net-snmp-coders — Discussion of internal project coding (Please use this OR -users, NOT both!)

Re: Agent+Sub-Agent

[Magnus F. <ma...@ly...>]

On Wed, Sep 08, 2021 at 02:17:14PM -0400, Bill Fenner wrote:
> On Fri, Sep 3, 2021 at 3:43 AM Feroz <fer...@gm...> wrote:
> 
> > My question is, is there a way to block an agent  from responding to
> > queries ( by timeout), till time the sub-agent connects to the agent.
> >
> 
> No, the master agent always lives under the impression that it knows
> everything.  You may be able to fake it out by giving it an unreachable
> proxy, something like "proxy udp:127.0.0.1:9 .1.3", and then having the
> agentx registration use a better priority so that it overrides the proxy
> config for each subtree that agentx registers.  However, this does use up
> snmp server resources trying to proxy each request to something that will
> not respond.
> 
> This is an interesting problem, especially if you have multiple
> sub-agents.  What if you had one sub-agent that serves IP-MIB, and a
> separate one that serves the system MIB?  Would you want to ignore requests
> until both subagents are connected?

Given that the system MIB contains sysORTable I have to say I find the
choise to put it in a subagent odd.

/MF

Re: Agent+Sub-Agent

[Feroz <fer...@gm...>]

how about to have a flag, that will be set to TRUE
in handle_master_agentx_packet()  and check the flag in handle_snmp_packet()

*master_admin.c*
    case AGENTX_MSG_PING:
        asp->status = agentx_ping_response(session, pdu);
+        subagent_connected = TRUE;
        break;

*snmp_agent.c*
    if (op != NETSNMP_CALLBACK_OP_RECEIVED_MESSAGE) {
        return 1;
    }

+ if (!IS_AGENTX_VERSION(pdu->version) && subagent_connected == FALSE) {
+         return 1;
+  }

On Mon, Sep 13, 2021 at 11:37 AM Feroz <fer...@gm...> wrote:

> For my testing I added "proxy -v2c -c public udp:127.0.0.1:9 .1.3" in
> snmpd.conf file..
> Unfortunately I still get "No Such Instance currently exists at this OID",
> for some time, whenever I restart the sub-agent.
>
>
> On Wed, Sep 8, 2021 at 11:47 PM Bill Fenner <fe...@gm...> wrote:
>
>> On Fri, Sep 3, 2021 at 3:43 AM Feroz <fer...@gm...> wrote:
>>
>>> My question is, is there a way to block an agent  from responding to
>>> queries ( by timeout), till time the sub-agent connects to the agent.
>>>
>>
>> No, the master agent always lives under the impression that it knows
>> everything.  You may be able to fake it out by giving it an unreachable
>> proxy, something like "proxy udp:127.0.0.1:9 .1.3", and then having the
>> agentx registration use a better priority so that it overrides the proxy
>> config for each subtree that agentx registers.  However, this does use up
>> snmp server resources trying to proxy each request to something that will
>> not respond.
>>
>> This is an interesting problem, especially if you have multiple
>> sub-agents.  What if you had one sub-agent that serves IP-MIB, and a
>> separate one that serves the system MIB?  Would you want to ignore requests
>> until both subagents are connected?
>>
>>   Bill
>>
>>
>
> --
> Regards,
> Feroz Ahmed
>


-- 
Regards,
Feroz Ahmed

using net-snmp at scale with one process and one socket

[Neil M. <nei...@gm...>]

This may have been covered many times before,  but just in case it
helps someone, here is a summary of my experience with using net-snmp
in a large network.  Specifically, I use it to talk to thousands of
SNMPv2 and SNMPv3 agents using just one UDP socket in a process that
runs continuously.

The net-snmp library uses linear linked lists for sessions, requests
and usmuser data. That would normally be OK, but does not scale so
well for this use-case.  So I had to make a few small changes:

(1) I still create a separate netsnmp-session for each remote agent
IP,  but force them all to use the same UDP socket.
(2) I turn off the v3 engine-id probe hooks so I can send and process
those requests manually.
(3) I do my own select() using hash tables keyed by reqid and msgid to
map back to the right netsnmp-session. There is no blocking.
(4) I do my own timeout check using a time-sorted tree.
(5) I changed the library to expose this function so I can feed
response PDUs back to the library directly:

extern void snmp_sess_receive_packet(void *sessp, u_char *packet, int
length, struct sockaddr *from, int from_len);

(6) I exposed this function to help construct engine-id probes:

extern int usm_build_probe_pdu(netsnmp_pdu **pdu);

(6) I changed the userList in snmplib/snmpusm.c to be a hash-table of
userLists keyed by engine-id (but the logic within each list is
otherwise unchanged).

These were the smallest changes I could make.  There don't seem to be
any significant bottlenecks now.

Neil

P.S. I was also tempted to set SNMPV3_IGNORE_UNAUTH_REPORTS=1 because
otherwise the library delivers an unexpected extra callback after a
failed engine-id probe,  but it seemed better to harden the logic to
handle unexpected callbacks gracefully.

Re: NET-SNMP 5.7.3: Got signal 6 in netsnmp_tdomain_transport_full operation

[Josef Ř. <jr...@re...>]

Hi Olivier,

As RHEL maintainer of net-snmp, I can only advise you to check whether
you're using the up to date version of net-snmp in RHEL-7
(net-snmp-5.7.2-49.1).

