Re: [netconf] Roman Danyliw's Discuss on draft-ietf-netconf-netconf-event-notifications-20: (with DISCUSS)

["Eric Voit (evoit)" <[e-mail]>]

Hi Roman,

Thanks for the review.   A thought in-line...

> From: Roman Danyliw, May 15, 2019 3:33 PM
>
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> An easy to fix issue.
> 
> Section 8.  I agree with the brevity of this section as the more detailed
> considerations can be found in [draft-ietf-netconf-subscribed-notifications].
> [draft-ietf-netconf-subscribed-notifications] has a similar statement about
> buggy subscribers, but also makes a SHOULD statement about operators
> monitoring for odd behavior.  This text doesn’t include this monitoring
> recommendation but does explicitly discuss terminating sessions.  Could the text
> in these two sections please be reconciled. Perhaps with a reference such as:
> 
> “This document does not introduce additional Security Considerations for
> dynamic subscriptions beyond those discussed in [draft-ietf-netconf-subscribed-
> notifications].  In particular for NETCONF subscribers …<use the current text> ”

I think what you are looking for is something like:
"This document does not introduce additional Security Considerations for dynamic subscriptions beyond those discussed in [draft-ietf-netconf-subscribed-notifications].  But there is one consideration worthy of more refinement based on the connection oriented nature of the NETCONF protocol.  Specifically, if a buggy or compromised NETCONF subscriber sends a number of "establish-subscription" requests, then these subscriptions accumulate and may use up system resources. In such a situation, subscriptions MAY be terminated by terminating the underlying NETCONF session... "

If this text works for you, I will add it in.

Eric