Policy Core Information Model (PCIM) Extensions
updates
- rfc-3060 — Policy Core Information Model -- Version 1 Specification
Extracted elements (30)
Device-level filter classes (IpHeadersFilter, 8021Filter) were defined separately from domain-level variable/value pairs because they support specifying all fields of a protocol header in a single object instance and use native type representations, whereas domain-level classes require separate instances per field and use string representations.
Implicit variables are modeled as classes (rather than as string identifiers) so that the type system and ValueTypes property can enforce compatibility between variable and value instances at model-construction time, enabling validation before deployment to an enforcement point.
PolicyRepository was deprecated and replaced with ReusablePolicyContainer because the name 'PolicyRepository' was already in use in Policy Framework documents to denote the storage location accessed by the PDP and Policy Management Tool, causing confusion with a completely different concept.
PolicySetComponent.Priority is required to be unique (no ties allowed) rather than permitting equal priorities, because the flexibility of equal priorities was judged insufficient benefit to justify variations in implementation behavior and the resulting confusion.
Priority was moved from the PolicyRule class to the PolicySetComponent aggregation for two reasons: it generalizes priority to apply to both groups and rules, and it places priority on the relationship between parent and subordinate, making value assignment easier since the value need only be unique within the containing set.
PCIMe deprecates PCIM's PolicyGroupInPolicyGroup, PolicyRuleInPolicyGroup, and PolicyRule.Priority, and replaces them with PolicySetComponent and PolicySetComponent.Priority. Implementations of RFC 3060 must migrate to these replacements; the deprecated elements are retained for backward reference only.
When multiple unrooted PolicySet instances apply to the same managed resource across different functional domains (e.g., QoS and IKE), they are evaluated independently of one another and are NOT joined in a common FirstMatching strategy.
An implementation of the rule engine need not provide action sequencing, but actions MUST be sequenced by the PEP or PDP on its behalf for the AllMatching strategy; higher-priority rule actions execute first.
For multiple unrooted PolicySet instances applying to the same managed resource in a given functional domain, the decision strategy among them is FirstMatching, with priority determined by the PolicySetInSystem association.
If a parent rule's condition evaluates to TRUE, the set of sub-rules SHALL BE evaluated according to the decision strategy and priorities defined in Section 5.5. The parent rule's actions are executed before those of sub-rules.
Implementations MUST support the FirstMatching decision strategy; implementations MAY support the AllMatching decision strategy. FirstMatching enforces actions only for the highest-priority rule whose conditions evaluate to TRUE; AllMatching enforces all matching rules.
PolicySetComponent.Priority MUST have a unique value when compared with others defined for the same aggregating PolicySet, ensuring deterministic rule evaluation within a set.
PolicySetInSystem.Priority values MUST be unique for an associated System, ensuring deterministic behavior among unrooted PolicySet instances applied to the same managed resource.
Side effects of condition evaluation MUST NOT affect the result of evaluating other conditions in the same evaluation pass. For AllMatching and nested rules, side effects of action enforcement MUST NOT be included in condition evaluation on the same pass.
Simple condition composition MUST enforce a data-type conformance rule: the ValueTypes property of the variable must be compatible with the type of the value class used in a SimplePolicyCondition.
The SET operator in SimplePolicyAction MUST overwrite the old value of the variable. For multi-valued variables, the only defined update operation is complete replacement of all previous values with a new set; no Add or Remove operations are defined.
8021Filter is a device-level filter class (subclass of FilterEntryBase) for 802.1 MAC frame headers. Properties include 8021HdrSrcMACAddr, 8021HdrSrcMACMask, 8021HdrDestMACAddr, 8021HdrDestMACMask, 8021HdrProtocolID, 8021HdrPriorityValue, and 8021HdrVLANID.
CompoundPolicyAction is a new subclass of PolicyAction representing a sequence of sub-actions to be applied as a single logical action. It carries a SequencedActions property and an ExecutionStrategy property, and may be nested within another CompoundPolicyAction.
CompoundPolicyCondition is a new subclass of PolicyCondition that represents a Boolean (DNF/CNF) combination of simpler conditions via the PolicyConditionInPolicyCondition aggregation. CompoundFilterCondition is a further subclass for packet filtering contexts.
FilterList aggregates FilterEntryBase instances via the EntriesInFilterList aggregation. It carries a Direction property (inbound/outbound) and an EntrySequence property on the aggregation to order filter entries within the list.
IpHeadersFilter is a device-level filter class (subclass of FilterEntryBase) specifying IP header fields in a single instance. Properties include HdrIpVersion, HdrSrcAddress, HdrSrcAddressEndOfRange, HdrSrcMask, HdrDestAddress, HdrDestMask, HdrProtocolID, HdrSrcPortStart/End, HdrDestPortStart/End, HdrDSCP, and HdrFlowLabel.
PolicyImplicitVariable carries a multi-valued ValueTypes property listing the types of PolicyValue instances that are compatible with the variable. PCIMe defines 21 implicit variable subclasses covering IPv4/IPv6 addresses, ports, protocol, DSCP, VLAN, MAC addresses, CoS, SNAP, and flow direction.
PolicyRoleCollection is a new class derived from CIM Collection that aggregates resources sharing a common role (via ElementInPolicyRoleCollection). Its PolicyRole property must match the PolicyRoles property of applicable PolicySets, enabling PDPs to determine rule applicability to resources.
PolicySet is a new abstract class inserted into the class hierarchy above both PolicyGroup and PolicyRule. It carries two properties: PolicyDecisionStrategy (FirstMatching or AllMatching) and PolicyRoles (characterizing applicable resources).
PolicySetComponent is a new concrete aggregation replacing the deprecated PolicyGroupInPolicyGroup and PolicyRuleInPolicyGroup. It provides the containment relationship for a PolicySet within a PolicySet, carrying a Priority property on the relationship itself.
PolicyVariable is a new abstract class with two concrete subtypes: PolicyExplicitVariable (bound to a specific CIM class/property name via ModelClass and ModelProperty properties) and PolicyImplicitVariable (evaluated outside the model, e.g., packet header fields).
ReusablePolicyContainer is a new class (subclass of AdminDomain) that replaces the deprecated PolicyRepository. It can contain any policy element (any subclass of Policy) via the new ReusablePolicy association, generalizing beyond conditions and actions only.
SimplePolicyAction models 'SET <variable> TO <value>'. The variable is linked via PolicyVariableInSimplePolicyAction and the value via PolicyValueInSimplePolicyAction aggregations; expected values expressed through ExpectedPolicyValuesForVariable are for validation only and do not affect execution.
SimplePolicyCondition models elementary Boolean expressions of the form '(variable MATCH value)'. The MATCH operator is implicit and overloaded, handling singletons, ranges, and sets; complex expressions are formed by combining instances via CompoundPolicyCondition.
Section 11 addresses security considerations for PCIMe. As a policy information model, unauthorized modification or spoofing of policy data could cause misconfiguration of enforcement points; the document references RFC 3060's security considerations and notes that data-model-level security depends on the transport and access-control mechanisms of the protocol carrying the model.