net-snmp-coders — Discussion of internal project coding (Please use this OR -users, NOT both!)

Securing snmpd.conf files

[Vivek A. <viv...@gm...>]

Hi

Is there a way to encrypt passwords in the snmpd.conf file? Currently, when
we open snmpd.conf file we can look at passwords in plaintext format, is
there a way to store those passwords in encrypted form. Does net-snmp
support any encryption/decryption of passwords while reading from
snmpd.conf?

Secondly, if there is no such encryption/decryption mechanism available in
net-snmp, how can we secure the snmpd.conf file?

-- 
Warm Regards,
Vivek Aditya

Re: The fix for usm_free_usmStateReference()

[Wes H. <har...@us...>]

Hanh Nguyen <han...@gm...> writes:

> I'm new to the net-snmp community. I'm looking for the changes for bug  2923 -Avoid that
> snmpv3 bulkget errors result in a double free

Hi Hanh,

I'll look at this hopefully in the next 2 days.  Thanks for submitting
the patch.
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: snmpwalk timeout

[Wes H. <har...@us...>]

Feroz <fer...@gm...> writes:

> For a given MIB, our container_load function takes 2 seconds, but
> still the snmpwalk (v2) command times out with default values (5
> retries with 1 sec delay between each retry).

The others have stated this already, but one additional point: it's not
just the port and address that snmpwalk is looking for.  There is also
the SNMP packets also contain a request-id that is not duplicated in the
retries.  So each request will look new and will be processed as if new
even though the ports and addresses themselves may be the same.

[Caching, as others have said, will help]
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: snmpwalk timeout

[Feroz <fer...@gm...>]

Hi Patrik,
My response has two parts.


*Part 1:*
In the following tcpdump I see the same source port being used by the
client i.e 39813 for all the get-next requests.
Moreover the agent has responded approximately at the 4th second i.e at
12:10:25.862408.
So, the 6th GetNextRequest should have worked (Assuming the cache is
loaded, refer part 2 below for query on cache).

8360:/home/admin# snmpwalk -v2c -c public localhost iso.3.6.1.2.1.4.24.7
12:10:21.516747 IP localhost.localdomain.39813 >
localhost.localdomain.snmp:  GetNextRequest(28)  ip.24.7
12:10:22.517747 IP localhost.localdomain.39813 >
localhost.localdomain.snmp:  GetNextRequest(28)  ip.24.7
12:10:23.518833 IP localhost.localdomain.39813 >
localhost.localdomain.snmp:  GetNextRequest(28)  ip.24.7
12:10:24.519913 IP localhost.localdomain.39813 >
localhost.localdomain.snmp:  GetNextRequest(28)  ip.24.7
12:10:25.520992 IP localhost.localdomain.39813 >
localhost.localdomain.snmp:  GetNextRequest(28)  ip.24.7
12:10:25.862408 IP localhost.localdomain.snmp >
localhost.localdomain.39813:  GetResponse(41)
 ip.24.7.1.7.1.4.2.0.1.0.24.0.0.0=7
12:10:26.521730 IP localhost.localdomain.39813 >
localhost.localdomain.snmp:  GetNextRequest(28)  ip.24.7
Timeout: No Response from localhost
8360:/home/admin#
12:10:27.720032 IP localhost.localdomain.snmp >
localhost.localdomain.39813:  GetResponse(41)
 ip.24.7.1.7.1.4.2.0.1.0.24.0.0.0=7
12:10:27.720051 IP localhost.localdomain > localhost.localdomain: ICMP
localhost.localdomain udp port 39813 unreachable, length 92
12:10:29.626460 IP localhost.localdomain.snmp >
localhost.localdomain.39813:  GetResponse(41)
 ip.24.7.1.7.1.4.2.0.1.0.24.0.0.0=7
12:10:29.626479 IP localhost.localdomain > localhost.localdomain: ICMP
localhost.localdomain udp port 39813 unreachable, length 92
12:10:31.458726 IP localhost.localdomain.snmp >
localhost.localdomain.39813:  GetResponse(41)
 ip.24.7.1.7.1.4.2.0.1.0.24.0.0.0=7
12:10:31.458746 IP localhost.localdomain > localhost.localdomain: ICMP
localhost.localdomain udp port 39813 unreachable, length 92
12:10:33.268019 IP localhost.localdomain.snmp >
localhost.localdomain.39813:  GetResponse(41)
 ip.24.7.1.7.1.4.2.0.1.0.24.0.0.0=7
12:10:33.268038 IP localhost.localdomain > localhost.localdomain: ICMP
localhost.localdomain udp port 39813 unreachable, length 92
12:10:35.085520 IP localhost.localdomain.snmp >
localhost.localdomain.39813:  GetResponse(41)
 ip.24.7.1.7.1.4.2.0.1.0.24.0.0.0=7
12:10:35.085539 IP localhost.localdomain > localhost.localdomain: ICMP
localhost.localdomain udp port 39813 unreachable, length 92
8360:/home/admin#


