Module Zone

Imported modules

Class InetZone

This is a simple Zone class using InetDomain as its address type.

Constructor __init__

Initializes an InetZone instance

Synopsis

__init__ (
        self,
        name,
        addr,
        inbound_services=None,
        outbound_services=None,
        admin_parent=None,
        umbrella=0,
        )

Description

Initializes an InetZone object instance, and sets its attributes based on arguments.

Arguments

Table 4-123. Arguments for InetZone.__init__()

selfthis instance
namename of this zone
addra string representing an address range, interpreted by the domain class (last argument), or a list of strings representing multiple address ranges.
inbound_services set of permitted inbound services as described by RootZone
outbound_servicesset of permitted outbound services as described by RootZone
admin_parentname of the administrative parent
umbrella TRUE if this zone is an umbrella zone

Class RootZone

A zone is the basis of access control in Zorp. It encapsulates an address range (for example an IPv4 subnet). Parsing and representing an address is done by the Domain class and derivates.

Zones are organized into two different hierarchies. The first is based on the address it encapsulates. In this case a zone is a child of some other zone, if the parent is containing it. (For example 0.0.0.0/0 contains 192.168.0.0/24) This hierarchy is used when searching the containing zone of a given network address.

The other hierarchy is based on administrative decisions. Administrative children inherit security attributes (permitted set of services etc.) from their parents.

The RootZone class serves two purposes:

1. it is the base class for all Zone-like classes, implementing interfaces for access control, and hierarchy travelsal.

2. an instance of this class is an address domain independent root of the Zone address hierarchy and delegates searches to the appropriate Zone.

Attributes

Table 4-124. Attributes for class RootZone

namea unique name of this zone
inbound_servicesmapping indexed by service name, containing an item for each permitted inbound service
outbound_servicessimilar to inbound_services, but used for outbound services.
admin_parent parent of this zone in the administrative hierarchy
umbrella true for umbrella zones (ie. zones that do not inherit security attributes from their administrative parents)

Constructor __init__

Initialize a RootZone instance.

Synopsis

__init__ (
        self,
        name,
        inbound_services=None,
        outbound_services=None,
        admin_parent=None,
        umbrella=0,
        )

Description

This function is primarily called by derived classes to initialize basic Zone data structures.

Arguments

Table 4-125. Arguments for RootZone.__init__()

selfthis instance
namename of this zone
inbound_servicesan array of allowed inbound service names
outbound_servicesan array of allowed outbound service names
admin_parentadministrative parent name
umbrellathis is an umbrella zone
domain address domain

Exceptions

  • ZoneException

Method __str__

Overridden operator to return the textual representation of self.

Synopsis

__str__ ( self )

Description

Called by the Python core to format the object contents when it is written.

Arguments

Table 4-126. Arguments for RootZone.__str__()

selfthis instance

Method addAddrChild

Add a address-based child to this zone.

Synopsis

addAddrChild ( self,  child )

Description

This function adds a children to the set of child zones.

Arguments

Table 4-127. Arguments for RootZone.addAddrChild()

selfthis instance
childchild to add

Method addAdminChild

Add an administrative child

Synopsis

addAdminChild ( self,  child )

Description

This function adds child to the set of administrative children.

Arguments

Table 4-128. Arguments for RootZone.addAdminChild()

selfthis instance
childchild zone add

Method delAddrChild

Delete an address child.

Synopsis

delAddrChild ( self,  child )

Description

This function removes an item from the set of address children.

Arguments

Table 4-129. Arguments for RootZone.delAddrChild()

selfthis instance
childchild to remove

Method findDomain

Find the root Zone of the given address domain.

Synopsis

findDomain ( self,  domain )

Description

Finds the first child in self which uses domain as address domain.

Arguments

Table 4-130. Arguments for RootZone.findDomain()

selfthis instance
domainclass implementing address range specifics (for example InetDomain for IPv4)

Exceptions

  • ZoneException

Method findZone

Find the most specific Zone for address.

Synopsis

findZone ( self,  address )

Description

This function searches the address hierarchy for the most specific Zone containing address.

Arguments

Table 4-131. Arguments for RootZone.findZone()

selfthis instance
addressaddress we are trying to find (should be derived from SockAddr)

Exceptions

  • ZoneException

Method isInboundServicePermitted

Inbound access control check.

