyGroup and PolicyRuleInPolicyGroup, so these two PolicyGroupInPolicyGroup and PolicyRuleInPolicyGroup, so these two
aggregations are deprecated. aggregations are deprecated.
A PolicySet's relationship to an AdminDomain or other administrative A PolicySet's relationship to an AdminDomain or other administrative
scoping system (for example, a ComputerSystem) is represented by the scoping system (for example, a ComputerSystem) is represented by the
PolicySetInSystem abstract association. This new association is derived PolicySetInSystem abstract association. This new association is derived
from PolicyInSystem, and the PolicyGroupInSystem and PolicyRuleInSystem from PolicyInSystem, and the PolicyGroupInSystem and PolicyRuleInSystem
associations are now derived from PolicySetInSystem instead of directly associations are now derived from PolicySetInSystem instead of directly
from PolicyInSystem. The PolicySetInSystem.Priority property is from PolicyInSystem. The PolicySetInSystem.Priority property is
discussed in Section 4.5.3. discussed in Section 5.5.3.
4.4. Nested Policy Rules 5.4. Nested Policy Rules
As previously discussed, policy is described by a set of policy rules As previously discussed, policy is described by a set of policy rules
that may be grouped into subsets. In this section we introduce the that may be grouped into subsets. In this section we introduce the
notion of nested rules, or the ability to define rules within rules. notion of nested rules, or the ability to define rules within rules.
Nested rules are also called sub-rules, and we use both terms in this Nested rules are also called sub-rules, and we use both terms in this
document interchangeably. The aggregation PolicySetComponent is used to document interchangeably. The aggregation PolicySetComponent is used to
represent the nesting of a policy rule in another policy rule. represent the nesting of a policy rule in another policy rule.
4.4.1. Usage Rules for Nested Rules 5.4.1. Usage Rules for Nested Rules
The relationship between rules and sub-rules is defined as follows: The relationship between rules and sub-rules is defined as follows:
o The parent rule's condition clause is a condition for evaluation o The parent rule's condition clause is a condition for evaluation
of all nested rules; that is, the conditions of the parent are of all nested rules; that is, the conditions of the parent are
logically ANDed to the conditions of the sub-rules. If the parent logically ANDed to the conditions of the sub-rules. If the parent
rule's condition clause evaluates to FALSE, sub-rules MAY be rule's condition clause evaluates to FALSE, sub-rules MAY be
skipped since they also evaluate to FALSE. skipped since they also evaluate to FALSE.
o If the parent rule's condition evaluates to TRUE, the set of sub- o If the parent rule's condition evaluates to TRUE, the set of sub-
rules SHALL BE evaluated according to the decision strategy and rules SHALL BE evaluated according to the decision strategy and
priorities as discussed in Section 4.5. priorities as discussed in Section 5.5.
o If the parent rule's condition evaluates to TRUE, the parent o If the parent rule's condition evaluates to TRUE, the parent
rule's set of actions is executed BEFORE execution of the sub- rule's set of actions is executed BEFORE execution of the sub-
rulesĘ actions. The parent rule's actions are not to be confused rulesĘ actions. The parent rule's actions are not to be confused
with default actions. A default action is one that is to be with default actions. A default action is one that is to be
executed only if none of the more specific sub-rules are executed. executed only if none of the more specific sub-rules are executed.
If a default action needs to be specified, it needs to be defined If a default action needs to be specified, it needs to be defined
as an action that is part of a catchall sub-rule associated with as an action that is part of a catchall sub-rule associated with
the parent rule. The association linking the default action(s) in the parent rule. The association linking the default action(s) in
this special sub-rule should have the lowest priority relative to this special sub-rule should have the lowest priority relative to
all other sub-rule associations: all other sub-rule associations:
if parent-condition then parent rule's action if parent-condition then parent rule's action
if condA then actA if condA then actA
if condB then ActB if condB then ActB
if True then default action if True then default action
Such a default action functions as a default when FirstMatching Such a default action functions as a default when FirstMatching
decision strategies are in effect (see section 4.5). If decision strategies are in effect (see section 5.5). If
AllMatching applies, the "default" action is always performed. AllMatching applies, the "default" action is always performed.
o Policy rules have a context in which they are executed. The rule o Policy rules have a context in which they are executed. The rule
engine evaluates and applies the policy rules in the context of engine evaluates and applies the policy rules in the context of
the managed resource(s) that are identified by the policy roles the managed resource(s) that are identified by the policy roles
(or by an explicit association). Submodels MAY add additional (or by an explicit association). Submodels MAY add additional
context to policy rules based on rule structure; any such context to policy rules based on rule structure; any such
additional context is defined by the semantics of the action additional context is defined by the semantics of the action
classes of the submodel. classes of the submodel.
4.4.2. Motivation 5.4.2. Motivation
Rule nesting enhances Policy readability, expressiveness and reusability. Rule nesting enhances Policy readability, expressiveness and reusability.
The ability to nest policy rules and form sub-rules is important for The ability to nest policy rules and form sub-rules is important for
manageability and scalability, as it enables complex policy rules to be manageability and scalability, as it enables complex policy rules to be
constructed from multiple simpler policy rules. These enhancements ease constructed from multiple simpler policy rules. These enhancements ease
the policy management tools' task, allowing policy rules to be expressed the policy management tools' task, allowing policy rules to be expressed
in a way closer to how humans think. in a way closer to how humans think.
Although rule nesting can be used to suggest optimizations in the way Although rule nesting can be used to suggest optimizations in the way
policy rules are evaluated, as discussed in section 4.5.2 "Side Effects," policy rules are evaluated, as discussed in section 5.5.2 "Side Effects,"
nesting does not specify nor does it require any particular order of nesting does not specify nor does it require any particular order of
evaluation of conditions. Optimization of rule evaluation can be done in evaluation of conditions. Optimization of rule evaluation can be done in
the PDP or in the PEP by dedicated code. This is similar to the relation the PDP or in the PEP by dedicated code. This is similar to the relation
between a high level programming language like C and machine code. An between a high level programming language like C and machine code. An
optimizer can create a more efficient machine code than any optimization optimizer can create a more efficient machine code than any optimization
done by the programmer within the source code. Nevertheless, if the PEP done by the programmer within the source code. Nevertheless, if the PEP
or PDP does not do optimization, the administrator writing the policy may or PDP does not do optimization, the administrator writing the policy may
be able to influence the evaluation of the policy rules for execution be able to influence the evaluation of the policy rules for execution
using rule nesting. using rule nesting.
Nested rules are not designed for policy repository retrieval Nested rules are not designed for policy repository retrieval
optimization. It is assumed that all rules and groups that are assigned optimization. It is assumed that all rules and groups that are assigned
to a role are retrieved by the PDP or PEP from the policy repository and to a role are retrieved by the PDP or PEP from the policy repository and
enforced. Optimizing the number of rules retrieved should be done by enforced. Optimizing the number of rules retrieved should be done by
clever selection of roles. clever selection of roles.
4.5. Priorities and Decision Strategies 5.5. Priorities and Decision Strategies
A "decision strategy" is used to specify the evaluation method for the A "decision strategy" is used to specify the evaluation method for the
policies in a PolicySet. Two decision strategies are defined: policies in a PolicySet. Two decision strategies are defined:
"FirstMatching" and "AllMatching." The FirstMatching strategy is used to "FirstMatching" and "AllMatching." The FirstMatching strategy is used to
cause the evaluation of the rules in a set such that the only actions cause the evaluation of the rules in a set such that the only actions
enforced on a given examination of the PolicySet are those for the first enforced on a given examination of the PolicySet are those for the first
rule (that is, the rule with the highest priority) that has its rule (that is, the rule with the highest priority) that has its
conditions evaluate to TRUE. The AllMatching strategy is used to cause conditions evaluate to TRUE. The AllMatching strategy is used to cause
the evaluation of all rules in a set; for all of the rules whose the evaluation of all rules in a set; for all of the rules whose
conditions evaluate to TRUE, the actions are enforced. Implementations conditions evaluate to TRUE, the actions are enforced. Implementations
skipping to change at page 18, line 24 skipping to change at page 19, line 24
and the higher priority rule sets the DSCP to 3 and the lower priority and the higher priority rule sets the DSCP to 3 and the lower priority
rule sets the DSCP to 4, the action of the lower priority rule will be rule sets the DSCP to 4, the action of the lower priority rule will be
executed later and, therefore, will "win," in this example, setting the executed later and, therefore, will "win," in this example, setting the
DSCP to 4. Thus, conflicts between rules are resolved by this execution DSCP to 4. Thus, conflicts between rules are resolved by this execution
order. order.
An implementation of the rule engine need not provide the action An implementation of the rule engine need not provide the action
sequencing but the actions MUST be sequenced by the PEP or PDP on its sequencing but the actions MUST be sequenced by the PEP or PDP on its
behalf. So, for example, the rule engine may provide an ordered list of behalf. So, for example, the rule engine may provide an ordered list of
actions to be executed by the PEP and any required serialization is then actions to be executed by the PEP and any required serialization is then
provided by the service configured by the rule engine. See section 4.5.2 provided by the service configured by the rule engine. See Section 5.5.2
for a discussion of side effects. for a discussion of side effects.
4.5.1. Structuring Decision Strategies 5.5.1. Structuring Decision Strategies
As discussed in Sections 4.3 and 4.4, PolicySet instances may be nested As discussed in Sections 5.3 and 5.4, PolicySet instances may be nested
arbitrarily. For a FirstMatching decision strategy on a PolicySet, any arbitrarily. For a FirstMatching decision strategy on a PolicySet, any
contained PolicySet that matches satisfies the termination criteria for contained PolicySet that matches satisfies the termination criteria for
the FirstMatching strategy. A PolicySet is considered to match if it is the FirstMatching strategy. A PolicySet is considered to match if it is
a PolicyRule and its conditions evaluate to True, or if the PolicySet is a PolicyRule and its conditions evaluate to True, or if the PolicySet is
a PolicyGroup and at least one of its contained PolicyGroups or a PolicyGroup and at least one of its contained PolicyGroups or
PolicyRules match. The priority associated with contained PolicySets, PolicyRules match. The priority associated with contained PolicySets,
then, determines when to terminate rule evaluation in the structured set then, determines when to terminate rule evaluation in the structured set
of rules. of rules.
In the example shown in Figure 3, the relative priorities for the nested In the example shown in Figure 3, the relative priorities for the nested
skipping to change at page 19, line 49 skipping to change at page 20, line 49
appropriate. PolicyRule 1X2 and PolicyRule 1B3 are also evaluated appropriate. PolicyRule 1X2 and PolicyRule 1B3 are also evaluated
and enforced as appropriate. If any of the sub-rules in the and enforced as appropriate. If any of the sub-rules in the
subtrees of PolicyGroup 1B evaluate to True, then PolicyRule 1C is subtrees of PolicyGroup 1B evaluate to True, then PolicyRule 1C is
not evaluated because the FirstMatching strategy of PolicyGroup 1 not evaluated because the FirstMatching strategy of PolicyGroup 1
has been satisfied. has been satisfied.
o If neither PolicyRule 1A nor PolicyGroup 1B yield a match, then o If neither PolicyRule 1A nor PolicyGroup 1B yield a match, then
PolicyRule 1C is evaluated. Since it is first matching, rules PolicyRule 1C is evaluated. Since it is first matching, rules
1C1, 1X2, and 1C3 are evaluated until the first match, if any. 1C1, 1X2, and 1C3 are evaluated until the first match, if any.
4.5.2. Side Effects 5.5.2. Side Effects
Although evaluation of conditions is sometimes discussed as an ordered Although evaluation of conditions is sometimes discussed as an ordered
set of operations, the rule engine need not be implemented as a set of operations, the rule engine need not be implemented as a
procedural language interpreter. Any side effects of condition evaluation procedural language interpreter. Any side effects of condition evaluation
or the execution of actions MUST NOT affect the result of the evaluation or the execution of actions MUST NOT affect the result of the evaluation
of other conditions evaluated by the rule engine in the same evaluation of other conditions evaluated by the rule engine in the same evaluation
pass. That is, an implementation of a rule engine MAY evaluate all pass. That is, an implementation of a rule engine MAY evaluate all
conditions in any order before applying the priority and determining conditions in any order before applying the priority and determining
which actions are to be executed. which actions are to be executed.
So, regardless of how a rule engine is implemented, it MUST NOT include So, regardless of how a rule engine is implemented, it MUST NOT include
any side effects of condition evaluation in the evaluation of conditions any side effects of condition evaluation in the evaluation of conditions
for either of the decision strategies. For both the AllMatching decision for either of the decision strategies. For both the AllMatching decision
strategy and for the nesting of rules within rules (either directly or strategy and for the nesting of rules within rules (either directly or
indirectly) where the actions of more than one rule may be enforced, any indirectly) where the actions of more than one rule may be enforced, any
side effects of the enforcement of actions MUST NOT be included in side effects of the enforcement of actions MUST NOT be included in
condition evaluation on the same evaluation pass. condition evaluation on the same evaluation pass.
4.5.3. Multiple PolicySet Trees For a Resource 5.5.3. Multiple PolicySet Trees For a Resource
As shown in the example in Figure 3. , PolicySet trees are defined by the As shown in the example in Figure 3. , PolicySet trees are defined by the
PolicySet subclass instances and the PolicySetComponent aggregation PolicySet subclass instances and the PolicySetComponent aggregation
instances between them. Each PolicySet tree has a defined set of instances between them. Each PolicySet tree has a defined set of
decision strategies and evaluation priorities. In section 4.6 we discuss decision strategies and evaluation priorities. In section 5.6 we discuss
some improvements in the use of PolicyRoles that cause the parent some improvements in the use of PolicyRoles that cause the parent
PolicySet.PolicyRoles to be applied to all contained PolicySet instances. PolicySet.PolicyRoles to be applied to all contained PolicySet instances.
However, a given resource may still have multiple, disjoint PolicySet However, a given resource may still have multiple, disjoint PolicySet
trees regardless of how they are collected. These top-level PolicySet trees regardless of how they are collected. These top-level PolicySet
instances are called "unrooted" relative to the given resource. instances are called "unrooted" relative to the given resource.
So, a PolicySet instance is defined to be rooted or unrooted in the So, a PolicySet instance is defined to be rooted or unrooted in the
context of a particular managed element; the relationship to the managed context of a particular managed element; the relationship to the managed
element is usually established by the policy roles of the PolicySet element is usually established by the policy roles of the PolicySet
instance and of the managed element (see 4.6 "Policy Roles"). A instance and of the managed element (see 5.6 "Policy Roles"). A
PolicySet instance is unrooted in that context if and only if there is no PolicySet instance is unrooted in that context if and only if there is no
PolicySetComponent association to a parent PolicySet that is also related PolicySetComponent association to a parent PolicySet that is also related
to the same managed element. These PolicySetComponent aggregations are to the same managed element. These PolicySetComponent aggregations are
traversed up the tree without regard to how a PolicySet instance came to traversed up the tree without regard to how a PolicySet instance came to
be related with the ManagedElement. Figure 4. shows an example where be related with the ManagedElement. Figure 4. shows an example where
instance A has role A, instance B has role B and so on. In this example, instance A has role A, instance B has role B and so on. In this example,
in the context of interface X, instances B, and C are unrooted and in the context of interface X, instances B, and C are unrooted and
instances D, E, and F are all rooted. In the context of interface Y, instances D, E, and F are all rooted. In the context of interface Y,
instance A is unrooted and instances B, C, D, E and F are all rooted. instance A is unrooted and instances B, C, D, E and F are all rooted.
skipping to change at page 21, line 38 skipping to change at page 22, line 38
only used as a default for unrooted PolicySet instances in a given only used as a default for unrooted PolicySet instances in a given
ManagedElement context. ManagedElement context.
The FirstMatching strategy is used among all unrooted PolicySet instances The FirstMatching strategy is used among all unrooted PolicySet instances
that apply to a given resource for a given functional domain. So, for that apply to a given resource for a given functional domain. So, for
example, the PolicySet instances that are used for QoS policy and the example, the PolicySet instances that are used for QoS policy and the
instances that are used for IKE policy, although they are disjoint, are instances that are used for IKE policy, although they are disjoint, are
not joined in a FirstMatching decision strategy. Instead, they are not joined in a FirstMatching decision strategy. Instead, they are
evaluated independently of one another. evaluated independently of one another.
4.5.4. Deterministic Decisions 5.5.4. Deterministic Decisions
As previously discussed, PolicySetComponent.Priority values MUST be As previously discussed, PolicySetComponent.Priority values MUST be
unique within a containing PolicySet and PolicySetInSystem.Priority unique within a containing PolicySet and PolicySetInSystem.Priority
values MUST be unique for an associated System. Each PolicySet, then, has values MUST be unique for an associated System. Each PolicySet, then, has
a deterministic behavior based upon the decision strategy and uniquely a deterministic behavior based upon the decision strategy and uniquely
defined priority. defined priority.
There are certainly cases where rules need not have a unique priority There are certainly cases where rules need not have a unique priority
value (i.e., where evaluation and execution priority is not important). value (i.e., where evaluation and execution priority is not important).
However, it is believed that the flexibility gained by this capability is However, it is believed that the flexibility gained by this capability is
not sufficiently beneficial to justify the possible variations in not sufficiently beneficial to justify the possible variations in
implementation behavior and the resulting confusion that might occur. implementation behavior and the resulting confusion that might occur.
4.6. Policy Roles 5.6. Policy Roles
A policy role is defined in [12] as "an administratively specified A policy role is defined in [10] as "an administratively specified
characteristic of a managed element (for example, an interface). It is a characteristic of a managed element (for example, an interface). It is a
selector for policy rules and PRovisioning Classes (PRCs), to determine selector for policy rules and PRovisioning Classes (PRCs), to determine
the applicability of the rule/PRC to a particular managed element." the applicability of the rule/PRC to a particular managed element."
In PCIMe, PolicyRoles is defined as a property of PolicySet, which is In PCIMe, PolicyRoles is defined as a property of PolicySet, which is
inherited by both PolicyRules and PolicyGroups. In this draft, we also inherited by both PolicyRules and PolicyGroups. In this draft, we also
add PolicyRole as the identifying name of a collection of resources add PolicyRole as the identifying name of a collection of resources
(PolicyRoleCollection), where each element in the collection has the (PolicyRoleCollection), where each element in the collection has the
specified role characteristic. specified role characteristic.
4.6.1. Comparison of Roles in PCIM with Roles in snmpconf 5.6.1. Comparison of Roles in PCIM with Roles in snmpconf
In the Configuration Management with SNMP (snmpconf) working group's In the Configuration Management with SNMP (snmpconf) working group's
Policy Based Management MIB [13], policy rules are of the form Policy Based Management MIB [14], policy rules are of the form
if <policyFilter> then <policyAction> if <policyFilter> then <policyAction>
where <policyFilter> is a set of conditions that are used to determine where <policyFilter> is a set of conditions that are used to determine
whether or not the policy applies to an object instance. The policy whether or not the policy applies to an object instance. The policy
filter can perform comparison operations on SNMP variables already filter can perform comparison operations on SNMP variables already
defined in MIBS (e.g., "ifType == ethernet"). defined in MIBS (e.g., "ifType == ethernet").
The policy management MIB defined in [13] defines a Role table that The policy management MIB defined in [14] defines a Role table that
enables one to associate Roles with elements, where roles have the same enables one to associate Roles with elements, where roles have the same
semantics as in PCIM. Then, since the policyFilter in a policy allows one semantics as in PCIM. Then, since the policyFilter in a policy allows one
to define conditions based on the comparison of the values of SNMP to define conditions based on the comparison of the values of SNMP
variables, one can filter elements based on their roles as defined in the variables, one can filter elements based on their roles as defined in the
Role group. Role group.
This approach differs from that adopted in PCIM in the following ways. This approach differs from that adopted in PCIM in the following ways.
First, in PCIM, a set of role(s) is associated with a policy rule as the First, in PCIM, a set of role(s) is associated with a policy rule as the
values of the PolicyRoles property of a policy rule. The semantics of values of the PolicyRoles property of a policy rule. The semantics of
role(s) are then expected to be implemented by the PDP (i.e. policies are role(s) are then expected to be implemented by the PDP (i.e. policies are
applied to the elements with the appropriate roles). In [13], however, applied to the elements with the appropriate roles). In [14], however,
no special processing is required for realizing the semantics of roles; no special processing is required for realizing the semantics of roles;
roles are treated just as any other SNMP variables and comparisons of roles are treated just as any other SNMP variables and comparisons of
role values can be included in the policy filter of a policy rule. role values can be included in the policy filter of a policy rule.
Secondly, in PCIM, there is no formally defined way of associating a role Secondly, in PCIM, there is no formally defined way of associating a role
with an object instance, whereas in [13] this is done via the use of the with an object instance, whereas in [14] this is done via the use of the
Role tables (pmRoleESTable and pmRoleSETable). The Role tables associate Role tables (pmRoleESTable and pmRoleSETable). The Role tables associate
Role values with elements. Role values with elements.
4.6.2. Addition of PolicyRoleCollection to PCIMe 5.6.2. Addition of PolicyRoleCollection to PCIMe
In order to remedy the latter shortcoming in PCIM (the lack of a way of In order to remedy the latter shortcoming in PCIM (the lack of a way of
associating a role with an object instance), PCIMe has a new class associating a role with an object instance), PCIMe has a new class
PolicyRoleCollection derived from the CIM Collection class. Resources PolicyRoleCollection derived from the CIM Collection class. Resources
that share a common role are aggregated by a PolicyRoleCollection that share a common role are aggregated by a PolicyRoleCollection
instance, via the ElementInPolicyRoleCollection aggregation. The role is instance, via the ElementInPolicyRoleCollection aggregation. The role is
specified in the PolicyRole property of the aggregating specified in the PolicyRole property of the aggregating
PolicyRoleCollection instance. PolicyRoleCollection instance.
A PolicyRoleCollection always exists in the context of a system. As was A PolicyRoleCollection always exists in the context of a system. As was
skipping to change at page 23, line 47 skipping to change at page 24, line 47
This enables a PDP to determine that the "Gold Service" policy rules This enables a PDP to determine that the "Gold Service" policy rules
apply to the three aggregated traffic trunks. apply to the three aggregated traffic trunks.
Note that roles are used to optimize policy retrieval. It is not Note that roles are used to optimize policy retrieval. It is not
mandatory to implement roles or, if they have been implemented, to group mandatory to implement roles or, if they have been implemented, to group
elements in a PolicyRoleCollection. However, if roles are used, then elements in a PolicyRoleCollection. However, if roles are used, then
either the collection approach should be implemented, or elements should either the collection approach should be implemented, or elements should
be capable of reporting their "pre-programmed" roles (as is done in be capable of reporting their "pre-programmed" roles (as is done in
COPS). COPS).
