net-snmp-coders — Discussion of internal project coding (Please use this OR -users, NOT both!)

Mib VNX 5500

[Alex O. <af...@ho...>]

Hi friend, do you have mib for VNX 5500 ?, send me please.  Or Where do you think I can find it ? I want to monitor disks, cpu, memory, etc.

Best regards,

Alex Ordóñez Vélez

snmptrapd queue+retry

[Feroz <fer...@gm...>]

hi,
Is it possible for snmptrapd to buffer/queue the TRAP's and INFORM's and
perform retry in case of failure to forward them to the destination?

I see "serverRecvBuf", "serverSendBuf","retries"  but they don't seem to
work, when used in snmptrapd.conf file.

--
Regards,
Feroz Ahmed

Re: How to avoid having ".0" at the end of the oids coming from a module

[dga <dam...@go...>]

Thanks a lot Magnus for your answer !

I ever saw this kind of answers on the forum, so you probably right ... 
However I not sure to understand it clearly in fact (may be there is 
another way to do it ?)

Anyway I had to find a solution, and I manage to remove the ".0" at the 
end of the oid, doing a fix on the function (header_generic):

int header_generic_fix(struct variable *vp,
                    oid * name,
                    size_t * length,
                    int exact, size_t * var_len, WriteMethod ** 
write_method,
                    int offset, int index)
{
     oid newname[MAX_OID_LEN];
     int result;

     memcpy((char *) newname, (char *) vp->name, (int) vp->namelen * 
sizeof(oid));

     result = snmp_oid_compare(name, *length, newname, vp->namelen);

     /* In case some OID of the "fake" interface are requested, we 
remove them */
     if (newname[index] == offset-1) {
         newname[index]=offset;
         result=1;
     }

     if ((exact && (result != 0)) || (!exact && (result >= 0))) return 
(MATCH_FAILED);
     memcpy((char *) name, (char *) newname, ((int) vp->namelen) * 
sizeof(oid));
     *length = vp->namelen;

     *write_method = (WriteMethod*)0;
     *var_len = sizeof(long);    /* default to 'long' results */
     return (MATCH_SUCCEEDED);
}

And I use it like that:

     if (header_generic_fix(vp, name, length, exact, var_len, 
write_method, OFFSET_TO_GPON, sizeof(gpon_fields_alias_oid)/sizeof(int) 
+ 1) == MATCH_FAILED) {
         snmp_log(LOG_ERR, "Error header_generic_fix: return 
MATCH_FAILED !\n");
         return NULL;
     }

/!\ I do not advise to do this. There is probably another solution to do 
it correctly ...

Best Regards,

Damien GARCIA


Le 16/04/2021 à 23:31, Magnus Fromreide a écrit :
> On Fri, Apr 16, 2021 at 04:41:43PM +0200, dga via Net-snmp-coders wrote:
>> Hello,
>>
>> I have written a module allowing to add "specifics" interfaces at a fixed
>> oid (50000) following the "linux" interfaces provided by default by the
>> package (version 5.7.3).
>>
>> However, it's not good for the customer has there is ".0" at the end of the
>> oids inserted for the "specifics" interfaces (the same oids for the "linux"
>> interfaces do not have this ".0" at the end).
>>
>> Example: request on the "alias field" of the mib2 (in ifXEntry)
>>
>> $ snmpwalk -v2c -c neufnet 192.168.247.123 1.3.6.1.2.1.31.1.1.1.18
>> iso.3.6.1.2.1.31.1.1.1.18.1 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.2 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.3 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.4 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.5 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.6 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.7 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.8 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.9 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.10 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.11 = ""
>> iso.3.6.1.2.1.31.1.1.1.18.50000.0 = STRING: "description of the specific
>> interface"        <= Here is the oid inserted by the module with the ".0" at
>> the end
>>
>> Instead of having:
>>
>> iso.3.6.1.2.1.31.1.1.1.18.50000.0 = STRING: "description of the specific
>> interface"
>>
>> I would like having:
>>
>> iso.3.6.1.2.1.31.1.1.1.18.50000 = STRING: "description of the specific
>> interface"
>>
>>
>> May be someone has ever faced the same issue ?
> ifXEntry is a table and so ifAlias has an index value last.
>
> ifAlias has the oid .1.3.6.1.2.1.31.1.1.1.18 and you want 50000 to be
> the table index. It sounds as if you are registering ifXEntry.*.50000 as
> singular values and those should have a trailing 0, like e.g.
> sysContact and the helpers are adding those for you.
>
> You want to add a table row, not a number of values.
>
> /MF
>
>> Best Regards,
>>
>> Damien GARCIA
>>
>>
>> Bellow the some parts of the code I use to create the module:
>>
>>
>> #define OFFSET_TO_GPON 50000
>>
>> #define ALIAS    18
>>
>> static struct variable2 gpon_fields_alias[] = { ALIAS, ASN_OCTET_STR, RONLY,
>> var_update_field, 2, { 18, 0 } };
>>
>> static oid gpon_fields_alias_oid[] = { 1, 3, 6, 1, 2, 1, 31, 1, 1, 1 }; /*
>> .1.3.6.1.2.1.31.1.1.1  (ifXEntry) */
>>
>> static void register_mib_interface_tree()
>> {
>>      /* Register OID for gpon0 alias in ifXEntry*/
>>      gpon_fields_alias[0].name[1] = OFFSET_TO_GPON;
>>      REGISTER_MIB("gpon_fields_alias", gpon_fields_alias, variable2,
>> gpon_fields_alias_oid);
>> }
>>
>> static u_char* var_update_field(struct variable *vp, oid * name, size_t *
>> length, int exact, size_t * var_len, WriteMethod ** write_method)
>> {
>>      DEBUGMSGTL(("gpon0", "var_update_field entered\n"));
>>      if (header_generic(vp, name, length, exact, var_len, write_method) ==
>> MATCH_FAILED) {
>>          snmp_log(LOG_ERR, "Error header_generic_fix: return MATCH_FAILED
>> !\n");
>>          return NULL;
>>      }
>>
>>      switch (vp->magic) {
>>      case ALIAS: /* This object is an 'alias' name for the interface as
>> specified by a network manager, and provides a non-volatile 'handle' for the
>> interface */
>>          *var_len = strlen(descriptionGpon_g);
>>          return (u_char *) descriptionGpon_g;
>>
>>      default:
>>          DEBUGMSGTL(("snmpd", "unknown sub-id %d in
>> mib_gpon/var_update_field\n", vp->magic));
>>
>>      }
>>      return NULL;
>> }
>>
>>
>>
>> _______________________________________________
>> Net-snmp-coders mailing list
>> Net...@li...
>> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders

Net-SNMP AgentX - Problem with new MIB and snmpset

[Simone M. <sim...@gm...>]

Hi all,
I'm a newbie with AgentX. I need to extend snmpd with a new custom MIB
module.
I have NET-SNMP version 5.5 on Redhat, I would implement perl API, using
NetSNMP::agent.
Hereby, the steps I've done:

- /etc/snmp/snmpd.conf
#sec.name              source        community
com2sec notConfigUser  default       public
#groupName              securityModel securityName
group   notConfigGroup  v1            notConfigUser
group   notConfigGroup  v2c           notConfigUser
#name           incl/excl     subtree         mask(optional)
view all        included      .1
#group               context sec.model sec.level prefix   read write  notif
access  notConfigGroup ""      any       noauth    exact  all   all   none
master    agentx

- MIB module
My custom MIB is related to an active alarms table for fault management.
It must be queryable from an external management station.
The MIB file (ACM-LOGWATCH-MIB) is located in /usr/share/snmp/mibs
directory.

