net-snmp-coders — Discussion of internal project coding (Please use this OR -users, NOT both!)

Re: Setting the uid and gid via a configuration file

[Wes H. <wjh...@uc...>]

>>>>> On Fri, 03 Nov 2000 11:22:16 -0800, Harrie Hazewinkel <ha...@co...> said:

Harrie> I will revise the patch over the weekend.

Great, then I'll let you change it and I'll apply it when you're done.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Checking out ucd-snmp-4.2-pre1

[Harrie H. <ha...@co...>]

Hi all,

I was wondering if why the distribution was not renamed
to net-snmp-4.2-pre1?

During testing I found the following in
'agent/mibgroup/examples/example.c' there are 2
almost equal fields.

    { EXAMPLETRIGGERTRAP, ASN_INTEGER, RWRITE, var_example, 2, {7, 0}},
    { EXAMPLETRIGGERTRAP2, ASN_INTEGER, RWRITE, var_example, 2, {7, 0}}

Attached patch fixes this.

Harrie
0- Harrie Hazewinkel ---------------------------------------0
 mailto:ha...@co...            phone:+1-415-536-5221
0-----------------------------------------------------------0

Re: Setting the uid and gid via a configuration file

[Harrie H. <ha...@co...>]

Wes Hardaker wrote:
> 
> >>>>> On Fri, 03 Nov 2000 08:04:49 -0800, Harrie Hazewinkel <ha...@co...> said:
> 
> Harrie> If the 'pwd'h' and 'grp.h' are not there, the agent must still
> Harrie> be a aware of the token in the configurstion file.
> 
> Why?  It can't make use of it.  Why not simply let the default
> unknown-token warning statement get issued.

OK, only the user must be aware of it. Then it is fine by me.
I will revise the patch over the weekend.


Harrie 
0- Harrie Hazewinkel ---------------------------------------0
 mailto:ha...@co...            phone:+1-415-536-5221
0-----------------------------------------------------------0

Re: Setting the uid and gid via a configuration file

[Wes H. <wjh...@uc...>]

>>>>> On Fri, 03 Nov 2000 08:04:49 -0800, Harrie Hazewinkel <ha...@co...> said:

Harrie> If the 'pwd'h' and 'grp.h' are not there, the agent must still
Harrie> be a aware of the token in the configurstion file.

Why?  It can't make use of it.  Why not simply let the default
unknown-token warning statement get issued.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Pluggable transport domains via register_readfd-like API?

[Dave S. <D.T...@cs...>]

>   Now, suppose that my transport service provides a socket interface.  It 
> would be really cool if I could register (and deregister) a socket for 
> standard "master agent"-style PDU processing, in the style of the 
> register_readfd etc. functions.  I see that there is already code to handle 
> the different hoops that need to be jumped throught for stream- versus 
> datagram-oriented transport services in _sess_read.  Essentially what would 
> be required would be a variant of snmp_sess_open which takes an already 
> fully open socket as an argument I think, though for sure there'd be other 
> things too.

OK - I'll bite.

As Wes and a few of the others know, I've been floating the idea of
stripping down the whole code base (both library and agent), and
re-designing it almost from the ground up.
  Every time I have to work on 'snmp_api.c' (in particular), my
head starts to hurt.   I've been wondering about trying to make use
of the {read,write,notify}_fd mechanism for the "normal" SNMP traffic
as well.  What you propose sounds (at first glance) to be along the
same sort of lines.

  My aims would be two-fold.  Firstly, to try and simplify the
arrangement of the code, to make it easier to understand, and maintain.
Secondly, to look at our current APIs, and use the change of project
name as an opportunity to make any (non-backward-compatible) amendments
that we think would be useful.

  Obviously, any such undertaking would be a fair amount of work, and
would probably result in a significant delay in the next release, so
this is very much a post-4.2 project.  And it would only be sensible
to attempt this if there was a general consensus that it was worth
while.   But since I've come out into the open with the idea, what
does anyone think?


Dave

Pluggable transport domains via register_readfd-like API?

[John N. <jb...@ca...>]

Hello,

  here's some Friday fun.  I'd like to be able to process SNMP packets that 
arrive at my agent over an AAL5 PVC.  This isn't a standard transport domain 
(AFAIK), so it's possible that strictly speaking this isn't SNMP, but let's 
ignore that for the moment.