4.6.3. Roles for PolicyGroups 5.6.3. Roles for PolicyGroups
In PCIM, role(s) are only associated with policy rules. However, it may In PCIM, role(s) are only associated with policy rules. However, it may
be desirable to associate role(s) with groups of policy rules. For be desirable to associate role(s) with groups of policy rules. For
example, a network administrator may want to define a group of rules that example, a network administrator may want to define a group of rules that
apply only to Ethernet interfaces. A policy group can be defined with a apply only to Ethernet interfaces. A policy group can be defined with a
role-combination="Ethernet", and all the relevant policy rules can be role-combination="Ethernet", and all the relevant policy rules can be
placed in this policy group. (Note that in PCIMe, role(s) are made placed in this policy group. (Note that in PCIMe, role(s) are made
available to PolicyGroups as well as to PolicyRules by moving PCIM's available to PolicyGroups as well as to PolicyRules by moving PCIM's
PolicyRoles property up from PolicyRule to the new abstract class PolicyRoles property up from PolicyRule to the new abstract class
PolicySet. The property is then inherited by both PolicyGroup and PolicySet. The property is then inherited by both PolicyGroup and
skipping to change at page 25, line 13 skipping to change at page 26, line 13
there a role conflict. there a role conflict.
Note that it is possible to override implicitly inherited roles via Note that it is possible to override implicitly inherited roles via
appropriate conditions on a PolicyRule. For example, suppose that PR3 appropriate conditions on a PolicyRule. For example, suppose that PR3
above had defined the following conditions: above had defined the following conditions:
(interface is not "Fast") and (interface is "Slow") (interface is not "Fast") and (interface is "Slow")
This results in unambiguous semantics for PR3. This results in unambiguous semantics for PR3.
4.7. Compound Policy Conditions and Compound Policy Actions 5.7. Compound Policy Conditions and Compound Policy Actions
Compound policy conditions and compound policy actions are introduced to Compound policy conditions and compound policy actions are introduced to
provide additional reusable "chunks" of policy. provide additional reusable "chunks" of policy.
4.7.1. Compound Policy Conditions 5.7.1. Compound Policy Conditions
A CompoundPolicyCondition is a PolicyCondition representing a Boolean A CompoundPolicyCondition is a PolicyCondition representing a Boolean
combination of simpler conditions. The conditions being combined may be combination of simpler conditions. The conditions being combined may be
SimplePolicyConditions (discussed below in section 4.7), but the utility SimplePolicyConditions (discussed below in Section 6.4), but the utility
of reusable combinations of policy conditions is not necessarily limited of reusable combinations of policy conditions is not necessarily limited
to the case where the component conditions are simple ones. to the case where the component conditions are simple ones.
The PCIM extensions to introduce compound policy conditions are The PCIM extensions to introduce compound policy conditions are
relatively straightforward. Since the purpose of the extension is to relatively straightforward. Since the purpose of the extension is to
apply the DNF / CNF logic from PCIM's PolicyConditionInPolicyRule apply the DNF / CNF logic from PCIM's PolicyConditionInPolicyRule
aggregation to a compound condition that aggregates simpler conditions, aggregation to a compound condition that aggregates simpler conditions,
the following changes are required: the following changes are required:
o Create a new aggregation PolicyConditionInPolicyCondition, with the o Create a new aggregation PolicyConditionInPolicyCondition, with the
skipping to change at page 25, line 49 skipping to change at page 26, line 49
need to re-document the properties themselves, since they are need to re-document the properties themselves, since they are
already documented in PCIM as part of the definition of the already documented in PCIM as part of the definition of the
PolicyConditionInPolicyRule aggregation. PolicyConditionInPolicyRule aggregation.
o It is also necessary to define a concrete subclass o It is also necessary to define a concrete subclass
CompoundPolicyCondition of PolicyCondition, to introduce the CompoundPolicyCondition of PolicyCondition, to introduce the
ConditionListType property. This property has the same function, ConditionListType property. This property has the same function,
and works in exactly the same way, as the corresponding property and works in exactly the same way, as the corresponding property
currently defined in PCIM for the PolicyRule class. currently defined in PCIM for the PolicyRule class.
The class and property definitions for representing compound policy The class and property definitions for representing compound policy
conditions are below, in Section 5. conditions are below, in Section 6.
4.7.2. Compound Policy Actions 5.7.2. Compound Policy Actions
A compound action is a convenient construct to represent a sequence of A compound action is a convenient construct to represent a sequence of
actions to be applied as a single atomic action within a policy rule. In actions to be applied as a single atomic action within a policy rule. In
many cases, actions are related to each other and should be looked upon many cases, actions are related to each other and should be looked upon
as sub-actions of one "logical" action. An example of such a logical as sub-actions of one "logical" action. An example of such a logical
action is "shape & mark" (i.e., shape a certain stream to a set of action is "shape & mark" (i.e., shape a certain stream to a set of
predefined bandwidth characteristics and then mark these packets with a predefined bandwidth characteristics and then mark these packets with a
certain DSCP value). This logical action is actually composed of two certain DSCP value). This logical action is actually composed of two
different QoS actions, which should be performed in a well-defined order different QoS actions, which should be performed in a well-defined order
and as a complete set. and as a complete set.
skipping to change at page 26, line 44 skipping to change at page 27, line 44
SequencedActions property. This property has the same function, SequencedActions property. This property has the same function,
and works in exactly the same way, as the corresponding property and works in exactly the same way, as the corresponding property
currently defined in PCIM for the PolicyRule class. currently defined in PCIM for the PolicyRule class.
o Finally, a new property ExecutionStrategy is needed for both the o Finally, a new property ExecutionStrategy is needed for both the
PCIM class PolicyRule and the new class CompoundPolicyAction. This PCIM class PolicyRule and the new class CompoundPolicyAction. This
property allows the policy administrator to specify how the PEP property allows the policy administrator to specify how the PEP
should behave in the case where there are multiple actions should behave in the case where there are multiple actions
aggregated by a PolicyRule or by a CompoundPolicyAction. aggregated by a PolicyRule or by a CompoundPolicyAction.
The class and property definitions for representing compound policy The class and property definitions for representing compound policy
actions are below, in Section 5. actions are below, in Section 6.
4.8. Variables and Values 5.8. Variables and Values
The following subsections introduce several related concepts, including The following subsections introduce several related concepts, including
PolicyVariables and PolicyValues (and their numerous subclasses), PolicyVariables and PolicyValues (and their numerous subclasses),
SimplePolicyConditions, and SimplePolicyActions. SimplePolicyConditions, and SimplePolicyActions.
4.8.1. Simple Policy Conditions 5.8.1. Simple Policy Conditions
The SimplePolicyCondition class models elementary Boolean expressions of The SimplePolicyCondition class models elementary Boolean expressions of
the form: "(<variable> MATCH <value>)". The relationship 'MATCH', which the form: "(<variable> MATCH <value>)". The relationship 'MATCH', which
is implicit in the model, is interpreted based on the variable and the is implicit in the model, is interpreted based on the variable and the
value. Section 4.8.3 explains the semantics of the 'MATCH' operator. value. Section 5.8.3 explains the semantics of the 'MATCH' operator.
Arbitrarily complex Boolean expressions can be formed by chaining Arbitrarily complex Boolean expressions can be formed by chaining
together any number of simple conditions using relational operators. together any number of simple conditions using relational operators.
Individual simple conditions can be negated as well. Arbitrarily complex Individual simple conditions can be negated as well. Arbitrarily complex
Boolean expressions are modeled by the class CompoundPolicyCondition Boolean expressions are modeled by the class CompoundPolicyCondition
(described in Section 4.7.1). (described in Section 5.7.1).
For example, the expression "SourcePort == 80" can be modeled by a simple For example, the expression "SourcePort == 80" can be modeled by a simple
condition. In this example, 'SourcePort' is a variable, '==' is the condition. In this example, 'SourcePort' is a variable, '==' is the
relational operator denoting the equality relationship (which is relational operator denoting the equality relationship (which is
generalized by PCIMe to a "MATCH" relationship), and '80' is an integer generalized by PCIMe to a "MATCH" relationship), and '80' is an integer
value. The complete interpretation of a simple condition depends on the value. The complete interpretation of a simple condition depends on the
binding of the variable. Section 4.8.5 describes variables and their binding of the variable. Section 5.8.5 describes variables and their
binding rules. binding rules.
The SimplePolicyCondition class refines the basic structure of the The SimplePolicyCondition class refines the basic structure of the
PolicyCondition class defined in PCIM by using the pair (<variable>, PolicyCondition class defined in PCIM by using the pair (<variable>,
<value>) to form the condition. Note that the operator between the <value>) to form the condition. Note that the operator between the
variable and the value is always implied in PCIMe: it is not a part of variable and the value is always implied in PCIMe: it is not a part of
the formal notation. the formal notation.
The variable specifies the attribute of an object that should be matched The variable specifies the attribute of an object that should be matched
when evaluating the condition. For example, for a QoS model, this object when evaluating the condition. For example, for a QoS model, this object
skipping to change at page 27, line 39 skipping to change at page 28, line 39
variables that cover network attributes commonly used for filtering is variables that cover network attributes commonly used for filtering is
introduced in PCIMe, to encourage interoperability. This list covers introduced in PCIMe, to encourage interoperability. This list covers
layer 3 IP attributes such as IP network addresses, protocols and ports, layer 3 IP attributes such as IP network addresses, protocols and ports,
as well as a set of layer 2 attributes (e.g., MAC addresses). as well as a set of layer 2 attributes (e.g., MAC addresses).
The bound variable is matched against a value to produce the Boolean The bound variable is matched against a value to produce the Boolean
result. For example, in the condition "The source IP address of the flow result. For example, in the condition "The source IP address of the flow
belongs to the 10.1.x.x subnet", a source IP address variable is matched belongs to the 10.1.x.x subnet", a source IP address variable is matched
against a 10.1.x.x subnet value. against a 10.1.x.x subnet value.
4.8.2. Using Simple Policy Conditions 5.8.2. Using Simple Policy Conditions
Simple conditions can be used in policy rules directly, or as building Simple conditions can be used in policy rules directly, or as building
blocks for creating compound policy conditions. blocks for creating compound policy conditions.
Simple condition composition MUST enforce the following data-type Simple condition composition MUST enforce the following data-type
conformance rule: The ValueTypes property of the variable must be conformance rule: The ValueTypes property of the variable must be
compatible with the type of the value class used. The simplest (and compatible with the type of the value class used. The simplest (and
friendliest, from a user point-of-view) way to do this is to equate the friendliest, from a user point-of-view) way to do this is to equate the
type of the value class with the name of the class. By ensuring that the type of the value class with the name of the class. By ensuring that the
ValueTypes property of the variable matches the name of the value class ValueTypes property of the variable matches the name of the value class
skipping to change at page 28, line 44 skipping to change at page 29, line 44
**** PolicyVariableInSimplePolicyCondition **** PolicyVariableInSimplePolicyCondition
@@@@ PolicyValueInSimplePolicyCondition @@@@ PolicyValueInSimplePolicyCondition
#### ExpectedPolicyValuesForVariable #### ExpectedPolicyValuesForVariable
Figure 6. SimplePolicyCondition Figure 6. SimplePolicyCondition
Note: The class names in parenthesis denote subclasses. The classes Note: The class names in parenthesis denote subclasses. The classes
named in the figure are abstract, and thus cannot themselves be named in the figure are abstract, and thus cannot themselves be
instantiated. instantiated.
4.8.3. The Simple Condition Operator 5.8.3. The Simple Condition Operator
A simple condition models an elementary Boolean expression of the form A simple condition models an elementary Boolean expression of the form
"variable MATCHes value". However, the formal notation of the "variable MATCHes value". However, the formal notation of the
SimplePolicyCondition, together with its associations, models only a SimplePolicyCondition, together with its associations, models only a
pair, (<variable>, <value>). The 'MATCH' operator is not directly pair, (<variable>, <value>). The 'MATCH' operator is not directly
modeled -- it is implied. Furthermore, this implied 'MATCH' operator modeled -- it is implied. Furthermore, this implied 'MATCH' operator
carries overloaded semantics. carries overloaded semantics.
For example, in the simple condition "DestinationPort MATCH '80'", the For example, in the simple condition "DestinationPort MATCH '80'", the
interpretation of the 'MATCH' operator is equality (the 'equal' interpretation of the 'MATCH' operator is equality (the 'equal'
skipping to change at page 30, line 18 skipping to change at page 31, line 18
o set match range -> the matching evaluates to true, if all values o set match range -> the matching evaluates to true, if all values
in the set are part of the range. For example, set (2,3) match in the set are part of the range. For example, set (2,3) match
range [1..4] evaluates to true. range [1..4] evaluates to true.
o set (a,b,c,...) match set (x,y,z,...) -> the matching evaluates to o set (a,b,c,...) match set (x,y,z,...) -> the matching evaluates to
true, if all values in the set (a,b,c,...) are part of the set true, if all values in the set (a,b,c,...) are part of the set
(x,y,z,...). For example, set (1,2,3) match set (1,2,3,4) (x,y,z,...). For example, set (1,2,3) match set (1,2,3,4)
evaluates to true. Set (1,2,3) match set (1,2) evaluates to evaluates to true. Set (1,2,3) match set (1,2) evaluates to
false. false.
Variables may contain various types (section 5.11.1). When not stated Variables may contain various types (Section 6.11.1). When not stated
otherwise, the type of the value bound to the variable at condition otherwise, the type of the value bound to the variable at condition
evaluation time and the value type of the PolicyValue instance need to be evaluation time and the value type of the PolicyValue instance need to be
of the same type. If they differ, then the condition evaluates to FALSE. of the same type. If they differ, then the condition evaluates to FALSE.
The ExpectedPolicyValuesForVariable association specifies an expected set The ExpectedPolicyValuesForVariable association specifies an expected set
of values that can be matched with a variable within a simple condition. of values that can be matched with a variable within a simple condition.
Using this association, a source or destination port can be limited to Using this association, a source or destination port can be limited to
the range 0-200, a source or destination IP address can be limited to a the range 0-200, a source or destination IP address can be limited to a
specified list of IPv4 address values, etc. specified list of IPv4 address values, etc.
skipping to change at page 31, line 14 skipping to change at page 32, line 14
The ability to express these limitations appears in the model to support The ability to express these limitations appears in the model to support
validation of a SimplePolicyCondition prior to its deployment to an validation of a SimplePolicyCondition prior to its deployment to an
enforcement point. A Policy Management Tool, for example SHOULD NOT enforcement point. A Policy Management Tool, for example SHOULD NOT
accept the SimplePolicyCondition shown in Figure 7. If, however, a accept the SimplePolicyCondition shown in Figure 7. If, however, a
policy rule containing this condition does appear at an enforcement policy rule containing this condition does appear at an enforcement
point, the expected values play no role in the determination of whether point, the expected values play no role in the determination of whether
the condition evaluates to True or False. Thus in this example, the the condition evaluates to True or False. Thus in this example, the
SimplePolicyCondition evaluates to True if the source port for the packet SimplePolicyCondition evaluates to True if the source port for the packet
under consideration is 300, and it evaluates to False otherwise. under consideration is 300, and it evaluates to False otherwise.
4.8.4. SimplePolicyActions 5.8.4. SimplePolicyActions
The SimplePolicyAction class models the elementary set operation. "SET The SimplePolicyAction class models the elementary set operation. "SET
<variable> TO <value>". The set operator MUST overwrite an old value of <variable> TO <value>". The set operator MUST overwrite an old value of
the variable. In the case where the variable to be updated is multi- the variable. In the case where the variable to be updated is multi-
valued, the only update operation defined is a complete replacement of valued, the only update operation defined is a complete replacement of
all previous values with a new set. In other words, there are no Add or all previous values with a new set. In other words, there are no Add or
Remove [to/from the set of values] operations defined for Remove [to/from the set of values] operations defined for
SimplePolicyActions. SimplePolicyActions.
For example, the action "set DSCP to EF" can be modeled by a simple For example, the action "set DSCP to EF" can be modeled by a simple
skipping to change at page 31, line 36 skipping to change at page 32, line 36
IP packet header DSCP field. 'EF' is an integer or bit string value (6 IP packet header DSCP field. 'EF' is an integer or bit string value (6
bits). The complete interpretation of a simple action depends on the bits). The complete interpretation of a simple action depends on the
binding of the variable. binding of the variable.
The SimplePolicyAction class refines the basic structure of the The SimplePolicyAction class refines the basic structure of the
PolicyAction class defined in PCIM, by specifying the contents of the PolicyAction class defined in PCIM, by specifying the contents of the
action using the (<variable>, <value>) pair to form the action. The action using the (<variable>, <value>) pair to form the action. The
variable specifies the attribute of an object. The value of this variable specifies the attribute of an object. The value of this
attribute is set to the value specified in <value>. Selection of the attribute is set to the value specified in <value>. Selection of the
object is a function of the type of variable involved. See Sections object is a function of the type of variable involved. See Sections
4.8.6 and 4.8.7, respectively, for details on object selection for 5.8.6 and 5.8.7, respectively, for details on object selection for
explicitly bound and implicitly bound policy variables. explicitly bound and implicitly bound policy variables.
SimplePolicyActions can be used in policy rules directly, or as building SimplePolicyActions can be used in policy rules directly, or as building
blocks for creating CompoundPolicyActions. blocks for creating CompoundPolicyActions.
The set operation is only valid if the list of types of the variable The set operation is only valid if the list of types of the variable
(ValueTypes property of PolicyImplicitVariable) includes the specified (ValueTypes property of PolicyImplicitVariable) includes the specified
type of the value. Conversion of values from one representation into type of the value. Conversion of values from one representation into
another is not defined. For example, a variable of IPv4Address type may another is not defined. For example, a variable of IPv4Address type may
not be set to a string containing a DNS name. Conversions are part of an not be set to a string containing a DNS name. Conversions are part of an
skipping to change at page 32, line 41 skipping to change at page 33, line 41
| (PolicyValue) | ooo | (PolicyValue) | | (PolicyValue) | ooo | (PolicyValue) |
+---------------+ +---------------+ +---------------+ +---------------+
Aggregation Legend: Aggregation Legend:
**** PolicyVariableInSimplePolicyAction **** PolicyVariableInSimplePolicyAction
@@@@ PolicyValueInSimplePolicyAction @@@@ PolicyValueInSimplePolicyAction
#### ExpectedPolicyValuesForVariable #### ExpectedPolicyValuesForVariable
Figure 8. SimplePolicyAction Figure 8. SimplePolicyAction
4.8.5. Policy Variables 5.8.5. Policy Variables
A variable generically represents information that changes (or "varies"), A variable generically represents information that changes (or "varies"),
and that is set or evaluated by software. In policy, conditions and and that is set or evaluated by software. In policy, conditions and
actions can abstract information as "policy variables" to be evaluated in actions can abstract information as "policy variables" to be evaluated in
logical expressions, or set by actions. logical expressions, or set by actions.
PCIMe defines two types of PolicyVariables, PolicyImplicitVariables and PCIMe defines two types of PolicyVariables, PolicyImplicitVariables and
PolicyExplicitVariables. The semantic difference between these classes PolicyExplicitVariables. The semantic difference between these classes
is based on modeling context. Explicit variables are bound to exact is based on modeling context. Explicit variables are bound to exact
model constructs, while implicit variables are defined and evaluated model constructs, while implicit variables are defined and evaluated
skipping to change at page 33, line 12 skipping to change at page 34, line 12
value "Error." The Status property is an explicitly defined value "Error." The Status property is an explicitly defined
PolicyVariable (i.e., it is defined in the context of the CIM Schema, and PolicyVariable (i.e., it is defined in the context of the CIM Schema, and
evaluated in the context of a specific instance). On the other hand, evaluated in the context of a specific instance). On the other hand,
network packets are not explicitly modeled or instantiated, since there network packets are not explicitly modeled or instantiated, since there
is no perceived value (at this time) in managing at the packet level. is no perceived value (at this time) in managing at the packet level.
Therefore, a PolicyCondition can make no explicit reference to a model Therefore, a PolicyCondition can make no explicit reference to a model
construct that represents a network packet's source address. In this construct that represents a network packet's source address. In this
case, an implicit PolicyVariable is defined, to allow evaluation or case, an implicit PolicyVariable is defined, to allow evaluation or
modification of a packet's source address. modification of a packet's source address.
4.8.6. Explicitly Bound Policy Variables 5.8.6. Explicitly Bound Policy Variables
Explicitly bound policy variables indicate the class and property names Explicitly bound policy variables indicate the class and property names
of the model construct to be evaluated or set. The CIM Schema defines of the model construct to be evaluated or set. The CIM Schema defines
and constrains "appropriate" values for the variable (i.e., model and constrains "appropriate" values for the variable (i.e., model
property) using data types and other information such as class/property property) using data types and other information such as class/property
qualifiers. qualifiers.
A PolicyExplicitVariable is "explicit" because its model semantics are A PolicyExplicitVariable is "explicit" because its model semantics are
exactly defined. It is NOT explicit due to an exact binding to a exactly defined. It is NOT explicit due to an exact binding to a
particular object instance. If PolicyExplicitVariables were tied to particular object instance. If PolicyExplicitVariables were tied to
skipping to change at page 34, line 30 skipping to change at page 35, line 30
example, if a selected instance were related to exactly one instance of example, if a selected instance were related to exactly one instance of
another class via a particular association class, and if the goal of the another class via a particular association class, and if the goal of the
policy rule were both to test a property of this related instance and to policy rule were both to test a property of this related instance and to
set a property of that same instance, then it would be possible to set a property of that same instance, then it would be possible to
represent the condition and action of the rule using represent the condition and action of the rule using
PolicyExplicitVariables. Rather than handling this one specific case PolicyExplicitVariables. Rather than handling this one specific case
with explicit variables, though, it was decided to lump them with the with explicit variables, though, it was decided to lump them with the
more general case, and deal with them if and when a policy language is more general case, and deal with them if and when a policy language is
defined. defined.
Refer to Section 5.10 for the formal definition of the class Refer to Section 6.10 for the formal definition of the class
PolicyExplicitVariable. PolicyExplicitVariable.
4.8.7. Implicitly Bound Policy Variables 5.8.7. Implicitly Bound Policy Variables
Implicitly bound policy variables define the data type and semantics of a Implicitly bound policy variables define the data type and semantics of a
variable. This determines how the variable is bound to a value in a variable. This determines how the variable is bound to a value in a
condition or an action. Further instructions are provided for specifying condition or an action. Further instructions are provided for specifying
data type and/or value constraints for implicitly bound variables. data type and/or value constraints for implicitly bound variables.
PCIMe introduces an abstract class, PolicyImplicitVariable, to model PCIMe introduces an abstract class, PolicyImplicitVariable, to model
implicitly bound variables. This class is derived from the abstract implicitly bound variables. This class is derived from the abstract
class PolicyVariable also defined in PCIMe. Each of the implicitly bound class PolicyVariable also defined in PCIMe. Each of the implicitly bound
variables introduced by PCIMe (and those that are introduced by domain- variables introduced by PCIMe (and those that are introduced by domain-
specific sub-models) MUST be derived from the PolicyImplicitVariable specific sub-models) MUST be derived from the PolicyImplicitVariable
class. The rationale for using this mechanism for modeling is explained class. The rationale for using this mechanism for modeling is explained
below in Section 4.8.9. below in Section 5.8.9.