I was able to find some modifications in netsnmp_tdomain_transport_full
method, that was backported from the upstream commit
https://github.com/net-snmp/net-snmp/commit/df863a5348aabf71bbca7bfefcf8beb8bb9e7762

So the question is, if this commit helps with investigation.

Best regards

Josef Ridky
Senior Software Engineer
Core Services Team
Red Hat Czech, s.r.o.


On Wed, Sep 15, 2021 at 11:27 PM Olivier Germain via Net-snmp-coders <
net...@li...> wrote:

> Hi SNMP Team,
>
> We integrated SNMP 5.7.3 library as part of our software (libsnmpsl and
> libpasnmpmgr). We are running on REHL 7 x86 64 bits.
> One of our partner reported us that they caught a signal 6 during the
> initialization of SNMP V3 session.
>
> Here is the stack trace fwe got in our product that involves *netsnmp_tdomain_transport_full
> *which is the latest operation called.
> Caught fatal signal 6 (Aborted)
> utl_dump_stack: Start of stack trace for pid 160070
>   #0 /opt/tibco/fp/3.9/kis/distrib/kabira/lib/libutils.so:utl_dump_stack
>   #1 /opt/tibco/fp/3.9/kis/distrib/kabira/lib/libutils.so:utl_dbg_sigstack
>   #2
> /opt/tibco/fp/3.9/kis/distrib/kabira/lib/libsyssrv.so:sw_debugSignalHandler
>   #3 /usr/lib64/libpthread.so.0:
>   #4 /usr/lib64/libc.so.6:gsignal
>   #5 /usr/lib64/libc.so.6:abort
>   #6 /usr/lib64/libc.so.6:
>   #7 /usr/lib64/libc.so.6:
>
>
> *  #8
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:netsnmp_tdomain_transport_full
> #9
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:
> #10
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:snmp_sess_open*
>   #11
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::openSession()
>   #12
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::updateSession()
>   #13
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::_initialisePrivPass(pasnmpmgr::PrivProtocolEnum
> const&, SWString const&)
>   #14
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::initialisePrivPass(pasnmpmgr::PrivProtocolEnum
> const&, SWString const&)
>   #15
> /opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::Session::initialisePrivPass(pasnmpmgr::PrivProtocolEnum
> const&, SWString const&)
>   #16
> /opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::initializeV3(SDDTools::NVSet
> const&, SWString const&, int const&, unsigned int const&)
>   #17
> /opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::initializeSnmpSession(SDDTools::NVSet
> const&)
>   #18
> /opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::_processCommand(SWString
> const&, SDDTools::NVSet&)
>   #19
> /opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::_processCommand_vdisp(CGObject
> const&, SWString const&, SDDTools::NVSet&)
>
> I don't have much information from the customer (no coredump).
> Unfortunately, this signal 6 is intermittent and they are not able to
> reproduce.
>
> I looked at the Bugs and Coders mailing list (not all the emails one by
> one of course) but I didn't find anything related to a signal 6 caught by
> *netsnmp_tdomain_transport_full. *
>
> I am a bit stuck. If someone of the list has an idea or any hints on a
> recreation model. Please feel free to share it.
> I really thank you in advance for your help.
> Best regards
>
> --
> Olivier GERMAIN
> TIBCO Support
>
> TIBCO software
> 18, rue du 4 Septembre
> 75002 Paris, France
> Mobile : +33 6 45 30 23 31
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>

Re: Difference between AES192 and AES192C

[Craig S. <cs...@dr...>]

Hi Pushpa,
  It's a matter of identifying it.

When the packet comes in, the receiver looks at the authentication protocol
and sees one value or the other. That's why you need to specify which
method you are using.
In theory, I expect that the receiver could just look at the auth protocol
and use the same method for both values, but they don't.

 - Craig


On Wed, 15 Sept 2021 at 15:44, Pushpa Thimmaiah <pus...@gm...>
wrote:

> Hi Craig Small,
>
> Thank you . This is really helpful.
> If AES192 and AES192C are AES standard from different entity  then are
> they interchangeable ?
> Eg: I did configure AES192 on snmpd and use AES192C from mibbrowser.
> Tool 'snmpget'  fails.
>
> It would help me if I know why CFB-AES192 (on silvercreek browser) fails
> with AES192 configured on snmp-agent.  It works fine when AES192C
> configured on snmpd.
>
>
> On Wed, Sep 15, 2021 at 4:10 AM Craig Small <csmall@dropbear.xyz> wrote:
>
>> Hi Pushpa,
>>   As you have discovered, there are two AES192 standards.
>>
>> When you select AES192 (with no C) this is the IETF draft Blumenthal
>> standard.
>>
>> When you select AES192C this is the Cisco "standard".
>>
>> What is the actual difference? As far as I can tell, it comes down to the
>> OID used for some of the parameters like the IV.
>>
>> The Cisco standard uses something under enterprises.Cisco, as you would
>> expect, while the draft IETF standard uses something under enterprises.ESO
>> ESO is Extended Security Options consortium, you can see their MIB at
>> http://www.snmp.com/eso/esoConsortiumMIB.txt
>>
>> To me, it looks like the same protocol, just how it identifies itself and
>> where it stores things changes. So it's not like one is doing CFB and the
>> other thought for some reason ECB was the way to go.
>>
>> If you look online for SNMP and AES 192 or 256, you can see this confuses
>> a bunch of people (e.g. AES192 works for device X, but not device Y, why?)
>>
>>  - Craig
>>
>> ObXKCD https://xkcd.com/927/
>>
>>
>> On Wed, 15 Sept 2021 at 01:51, Pushpa Thimmaiah <
>> pus...@gm...> wrote:
>>
>>> Hi Folks,
>>>
>>> I am using SilverCreek as mib browser(windows10)  and net-snmp-.5.9 on
>>> snmp-agent(linux).
>>>
>>> *snmp-agent*
>>> creatUser testmd5aes192 MD5  testingauth AES192 testingpriv
>>>
>>> *SilverCreek*
>>> It provides CFB-AES192 option for privprotocol . So I selected
>>> authprotocol as 'MD5' and priv protocol 'CFB-AES192'
>>> snmpquery on fails for this
>>>
>>> So, I  changed AES192 to AES192C at snmp-agent side as mentioned below
>>> and it works
>>> creatUser testmd5aes192 MD5  testingauth AES192C testingpriv
>>>
>>> Kindly let me know when to use AES192 and AES192C. Is it based on cipher
>>> methods of AES?
>>>
>>> Thanks,
>>> Pushpa.T
>>>
>>>
>>> _______________________________________________
>>> Net-snmp-coders mailing list
>>> Net...@li...
>>> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>>>
>>

Re: Difference between AES192 and AES192C

[Pushpa T. <pus...@gm...>]

Hi Craig Small,

Thank you . This is really helpful.
If AES192 and AES192C are AES standard from different entity  then are they
interchangeable ?
Eg: I did configure AES192 on snmpd and use AES192C from mibbrowser.   Tool
'snmpget'  fails.

It would help me if I know why CFB-AES192 (on silvercreek browser) fails
with AES192 configured on snmp-agent.  It works fine when AES192C
configured on snmpd.


On Wed, Sep 15, 2021 at 4:10 AM Craig Small <csmall@dropbear.xyz> wrote:

> Hi Pushpa,
>   As you have discovered, there are two AES192 standards.
>
> When you select AES192 (with no C) this is the IETF draft Blumenthal
> standard.
>
> When you select AES192C this is the Cisco "standard".
>
> What is the actual difference? As far as I can tell, it comes down to the
> OID used for some of the parameters like the IV.
>
> The Cisco standard uses something under enterprises.Cisco, as you would
> expect, while the draft IETF standard uses something under enterprises.ESO
> ESO is Extended Security Options consortium, you can see their MIB at
> http://www.snmp.com/eso/esoConsortiumMIB.txt
>
> To me, it looks like the same protocol, just how it identifies itself and
> where it stores things changes. So it's not like one is doing CFB and the
> other thought for some reason ECB was the way to go.
>
> If you look online for SNMP and AES 192 or 256, you can see this confuses
> a bunch of people (e.g. AES192 works for device X, but not device Y, why?)
>
>  - Craig
>
> ObXKCD https://xkcd.com/927/
>
>
> On Wed, 15 Sept 2021 at 01:51, Pushpa Thimmaiah <
> pus...@gm...> wrote:
>
>> Hi Folks,
>>
>> I am using SilverCreek as mib browser(windows10)  and net-snmp-.5.9 on
>> snmp-agent(linux).
>>
>> *snmp-agent*
>> creatUser testmd5aes192 MD5  testingauth AES192 testingpriv
>>
>> *SilverCreek*
>> It provides CFB-AES192 option for privprotocol . So I selected
>> authprotocol as 'MD5' and priv protocol 'CFB-AES192'
>> snmpquery on fails for this
>>
>> So, I  changed AES192 to AES192C at snmp-agent side as mentioned below
>> and it works
>> creatUser testmd5aes192 MD5  testingauth AES192C testingpriv
>>
>> Kindly let me know when to use AES192 and AES192C. Is it based on cipher
>> methods of AES?
>>
>> Thanks,
>> Pushpa.T
>>
>>
>> _______________________________________________
>> Net-snmp-coders mailing list
>> Net...@li...
>> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>>
>

Re: Difference between AES192 and AES192C

[Craig S. <cs...@dr...>]

Hi Pushpa,
  As you have discovered, there are two AES192 standards.

When you select AES192 (with no C) this is the IETF draft Blumenthal
standard.

When you select AES192C this is the Cisco "standard".

What is the actual difference? As far as I can tell, it comes down to the
OID used for some of the parameters like the IV.

The Cisco standard uses something under enterprises.Cisco, as you would
expect, while the draft IETF standard uses something under enterprises.ESO
ESO is Extended Security Options consortium, you can see their MIB at
http://www.snmp.com/eso/esoConsortiumMIB.txt

To me, it looks like the same protocol, just how it identifies itself and
where it stores things changes. So it's not like one is doing CFB and the
other thought for some reason ECB was the way to go.

If you look online for SNMP and AES 192 or 256, you can see this confuses a
bunch of people (e.g. AES192 works for device X, but not device Y, why?)