*Part 2:*
If you look at:
void ifTable_container_init(netsnmp_container **container_ptr_ptr,
netsnmp_cache * cache)

We have a cache timeout of 3sec (in our implementation its 30 sec)

 cache->timeout = IFTABLE_CACHE_TIMEOUT;     /* seconds */

My question is at "12:10:25.862408", the cache should have been loaded with
the required data, so the last retry (12:10:26.521730) should have returned
the data from the cache.
But what we are observing is the time difference between subsequent
request-response is increasing, it looks like the agent is not returning
data from cache after the first response. (For the last retry it took
approximately 9sec)

Note that for retries R2-R5 container_load() function will not be called.


On Thu, May 5, 2022 at 4:06 PM Patrik Arlos <pat...@gm...> wrote:

> Hej,
>
> My 2c is:
> 1. (T=0) Request being sent, timeout set 1s. Request comes from
> IPsrc:PortSrc, PortSrc is an ephemeral port selected by the OS.
> 2. (T=0+network travel time(ntt)) Request received, request delegated to
> thread/worker. Starts loading.
> 3. (T=0+1) Timeout occurs on sender side. Socket returns, with an error
> (ETIMEOUT|EWOULDBLOCK or whatever flavor signaling scheme is used).
> 4. (T=1+processing time) A retry is triggered, and a new request is sent.
> This will come from IPsrc:PortSrc+X, X being a random number from 1 and up.
> 5. (T=1+ntt), Request is received, delegated to thread/worker. Starts
> loading. Note, NEW worker/thread.
> 6. (T=0+ntt+loading time 2s) Reply is sent to IPsrc:PortSrc.
> 7. (T=0+ntt+loading time 2s+ntt) Reply (6) is received at source, but
> socket PortSrc is in a blocked state (the application that would receive it
> isn't associated port anymore).
> .. then this repeats.
>
> The only thing you can do to mitigate this (on the agent side) is to speed
> up the loading. Either just plain faster, or caching the loaded information
> somehow, so that the reply can be triggered directly, without loading for t
> time-units. Then refresh the information periodically, so that the returned
> information is as 'stale' as possible.
>
> BR/Patrik
>
> ps. use wireshark/tcpdump to see if you can see the reply at 6.. ds
>
> Den tors 5 maj 2022 kl 09:14 skrev Feroz <fer...@gm...>:
>
>> Hi,
>> We are using net-snmp 5.8.
>> We have Agent-SubAgent model.
>>
>> For a given MIB, our container_load function takes 2 seconds, but still
>> the snmpwalk (v2) command times out with default values (5 retries with 1
>> sec delay between each retry).
>>
>> My question is, why does it time out, though the container_load function
>> returns the data in 2sec, we still have another 4 seconds.
>> We should have got the response in the 3rd to 5th retry.
>>
>> If I increase the timeout value in snmpwalk command with "-t 3", it works
>> fine.
>> --
>> Regards,
>> Feroz Ahmed
>> _______________________________________________
>> Net-snmp-users mailing list
>> Net...@li...
>> Please see the following page to unsubscribe or change other options:
>> https://lists.sourceforge.net/lists/listinfo/net-snmp-users
>>
>

-- 
Regards,
Feroz Ahmed

Re: snmpwalk timeout

[Craig S. <cs...@dr...>]

Hi,
  The default setup with 5 retries and 1 second delay would work if the
function works across requests. My guess is that the third request cannot
use the data from the first request.