A domain-specific policy information model that extends PCIMe may define A domain-specific policy information model that extends PCIMe may define
additional implicitly bound variables either by deriving them directly additional implicitly bound variables either by deriving them directly
from the class PolicyImplicitVariable, or by further refining an existing from the class PolicyImplicitVariable, or by further refining an existing
variable class such as SourcePort. When refining a class such as variable class such as SourcePort. When refining a class such as
SourcePort, existing binding rules, type or value constraints may be SourcePort, existing binding rules, type or value constraints may be
narrowed. narrowed.
4.8.8. Structure and Usage of Pre-Defined Variables 5.8.8. Structure and Usage of Pre-Defined Variables
A class derived from PolicyImplicitVariable to model a particular A class derived from PolicyImplicitVariable to model a particular
implicitly bound variable SHOULD be constructed so that its name depicts implicitly bound variable SHOULD be constructed so that its name depicts
the meaning of the variable. For example, a class defined to model the the meaning of the variable. For example, a class defined to model the
source port of a TCP/UDP flow SHOULD have 'SourcePort' in its name. source port of a TCP/UDP flow SHOULD have 'SourcePort' in its name.
PCIMe defines one association and one general-purpose mechanism that PCIMe defines one association and one general-purpose mechanism that
together characterize each of the implicitly bound variables that it together characterize each of the implicitly bound variables that it
introduces: introduces:
skipping to change at page 36, line 5 skipping to change at page 37, line 5
PolicyIPv4AddrValue, since source ports have different semantics PolicyIPv4AddrValue, since source ports have different semantics
than IP addresses and may not be matched. However, integer value than IP addresses and may not be matched. However, integer value
types are allowed as the property ValueTypes holds the string types are allowed as the property ValueTypes holds the string
"PolicyIntegerValue", which is the class name for integer values. "PolicyIntegerValue", which is the class name for integer values.
o The ExpectedPolicyValuesForVariable association also ensures that o The ExpectedPolicyValuesForVariable association also ensures that
variable-specific semantics are enforced (e.g., the SourcePort variable-specific semantics are enforced (e.g., the SourcePort
variable may include a constraint association to a value object variable may include a constraint association to a value object
defining a specific integer range that should be matched). defining a specific integer range that should be matched).
4.8.9. Rationale for Modeling Implicit Variables as Classes 5.8.9. Rationale for Modeling Implicit Variables as Classes
An implicitly bound variable can be modeled in one of several ways, An implicitly bound variable can be modeled in one of several ways,
including a single class with an enumerator for each individual including a single class with an enumerator for each individual
implicitly bound variable and an abstract class extended for each implicitly bound variable and an abstract class extended for each
individual variable. The reasons for using a class inheritance mechanism individual variable. The reasons for using a class inheritance mechanism
for specifying individual implicitly bound variables are these: for specifying individual implicitly bound variables are these:
1. It is easy to extend. A domain-specific information model can 1. It is easy to extend. A domain-specific information model can
easily extend the PolicyImplicitVariable class or its subclasses easily extend the PolicyImplicitVariable class or its subclasses
to define domain-specific and context-specific variables. For to define domain-specific and context-specific variables. For
skipping to change at page 37, line 5 skipping to change at page 38, line 5
information model may be more difficult to optimize for information model may be more difficult to optimize for
applications. This argument is rejected on the grounds that applications. This argument is rejected on the grounds that
application optimization is of lesser value for an information application optimization is of lesser value for an information
model than clarity and ease of extension. In addition, it is hard model than clarity and ease of extension. In addition, it is hard
to claim that the inheritance model places an absolute burden on to claim that the inheritance model places an absolute burden on
the optimization. For example, a data model may still use the optimization. For example, a data model may still use
enumeration to denote instances of pre-defined variables and claim enumeration to denote instances of pre-defined variables and claim
PCIMe compliance, as long as the data model can be mapped PCIMe compliance, as long as the data model can be mapped
correctly to the definitions specified in this document. correctly to the definitions specified in this document.
4.8.10. Policy Values 5.8.10. Policy Values
The abstract class PolicyValue is used for modeling values and constants The abstract class PolicyValue is used for modeling values and constants
used in policy conditions. Different value types are derived from this used in policy conditions. Different value types are derived from this
class, to represent the various attributes required. Extensions of the class, to represent the various attributes required. Extensions of the
abstract class PolicyValue, defined in this document, provide a list of abstract class PolicyValue, defined in this document, provide a list of
values for basic network attributes. Values can be used to represent values for basic network attributes. Values can be used to represent
constants as named values. Named values can be kept in a reusable policy constants as named values. Named values can be kept in a reusable policy
container to be reused by multiple conditions. Examples of constants container to be reused by multiple conditions. Examples of constants
include well-known ports, well-known protocols, server addresses, and include well-known ports, well-known protocols, server addresses, and
other similar concepts. other similar concepts.
The PolicyValue subclasses define three basic types of values: scalars, The PolicyValue subclasses define three basic types of values: scalars,
ranges and sets. For example, a well-known port number could be defined ranges and sets. For example, a well-known port number could be defined
using the PolicyIntegerValue class, defining a single value (80 for using the PolicyIntegerValue class, defining a single value (80 for
HTTP), a range (80-88), or a set (80, 82, 8080) of ports, respectively. HTTP), a range (80-88), or a set (80, 82, 8080) of ports, respectively.
For details, please see the class definition for each value type in For details, please see the class definition for each value type in
Section 5.14 of this document. Section 6.14 of this document.
PCIMe defines the following subclasses of the abstract class PolicyValue: PCIMe defines the following subclasses of the abstract class PolicyValue:
Classes for general use: Classes for general use:
- PolicyStringValue, - PolicyStringValue,
- PolicyIntegerValue, - PolicyIntegerValue,
- PolicyBitStringValue - PolicyBitStringValue
- PolicyBooleanValue. - PolicyBooleanValue.
Classes for layer 3 Network values: Classes for layer 3 Network values:
- PolicyIPv4AddrValue, - PolicyIPv4AddrValue,
- PolicyIPv6AddrValue. - PolicyIPv6AddrValue.
Classes for layer 2 Network values: Classes for layer 2 Network values:
- PolicyMACAddrValue. - PolicyMACAddrValue.
For details, please see the class definition section of each class in For details, please see the class definition section of each class in
Section 5.14 of this document. Section 6.14 of this document.
4.9. Packet Filtering 5.9. Packet Filtering
PCIMe contains two mechanisms for representing packet filters. The more PCIMe contains two mechanisms for representing packet filters. The more
general of these, termed here the domain-level model, expresses packet general of these, termed here the domain-level model, expresses packet
filters in terms of policy variables and policy values. The other filters in terms of policy variables and policy values. The other
mechanism, termed here the device-level model, expresses packet filters mechanism, termed here the device-level model, expresses packet filters
in a way that maps more directly to the packet fields to which the in a way that maps more directly to the packet fields to which the
filters are being applied. While it is possible to map between these two filters are being applied. While it is possible to map between these two
representations of packet filters, no mapping is provided in PCIMe representations of packet filters, no mapping is provided in PCIMe
itself. itself.
4.9.1. Domain-Level Packet Filters 5.9.1. Domain-Level Packet Filters
In addition to filling in the holes in the overall Policy infrastructure, In addition to filling in the holes in the overall Policy infrastructure,
PCIMe proposes a single mechanism for expressing domain-level packet PCIMe proposes a single mechanism for expressing domain-level packet
filters in policy conditions. This is being done in response to concerns filters in policy conditions. This is being done in response to concerns
that even though the initial "wave" of submodels derived from PCIM were that even though the initial "wave" of submodels derived from PCIM were
all filtering on IP packets, each was doing it in a slightly different all filtering on IP packets, each was doing it in a slightly different
way. PCIMe proposes a common way to express IP packet filters. The way. PCIMe proposes a common way to express IP packet filters. The
following figure illustrates how packet-filtering conditions are following figure illustrates how packet-filtering conditions are
expressed in PCIMe. expressed in PCIMe.
skipping to change at page 39, line 26 skipping to change at page 40, line 26
address = 9.1.1.1 and its Destination port = 80. address = 9.1.1.1 and its Destination port = 80.
IsMirrored "flips" the following Source/Destination packet header fields: IsMirrored "flips" the following Source/Destination packet header fields:
o FlowDirection "In" / FlowDirection "Out" o FlowDirection "In" / FlowDirection "Out"
o Source IP address / Destination IP address o Source IP address / Destination IP address
o Source port / Destination port o Source port / Destination port
o Source MAC address / Destination MAC address o Source MAC address / Destination MAC address
o Source [layer-2] SAP / Destination [layer-2] SAP. o Source [layer-2] SAP / Destination [layer-2] SAP.
4.9.2. Device-Level Packet Filters 5.9.2. Device-Level Packet Filters
At the device level, packet header filters are represented by two At the device level, packet header filters are represented by two
subclasses of the abstract class FilterEntryBase: IpHeadersFilter and subclasses of the abstract class FilterEntryBase: IpHeadersFilter and
8021Filter. Submodels of PCIMe may define other subclasses of 8021Filter. Submodels of PCIMe may define other subclasses of
FilterEntryBase in addition to these two; ICPM [6], for example, defines FilterEntryBase in addition to these two; ICPM [12], for example, defines
subclasses for IPsec-specific filters. subclasses for IPsec-specific filters.
Instances of the subclasses of FilterEntryBase are not used directly as Instances of the subclasses of FilterEntryBase are not used directly as
filters. They are always aggregated into a FilterList, by the filters. They are always aggregated into a FilterList, by the
aggregation EntriesInFilterList. For PCIMe and its submodels, the aggregation EntriesInFilterList. For PCIMe and its submodels, the
EntrySequence property in this aggregation always takes its default value EntrySequence property in this aggregation always takes its default value
'0', indicating that the aggregated filter entries are ANDed together. '0', indicating that the aggregated filter entries are ANDed together.
The FilterList class includes an enumeration property Direction, The FilterList class includes an enumeration property Direction,
representing the direction of the traffic flow to which the FilterList is representing the direction of the traffic flow to which the FilterList is
to be applied. The value Mirrored(4) for Direction represents exactly to be applied. The value Mirrored(4) for Direction represents exactly
the same thing as the IsMirrored boolean does in CompoundFilterCondition. the same thing as the IsMirrored boolean does in CompoundFilterCondition.
See Section 4.9.1 for details. See Section 5.9.1 for details.
4.10. Conformance to PCIM and PCIMe 5.10. Conformance to PCIM and PCIMe
Because PCIM and PCIMe provide the core classes for modeling policies, Because PCIM and PCIMe provide the core classes for modeling policies,
they are not in general sufficient by themselves for representing actual they are not in general sufficient by themselves for representing actual
policy rules. Submodels, such as QPIM and ICPM, provide the means for policy rules. Submodels, such as QPIM and ICPM, provide the means for
expressing policy rules, by defining subclasses of the classes defined in expressing policy rules, by defining subclasses of the classes defined in
PCIM and PCIMe, and/or by indicating how the PolicyVariables and PCIM and PCIMe, and/or by indicating how the PolicyVariables and
PolicyValues defined in PCIMe can be used to express conditions and PolicyValues defined in PCIMe can be used to express conditions and
actions applicable to the submodel. actions applicable to the submodel.
A particular submodel will not, in general, need to use every element A particular submodel will not, in general, need to use every element
skipping to change at page 40, line 36 skipping to change at page 41, line 36
incorrectly defined conditions or actions is not prescribed by this incorrectly defined conditions or actions is not prescribed by this
information model. While it would be helpful if it were prescribed, the information model. While it would be helpful if it were prescribed, the
variations in implementation restrict the ability for this information variations in implementation restrict the ability for this information
model to control the effect. For example, if an implementation only model to control the effect. For example, if an implementation only
detected that a PEP could not enforce a given action on that PEP, it detected that a PEP could not enforce a given action on that PEP, it
would be very difficult to declare that such a failure should affect would be very difficult to declare that such a failure should affect
other PEPs, or the PDP process. On the other hand, if the PDP determines other PEPs, or the PDP process. On the other hand, if the PDP determines
that it cannot properly evaluate a condition, that failure may well that it cannot properly evaluate a condition, that failure may well
affect all applications of the containing rules. affect all applications of the containing rules.
5. Class Definitions 6. Class Definitions
The following definitions supplement those in PCIM itself. PCIM The following definitions supplement those in PCIM itself. PCIM
definitions that are not DEPRECATED here are still current parts of the definitions that are not DEPRECATED here are still current parts of the
overall Policy Core Information Model. overall Policy Core Information Model.
5.1. The Abstract Class "PolicySet" 6.1. The Abstract Class "PolicySet"
PolicySet is an abstract class that may group policies into a structured PolicySet is an abstract class that may group policies into a structured
set of policies. set of policies.
NAME PolicySet NAME PolicySet
DESCRIPTION An abstract class that represents a set of policies DESCRIPTION An abstract class that represents a set of policies
that form a coherent set. The set of contained that form a coherent set. The set of contained
policies has a common decision strategy and a common policies has a common decision strategy and a common
set of policy roles. Subclasses include PolicyGroup set of policy roles. Subclasses include PolicyGroup
and PolicyRule. and PolicyRule.
skipping to change at page 41, line 22 skipping to change at page 42, line 22
the first rule that evaluates to TRUE; AllMatching the first rule that evaluates to TRUE; AllMatching
enforces the actions of all rules that evaluate to enforces the actions of all rules that evaluate to
TRUE. TRUE.
SYNTAX uint16 SYNTAX uint16
VALUES 1 [FirstMatching], 2 [AllMatching] VALUES 1 [FirstMatching], 2 [AllMatching]
DEFAULT VALUE 1 [FirstMatching] DEFAULT VALUE 1 [FirstMatching]
The definition of PolicyRoles is unchanged from PCIM. It is, however, The definition of PolicyRoles is unchanged from PCIM. It is, however,
moved from the class Policy up to the superclass PolicySet. moved from the class Policy up to the superclass PolicySet.
5.2. Update PCIM's Class "PolicyGroup" 6.2. Update PCIM's Class "PolicyGroup"
The PolicyGroup class is moved, so that it is now derived from PolicySet. The PolicyGroup class is moved, so that it is now derived from PolicySet.
NAME PolicyGroup NAME PolicyGroup
DESCRIPTION A container for a set of related PolicyRules and DESCRIPTION A container for a set of related PolicyRules and
PolicyGroups. PolicyGroups.
DERIVED FROM PolicySet DERIVED FROM PolicySet
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.3. Update PCIM's Class "PolicyRule" 6.3. Update PCIM's Class "PolicyRule"
The PolicyRule class is moved, so that it is now derived from PolicySet. The PolicyRule class is moved, so that it is now derived from PolicySet.
The Priority property is also deprecated in PolicyRule, and PolicyRoles The Priority property is also deprecated in PolicyRule, and PolicyRoles
is now inherited from the parent class PolicySet. Finally, a new is now inherited from the parent class PolicySet. Finally, a new
property ExecutionStrategy is introduced, paralleling the property of the property ExecutionStrategy is introduced, paralleling the property of the
same name in the class CompoundPolicyAction. same name in the class CompoundPolicyAction.
NAME PolicyRule NAME PolicyRule
DESCRIPTION The central class for representing the "If Condition DESCRIPTION The central class for representing the "If Condition
then Action" semantics associated with a policy rule. then Action" semantics associated with a policy rule.
skipping to change at page 42, line 31 skipping to change at page 43, line 31
The property definition is as follows: The property definition is as follows:
NAME ExecutionStrategy NAME ExecutionStrategy
DESCRIPTION An enumeration indicating how to interpret the action DESCRIPTION An enumeration indicating how to interpret the action
ordering for the actions aggregated by this ordering for the actions aggregated by this
PolicyRule. PolicyRule.
SYNTAX uint16 (ENUM, {1=Do Until Success, 2=Do All, 3=Do SYNTAX uint16 (ENUM, {1=Do Until Success, 2=Do All, 3=Do
Until Failure} ) Until Failure} )
DEFAULT VALUE Do All (2) DEFAULT VALUE Do All (2)
5.4. The Class "SimplePolicyCondition" 6.4. The Class "SimplePolicyCondition"
A simple policy condition is composed of an ordered triplet: A simple policy condition is composed of an ordered triplet:
<Variable> MATCH <Value> <Variable> MATCH <Value>
No formal modeling of the MATCH operator is provided. The 'match' No formal modeling of the MATCH operator is provided. The 'match'
relationship is implied. Such simple conditions are evaluated by relationship is implied. Such simple conditions are evaluated by
answering the question: answering the question:
Does <variable> match <value>? Does <variable> match <value>?
skipping to change at page 43, line 12 skipping to change at page 44, line 12
PolicyVariableInSimplePolicyCondition and PolicyVariableInSimplePolicyCondition and
PolicyValueInSimplePolicyCondition. PolicyValueInSimplePolicyCondition.
The class definition is as follows: The class definition is as follows:
NAME SimplePolicyCondition NAME SimplePolicyCondition
DERIVED FROM PolicyCondition DERIVED FROM PolicyCondition
ABSTRACT False ABSTRACT False
PROPERTIES (none) PROPERTIES (none)
5.5. The Class "CompoundPolicyCondition" 6.5. The Class "CompoundPolicyCondition"
This class represents a compound policy condition, formed by aggregation This class represents a compound policy condition, formed by aggregation
of simpler policy conditions. of simpler policy conditions.
NAME CompoundPolicyCondition NAME CompoundPolicyCondition
DESCRIPTION A subclass of PolicyCondition that introduces the DESCRIPTION A subclass of PolicyCondition that introduces the
ConditionListType property, used for assigning DNF / ConditionListType property, used for assigning DNF /
CNF semantics to subordinate policy conditions. CNF semantics to subordinate policy conditions.
DERIVED FROM PolicyCondition DERIVED FROM PolicyCondition
ABSTRACT FALSE ABSTRACT FALSE
skipping to change at page 43, line 39 skipping to change at page 44, line 39
definition is as follows: definition is as follows:
NAME ConditionListType NAME ConditionListType
DESCRIPTION Indicates whether the list of policy conditions DESCRIPTION Indicates whether the list of policy conditions
associated with this policy rule is in disjunctive associated with this policy rule is in disjunctive
normal form (DNF) or conjunctive normal form (CNF). normal form (DNF) or conjunctive normal form (CNF).
SYNTAX uint16 SYNTAX uint16
VALUES DNF(1), CNF(2) VALUES DNF(1), CNF(2)
DEFAULT VALUE DNF(1) DEFAULT VALUE DNF(1)
5.6. The Class "CompoundFilterCondition" 6.6. The Class "CompoundFilterCondition"
This subclass of CompoundPolicyCondition introduces one additional This subclass of CompoundPolicyCondition introduces one additional
property, the boolean IsMirrored. This property turns on or off the property, the boolean IsMirrored. This property turns on or off the
"flipping" of corresponding source and destination fields in a filter "flipping" of corresponding source and destination fields in a filter
specification. specification.
NAME CompoundFilterCondition NAME CompoundFilterCondition
DESCRIPTION A subclass of CompoundPolicyCondition that introduces DESCRIPTION A subclass of CompoundPolicyCondition that introduces
the IsMirrored property. the IsMirrored property.
DERIVED FROM CompoundPolicyCondition DERIVED FROM CompoundPolicyCondition
skipping to change at page 44, line 11 skipping to change at page 45, line 11
The IsMirrored property indicates whether packets that "mirror" a The IsMirrored property indicates whether packets that "mirror" a
compound filter condition should be treated as matching the filter. The compound filter condition should be treated as matching the filter. The
property definition is as follows: property definition is as follows:
NAME IsMirrored NAME IsMirrored
DESCRIPTION Indicates whether packets that mirror the specified DESCRIPTION Indicates whether packets that mirror the specified
filter are to be treated as matching the filter. filter are to be treated as matching the filter.
SYNTAX boolean SYNTAX boolean
DEFAULT VALUE FALSE DEFAULT VALUE FALSE
5.7. The Class "SimplePolicyAction" 6.7. The Class "SimplePolicyAction"
The SimplePolicyAction class models the elementary set operation. "SET The SimplePolicyAction class models the elementary set operation. "SET
<variable> TO <value>". The set operator MUST overwrite an old value of <variable> TO <value>". The set operator MUST overwrite an old value of
the variable. the variable.
Two aggregations are used in order to create the pair <variable> <value>. Two aggregations are used in order to create the pair <variable> <value>.
The aggregation PolicyVariableInSimplePolicyAction relates a The aggregation PolicyVariableInSimplePolicyAction relates a
SimplePolicyAction to a single variable instance. Similarly, the SimplePolicyAction to a single variable instance. Similarly, the
aggregation PolicyValueInSimplePolicyAction relates a SimplePolicyAction aggregation PolicyValueInSimplePolicyAction relates a SimplePolicyAction
to a single value instance. Both aggregations are defined in this to a single value instance. Both aggregations are defined in this
document. document.
NAME SimplePolicyAction NAME SimplePolicyAction
DESCRIPTION A subclass of PolicyAction that introduces the notion DESCRIPTION A subclass of PolicyAction that introduces the notion
of "SET variable TO value". of "SET variable TO value".
DERIVED FROM PolicyAction DERIVED FROM PolicyAction
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.8. The Class "CompoundPolicyAction" 6.8. The Class "CompoundPolicyAction"
The CompoundPolicyAction class is used to represent an expression The CompoundPolicyAction class is used to represent an expression
consisting of an ordered sequence of action terms. Each action term is consisting of an ordered sequence of action terms. Each action term is
represented as a subclass of the PolicyAction class, defined in [PCIM]. represented as a subclass of the PolicyAction class, defined in [PCIM].
Compound actions are constructed by associating dependent action terms Compound actions are constructed by associating dependent action terms
together using the PolicyActionInPolicyAction aggregation. together using the PolicyActionInPolicyAction aggregation.
The class definition is as follows: The class definition is as follows:
NAME CompoundPolicyAction NAME CompoundPolicyAction
skipping to change at page 46, line 4 skipping to change at page 47, line 4
The definition of the ExecutionStrategy property is as follows: The definition of the ExecutionStrategy property is as follows:
NAME ExecutionStrategy NAME ExecutionStrategy
DESCRIPTION An enumeration indicating how to interpret the action DESCRIPTION An enumeration indicating how to interpret the action
ordering for the actions aggregated by this ordering for the actions aggregated by this
CompoundPolicyAction. CompoundPolicyAction.
SYNTAX uint16 (ENUM, {1=Do Until Success, 2=Do All, 3=Do SYNTAX uint16 (ENUM, {1=Do Until Success, 2=Do All, 3=Do
Until Failure} ) Until Failure} )
DEFAULT VALUE Do All (2) DEFAULT VALUE Do All (2)
5.9. The Abstract Class "PolicyVariable" 6.9. The Abstract Class "PolicyVariable"
Variables are used for building individual conditions. The variable Variables are used for building individual conditions. The variable
specifies the property of a flow or an event that should be matched when specifies the property of a flow or an event that should be matched when
evaluating the condition. However, not every combination of a variable evaluating the condition. However, not every combination of a variable
and a value creates a meaningful condition. For example, a source IP and a value creates a meaningful condition. For example, a source IP
address variable can not be matched against a value that specifies a port address variable can not be matched against a value that specifies a port
number. A given variable selects the set of matchable value types. number. A given variable selects the set of matchable value types.
