Re: [Netconf] [SPAM?] RE: LC on subscribed-notifications-10

["Sterne, Jason (Nokia - CA/Ottawa)" <[e-mail]>]

About "hooks between NACM...".  That may be possible in a system where NACM rules/processing and subscription handling are integrated (i.e. on the same box), but what if authorization rules are located on a remote TACACS+ or RADIUS server ?

> -----Original Message-----
> From: Netconf [mailto:[e-mail]] On Behalf Of Randy Presuhn
> Sent: Sunday, March 18, 2018 10:16 PM
> To: [e-mail]
> Subject: Re: [Netconf] [SPAM?] RE: LC on subscribed-notifications-10
> 
> Hi -
> 
> On 3/18/2018 2:59 AM, [e-mail] wrote:
> > Yes.  Conceptually, it is cleanest to apply the filter on the event
> > contents with each update.  At the same time, in the interest of
> > performance, Andy and others have raised the issue of performance
> > penalty if every update has to be subjected to a filter.  One option is
> > for an implementation to simply reject a subscription if there is a
> > chance that it might contain information that would have to be filtered
> > (i.e. do the NACM check at the time the subscription is created), and in
> > case of NACM changes later that might affect subscriptions, to terminate
> > the subscription (and let users resubscribe).
> 
> This would increase the cost of NACM configuration changes (probably
> not a big deal, but it means hooks between NACM and the notification
> subsystem are needed so NACM would be able to let the notification
> stuff know it needs to re-evaluate some of its subscriptions) and
> would potentially leak information to other users about the fact that
> the security administrator is making NACM configuration changes, even
> if nothing is happening that would otherwise expose the fact that
> the change has taken place.
> 
> Randy
> 
> _______________________________________________
> Netconf mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/netconf