The timeline would be something like (with a second gap between each line)
T0 - Request #1 - function #1 starts
T1 - Request #2 - function #2 starts - request #1 times out
T2 - Request #3 - function #3 starts - request #2 times out
T3 - Request #4 - function #4 starts - request #3 times out - function #1
responds to request #1 but it is ignored because that request timed out
T4 - Request #5 - function #5 starts - request #4 times out - function #2
responds to request #2 but it is ignored because that request timed out

You either want the function to work across requests or increase the
timeout or run the function once and share the result.

T0 - Request #1 - function starts
T1 - Request #2 - function not started as its running - request #1 times out
T2 - Request #3 - function not started as its running - request #2 times out
T3 - Request #4 - function not started as its running - we have a result!
return it for request 4 and cache it!

Which way you go depends on how expensive the function is and how fresh the
data needs to be. If you know you are polling once every 5 minutes you
could just run the function in cron every 5 minutes; the data might be up
to slightly less than 5 minutes old.

 - Craig


On Thu, 5 May 2022 at 17:12, Feroz <fer...@gm...> wrote:

> Hi,
> We are using net-snmp 5.8.
> We have Agent-SubAgent model.
>
> For a given MIB, our container_load function takes 2 seconds, but still
> the snmpwalk (v2) command times out with default values (5 retries with 1
> sec delay between each retry).
>
> My question is, why does it time out, though the container_load function
> returns the data in 2sec, we still have another 4 seconds.
> We should have got the response in the 3rd to 5th retry.
>
> If I increase the timeout value in snmpwalk command with "-t 3", it works
> fine.
> --
> Regards,
> Feroz Ahmed
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>

snmpwalk timeout

[Feroz <fer...@gm...>]

Hi,
We are using net-snmp 5.8.
We have Agent-SubAgent model.

For a given MIB, our container_load function takes 2 seconds, but still the
snmpwalk (v2) command times out with default values (5 retries with 1 sec
delay between each retry).

My question is, why does it time out, though the container_load function
returns the data in 2sec, we still have another 4 seconds.
We should have got the response in the 3rd to 5th retry.

If I increase the timeout value in snmpwalk command with "-t 3", it works
fine.
-- 
Regards,
Feroz Ahmed

The fix for usm_free_usmStateReference()

[Hanh N. <han...@gm...>]

Hi,

I'm new to the net-snmp community. I'm looking for the changes for bug  2923
-Avoid that snmpv3 bulkget errors result in a double free


I downloaded net-snmp-5.9.1. The ChangeLog indicates that the fix is in
net-snmp-5.9.1. Sam Tannous posted the v3doublefree2.patch in the
discussion thread - https://sourceforge.net/p/net-snmp/bugs/search/?q=2923.


I checked the changes in the v3doublefree2.patch and the net-snmp-5.9.1
source code. They don't seem to match.


Any idea how I can find the commit for this fix?


Thanks in advance for any suggestions.

Hanh

Re: multiple subagent with same set of oid.

[Craig S. <cs...@dr...>]

On Wed, 27 Apr 2022 at 12:30, Paban Agarwalla <pab...@gm...>
wrote:

> Would you please share some examples of context?
>
> snmpd.examples has some good, well, examples but a way of using contexts
for overlapping OIDs is below. This is for two agents using the proxy
method as its easier to see the results.
This is a pretty wide access control so you would want to tighten it up in
prod.