Here the subset for Table:

acmLogWatchTable OBJECT-TYPE
    SYNTAX      SEQUENCE OF acmLogWatchEntry
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        "Table of objects"
    ::= { acmLogWatch 10 }

acmLogWatchEntry OBJECT-TYPE
    SYNTAX      acmLogWatchEntry
    MAX-ACCESS  read-only
    STATUS      current
    DESCRIPTION
        ""
    INDEX   { acmLogWatchIndex }
    ::= { acmLogWatchTable 1 }

acmLogWatchEntry ::= SEQUENCE {
    acmLogWatchIndex                   Integer32,
    acmLogWatchSpecificProblem         DisplayString,
    acmLogWatchProbableCause           DisplayString,
}

acmLogWatchIndex OBJECT-TYPE
                                SYNTAX  INTEGER
                                ACCESS  read-only
                                STATUS  mandatory
                                DESCRIPTION
                                "A unique value for each active alarm"
                                ::= { acmLogWatchEntry 1 }

acmLogWatchSpecificProblem              OBJECT-TYPE
                                SYNTAX      DisplayString
                                MAX-ACCESS  read-write
                                STATUS      current
                                DESCRIPTION
                                "the specific problem of the alarm"
                                ::= { acmLogWatchEntry 2 }

acmLogWatchProbableCause                OBJECT-TYPE
                                SYNTAX      DisplayString
                                MAX-ACCESS  read-write
                                STATUS      current
                                DESCRIPTION
                                "the probable cause of the alarm"
                                ::= { acmLogWatchEntry 3 }

snmpset is used to set OID's Values.

- perl code:

use NetSNMP::agent (':all');
use NetSNMP::ASN (':all');
use NetSNMP::OID(':all');

my $default_SP = "SP 1";
my $default_PC = "PC 1";

sub myhandler {
    my ($handler, $registration_info, $request_info, $requests) = @_;
        my $request;

    for($request = $requests; $request; $request = $request->next()) {
        my $oid = $request->getOID();
        if ($request_info->getMode() == MODE_GET) {
            # ... generally, you would calculate value from oid
            if ($oid == new
NetSNMP::OID(".1.3.6.1.4.1.193.37.10.11.64.10.1.2.0")) {
            $request->setValue(ASN_OCTET_STR, $default_SP);
            }
            if ($oid == new
NetSNMP::OID(".1.3.6.1.4.1.193.37.10.11.64.10.1.3.0")) {
            $request->setValue(ASN_OCTET_STR, $default_PC);
            }
        } elsif ($request_info->getMode() == MODE_GETNEXT) {
            # ... generally, you would calculate value from oid
            if ( $oid < new
NetSNMP::OID(".1.3.6.1.4.1.193.37.10.11.64.10.1.2.0")) {
            $request->setOID(".1.3.6.1.4.1.193.37.10.11.64.10.1.2.0");
            $request->setValue(ASN_OCTET_STR, $default_SP);
            $request->setOID(".1.3.6.1.4.1.193.37.10.11.64.10.1.3.0");
            $request->setValue(ASN_OCTET_STR, $default_PC);
            }
        } elsif ($request_info->getMode() == MODE_SET_RESERVE1) {
            if ( ( $oid != new
NetSNMP::OID(".1.3.6.1.4.1.193.37.10.11.64.10.1.2.0")) and ( $oid != new
NetSNMP::OID(".1.3.6.1.4.1.193.37.10.11.64.10.1.3.0")) ) {  # do error
checking here
            $request->setError($request_info, SNMP_ERR_NOSUCHNAME);
            }
        } elsif ($request_info->getMode() == MODE_SET_ACTION) {
            # ... (or use the value)
            $value = $request->getValue();
        }
    }

}

my $agent = new NetSNMP::agent(
    # makes the agent read a my_agent_name.conf file
    'Name' => "my_agent_name",
    'AgentX' => 1
    );
$agent->register("my_agent_name", ".1.3.6.1.4.1.193.37.10.11.64.10",
    \&myhandler);

my $running = 1;
while($running) {
    $agent->agent_check_and_process(1);
}

$agent->shutdown();

Results:

# snmpget -v2c -c public localhost .1.3.6.1.4.1.193.37.10.11.64.10.1.2.0
ACM-LOGWATCH-MIB::acmLogWatchSpecificProblem.0 = STRING: SP 1
# snmpget -v2c -c public localhost .1.3.6.1.4.1.193.37.10.11.64.10.1.3.0
ACM-LOGWATCH-MIB::acmLogWatchProbableCause.0 = STRING: PC 1

SNMPWALK doesn't show all the OID's set, but last one:
# snmpwalk -v2c -c public localhost .1.3.6.1.4.1.193.37.10.11.64.10
ACM-LOGWATCH-MIB::acmLogWatchProbableCause.0 = STRING: PC 1

SNMPSET doesn't work:
[root@redhatgp ACM]# snmpset -v2c -c public localhost
.1.3.6.1.4.1.193.37.10.11.64.10.1.3.0 s "PC 2"
ACM-LOGWATCH-MIB::acmLogWatchProbableCause.0 = STRING: PC 2
[root@redhatgp ACM]# snmpget -v2c -c public localhost
.1.3.6.1.4.1.193.37.10.11.64.10.1.3.0
ACM-LOGWATCH-MIB::acmLogWatchProbableCause.0 = STRING: PC 1

Can anyone help me?

Thanks
Simone

Re: How to avoid having ".0" at the end of the oids coming from a module

[Magnus F. <ma...@ly...>]

On Fri, Apr 16, 2021 at 04:41:43PM +0200, dga via Net-snmp-coders wrote:
> Hello,
> 
> I have written a module allowing to add "specifics" interfaces at a fixed
> oid (50000) following the "linux" interfaces provided by default by the
> package (version 5.7.3).
> 
> However, it's not good for the customer has there is ".0" at the end of the
> oids inserted for the "specifics" interfaces (the same oids for the "linux"
> interfaces do not have this ".0" at the end).
> 
> Example: request on the "alias field" of the mib2 (in ifXEntry)
> 
> $ snmpwalk -v2c -c neufnet 192.168.247.123 1.3.6.1.2.1.31.1.1.1.18
> iso.3.6.1.2.1.31.1.1.1.18.1 = ""
> iso.3.6.1.2.1.31.1.1.1.18.2 = ""
> iso.3.6.1.2.1.31.1.1.1.18.3 = ""
> iso.3.6.1.2.1.31.1.1.1.18.4 = ""
> iso.3.6.1.2.1.31.1.1.1.18.5 = ""
> iso.3.6.1.2.1.31.1.1.1.18.6 = ""
> iso.3.6.1.2.1.31.1.1.1.18.7 = ""
> iso.3.6.1.2.1.31.1.1.1.18.8 = ""
> iso.3.6.1.2.1.31.1.1.1.18.9 = ""
> iso.3.6.1.2.1.31.1.1.1.18.10 = ""
> iso.3.6.1.2.1.31.1.1.1.18.11 = ""
> iso.3.6.1.2.1.31.1.1.1.18.50000.0 = STRING: "description of the specific
> interface"        <= Here is the oid inserted by the module with the ".0" at
> the end
> 
> Instead of having:
> 
> iso.3.6.1.2.1.31.1.1.1.18.50000.0 = STRING: "description of the specific
> interface"
> 
> I would like having:
> 
> iso.3.6.1.2.1.31.1.1.1.18.50000 = STRING: "description of the specific
> interface"
> 
> 
> May be someone has ever faced the same issue ?

ifXEntry is a table and so ifAlias has an index value last.

ifAlias has the oid .1.3.6.1.2.1.31.1.1.1.18 and you want 50000 to be
the table index. It sounds as if you are registering ifXEntry.*.50000 as
singular values and those should have a trailing 0, like e.g.
sysContact and the helpers are adding those for you.

You want to add a table row, not a number of values.