 - Craig

ObXKCD https://xkcd.com/927/


On Wed, 15 Sept 2021 at 01:51, Pushpa Thimmaiah <pus...@gm...>
wrote:

> Hi Folks,
>
> I am using SilverCreek as mib browser(windows10)  and net-snmp-.5.9 on
> snmp-agent(linux).
>
> *snmp-agent*
> creatUser testmd5aes192 MD5  testingauth AES192 testingpriv
>
> *SilverCreek*
> It provides CFB-AES192 option for privprotocol . So I selected
> authprotocol as 'MD5' and priv protocol 'CFB-AES192'
> snmpquery on fails for this
>
> So, I  changed AES192 to AES192C at snmp-agent side as mentioned below and
> it works
> creatUser testmd5aes192 MD5  testingauth AES192C testingpriv
>
> Kindly let me know when to use AES192 and AES192C. Is it based on cipher
> methods of AES?
>
> Thanks,
> Pushpa.T
>
>
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>

Client application recieves only timeouts once agent is reset

[Caleb H. <cal...@gm...>]

Hello,

Please let me know if this belongs in -users instead.

I am using libsnmp30, v5.7.3, in a C++ client application on Debian
Stretch. I'm using it to communicate with a managed PoE switch. Using
the TUT:Simple_Application on the net-snmp wiki. I am able to set and get
PoE status, among other commands. However, if this switch is reset via
unplug or via OID command, the only response I get from the switch from
then on is a timeout error until I restart the client application.

When the application begins, communication works perfectly. Once the switch
is turned off, the     status from `snmp_sync_response()` reports that it
is unsuccessful, but there is no timeout, which seems normal. However, once
the switch is back online, the status from `snmp_sync_response()` is a
STAT_TIMEOUT until I restart the client application.

While these timeouts are happening, I am still able to communicate via snmp
CLI (snmpget, snmpset, etc.).

Is there any way to refresh the client communication? My fallback is to
restart the application, but I would like to find a cleaner solution.

Thank you for taking the time to help,
-Cal

Difference between AES192 and AES192C

[Pushpa T. <pus...@gm...>]

Hi Folks,

I am using SilverCreek as mib browser(windows10)  and net-snmp-.5.9 on
snmp-agent(linux).

*snmp-agent*
creatUser testmd5aes192 MD5  testingauth AES192 testingpriv

*SilverCreek*
It provides CFB-AES192 option for privprotocol . So I selected authprotocol
as 'MD5' and priv protocol 'CFB-AES192'
snmpquery on fails for this

So, I  changed AES192 to AES192C at snmp-agent side as mentioned below and
it works
creatUser testmd5aes192 MD5  testingauth AES192C testingpriv

Kindly let me know when to use AES192 and AES192C. Is it based on cipher
methods of AES?

Thanks,
Pushpa.T

NET-SNMP 5.7.3: Got signal 6 in netsnmp_tdomain_transport_full operation

[Olivier G. <oge...@ti...>]

Hi SNMP Team,

We integrated SNMP 5.7.3 library as part of our software (libsnmpsl and
libpasnmpmgr). We are running on REHL 7 x86 64 bits.
One of our partner reported us that they caught a signal 6 during the
initialization of SNMP V3 session.

Here is the stack trace fwe got in our product that involves
*netsnmp_tdomain_transport_full
*which is the latest operation called.
Caught fatal signal 6 (Aborted)
utl_dump_stack: Start of stack trace for pid 160070
  #0 /opt/tibco/fp/3.9/kis/distrib/kabira/lib/libutils.so:utl_dump_stack
  #1 /opt/tibco/fp/3.9/kis/distrib/kabira/lib/libutils.so:utl_dbg_sigstack
  #2
/opt/tibco/fp/3.9/kis/distrib/kabira/lib/libsyssrv.so:sw_debugSignalHandler
  #3 /usr/lib64/libpthread.so.0:
  #4 /usr/lib64/libc.so.6:gsignal
  #5 /usr/lib64/libc.so.6:abort
  #6 /usr/lib64/libc.so.6:
  #7 /usr/lib64/libc.so.6:


*  #8
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:netsnmp_tdomain_transport_full
#9
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:
#10
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:snmp_sess_open*
  #11
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::openSession()
  #12
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::updateSession()
  #13
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::_initialisePrivPass(pasnmpmgr::PrivProtocolEnum
const&, SWString const&)
  #14
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::SessionImpl::initialisePrivPass(pasnmpmgr::PrivProtocolEnum
const&, SWString const&)
  #15
/opt/tibco/fp/3.9/kis/distrib/kabira/component/pasnmpmgr/prodlib/libpasnmpmgr_impl.so:pasnmpmgr::Session::initialisePrivPass(pasnmpmgr::PrivProtocolEnum
const&, SWString const&)
  #16
/opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::initializeV3(SDDTools::NVSet
const&, SWString const&, int const&, unsigned int const&)
  #17
/opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::initializeSnmpSession(SDDTools::NVSet
const&)
  #18
/opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::_processCommand(SWString
const&, SDDTools::NVSet&)
  #19
/opt/tibco/fp/3.9/kis/distrib/kabira/kpsa/component/snmpsl/prodlib/libsnmpsl_impl.so:snmpsl::SnmpSessionLayerSessionImpl::_processCommand_vdisp(CGObject
const&, SWString const&, SDDTools::NVSet&)

I don't have much information from the customer (no coredump).
Unfortunately, this signal 6 is intermittent and they are not able to
reproduce.