The mapping is, no matter the OID:
127.0.0.1(public1) proxy to 127.0.0.11(public11)
127.0.0.1(public2) proxy to 127.0.0.12(public12)

com2sec -Cn ctx1 sec1 default public1
com2sec -Cn ctx2 sec1 default public2
proxy -Cn ctx1 -v 1 -c public11 127.0.0.11 .1.3
proxy -Cn ctx2 -v 1 -c public12 127.0.0.12 .1.3
group proxygrp v1 sec1
view    all     included        .1
access  proxygrp        ctx1    any     noauth  exact   all     none    none
access  proxygrp        ctx2    any     noauth  exact   all     none    none

Cut down wireshark output:
$ sudo tshark -i lo -f 'src 127.0.0.1 and udp port 161' -Osnmp -l
2>/dev/null | egrep '(Internet Protocol|Simple|community:|Object Name:|^$)'
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Simple Network Management Protocol
    *community: public1*
                    Object Name: 1.3.6.1.4.1.42 (iso.3.6.1.4.1.42)

Internet Protocol Version 4, Src: 127.0.0.1, *Dst: 127.0.0.11*
Simple Network Management Protocol
    *community: public11*
                    Object Name: 1.3.6.1.4.1.42 (iso.3.6.1.4.1.42)

and the second one:
Internet Protocol Version 4, Src: 127.0.0.1, Dst: 127.0.0.1
Simple Network Management Protocol
    *community: public2*
                    Object Name: 1.3.6.1.4.1.42 (iso.3.6.1.4.1.42)

Internet Protocol Version 4, Src: 127.0.0.1, *Dst: 127.0.0.12*
Simple Network Management Protocol
   * community: public12*
                    Object Name: 1.3.6.1.4.1.42 (iso.3.6.1.4.1.42)

Same OID, different communities map internally to different contexts and
therefore to different remote proxy hosts.

 - Craig

Re: multiple subagent with same set of oid.

[Paban A. <pab...@gm...>]

Hi Wes,

Would you please share some examples of context?

Regards
Paban



On Fri, Apr 22, 2022 at 4:10 AM Wes Hardaker <har...@us...>
wrote:

> Paban Agarwalla <pab...@gm...> writes:
>
> > We are using to Netsnmp to collect statistics from our device.
> >
> > We are registering multiple subagents with the same set of oids.
> >
> > can i get all sub agent statastics using the same oid with v2c/v1 snmp
> > host?
>
> The only way to deal with problems like that is to use SNMPv3 contexts,
> where each context can map to a different subagent with overlapping OID
> registrations.  You can make v1/v2c communities to v3 contexts using the
> com2sec configuration tokens if you wish.
>
> --
> Wes Hardaker
> Please mail all replies to net...@li...
>

Re: multiple subagent with same set of oid.

[Paban A. <pab...@gm...>]

Hi Bill,

Would you please share the patch?

Regards
Paban

On Sun, Apr 24, 2022 at 10:13 PM Bill Fenner <fe...@gm...> wrote:

> If there's interest, I have a patch that allows communities of the form
> "community@context" to be treated by the snmp agent as separate community
> and context values, eliminating the need to define each combination as a
> valid community, and use com2sec to do the mapping.
>
> I hadn't upstreamed it previously because it would change the behavior for
> anyone who had an "@" in their community string.  Obviously giving it a
> configuration file entry to turn this behavior on would probably address
> that concern.
>
>   Bill
>
>
> On Thu, Apr 21, 2022 at 3:41 PM Wes Hardaker via Net-snmp-coders <
> net...@li...> wrote:
>
>> Paban Agarwalla <pab...@gm...> writes:
>>
>> > We are using to Netsnmp to collect statistics from our device.
>> >
>> > We are registering multiple subagents with the same set of oids.
>> >
>> > can i get all sub agent statastics using the same oid with v2c/v1 snmp
>> > host?
>>
>> The only way to deal with problems like that is to use SNMPv3 contexts,
>> where each context can map to a different subagent with overlapping OID
>> registrations.  You can make v1/v2c communities to v3 contexts using the
>> com2sec configuration tokens if you wish.
>>
>> --
>> Wes Hardaker
>> Please mail all replies to net...@li...
>>
>>
>> _______________________________________________
>> Net-snmp-coders mailing list
>> Net...@li...
>> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>>
>

Re: multiple subagent with same set of oid.

[Bill F. <fe...@gm...>]

If there's interest, I have a patch that allows communities of the form
"community@context" to be treated by the snmp agent as separate community
and context values, eliminating the need to define each combination as a
valid community, and use com2sec to do the mapping.

