Subject: [Netconf] Access control on yang-push notifications

From: Balazs Lengyel <[email-masked]>
Date: Thu, 28 Apr 2016 16:35:30 +0200

Hello,
RFC 6536 states:
"Configuration of access control rules specifically for descendant nodes 
of the notification event type element are outside the scope of this 
document."

draft-ietf-netconf-yang-push-02 states:
"A push update notification contains several parameters:

- A data node that contains a representation of the datastore subtree 
containing the updates. The subtree is filtered per access control rules 
to contain only data that the subscriber is authorized to see."

IMHO these to contradict. Will we update RFC6536? We should.
regards Balazs

-- 
Balazs Lengyel                       Ericsson Hungary Ltd.
Senior Specialist
ECN: 831 7320
Mobile: +36-70-330-7909              email: [email-masked]

---

From: Andy Bierman <[email-masked]>
Date: Thu, 28 Apr 2016 08:57:30 -0700

On Thu, Apr 28, 2016 at 7:35 AM, Balazs Lengyel <[email-masked]
> wrote:

> containing the updates. The subtree is filtered per access control rules to
> contain only data that the subscriber is authorized to see."
>

The reason NACM only supports limited processing of notifications is to
make it easier to implement with high performance.  There was consensus
that fine-grained access control was not needed for notifications or RPC
parameters.

IMO the access control for YANG push should be simple, and it should
be checked at subscribe-time.  The receiver must have read permission
for the subscribed node and all descendants or the subscription request is
rejected.

If the NACM config changes so that complete subtree read permission is no
longer true,
then the subscription is dropped by the server.

regards Balazs

Andy

> _______________________________________________
> Netconf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/netconf
>