  Now, suppose that my transport service provides a socket interface.  It 
would be really cool if I could register (and deregister) a socket for 
standard "master agent"-style PDU processing, in the style of the 
register_readfd etc. functions.  I see that there is already code to handle 
the different hoops that need to be jumped throught for stream- versus 
datagram-oriented transport services in _sess_read.  Essentially what would 
be required would be a variant of snmp_sess_open which takes an already 
fully open socket as an argument I think, though for sure there'd be other 
things too.  In fact, I think this would be a nice clean API, as it kind of 
separates out the stuff which is responsible for knowing about hostnames/IP 
addresses/PVCs/NSAPs/whatever and how to open the relevant sockets from the 
stuff which is concerned with actual SNMP session layer information 
(timeouts, retries, etc.).

  Anyone have any thoughts on this?  Or could see other uses for it maybe?  The alternative is just to kludge something, but I don't think it'd be a great deal more work to do it quite nicely, so I may have a crack at doing something like this some time soon.  So if anyone cares to point out the showstoppers now, before I start, that would be great! ;-)

John

-- 
// Dr. John Naylon // Senior Software Engineer // Cambridge Broadband Ltd.
// The future of broadband wireless access  // www.cambridgebroadband.com

Re: Setting the uid and gid via a configuration file

[Harrie H. <ha...@co...>]

"Michael J. Slifcak" wrote:
> 
> Do you think the load of logic is wotth the trouble ?
> 
> Seems to me a set of "configure" options would be
> easier, less overhead, more robust.

That is have the solution. If the 'pwd'h' and 'grp.h'
are not there, the agent must still be a aware of the
token in the configurstion file. One could decide in
that case you parse it as an unknown token, but from
a security point of view the user has to know it was
not parsed and should return an error.

> 
> most of us will use bin/bin -- anyone have other
> favorite user/group combinations ?

Yes. I do and there are others too I suppose.

> Honestly, how often would users want to configure
> the running user and group ids of this daemon ?

Once . At start up (each time).

> And, one more thought.  What should happen to the
> exec scripts when "nobody" owns the process ?

That needs to be fixed then. Of course, these scripts
most be executable by the user the deamon runs as.
I don't see this as any problem.


Harrie
0- Harrie Hazewinkel ---------------------------------------0
 mailto:ha...@co...            phone:+1-415-536-5221
0-----------------------------------------------------------0

Re: Setting the uid and gid via a configuration file

[Bert D. <dri...@pl...>]

On Thu, 2 Nov 2000, Michael J. Slifcak wrote:

> Do you think the load of logic is wotth the trouble ?
> 
> Seems to me a set of "configure" options would be
> easier, less overhead, more robust.

It works well with Squid and Apache, and it isn't rocket engineering.

> most of us will use bin/bin -- anyone have other
> favorite user/group combinations ?

Yeah. snmpd/snmpd. I never got round to installing mine as other than
root, but I never got rid of the queasy feeling either. If there is no
functional requirement for inter-subsystem file access, each should have
its own [ug]id. In an ideal world.

bin/bin is a particularly bad choice, because too many binaries have
those permissions and are security critical on most systems.

> Honestly, how often would users want to configure
> the running user and group ids of this daemon ?

Not too often, but using configure to provide this functionality ties
the binary to a particular machine. snmpd may have a completely
different UID on my build system than on a system in the field.

> And, one more thought.  What should happen to the
> exec scripts when "nobody" owns the process ?

Well, they'd better be prepared to cope with that. Again, the issue is
the same as with Apache and Squid and people have learned to live with
that (and in a lot of cases, not by doing a "chmod -R a+w /").

The long and short of it: I'm not too worried about snmpd running as
root (yet :-), but I think Harrie's suggestion is a good step forward.

Cheers,

				-- Bert


Bert Driehuis -- dri...@pl... -- +31-20-3116119
If the only tool you've got is an axe, every problem looks like fun!

Re: Setting the uid and gid via a configuration file

[Michael J. S. <msl...@is...>]

Do you think the load of logic is wotth the trouble ?

Seems to me a set of "configure" options would be
easier, less overhead, more robust.

most of us will use bin/bin -- anyone have other
favorite user/group combinations ?

Honestly, how often would users want to configure
the running user and group ids of this daemon ?

And, one more thought.  What should happen to the
exec scripts when "nobody" owns the process ?


Mike Slifcak, Internet Security Systems, Inc.

