#2271 Varbinds OID doesn't match matched OID (embedded perl)

open
nobody
None
5
2012-11-08
2011-08-03
No

I found an issue with snmptrapd and embedded perl in net-snmp-5.4.2.1-r4 in Gentoo.

The issue is that, when registering a receiver using NetSNMP::TrapReceiver::register, the registered function isn't called when the OID is received. In this case, the OID on the wire (viewed with tcpdump) appears as something like:

14:34:23.459820 IP switch.52571 > nms.162: C=string Trap(108) .1.3.6.1.4.1.9.9.315.0 10.111.12.24 enterpriseSpecific s=1 1169848564 .1.3.6.1.2.1.2.2.1.1.23=23 .1.3.6.1.2.1.2.2.1.2.23="FastEthernet0/23" .1.3.6.1.4.1.9.9.315.1.2.1.1.10.23=00_1d_e0_76_0e_fb

Also, in wireshark, it is listed as a V1 trap.

When using the perldoc sample embedded perl trap printing (where VARBINDS is printed verbatim), the following output is generated (for a similar packet):

PDU INFO:
notificationtype TRAP
receivedfrom UDP: [switch]:52571->[nms]
version 0
errorstatus 0
messageid 0
community string
transactionid 25
errorindex 0
requestid 0
VARBINDS:
DISMAN-EVENT-MIB::sysUpTimeInstance type=67 value=Timeticks: (1169873677) 135 days, 9:38:56.77
SNMPv2-MIB::snmpTrapOID.0 type=6 value=OID: SNMPv2-SMI::enterprises.9.9.315.0.0.1
IF-MIB::ifIndex.23 type=66 value=Gauge32: 23
IF-MIB::ifDescr.23 type=4 value=STRING: "FastEthernet0/23"
SNMPv2-SMI::enterprises.9.9.315.1.2.1.1.10.23 type=4 value=Hex-STRING: 00 1D E0 76 0E FB
SNMP-COMMUNITY-MIB::snmpTrapAddress.0 type=64 value=IpAddress: switch
SNMP-COMMUNITY-MIB::snmpTrapCommunity.0 type=4 value=STRING: "string"
SNMPv2-MIB::snmpTrapEnterprise.0 type=6 value=OID: SNMPv2-SMI::enterprises.9.9.315.0

Note that it claims "SNMPv2-MIB::snmpTrapOID.0" is "SNMPv2-SMI::enterprises.9.9.315.0.0.1".

The problem arises when I try to register a handler for "SNMPv2-SMI::enterprises.9.9.315.0.0.1" because it doesn't actually get called for the traps as described above. Instead, the appropriate OID to register for is "SNMPv2-SMI::enterprises.9.9.315.0.1" but I can't remember if I guessed this OID or what (woops).

Discussion

  • Robert Story

    Robert Story - 2011-08-03

    a few more tidbits:
    - netsnmp_trapd_auth() contains the comment 'convert to v2 so we can check it in a consistent manner'.
    - v1 -> v2c trap conversion covered in rfc 1902, section 3.1.2, step 2 and rfc 2089, section 3.3, step 2.c
    - based on actual trap oid ending with 315.0, matching want 315.0.1, but perl handler gets 315.0.0.1, I'm guessing that the conversion is happening twice for some reason..

    Brian, any chance you can download the source for 5.6.1.1 (or 5.7.1.pre1 if it's out yet) and see if the problem persists there?

     
  • Brian De Wolf

    Brian De Wolf - 2011-08-04

    I downloaded both 5.7 and 5.6.1.1 from the website, built them in /tmp, and VARBINDS lists the 315.0.0.1 OID still in both of them.

     

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:





No, thanks