I hadn't upstreamed it previously because it would change the behavior for
anyone who had an "@" in their community string.  Obviously giving it a
configuration file entry to turn this behavior on would probably address
that concern.

  Bill


On Thu, Apr 21, 2022 at 3:41 PM Wes Hardaker via Net-snmp-coders <
net...@li...> wrote:

> Paban Agarwalla <pab...@gm...> writes:
>
> > We are using to Netsnmp to collect statistics from our device.
> >
> > We are registering multiple subagents with the same set of oids.
> >
> > can i get all sub agent statastics using the same oid with v2c/v1 snmp
> > host?
>
> The only way to deal with problems like that is to use SNMPv3 contexts,
> where each context can map to a different subagent with overlapping OID
> registrations.  You can make v1/v2c communities to v3 contexts using the
> com2sec configuration tokens if you wish.
>
> --
> Wes Hardaker
> Please mail all replies to net...@li...
>
>
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>

Net-SNMP 5.9.2.rc1 available for testing

[Wes H. <har...@us...>]

Greetings all,

An RC1 candidate is available for download and testing:

https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.2-pre-releases/

If there are no proposed changes to this, it'll be 5.9.2 next.  As a
reminder, in the RC phase of development, any proposed changes (from
anyone) must get 3 vote positive approvals on the -coders list to go
into a future release.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: multiple subagent with same set of oid.

[Wes H. <har...@us...>]

Paban Agarwalla <pab...@gm...> writes:

> We are using to Netsnmp to collect statistics from our device.
> 
> We are registering multiple subagents with the same set of oids.
> 
> can i get all sub agent statastics using the same oid with v2c/v1 snmp
> host?

The only way to deal with problems like that is to use SNMPv3 contexts,
where each context can map to a different subagent with overlapping OID
registrations.  You can make v1/v2c communities to v3 contexts using the
com2sec configuration tokens if you wish.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: net-snmp and openssl v3

[Wes H. <har...@us...>]

Craig Small <csmall@dropbear.xyz> writes:

> However, net-snmp v 5.9.1 doesn't have all of these yet. I can either
> try to pick the relevant ones out and patch the Debian package, or
> wait until 5.9.2 comes out. My question is, is there an idea when that
> would be?  My preference is to not patch as I'll be cherry-picking and
> might miss some subtle but important patch.

I'd expect 5.9.2 final to come out sometime in the next month.  I'll
push a another pre-release or rc1 this week.  There weren't that many
changes since pre1, so a rc1 is likely possible.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Net-SNMP 5.9.2.pre1 published for testing

[Wes H. <har...@us...>]

Craig Small <csmall@dropbear.xyz> writes:

> Anyway, the change was to add $(AGENTLIB) to the linker line for
> libnetsnmptrapd in apps/Makefile.in

When I looked in the apps/Makefile.in it looked to me that it already
had that in it -- can you provide an exact patch?  Maybe I misread where
you meant to apply it.
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Net-SNMP 5.9.2.pre1 published for testing

[Craig S. <cs...@dr...>]

Hello again,
  The issue was tied up with libtool and how Debian's is slightly
different. link_all_deplibs is set to no so you explicitly need to put the
libraries.
Anyway, the change was to add $(AGENTLIB) to the linker line for
libnetsnmptrapd in apps/Makefile.in

The result is I can Debian package linking to either libssl1.1 or libssl3
:)

libsnmp40_5.9.2~pre1+dfsg-1_amd64.deb
 Depends: libc6 (>= 2.33), libpci3 (>= 1:3.5.1), libperl5.34 (>= 5.34.0),
libsensors5 (>= 1:3.5.0), *libssl1.1* (>= 1.1.0), libwrap0 (>= 7.6-4~),
libsnmp-base
libsnmp40_5.9.2~pre1+dfsg-2_amd64.deb
 Depends: libc6 (>= 2.33), libpci3 (>= 1:3.5.1), libperl5.34 (>= 5.34.0),
libsensors5 (>= 1:3.5.0), *libssl3* (>= 3.0.1-1), libwrap0 (>= 7.6-4~),
libsnmp-base

 - Craig

multiple subagent with same set of oid.