Synopsis

isInboundServicePermitted ( self,  session )

Description

This function is called when a session is connecting to a server to check whether it is permitted.

Arguments

Table 4-132. Arguments for RootZone.isInboundServicePermitted()

selfthis instance
sessionsession that should be checked

Returns

Z_ACCEPT if the service is permitted, Z_REJECT otherwise

Method isOutboundServicePermitted

Outbound access control check.

Synopsis

isOutboundServicePermitted ( self,  session )

Description

This function is called when an incoming connection is detected to check whether it is allowable.

Arguments

Table 4-133. Arguments for RootZone.isOutboundServicePermitted()

selfthis instance
sessionsession that should be checked

Returns

Z_ACCEPT if the service is permitted, Z_REJECT otherwise

Method iterAddrChildren

Iterate over the set of address children

Synopsis

iterAddrChildren (
        self,
        fn,
        parm=None,
        )

Description

This function iterates over the set of address children and calls fn for each item.

Arguments

Table 4-134. Arguments for RootZone.iterAddrChildren()

selfthis instance
fnfunction to call
parmopaque argument passed to fn

Method iterAdminChildren

Iterate over the set of administrative children.

Synopsis

iterAdminChildren (
        self,
        fn,
        parm=None,
        )

Description

This function iterates over the set of administrative children calling the function fn for each item, with parameters parm, self and the item.

The callback fn may delete items from admin_children, this function uses a local copy of that array.

Arguments

Table 4-135. Arguments for RootZone.iterAdminChildren()

selfthis instance
fnfunction to call
parmopaque object passed to fn

Method setAddrParent

Set address parent of this zone.

Synopsis

setAddrParent ( self,  parent )

Description

This function sets the address parent of this Zone.

Arguments

Table 4-136. Arguments for RootZone.setAddrParent()

selfthis instance
parentparent Zone

Method setAdminParent

Set administrative parent of this zone.

Synopsis

setAdminParent ( self,  parent )

Description

This function sets the administrative parent of this Zone.

Arguments

Table 4-137. Arguments for RootZone.setAdminParent()

selfthis instance
parentparent Zone

Class Zone

This class differs from RootZone in that it uses a real address domain (for IPv4 InetDomain is used), unlike RootZone which is a general wrapper for all address types (IPv4, IPv6, SPX etc.)

Constructor __init__

Initializes a Zone instance.

Synopsis

__init__ (
        self,
        name,
        addr,
        inbound_services=None,
        outbound_services=None,
        admin_parent=None,
        umbrella=0,
        domain=None,
        )

Description

This class initializes a Zone instance by calling the inherited constructor, and setting local attributes.

Arguments

Table 4-138. Arguments for Zone.__init__()

selfthis instance
namename of this zone
addra string representing an address range interpreted by the domain class (last argument), or a list of strings representing multiple address ranges.
inbound_services set of permitted inbound services as described by RootZone
outbound_servicesset of permitted outbound services as described by RootZone
admin_parentname of the administrative parent
umbrella TRUE if this zone is an umbrella zone
domainaddress domain class parsing addr and performing address comparisons for IPv4 addresses it should be InetDomain

Exceptions

  • ValueError

Notes

If addr is a list of addresses (like ['192.168.1.1', '192.168.1.5']), several subzones are automatically created with administrative parent set to self. This way you can define members with additional privilege easily.

Method __str__

Format the Zone as string

Synopsis

__str__ ( self )

Description

This function is called by the Python core when this object is used as string.

Method findZone

Find the most specific containing Zone of addr

Synopsis

findZone ( self,  addr )

Description

This function returns the most specific Zone containing addr

Arguments

Table 4-139. Arguments for Zone.findZone()

selfthis instance
addraddress to look up

Exceptions

  • ZoneException

Method setAddrRelatives

Helper function to place this zone into the address hierarchy.

Synopsis

setAddrRelatives ( self )

Description

This function is called by the Zone constructor to place this zone into the address hierarchy.

Arguments

Table 4-140. Arguments for Zone.setAddrRelatives()

selfthis instance

Exceptions

  • NotImplementedError