I looked at the Bugs and Coders mailing list (not all the emails one by one
of course) but I didn't find anything related to a signal 6 caught by
*netsnmp_tdomain_transport_full. *

I am a bit stuck. If someone of the list has an idea or any hints on a
recreation model. Please feel free to share it.
I really thank you in advance for your help.
Best regards

-- 
Olivier GERMAIN
TIBCO Support

TIBCO software
18, rue du 4 Septembre
75002 Paris, France
Mobile : +33 6 45 30 23 31

Re: Agent+Sub-Agent

[Feroz <fer...@gm...>]

For my testing I added "proxy -v2c -c public udp:127.0.0.1:9 .1.3" in
snmpd.conf file..
Unfortunately I still get "No Such Instance currently exists at this OID",
for some time, whenever I restart the sub-agent.


On Wed, Sep 8, 2021 at 11:47 PM Bill Fenner <fe...@gm...> wrote:

> On Fri, Sep 3, 2021 at 3:43 AM Feroz <fer...@gm...> wrote:
>
>> My question is, is there a way to block an agent  from responding to
>> queries ( by timeout), till time the sub-agent connects to the agent.
>>
>
> No, the master agent always lives under the impression that it knows
> everything.  You may be able to fake it out by giving it an unreachable
> proxy, something like "proxy udp:127.0.0.1:9 .1.3", and then having the
> agentx registration use a better priority so that it overrides the proxy
> config for each subtree that agentx registers.  However, this does use up
> snmp server resources trying to proxy each request to something that will
> not respond.
>
> This is an interesting problem, especially if you have multiple
> sub-agents.  What if you had one sub-agent that serves IP-MIB, and a
> separate one that serves the system MIB?  Would you want to ignore requests
> until both subagents are connected?
>
>   Bill
>
>

-- 
Regards,
Feroz Ahmed

Re: Agent+Sub-Agent

[Feroz <fer...@gm...>]

Hi Bill,
I have only one sub-agent running on the same box.
Let me test by adding the proxy configuration in snmpd.conf that you shared.
i.e:

"proxy udp:127.0.0.1:9 .1.3"

Thanks a lot for your response.

-Feroz

On Wed, 8 Sep, 2021, 11:47 pm Bill Fenner, <fe...@gm...> wrote:

> On Fri, Sep 3, 2021 at 3:43 AM Feroz <fer...@gm...> wrote:
>
>> My question is, is there a way to block an agent  from responding to
>> queries ( by timeout), till time the sub-agent connects to the agent.
>>
>
> No, the master agent always lives under the impression that it knows
> everything.  You may be able to fake it out by giving it an unreachable
> proxy, something like "proxy udp:127.0.0.1:9 .1.3", and then having the
> agentx registration use a better priority so that it overrides the proxy
> config for each subtree that agentx registers.  However, this does use up
> snmp server resources trying to proxy each request to something that will
> not respond.
>
> This is an interesting problem, especially if you have multiple
> sub-agents.  What if you had one sub-agent that serves IP-MIB, and a
> separate one that serves the system MIB?  Would you want to ignore requests
> until both subagents are connected?
>
>   Bill
>
>

Re: Agent+Sub-Agent

[Bill F. <fe...@gm...>]

On Fri, Sep 3, 2021 at 3:43 AM Feroz <fer...@gm...> wrote:

> My question is, is there a way to block an agent  from responding to
> queries ( by timeout), till time the sub-agent connects to the agent.
>

No, the master agent always lives under the impression that it knows
everything.  You may be able to fake it out by giving it an unreachable
proxy, something like "proxy udp:127.0.0.1:9 .1.3", and then having the
agentx registration use a better priority so that it overrides the proxy
config for each subtree that agentx registers.  However, this does use up
snmp server resources trying to proxy each request to something that will
not respond.

This is an interesting problem, especially if you have multiple
sub-agents.  What if you had one sub-agent that serves IP-MIB, and a
separate one that serves the system MIB?  Would you want to ignore requests
until both subagents are connected?

  Bill

Re: When exactly the response is received from node 2 ?

[Bill F. <fe...@gm...>]

By the way, I wanted to mention - I noticed your example was using SNMPv1.
SNMPv1 has been obsolete since 2002 (when the RFC was moved to historic
status).  You should ideally be using SNMPv3, with its authorization and
privacy improvements, and if not, at least use SNMPv2 which is not obsolete.

  Bill

Re: When exactly the response is received from node 2 ?

[Bill F. <fe...@gm...>]

On Sun, Sep 5, 2021 at 9:59 AM Nishant Nayan <nay...@gm...>
wrote:

> My aim is to know how various parameters like errorstat and errindex etc.
> are set from response.
>
> For an example command :
> snmpget -v1 -c cmty_remotehost1 localhost SNMPv2-MIB::sysName.1
> SNMPv2-MIB::sysDescr.0 SNMPv2-MIB::sysObjectID.0
>
> SNMPv2-MIB::sysName.1 being an incorrect oid
>

I like to add "-Ddumpv,dumph" to get details of the messages that are being
send and received.  Try running your get with that debugging to see if the
output helps you understand where each field comes from.  (You can change
it to just "-Ddump" to also get a hex dump, which you may be able to
compare with the data field you see in your debugger).