A variable can have constraints that limit the set of values within a A variable can have constraints that limit the set of values within a
particular value type that can be matched against it in a condition. For particular value type that can be matched against it in a condition. For
skipping to change at page 46, line 32 skipping to change at page 47, line 32
variable classes are defined as sub classes of the PolicyVariable class. variable classes are defined as sub classes of the PolicyVariable class.
A set of implicit variables is defined in this document as well. A set of implicit variables is defined in this document as well.
The class definition is as follows: The class definition is as follows:
NAME PolicyVariable NAME PolicyVariable
DERIVED FROM Policy DERIVED FROM Policy
ABSTRACT TRUE ABSTRACT TRUE
PROPERTIES (none) PROPERTIES (none)
5.10. The Class "PolicyExplicitVariable" 6.10. The Class "PolicyExplicitVariable"
Explicitly defined policy variables are evaluated within the context of Explicitly defined policy variables are evaluated within the context of
the CIM Schema and its modeling constructs. The PolicyExplicitVariable the CIM Schema and its modeling constructs. The PolicyExplicitVariable
class indicates the exact model property to be evaluated or manipulated. class indicates the exact model property to be evaluated or manipulated.
See Section 4.8.6 for a complete discussion of what happens when the See Section 5.8.6 for a complete discussion of what happens when the
values of the ModelClass and ModelProperty properties in an instance of values of the ModelClass and ModelProperty properties in an instance of
this class do not correspond to the characteristics of the model this class do not correspond to the characteristics of the model
construct being evaluated or updated. construct being evaluated or updated.
The class definition is as follows: The class definition is as follows:
NAME PolicyExplicitVariable NAME PolicyExplicitVariable
DERIVED FROM PolicyVariable DERIVED FROM PolicyVariable
ABSTRACT False ABSTRACT False
PROPERTIES ModelClass, ModelProperty PROPERTIES ModelClass, ModelProperty
5.10.1. The Single-Valued Property "ModelClass" 6.10.1. The Single-Valued Property "ModelClass"
This property is a string specifying the class name whose property is This property is a string specifying the class name whose property is
evaluated or set as a PolicyVariable. evaluated or set as a PolicyVariable.
The property is defined as follows: The property is defined as follows:
NAME ModelClass NAME ModelClass
SYNTAX String SYNTAX String
5.10.2. The Single-Valued Property ModelProperty 6.10.2. The Single-Valued Property ModelProperty
This property is a string specifying the property name, within the This property is a string specifying the property name, within the
ModelClass, which is evaluated or set as a PolicyVariable. The property ModelClass, which is evaluated or set as a PolicyVariable. The property
is defined as follows: is defined as follows:
NAME ModelProperty NAME ModelProperty
SYNTAX String SYNTAX String
5.11. The Abstract Class "PolicyImplicitVariable" 6.11. The Abstract Class "PolicyImplicitVariable"
Implicitly defined policy variables are evaluated outside of the context Implicitly defined policy variables are evaluated outside of the context
of the CIM Schema and its modeling constructs. Subclasses specify the of the CIM Schema and its modeling constructs. Subclasses specify the
data type and semantics of the PolicyVariables. data type and semantics of the PolicyVariables.
Interpretation and evaluation of a PolicyImplicitVariable can vary, Interpretation and evaluation of a PolicyImplicitVariable can vary,
depending on the particular context in which it is used. For example, a depending on the particular context in which it is used. For example, a
"SourceIP" address may denote the source address field of an IP packet "SourceIP" address may denote the source address field of an IP packet
header, or the sender address delivered by an RSVP PATH message. header, or the sender address delivered by an RSVP PATH message.
The class definition is as follows: The class definition is as follows:
NAME PolicyImplicitVariable NAME PolicyImplicitVariable
DERIVED FROM PolicyVariable DERIVED FROM PolicyVariable
ABSTRACT True ABSTRACT True
PROPERTIES ValueTypes[ ] PROPERTIES ValueTypes[ ]
5.11.1. The Multi-Valued Property "ValueTypes" 6.11.1. The Multi-Valued Property "ValueTypes"
This property is a set of strings specifying an unordered list of This property is a set of strings specifying an unordered list of
possible value/data types that can be used in simple conditions and possible value/data types that can be used in simple conditions and
actions, with this variable. The value types are specified by their actions, with this variable. The value types are specified by their
class names (subclasses of PolicyValue such as PolicyStringValue). The class names (subclasses of PolicyValue such as PolicyStringValue). The
list of class names enables an application to search on a specific name, list of class names enables an application to search on a specific name,
as well as to ensure that the data type of the variable is of the correct as well as to ensure that the data type of the variable is of the correct
type. type.
The list of default ValueTypes for each subclass of The list of default ValueTypes for each subclass of
PolicyImplicitVariable is specified within that variable's definition. PolicyImplicitVariable is specified within that variable's definition.
The property is defined as follows: The property is defined as follows:
NAME ValueTypes NAME ValueTypes
SYNTAX String SYNTAX String
5.12. Subclasses of "PolicyImplicitVariable" Specified in PCIMe
6.12. Subclasses of "PolicyImplicitVariable" Specified in PCIMe
The following subclasses of PolicyImplicitVariable are defined in PCIMe. The following subclasses of PolicyImplicitVariable are defined in PCIMe.
5.12.1. The Class "PolicySourceIPv4Variable" 6.12.1. The Class "PolicySourceIPv4Variable"
NAME PolicySourceIPv4Variable NAME PolicySourceIPv4Variable
DESCRIPTION The source IPv4 address. of the outermost IP packet DESCRIPTION The source IPv4 address. of the outermost IP packet
header. "Outermost" here refers to the IP packet as header. "Outermost" here refers to the IP packet as
it flows on the wire, before any headers have been it flows on the wire, before any headers have been
stripped from it. stripped from it.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIPv4AddrValue - PolicyIPv4AddrValue
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.2. The Class "PolicySourceIPv6Variable" 6.12.2. The Class "PolicySourceIPv6Variable"
NAME PolicySourceIPv6Variable NAME PolicySourceIPv6Variable
DESCRIPTION The source IPv6 address of the outermost IP packet DESCRIPTION The source IPv6 address of the outermost IP packet
header. "Outermost" here refers to the IP packet as header. "Outermost" here refers to the IP packet as
it flows on the wire, before any headers have been it flows on the wire, before any headers have been
stripped from it. stripped from it.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIPv6AddrValue - PolicyIPv6AddrValue
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.3. The Class "PolicyDestinationIPv4Variable" 6.12.3. The Class "PolicyDestinationIPv4Variable"
NAME PolicyDestinationIPv4Variable NAME PolicyDestinationIPv4Variable
DESCRIPTION The destination IPv4 address of the outermost IP DESCRIPTION The destination IPv4 address of the outermost IP
packet header. "Outermost" here refers to the IP packet header. "Outermost" here refers to the IP
packet as it flows on the wire, before any headers packet as it flows on the wire, before any headers
have been stripped from it. have been stripped from it.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIPv4AddrValue - PolicyIPv4AddrValue
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.4. The Class "PolicyDestinationIPv6Variable" 6.12.4. The Class "PolicyDestinationIPv6Variable"
NAME PolicyDestinationIPv6Variable NAME PolicyDestinationIPv6Variable
DESCRIPTION The destination IPv6 address of the outermost IP DESCRIPTION The destination IPv6 address of the outermost IP
packet header. "Outermost" here refers to the IP packet header. "Outermost" here refers to the IP
packet as it flows on the wire, before any headers packet as it flows on the wire, before any headers
have been stripped from it. have been stripped from it.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIPv6AddrValue - PolicyIPv6AddrValue
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.5. The Class "PolicySourcePortVariable" 6.12.5. The Class "PolicySourcePortVariable"
NAME PolicySourcePortVariable NAME PolicySourcePortVariable
DESCRIPTION Ports are defined as the abstraction that transport DESCRIPTION Ports are defined as the abstraction that transport
protocols use to distinguish among multiple protocols use to distinguish among multiple
destinations within a given host computer. For TCP destinations within a given host computer. For TCP
and UDP flows, the PolicySourcePortVariable is and UDP flows, the PolicySourcePortVariable is
logically bound to the source port field of the logically bound to the source port field of the
outermost UDP or TCP packet header. "Outermost" here outermost UDP or TCP packet header. "Outermost" here
refers to the IP packet as it flows on the wire, refers to the IP packet as it flows on the wire,
before any headers have been stripped from it. before any headers have been stripped from it.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..65535) - PolicyIntegerValue (0..65535)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.6. The Class "PolicyDestinationPortVariable" 6.12.6. The Class "PolicyDestinationPortVariable"
NAME PolicyDestinationPortVariable NAME PolicyDestinationPortVariable
DESCRIPTION Ports are defined as the abstraction that transport DESCRIPTION Ports are defined as the abstraction that transport
protocols use to distinguish among multiple protocols use to distinguish among multiple
destinations within a given host computer. For TCP destinations within a given host computer. For TCP
and UDP flows, the PolicyDestinationPortVariable is and UDP flows, the PolicyDestinationPortVariable is
logically bound to the destination port field of the logically bound to the destination port field of the
outermost UDP or TCP packet header. "Outermost" here outermost UDP or TCP packet header. "Outermost" here
refers to the IP packet as it flows on the wire, refers to the IP packet as it flows on the wire,
before any headers have been stripped from it. before any headers have been stripped from it.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..65535) - PolicyIntegerValue (0..65535)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.7. The Class "PolicyIPProtocolVariable"
6.12.7. The Class "PolicyIPProtocolVariable"
NAME PolicyIPProtocolVariable NAME PolicyIPProtocolVariable
DESCRIPTION The IP protocol number. DESCRIPTION The IP protocol number.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..255) - PolicyIntegerValue (0..255)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.8. The Class "PolicyIPVersionVariable" 6.12.8. The Class "PolicyIPVersionVariable"
NAME PolicyIPVersionVariable NAME PolicyIPVersionVariable
DESCRIPTION The IP version number. The well-known values are 4 DESCRIPTION The IP version number. The well-known values are 4
and 6. and 6.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..15) - PolicyIntegerValue (0..15)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.9. The Class "PolicyIPToSVariable" 6.12.9. The Class "PolicyIPToSVariable"
NAME PolicyIPToSVariable NAME PolicyIPToSVariable
DESCRIPTION The IP TOS octet. DESCRIPTION The IP TOS octet.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..255) - PolicyIntegerValue (0..255)
- PolicyBitStringValue (8 bits) - PolicyBitStringValue (8 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.10. The Class "PolicyDSCPVariable" 6.12.10. The Class "PolicyDSCPVariable"
NAME PolicyDSCPVariable NAME PolicyDSCPVariable
DESCRIPTION The 6 bit Differentiated Service Code Point. DESCRIPTION The 6 bit Differentiated Service Code Point.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..63) - PolicyIntegerValue (0..63)
- PolicyBitStringValue (6 bits) - PolicyBitStringValue (6 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.11. The Class "PolicyFlowIdVariable"
6.12.11. The Class "PolicyFlowIdVariable"
NAME PolicyFlowIdVariable NAME PolicyFlowIdVariable
DESCRIPTION The flow identifer of the outermost IPv6 packet DESCRIPTION The flow identifer of the outermost IPv6 packet
header. "Outermost" here refers to the IP packet as header. "Outermost" here refers to the IP packet as
it flows on the wire, before any headers have been it flows on the wire, before any headers have been
stripped from it. stripped from it.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..1048575 - PolicyIntegerValue (0..1048575
- PolicyBitStringValue (20 bits) - PolicyBitStringValue (20 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.12. The Class "PolicySourceMACVariable" 6.12.12. The Class "PolicySourceMACVariable"
NAME PolicySourceMACVariable NAME PolicySourceMACVariable
DESCRIPTION The source MAC address. DESCRIPTION The source MAC address.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyMACAddrValue - PolicyMACAddrValue
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.13. The Class "PolicyDestinationMACVariable" 6.12.13. The Class "PolicyDestinationMACVariable"
NAME PolicyDestinationMACVariable NAME PolicyDestinationMACVariable
DESCRIPTION The destination MAC address. DESCRIPTION The destination MAC address.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyMACAddrValue - PolicyMACAddrValue
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.14. The Class "PolicyVLANVariable" 6.12.14. The Class "PolicyVLANVariable"
NAME PolicyVLANVariable NAME PolicyVLANVariable
DESCRIPTION The virtual Bridged Local Area Network Identifier, a DESCRIPTION The virtual Bridged Local Area Network Identifier, a
12-bit field as defined in the IEEE 802.1q standard. 12-bit field as defined in the IEEE 802.1q standard.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..4095) - PolicyIntegerValue (0..4095)
- PolicyBitStringValue (12 bits) - PolicyBitStringValue (12 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.15. The Class "PolicyCoSVariable" 6.12.15. The Class "PolicyCoSVariable"
NAME PolicyCoSVariable NAME PolicyCoSVariable
DESCRIPTION Class of Service, a 3-bit field, used in the layer 2 DESCRIPTION Class of Service, a 3-bit field, used in the layer 2
header to select the forwarding treatment. Bound to header to select the forwarding treatment. Bound to
the IEEE 802.1q user-priority field. the IEEE 802.1q user-priority field.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..7) - PolicyIntegerValue (0..7)
- PolicyBitStringValue (3 bits) - PolicyBitStringValue (3 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.16. The Class "PolicyEthertypeVariable" 6.12.16. The Class "PolicyEthertypeVariable"
NAME PolicyEthertypeVariable NAME PolicyEthertypeVariable
DESCRIPTION The Ethertype protocol number of Ethernet frames. DESCRIPTION The Ethertype protocol number of Ethernet frames.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..65535) - PolicyIntegerValue (0..65535)
- PolicyBitStringValue (16 bits) - PolicyBitStringValue (16 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.17. The Class "PolicySourceSAPVariable" 6.12.17. The Class "PolicySourceSAPVariable"
NAME PolicySourceSAPVariable NAME PolicySourceSAPVariable
DESCRIPTION The Source Service Access Point (SAP) number of the DESCRIPTION The Source Service Access Point (SAP) number of the
IEEE 802.2 LLC header. IEEE 802.2 LLC header.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..255) - PolicyIntegerValue (0..255)
- PolicyBitStringValue (8 bits) - PolicyBitStringValue (8 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.18. The Class "PolicyDestinationSAPVariable" 6.12.18. The Class "PolicyDestinationSAPVariable"
NAME PolicyDestinationSAPVariable NAME PolicyDestinationSAPVariable
DESCRIPTION The Destination Service Access Point (SAP) number of DESCRIPTION The Destination Service Access Point (SAP) number of
the IEEE 802.2 LLC header. the IEEE 802.2 LLC header.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..255) - PolicyIntegerValue (0..255)
- PolicyBitStringValue (8 bits) - PolicyBitStringValue (8 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
6.12.19. The Class "PolicySNAPOUIVariable"
5.12.19. The Class "PolicySNAPOUIVariable"
NAME PolicySNAPOUIVariable NAME PolicySNAPOUIVariable
DESCRIPTION The value of the first three octets of the Sub-Network DESCRIPTION The value of the first three octets of the Sub-Network
Access Protocol (SNAP) Protocol Identifier field for Access Protocol (SNAP) Protocol Identifier field for
802.2 SNAP encapsulation, containing an 802.2 SNAP encapsulation, containing an
Organizationally Unique Identifier (OUI). The value Organizationally Unique Identifier (OUI). The value
00-00-00 indicates the encapsulation of Ethernet 00-00-00 indicates the encapsulation of Ethernet
frames (RFC 1042). OUI value 00-00-F8 indicates the frames (RFC 1042). OUI value 00-00-F8 indicates the
special encapsulation of Ethernet frames by certain special encapsulation of Ethernet frames by certain
types of bridges (IEEE 802.1H). Other values are types of bridges (IEEE 802.1H). Other values are
skipping to change at page 53, line 36 skipping to change at page 54, line 30
PolicySNAPTypeVariable. PolicySNAPTypeVariable.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..16777215) - PolicyIntegerValue (0..16777215)
- PolicyBitStringValue (24 bits) - PolicyBitStringValue (24 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.20. The Class "PolicySNAPTypeVariable" 6.12.20. The Class "PolicySNAPTypeVariable"
NAME PolicySNAPTypeVariable NAME PolicySNAPTypeVariable
DESCRIPTION The value of the 4th and 5th octets of the Sub-Network DESCRIPTION The value of the 4th and 5th octets of the Sub-Network
Access Protocol (SNAP) Protocol Identifier field for Access Protocol (SNAP) Protocol Identifier field for
IEEE 802 SNAP encapsulation when the IEEE 802 SNAP encapsulation when the
PolicySNAPOUIVariable indicates one of the two PolicySNAPOUIVariable indicates one of the two
Encapsulated Ethernet frame formats. This value is Encapsulated Ethernet frame formats. This value is
undefined for other values of PolicySNAPOUIVariable. undefined for other values of PolicySNAPOUIVariable.
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyIntegerValue (0..65535) - PolicyIntegerValue (0..65535)
- PolicyBitStringValue (16 bits) - PolicyBitStringValue (16 bits)
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.12.21. The Class "PolicyFlowDirectionVariable"
6.12.21. The Class "PolicyFlowDirectionVariable"
NAME PolicyFlowDirectionVariable NAME PolicyFlowDirectionVariable
DESCRIPTION The direction of a flow relative to a network element. DESCRIPTION The direction of a flow relative to a network element.
Direction may be "IN" and/or "OUT". Direction may be "IN" and/or "OUT".
ALLOWED VALUE TYPES: ALLOWED VALUE TYPES:
- PolicyStringValue ('IN", "OUT") - PolicyStringValue ('IN", "OUT")
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
To match on both inbound and outbound flows, the associated To match on both inbound and outbound flows, the associated
PolicyStringValue object has two entries in its StringList property: "IN" PolicyStringValue object has two entries in its StringList property: "IN"
and "OUT". and "OUT".
skipping to change at page 54, line 21 skipping to change at page 55, line 15
- PolicyStringValue ('IN", "OUT") - PolicyStringValue ('IN", "OUT")
DERIVED FROM PolicyImplicitVariable DERIVED FROM PolicyImplicitVariable
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
To match on both inbound and outbound flows, the associated To match on both inbound and outbound flows, the associated
PolicyStringValue object has two entries in its StringList property: "IN" PolicyStringValue object has two entries in its StringList property: "IN"
and "OUT". and "OUT".
5.13. The Abstract Class "PolicyValue" 6.13. The Abstract Class "PolicyValue"
This is an abstract class that serves as the base class for all This is an abstract class that serves as the base class for all
subclasses that are used to define value objects in the PCIMe. It is subclasses that are used to define value objects in the PCIMe. It is
used for defining values and constants used in policy conditions. The used for defining values and constants used in policy conditions. The
class definition is as follows: class definition is as follows:
NAME PolicyValue NAME PolicyValue
DERIVED FROM Policy DERIVED FROM Policy
ABSTRACT True ABSTRACT True
PROPERTIES (none) PROPERTIES (none)
5.14. Subclasses of "PolicyValue" Specified in PCIMe 6.14. Subclasses of "PolicyValue" Specified in PCIMe
The following subsections contain the PolicyValue subclasses defined in The following subsections contain the PolicyValue subclasses defined in
PCIMe. Additional subclasses may be defined in models derived from PCIMe. Additional subclasses may be defined in models derived from
PCIMe. PCIMe.
5.14.1. The Class "PolicyIPv4AddrValue" 6.14.1. The Class "PolicyIPv4AddrValue"
This class is used to provide a list of IPv4Addresses, hostnames and This class is used to provide a list of IPv4Addresses, hostnames and
address range values to be matched against in a policy condition. The address range values to be matched against in a policy condition. The
class definition is as follows: class definition is as follows:
NAME PolicyIPv4AddrValue NAME PolicyIPv4AddrValue
DERIVED FROM PolicyValue DERIVED FROM PolicyValue
ABSTRACT False ABSTRACT False
PROPERTIES IPv4AddrList[ ] PROPERTIES IPv4AddrList[ ]
The IPv4AddrList property provides an unordered list of strings, each The IPv4AddrList property provides an unordered list of strings, each
specifying a single IPv4 address, a hostname, or a range of IPv4 specifying a single IPv4 address, a hostname, or a range of IPv4
addresses, according to the ABNF definition [8] of an IPv4 address, as addresses, according to the ABNF definition [6] of an IPv4 address, as
specified below: specified below:
IPv4address = 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT IPv4address = 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT
IPv4prefix = IPv4address "/" 1*2DIGIT IPv4prefix = IPv4address "/" 1*2DIGIT
IPv4range = IPv4address"-"IPv4address IPv4range = IPv4address"-"IPv4address
IPv4maskedaddress = IPv4address","IPv4address IPv4maskedaddress = IPv4address","IPv4address
Hostname (as defined in [9]) Hostname (as defined in [4])
In the above definition, each string entry is either: In the above definition, each string entry is either:
1. A single IPv4address in dot notation, as defined above. Example: 1. A single IPv4address in dot notation, as defined above. Example:
121.1.1.2 121.1.1.2
2. An IPv4prefix address range, as defined above, specified by an 2. An IPv4prefix address range, as defined above, specified by an
address and a prefix length, separated by "/". Example: address and a prefix length, separated by "/". Example:
2.3.128.0/15 2.3.128.0/15
skipping to change at page 55, line 33 skipping to change at page 56, line 25
range's starting and ending addresses, including these two range's starting and ending addresses, including these two
addresses. Example: 1.1.22.1-1.1.22.5 addresses. Example: 1.1.22.1-1.1.22.5
4. An IPv4maskedaddress address range, as defined above, specified by 4. An IPv4maskedaddress address range, as defined above, specified by
an address and mask. The address and mask are represented in dot an address and mask. The address and mask are represented in dot
notation, separated by a comma ",". The masked address appears notation, separated by a comma ",". The masked address appears
before the comma, and the mask appears after the comma. Example: before the comma, and the mask appears after the comma. Example:
2.3.128.0,255.255.248.0. 2.3.128.0,255.255.248.0.
5. A single Hostname. The Hostname format follows the guidelines and 5. A single Hostname. The Hostname format follows the guidelines and
restrictions specified in [9]. Example: www.bigcompany.com. restrictions specified in [4]. Example: www.bigcompany.com.
Conditions matching IPv4AddrValues evaluate to true according to the Conditions matching IPv4AddrValues evaluate to true according to the
generic matching rules. Additionally, a hostname is matched against generic matching rules. Additionally, a hostname is matched against
another valid IPv4address representation by resolving the hostname into another valid IPv4address representation by resolving the hostname into
an IPv4 address first, and then comparing the addresses afterwards. an IPv4 address first, and then comparing the addresses afterwards.
Matching hostnames against each other is done using a string comparison Matching hostnames against each other is done using a string comparison
of the two names. of the two names.