/MF

> 
> Best Regards,
> 
> Damien GARCIA
> 
> 
> Bellow the some parts of the code I use to create the module:
> 
> 
> #define OFFSET_TO_GPON 50000
> 
> #define ALIAS    18
> 
> static struct variable2 gpon_fields_alias[] = { ALIAS, ASN_OCTET_STR, RONLY,
> var_update_field, 2, { 18, 0 } };
> 
> static oid gpon_fields_alias_oid[] = { 1, 3, 6, 1, 2, 1, 31, 1, 1, 1 }; /*
> .1.3.6.1.2.1.31.1.1.1  (ifXEntry) */
> 
> static void register_mib_interface_tree()
> {
>     /* Register OID for gpon0 alias in ifXEntry*/
>     gpon_fields_alias[0].name[1] = OFFSET_TO_GPON;
>     REGISTER_MIB("gpon_fields_alias", gpon_fields_alias, variable2,
> gpon_fields_alias_oid);
> }
> 
> static u_char* var_update_field(struct variable *vp, oid * name, size_t *
> length, int exact, size_t * var_len, WriteMethod ** write_method)
> {
>     DEBUGMSGTL(("gpon0", "var_update_field entered\n"));
>     if (header_generic(vp, name, length, exact, var_len, write_method) ==
> MATCH_FAILED) {
>         snmp_log(LOG_ERR, "Error header_generic_fix: return MATCH_FAILED
> !\n");
>         return NULL;
>     }
> 
>     switch (vp->magic) {
>     case ALIAS: /* This object is an 'alias' name for the interface as
> specified by a network manager, and provides a non-volatile 'handle' for the
> interface */
>         *var_len = strlen(descriptionGpon_g);
>         return (u_char *) descriptionGpon_g;
> 
>     default:
>         DEBUGMSGTL(("snmpd", "unknown sub-id %d in
> mib_gpon/var_update_field\n", vp->magic));
> 
>     }
>     return NULL;
> }
> 
> 
> 
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders

How to avoid having ".0" at the end of the oids coming from a module

[dga <dam...@go...>]

Hello,

I have written a module allowing to add "specifics" interfaces at a 
fixed oid (50000) following the "linux" interfaces provided by default 
by the package (version 5.7.3).

However, it's not good for the customer has there is ".0" at the end of 
the oids inserted for the "specifics" interfaces (the same oids for the 
"linux" interfaces do not have this ".0" at the end).

Example: request on the "alias field" of the mib2 (in ifXEntry)

$ snmpwalk -v2c -c neufnet 192.168.247.123 1.3.6.1.2.1.31.1.1.1.18
iso.3.6.1.2.1.31.1.1.1.18.1 = ""
iso.3.6.1.2.1.31.1.1.1.18.2 = ""
iso.3.6.1.2.1.31.1.1.1.18.3 = ""
iso.3.6.1.2.1.31.1.1.1.18.4 = ""
iso.3.6.1.2.1.31.1.1.1.18.5 = ""
iso.3.6.1.2.1.31.1.1.1.18.6 = ""
iso.3.6.1.2.1.31.1.1.1.18.7 = ""
iso.3.6.1.2.1.31.1.1.1.18.8 = ""
iso.3.6.1.2.1.31.1.1.1.18.9 = ""
iso.3.6.1.2.1.31.1.1.1.18.10 = ""
iso.3.6.1.2.1.31.1.1.1.18.11 = ""
iso.3.6.1.2.1.31.1.1.1.18.50000.0 = STRING: "description of the specific 
interface"        <= Here is the oid inserted by the module with the 
".0" at the end

Instead of having:

iso.3.6.1.2.1.31.1.1.1.18.50000.0 = STRING: "description of the specific 
interface"

I would like having:

iso.3.6.1.2.1.31.1.1.1.18.50000 = STRING: "description of the specific 
interface"


May be someone has ever faced the same issue ?


Best Regards,

Damien GARCIA


Bellow the some parts of the code I use to create the module:


#define OFFSET_TO_GPON 50000

#define ALIAS    18

static struct variable2 gpon_fields_alias[] = { ALIAS, ASN_OCTET_STR, 
RONLY, var_update_field, 2, { 18, 0 } };

static oid gpon_fields_alias_oid[] = { 1, 3, 6, 1, 2, 1, 31, 1, 1, 1 }; 
/* .1.3.6.1.2.1.31.1.1.1  (ifXEntry) */

static void register_mib_interface_tree()
{
     /* Register OID for gpon0 alias in ifXEntry*/
     gpon_fields_alias[0].name[1] = OFFSET_TO_GPON;
     REGISTER_MIB("gpon_fields_alias", gpon_fields_alias, variable2, 
gpon_fields_alias_oid);
}

static u_char* var_update_field(struct variable *vp, oid * name, size_t 
* length, int exact, size_t * var_len, WriteMethod ** write_method)
{
     DEBUGMSGTL(("gpon0", "var_update_field entered\n"));
     if (header_generic(vp, name, length, exact, var_len, write_method) 
== MATCH_FAILED) {
         snmp_log(LOG_ERR, "Error header_generic_fix: return 
MATCH_FAILED !\n");
         return NULL;
     }

     switch (vp->magic) {
     case ALIAS: /* This object is an 'alias' name for the interface as 
specified by a network manager, and provides a non-volatile 'handle' for 
the interface */
         *var_len = strlen(descriptionGpon_g);
         return (u_char *) descriptionGpon_g;

     default:
         DEBUGMSGTL(("snmpd", "unknown sub-id %d in 
mib_gpon/var_update_field\n", vp->magic));

     }
     return NULL;
}

Net-SNMP V5.9.1.pre1 released for testing

[Wes H. <har...@us...>]

It was produced from the V5-9-patches branch and is available here:

https://sourceforge.net/projects/net-snmp/files/net-snmp/5.9.1-pre-releases/

Please take it for a test drive and see how it fairs.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: MIB search path

[Craig S. <cs...@dr...>]

Hi Simon,

net-snmp-config is a shell script that literally prints $HOME/.snmp/mibs

snmpinform (or actually the snmp library) is a little more complicated with
a bunch of overrides.

So I'm trying to get what you see with:
# HOME=/home/root snmpinform -v 2c -c public -m blahmib  127.0.0.1 1 blahoid
MIB search path:
/home/root/.snmp/mibs:/usr/share/snmp/mibs:/usr/share/snmp/mibs/iana:/usr/share/snmp/mibs/ietf
Cannot find module (blahmib): At line 1 in (none)
blahoid: Unknown Object Identifier (Sub-id not found: (top) -> blahoid)

That output is a standard Debian setup, yours might be slightly different.

Try with an extra flag -Dget_mib_directory (before the IP address), it will
tell you what the library is doing with the MIB directories.

 - Craig

MIB search path

[Simon C. <sim...@mp...>]

Hi,

When using snmpinform, I get the messages:

SNMPInform failed: MIB search path: /root/.snmp/mibs:/usr/share/snmp/mibs

Where are these MIB search paths defined?

When I issue:
# net-snmp-config --default-mibdirs
/home/root/.snmp/mibs:/usr/share/snmp/mibs

So it should look for:
 /home/root/.snmp/mibs  but instead it looks for /root/.snmp/mibs.

Also,
# echo $HOME
/home/root

Why are the applications looking for the MIB in the wrong path ?

Thanks,
S.

NET-SNMP version: 5.8 - v1/ v2 blocked, v3 works

[Simon C. <sim...@mp...>]

Hi,

Seems like v1/v2 is blocked while v3 works fine.