[Paban A. <pab...@gm...>]

Hi,

We are using to Netsnmp to collect statistics from our device.

We are registering multiple subagents with the same set of oids.

can i get all sub agent statastics using the same oid with v2c/v1 snmp host?

Regards
Paban

Re: Net-SNMP 5.9.2.pre1 published for testing

[Craig S. <cs...@dr...>]

On Thu, 7 Apr 2022 at 07:11, Craig Small <csmall@dropbear.xyz> wrote:

> I'll run the source code through a standard Debian pbuilder and one with
> OpenSSL v3 added as well to check it works with both versions.
>
Standard Debian sid pbuilder came up with this error below.

convert_v1pdu_to_v2() and send_v2trap() are in agent/agent_trap.c

I'm trying to work out why this compile failed while the previous one
worked. It's either the Debian specific patches or the build flags.

So, some more investigation is needed; but if anyone has some ideas about
where to look that would be helpful.

 - Craig


libtool: compile:  gcc -I../include -I. -I../agent -I../agent/helpers
-I../agent/mibgroup -I../snmplib -I/usr/include/mariadb/ -Wdate-time
-D_FORTIFY_SOURCE=2 -g -O2
"-ffile-prefix-map=/build/net-snmp-5.9.2~pre1+dfsg=."
-fstack-protector-strong -Wformat -Werror=format-security
-DNETSNMP_USE_INLINE -DNETSNMP_ENABLE_IPV6 -fno-strict-aliasing
-DNETSNMP_REMOVE_U64 -g -O2
"-ffile-prefix-map=/build/net-snmp-5.9.2~pre1+dfsg=."
-fstack-protector-strong -Wformat -DNETSNMP_USE_INLINE -Ulinux
-Dlinux=linux -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fwrapv
-fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64 -I/usr/lib/x86_64-linux-gnu/perl/5.34/CORE -c
snmptrapd_sql.c -o snmptrapd_sql.o >/dev/null 2>&1
/bin/bash ../libtool  --mode=link gcc -g -O2
-ffile-prefix-map=/build/net-snmp-5.9.2~pre1+dfsg=.
-fstack-protector-strong -Wformat -Werror=format-security
-DNETSNMP_USE_INLINE -DNETSNMP_ENABLE_IPV6 -fno-strict-aliasing
-DNETSNMP_REMOVE_U64 -g -O2
-ffile-prefix-map=/build/net-snmp-5.9.2~pre1+dfsg=.
-fstack-protector-strong -Wformat  -DNETSNMP_USE_INLINE -Ulinux
-Dlinux=linux  -D_REENTRANT -D_GNU_SOURCE -DDEBIAN -fwrapv
-fno-strict-aliasing -pipe -I/usr/local/include -D_LARGEFILE_SOURCE
-D_FILE_OFFSET_BITS=64  -I/usr/lib/x86_64-linux-gnu/perl/5.34/CORE   -rpath
/usr/lib/x86_64-linux-gnu -version-info 41:0:2 -Wl,-no-undefined -o
libnetsnmptrapd.la snmptrapd_handlers.lo snmptrapd_log.lo snmptrapd_auth.lo
snmptrapd_sql.lo ../agent/libnetsnmpmibs.la -L/usr/lib/x86_64-linux-gnu/
-lmariadb ../snmplib/libnetsnmp.la  -Wl,-E  -fstack-protector-strong
-L/usr/local/lib  -L/usr/lib/x86_64-linux-gnu/perl/5.34/CORE -lperl -ldl
-lm -lpthread -lc -lcrypt -Wl,-z,relro -Wl,-z,now
libtool: link: gcc -shared  -fPIC -DPIC  .libs/snmptrapd_handlers.o
.libs/snmptrapd_log.o .libs/snmptrapd_auth.o .libs/snmptrapd_sql.o
-Wl,-rpath -Wl,/build/net-snmp-5.9.2~pre1+dfsg/agent/.libs -Wl,-rpath
-Wl,/build/net-snmp-5.9.2~pre1+dfsg/snmplib/.libs
../agent/.libs/libnetsnmpmibs.so -L/usr/lib/x86_64-linux-gnu/ -lmariadb
../snmplib/.libs/libnetsnmp.so -L/usr/local/lib
-L/usr/lib/x86_64-linux-gnu/perl/5.34/CORE -lperl -ldl -lm -lpthread -lc
-lcrypt  -g -O2 -fstack-protector-strong -g -O2 -fstack-protector-strong
-Wl,-no-undefined -Wl,-E -fstack-protector-strong -Wl,-z -Wl,relro -Wl,-z
-Wl,now   -Wl,-soname -Wl,libnetsnmptrapd.so.39 -o
.libs/libnetsnmptrapd.so.39.2.0
/usr/bin/ld: .libs/snmptrapd_handlers.o: in function `command_handler':
./apps/snmptrapd_handlers.c:862: undefined reference to `run_shell_command'
/usr/bin/ld: ./apps/snmptrapd_handlers.c:818: undefined reference to
`convert_v1pdu_to_v2'
/usr/bin/ld: .libs/snmptrapd_handlers.o: in function `axforward_handler':
./apps/snmptrapd_handlers.c:883: undefined reference to `send_v2trap'
/usr/bin/ld: .libs/snmptrapd_auth.o: in function `netsnmp_trapd_auth':
./apps/snmptrapd_auth.c:138: undefined reference to
`vacm_check_view_contents'
/usr/bin/ld: ./apps/snmptrapd_auth.c:95: undefined reference to
`convert_v1pdu_to_v2'
/usr/bin/ld: .libs/snmptrapd_auth.o: in function `init_netsnmp_trapd_auth':
./apps/snmptrapd_auth.c:51: undefined reference to `init_vacm_config_tokens'
collect2: error: ld returned 1 exit status