Each field in the packet is encoded using ASN.1, which is more or less a
type/length/value encoding, but is fairly complex.  If you're trying to
create your own packets, please see if it's feasible to use an existing
ASN.1 encoder, because there have historically been many bugs in ASN.1
parsing and encoding so it's best to use a well-tested implementation.

Also, if you want to know what the SNMP protocol is doing, as opposed to
what the helpful snmpget command is doing, you should add "-Cf" to the
snmpget command line - when snmpget gets an error like this, it'll strip
out the bad object and try again so that it gets the data that may exist,
but that is not how SNMP works per se - that is how snmpget works.

  Bill

Re: Code location of errorindex (response->errindex)

[Nishant N. <nay...@gm...>]

Thank you for the clarification.
Is there a way to debug both snmpget and snmpagent ?
I am querying a node (node 2) from node 1 using proxy pass, so in this case
agent on node2 sends oid values / errindex of wrong oids to node 1
(snmpmanager) ?

Thanks

On Tue, 17 Aug 2021 at 02:35, Wes Hardaker <har...@us...>
wrote:

> Nishant Nayan <nay...@gm...> writes:
>
> > I debugged in snmpget.c till the section where the request is performed.
> > The errindex is getting set after the below function call (as one of
> > the properties of &response) :-
>
> So the error index is not set by snmpget, but by the agent that snmpget
> is querying.  snmpget is just pulling the answer and the count from the
> agent's response packet and not calculating it itself.
> --
> Wes Hardaker
> Please mail all replies to net...@li...
>

When exactly the response is received from node 2 ?

[Nishant N. <nay...@gm...>]

I am using snmpget command to understand how and when the response is
created.
I am using proxy and querying another node (node 2) from one (node 1)
My aim is to know how various parameters like errorstat and errindex etc.
are set from response.

For an example command :
snmpget -v1 -c cmty_remotehost1 localhost SNMPv2-MIB::sysName.1
SNMPv2-MIB::sysDescr.0 SNMPv2-MIB::sysObjectID.0

SNMPv2-MIB::sysName.1 being an incorrect oid

I have the following backtrace

#0  snmp_comstr_parse (
data=0x6e3ca5
"\004\020cmty_remotehost1\242\070\002\004y\017\255\242\002\001\002\002\001\003\060*0\f\006\b+\006\001\002\001\001\005\001\005",
data@entry=0x6e3ca0 "0O\002\001", length=length@entry=0x7fffffffd548,
    psid=psid@entry=0x7fffffffd570 "7.0.0.1]\241\245\267\367\377\177",
slen=slen@entry=0x7fffffffd558,
    version=version@entry=0x6f3cb0) at snmp_auth.c:132
#1  0x00007ffff7b1e376 in _snmp_parse (sessp=sessp@entry=0x6bd2d0,
session=session@entry=0x62a6d0,
    pdu=pdu@entry=0x6f3cb0, data=data@entry=0x6e3ca0 "0O\002\001",
length=76, length@entry=81)
    at snmp_api.c:4110
#2  0x00007ffff7b1f1cd in snmp_parse (length=81, data=0x6e3ca0
"0O\002\001", pdu=0x6f3cb0, pss=0x62a6d0,
    sessp=0x6bd2d0) at snmp_api.c:4343
#3  _sess_process_packet (sessp=sessp@entry=0x6bd2d0, sp=sp@entry=0x62a6d0,
isp=isp@entry=0x6d5550,
    transport=transport@entry=0x6caef0, opaque=0x6d7030, olength=<optimized
out>,
    packetptr=packetptr@entry=0x6e3ca0 "0O\002\001", length=81) at
snmp_api.c:5254
#4  0x00007ffff7b1fa9e in _sess_read (sessp=sessp@entry=0x6bd2d0,
fdset=fdset@entry=0x7fffffffd7d0)
    at snmp_api.c:5828
#5  0x00007ffff7b208e9 in snmp_sess_read2 (sessp=sessp@entry=0x6bd2d0,
fdset=fdset@entry=0x7fffffffd7d0)
    at snmp_api.c:5860
#6  0x00007ffff7b2093b in snmp_read2 (fdset=fdset@entry=0x7fffffffd7d0) at
snmp_api.c:5462
#7  0x00007ffff7b2097c in snmp_read (fdset=fdset@entry=0x7fffffffd8e0) at
snmp_api.c:5452
#8  0x00007ffff7af73e0 in snmp_synch_response_cb (ss=ss@entry=0x62a6d0,
pdu=pdu@entry=0x6e2e00,
    response=response@entry=0x7fffffffd9b0, pcb=pcb@entry=0x7ffff7af6a60
<snmp_synch_input>)
    at snmp_client.c:1056
#9  0x00007ffff7af753c in snmp_synch_response (ss=ss@entry=0x62a6d0,
pdu=pdu@entry=0x6e2e00,
    response=response@entry=0x7fffffffd9b0) at snmp_client.c:1102
#10 0x0000000000400eaf in main (argc=<optimized out>, argv=<optimized out>)
at snmpget.c:199

My understanding:
The data parameter in #0
(\004\020cmty_remotehost1\242\070\002\004y\017\255\242\002\001\002\002\001\003\060*0\f\006\b+\006\001\002\001\001\005\001\005)
corresponds to the response from node 2 containing values of
errindex,errstat (if any) , otherwise the value of correct OID.
But how this data is created from snmp_parse() call is the question, and
what does data=data@entry=0x6e3ca0 "0O\002\001" means in snmp_parse is also
not clear to me.