*V3 works Fine*
# snmpget  -v 3 -u Simon -a MD5 -A simon123 -l authNoPriv  localhost
 NEM-DCI-MIB::nemDCISnmpTrapPort.0
NEM-DCI-MIB::nemDCISnmpTrapPort.0 = INTEGER: 162

*V1/V2 does not work*
# snmpget -v 2c -c public localhost  NEM-DCI-MIB::nemDCISnmpTrapPort.0
NEM-DCI-MIB::nemDCISnmpTrapPort.0 = No Such Object available on this agent
at this OID

# snmpget -v 1 -c public localhost  NEM-DCI-MIB::nemDCISnmpTrapPort.0
Error in packet
Reason: (noSuchName) There is no such variable name in this MIB.
Failed object: NEM-DCI-MIB::nemDCISnmpTrapPort.0


*The config file I have is:*

createUser Simon    MD5 "simon123"
rwuser     Simon
# rocommunity: a SNMPv1/SNMPv2c read-only access community name
rocommunity  public

# rwcommunity: a SNMPv1/SNMPv2c read-write access community name
rwcommunity  private


Any clues on why this is happening?

Thanks,
Simon

Re: support for SHA2 in net-snmp-5.9

[Pushpa T. <pus...@gm...>]

It is resolved by adding ''--with-openssl' .


---------------------------------------------------------
            Net-SNMP configuration summary:
---------------------------------------------------------

  SNMP Versions Supported:    1 2c 3
  Building for:               linux
  Net-SNMP Version:           5.9
  Network transport support:  Callback Unix Alias TCP UDP TCPIPv6 UDPIPv6
IPv4Base SocketBase TCPBase UDPIPv4Base UDPBase IPBase IPv6Base
  SNMPv3 Security Modules:     usm
  Agent MIB code:            default_modules mibII snmpv3mibs =>
 snmpv3mibs mibII ucd_snmp notification notification-log-mib target
agent_mibs agentx disman/event disman/schedule utilities host
mibII/system_mib mibII/sysORTable mibII/snmp_mib mibII/vacm_vars
mibII/setSerialNo mibII/at mibII/ifTable mibII/ip mibII/tcp mibII/udp
mibII/ipv6 mibII/icmp if-mib ip-mib ip-forward-mib tcp-mib udp-mib
snmpv3/snmpEngine snmpv3/snmpMPDStats snmpv3/usmStats snmpv3/usmConf
snmpv3/usmUser
  MYSQL Trap Logging:         unavailable
  Embedded Perl support:      disabled
  SNMP Perl modules:          disabled
  SNMP Python modules:        disabled
  Crypto support from:        crypto
  Authentication support:     MD5 SHA1 SHA224 SHA256 SHA384 SHA512
  Encryption support:         DES AES AES128 AES192 AES192C AES256 AES256C
  Local DNSSEC validation:    disabled

---------------------------------------------------------

On Wed, Mar 10, 2021 at 9:28 PM Pushpa Thimmaiah <pus...@gm...>
wrote:

> Hi All,
>
> It is resolved by adding ''--without-openssl' .
>
>
> ---------------------------------------------------------
>             Net-SNMP configuration summary:
> ---------------------------------------------------------
>
>   SNMP Versions Supported:    1 2c 3
>   Building for:               linux
>   Net-SNMP Version:           5.9
>   Network transport support:  Callback Unix Alias TCP UDP TCPIPv6 UDPIPv6
> IPv4Base SocketBase TCPBase UDPIPv4Base UDPBase IPBase IPv6Base
>   SNMPv3 Security Modules:     usm
>   Agent MIB code:            default_modules mibII snmpv3mibs =>
>  snmpv3mibs mibII ucd_snmp notification notification-log-mib target
> agent_mibs agentx disman/event disman/schedule utilities host
> mibII/system_mib mibII/sysORTable mibII/snmp_mib mibII/vacm_vars
> mibII/setSerialNo mibII/at mibII/ifTable mibII/ip mibII/tcp mibII/udp
> mibII/ipv6 mibII/icmp if-mib ip-mib ip-forward-mib tcp-mib udp-mib
> snmpv3/snmpEngine snmpv3/snmpMPDStats snmpv3/usmStats snmpv3/usmConf
> snmpv3/usmUser
>   MYSQL Trap Logging:         unavailable
>   Embedded Perl support:      disabled
>   SNMP Perl modules:          disabled
>   SNMP Python modules:        disabled
>   Crypto support from:        crypto
>   Authentication support:     MD5 SHA1 SHA224 SHA256 SHA384 SHA512
>   Encryption support:         DES AES AES128 AES192 AES192C AES256 AES256C
>   Local DNSSEC validation:    disabled
>
> ---------------------------------------------------------
>
> On Wed, Mar 10, 2021 at 4:30 PM Pushpa Thimmaiah <
> pus...@gm...> wrote:
>
>> Hi All,
>>
>> I tried configure net-snmp-5.9  to enable  AES192, SHA2  for my work.   I
>> have used option '--enable-blumenthal-aes'  while configure , however
>> config log shows no details of sha2. Am I missing any config option here?
>>
>> ./configure '--prefix=/home//software/snmp8/snmpprefix'
>> '--with-default-snmp-version=3' '--with-sys-contact=te...@gm...'
>> '--with-sys-location=blocka' '--with-logfile=/home/software/snmp8/snmplog'
>> '--with-persistent-directory=/home/software/snmp8/snmper'
>> '--without-perl-modules' '--without-python-modules'
>> '--disable-embedded-perl' '--disable-shared' '--enable-static'
>> '--with-security-modules=usm' '--enable-ipv6' '--with-pic' '--with-cc=gcc'
>> 'CC=gcc' 'CFLAGS=-m64' '--with-mib-modules=mibII,snmpv3mibs'*
>> '--enable-blumenthal-aes'*
>>
>> ==================================================================
>> ---------------------------------------------------------
>>             Net-SNMP configuration summary:
>> ---------------------------------------------------------
>>
>>   SNMP Versions Supported:    1 2c 3
>>   Building for:               linux
>>   Net-SNMP Version:           5.9
>>   Network transport support:  Callback Unix Alias TCP UDP TCPIPv6 UDPIPv6
>> IPv4Base SocketBase TCPBase UDPIPv4Base UDPBase IPBase IPv6Base
>>   SNMPv3 Security Modules:     usm
>>   Agent MIB code:            default_modules mibII snmpv3mibs =>
>>  snmpv3mibs mibII ucd_snmp notification notification-log-mib target
>> agent_mibs agentx disman/event disman/schedule utilities host
>> mibII/system_mib mibII/sysORTable mibII/snmp_mib mibII/vacm_vars
>> mibII/setSerialNo mibII/at mibII/ifTable mibII/ip mibII/tcp mibII/udp
>> mibII/ipv6 mibII/icmp if-mib ip-mib ip-forward-mib tcp-mib udp-mib
>> snmpv3/snmpEngine snmpv3/snmpMPDStats snmpv3/usmStats snmpv3/usmConf
>> snmpv3/usmUser
>>   MYSQL Trap Logging:         unavailable
>>   Embedded Perl support:      disabled
>>   SNMP Perl modules:          disabled
>>   SNMP Python modules:        disabled
>>   Crypto support from:        internal
>>   *Authentication support:     MD5 SHA1*
>>   Encryption support:         DES AES AES128
>>   Local DNSSEC validation:    disabled
>>
>> ====================================================
>>
>

Re: support for SHA2 in net-snmp-5.9

[Pushpa T. <pus...@gm...>]

Hi All,

It is resolved by adding ''--without-openssl' .