>

Re: Net-SNMP 5.9.2.pre1 published for testing

[Wes H. <har...@us...>]

Craig Small <csmall@dropbear.xyz> writes:

> On Wed, 6 Apr 2022, 10:09 Wes Hardaker via Net-snmp-coders, <net...@li...>
> wrote:
> 
>     Net-SNMP 5.9.2.pre1 has been published for testing as available at:
> 
> I can confirm that the compile issues with OpenSSL v3 are fixed with this.
> 
> I'll run the source code through a standard Debian pbuilder and one with OpenSSL v3 added as well to
> check it works with both versions.

Excellent news, thank you!
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Net-SNMP 5.9.2.pre1 published for testing

[Craig S. <cs...@dr...>]

On Wed, 6 Apr 2022, 10:09 Wes Hardaker via Net-snmp-coders, <
net...@li...> wrote:

>
> Net-SNMP 5.9.2.pre1 has been published for testing as available at:
>

I can confirm that the compile issues with OpenSSL v3 are fixed with this.

I'll run the source code through a standard Debian pbuilder and one with
OpenSSL v3 added as well to check it works with both versions.

 - Craig

Net-SNMP 5.9.2.pre1 published for testing

[Wes H. <har...@us...>]

Greetings all,

Net-SNMP 5.9.2.pre1 has been published for testing as available at:

https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.2-pre-releases/

Please file any issues or pull requests required to improve the state of
this release.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: net-snmp and openssl v3

[Bart V. A. <bva...@ac...>]

(+Wes)

On 3/21/22 23:08, Craig Small wrote:
> I received a bug report about issues linking net-snmp with openssl 
> v3. Generally its because there are functions referenced that were 
> deprecated in 3.0 or even sometimes 1.1.0 !
> 
> I started looking around and found that net-snmp already has some, if 
> not all, the patches required. such as those found in [1]
> 
> However, net-snmp v 5.9.1 doesn't have all of these yet. I can either 
> try to pick the relevant ones out and patch the Debian package, or wait 
> until 5.9.2 comes out. My question is, is there an idea when that would 
> be?  My preference is to not patch as I'll be cherry-picking and might 
> miss some subtle but important patch.

