Transaction/set hook handler

General
1

Within a container, if i wanted to change one parameter of command B(internally) when command A(user entered) of same container is changed, which hook to be used

or When to use sethook and when to use transaction hook?
Both seem to be working for our case, (just asking which one is best / must to use in this case)

Also, does NACM gets honored for command B as well in both the hooks?

2

Hooks and the difference between the set and transaction hooks are thuroughly explained in the ConfD UG section “Hooks”. There are also multiple examples in the ConfD example set that use hooks. E.g. examples.confd/intro/python/11-hooks. NACM is honored.

3

Thanks for your response. But i have below query. can you pls respond?

Keypath1: /interfaces/interface{eth-1/1}
Keypath2: /protocols/protocol{eth-1/1} (this is leaf ref of previous command)

Whenever keypath1 is created, keypath2 will get hit through set-hook and creates entry in DB.

We have NACM rule written for
keypath1 to be allowed(level-3) and
keypath2 to be denied (for level-3 user).

But when we execute this command (keypath1) via NETCONF for level3, NACM rule gets honored for keypath2 and command gets denied. This happens only for NETCONF and not for CLI.

keypath2 is something gets set only through set-hook, AAA rule should not get ideally applied here as it gets set via set-hook.
Do we have any confd issue for this?

4

Sorry, I have to correct my statement:

From the ConfD UG:

• A hook can use maapi to modify config elements that the operator is not allowed to modify directly, according to the active aaa rule set.

This applies to CLI, NETCONF, etc.