Network Configuration Protocol (NETCONF) Base Notifications
Extracted elements (22)
These notifications pertain to configuration and monitoring portions of the managed system, not the entire system. The scope is deliberately limited to events directly related to NETCONF protocol operation and management sessions, keeping the module focused and avoiding overlap with broader system event frameworks.
The notifications defined here are intended for use within the 'NETCONF' event stream defined in RFC 5277. Clients subscribe to this stream using the RFC 5277 subscription mechanism; the module does not define its own subscription protocol.
A NETCONF server MUST report events that are directly related to the NETCONF protocol. A server MAY report events for non-NETCONF management sessions, using the 'session-id' value of zero.
A NETCONF session MUST be identified by a non-zero session-id value. A non-NETCONF session MAY be identified by the value zero.
An edit record SHOULD be present for each distinct edit operation that the server has detected on the target datastore. This list MAY be omitted if the detailed edit operations are not known.
The lowest NETCONF layer is the secure transport layer and the mandatory-to-implement secure transport is SSH, as defined in RFC 6242. Access to the notifications in this module MUST be controlled via the secure transport.
Within the edit list, a server SHOULD set the 'target' object to the node within the datastore that is being altered, and MUST set the 'operation' object to the NETCONF edit operation performed on the target datastore.
The 'changed-by-parms' grouping contains a 'changed-by' container with a mandatory choice between an empty 'server' leaf (internal action) and a 'by-user' case using common-session-parms (management session). This grouping is reused in netconf-config-change and netconf-capability-change.
The 'common-session-parms' grouping identifies a management session with three leaves: 'username' (mandatory string), 'session-id' (mandatory nc:session-id-or-zero-type), and optional 'source-host' (inet:ip-address). It is reused across session-start, session-end, and confirmed-commit notifications.
The 'netconf-capability-change' notification is generated when server capabilities change. It carries changed-by-parms and three leaf-lists of URI type: 'added-capability', 'deleted-capability', and 'modified-capability' (a modified capability has the same base URI but changed parameters; the full new URI is returned).
The 'netconf-config-change' notification is generated when the <running> or <startup> datastore is changed by a management session. It carries changed-by-parms, a 'datastore' leaf (enumeration: running/startup, default running), and a repeating 'edit' list with 'target' (instance-identifier) and 'operation' (nc:edit-operation-type) leaves.
The 'netconf-confirmed-commit' notification includes a conditional 'timeout' leaf (uint32, seconds) present only when confirm-event is 'start' or 'extend', indicating the approximate seconds until a 'timeout' event may occur. The common-session-parms are included for all events except 'timeout'.
The 'netconf-session-end' notification is generated when a NETCONF session terminates. In addition to common-session-parms, it carries an optional 'killed-by' leaf (session-id-type, present only when termination-reason='killed') and a mandatory 'termination-reason' enumeration: closed, killed, dropped, timeout, bad-hello, other.
The 'netconf-session-start' notification is generated when a NETCONF session starts. It carries only common-session-parms (username, session-id, source-host). A server MAY generate this for non-NETCONF management sessions.
The YANG module 'ietf-netconf-notifications' (namespace urn:ietf:params:xml:ns:yang:ietf-netconf-notifications, prefix ncn) defines five event notifications for use within the 'NETCONF' stream, accessible via the RFC 5277 subscription mechanism. It imports types from ietf-netconf (RFC 6241) and ietf-inet-types (RFC 6021).
This document registers the XML namespace URI 'urn:ietf:params:xml:ns:yang:ietf-netconf-notifications' in the IETF XML registry (RFC 3688). Registrant contact is the IESG.
This document registers the YANG module name 'ietf-netconf-notifications' with prefix 'ncn' and namespace 'urn:ietf:params:xml:ns:yang:ietf-netconf-notifications' in the YANG Module Names registry defined in RFC 6020.
Session-related notifications (netconf-session-start, netconf-session-end) expose username and source-host for each management session. The session-start event can alert an attacker that a concurrent session is editing an unlocked datastore; the session-end event signals that datastore changes may have been committed.
The netconf-capability-change notification exposes which capability URIs were added, deleted, or modified. An attacker who understands specific capability URI strings (e.g., a packet-capture monitoring capability) could use this to identify attack vectors or eavesdropping opportunities on the device.
The netconf-config-change notification reveals that system configuration has changed, which specific nodes were altered, whether the server or a named user caused the change (with username, session-id, source-host), which datastore was affected, and the specific edit operations performed—information that could help an attacker identify newly introduced vulnerabilities.
The netconf-confirmed-commit notification reveals that the <running> datastore may be changing or has changed; the 'timeout' leaf discloses when a future automatic revert to an older configuration will occur, which could be exploited by an attacker timing an attack to coincide with that revert.
The 'netconf-confirmed-commit' notification models the confirmed-commit procedure with five states via the mandatory 'confirm-event' enumeration: 'start' (procedure initiated), 'cancel' (canceled by session termination or <cancel-commit>), 'timeout' (confirm-timeout expired; no session params present), 'extend' (timeout extended by new <confirmed-commit>), 'complete' (procedure finished).