If someone could clarify these then it would be of great help.


Regards
Nishant

Agent+Sub-Agent

[Feroz <fer...@gm...>]

Hi,
I have an agent/sub-agent model.

I have moved the implementation of System-MIB to a sub-agent.
While the sub-agent is still connecting to agent, if someone queries for "
SNMPv2-MIB::sysObjectID.0", agent is responding with "*No Such Object
available on this agent at this OID*"

e.g:
snmpget -v2c -c public 10.10.116.16 1.3.6.1.2.1.1.2.0

*SNMPv2-MIB::sysObjectID.0 = No Such Object available on this agent at this
OID*


Whereas once the sub-agent connects to the agent, it returns proper OID.
e.g:
snmpget -v2c -c public 10.10.116.16 1.3.6.1.2.1.1.2.0

SNMPv2-MIB::sysObjectID.0 = OID: SNMPv2-SMI::enterprises.xxxx.4.1.1.1.100


My question is, is there a way to block an agent  from responding to
queries ( by timeout), till time the sub-agent connects to the agent.

-- 
Regards,
Feroz Ahmed

I have some qhestions about work you library.

[Иван И. <tir...@ya...>]

<div>I write some soft for network work with snmp. We have device with snmp server and whant to work with it via snmp lib. Now i have got some problem with work you snmp applications. I want to make snmpset and snmpget programs on the local host, transfering conection to server on device. The question is : where i should put ip adress of the snmp server and port for remote host. Can you make simple example about it, and it's will be nice if you will add this information to the documentation for you tools.</div><div> </div><div> </div><div> </div><div>All the best, Ivan Ivanov.</div><div> </div><div> </div>

netsnmpd: malloc(): smallbin double linked list corrupted

[Jenny Y. <jen...@gm...>]

Hi All,

We are running net-snmp 5.8 and use snmpd as proxy. We got the below crash.
At the same time frame, snmpd log showed:

2021-08-23_23:40:20.96206 malloc(): smallbin double linked list corrupted

Crash backtrace:

[New LWP 685]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/libthread_db.so.1".
Core was generated by `/usr/sbin/snmpd -f -c /etc/snmp/snmpd.conf
-Dsnmpd/main,mib_init -Lo -I usmConf'.
Program terminated with signal SIGABRT, Aborted.
#0 __GI_raise (sig=) at ../sysdeps/unix/sysv/linux/raise.c:50
50 return ret;
#0 __GI_raise (sig=) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x000000ffeabb5f68 in __GI_abort () at abort.c:79
#2 0x000000ffeabf8eb8 in __libc_message (action=, fmt=) at
../sysdeps/posix/libc_fatal.c:181
#3 0x000000ffeac01458 in malloc_printerr (str=) at malloc.c:5350
#4 0x000000ffeac04514 in _int_malloc (av=0xffead1b528 ,
bytes=1099159117824) at malloc.c:3648
#5 0x000000ffeac076a0 in __libc_calloc (n=, elem_size=) at malloc.c:3436
#6 0x000000ffeb17bb1c in netsnmp_create_delegated_cache () from
/usr/lib/libnetsnmpagent.so.35
#7 0x000000ffeaf08f5c in proxy_handler () from /usr/lib/libnetsnmpmibs.so.35
#8 0x000000ffeb17a8ec in netsnmp_call_handlers () from
/usr/lib/libnetsnmpagent.so.35
#9 0x000000ffeb18ea3c in handle_var_requests () from
/usr/lib/libnetsnmpagent.so.35
#10 0x000000ffeb18fe24 in handle_pdu () from /usr/lib/libnetsnmpagent.so.35
#11 0x000000ffeb190050 in netsnmp_handle_request () from
/usr/lib/libnetsnmpagent.so.35
#12 0x000000ffeb190744 in handle_snmp_packet () from
/usr/lib/libnetsnmpagent.so.35
warning: GDB can't find the start of the function at 0xffead72a6f.

Thanks a lot for your help.

Jenny Yao

Re: snmpwalk: security service 3 error parsing ScopedPDU

[Wes H. <har...@us...>]

chandrasekharreddy chinnapareddygari <cha...@ho...>
writes:

>                         variable-bindings: 1 item
>                             RFC1213-MIB::mib-2.15.3.1.1.4.0.0.41.218 (1.3.6.1.2.1.15.3.1.1.4.0.0.41.218): <MISSING>
>                                 Object Name: 1.3.6.1.2.1.15.3.1.1.4.0.0.41.218
> (RFC1213-MIB::mib-2.15.3.1.1.4.0.0.41.218)
>                                 Value (IpAddress): <MISSING>

So what do you mean by "<MISSING>"?  If the ScopedPDU isn't of the right
size, then the client does reject it as being incomplete.  IE, if the
agent is not sending a properly encoded scopedpdu there is nothing the
client and do (and its not its fault, it's the agent's).
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Code location of errorindex (response->errindex)

[Wes H. <har...@us...>]

Nishant Nayan <nay...@gm...> writes:

> I debugged in snmpget.c till the section where the request is performed.
> The errindex is getting set after the below function call (as one of
> the properties of &response) :-

So the error index is not set by snmpget, but by the agent that snmpget
is querying.  snmpget is just pulling the answer and the count from the
agent's response packet and not calculating it itself.
-- 
Wes Hardaker
Please mail all replies to net...@li...

net-snmp not returning number of descriptors when running OMAPI to DHCP server all on same linux platform

[Resham H. <Res...@ge...>]

We have a SNMP running with Sub-agents and are using the "snmp_select_info" call to find the number of file descriptors and then
perform a select call to get the data. However, when we run a OMAPI thread that communicates with a DHCP server over TCP connection to get lease information the "snmp_select_info" call doesn't provide the correct number of socket descriptors and so fails to communicate with our snmp manager.