####

Harrie Hazewinkel wrote:
> 
> Wes Hardaker wrote:
> >
> > >>>>> On Thu, 02 Nov 2000 08:26:04 -0800, Harrie Hazewinkel <ha...@co...> said:
> >
> > Harrie> An option would be if pwd.h and grp.h are not present the
> > Harrie> snmpuser and snmpgroup are just read from the configuration
> > Harrie> file, but ignored.
> >
> > That's possible too, though not putting them in as valid tokens makes
> > more sense.  I'd *want* to know if the tokens weren't used (since I'd
> > then be running as root and not what I expected).
> 
> I agree. I was already looking in the error handling
> part of reading configuration files. The only thing
> is should we treat it as a warning or real error
> and even exit.
> 
> I would say error and exit.
> 
> Harrie
> 0- Harrie Hazewinkel ---------------------------------------0
>  mailto:ha...@co...            phone:+1-415-536-5221
> 0-----------------------------------------------------------0
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> http://lists.sourceforge.net/mailman/listinfo/net-snmp-coders

Re: Setting the uid and gid via a configuration file

[Harrie H. <ha...@co...>]

Wes Hardaker wrote:
> 
> >>>>> On Thu, 02 Nov 2000 08:26:04 -0800, Harrie Hazewinkel <ha...@co...> said:
> 
> Harrie> An option would be if pwd.h and grp.h are not present the
> Harrie> snmpuser and snmpgroup are just read from the configuration
> Harrie> file, but ignored.
> 
> That's possible too, though not putting them in as valid tokens makes
> more sense.  I'd *want* to know if the tokens weren't used (since I'd
> then be running as root and not what I expected).

I agree. I was already looking in the error handling
part of reading configuration files. The only thing
is should we treat it as a warning or real error
and even exit.

I would say error and exit.


Harrie 
0- Harrie Hazewinkel ---------------------------------------0
 mailto:ha...@co...            phone:+1-415-536-5221
0-----------------------------------------------------------0

Re: Setting the uid and gid via a configuration file

[Wes H. <wjh...@uc...>]

>>>>> On Thu, 02 Nov 2000 08:26:04 -0800, Harrie Hazewinkel <ha...@co...> said:

Harrie> An option would be if pwd.h and grp.h are not present the
Harrie> snmpuser and snmpgroup are just read from the configuration
Harrie> file, but ignored.

That's possible too, though not putting them in as valid tokens makes
more sense.  I'd *want* to know if the tokens weren't used (since I'd
then be running as root and not what I expected).

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Setting the uid and gid via a configuration file

[Harrie H. <ha...@co...>]

Wes Hardaker wrote:
> 
> Harrie> Attached is a patch that allows you to set the agent userid
> Harrie> and agent groupid from the configuration files.
> 
> I'd love to apply the patch, but I'll have to protect it against
> machines that don't have pwd.h and/or grp.h files plus the associated
> functions (eg, windows).

An option would be if pwd.h and grp.h are not present
the snmpuser and snmpgroup are just read from the configuration file,
but ignored.

Harrie
0- Harrie Hazewinkel ---------------------------------------0
 mailto:ha...@co...            phone:+1-415-536-5221
0-----------------------------------------------------------0

Re: ANNOUNCE: 4.2.pre1 released

[Wes H. <wjh...@uc...>]

>>>>> On 01 Nov 2000 17:19:15 -0800, Wes Hardaker <wjh...@uc...> said:

Wes> Ok, we've finally pressed a 4.2.pre1 release.  We're aware of a
Wes> few outstanding problems (especially with the agentx support),
Wes> but would love it if you would help us test out this pre-release.

By the way (I shouldn't write important notes like this when I'm half
asleep), please submit all new bug reports to the net-snmp bug
database at http://sourceforge.net/bugs/?group_id=12694.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Setting the uid and gid via a configuration file

[Wes H. <wjh...@uc...>]

Harrie> Attached is a patch that allows you to set the agent userid
Harrie> and agent groupid from the configuration files.

I'd love to apply the patch, but I'll have to protect it against
machines that don't have pwd.h and/or grp.h files plus the associated
functions (eg, windows).

-- 
Wes Hardaker
Please mail all replies to net...@li...

ANNOUNCE: 4.2.pre1 released

[Wes H. <wjh...@uc...>]

Ok, we've finally pressed a 4.2.pre1 release.  We're aware of a few
outstanding problems (especially with the agentx support), but would
love it if you would help us test out this pre-release.

On your architecture(s) of choice, configure and build it and see if
it meets your expectations.  Bad results durning "make test" would be
helpful as well.

