Re: [Netconf] notification access control

[Andy Bierman <andy at netconfcentral.com>]

Martin Bjorklund wrote:
> Andy Bierman <andy at netconfcentral.com> wrote:
> > The all-or-nothing approach actually helps hackers.
> > If there is no filter, then any dropped notification
> > would stick out like a red flag, since it must have
> > contained some sensitive data. (This works just
> > by watching the traffic with wireshark, without
> > actually being able to read any of the packets.)
>
> How would a hacker know that a notification was *not* sent by watching
> the traffic?

by watching traffic patterns (when multiple subscriptions
are active).


> I don't care that much if the entire notif is dropped, or some element
> is pruned, but the current spec is pretty clear - the notification
> MUST be dropped.  So a 5277 compliant server cannot prune
> elements from the notifications.

I don't think the RFC says that anywhere.
There is just the vague text about granting
permission.  IMO, that meant that the manager
has permission to see the <eventType> element,
but it does not mean the entire payload is going
to be delivered, if ACM policy decides otherwise.

What if the ACM rule is simply:  deny "//secret-stuff".
What if the ACM defines 'deny on read access' to mean prune?
(And what about applying access control to 'anyxml'
nodes, like a subtree <filter>?)

> /martin

Andy