Re: [Netconf] [SPAM?] RE: LC on subscribed-notifications-10

[Randy Presuhn <[e-mail]>]

Hi -

On 3/18/2018 2:59 AM, [e-mail] wrote:
> Yes.  Conceptually, it is cleanest to apply the filter on the event 
> contents with each update.  At the same time, in the interest of 
> performance, Andy and others have raised the issue of performance 
> penalty if every update has to be subjected to a filter.  One option is 
> for an implementation to simply reject a subscription if there is a 
> chance that it might contain information that would have to be filtered 
> (i.e. do the NACM check at the time the subscription is created), and in 
> case of NACM changes later that might affect subscriptions, to terminate 
> the subscription (and let users resubscribe).

This would increase the cost of NACM configuration changes (probably
not a big deal, but it means hooks between NACM and the notification
subsystem are needed so NACM would be able to let the notification
stuff know it needs to re-evaluate some of its subscriptions) and
would potentially leak information to other users about the fact that
the security administrator is making NACM configuration changes, even
if nothing is happening that would otherwise expose the fact that
the change has taken place.

Randy