Re: net-snmp and openssl v3

[Tomasz K. <klo...@gm...>]

On Tue, 22 Mar 2022 at 07:41, Craig Small <csmall@dropbear.xyz> wrote:

> Hi,
>   I received a bug report about issues linking net-snmp with openssl v3.
> Generally its because there are functions referenced that were deprecated
> in 3.0 or even sometimes 1.1.0 !
>
> I started looking around and found that net-snmp already has some, if not
> all, the patches required. such as those found in [1]
>
> However, net-snmp v 5.9.1 doesn't have all of these yet. I can either try
> to pick the relevant ones out and patch the Debian package, or wait until
> 5.9.2 comes out. My question is, is there an idea when that would be?  My
> preference is to not patch as I'll be cherry-picking and might miss some
> subtle but important patch.
>

Maintainance and regular release of some new releases is one of the biggest
poroblemd of the net-snmp project.

kloczek
-- 
Tomasz Kłoczko | LinkedIn: http://lnkd.in/FXPWxH

net-snmp and openssl v3

[Craig S. <cs...@dr...>]

Hi,
  I received a bug report about issues linking net-snmp with openssl v3.
Generally its because there are functions referenced that were deprecated
in 3.0 or even sometimes 1.1.0 !

I started looking around and found that net-snmp already has some, if not
all, the patches required. such as those found in [1]

However, net-snmp v 5.9.1 doesn't have all of these yet. I can either try
to pick the relevant ones out and patch the Debian package, or wait until
5.9.2 comes out. My question is, is there an idea when that would be?  My
preference is to not patch as I'll be cherry-picking and might miss some
subtle but important patch.

 - Craig


1: https://github.com/net-snmp/net-snmp/commits/V5-9-patches

-- 

Craig Small             https://dropbear.xyz/  csmall at : dropbear.xyz
Debian GNU/Linux        https://www.debian.org/
<http://www.debian.org/>  csmall at : debian.org
GPG fingerprint:     5D2F B320 B825 D939 04D2  0519 3938 F96B DF50 FEA5

Re: How to enable logging with verbose and log rations in net-snmp daemon in snmpd.conf for

[Suresh <skj...@ho...>]

Hi Mike
Thanks to reply. Can u explain little bit more on this, I need to log rotation verbose for windows OS on net-snmp.


Thanks
Suresh
________________________________
From: Mike Eggleston <mik...@gm...>
Sent: Monday, March 21, 2022 7:19 PM
To: Suresh <skj...@ho...>
Cc: net...@li... <net...@li...>; net...@li... <net...@li...>
Subject: Re: How to enable logging with verbose and log rations in net-snmp daemon in snmpd.conf for

Log to a file and put that file under logrotate(8)?

Mike

On Mar 21, 2022, at 08:00, Suresh <skj...@ho...<mailto:skj...@ho...>> wrote:

Hi Anyone able enable logging with verbose and log rotations in net-snmp daemon.
from snmpd.conf
________________________________
From: Suresh <skj...@ho...<mailto:skj...@ho...>>
Sent: Tuesday, March 15, 2022 7:48 PM
To: net...@li...<mailto:net...@li...> <net...@li...<mailto:net...@li...>>; net...@li...<mailto:net...@li...> <net...@li...<mailto:net...@li...>>
Subject: How to enable logging with verbose and log rations in net-snmp daemon in snmpd.conf for

Hello
I'm using net-snmp version:  5.9.1 service with extended my enterprise specific mibs for snmpwalk/get/set
I want enable logs with rotation policy and verbose  level.

Example
Log file name  rataiotn with date_time and verbose leve debug, error level or info level.

What parameter i need to set in snmpd.conf or any other way programmatically or using configuration
i try to run snmpd.exe with  -Lf D:\snmplog\snmpd.log

But want to know how i rotate log file if log file size reach say 1 MB.
like snmd_15_3_2022_18.30.log size exceed 1 MB.

Also which parameter to set in snmpd.conf for verbose level and log file size.


Thanks
Suresh
_______________________________________________
Net-snmp-users mailing list
Net...@li...<mailto:Net...@li...>
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users