The property definition is as follows: The property definition is as follows:
NAME IPv4AddrList NAME IPv4AddrList
SYNTAX String SYNTAX String
FORMAT IPv4address | IPv4prefix | IPv4range | FORMAT IPv4address | IPv4prefix | IPv4range |
IPv4maskedaddress | hostname IPv4maskedaddress | hostname
5.14.2. The Class "PolicyIPv6AddrValue 6.14.2. The Class "PolicyIPv6AddrValue
This class is used to define a list of IPv6 addresses, hostnames, and This class is used to define a list of IPv6 addresses, hostnames, and
address range values. The class definition is as follows: address range values. The class definition is as follows:
NAME PolicyIPv6AddrValue NAME PolicyIPv6AddrValue
DERIVED FROM PolicyValue DERIVED FROM PolicyValue
ABSTRACT False ABSTRACT False
PROPERTIES IPv6AddrList[ ] PROPERTIES IPv6AddrList[ ]
The property IPv6AddrList provides an unordered list of strings, each The property IPv6AddrList provides an unordered list of strings, each
specifying an IPv6 address, a hostname, or a range of IPv6 addresses. specifying an IPv6 address, a hostname, or a range of IPv6 addresses.
IPv6 address format definition uses the standard address format defined IPv6 address format definition uses the standard address format defined
in [10]. The ABNF definition [8] as specified in [10] is: in [7]. The ABNF definition [6] as specified in [7] is:
IPv6address = hexpart [ ":" IPv4address ] IPv6address = hexpart [ ":" IPv4address ]
IPv4address = 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT IPv4address = 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT "." 1*3DIGIT
IPv6prefix = hexpart "/" 1*2DIGIT IPv6prefix = hexpart "/" 1*2DIGIT
hexpart = hexseq | hexseq "::" [ hexseq ] | "::" [ hexseq ] hexpart = hexseq | hexseq "::" [ hexseq ] | "::" [ hexseq ]
hexseq = hex4 *( ":" hex4) hexseq = hex4 *( ":" hex4)
hex4 = 1*4HEXDIG hex4 = 1*4HEXDIG
IPv6range = IPv6address"-"IPv6address IPv6range = IPv6address"-"IPv6address
IPv6maskedaddress = IPv6address","IPv6address IPv6maskedaddress = IPv6address","IPv6address
Hostname (as defines in [NAMES]) Hostname (as defines in [NAMES])
Each string entry is either: Each string entry is either:
1. A single IPv6address as defined above. 1. A single IPv6address as defined above.
2. A single Hostname. Hostname format follows guidelines and 2. A single Hostname. Hostname format follows guidelines and
restrictions specified in [9]. restrictions specified in [4].
3. An IPv6range address range, specified by a starting address in dot 3. An IPv6range address range, specified by a starting address in dot
notation and an ending address in dot notation, separated by "-". notation and an ending address in dot notation, separated by "-".
The range includes all addresses between the range's starting and The range includes all addresses between the range's starting and
ending addresses, including these two addresses. ending addresses, including these two addresses.
4. An IPv4maskedaddress address range defined above specified by an 4. An IPv4maskedaddress address range defined above specified by an
address and mask. The address and mask are represented in dot address and mask. The address and mask are represented in dot
notation separated by a comma ",". notation separated by a comma ",".
5. A single IPv6prefix as defined above. 5. A single IPv6prefix as defined above.
Conditions matching IPv6AddrValues evaluate to true according to the Conditions matching IPv6AddrValues evaluate to true according to the
generic matching rules. Additionally, a hostname is matched against generic matching rules. Additionally, a hostname is matched against
another valid IPv6address representation by resolving the hostname into another valid IPv6address representation by resolving the hostname into
an IPv6 address first, and then comparing the addresses afterwards. an IPv6 address first, and then comparing the addresses afterwards.
Matching hostnames against each other is done using a string comparison Matching hostnames against each other is done using a string comparison
of the two names. of the two names.
5.14.3. The Class "PolicyMACAddrValue" 6.14.3. The Class "PolicyMACAddrValue"
This class is used to define a list of MAC addresses and MAC address This class is used to define a list of MAC addresses and MAC address
range values. The class definition is as follows: range values. The class definition is as follows:
NAME PolicyMACAddrValue NAME PolicyMACAddrValue
DERIVED FROM PolicyValue DERIVED FROM PolicyValue
ABSTRACT False ABSTRACT False
PROPERTIES MACAddrList[ ] PROPERTIES MACAddrList[ ]
The property MACAddrList provides an unordered list of strings, each The property MACAddrList provides an unordered list of strings, each
specifying a MAC address or a range of MAC addresses. The 802 MAC specifying a MAC address or a range of MAC addresses. The 802 MAC
address canonical format is used. The ABNF definition [8] is: address canonical format is used. The ABNF definition [6] is:
MACaddress = 1*4HEXDIG ":" 1*4HEXDIG ":" 1*4HEXDIG MACaddress = 1*4HEXDIG ":" 1*4HEXDIG ":" 1*4HEXDIG
MACmaskedaddress = MACaddress","MACaddress MACmaskedaddress = MACaddress","MACaddress
Each string entry is either: Each string entry is either:
1. A single MAC address. Example: 0000:00A5:0000 1. A single MAC address. Example: 0000:00A5:0000
2. A MACmaskedaddress address range defined specified by an address 2. A MACmaskedaddress address range defined specified by an address
and mask. The mask specifies the relevant bits in the address. and mask. The mask specifies the relevant bits in the address.
Example: 0000:00A5:0000,FFFF:FFFF:0000 defines a range of MAC Example: 0000:00A5:0000,FFFF:FFFF:0000 defines a range of MAC
addresses in which the first four octets are equal to 0000:00A5. addresses in which the first four octets are equal to 0000:00A5.
The property definition is as follows: The property definition is as follows:
skipping to change at page 57, line 26 skipping to change at page 58, line 19
and mask. The mask specifies the relevant bits in the address. and mask. The mask specifies the relevant bits in the address.
Example: 0000:00A5:0000,FFFF:FFFF:0000 defines a range of MAC Example: 0000:00A5:0000,FFFF:FFFF:0000 defines a range of MAC
addresses in which the first four octets are equal to 0000:00A5. addresses in which the first four octets are equal to 0000:00A5.
The property definition is as follows: The property definition is as follows:
NAME MACAddrList NAME MACAddrList
SYNTAX String SYNTAX String
FORMAT MACaddress | MACmaskedaddress FORMAT MACaddress | MACmaskedaddress
5.14.4. The Class "PolicyStringValue" 6.14.4. The Class "PolicyStringValue"
This class is used to represent a single string value, or a set of string This class is used to represent a single string value, or a set of string
values. Each value can have wildcards. The class definition is as values. Each value can have wildcards. The class definition is as
follows: follows:
NAME PolicyStringValue NAME PolicyStringValue
DERIVED FROM PolicyValue DERIVED FROM PolicyValue
ABSTRACT False ABSTRACT False
PROPERTIES StringList[ ] PROPERTIES StringList[ ]
The property StringList provides an unordered list of strings, each The property StringList provides an unordered list of strings, each
representing a single string with wildcards. The asterisk character "*" representing a single string with wildcards. The asterisk character "*"
is used as a wildcard, and represents an arbitrary substring replacement. is used as a wildcard, and represents an arbitrary substring replacement.
For example, the value "abc*def" matches the string "abcxyzdef", and the For example, the value "abc*def" matches the string "abcxyzdef", and the
value "abc*def*" matches the string "abcxxxdefyyyzzz". The syntax value "abc*def*" matches the string "abcxxxdefyyyzzz". The syntax
definition is identical to the substring assertion syntax defined in definition is identical to the substring assertion syntax defined in [5].
[11]. If the asterisk character is required as part of the string value If the asterisk character is required as part of the string value itself,
itself, it MUST be quoted as described in section 4.3 of [11]. it MUST be quoted as described in Section 4.3 of [5].
The property definition is as follows: The property definition is as follows:
NAME StringList NAME StringList
SYNTAX String SYNTAX String
5.14.5. The Class "PolicyBitStringValue" 6.14.5. The Class "PolicyBitStringValue"
This class is used to represent a single bit string value, or a set of This class is used to represent a single bit string value, or a set of
bit string values. The class definition is as follows: bit string values. The class definition is as follows:
NAME PolicyBitStringValue NAME PolicyBitStringValue
DERIVED FROM PolicyValue DERIVED FROM PolicyValue
ABSTRACT False ABSTRACT False
PROPERTIES BitStringList[ ] PROPERTIES BitStringList[ ]
The property BitStringList provides an unordered list of strings, each The property BitStringList provides an unordered list of strings, each
skipping to change at page 58, line 39 skipping to change at page 59, line 31
the bit string value. For example, 110110, 100110 and 110111 the bit string value. For example, 110110, 100110 and 110111
would match the maskedBitString 100110,101110 but 100100 would would match the maskedBitString 100110,101110 but 100100 would
not. not.
The property definition is as follows: The property definition is as follows:
NAME BitStringList NAME BitStringList
SYNTAX String SYNTAX String
FORMAT bitString | maskedBitString FORMAT bitString | maskedBitString
5.14.6. The Class "PolicyIntegerValue" 6.14.6. The Class "PolicyIntegerValue"
This class provides a list of integer and integer range values. Integers This class provides a list of integer and integer range values. Integers
of arbitrary sizes can be represented. The class definition is as of arbitrary sizes can be represented. The class definition is as
follows: follows:
NAME PolicyIntegerValue NAME PolicyIntegerValue
DERIVED FROM PolicyValue DERIVED FROM PolicyValue
ABSTRACT False ABSTRACT False
PROPERTIES IntegerList[ ] PROPERTIES IntegerList[ ]
skipping to change at page 59, line 16 skipping to change at page 60, line 7
and an ending integer, separated by '..'. The starting integer and an ending integer, separated by '..'. The starting integer
MUST be less than or equal to the ending integer. The range MUST be less than or equal to the ending integer. The range
includes all integers between the starting and ending integers, includes all integers between the starting and ending integers,
including these two integers. including these two integers.
To represent a range of integers that is not bounded, the reserved words To represent a range of integers that is not bounded, the reserved words
-INFINITY and/or INFINITY can be used in place of the starting and ending -INFINITY and/or INFINITY can be used in place of the starting and ending
integers. In addition to ordinary integer matches, INFINITY matches integers. In addition to ordinary integer matches, INFINITY matches
INFINITY and -INFINITY matches -INFINITY. INFINITY and -INFINITY matches -INFINITY.
The ABNF definition [8] is: The ABNF definition [6] is:
integer = [-]1*DIGIT | "INFINITY" | "-INFINITY" integer = [-]1*DIGIT | "INFINITY" | "-INFINITY"
integerrange = integer".."integer integerrange = integer".."integer
Using ranges, the operators greater-than, greater-than-or-equal-to, less- Using ranges, the operators greater-than, greater-than-or-equal-to, less-
than, and less-than-or-equal-to can be expressed. For example, "X is- than, and less-than-or-equal-to can be expressed. For example, "X is-
greater-than 5" (where X is an integer) can be translated to "X matches greater-than 5" (where X is an integer) can be translated to "X matches
6-INFINITY". This enables the match condition semantics of the operator 6-INFINITY". This enables the match condition semantics of the operator
for the SimplePolicyCondition class to be kept simple (i.e., just the for the SimplePolicyCondition class to be kept simple (i.e., just the
value "match"). value "match").
The property definition is as follows: The property definition is as follows:
NAME IntegerList NAME IntegerList
SYNTAX String SYNTAX String
FORMAT integer | integerrange FORMAT integer | integerrange
5.14.7. The Class "PolicyBooleanValue" 6.14.7. The Class "PolicyBooleanValue"
This class is used to represent a Boolean (TRUE/FALSE) value. The class This class is used to represent a Boolean (TRUE/FALSE) value. The class
definition is as follows: definition is as follows:
NAME PolicyBooleanValue NAME PolicyBooleanValue
DERIVED FROM PolicyValue DERIVED FROM PolicyValue
ABSTRACT False ABSTRACT False
PROPERTIES BooleanValue PROPERTIES BooleanValue
The property definition is as follows: The property definition is as follows:
NAME BooleanValue NAME BooleanValue
SYNTAX boolean SYNTAX boolean
5.15. The Class "PolicyRoleCollection" 6.15. The Class "PolicyRoleCollection"
This class represents a collection of managed elements that share a This class represents a collection of managed elements that share a
common role. The PolicyRoleCollection always exists in the context of a common role. The PolicyRoleCollection always exists in the context of a
system, specified using the PolicyRoleCollectionInSystem association. system, specified using the PolicyRoleCollectionInSystem association.
The value of the PolicyRole property in this class specifies the role, The value of the PolicyRole property in this class specifies the role,
and can be matched with the value(s) in the PolicyRoles array in and can be matched with the value(s) in the PolicyRoles array in
PolicyRules and PolicyGroups. ManagedElements that share the role PolicyRules and PolicyGroups. ManagedElements that share the role
defined in this collection are aggregated into the collection via the defined in this collection are aggregated into the collection via the
association ElementInPolicyRoleCollection. association ElementInPolicyRoleCollection.
NAME PolicyRoleCollection NAME PolicyRoleCollection
DESCRIPTION A subclass of the CIM Collection class used to group DESCRIPTION A subclass of the CIM Collection class used to group
together managed elements that share a role. together managed elements that share a role.
DERIVED FROM Collection DERIVED FROM Collection
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES PolicyRole PROPERTIES PolicyRole
5.15.1. The Single-Valued Property "PolicyRole" 6.15.1. The Single-Valued Property "PolicyRole"
This property represents the role associated with a PolicyRoleCollection. This property represents the role associated with a PolicyRoleCollection.
The property definition is as follows: The property definition is as follows:
NAME PolicyRole NAME PolicyRole
DESCRIPTION A string representing the role associated with a DESCRIPTION A string representing the role associated with a
PolicyRoleCollection. PolicyRoleCollection.
SYNTAX string SYNTAX string
5.16. The Class "ReusablePolicyContainer" 6.16. The Class "ReusablePolicyContainer"
The new class ReusablePolicyContainer is defined as follows: The new class ReusablePolicyContainer is defined as follows:
NAME ReusablePolicyContainer NAME ReusablePolicyContainer
DESCRIPTION A class representing an administratively defined DESCRIPTION A class representing an administratively defined
container for reusable policy-related information. container for reusable policy-related information.
This class does not introduce any additional This class does not introduce any additional
properties beyond those in its superclass AdminDomain. properties beyond those in its superclass AdminDomain.
It does, however, participate in a number of unique It does, however, participate in a number of unique
associations. associations.
DERIVED FROM AdminDomain DERIVED FROM AdminDomain
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.17. Deprecate PCIM's Class "PolicyRepository" 6.17. Deprecate PCIM's Class "PolicyRepository"
The class definition of PolicyRepository (from PCIM) is updated as The class definition of PolicyRepository (from PCIM) is updated as
follows, with an indication that the class has been deprecated. Note follows, with an indication that the class has been deprecated. Note
that when an element of the model is deprecated, its replacement element that when an element of the model is deprecated, its replacement element
is identified explicitly. is identified explicitly.
NAME PolicyRepository NAME PolicyRepository
DEPRECATED FOR ReusablePolicyContainer DEPRECATED FOR ReusablePolicyContainer
DESCRIPTION A class representing an administratively defined DESCRIPTION A class representing an administratively defined
container for reusable policy-related information. container for reusable policy-related information.
This class does not introduce any additional This class does not introduce any additional
properties beyond those in its superclass AdminDomain. properties beyond those in its superclass AdminDomain.
It does, however, participate in a number of unique It does, however, participate in a number of unique
associations. associations.
DERIVED FROM AdminDomain DERIVED FROM AdminDomain
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES (none) PROPERTIES (none)
5.18. The Abstract Class "FilterEntryBase" 6.18. The Abstract Class "FilterEntryBase"
FilterEntryBase is the abstract base class from which all filter entry FilterEntryBase is the abstract base class from which all filter entry
classes are derived. It serves as the endpoint for the classes are derived. It serves as the endpoint for the
EntriesInFilterList aggregation, which groups filter entries into filter EntriesInFilterList aggregation, which groups filter entries into filter
lists. Its properties include CIM naming attributes and an IsNegated lists. Its properties include CIM naming attributes and an IsNegated
boolean property (to easily "NOT" the match information specified in an boolean property (to easily "NOT" the match information specified in an
instance of one of its subclasses). instance of one of its subclasses).
The class definition is as follows: The class definition is as follows:
NAME FilterEntryBase NAME FilterEntryBase
DESCRIPTION An abstract class representing a single DESCRIPTION An abstract class representing a single
filter that is aggregated into a filter that is aggregated into a
FilterList via the aggregation FilterList via the aggregation
EntriesInFilterList. EntriesInFilterList.
DERIVED FROM LogicalElement DERIVED FROM LogicalElement
TYPE Abstract TYPE Abstract
PROPERTIES IsNegated PROPERTIES IsNegated
5.19. The Class "IpHeadersFilter" 6.19. The Class "IpHeadersFilter"
This concrete class contains the most commonly required properties for This concrete class contains the most commonly required properties for
performing filtering on IP, TCP or UDP headers. Properties not present performing filtering on IP, TCP or UDP headers. Properties not present
in an instance of IPHeadersFilter are treated as 'all values'. A in an instance of IPHeadersFilter are treated as 'all values'. A
property HdrIpVersion identifies whether the IP addresses in an instance property HdrIpVersion identifies whether the IP addresses in an instance
are IPv4 or IPv6 addresses. Since the source and destination IP are IPv4 or IPv6 addresses. Since the source and destination IP
addresses come from the same packet header, they will always be of the addresses come from the same packet header, they will always be of the
same type. same type.
The class definition is as follows: The class definition is as follows:
skipping to change at page 61, line 51 skipping to change at page 62, line 43
DERIVED FROM FilterEntryBase DERIVED FROM FilterEntryBase
TYPE Concrete TYPE Concrete
PROPERTIES HdrIpVersion, HdrSrcAddress, PROPERTIES HdrIpVersion, HdrSrcAddress,
HdrSrcAddressEndOfRange, HdrSrcMask, HdrSrcAddressEndOfRange, HdrSrcMask,
HdrDestAddress, HdrDestAddressEndOfRange, HdrDestAddress, HdrDestAddressEndOfRange,
HdrDestMask, HdrProtocolID, HdrDestMask, HdrProtocolID,
HdrSrcPortStart, HdrSrcPortEnd, HdrSrcPortStart, HdrSrcPortEnd,
HdrDestPortStart, HdrDestPortEnd, HdrDSCP[ ], HdrDestPortStart, HdrDestPortEnd, HdrDSCP[ ],
HdrFlowLabel HdrFlowLabel
5.19.1. The Property HdrIpVersion 6.19.1. The Property HdrIpVersion
This property is an 8-bit unsigned integer, identifying the version of This property is an 8-bit unsigned integer, identifying the version of
the IP addresses to be filtered on. IP versions are identified as they the IP addresses to be filtered on. IP versions are identified as they
are in the Version field of the IP packet header - IPv4 = 4, IPv6 = 6. are in the Version field of the IP packet header - IPv4 = 4, IPv6 = 6.
These two values are the only ones defined for this property. These two values are the only ones defined for this property.
The value of this property determines the sizes of the OctetStrings in The value of this property determines the sizes of the OctetStrings in
the six properties HdrSrcAddress, HdrSrcAddressEndOfRange, HdrSrcMask, the six properties HdrSrcAddress, HdrSrcAddressEndOfRange, HdrSrcMask,
HdrDestAddress, HdrDestAddressEndOfRange, and HdrDestMask, as follows: HdrDestAddress, HdrDestAddressEndOfRange, and HdrDestMask, as follows:
o IPv4: OctetString(SIZE (4)) o IPv4: OctetString(SIZE (4))
o IPv6: OctetString(SIZE (16|20)), depending on whether a scope o IPv6: OctetString(SIZE (16|20)), depending on whether a scope
identifier is present identifier is present
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider IP version in selecting matching packets, i.e., IP version consider IP version in selecting matching packets, i.e., IP version
matches for all values. In this case, the HdrSrcAddress, matches for all values. In this case, the HdrSrcAddress,
HdrSrcAddressEndOfRange, HdrSrcMask, HdrDestAddress, HdrSrcAddressEndOfRange, HdrSrcMask, HdrDestAddress,
HdrDestAddressEndOfRange, and HdrDestMask must also not be present. HdrDestAddressEndOfRange, and HdrDestMask must also not be present.
5.19.2. The Property HdrSrcAddress 6.19.2. The Property HdrSrcAddress
This property is an OctetString, of a size determined by the value of the This property is an OctetString, of a size determined by the value of the
HdrIpVersion property, representing a source IP address. When there is HdrIpVersion property, representing a source IP address. When there is
no HdrSrcAddressEndOfRange value, this value is compared to the source no HdrSrcAddressEndOfRange value, this value is compared to the source
address in the IP header, subject to the mask represented in the address in the IP header, subject to the mask represented in the
HdrSrcMask property. (Note that the mask is ANDed with the address.) HdrSrcMask property. (Note that the mask is ANDed with the address.)
When there is a HdrSrcAddressEndOfRange value, this value is the start of When there is a HdrSrcAddressEndOfRange value, this value is the start of
the specified range (i.e., the HdrSrcAddress is lower than the the specified range (i.e., the HdrSrcAddress is lower than the
HdrSrcAddressEndOfRange) that is compared to the source address in the IP HdrSrcAddressEndOfRange) that is compared to the source address in the IP
header and matches on any value in the range. header and matches on any value in the range.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrSrcAddress in selecting matching packets, i.e., HdrSrcAddress consider HdrSrcAddress in selecting matching packets, i.e., HdrSrcAddress
matches for all values. matches for all values.
5.19.3. The Property HdrSrcAddressEndOfRange 6.19.3. The Property HdrSrcAddressEndOfRange
This property is an OctetString, of a size determined by the value of the This property is an OctetString, of a size determined by the value of the
HdrIpVersion property, representing the end of a range of source IP HdrIpVersion property, representing the end of a range of source IP
addresses (inclusive), where the start of the range is the HdrSrcAddress addresses (inclusive), where the start of the range is the HdrSrcAddress
property value. property value.
If a value for HdrSrcAddress is not provided, then this property also If a value for HdrSrcAddress is not provided, then this property also
MUST NOT be provided. If a value for this property is provided, then MUST NOT be provided. If a value for this property is provided, then
HdrSrcMask MUST NOT be provided. HdrSrcMask MUST NOT be provided.
5.19.4. The Property HdrSrcMask 6.19.4. The Property HdrSrcMask
This property is an OctetString, of a size determined by the value of the This property is an OctetString, of a size determined by the value of the
HdrIpVersion property, representing a mask to be used in comparing the HdrIpVersion property, representing a mask to be used in comparing the
source address in the IP header with the value represented in the source address in the IP header with the value represented in the
HdrSrcAddress property. HdrSrcAddress property.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrSrcMask in selecting matching packets, i.e., the value of consider HdrSrcMask in selecting matching packets, i.e., the value of
HdrSrcAddress or the source address range must match the source address HdrSrcAddress or the source address range must match the source address
in the packet exactly. If a value for this property is provided, then in the packet exactly. If a value for this property is provided, then
HdrSrcAddressEndOfRange MUST NOT be provided. HdrSrcAddressEndOfRange MUST NOT be provided.
