[Netconf] notification access control

[Andy Bierman <andy at netconfcentral.com>]

Hi,

I know I keep complaining about the lack of a coherent
ACM in NETCONF, but the presumption of a completely
unspecified access control in this RFC is problematic.

3.2, para 4:

   After generation of the <notification> element, access control is
   applied by the server.  If a session does not have permission to
   receive the <notification>, then it is discarded for that session,
   and processing of the internal event is completed for that session.

Without any actual ACM, what does 'permission' really mean?

Why is there a presumption that data delivered to a session
via <get> should have a different ACM architecture than data
delivered to the exact same session via <notification>?

The RFC never says the agent MUST make an all-or-nothing
decision wrt/ granting permission to deliver the notification.
What if access control is enforced at a lower level,
in the XML generation, so no matter what RPC method is
trying to access /path/to/secret-password, they can't?

I will assume an implementation may silently prune
parts of the payload from the notification, due to access
control policy.  The notification MUST be dropped
if the <eventType> element would be filtered out,
in violation of the <notification> element schema.


Andy