---------------------------------------------------------
            Net-SNMP configuration summary:
---------------------------------------------------------

  SNMP Versions Supported:    1 2c 3
  Building for:               linux
  Net-SNMP Version:           5.9
  Network transport support:  Callback Unix Alias TCP UDP TCPIPv6 UDPIPv6
IPv4Base SocketBase TCPBase UDPIPv4Base UDPBase IPBase IPv6Base
  SNMPv3 Security Modules:     usm
  Agent MIB code:            default_modules mibII snmpv3mibs =>
 snmpv3mibs mibII ucd_snmp notification notification-log-mib target
agent_mibs agentx disman/event disman/schedule utilities host
mibII/system_mib mibII/sysORTable mibII/snmp_mib mibII/vacm_vars
mibII/setSerialNo mibII/at mibII/ifTable mibII/ip mibII/tcp mibII/udp
mibII/ipv6 mibII/icmp if-mib ip-mib ip-forward-mib tcp-mib udp-mib
snmpv3/snmpEngine snmpv3/snmpMPDStats snmpv3/usmStats snmpv3/usmConf
snmpv3/usmUser
  MYSQL Trap Logging:         unavailable
  Embedded Perl support:      disabled
  SNMP Perl modules:          disabled
  SNMP Python modules:        disabled
  Crypto support from:        crypto
  Authentication support:     MD5 SHA1 SHA224 SHA256 SHA384 SHA512
  Encryption support:         DES AES AES128 AES192 AES192C AES256 AES256C
  Local DNSSEC validation:    disabled

---------------------------------------------------------

On Wed, Mar 10, 2021 at 4:30 PM Pushpa Thimmaiah <pus...@gm...>
wrote:

> Hi All,
>
> I tried configure net-snmp-5.9  to enable  AES192, SHA2  for my work.   I
> have used option '--enable-blumenthal-aes'  while configure , however
> config log shows no details of sha2. Am I missing any config option here?
>
> ./configure '--prefix=/home//software/snmp8/snmpprefix'
> '--with-default-snmp-version=3' '--with-sys-contact=te...@gm...'
> '--with-sys-location=blocka' '--with-logfile=/home/software/snmp8/snmplog'
> '--with-persistent-directory=/home/software/snmp8/snmper'
> '--without-perl-modules' '--without-python-modules'
> '--disable-embedded-perl' '--disable-shared' '--enable-static'
> '--with-security-modules=usm' '--enable-ipv6' '--with-pic' '--with-cc=gcc'
> 'CC=gcc' 'CFLAGS=-m64' '--with-mib-modules=mibII,snmpv3mibs'*
> '--enable-blumenthal-aes'*
>
> ==================================================================
> ---------------------------------------------------------
>             Net-SNMP configuration summary:
> ---------------------------------------------------------
>
>   SNMP Versions Supported:    1 2c 3
>   Building for:               linux
>   Net-SNMP Version:           5.9
>   Network transport support:  Callback Unix Alias TCP UDP TCPIPv6 UDPIPv6
> IPv4Base SocketBase TCPBase UDPIPv4Base UDPBase IPBase IPv6Base
>   SNMPv3 Security Modules:     usm
>   Agent MIB code:            default_modules mibII snmpv3mibs =>
>  snmpv3mibs mibII ucd_snmp notification notification-log-mib target
> agent_mibs agentx disman/event disman/schedule utilities host
> mibII/system_mib mibII/sysORTable mibII/snmp_mib mibII/vacm_vars
> mibII/setSerialNo mibII/at mibII/ifTable mibII/ip mibII/tcp mibII/udp
> mibII/ipv6 mibII/icmp if-mib ip-mib ip-forward-mib tcp-mib udp-mib
> snmpv3/snmpEngine snmpv3/snmpMPDStats snmpv3/usmStats snmpv3/usmConf
> snmpv3/usmUser
>   MYSQL Trap Logging:         unavailable
>   Embedded Perl support:      disabled
>   SNMP Perl modules:          disabled
>   SNMP Python modules:        disabled
>   Crypto support from:        internal
>   *Authentication support:     MD5 SHA1*
>   Encryption support:         DES AES AES128
>   Local DNSSEC validation:    disabled
>
> ====================================================
>

support for SHA2 in net-snmp-5.9

[Pushpa T. <pus...@gm...>]

Hi All,

I tried configure net-snmp-5.9  to enable  AES192, SHA2  for my work.   I
have used option '--enable-blumenthal-aes'  while configure , however
config log shows no details of sha2. Am I missing any config option here?

./configure '--prefix=/home//software/snmp8/snmpprefix'
'--with-default-snmp-version=3' '--with-sys-contact=te...@gm...'
'--with-sys-location=blocka' '--with-logfile=/home/software/snmp8/snmplog'
'--with-persistent-directory=/home/software/snmp8/snmper'
'--without-perl-modules' '--without-python-modules'
'--disable-embedded-perl' '--disable-shared' '--enable-static'
'--with-security-modules=usm' '--enable-ipv6' '--with-pic' '--with-cc=gcc'
'CC=gcc' 'CFLAGS=-m64' '--with-mib-modules=mibII,snmpv3mibs'*
'--enable-blumenthal-aes'*

==================================================================
---------------------------------------------------------
            Net-SNMP configuration summary:
---------------------------------------------------------

  SNMP Versions Supported:    1 2c 3
  Building for:               linux
  Net-SNMP Version:           5.9
  Network transport support:  Callback Unix Alias TCP UDP TCPIPv6 UDPIPv6
IPv4Base SocketBase TCPBase UDPIPv4Base UDPBase IPBase IPv6Base
  SNMPv3 Security Modules:     usm
  Agent MIB code:            default_modules mibII snmpv3mibs =>
 snmpv3mibs mibII ucd_snmp notification notification-log-mib target
agent_mibs agentx disman/event disman/schedule utilities host
mibII/system_mib mibII/sysORTable mibII/snmp_mib mibII/vacm_vars
mibII/setSerialNo mibII/at mibII/ifTable mibII/ip mibII/tcp mibII/udp
mibII/ipv6 mibII/icmp if-mib ip-mib ip-forward-mib tcp-mib udp-mib
snmpv3/snmpEngine snmpv3/snmpMPDStats snmpv3/usmStats snmpv3/usmConf
snmpv3/usmUser
  MYSQL Trap Logging:         unavailable
  Embedded Perl support:      disabled
  SNMP Perl modules:          disabled
  SNMP Python modules:        disabled
  Crypto support from:        internal
  *Authentication support:     MD5 SHA1*
  Encryption support:         DES AES AES128
  Local DNSSEC validation:    disabled

====================================================

double free crash, with snmp_sess_timeout

[SURYA T S <sur...@gm...>]

Hi,

I am using netsnmp 5.8, and facing double free crash on
snmp_synch_response, while trying to send snmp inform packets. Crash
is happening in snmp_sess_timeout, while trying to free varbinds.

gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1 0x0000ffffad811f54 in __GI_abort () at abort.c:79
#2 0x0000ffffad85c274 in __libc_message (action=action@entry=do_abort,
fmt=fmt@entry=0xffffad914a68 "%s\n")
at ../sysdeps/posix/libc_fatal.c:181
#3 0x0000ffffad86352c in malloc_printerr (str=str@entry=0xffffad9104f0
"double free or corruption (!prev)") at malloc.c:5332
#4 0x0000ffffad8650d0 in _int_free (av=0xffffa8000020,
p=0xffffa8007de0, have_lock=) at malloc.c:4317
#5 0x0000ffffada30834 in snmp_free_varbind (var=) at snmp_api.c:5800
#6 0x0000ffffada34bf8 in snmp_free_pdu (pdu=0xffffa80133f0) at snmp_api.c:5840
#7 snmp_free_pdu (pdu=0xffffa80133f0) at snmp_api.c:5809
#8 0x0000ffffada36a40 in snmp_sess_timeout
(sessp=sessp@entry=0xffffa8006710) at snmp_api.c:7189
#9 0x0000ffffada36b98 in snmp_timeout () at snmp_api.c:7017
#10 0x0000ffffada13a80 in snmp_synch_response_cb (ss=0xffffa8001660,
pdu=pdu@entry=0xffffa80133f0,
response=response@entry=0xffffacc96078, pcb=pcb@entry=0xffffada12f80
<snmp_synch_input>) at snmp_client.c:1085
#11 0x0000ffffada13bc4 in snmp_synch_response (ss=,
pdu=pdu@entry=0xffffa80133f0,
response=response@entry=0xffffacc96078) at snmp_client.c:1126

I have tried patches below patches as mentioned in
https://sourceforge.net/p/net-snmp/patches/1391/?limit=25, but issue
is still seen.