5.19.5. The Property HdrDestAddress 6.19.5. The Property HdrDestAddress
This property is an OctetString, of a size determined by the value of the This property is an OctetString, of a size determined by the value of the
HdrIpVersion property, representing a destination IP address. When there HdrIpVersion property, representing a destination IP address. When there
is no HdrDestAddressEndOfRange value, this value is compared to the is no HdrDestAddressEndOfRange value, this value is compared to the
destination address in the IP header, subject to the mask represented in destination address in the IP header, subject to the mask represented in
the HdrDestMask property. (Note that the mask is ANDed with the the HdrDestMask property. (Note that the mask is ANDed with the
address.) When there is a HdrDestAddressEndOfRange value, this value is address.) When there is a HdrDestAddressEndOfRange value, this value is
the start of the specified range (i.e., the HdrDestAddress is lower than the start of the specified range (i.e., the HdrDestAddress is lower than
the HdrDestAddressEndOfRange) that is compared to the destination address the HdrDestAddressEndOfRange) that is compared to the destination address
in the IP header and matches on any value in the range. in the IP header and matches on any value in the range.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrDestAddress in selecting matching packets, i.e., consider HdrDestAddress in selecting matching packets, i.e.,
HdrDestAddress matches for all values. HdrDestAddress matches for all values.
5.19.6. The Property HdrDestAddressEndOfRange 6.19.6. The Property HdrDestAddressEndOfRange
This property is an OctetString, of a size determined by the value of the This property is an OctetString, of a size determined by the value of the
HdrIpVersion property, representing the end of a range of destination IP HdrIpVersion property, representing the end of a range of destination IP
addresses (inclusive), where the start of the range is the HdrDestAddress addresses (inclusive), where the start of the range is the HdrDestAddress
property value. property value.
If a value for HdrDestAddress is not provided, then this property also If a value for HdrDestAddress is not provided, then this property also
MUST NOT be provided. If a value for this property is provided, then MUST NOT be provided. If a value for this property is provided, then
HdrDestMask MUST NOT be provided. HdrDestMask MUST NOT be provided.
5.19.7. The Property HdrDestMask 6.19.7. The Property HdrDestMask
This property is an OctetString, of a size determined by the value of the This property is an OctetString, of a size determined by the value of the
HdrIpVersion property, representing a mask to be used in comparing the HdrIpVersion property, representing a mask to be used in comparing the
destination address in the IP header with the value represented in the destination address in the IP header with the value represented in the
HdrDestAddress property. HdrDestAddress property.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrDestMask in selecting matching packets, i.e., the value of consider HdrDestMask in selecting matching packets, i.e., the value of
HdrDestAddress or the destination address range must match the HdrDestAddress or the destination address range must match the
destination address in the packet exactly. If a value for this property destination address in the packet exactly. If a value for this property
is provided, then HdrDestAddressEndOfRange MUST NOT be provided. is provided, then HdrDestAddressEndOfRange MUST NOT be provided.
5.19.8. The Property HdrProtocolID 6.19.8. The Property HdrProtocolID
This property is an 8-bit unsigned integer, representing an IP protocol This property is an 8-bit unsigned integer, representing an IP protocol
type. This value is compared to the Protocol field in the IP header. type. This value is compared to the Protocol field in the IP header.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrProtocolID in selecting matching packets, i.e., HdrProtocolID consider HdrProtocolID in selecting matching packets, i.e., HdrProtocolID
matches for all values. matches for all values.
5.19.9. The Property HdrSrcPortStart 6.19.9. The Property HdrSrcPortStart
This property is a 16-bit unsigned integer, representing the lower end of This property is a 16-bit unsigned integer, representing the lower end of
a range of UDP or TCP source ports. The upper end of the range is a range of UDP or TCP source ports. The upper end of the range is
represented by the HdrSrcPortEnd property. The value of HdrSrcPortStart represented by the HdrSrcPortEnd property. The value of HdrSrcPortStart
MUST be no greater than the value of HdrSrcPortEnd. A single port is MUST be no greater than the value of HdrSrcPortEnd. A single port is
indicated by equal values for HdrSrcPortStart and HdrSrcPortEnd. indicated by equal values for HdrSrcPortStart and HdrSrcPortEnd.
A source port filter is evaluated by testing whether the source port A source port filter is evaluated by testing whether the source port
identified in the IP header falls within the range of values between identified in the IP header falls within the range of values between
HdrSrcPortStart and HdrSrcPortEnd, including these two end points. HdrSrcPortStart and HdrSrcPortEnd, including these two end points.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrSrcPortStart in selecting matching packets, i.e., there is no consider HdrSrcPortStart in selecting matching packets, i.e., there is no
lower bound in matching source port values. lower bound in matching source port values.
5.19.10. The Property HdrSrcPortEnd 6.19.10. The Property HdrSrcPortEnd
This property is a 16-bit unsigned integer, representing the upper end of This property is a 16-bit unsigned integer, representing the upper end of
a range of UDP or TCP source ports. The lower end of the range is a range of UDP or TCP source ports. The lower end of the range is
represented by the HdrSrcPortStart property. The value of HdrSrcPortEnd represented by the HdrSrcPortStart property. The value of HdrSrcPortEnd
MUST be no less than the value of HdrSrcPortStart. A single port is MUST be no less than the value of HdrSrcPortStart. A single port is
indicated by equal values for HdrSrcPortStart and HdrSrcPortEnd. indicated by equal values for HdrSrcPortStart and HdrSrcPortEnd.
A source port filter is evaluated by testing whether the source port A source port filter is evaluated by testing whether the source port
identified in the IP header falls within the range of values between identified in the IP header falls within the range of values between
HdrSrcPortStart and HdrSrcPortEnd, including these two end points. HdrSrcPortStart and HdrSrcPortEnd, including these two end points.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrSrcPortEnd in selecting matching packets, i.e., there is no consider HdrSrcPortEnd in selecting matching packets, i.e., there is no
upper bound in matching source port values. upper bound in matching source port values.
5.19.11. The Property HdrDestPortStart 6.19.11. The Property HdrDestPortStart
This property is a 16-bit unsigned integer, representing the lower end of This property is a 16-bit unsigned integer, representing the lower end of
a range of UDP or TCP destination ports. The upper end of the range is a range of UDP or TCP destination ports. The upper end of the range is
represented by the HdrDestPortEnd property. The value of represented by the HdrDestPortEnd property. The value of
HdrDestPortStart MUST be no greater than the value of HdrDestPortEnd. A HdrDestPortStart MUST be no greater than the value of HdrDestPortEnd. A
single port is indicated by equal values for HdrDestPortStart and single port is indicated by equal values for HdrDestPortStart and
HdrDestPortEnd. HdrDestPortEnd.
A destination port filter is evaluated by testing whether the destination A destination port filter is evaluated by testing whether the destination
port identified in the IP header falls within the range of values between port identified in the IP header falls within the range of values between
HdrDestPortStart and HdrDestPortEnd, including these two end points. HdrDestPortStart and HdrDestPortEnd, including these two end points.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrDestPortStart in selecting matching packets, i.e., there is consider HdrDestPortStart in selecting matching packets, i.e., there is
no lower bound in matching destination port values. no lower bound in matching destination port values.
5.19.12. The Property HdrDestPortEnd 6.19.12. The Property HdrDestPortEnd
This property is a 16-bit unsigned integer, representing the upper end of This property is a 16-bit unsigned integer, representing the upper end of
a range of UDP or TCP destination ports. The lower end of the range is a range of UDP or TCP destination ports. The lower end of the range is
represented by the HdrDestPortStart property. The value of represented by the HdrDestPortStart property. The value of
HdrDestPortEnd MUST be no less than the value of HdrDestPortStart. A HdrDestPortEnd MUST be no less than the value of HdrDestPortStart. A
single port is indicated by equal values for HdrDestPortStart and single port is indicated by equal values for HdrDestPortStart and
HdrDestPortEnd. HdrDestPortEnd.
A destination port filter is evaluated by testing whether the destination A destination port filter is evaluated by testing whether the destination
port identified in the IP header falls within the range of values between port identified in the IP header falls within the range of values between
HdrDestPortStart and HdrDestPortEnd, including these two end points. HdrDestPortStart and HdrDestPortEnd, including these two end points.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrDestPortEnd in selecting matching packets, i.e., there is no consider HdrDestPortEnd in selecting matching packets, i.e., there is no
upper bound in matching destination port values. upper bound in matching destination port values.
5.19.13. The Property HdrDSCP 6.19.13. The Property HdrDSCP
The property HdrDSCP is defined as an array of uint8's, restricted to the The property HdrDSCP is defined as an array of uint8's, restricted to the
range 0..63. Since DSCPs are defined as discrete code points, with no range 0..63. Since DSCPs are defined as discrete code points, with no
inherent structure, there is no semantically significant relationship inherent structure, there is no semantically significant relationship
between different DSCPs. Consequently, there is no provision for between different DSCPs. Consequently, there is no provision for
specifying a range of DSCPs in this property. However, a list of specifying a range of DSCPs in this property. However, a list of
individual DSCPs, which are ORed together to form a filter, is supported individual DSCPs, which are ORed together to form a filter, is supported
by the array syntax. by the array syntax.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrDSCP in selecting matching packets, i.e., HdrDSCP matches for consider HdrDSCP in selecting matching packets, i.e., HdrDSCP matches for
all values. all values.
5.19.14. The Property HdrFlowLabel 6.19.14. The Property HdrFlowLabel
The 20-bit Flow Label field in the IPv6 header may be used by a source to The 20-bit Flow Label field in the IPv6 header may be used by a source to
label sequences of packets for which it requests special handling by IPv6 label sequences of packets for which it requests special handling by IPv6
devices, such as non-default quality of service or 'real-time' service. devices, such as non-default quality of service or 'real-time' service.
This property is an octet string of size 3 (that is, 24 bits), in which This property is an octet string of size 3 (that is, 24 bits), in which
the 20-bit Flow Label appears in the rightmost 20 bits, padded on the the 20-bit Flow Label appears in the rightmost 20 bits, padded on the
left with b'0000'. left with b'0000'.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider HdrFlowLabel in selecting matching packets, i.e., HdrFlowLabel consider HdrFlowLabel in selecting matching packets, i.e., HdrFlowLabel
matches for all values. matches for all values.
5.20. The Class "8021Filter" 6.20. The Class "8021Filter"
This concrete class allows 802.1.source and destination MAC addresses, as This concrete class allows 802.1.source and destination MAC addresses, as
well as the 802.1 protocol ID, priority, and VLAN identifier fields, to well as the 802.1 protocol ID, priority, and VLAN identifier fields, to
be expressed in a single object be expressed in a single object
The class definition is as follows: The class definition is as follows:
NAME 8021Filter NAME 8021Filter
DESCRIPTION A class that allows 802.1 source DESCRIPTION A class that allows 802.1 source
and destination MAC address and and destination MAC address and
protocol ID, priority, and VLAN protocol ID, priority, and VLAN
identifier filters to be identifier filters to be
expressed in a single object. expressed in a single object.
DERIVED FROM FilterEntryBase DERIVED FROM FilterEntryBase
TYPE Concrete TYPE Concrete
PROPERTIES 8021HdrSrcMACAddr, 8021HdrSrcMACMask, PROPERTIES 8021HdrSrcMACAddr, 8021HdrSrcMACMask,
8021HdrDestMACAddr, 8021HdrDestMACMask, 8021HdrDestMACAddr, 8021HdrDestMACMask,
8021HdrProtocolID, 8021HdrPriorityValue, 8021HdrProtocolID, 8021HdrPriorityValue,
8021HDRVLANID 8021HDRVLANID
5.20.1. The Property 8021HdrSrcMACAddr 6.20.1. The Property 8021HdrSrcMACAddr
This property is an OctetString of size 6, representing a 48-bit source This property is an OctetString of size 6, representing a 48-bit source
MAC address in canonical format. This value is compared to the MAC address in canonical format. This value is compared to the
SourceAddress field in the MAC header, subject to the mask represented in SourceAddress field in the MAC header, subject to the mask represented in
the 8021HdrSrcMACMask property. the 8021HdrSrcMACMask property.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider 8021HdrSrcMACAddr in selecting matching packets, i.e., consider 8021HdrSrcMACAddr in selecting matching packets, i.e.,
8021HdrSrcMACAddr matches for all values. 8021HdrSrcMACAddr matches for all values.
5.20.2. The Property 8021HdrSrcMACMask 6.20.2. The Property 8021HdrSrcMACMask
This property is an OctetString of size 6, representing a 48-bit mask to This property is an OctetString of size 6, representing a 48-bit mask to
be used in comparing the SourceAddress field in the MAC header with the be used in comparing the SourceAddress field in the MAC header with the
value represented in the 8021HdrSrcMACAddr property. value represented in the 8021HdrSrcMACAddr property.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider 8021HdrSrcMACMask in selecting matching packets, i.e., the value consider 8021HdrSrcMACMask in selecting matching packets, i.e., the value
of 8021HdrSrcMACAddr must match the source MAC address in the packet of 8021HdrSrcMACAddr must match the source MAC address in the packet
exactly. exactly.
5.20.3. The Property 8021HdrDestMACAddr 6.20.3. The Property 8021HdrDestMACAddr
This property is an OctetString of size 6, representing a 48-bit This property is an OctetString of size 6, representing a 48-bit
destination MAC address in canonical format. This value is compared to destination MAC address in canonical format. This value is compared to
the DestinationAddress field in the MAC header, subject to the mask the DestinationAddress field in the MAC header, subject to the mask
represented in the 8021HdrDestMACMask property. represented in the 8021HdrDestMACMask property.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider 8021HdrDestMACAddr in selecting matching packets, i.e., consider 8021HdrDestMACAddr in selecting matching packets, i.e.,
8021HdrDestMACAddr matches for all values. 8021HdrDestMACAddr matches for all values.
5.20.4. The Property 8021HdrDestMACMask 6.20.4. The Property 8021HdrDestMACMask
This property is an OctetString of size 6, representing a 48-bit mask to This property is an OctetString of size 6, representing a 48-bit mask to
be used in comparing the DestinationAddress field in the MAC header with be used in comparing the DestinationAddress field in the MAC header with
the value represented in the 8021HdrDestMACAddr property. the value represented in the 8021HdrDestMACAddr property.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider 8021HdrDestMACMask in selecting matching packets, i.e., the consider 8021HdrDestMACMask in selecting matching packets, i.e., the
value of 8021HdrDestMACAddr must match the destination MAC address in the value of 8021HdrDestMACAddr must match the destination MAC address in the
packet exactly. packet exactly.
5.20.5. The Property 8021HdrProtocolID 6.20.5. The Property 8021HdrProtocolID
This property is a 16-bit unsigned integer, representing an Ethernet This property is a 16-bit unsigned integer, representing an Ethernet
protocol type. This value is compared to the Ethernet Type field in the protocol type. This value is compared to the Ethernet Type field in the
802.3 MAC header. 802.3 MAC header.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider 8021HdrProtocolID in selecting matching packets, i.e., consider 8021HdrProtocolID in selecting matching packets, i.e.,
8021HdrProtocolID matches for all values. 8021HdrProtocolID matches for all values.
5.20.6. The Property 8021HdrPriorityValue 6.20.6. The Property 8021HdrPriorityValue
This property is an 8-bit unsigned integer, representing an 802.1Q This property is an 8-bit unsigned integer, representing an 802.1Q
priority. This value is compared to the Priority field in the 802.1Q priority. This value is compared to the Priority field in the 802.1Q
header. Since the 802.1Q Priority field consists of 3 bits, the values header. Since the 802.1Q Priority field consists of 3 bits, the values
for this property are limited to the range 0..7. for this property are limited to the range 0..7.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider 8021HdrPriorityValue in selecting matching packets, i.e., consider 8021HdrPriorityValue in selecting matching packets, i.e.,
8021HdrPriorityValue matches for all values. 8021HdrPriorityValue matches for all values.
5.20.7. The Property 8021HdrVLANID 6.20.7. The Property 8021HdrVLANID
This property is a 32-bit unsigned integer, representing an 802.1Q VLAN This property is a 32-bit unsigned integer, representing an 802.1Q VLAN
Identifier. This value is compared to the VLAN ID field in the 802.1Q Identifier. This value is compared to the VLAN ID field in the 802.1Q
header. Since the 802.1Q VLAN ID field consists of 12 bits, the values header. Since the 802.1Q VLAN ID field consists of 12 bits, the values
for this property are limited to the range 0..4095. for this property are limited to the range 0..4095.
If a value for this property is not provided, then the filter does not If a value for this property is not provided, then the filter does not
consider 8021HdrVLANID in selecting matching packets, i.e., 8021HdrVLANID consider 8021HdrVLANID in selecting matching packets, i.e., 8021HdrVLANID
matches for all values. matches for all values.
5.21. The Class FilterList 6.21. The Class FilterList
This is a concrete class that aggregates instances of (subclasses of) This is a concrete class that aggregates instances of (subclasses of)
FilterEntryBase via the aggregation EntriesInFilterList. It is possible FilterEntryBase via the aggregation EntriesInFilterList. It is possible
to aggregate different types of filters into a single FilterList - for to aggregate different types of filters into a single FilterList - for
example, packet header filters (represented by the IpHeadersFilter class) example, packet header filters (represented by the IpHeadersFilter class)
and security filters (represented by subclasses of FilterEntryBase and security filters (represented by subclasses of FilterEntryBase
defined by IPsec). defined by IPsec).
The aggregation property EntriesInFilterList.EntrySequence serves to The aggregation property EntriesInFilterList.EntrySequence is always set
order the filter entries in a FilterList. This is necessary when to 0, to indicate that the aggregated filter entries are ANDed together
algorithms such as "Match First" are used to identify traffic based on an to form a selector for a class of traffic.
aggregated set of FilterEntries. In modeling QoS classifiers, however,
this property is always set to 0, to indicate that the aggregated filter
entries are ANDed together to form a selector for a class of traffic.
The class definition is as follows: The class definition is as follows:
NAME FilterList NAME FilterList
DESCRIPTION A concrete class representing DESCRIPTION A concrete class representing
the aggregation of multiple filters. the aggregation of multiple filters.
DERIVED FROM LogicalElement DERIVED FROM LogicalElement
TYPE Concrete TYPE Concrete
PROPERTIES Direction PROPERTIES Direction
5.21.1. The Property Direction 6.21.1. The Property Direction
This property is a 16-bit unsigned integer enumeration, representing the This property is a 16-bit unsigned integer enumeration, representing the
direction of the traffic flow to which the FilterList is to be applied. direction of the traffic flow to which the FilterList is to be applied.
Defined enumeration values are Defined enumeration values are
o NotApplicable(0) o NotApplicable(0)
o Input(1) o Input(1)
o Output(2) o Output(2)
o Both(3) - This value is used to indicate that the direction is o Both(3) - This value is used to indicate that the direction is
immaterial, e.g., to filter on a source subnet regardless of immaterial, e.g., to filter on a source subnet regardless of
skipping to change at page 68, line 41 skipping to change at page 69, line 39
The match conditions in the aggregated FilterEntryBase subclass The match conditions in the aggregated FilterEntryBase subclass
instances are defined from the perspective of outbound flows and instances are defined from the perspective of outbound flows and
applied to inbound flows as well by reversing the source and applied to inbound flows as well by reversing the source and
destination criteria. So, for example, consider a FilterList with destination criteria. So, for example, consider a FilterList with
3 filter entries indicating destination port = 80, and source and 3 filter entries indicating destination port = 80, and source and
destination addresses of a and b, respectively. Then, for the destination addresses of a and b, respectively. Then, for the
outbound direction, the filter entries match as specified and the outbound direction, the filter entries match as specified and the
'mirror' (for the inbound direction) matches on source port = 80 'mirror' (for the inbound direction) matches on source port = 80
and source and destination addresses of b and a, respectively. and source and destination addresses of b and a, respectively.
6. Association and Aggregation Definitions 7. Association and Aggregation Definitions
The following definitions supplement those in PCIM itself. PCIM The following definitions supplement those in PCIM itself. PCIM
definitions that are not DEPRECATED here are still current parts of the definitions that are not DEPRECATED here are still current parts of the
overall Policy Core Information Model. overall Policy Core Information Model.
6.1. The Aggregation "PolicySetComponent" 7.1. The Aggregation "PolicySetComponent"
PolicySetComponent is a new aggregation class that collects instances of PolicySetComponent is a new aggregation class that collects instances of
PolicySet subclasses (PolicyGroups and PolicyRules) into coherent sets of PolicySet subclasses (PolicyGroups and PolicyRules) into coherent sets of
policies. policies.
NAME PolicySetComponent NAME PolicySetComponent
DESCRIPTION A concrete class representing the components of a DESCRIPTION A concrete class representing the components of a
policy set that have the same decision strategy, and policy set that have the same decision strategy, and
are prioritized within the set. are prioritized within the set.
DERIVED FROM PolicyComponent DERIVED FROM PolicyComponent
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref PolicySet[0..n]] PROPERTIES GroupComponent[ref PolicySet[0..n]]
PartComponent[ref PolicySet[0..n]] PartComponent[ref PolicySet[0..n]]
Priority Priority
The definition of the Priority property is unchanged from its previous The definition of the Priority property is unchanged from its previous
definition in [PCIM]. definition in [PCIM].
NAME Priority NAME Priority
skipping to change at page 69, line 22 skipping to change at page 70, line 19
definition in [PCIM]. definition in [PCIM].
NAME Priority NAME Priority
DESCRIPTION A non-negative integer for prioritizing this PolicySet DESCRIPTION A non-negative integer for prioritizing this PolicySet
component relative to other components of the same component relative to other components of the same
PolicySet. A larger value indicates a higher PolicySet. A larger value indicates a higher
priority. priority.
SYNTAX uint16 SYNTAX uint16
DEFAULT VALUE 0 DEFAULT VALUE 0
6.2. Deprecate PCIM's Aggregation "PolicyGroupInPolicyGroup" 7.2. Deprecate PCIM's Aggregation "PolicyGroupInPolicyGroup"
The new aggregation PolicySetComponent is used directly to represent The new aggregation PolicySetComponent is used directly to represent
aggregation of PolicyGroups by a higher-level PolicyGroup. Thus the aggregation of PolicyGroups by a higher-level PolicyGroup. Thus the
aggregation PolicyGroupInPolicyGroup is no longer needed, and can be aggregation PolicyGroupInPolicyGroup is no longer needed, and can be
deprecated. deprecated.
NAME PolicyGroupInPolicyGroup NAME PolicyGroupInPolicyGroup
DEPRECATED FOR PolicySetComponent DEPRECATED FOR PolicySetComponent
DESCRIPTION A class representing the aggregation of PolicyGroups DESCRIPTION A class representing the aggregation of PolicyGroups
by a higher-level PolicyGroup. by a higher-level PolicyGroup.
DERIVED FROM PolicyComponent DERIVED FROM PolicyComponent
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref PolicyGroup[0..n]] PROPERTIES GroupComponent[ref PolicyGroup[0..n]]
PartComponent[ref PolicyGroup[0..n]] PartComponent[ref PolicyGroup[0..n]]
6.3. Deprecate PCIM's Aggregation "PolicyRuleInPolicyGroup" 7.3. Deprecate PCIM's Aggregation "PolicyRuleInPolicyGroup"
The new aggregation PolicySetComponent is used directly to represent The new aggregation PolicySetComponent is used directly to represent
aggregation of PolicyRules by a PolicyGroup. Thus the aggregation aggregation of PolicyRules by a PolicyGroup. Thus the aggregation
PolicyRuleInPolicyGroup is no longer needed, and can be deprecated. PolicyRuleInPolicyGroup is no longer needed, and can be deprecated.