As soon as we remove the OMAPI thread interface the "snmp_select_info" works fine. We have tried modifying the OMAPI default
port from 7911 to some other value, this has had no effect. The snmp agentX and OMAPI run in separate threads, can see the "snmp_select_info" being called, but the select fails, yet the OMAPI is fine in getting the lease information from the DHCP server.

The OMAPI is run as synchronous within its own thread.

It seems the number of sockets is not being updated "numfds" and "fdset" in the call to "snmp_select_info".


This e-mail, and any attachments to this e-mail, is intended only for use by the person or entity to which it is addressed and may contain confidential and/or legally privileged material. Any review, retransmission, dissemination, copying, or other use of, or taking of any action in reliance upon, this e-mail, and any attachments hereto, by persons or entities other than the intended recipient is strictly prohibited. If you received this in error, please contact the sender and permanently delete the original from any computer and destroy any printout thereof.

Code location of errorindex (response->errindex)

[Nishant N. <nay...@gm...>]

Hi,
    I am trying to know the code location where 'errorindex' is set when we
request a wrong OID.
For example in below command :-
snmpget -v1 -c cmty_remotehost1 localhost SNMPv2-MIB::sysName.1
SNMPv2-MIB::sysDescr.0 SNMPv2-MIB::sysObjectID.0

My first OID is wrong hence the errorindex would be 1 , this errorindex is
used to remove the faulty OID and retry the request.

I debugged in snmpget.c till the section where the request is performed.
The errindex is getting set after the below function call (as one of the
properties of &response) :-

 status = snmp_synch_response(ss, pdu, &response);

I debugged further to see the functions called by
snmp_synch_response(ss, pdu, &response)

but I am having a tough time finding it so far. Maybe I am missing
something. Please let me know for any suggestions. That would be
really helpful.

Regards

Nishant

snmpwalk: security service 3 error parsing ScopedPDU

[chandrasekharreddy c. <cha...@ho...>]

Hi  ,

I am getting "snmpwalk: security service 3 error parsing ScopedPDU "  and "Timeout: No Response from localhost" while doing snmpwalk on bgpI

SNMPv2 walk
-------------------
 snmpwalk -v2c -c public localhost 1.3.6.1.2.1.15.4
registered debug token recv, 1
recv: error while parsing VarBindList:
recv: Error: Generic error
recv: error while parsing VarBindList:
recv: Error: Generic error
recv: error while parsing VarBindList:
recv: Error: Generic error


SNMPv3 walk
---------------------
registered debug token recv, 1
recv: error while parsing VarBindList:
security service 3 error parsing ScopedPDU
recv: error while parsing VarBindList:
security service 3 error parsing ScopedPDU
recv: error while parsing VarBindList:
security service 3 error parsing ScopedPDU
recv: error while parsing VarBindList:
security service 3 error parsing ScopedPDU
recv: error while parsing VarBindList:
security service 3 error parsing ScopedPDU

Captured PCAP files between 5.7.2 client <---> 5.8 server  and 5.8 client <--->s5.8 server

My observations on the PCAP file.

server is 5.8 ---client 5.7.2
------------------------------------

the client is sending snmpwalk request  for bgpIdentifier
the server is responding to the client as below.


                        variable-bindings: 1 item
                            RFC1213-MIB::mib-2.15.3.1.1.4.0.0.41.218 (1.3.6.1.2.1.15.3.1.1.4.0.0.41.218): <MISSING>
                                Object Name: 1.3.6.1.2.1.15.3.1.1.4.0.0.41.218 (RFC1213-MIB::mib-2.15.3.1.1.4.0.0.41.218)
                                Value (IpAddress): <MISSING>


client is returning the o/p as 0.0.0.0 for bgp identifier.

case 2:
----------
 server is 5.8 or 5.9  ---- client 5.8 or 5.9

the client is sending snmpwalk request  for bgpIdentifier OID
the server is responding to the client as below.


                           variable-bindings: 1 item
                            RFC1213-MIB::mib-2.15.3.1.1.4.0.0.41.218 (1.3.6.1.2.1.15.3.1.1.4.0.0.41.218): <MISSING>
                                Object Name: 1.3.6.1.2.1.15.3.1.1.4.0.0.41.218 (RFC1213-MIB::mib-2.15.3.1.1.4.0.0.41.218)
                                Value (IpAddress): <MISSING>

the client is resending  requests bgpIdentifier

The issue is seeing on net-snmp 5.8 and net-snmp 5.9 SNMP clients.

Are there any behavioral changes between 5.8 and 5.7.2 clientsimplimentation?



Thanks,
Chandra Sekhar.



























Thanks

Chandra Sekhar