0002-snmplib-snmp_api-Remove-the-request-on-the-session-w.patch
0001-BUG2914-Agent-master-needs-to-treat-resend-as-normal.patch

Do I need to add any more patches to get this issue fixed.

Re: Client snmptrap does not encrypt PDU for AES user

[Jenny Y. <jen...@gm...>]

Hi team,

   Sorry, false alarm. I forgot to add `-l authPriv`.

Thanks,
Jenny

On Sat, Mar 6, 2021 at 12:09 AM Jenny Yao <jen...@gm...> wrote:

> Hi team,
>
>     I am using net-snmp 5.8 with AES. And I found out that snmptrap does
> not encrypt the PDU. snmpwalk, snmpd, and snmptrapd encrypt fine. Do I miss
> something in my config?
>
> vm4:~$ snmptrap -dd -v 3 -u u1 -a SHA -A "12345678" -x AES -X "12345678"
> localhost:16662 '' '.1.3.6.1.6.3.1.1.5.4' .1.3.6.1.6.3.1.1.5.4 s "eth0"
>
>
> Sending 162 bytes to UDP: [127.0.0.1]:16662->[0.0.0.0]:0
>
> 0000: 30 81 9F 02  01 03 30 10  02 04 55 D6  CF 0B 02 02
> 0.....0...U.....
>
> 0016: 05 C0 04 01  00 02 01 03  04 23 30 21  04 11 80 00
> .........#0!....
>
> 0032: 1F 88 80 28  21 85 2B F7  36 43 60 00  00 00 00 02
> ...(!.+.6C`.....
>
> 0048: 01 01 02 01  00 04 02 75  31 04 00 04  00 30 63 04
> .......u1....0c.
>
> 0064: 11 80 00 1F  88 80 28 21  85 2B F7 36  43 60 00 00
> ......(!.+.6C`..
>
> 0080: 00 00 04 00  A7 4C 02 04  6C 1A 74 05  02 01 00 02
> .....L..l.t.....
>
> 0096: 01 00 30 3E  30 10 06 08  2B 06 01 02  01 01 03 00
> ..0>0...+.......
>
> 0112: 43 04 0B 12  AC 4F 30 17  06 0A 2B 06  01 06 03 01
> C....O0...+.....
>
> 0128: 01 04 01 00  06 09 2B 06  01 06 03 01  01 05 04 30
> ......+........0
>
> 0144: 11 06 09 2B  06 01 06 03  01 01 05 04  04 04 65 74
> ...+..........et
>
> 0160: 68 30                                                 h0
>
>
> vm4:~$ snmptrap --version
>
> NET-SNMP version: 5.8
>
> Your help is appreciated.
>
> Thanks,
> Jenny Yao
>

Client snmptrap does not encrypt PDU for AES user

[Jenny Y. <jen...@gm...>]

Hi team,

    I am using net-snmp 5.8 with AES. And I found out that snmptrap does
not encrypt the PDU. snmpwalk, snmpd, and snmptrapd encrypt fine. Do I miss
something in my config?

vm4:~$ snmptrap -dd -v 3 -u u1 -a SHA -A "12345678" -x AES -X "12345678"
localhost:16662 '' '.1.3.6.1.6.3.1.1.5.4' .1.3.6.1.6.3.1.1.5.4 s "eth0"


Sending 162 bytes to UDP: [127.0.0.1]:16662->[0.0.0.0]:0

0000: 30 81 9F 02  01 03 30 10  02 04 55 D6  CF 0B 02 02    0.....0...U.....

0016: 05 C0 04 01  00 02 01 03  04 23 30 21  04 11 80 00    .........#0!....

0032: 1F 88 80 28  21 85 2B F7  36 43 60 00  00 00 00 02    ...(!.+.6C`.....

0048: 01 01 02 01  00 04 02 75  31 04 00 04  00 30 63 04    .......u1....0c.

0064: 11 80 00 1F  88 80 28 21  85 2B F7 36  43 60 00 00    ......(!.+.6C`..

0080: 00 00 04 00  A7 4C 02 04  6C 1A 74 05  02 01 00 02    .....L..l.t.....

0096: 01 00 30 3E  30 10 06 08  2B 06 01 02  01 01 03 00    ..0>0...+.......

0112: 43 04 0B 12  AC 4F 30 17  06 0A 2B 06  01 06 03 01    C....O0...+.....

0128: 01 04 01 00  06 09 2B 06  01 06 03 01  01 05 04 30    ......+........0

0144: 11 06 09 2B  06 01 06 03  01 01 05 04  04 04 65 74    ...+..........et

0160: 68 30                                                 h0


vm4:~$ snmptrap --version

NET-SNMP version: 5.8

Your help is appreciated.

Thanks,
Jenny Yao

Re: Getting double free or corruption

[Feroz <fer...@gm...>]

Do the patch mentioned for CVE-2019-20892 in the link below, will fix this
double free crash?
Is it safe to appy this patch?

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20892

-Feroz


On Fri, 5 Mar, 2021, 2:01 am chandrasekharreddy c, <
cha...@ho...> wrote:

> Hi  Team,
>
>
> I'm upgraded to net-snmp 5.8 version recently.
> I'm getting snmpd core dump with double free while doing snmpv3 bulk get.
> I compared net-snmp 5.8 and 5.9.
> It looks like some changes happend.
> My bt is like this.
>
> #0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
>
> #1 0x0000ffffa3729f54 in __GI_abort () at abort.c:79
>
> #2 0x0000ffffa3774274 <+913774274> in __libc_message (action=action@entry=do_abort,
> fmt=fmt@entry=0xffffa382ca68 "%s\n") at ../sysdeps/posix/libc_fatal.c:181
>
> #3 0x0000ffffa377b52c in malloc_printerr (str=str@entry=0xffffa3828468
> <+913828468> "double free or corruption (fasttop)") at malloc.c:5332
>
> #4 0x0000ffffa377cdec in _int_free (av=<optimized out>, p=0x4d56b0,
> have_lock=0) at malloc.c:4266
>
> #5 0x0000ffffa38e98c8 in usm_free_usmStateReference (old=old@entry=0x56dc60)
> at snmpusm.c:313
>
> #6 0x0000ffffa38ee194 in usm_generate_out_msg (msgProcModel=<optimized
> out>, globalData=<optimized out>, globalDataLen=27, maxMsgSize=<optimized
> out>, secModel=<optimized
>
> out>, secEngineID=<optimized out>, secEngineIDLen=<optimized out>,
> secName=<optimized out>, secNameLen=5, secLevel=3, scopedPdu=0xfffff9717bb0
> "0\202\004\321\004\033\200", scopedPduLen=1237, secStateRef=0x56dc60,
> secParams=0x5639fb ' ' <repeats 200 times>..., secParamsLen=0xfffff9717b00,
> wholeMsg=0xfffff9717b10, wholeMsgLen=0xfffff97182e8) at snmpusm.c:1201
>
> #7 0x0000ffffa38eec0c in usm_secmod_generate_out_msg (parms=<optimized
> out>) at snmpusm.c:868
>
> #8 0x0000ffffa38a9b20 in snmpv3_packet_build (session=session@entry=0x456bd0,
> pdu=pdu@entry=0x577340 <+91577340>, packet=0x5639e0 "0\202",
> out_length=out_length@entry=0xfffff97182e8,
>
> pdu_data=pdu_data@entry=0x0, pdu_data_len=pdu_data_len@entry=0) at
> snmp_api.c:3085
>
> #9 0x0000ffffa38ab824 in snmpv3_build (pdu=0x577340 <+91577340>,
> session=0x456bd0, offset=0xfffff9718228 <+919718228>,
> pkt_len=0xfffff97182e8, pkt=0xfffff97182d0) at snmp_api.c:2561
>
> #10 _snmp_build (pdu=0x577340 <+91577340>, session=0x456bd0,
> offset=0xfffff9718228 <+919718228>, pkt_len=0xfffff97182e8,
> pkt=0xfffff97182d0) at snmp_api.c:3143
>
> #11 snmp_build (pkt=0xfffff97182d0, pkt_len=0xfffff97182e8, offset=0xfffff
> 9718228 <+919718228>, pss=0x456bd0, pdu=0x577340) <+91577340> at
> snmp_api.c:3482
>
> #12 0x0000ffffa38abd20 in netsnmp_build_packet (isp=isp@entry=0x4bd9d0,
> sp=sp@entry=0x456bd0, pdu=pdu@entry=0x577340 <+91577340>,
> pktbuf_p=pktbuf_p@entry=0xfffff97182d0, pktbuf_len_p=pktbuf_len_p@entry=0xfffff97182e0,
> pkt_p=pkt_p@entry=0xfffff97182d8, len_p=len_p@entry=0xfffff97182e8) at
> snmp_api.c:5294
>
> #13 0x0000ffffa38abec4 in _build_initial_pdu_packet (slp=<optimized out>,
> pdu=0x577340 <+91577340>, bulk=1) at snmp_api.c:5471
>
> #14 0x0000ffffa49ac874 in netsnmp_wrap_up_request (asp=asp@entry=0x4c9c30,
> status=status@entry=0) at snmp_agent.c:2011
>
> #15 0x0000ffffa49afc0c in check_delayed_request (asp=asp@entry=0x4c9c30)
> at snmp_agent.c:3470
>
> #16 0x0000ffffa49afca8 in netsnmp_check_delegated_requests () at
> snmp_agent.c:3282
>
> #17 0x0000ffffa49b08c4 in netsnmp_check_outstanding_agent_requests () at
> snmp_agent.c:3314
>
> #18 0x0000000000403 <+91000000000403>da0 in ?? ()
>
> #19 0x000000000040361c in ?? ()
>
> #20 0x0000ffffa372a3ac in __libc_start_main (main=0x4025a0, argc=7,
> argv=0xfffff9718858 <+919718858>, init=<optimized out>, fini=<optimized
> out>, rtld_fini=<optimized out>, stack_end=<optimized out>) at
> ../csu/libc-start.c:308
>
> #21 0x00000000004039 <+910000000004039>bc in ?? ()
>
>
> How to get patch details .can you please help me
>
>
>
> Thanks,
> Chandra
>
> Get Outlook for Android <https://aka.ms/ghei36>
> _______________________________________________
> Net-snmp-users mailing list
> Net...@li...
> Please see the following page to unsubscribe or change other options:
> https://lists.sourceforge.net/lists/listinfo/net-snmp-users
>

Re: Compiling Net-SNMP with TLS and DTLS Support

[Craig S. <cs...@dr...>]

On Wed, 24 Feb 2021 at 01:59, Simon Chamlian <sim...@mp...> wrote:

> When these flags (--with-security-modules and --with-transports) are not
> specified, what does snmpv3 uses by default?
>

The default set of security modules is defined in
configure.d/config_modules_security_modules and is just usm.
USM is the standard User Security Module we all know and love that uses a
username given in the request (plus optional authentication) to authorise
access to the agent.

The default set of transports are (depending on the operating system)
TCPIPv6 UDPIPv6 TCP UDP Alias Unix and Callback defined in
config_modules_transport

Most distributions will not use the defaults as they will enable or disable
various things. For example, recent Debian versions come with tsm and the
related transports enabled.

You need secure transports for tsm to work as there is no authentication
information in the SNMP packet but is found in the transport (e.g. UDP by
itself has no user or password). Protocols such as DTLS have the concept of
user (called a principal).

 - Craig

Re: NOOB Question - Adding Enterprise MIBs to an Agent

[Craig S. <cs...@dr...>]

On Fri, 26 Feb 2021 at 10:38, Michael Klett <Mi...@vu...>
wrote:

> We have decided to use Linux for our next project so I’m working on
> learning Linux at the same time that I’m tasked with adding our Enterprise
> MBs to the firmware of the new project.  I have been Google-ing for days
> and my Google-Fu is simply not good enough.  Is there a tutorial out on the
> web that explains this process?  There are tons of devices that implement
> SNMP Agents so among some people this must be well known and understood.
> I’d like to break into that fraternity.  Where is a good place to start
> learning how to add Enterprise MIBs to snmpd?
>
Hi Michael,
  Have you looked at the tutorial located at
http://www.net-snmp.org/wiki/index.php/TUT:Writing_a_Dynamically_Loadable_Object


You could use mib2c as well which can take a MIB and produce C skeleton.

My suggestion would be to look at the net SNMP tutorials and get the
tutorial MIB going first because its a known quantity. Then once you're
happy that works, try it with your own MIB.

You could also use a sub-agent which is a special SNMP agent just for your
collection of items.

 - Craig

NOOB Question - Adding Enterprise MIBs to an Agent

[Michael K. <Mi...@vu...>]

Net SNMP Coder,

I'm brand new at this, a noob.  We have a working product running on an RTOS that is an SNMP Agent and it provides several MIBs / OiDs to the outside world.  At this point I'm not even smart enough to know what questions I should be asking.

We have decided to use Linux for our next project so I'm working on learning Linux at the same time that I'm tasked with adding our Enterprise MBs to the firmware of the new project.  I have been Google-ing for days and my Google-Fu is simply not good enough.  Is there a tutorial out on the web that explains this process?  There are tons of devices that implement SNMP Agents so among some people this must be well known and understood.  I'd like to break into that fraternity.  Where is a good place to start learning how to add Enterprise MIBs to snmpd?

The Google search that got me the closest was, "customizing ubuntu snmp agent"

Thanks,
Michael

[Vubiq-email-signature-logo]
Michael F. Klett
Principle Systems Engineer
Vubiq Networks, Inc.
9231 Irvine Blvd
Irvine, CA  92618

Mi...@vu...<mailto:Mi...@vu...>
Direct:  949-226-8405
Cell:      303-775-5179
www.vubiqnetworks.com<http://www.vubiqnetworks.com/>

Software is free!  But, correctly placing all the ones and zeros is priceless.

  *   Ron Brombach

still reachable loss record

[jayshankar n. <jay...@gm...>]

Hi,

I am testing net-snmp for memory leaks with valgrind. I am getting the
message for still reachable in loss record. I analyze the code parse.c. It
is allocating memory for tp structure and calling do_subtree recursively.

Let me know is this an issue.