NAME PolicyRuleInPolicyGroup NAME PolicyRuleInPolicyGroup
DEPRECATED FOR PolicySetComponent DEPRECATED FOR PolicySetComponent
DESCRIPTION A class representing the aggregation of PolicyRules by DESCRIPTION A class representing the aggregation of PolicyRules by
a PolicyGroup. a PolicyGroup.
DERIVED FROM PolicyComponent DERIVED FROM PolicyComponent
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref PolicyGroup[0..n]] PROPERTIES GroupComponent[ref PolicyGroup[0..n]]
PartComponent[ref PolicyRule[0..n]] PartComponent[ref PolicyRule[0..n]]
6.4. The Abstract Association "PolicySetInSystem" 7.4. The Abstract Association "PolicySetInSystem"
PolicySetInSystem is a new association that defines a relationship PolicySetInSystem is a new association that defines a relationship
between a System and a PolicySet used in the administrative scope of that between a System and a PolicySet used in the administrative scope of that
system (e.g., AdminDomain, ComputerSystem). The Priority property is system (e.g., AdminDomain, ComputerSystem). The Priority property is
used to assign a relative priority to a PolicySet within the used to assign a relative priority to a PolicySet within the
administrative scope in contexts where it is not a component of another administrative scope in contexts where it is not a component of another
PolicySet. PolicySet.
NAME PolicySetInSystem NAME PolicySetInSystem
DESCRIPTION An abstract class representing the relationship DESCRIPTION An abstract class representing the relationship
skipping to change at page 70, line 36 skipping to change at page 71, line 36
therefore, have no other relative priority defined. therefore, have no other relative priority defined.
NAME Priority NAME Priority
DESCRIPTION A non-negative integer for prioritizing the referenced DESCRIPTION A non-negative integer for prioritizing the referenced
PolicySet among other PolicySet instances that are not PolicySet among other PolicySet instances that are not
components of a common PolicySet. A larger value components of a common PolicySet. A larger value
indicates a higher priority. indicates a higher priority.
SYNTAX uint16 SYNTAX uint16
DEFAULT VALUE 0 DEFAULT VALUE 0
6.5. Update PCIM's Weak Association "PolicyGroupInSystem" 7.5. Update PCIM's Weak Association "PolicyGroupInSystem"
Regardless of whether it a component of another PolicySet, a PolicyGroup Regardless of whether it a component of another PolicySet, a PolicyGroup
is itself defined within the scope of a System. This association links a is itself defined within the scope of a System. This association links a
PolicyGroup to the System in whose scope the PolicyGroup is defined. It PolicyGroup to the System in whose scope the PolicyGroup is defined. It
is a subclass of the abstract PolicySetInSystem association. The class is a subclass of the abstract PolicySetInSystem association. The class
definition for the association is as follows: definition for the association is as follows:
NAME PolicyGroupInSystem NAME PolicyGroupInSystem
DESCRIPTION A class representing the fact that a PolicyGroup is DESCRIPTION A class representing the fact that a PolicyGroup is
defined within the scope of a System. defined within the scope of a System.
skipping to change at page 71, line 17 skipping to change at page 72, line 17
the scope of exactly one System. the scope of exactly one System.
The Reference "Dependent" is inherited from PolicySetInSystem, and The Reference "Dependent" is inherited from PolicySetInSystem, and
overridden to become an object reference to a PolicyGroup defined within overridden to become an object reference to a PolicyGroup defined within
the scope of a System. Note that for any single instance of the the scope of a System. Note that for any single instance of the
association class PolicyGroupInSystem, this property (like all reference association class PolicyGroupInSystem, this property (like all reference
properties) is single-valued. The [0..n] cardinality indicates that a properties) is single-valued. The [0..n] cardinality indicates that a
given System may have 0, 1, or more than one PolicyGroups defined within given System may have 0, 1, or more than one PolicyGroups defined within
its scope. its scope.
6.6. Update PCIM's Weak Association "PolicyRuleInSystem" 7.6. Update PCIM's Weak Association "PolicyRuleInSystem"
Regardless of whether it a component of another PolicySet, a PolicyRule Regardless of whether it a component of another PolicySet, a PolicyRule
is itself defined within the scope of a System. This association links a is itself defined within the scope of a System. This association links a
PolicyRule to the System in whose scope the PolicyRule is defined. It is PolicyRule to the System in whose scope the PolicyRule is defined. It is
a subclass of the abstract PolicySetInSystem association. The class a subclass of the abstract PolicySetInSystem association. The class
definition for the association is as follows: definition for the association is as follows:
NAME PolicyRuleInSystem NAME PolicyRuleInSystem
DESCRIPTION A class representing the fact that a PolicyRule is DESCRIPTION A class representing the fact that a PolicyRule is
defined within the scope of a System. defined within the scope of a System.
skipping to change at page 71, line 48 skipping to change at page 72, line 48
scope of exactly one System. scope of exactly one System.
The Reference "Dependent" is inherited from PolicySetInSystem, and The Reference "Dependent" is inherited from PolicySetInSystem, and
overridden to become an object reference to a PolicyRule defined within overridden to become an object reference to a PolicyRule defined within
the scope of a System. Note that for any single instance of the the scope of a System. Note that for any single instance of the
association class PolicyRuleInSystem, this property (like all Reference association class PolicyRuleInSystem, this property (like all Reference
properties) is single-valued. The [0..n] cardinality indicates that a properties) is single-valued. The [0..n] cardinality indicates that a
given System may have 0, 1, or more than one PolicyRules defined within given System may have 0, 1, or more than one PolicyRules defined within
its scope. its scope.
6.7. The Abstract Aggregation "PolicyConditionStructure" 7.7. The Abstract Aggregation "PolicyConditionStructure"
NAME PolicyConditionStructure NAME PolicyConditionStructure
DESCRIPTION A class representing the aggregation of DESCRIPTION A class representing the aggregation of
PolicyConditions by an aggregating instance. PolicyConditions by an aggregating instance.
DERIVED FROM PolicyComponent DERIVED FROM PolicyComponent
ABSTRACT TRUE ABSTRACT TRUE
PROPERTIES PartComponent[ref PolicyCondition[0..n]] PROPERTIES PartComponent[ref PolicyCondition[0..n]]
GroupNumber GroupNumber
ConditionNegated ConditionNegated
6.8. Update PCIM's Aggregation "PolicyConditionInPolicyRule" 7.8. Update PCIM's Aggregation "PolicyConditionInPolicyRule"
The PCIM aggregation "PolicyConditionInPolicyRule" is updated, to make it The PCIM aggregation "PolicyConditionInPolicyRule" is updated, to make it
a subclass of the new abstract aggregation PolicyConditionStructure. The a subclass of the new abstract aggregation PolicyConditionStructure. The
properties GroupNumber and ConditionNegated are now inherited, rather properties GroupNumber and ConditionNegated are now inherited, rather
than specified explicitly as they were in PCIM. than specified explicitly as they were in PCIM.
NAME PolicyConditionInPolicyRule NAME PolicyConditionInPolicyRule
DESCRIPTION A class representing the aggregation of DESCRIPTION A class representing the aggregation of
PolicyConditions by a PolicyRule. PolicyConditions by a PolicyRule.
DERIVED FROM PolicyConditionStructure DERIVED FROM PolicyConditionStructure
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref PolicyRule[0..n]] PROPERTIES GroupComponent[ref PolicyRule[0..n]]
6.9. The Aggregation "PolicyConditionInPolicyCondition" 7.9. The Aggregation "PolicyConditionInPolicyCondition"
A second subclass of PolicyConditionStructure is defined, representing A second subclass of PolicyConditionStructure is defined, representing
the compounding of policy conditions into a higher-level policy the compounding of policy conditions into a higher-level policy
condition. condition.
NAME PolicyConditionInPolicyCondition NAME PolicyConditionInPolicyCondition
DESCRIPTION A class representing the aggregation of DESCRIPTION A class representing the aggregation of
PolicyConditions by another PolicyCondition. PolicyConditions by another PolicyCondition.
DERIVED FROM PolicyConditionStructure DERIVED FROM PolicyConditionStructure
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref CompoundPolicyCondition[0..n]] PROPERTIES GroupComponent[ref CompoundPolicyCondition[0..n]]
6.10. The Abstract Aggregation "PolicyActionStructure" 7.10. The Abstract Aggregation "PolicyActionStructure"
NAME PolicyActionStructure NAME PolicyActionStructure
DESCRIPTION A class representing the aggregation of PolicyActions DESCRIPTION A class representing the aggregation of PolicyActions
by an aggregating instance. by an aggregating instance.
DERIVED FROM PolicyComponent DERIVED FROM PolicyComponent
ABSTRACT TRUE ABSTRACT TRUE
PROPERTIES PartComponent[ref PolicyAction[0..n]] PROPERTIES PartComponent[ref PolicyAction[0..n]]
ActionOrder ActionOrder
The definition of the ActionOrder property appears in Section 7.8.3 of The definition of the ActionOrder property appears in Section 7.8.3 of
PCIM [3]. PCIM [1].
6.11. Update PCIM's Aggregation "PolicyActionInPolicyRule" 7.11. Update PCIM's Aggregation "PolicyActionInPolicyRule"
The PCIM aggregation "PolicyActionInPolicyRule" is updated, to make it a The PCIM aggregation "PolicyActionInPolicyRule" is updated, to make it a
subclass of the new abstract aggregation PolicyActionStructure. The subclass of the new abstract aggregation PolicyActionStructure. The
property ActionOrder is now inherited, rather than specified explicitly property ActionOrder is now inherited, rather than specified explicitly
as it was in PCIM. as it was in PCIM.
NAME PolicyActionInPolicyRule NAME PolicyActionInPolicyRule
DESCRIPTION A class representing the aggregation of PolicyActions DESCRIPTION A class representing the aggregation of PolicyActions
by a PolicyRule. by a PolicyRule.
DERIVED FROM PolicyActionStructure DERIVED FROM PolicyActionStructure
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref PolicyRule[0..n]] PROPERTIES GroupComponent[ref PolicyRule[0..n]]
6.12. The Aggregation "PolicyActionInPolicyAction" 7.12. The Aggregation "PolicyActionInPolicyAction"
A second subclass of PolicyActionStructure is defined, representing the A second subclass of PolicyActionStructure is defined, representing the
compounding of policy actions into a higher-level policy action. compounding of policy actions into a higher-level policy action.
NAME PolicyActionInPolicyAction NAME PolicyActionInPolicyAction
DESCRIPTION A class representing the aggregation of PolicyActions DESCRIPTION A class representing the aggregation of PolicyActions
by another PolicyAction. by another PolicyAction.
DERIVED FROM PolicyActionStructure DERIVED FROM PolicyActionStructure
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref CompoundPolicyAction[0..n]] PROPERTIES GroupComponent[ref CompoundPolicyAction[0..n]]
6.13. The Aggregation "PolicyVariableInSimplePolicyCondition" 7.13. The Aggregation "PolicyVariableInSimplePolicyCondition"
A simple policy condition is represented as an ordered triplet {variable, A simple policy condition is represented as an ordered triplet {variable,
operator, value}. This aggregation provides the linkage between a operator, value}. This aggregation provides the linkage between a
SimplePolicyCondition instance and a single PolicyVariable. The SimplePolicyCondition instance and a single PolicyVariable. The
aggregation PolicyValueInSimplePolicyCondition links the aggregation PolicyValueInSimplePolicyCondition links the
SimplePolicyCondition to a single PolicyValue. The Operator property of SimplePolicyCondition to a single PolicyValue. The Operator property of
SimplePolicyCondition represents the third element of the triplet, the SimplePolicyCondition represents the third element of the triplet, the
operator. operator.
The class definition for this aggregation is as follows: The class definition for this aggregation is as follows:
skipping to change at page 74, line 7 skipping to change at page 75, line 7
The reference property "PartComponent" is inherited from PolicyComponent, The reference property "PartComponent" is inherited from PolicyComponent,
and overridden to become an object reference to a PolicyVariable that is and overridden to become an object reference to a PolicyVariable that is
defined within the scope of a SimplePolicyCondition. Note that for any defined within the scope of a SimplePolicyCondition. Note that for any
single instance of the association class single instance of the association class
PolicyVariableInSimplePolicyCondition, this property (like all reference PolicyVariableInSimplePolicyCondition, this property (like all reference
properties) is single-valued. The [1..1] cardinality indicates that a properties) is single-valued. The [1..1] cardinality indicates that a
SimplePolicyCondition must have exactly one policy variable defined SimplePolicyCondition must have exactly one policy variable defined
within its scope in order to be meaningful. within its scope in order to be meaningful.
6.14. The Aggregation "PolicyValueInSimplePolicyCondition" 7.14. The Aggregation "PolicyValueInSimplePolicyCondition"
A simple policy condition is represented as an ordered triplet {variable, A simple policy condition is represented as an ordered triplet {variable,
operator, value}. This aggregation provides the linkage between a operator, value}. This aggregation provides the linkage between a
SimplePolicyCondition instance and a single PolicyValue. The aggregation SimplePolicyCondition instance and a single PolicyValue. The aggregation
PolicyVariableInSimplePolicyCondition links the SimplePolicyCondition to PolicyVariableInSimplePolicyCondition links the SimplePolicyCondition to
a single PolicyVariable. The Operator property of SimplePolicyCondition a single PolicyVariable. The Operator property of SimplePolicyCondition
represents the third element of the triplet, the operator. represents the third element of the triplet, the operator.
The class definition for this aggregation is as follows: The class definition for this aggregation is as follows:
skipping to change at page 74, line 41 skipping to change at page 75, line 41
The reference property "PartComponent" is inherited from PolicyComponent, The reference property "PartComponent" is inherited from PolicyComponent,
and overridden to become an object reference to a PolicyValue that is and overridden to become an object reference to a PolicyValue that is
defined within the scope of a SimplePolicyCondition. Note that for any defined within the scope of a SimplePolicyCondition. Note that for any
single instance of the association class single instance of the association class
PolicyValueInSimplePolicyCondition, this property (like all reference PolicyValueInSimplePolicyCondition, this property (like all reference
properties) is single-valued. The [1..1] cardinality indicates that a properties) is single-valued. The [1..1] cardinality indicates that a
SimplePolicyCondition must have exactly one policy value defined within SimplePolicyCondition must have exactly one policy value defined within
its scope in order to be meaningful. its scope in order to be meaningful.
6.15. The Aggregation "PolicyVariableInSimplePolicyAction" 7.15. The Aggregation "PolicyVariableInSimplePolicyAction"
A simple policy action is represented as a pair {variable, value}. This A simple policy action is represented as a pair {variable, value}. This
aggregation provides the linkage between a SimplePolicyAction instance aggregation provides the linkage between a SimplePolicyAction instance
and a single PolicyVariable. The aggregation and a single PolicyVariable. The aggregation
PolicyValueInSimplePolicyAction links the SimplePolicyAction to a single PolicyValueInSimplePolicyAction links the SimplePolicyAction to a single
PolicyValue. PolicyValue.
The class definition for this aggregation is as follows: The class definition for this aggregation is as follows:
NAME PolicyVariableInSimplePolicyAction NAME PolicyVariableInSimplePolicyAction
skipping to change at page 75, line 23 skipping to change at page 76, line 23
The reference property "PartComponent" is inherited from PolicyComponent, The reference property "PartComponent" is inherited from PolicyComponent,
and overridden to become an object reference to a PolicyVariable that is and overridden to become an object reference to a PolicyVariable that is
defined within the scope of a SimplePolicyAction. Note that for any defined within the scope of a SimplePolicyAction. Note that for any
single instance of the association class single instance of the association class
PolicyVariableInSimplePolicyAction, this property (like all reference PolicyVariableInSimplePolicyAction, this property (like all reference
properties) is single-valued. The [1..1] cardinality indicates that a properties) is single-valued. The [1..1] cardinality indicates that a
SimplePolicyAction must have exactly one policy variable defined within SimplePolicyAction must have exactly one policy variable defined within
its scope in order to be meaningful. its scope in order to be meaningful.
6.16. The Aggregation "PolicyValueInSimplePolicyAction" 7.16. The Aggregation "PolicyValueInSimplePolicyAction"
A simple policy action is represented as a pair {variable, value}. This A simple policy action is represented as a pair {variable, value}. This
aggregation provides the linkage between a SimplePolicyAction instance aggregation provides the linkage between a SimplePolicyAction instance
and a single PolicyValue. The aggregation and a single PolicyValue. The aggregation
PolicyVariableInSimplePolicyAction links the SimplePolicyAction to a PolicyVariableInSimplePolicyAction links the SimplePolicyAction to a
single PolicyVariable. single PolicyVariable.
The class definition for this aggregation is as follows: The class definition for this aggregation is as follows:
NAME PolicyValueInSimplePolicyAction NAME PolicyValueInSimplePolicyAction
skipping to change at page 76, line 5 skipping to change at page 77, line 5
SimplePolicyAction objects that contain any given policy value object. SimplePolicyAction objects that contain any given policy value object.
The reference property "PartComponent" is inherited from PolicyComponent, The reference property "PartComponent" is inherited from PolicyComponent,
and overridden to become an object reference to a PolicyValue that is and overridden to become an object reference to a PolicyValue that is
defined within the scope of a SimplePolicyAction. Note that for any defined within the scope of a SimplePolicyAction. Note that for any
single instance of the association class PolicyValueInSimplePolicyAction, single instance of the association class PolicyValueInSimplePolicyAction,
this property (like all reference properties) is single-valued. The this property (like all reference properties) is single-valued. The
[1..1] cardinality indicates that a SimplePolicyAction must have exactly [1..1] cardinality indicates that a SimplePolicyAction must have exactly
one policy value defined within its scope in order to be meaningful. one policy value defined within its scope in order to be meaningful.
6.17. The Association "ReusablePolicy" 7.17. The Association "ReusablePolicy"
The association ReusablePolicy makes it possible to include any subclass The association ReusablePolicy makes it possible to include any subclass
of the abstract class "Policy" in a ReusablePolicyContainer. of the abstract class "Policy" in a ReusablePolicyContainer.
NAME ReusablePolicy NAME ReusablePolicy
DESCRIPTION A class representing the inclusion of a reusable DESCRIPTION A class representing the inclusion of a reusable
policy element in a ReusablePolicyContainer. Reusable policy element in a ReusablePolicyContainer. Reusable
elements may be PolicyGroups, PolicyRules, elements may be PolicyGroups, PolicyRules,
PolicyConditions, PolicyActions, PolicyVariables, PolicyConditions, PolicyActions, PolicyVariables,
PolicyValues, or instances of any other subclasses of PolicyValues, or instances of any other subclasses of
the abstract class Policy. the abstract class Policy.
DERIVED FROM PolicyInSystem DERIVED FROM PolicyInSystem
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES Antecedent[ref ReusablePolicyContainer[0..1]] PROPERTIES Antecedent[ref ReusablePolicyContainer[0..1]]
6.18. Deprecate PCIM's "PolicyConditionInPolicyRepository" 7.18. Deprecate PCIM's "PolicyConditionInPolicyRepository"
NAME PolicyConditionInPolicyRepository NAME PolicyConditionInPolicyRepository
DEPRECATED FOR ReusablePolicy DEPRECATED FOR ReusablePolicy
DESCRIPTION A class representing the inclusion of a reusable DESCRIPTION A class representing the inclusion of a reusable
PolicyCondition in a PolicyRepository. PolicyCondition in a PolicyRepository.
DERIVED FROM PolicyInSystem DERIVED FROM PolicyInSystem
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES Antecedent[ref PolicyRepository[0..1]] PROPERTIES Antecedent[ref PolicyRepository[0..1]]
Dependent[ref PolicyCondition[0..n]] Dependent[ref PolicyCondition[0..n]]
6.19. Deprecate PCIM's "PolicyActionInPolicyRepository" 7.19. Deprecate PCIM's "PolicyActionInPolicyRepository"
NAME PolicyActionInPolicyRepository NAME PolicyActionInPolicyRepository
DEPRECATED FOR ReusablePolicy DEPRECATED FOR ReusablePolicy
DESCRIPTION A class representing the inclusion of a reusable DESCRIPTION A class representing the inclusion of a reusable
PolicyAction in a PolicyRepository. PolicyAction in a PolicyRepository.
DERIVED FROM PolicyInSystem DERIVED FROM PolicyInSystem
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES Antecedent[ref PolicyRepository[0..1]] PROPERTIES Antecedent[ref PolicyRepository[0..1]]
Dependent[ref PolicyAction[0..n]] Dependent[ref PolicyAction[0..n]]
6.20. The Association ExpectedPolicyValuesForVariable 7.20. The Association ExpectedPolicyValuesForVariable
This association links a PolicyValue object to a PolicyVariable object, This association links a PolicyValue object to a PolicyVariable object,
modeling the set of expected values for that PolicyVariable. Using this modeling the set of expected values for that PolicyVariable. Using this
association, a variable (instance) may be constrained to be bound- association, a variable (instance) may be constrained to be bound-
to/assigned only a set of allowed values. For example, modeling an to/assigned only a set of allowed values. For example, modeling an
enumerated source port variable, one creates an instance of the enumerated source port variable, one creates an instance of the
PolicySourcePortVariable class and associates with it the set of values PolicySourcePortVariable class and associates with it the set of values
(integers) representing the allowed enumeration, using appropriate number (integers) representing the allowed enumeration, using appropriate number
of instances of the ExpectedPolicyValuesForVariable association. of instances of the ExpectedPolicyValuesForVariable association.
Note that a single variable instance may be constrained by any number of Note that a single variable instance may be constrained by any number of
values, and a single value may be used to constrain any number of values, and a single value may be used to constrain any number of
variables. These relationships are manifested by the n-to-m cardinality variables. These relationships are manifested by the n-to-m cardinality
of the association. of the association.
The purpose of this association is to support validation of simple policy The purpose of this association is to support validation of simple policy
conditions and simple policy actions, prior to their deployment to an conditions and simple policy actions, prior to their deployment to an
enforcement point. This association, and the PolicyValue object that it enforcement point. This association, and the PolicyValue object that it
refers to, plays no role when a PDP or a PEP is evaluating a simple refers to, plays no role when a PDP or a PEP is evaluating a simple
policy condition, or executing a simple policy action. See Section 4.8.3 policy condition, or executing a simple policy action. See Section 5.8.3
for more details on this point. for more details on this point.
The class definition for the association is as follows: The class definition for the association is as follows:
NAME ExpectedPolicyValuesForVariable NAME ExpectedPolicyValuesForVariable
DESCRIPTION A class representing the association of a set of DESCRIPTION A class representing the association of a set of
expected values to a variable object. expected values to a variable object.
DERIVED FROM Dependency DERIVED FROM Dependency
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES Antecedent [ref PolicyVariable[0..n]] PROPERTIES Antecedent [ref PolicyVariable[0..n]]
skipping to change at page 77, line 36 skipping to change at page 78, line 36
optionally having value constraints. The [0..n] cardinality indicates optionally having value constraints. The [0..n] cardinality indicates
that any number of variables may be constrained by a given value. that any number of variables may be constrained by a given value.