Locations to pick up the tar ball are:
   http://download.sourceforge.net/net-snmp/ucd-snmp-4.2.pre1.tar.gz
   ftp://ucd-snmp.ucdavis.edu/beta/ucd-snmp-4.2.pre1.tar.gz

-- 
Wes Hardaker
Information Resources
University of California at Davis

Re: Setting the uid and gid via a configuration file

[<uc...@ra...>]

On Wed, Nov 01, 2000 at 01:09:21PM -0500, Michael J. Slifcak wrote:
> > Attached is a patch that allows you to set the agent userid
> > and agent groupid from the configuration files.
> > 
> > Example line for snmpd.conf: "agentuser snmp"
> > This will cause the snmp agent to run as the user 'snmp'.
> > It works similar as the commandline options.
> > 
> > I also have added the option in the manpages.
> 
> 
> I missed why this is important.  Please advise.

To change user in general, or to be able to do it from the
configuration-file?

The reason for changing the user in general, is for security. The deamon
must be started as root to be able to bind to the port and open files
(like /dev/kmem). If a bug would allow an attacker to manipulate the
agent to do something else (say a buffer overflow bug) the attacker
would gain root access easily.

If the deamon is running e.g. as user "nobody" there is less chance of
taking advantage of such a security hole.

Configuration-file / commandline options is of course just a question of
preferance - allowing both should make everyone happy :-)


-- 
Ragnar Kjørstad

Re: Setting the uid and gid via a configuration file

[Harrie H. <ha...@co...>]

"Michael J. Slifcak" wrote:
[snip]
> 
> I missed why this is important.  Please advise.

I left that out, since there was already support via the commandline.

Why this is important is because it allows you to drop
the user-id from 'root' to 'nobody' after you have open
the SNMP port for instance. So if someone hacks your process
and gets somehow access to the system he is
'nobody' instaed of 'root'.


> -Mike Slifcak, Internet Security Systems, Inc.

-- 
0- Harrie Hazewinkel ---------------------------------------0
 mailto:ha...@co...            phone:+1-415-536-5221
0-----------------------------------------------------------0

Re: Setting the uid and gid via a configuration file

[Michael J. S. <msl...@is...>]

Harrie Hazewinkel wrote:
> 
> HI,
> 
> Attached is a patch that allows you to set the agent userid
> and agent groupid from the configuration files.
> 
> Example line for snmpd.conf: "agentuser snmp"
> This will cause the snmp agent to run as the user 'snmp'.
> It works similar as the commandline options.
> 
> I also have added the option in the manpages.
> 
> Harrie
> 0- Harrie Hazewinkel ---------------------------------------0
>  mailto:ha...@co...            phone:+1-415-536-5221
> 0-----------------------------------------------------------0
> 


I missed why this is important.  Please advise.
-Mike Slifcak, Internet Security Systems, Inc.

Setting the uid and gid via a configuration file

[Harrie H. <ha...@co...>]

HI,

Attached is a patch that allows you to set the agent userid
and agent groupid from the configuration files.

Example line for snmpd.conf: "agentuser snmp"
This will cause the snmp agent to run as the user 'snmp'.
It works similar as the commandline options.

I also have added the option in the manpages.


Harrie 
0- Harrie Hazewinkel ---------------------------------------0
 mailto:ha...@co...            phone:+1-415-536-5221
0-----------------------------------------------------------0

Re: Little favour

[Md A S. <sa...@la...>]

Sorry for bombarding the request impolitely, infact i have been searching
for this since long time and i got exhausted so desperately i sent the
mail. Please pardon me!

> That said, I'm currently working to salvage the excellent work done by
> the BTNG team. It works fine as a standalone daemon on FreeBSD and
> BSD/OS. If you need it now, you're more than welcome to it but I won't
> be able to answer any questions about it.

Yes i really need it, please send me ftp/http address to download.

Thanks again,
saif.


On Wed, 1 Nov 2000, Bert Driehuis wrote:

> [ Please, DO NOT SPAM A GAZILLION MAILING LISTS LIKE YOU JUST DID. THIS
> IS HIGHLY OFFENSIVE. Sorry for shouting. I snipped 99% of the cc's from
> my reply. Sorry if you still get this twice. ]
> 
> On Wed, 1 Nov 2000, Md A Saifulla wrote:
> 
> > Thanks for the ucd-snmp(netsnmp) great services. Can anyone please tell me
> > where the RMON1/2 open source is available? I heard some one from ucd-snmp
> > is currently working on RMON MIB. I will be grateful if anyone can help
> > me.
> 
> To my knowledge, no-one is.
> 
> That said, I'm currently working to salvage the excellent work done by
> the BTNG team. It works fine as a standalone daemon on FreeBSD and
> BSD/OS. If you need it now, you're more than welcome to it but I won't
> be able to answer any questions about it.
> 
> Cheers,
> 
> 				-- Bert
> 
> Bert Driehuis -- dri...@pl... -- +31-20-3116119
> If the only tool you've got is an axe, every problem looks like fun!
> 

