Hello,
I noticed something that is troubling me, I would like to have your point of view on it.
Basically, in the logs of a netconf client, I had something like this:
Received message: <notification xmlns="urn:ietf:params:xml:ns:netconf:notification:1.0">
<eventTime>2026-09-04T11:05:26.727515058+00:00</eventTime>
<netconf-config-change xmlns="urn:ietf:params:xml:ns:yang:ietf-netconf-notifications">
<changed-by>
<username>####</username>
<session-id>0</session-id>
</changed-by>
<datastore>running</datastore>
<edit>
<target xmlns:ncs="urn:ietf:params:xml:ns:yang:ietf-netconf-server">
/ncs:netconf-server/ncs:call-home/ncs:netconf-client[ncs:name='client']/ncs:reconnect-strategy/ncs:max-wait</target>
<operation>replace</operation>
</edit>
<edit>
<target xmlns:ncs="urn:ietf:params:xml:ns:yang:ietf-netconf-server">
/ncs:netconf-server/ncs:call-home/ncs:netconf-client[ncs:name='client']/ncs:reconnect-strategy/ncs:max-attempts</target>
<operation>replace</operation>
</edit>
</netconf-config-change>
</notification>
Received an invalid message (Invalid instance-identifier "/ncs:netconf-server/ncs:call-home/ncs:netconf-client[ncs:name='client']/ncs:reconnect-strategy/ncs:max-wait" value - semantic error: No module connected with the prefix "ncs" found (prefix format XML prefixes).)So, this error can be expected because the netconf client doesn't implement the ietf-netconf-server module, and as such doesn't know this prefix.
So I tried using NACM to deny the netconf-server, module, but still, the "netconf-config-change" were sent about the module which is denied for the user.
For me, the netconf client shouldn't complain about this message, maybe only log a warning about it.
But should netopeer2 emit these netconf-config-change notification for module that the user is denied access to ?
I checked in the RFC and it's not very clear, it seems to specify only the behavior for the top level notification behavior; Which is blocked only if the module itself is blocked. But this is not possible in my case, because the netconf-config-change is needed.
Hello,
I noticed something that is troubling me, I would like to have your point of view on it.
Basically, in the logs of a netconf client, I had something like this:
So, this error can be expected because the netconf client doesn't implement the ietf-netconf-server module, and as such doesn't know this prefix.
So I tried using NACM to deny the netconf-server, module, but still, the "netconf-config-change" were sent about the module which is denied for the user.
For me, the netconf client shouldn't complain about this message, maybe only log a warning about it.
But should netopeer2 emit these netconf-config-change notification for module that the user is denied access to ?
I checked in the RFC and it's not very clear, it seems to specify only the behavior for the top level notification behavior; Which is blocked only if the module itself is blocked. But this is not possible in my case, because the netconf-config-change is needed.