Re: [Netconf] notification access control

["Randy Presuhn" <randy_presuhn at mindspring.com>]

Hi -

> From: "Andy Bierman" <andy at netconfcentral.com>
> To: "Phil Shafer" <phil at juniper.net>
> Cc: "NETCONF" <netconf at ietf.org>
> Sent: Wednesday, June 17, 2009 1:17 PM
> Subject: Re: [Netconf] notification access control
...
> The all-or-nothing approach actually helps hackers.
> If there is no filter, then any dropped notification
> would stick out like a red flag, since it must have
> contained some sensitive data. (This works just
> by watching the traffic with wireshark, without
> actually being able to read any of the packets.)
> We should want to make it as difficult as possible
> to discover the access control policy in use on an agent.

I have a couple of problems with this line of reasoning.

(1) hiding the policy is probably not as important as
protecting the information covered by that policy.

(2) selective removal of elements from the payload
can still permit semantic leaks.  Consider something
analogous to a "linkUp" notification.  For a particular
interface, the payload might be supressed by such a
policy, but the notification would still be delivered to
a party that wasn't supposed to know what was going
on with that interface.  If that was the only interface
which would meet the subscription's criteria, then
even surpressing the payload doesn't prevent the
information leak.

Randy