Re: Little favour

[Bert D. <dri...@pl...>]

[ Please, DO NOT SPAM A GAZILLION MAILING LISTS LIKE YOU JUST DID. THIS
IS HIGHLY OFFENSIVE. Sorry for shouting. I snipped 99% of the cc's from
my reply. Sorry if you still get this twice. ]

On Wed, 1 Nov 2000, Md A Saifulla wrote:

> Thanks for the ucd-snmp(netsnmp) great services. Can anyone please tell me
> where the RMON1/2 open source is available? I heard some one from ucd-snmp
> is currently working on RMON MIB. I will be grateful if anyone can help
> me.

To my knowledge, no-one is.

That said, I'm currently working to salvage the excellent work done by
the BTNG team. It works fine as a standalone daemon on FreeBSD and
BSD/OS. If you need it now, you're more than welcome to it but I won't
be able to answer any questions about it.

Cheers,

				-- Bert

Bert Driehuis -- dri...@pl... -- +31-20-3116119
If the only tool you've got is an axe, every problem looks like fun!

Little favour

[Md A S. <sa...@la...>]

Hello,

Thanks for the ucd-snmp(netsnmp) great services. Can anyone please tell me
where the RMON1/2 open source is available? I heard some one from ucd-snmp
is currently working on RMON MIB. I will be grateful if anyone can help
me.

Thanks in advance,
saif.

       ______________________________________________
     _ |  Saifulla M.A., M.Sc(CSE)., IIIsem M.S.    | _
    / )|  Dept. of Comp. Science,IIT,Madras.        |( \
   / / |      address  : 203,Krishna Hostel,IIT,    | \ \
 _( (  |  _   *******    Madras,T.N.-600036      _  |  ) )_
(((\ \ | / / also @:sa...@la...  < \ | / /)))
(\ \|/ /   Phone: (044) 445 - 9079, Room 203.    \ \|/ ////)
 \       /----------------------------------------\       /
  \     /                                          \     /
   \   /                                            \    \
===============================================================

polling for ifOperStatus

[Ron B. <ron...@al...>]

I am trying to write code to only get the ifOperStatus of the available =
interfaces and then write this info to a proc file. I've been looking at =
the interfaces.c file trying to use some of that code. I don't want to =
fill the entire ifnet structure. I'm still not entirely sure how to =
retrieve this information. Could someone give me a hand.

Thanks

DISPLAY-HINT and TEXTUAL-CONVENTIONS

[<Igo...@vf...>]

Hi,

I have 2 questions regarding textual conventions, for example if I 
define an SNMP object to be of type DateString (as defined here), 
what sort of value would I have to send in order that the user 
requesting a variable actually receives 26-Jun-2000. Would an SNMP 
Manager use MIB file and the DISPLAY-HINT clause to format the 
actual output on the management console screen ? 

DateString ::= TEXTUAL-CONVENTION
	DISPLAY-HINT	"1d-3a-2d"
	STATUS			current
	DESCRIPTION
		"Date specification as delimited octet strings. The strings
are 
		converted as follows:
		    field  octets  contents                  range
		    -----  ------  --------                  -----
		      1       1    day                       1..31
		      2      2-5   month                    Jan-Dec
		      3       6    year                     0..65536
		
		    For example, Monday 26th June, 2000 at 13:30 would be
		    displayed as:
		            26-Jun-2000"
	SYNTAX			OCTET STRING (SIZE (6))

Other question is regarding following textual convention
Percent ::= TEXTUAL-CONVENTION
	DISPLAY-HINT	"d-2"
	STATUS			current
	DESCRIPTION
		"Ratio expressed as an integer, formatted so that decimal
		point makes it into a real number with 2 decimal places.
		For example, integer 5367 will be rendered as 53.67"
	SYNTAX		INTEGER (0..10000)

Would it be possible to use this so I can say send a value of 5367, and 
the DISPLAY-HINT would format it as 53.67.

Thank you,

Igor Naumovski

Re: Duplicating snmp values at another location in the MIB

[Dave S. <D.T...@cs...>]

> What is the simplest way to use/duplicate SNMP information at another place
> in the MIB?

The "simplest" way is to use the same code file for both.
Just register it twice, giving the two locations.
You may need to make minor adjustments to accomodate differences
between the two groups (e.g. OID lengths or new/dropped objects).

See the mibII/at.c file for an example.


Alternatively,  you can reference the same underlying data structure in
a different file, and reproduce the relevant bits of the var_xxx routine
that report them.

Dave