The reference property "Dependent" is inherited from Dependency, and The reference property "Dependent" is inherited from Dependency, and
overridden to become an object reference to a PolicyValue representing overridden to become an object reference to a PolicyValue representing
the values that a particular PolicyVariable can have. The [0..n] the values that a particular PolicyVariable can have. The [0..n]
cardinality indicates that a given policy variable may have 0, 1 or more cardinality indicates that a given policy variable may have 0, 1 or more
than one PolicyValues defined to model the set(s) of values that the than one PolicyValues defined to model the set(s) of values that the
policy variable can take. policy variable can take.
6.21. The Aggregation "ContainedDomain" 7.21. The Aggregation "ContainedDomain"
The aggregation ContainedDomain provides a means of nesting of one The aggregation ContainedDomain provides a means of nesting of one
ReusablePolicyContainer inside another one. The aggregation is defined ReusablePolicyContainer inside another one. The aggregation is defined
at the level of ReusablePolicyContainer's superclass, AdminDomain, to at the level of ReusablePolicyContainer's superclass, AdminDomain, to
give it applicability to areas other than Core Policy. give it applicability to areas other than Core Policy.
NAME ContainedDomain NAME ContainedDomain
DESCRIPTION A class representing the aggregation of lower level DESCRIPTION A class representing the aggregation of lower level
administrative domains by a higher-level AdminDomain. administrative domains by a higher-level AdminDomain.
DERIVED FROM SystemComponent DERIVED FROM SystemComponent
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref AdminDomain [0..n]] PROPERTIES GroupComponent[ref AdminDomain [0..n]]
PartComponent[ref AdminDomain [0..n]] PartComponent[ref AdminDomain [0..n]]
6.22. Deprecate PCIM's "PolicyRepositoryInPolicyRepository" 7.22. Deprecate PCIM's "PolicyRepositoryInPolicyRepository"
NAME PolicyRepositoryInPolicyRepository NAME PolicyRepositoryInPolicyRepository
DEPRECATED FOR ContainedDomain DEPRECATED FOR ContainedDomain
DESCRIPTION A class representing the aggregation of DESCRIPTION A class representing the aggregation of
PolicyRepositories by a higher-level PolicyRepository. PolicyRepositories by a higher-level PolicyRepository.
DERIVED FROM SystemComponent DERIVED FROM SystemComponent
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES GroupComponent[ref PolicyRepository[0..n]] PROPERTIES GroupComponent[ref PolicyRepository[0..n]]
PartComponent[ref PolicyRepository[0..n]] PartComponent[ref PolicyRepository[0..n]]
6.23. The Aggregation "EntriesInFilterList" 7.23. The Aggregation "EntriesInFilterList"
This aggregation is a specialization of the Component aggregation; it is This aggregation is a specialization of the Component aggregation; it is
used to define a set of filter entries (subclasses of FilterEntryBase) used to define a set of filter entries (subclasses of FilterEntryBase)
that are aggregated by a FilterList. that are aggregated by a FilterList.
The cardinalities of the aggregation itself are 0..1 on the FilterList The cardinalities of the aggregation itself are 0..1 on the FilterList
end, and 0..n on the FilterEntryBase end. Thus in the general case, a end, and 0..n on the FilterEntryBase end. Thus in the general case, a
filter entry can exist without being aggregated into any FilterList. filter entry can exist without being aggregated into any FilterList.
However, the only way a filter entry can figure in the PCIMe model is by However, the only way a filter entry can figure in the PCIMe model is by
being aggregated into a FilterList by this aggregation. being aggregated into a FilterList by this aggregation.
skipping to change at page 78, line 38 skipping to change at page 79, line 38
FilterEntryBase) that are aggregated by FilterEntryBase) that are aggregated by
a particular FilterList. a particular FilterList.
DERIVED FROM Component DERIVED FROM Component
ABSTRACT False ABSTRACT False
PROPERTIES GroupComponent[ref PROPERTIES GroupComponent[ref
FilterList[0..1]], FilterList[0..1]],
PartComponent[ref PartComponent[ref
FilterEntryBase[0..n], FilterEntryBase[0..n],
EntrySequence EntrySequence
6.23.1. The Reference GroupComponent 7.23.1. The Reference GroupComponent
This property is overridden in this aggregation to represent an object This property is overridden in this aggregation to represent an object
reference to a FilterList object (instead of to the more generic reference to a FilterList object (instead of to the more generic
ManagedSystemElement object defined in its superclass). It also ManagedSystemElement object defined in its superclass). It also
restricts the cardinality of the aggregate to 0..1 (instead of the more restricts the cardinality of the aggregate to 0..1 (instead of the more
generic 0-or-more), representing the fact that a filter entry always generic 0-or-more), representing the fact that a filter entry always
exists within the context of at most one FilterList. exists within the context of at most one FilterList.
6.23.2. The Reference PartComponent 7.23.2. The Reference PartComponent
This property is overridden in this aggregation to represent an object This property is overridden in this aggregation to represent an object
reference to a FilterEntryBase object (instead of to the more generic reference to a FilterEntryBase object (instead of to the more generic
ManagedSystemElement object defined in its superclass). This object ManagedSystemElement object defined in its superclass). This object
represents a single filter entry, which may be aggregated with other represents a single filter entry, which may be aggregated with other
filter entries to form the FilterList. filter entries to form the FilterList.
6.23.3. The Property EntrySequence 7.23.3. The Property EntrySequence
An unsigned 16-bit integer indicating the order of the filter entry An unsigned 16-bit integer indicating the order of the filter entry
relative to all others in the FilterList. The default value '0' relative to all others in the FilterList. The default value '0'
indicates that order is not significant, because the entries in this indicates that order is not significant, because the entries in this
FilterList are ANDed together. FilterList are ANDed together.
6.24. The Aggregation "ElementInPolicyRoleCollection" 7.24. The Aggregation "ElementInPolicyRoleCollection"
The following aggregation is used to associate ManagedElements with a The following aggregation is used to associate ManagedElements with a
PolicyRoleCollection object that represents a role played by these PolicyRoleCollection object that represents a role played by these
ManagedElements. ManagedElements.
NAME ElementInPolicyRoleCollection NAME ElementInPolicyRoleCollection
DESCRIPTION A class representing the inclusion of a ManagedElement DESCRIPTION A class representing the inclusion of a ManagedElement
in a collection, specified as having a given role. in a collection, specified as having a given role.
All the managed elements in the collection share the All the managed elements in the collection share the
same role. same role.
DERIVED FROM MemberOfCollection DERIVED FROM MemberOfCollection
ABSTRACT FALSE ABSTRACT FALSE
PROPERTIES Collection[ref PolicyRoleCollection [0..n]] PROPERTIES Collection[ref PolicyRoleCollection [0..n]]
Member[ref ManagedElement [0..n]] Member[ref ManagedElement [0..n]]
6.25. The Weak Association "PolicyRoleCollectionInSystem" 7.25. The Weak Association "PolicyRoleCollectionInSystem"
A PolicyRoleCollection is defined within the scope of a System. This A PolicyRoleCollection is defined within the scope of a System. This
association links a PolicyRoleCollection to the System in whose scope it association links a PolicyRoleCollection to the System in whose scope it
is defined. is defined.
When associating a PolicyRoleCollection with a System, this should be When associating a PolicyRoleCollection with a System, this should be
done consistently with the system that scopes the policy rules/groups done consistently with the system that scopes the policy rules/groups
that are applied to the resources in that collection. A that are applied to the resources in that collection. A
PolicyRoleCollection is associated with the same system as the applicable PolicyRoleCollection is associated with the same system as the applicable
PolicyRules and/or PolicyGroups, or to a System higher in the tree formed PolicyRules and/or PolicyGroups, or to a System higher in the tree formed
skipping to change at page 80, line 15 skipping to change at page 81, line 15
exactly one System. exactly one System.
The reference property Dependent is inherited from Dependency, and The reference property Dependent is inherited from Dependency, and
overridden to become an object reference to a PolicyRoleCollection overridden to become an object reference to a PolicyRoleCollection
defined within the scope of a System. Note that for any single instance defined within the scope of a System. Note that for any single instance
of the association class PolicyRoleCollectionInSystem, this property of the association class PolicyRoleCollectionInSystem, this property
(like all Reference properties) is single-valued. The [0..n] cardinality (like all Reference properties) is single-valued. The [0..n] cardinality
indicates that a given System may have 0, 1, or more than one indicates that a given System may have 0, 1, or more than one
PolicyRoleCollections defined within its scope. PolicyRoleCollections defined within its scope.
7. Intellectual Property 8. Intellectual Property
The IETF takes no position regarding the validity or scope of any The IETF takes no position regarding the validity or scope of any
intellectual property or other rights that might be claimed to pertain to intellectual property or other rights that might be claimed to pertain to
the implementation or use of the technology described in this document or the implementation or use of the technology described in this document or
the extent to which any license under such rights might or might not be the extent to which any license under such rights might or might not be
available; neither does it represent that it has made any effort to available; neither does it represent that it has made any effort to
identify any such rights. Information on the IETF's procedures with identify any such rights. Information on the IETF's procedures with
respect to rights in standards-track and standards-related documentation respect to rights in standards-track and standards-related documentation
can be found in BCP-11. can be found in BCP-11.
skipping to change at page 80, line 37 skipping to change at page 81, line 37
assurances of licenses to be made available, or the result of an attempt assurances of licenses to be made available, or the result of an attempt
made to obtain a general license or permission for the use of such made to obtain a general license or permission for the use of such
proprietary rights by implementers or users of this specification can be proprietary rights by implementers or users of this specification can be
obtained from the IETF Secretariat. obtained from the IETF Secretariat.
The IETF invites any interested party to bring to its attention any The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary rights copyrights, patents or patent applications, or other proprietary rights
which may cover technology that may be required to practice this which may cover technology that may be required to practice this
standard. Please address the information to the IETF Executive Director. standard. Please address the information to the IETF Executive Director.
8. Acknowledgements 9. Acknowledgements
The starting point for this document was PCIM itself [3], and the first The starting point for this document was PCIM itself [1], and the first
three submodels derived from it [5], [6], [7]. The authors of these three submodels derived from it [11], [12], [13]. The authors of these
documents created the extensions to PCIM, and asked the questions about documents created the extensions to PCIM, and asked the questions about
PCIM, that are reflected in PCIMe. PCIM, that are reflected in PCIMe.
9. Security Considerations 10. Contributors
The Policy Core Information Model (PCIM) [3] describes the general
security considerations related to the general core policy model. The
extensions defined in this document do not introduce any additional
considerations related to security.
10. References
[1] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[2] Hovey, R., and S. Bradner, "The Organizations Involved in the IETF
Standards Process", BCP 11, RFC 2028, October 1996.
[3] Strassner, J., and E. Ellesson, B. Moore, A. Westerinen, "Policy Core
Information Model -- Version 1 Specification", RFC 3060, February
2001.
[4] Distributed Management Task Force, Inc., "DMTF Technologies: CIM
Standards ū CIM Schema: Version 2.5", available at
http://www.dmtf.org/standards/cim_schema_v25.php.
[5] Snir, Y., and Y. Ramberg, J. Strassner, R. Cohen, "Policy QoS
Information Model", work in progress, draft-ietf-policy-qos-info-
model-04.txt, November 2001.
[6] Jason, J., and L. Rafalow, E. Vyncke, "IPsec Configuration Policy
Model", work in progress, draft-ietf-ipsp-config-policy-model-04.txt,
November 2001.
[7] Chadha, R., and M. Brunner, M. Yoshida, J. Quittek, G. Mykoniatis, A.
Poylisher, R. Vaidyanathan, A. Kind, F. Reichmeyer, "Policy Framework
MPLS Information Model for QoS and TE", work in progress, draft-
chadha-policy-mpls-te-01.txt, December 2000.
[8] Crocker, D., and P. Overell, "Augmented BNF for Syntax Specifications:
ABNF", RFC 2234, November 1997.
[9] P. Mockapetris, "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION", RFC
1035, November 1987.
[10] R. Hinden, S. Deering, "IP Version 6 Addressing Architecture", RFC
2373, July 1998.
[11] M. Wahl, A. Coulbeck, "Lightweight Directory Access Protocol (v3):
Attribute Syntax Definitions", RFC 2252, December 1997.
[12] A. Westerinen, et al., "Terminology for Policy-Based Management", RFC
3198, November 2001.
[13] S. Waldbusser, and J. Saperia, T. Hongal, "Policy Based Management
MIB", work in progress, <draft-ietf-snmpconf-pm-09.txt>, November
2001.
[14] B. Moore, and D. Durham, J. Halpern, J. Strassner, A. Westerinen, W.
Weiss, "Information Model for Describing Network Device QoS Datapath
Mechanisms", work in progress, <draft-ietf-policy-qos-device-info-
model-07.txt>, March 2002.
11. Authors' Addresses
Bob Moore This document includes text written by a number of authors (including the
IBM Corporation, BRQA/501 editor), that was subsequently merged by the editor. The following
4205 S. Miami Blvd. people contributed text to this document:
Research Triangle Park, NC 27709
Phone: +1 919-254-4436
Fax: +1 919-254-6243
E-mail: remoore@us.ibm.com
Lee Rafalow Lee Rafalow
IBM Corporation, BRQA/501 IBM Corporation, BRQA/501
4205 S. Miami Blvd. 4205 S. Miami Blvd.
Research Triangle Park, NC 27709 Research Triangle Park, NC 27709
Phone: +1 919-254-4455 Phone: +1 919-254-4455
Fax: +1 919-254-6243 Fax: +1 919-254-6243
E-mail: rafalow@us.ibm.com E-mail: rafalow@us.ibm.com
Yoram Ramberg Yoram Ramberg
skipping to change at page 83, line 15 skipping to change at page 82, line 53
NEC Europe Ltd. NEC Europe Ltd.
C&C Research Laboratories C&C Research Laboratories
Adenauerplatz 6 Adenauerplatz 6
D-69115 Heidelberg, Germany D-69115 Heidelberg, Germany
Phone: +49 (0)6221 9051129 Phone: +49 (0)6221 9051129
Fax: +49 (0)6221 9051155 Fax: +49 (0)6221 9051155
E-mail: brunner@ccrle.nec.de E-mail: brunner@ccrle.nec.de
Ron Cohen Ron Cohen
Ntear LLC Ntear LLC
Phone:
Fax:
E-mail: ronc@ntear.com E-mail: ronc@ntear.com
John Strassner John Strassner
INTELLIDEN, Inc. INTELLIDEN, Inc.
90 South Cascade Avenue 90 South Cascade Avenue
Colorado Springs, CO 80903 Colorado Springs, CO 80903
Phone: +1-719-785-0648 Phone: +1-719-785-0648
E-mail: john.strassner@intelliden.com E-mail: john.strassner@intelliden.com
12. Full Copyright Statement 11. Security Considerations
The Policy Core Information Model (PCIM) [1] describes the general
security considerations related to the general core policy model. The
extensions defined in this document do not introduce any additional
considerations related to security.
12. Normative References
[1] Strassner, J., and E. Ellesson, B. Moore, A. Westerinen, "Policy Core
Information Model -- Version 1 Specification", RFC 3060, February
2001.
[2] Distributed Management Task Force, Inc., "DMTF Technologies: CIM
Standards ū CIM Schema: Version 2.5", available at
http://www.dmtf.org/standards/cim_schema_v25.php.
[3] Distributed Management Task Force, Inc., "Common Information Model
(CIM) Specification: Version 2.2", June 14, 1999, available at
http://www.dmtf.org/standards/documents/CIM/DSP0004.pdf.
[4] P. Mockapetris, "DOMAIN NAMES - IMPLEMENTATION AND SPECIFICATION", RFC
1035, November 1987.
[5] M. Wahl, A. Coulbeck, "Lightweight Directory Access Protocol (v3):
Attribute Syntax Definitions", RFC 2252, December 1997.
[6] Crocker, D., and P. Overell, "Augmented BNF for Syntax Specifications:
ABNF", RFC 2234, November 1997.
[7] R. Hinden, S. Deering, "IP Version 6 Addressing Architecture", RFC
2373, July 1998.
13. Informative References
[8] Bradner, S., "Key words for use in RFCs to Indicate Requirement
Levels", BCP 14, RFC 2119, March 1997.
[9] Hovey, R., and S. Bradner, "The Organizations Involved in the IETF
Standards Process", BCP 11, RFC 2028, October 1996.
[10] A. Westerinen, et al., "Terminology for Policy-Based Management", RFC
3198, November 2001.
[11] Snir, Y., and Y. Ramberg, J. Strassner, R. Cohen, "Policy QoS
Information Model", work in progress, draft-ietf-policy-qos-info-
model-04.txt, November 2001.
[12] Jason, J., and L. Rafalow, E. Vyncke, "IPsec Configuration Policy
Model", work in progress, draft-ietf-ipsp-config-policy-model-04.txt,
November 2001.
[13] Chadha, R., and M. Brunner, M. Yoshida, J. Quittek, G. Mykoniatis, A.
Poylisher, R. Vaidyanathan, A. Kind, F. Reichmeyer, "Policy Framework
MPLS Information Model for QoS and TE", work in progress, draft-
chadha-policy-mpls-te-01.txt, December 2000.
[14] S. Waldbusser, and J. Saperia, T. Hongal, "Policy Based Management
MIB", work in progress, <draft-ietf-snmpconf-pm-09.txt>, November
2001.
[15] B. Moore, and D. Durham, J. Halpern, J. Strassner, A. Westerinen, W.
Weiss, "Information Model for Describing Network Device QoS Datapath
Mechanisms", work in progress, <draft-ietf-policy-qos-device-info-
model-07.txt>, March 2002.
14. Editor's Address
Bob Moore
IBM Corporation, BRQA/501
4205 S. Miami Blvd.
Research Triangle Park, NC 27709
Phone: +1 919-254-4436
Fax: +1 919-254-6243
E-mail: remoore@us.ibm.com
15. Full Copyright Statement
Copyright (C) The Internet Society (2002). All Rights Reserved. Copyright (C) The Internet Society (2002). All Rights Reserved.
This document and translations of it may be copied and furnished to This document and translations of it may be copied and furnished to
others, and derivative works that comment on or otherwise explain it or others, and derivative works that comment on or otherwise explain it or
assist in its implementation may be prepared, copied, published and assist in its implementation may be prepared, copied, published and
distributed, in whole or in part, without restriction of any kind, distributed, in whole or in part, without restriction of any kind,
provided that the above copyright notice and this paragraph are included provided that the above copyright notice and this paragraph are included
on all such copies and derivative works. However, this document itself on all such copies and derivative works. However, this document itself
may not be modified in any way, such as by removing the copyright notice may not be modified in any way, such as by removing the copyright notice
skipping to change at page 84, line 5 skipping to change at page 85, line 15
The limited permissions granted above are perpetual and will not be The limited permissions granted above are perpetual and will not be
revoked by the Internet Society or its successors or assigns. revoked by the Internet Society or its successors or assigns.
This document and the information contained herein is provided on an "AS This document and the information contained herein is provided on an "AS
IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK
FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT
LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT
INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR
FITNESS FOR A PARTICULAR PURPOSE. FITNESS FOR A PARTICULAR PURPOSE.
13. Appendix A: Closed Issues 16. Appendix A: Closed Issues
EDITOR'S NOTE: The following list captures the major technical issues EDITOR'S NOTE: The following list captures the major technical issues
that were resolved during the course of progressing PCIMe from initial that were resolved during the course of progressing PCIMe from initial
draft to Proposed Standard. This appendix will be removed for submission draft to Proposed Standard. This appendix will be removed for submission
to the RFC Editor (unless there is a consensus to preserve it in the to the RFC Editor (unless there is a consensus to preserve it in the
RFC), but it should be archived somewhere. RFC), but it should be archived somewhere.
1. Unrestricted use of DNF/CNF for CompoundPolicyConditions. 1. Unrestricted use of DNF/CNF for CompoundPolicyConditions.
Alternative: for the conditions aggregated by a Alternative: for the conditions aggregated by a
CompoundPolicyCondition, allow only ANDing, with negation of CompoundPolicyCondition, allow only ANDing, with negation of
skipping to change at page 85, line 14 skipping to change at page 86, line 24
RESOLUTION: PCIMe will continue to prohibit equal Priority values. RESOLUTION: PCIMe will continue to prohibit equal Priority values.
6. Modeling a SimplePolicyAction with just a related PolicyVariable 6. Modeling a SimplePolicyAction with just a related PolicyVariable
and PolicyValue -- the "set" or "apply" operation is implicit. and PolicyValue -- the "set" or "apply" operation is implicit.
Alternative: include an Operation property in SimplePolicyAction, Alternative: include an Operation property in SimplePolicyAction,
similar to the Operation property in SimplePolicyCondition. similar to the Operation property in SimplePolicyCondition.
RESOLUTION: This issue has been resolved by a change in the RESOLUTION: This issue has been resolved by a change in the
opposite direction. The operations are now implicit for BOTH opposite direction. The operations are now implicit for BOTH
SimplePolicyCondition and SimplePolicyAction. See Sections 4.8.3 SimplePolicyCondition and SimplePolicyAction. See Sections 5.8.3
and 4.8.4, respectively, for discussions of and 5.8.4, respectively, for discussions of
SimplePolicyCondition's implicit MATCH operator and SimplePolicyCondition's implicit MATCH operator and
SimplePolicyAction's implicit SET operator. SimplePolicyAction's implicit SET operator.
7. Representation of PolicyValues: should values like IPv4 addresses 7. Representation of PolicyValues: should values like IPv4 addresses
be represented only as strings (as in LDAP), or natively (e.g., an be represented only as strings (as in LDAP), or natively (e.g., an
IPv4 address would be a four-octet field) with mappings to other IPv4 address would be a four-octet field) with mappings to other
representations such as strings? representations such as strings?
RESOLUTION: Mappings have been eliminated. Each value type has a RESOLUTION: Mappings have been eliminated. Each value type has a
single representation specified for it. single representation specified for it.
skipping to change at page 86, line 39 skipping to change at page 87, line 47
action should set) a particular property in a particular object action should set) a particular property in a particular object
instance. But we do not believe that the current mechanism of instance. But we do not believe that the current mechanism of
specifying a target object class and property name is sufficient. specifying a target object class and property name is sufficient.
For the next version of PCIMe, we need to either find a way to For the next version of PCIMe, we need to either find a way to
make this work in general; or find a way to make it work in some make this work in general; or find a way to make it work in some
cases, and then describe clearly what these cases are; or remove cases, and then describe clearly what these cases are; or remove
PolicyExplicitVariables from PCIMe entirely. PolicyExplicitVariables from PCIMe entirely.
RESOLUTION (in PCIMe-02): From the list of choices above, we took RESOLUTION (in PCIMe-02): From the list of choices above, we took
the path of making explicit variables work in a specific case, and the path of making explicit variables work in a specific case, and
indicating clearly that they work only in this case. See section indicating clearly that they work only in this case. See Section
4.8.6 5.8.6
 End of changes. 266 change blocks. 
527 lines changed or deleted 557 lines changed or added

This html diff was produced by rfcdiff 1.34. The latest version is available from http://tools.ietf.org/tools/rfcdiff/