Thanks,
Jayshankar

 21,888 bytes in 114 blocks are still reachable in loss record 1,091 of
1,099
==60263==    at 0x4C2C089: calloc (vg_replace_malloc.c:760)
==60263==    by 0x63413D8: do_subtree (parse.c:1611)
==60263==    by 0x6341543: do_subtree (parse.c:1627)
==60263==    by 0x6341543: do_subtree (parse.c:1627)
==60263==    by 0x6341543: do_subtree (parse.c:1627)
==60263==    by 0x6341543: do_subtree (parse.c:1627)
==60263==    by 0x6341543: do_subtree (parse.c:1627)
==60263==    by 0x6343FF6: do_linkup (parse.c:1770)
==60263==    by 0x6343FF6: parse.constprop.7 (parse.c:4363)
==60263==    by 0x63444DB: read_module_internal (parse.c:3920)
==60263==    by 0x6342B4D: netsnmp_read_module (parse.c:4016)
==60263==    by 0x6332A6F: netsnmp_init_mib (mib.c:2657)
==60263==    by 0x63569A4: init_snmp (snmp_api.c:852)

Net-SNMP compile with Apple IOS

[Powrie, W. <wp...@in...>]

Hi Everyone,

I have an application that uses Net-SNMP for monitoring the runtime health of electrical devices. This application currently only runs on the Microsoft Windows environment.

The intention is to try to port it such that it can run on an Apple IPhone or IPad. Is there a way the Net-SNMP library can be built for the latest version of Apple IOS, for example version 14?

Apologies if this question has already been asked.

Best Regards

William Powrie

________________________________

Este correo electr?nico y, en su caso, cualquier fichero anexo al mismo, contiene informaci?n de car?cter confidencial exclusivamente dirigida a su destinatario o destinatarios. Si no es vd. el destinatario indicado, queda notificado que la lectura, utilizaci?n, divulgaci?n y/o copia sin autorizaci?n est? prohibida en virtud de la legislaci?n vigente. En el caso de haber recibido este correo electr?nico por error, se ruega notificar inmediatamente esta circunstancia mediante reenv?o a la direcci?n electr?nica del remitente.
Evite imprimir este mensaje si no es estrictamente necesario.

This email and any file attached to it (when applicable) contain(s) confidential information that is exclusively addressed to its recipient(s). If you are not the indicated recipient, you are informed that reading, using, disseminating and/or copying it without authorisation is forbidden in accordance with the legislation in effect. If you have received this email by mistake, please immediately notify the sender of the situation by resending it to their email address.
Avoid printing this message if it is not absolutely necessary.

Compiling Net-SNMP with TLS and DTLS Support

[Simon C. <sim...@mp...>]

Hi,

Compiling Net-SNMP with TLS and DTLS Support

Just ensure you have a recent version of OpenSSL
<http://net-snmp.sourceforge.net/wiki/index.php/OpenSSL> installed as well
as run configure with the following two options in addition to your normal
options:

# ./configure *--with-security-modules=tsm --with-transports=TLSTCP,DTLSUDP*


When these flags (--with-security-modules and --with-transports) are not
specified, what does snmpv3 uses by default?

Thanks,
S.



>

Re: Traditional API & snmpv3

[Harald K. <hk...@hk...>]

On 17.02.21 15:48, Wes Hardaker wrote:
> Harald Krammer <hk...@hk...> writes:
> 
>> If an SNMPv3 node is missing, the function is blocked.
> 
> What function is getting blocked?  Anything in our library should return
> with a timeout error just like v1/v2.  Yes, the engineID won't be
> retrievable but it shouldn't cause anything to hang indefinitely.
> 

snmpv3_engineID_probe works synchronously. It takes approx. 6 seconds 
per query on missing node (6 repetitions after waiting 1 s). This now 
delays the query interval for snmpv3. The problem is now, if I query 150 
nodes and e.g. 100 nodes are missing, then the query interval increases 
to 600 seconds. The interval should stay at e.g. 60 seconds. 
Unfortunately, this behavior is not accepted.

Running snmpv3_engineID_probe asynchronously is a solution, but it's not 
that easy for me.

Nice greetings
Harald

Re: A simple C program which sends v2c informs do not make retries in case of unavailable destination

[<AYa...@ib...>]

Hi,

Thanks for your hint.
With snmp_synch_response it works properly.

Best regards, 
Andrei Yahorau



From:   "Craig Small" <csmall@dropbear.xyz>
To:     AYa...@ib...
Cc:     "net-snmp coders" <net...@li...>
Date:   28.01.2021 04:20
Subject:        Re: A simple C program which sends v2c informs do not make 
retries in case of unavailable destination



Hi,
  Maybe have a look at the source to snmptrap to see how its done there?

snmp_send seems to be a fire and forget.  

You probably want snmp_synch_response or to look how it does the select, 
read and timeout functions and copy that.

 - Craig


On Thu, 28 Jan 2021 at 01:35, <AYa...@ib...> wrote:
Hello!

Did anyone face the same behaviour? 
Why the retries are not accepted?

What is necessary to do in order to resolve this situation? 

Best regards, 
Andrei Yahorau 



From:        Andrei Yahorau/IBA 
To:        net...@li... 
Date:        08.05.2020 10:37 
Subject:        A simple C program which sends v2c informs do not make 
retries in case of unavailable destination 


Hello Everyone! 

I have a question. I want to send SNMP v2c informs using C and net-snmp 
module in linux SLES 12.
To do this I created the following simple program where everything comes 
to send_trap_to_sess() function :

#include <net-snmp/net-snmp-config.h>
#include <net-snmp/net-snmp-includes.h>
oid             objid_sysuptime[] = { 1, 3, 6, 1, 2, 1, 1, 3, 0 };
oid             objid_id[] = { 1,3,6,1,4,1,78945,1,1,2,4,0};
oid             objid_name[] = { 1,3,6,1,4,1,78945,1,1,2,1,0};
oid              trap_oid[] = {1,3,6,1,4,1,78945,1,1,1,1,1};
int main()
{
   netsnmp_session session, *ss;
   netsnmp_pdu    *pdu, *response;
   char *trap = NULL;

   char comm[] = "public";
   snmp_sess_init( &session );
   session.version = SNMP_VERSION_2c;
   session.community = comm;
   session.community_len = strlen(session.community);
   session.peername = "192.168.4.10:1234"; 
    session.retries = 3; 
    session.timeout = 1000;
   ss = snmp_open(&session);
   if (!ss) {
     snmp_sess_perror("ack", &session);
     exit(1);
   }
   pdu = snmp_pdu_create(SNMP_MSG_INFORM);
   pdu->community = comm;
   pdu->community_len = strlen(comm);
   pdu->trap_type = SNMP_TRAP_ENTERPRISESPECIFIC;
   long sysuptime;
   char csysuptime [20];
   sysuptime = get_uptime ();
   sprintf (csysuptime, "%ld", sysuptime);
   trap = csysuptime;
   snmp_add_var (pdu, objid_sysuptime, sizeof (objid_sysuptime)/sizeof
(oid),'t', trap);
   snmp_add_var(pdu, trap_oid, OID_LENGTH(trap_oid), 'o', 
"1.3.6.1.4.1.78945.1.1.1.1.1");
   snmp_add_var(pdu, objid_name, OID_LENGTH(objid_name), 's', "Test Name"
);
   snmp_add_var(pdu, objid_id, OID_LENGTH(objid_id) , 'i', "5468");
   send_trap_to_sess (ss, pdu);
   snmp_close(ss);
   return (0);
}


Frankly speaking this is modified part of code taken from 
https://stackoverflow.com/questions/30050542/how-to-send-v2-traps-in-net-snmp-using-c 
 where a user asked how to send snmp v2c trap using C. 
Here I modified creation of pdu:
pdu = snmp_pdu_create(SNMP_MSG_INFORM);
and added assignments of retries and timeout values for informs
session.retries = 3; 
session.timeout = 1000; 

This example works quite well. I see that it sends inform request in 
wireshark output. But there is one problem: If the destination is not 
available it will not do any retries despite that this is an inform.

Could you please give me a suggestion what I do wrong here? 
Thank you in advance.

Best regards, 
Andrei Yahorau 
_______________________________________________
Net-snmp-coders mailing list
Net...@li...
https://lists.sourceforge.net/lists/listinfo/net-snmp-coders