<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Network Segmentation Validation — API Reference

## Palo Alto Firewall Rule Query

```python
import requests

PA_URL = "https://firewall.corp.local/restapi/v10.2"
HEADERS = {"X-PAN-KEY": "your-api-key"}

# Get security rules
resp = requests.get(f"{PA_URL}/Policies/SecurityRules", headers=HEADERS, params={
    "location": "vsys", "vsys": "vsys1",
})

# Get address objects (zones)
requests.get(f"{PA_URL}/Objects/Addresses", headers=HEADERS)
```

## Nmap Segmentation Test

```bash
# Test specific port reachability between zones
nmap -Pn -p 5432 --reason -oX segtest.xml 10.0.2.0/24

# Scan for open ports across zone boundary
nmap -sS -p 1-1024 --open -oG - 10.0.2.0/24 | grep "open"
```

## AWS Security Group Analysis

```python
import boto3

ec2 = boto3.client("ec2")

# Get all security groups
sgs = ec2.describe_security_groups()["SecurityGroups"]
for sg in sgs:
    for rule in sg["IpPermissions"]:
        print(sg["GroupId"], rule.get("FromPort"), rule.get("IpRanges"))
```

## Segmentation Test Data Contract

```python
@dataclass
class SegmentationRule:
    """
    Fields:
        src_zone: Source network zone name
        dst_zone: Destination network zone name
        allowed_ports: List of TCP/UDP ports permitted
        protocol: tcp | udp | icmp
        expected: allow | deny — expected connectivity state
    """
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All segmentation controls validated |
| 1 | Policy drift detected — review violations |
| 2 | Segmentation test infrastructure failure |
