net-snmp-coders — Discussion of internal project coding (Please use this OR -users, NOT both!)

Backporting "SNMPv3 not-in-time window after 248 days" fix

[Bong C. <nik...@gm...>]

Hi,

We've encountered the "SNMPv3 not-in-time window after 248 days" problem
and I thought of backporting the fix from 5.2 to the previous version
(upgrading seems to be very complicated in our system). But I am having
difficulty figuring out what set of changes were made to fix this.

Can somebody point me in the right direction on how to get this
information? Were there any patches for this available given that we are
talking about a very old version.

Thanks for your help.

Irvin

Re: helpers/scalar's realloc() of rootoid vs. netsnmp_subtree_split copying just the known size

[Bill F. <fe...@gm...>]

I happened to get to talk to Wes about this, and his answer was basically
that these things were not meant to be mixed in this way.  I have since
changed my code to use netsnmp_register_scalar when I want to shadow a
scalar, and that works fine.

  Bill


On Wed, Nov 9, 2022 at 8:36 AM Bill Fenner <fe...@gm...> wrote:

> Hi,
>
> I have a MIB module that uses netsnmp_register_scalar() which realloc's
> the given root oid to have one more space in it, so that
> the netsnmp_scalar_helper_handler can use that space to store the ".0"
> instance during the handling of a request.
>
> This all works fine, until we register an instance for the same object via
> netsnmp_register_instance() - or, really, until that instance gets
> unregistered, via unregister_mib_context().  At this point, we go back to
> calling the scalar handler for that object, but, due to the duplicate
> registration, that scalar handler's registration has been duplicated via
> netsnmp_subtree_split.  Understandably, when netsnmp_subtree_split
> duplicates an OID, it doesn't add the magic extra space that the scalar
> helper needs, so after this registration and unregistration, the scalar
> helper starts stomping on memory it doesn't own.
>
> Is anyone familiar enough with this code to be able to suggest a way
> forward? If the scalar helper wants an extra oid's worth of memory in the
> rootoid pointer, it's almost like netsnmp_subtree_split needs to know that
> (e.g., a helper can provide its own implementation of snmp_duplicate_objid)?
>
> Thanks,
>   Bill
>
>

helpers/scalar's realloc() of rootoid vs. netsnmp_subtree_split copying just the known size

[Bill F. <fe...@gm...>]

Hi,

I have a MIB module that uses netsnmp_register_scalar() which realloc's the
given root oid to have one more space in it, so that
the netsnmp_scalar_helper_handler can use that space to store the ".0"
instance during the handling of a request.

This all works fine, until we register an instance for the same object via
netsnmp_register_instance() - or, really, until that instance gets
unregistered, via unregister_mib_context().  At this point, we go back to
calling the scalar handler for that object, but, due to the duplicate
registration, that scalar handler's registration has been duplicated via
netsnmp_subtree_split.  Understandably, when netsnmp_subtree_split
duplicates an OID, it doesn't add the magic extra space that the scalar
helper needs, so after this registration and unregistration, the scalar
helper starts stomping on memory it doesn't own.

Is anyone familiar enough with this code to be able to suggest a way
forward? If the scalar helper wants an extra oid's worth of memory in the
rootoid pointer, it's almost like netsnmp_subtree_split needs to know that
(e.g., a helper can provide its own implementation of snmp_duplicate_objid)?

Thanks,
  Bill

Re: Need solution to suppress Warning for 32 bit net-SNMP installing on 64 bit

[Magnus F. <ma...@ly...>]

On Tue, Nov 01, 2022 at 11:17:07AM +0000, Jendal, Bhanu wrote:
> Hello Team,
> 
> Can you please help on the below scenario:
> Need solution to suppress Warning for 32 bit net-SNMP installing on 64 bit while installing through the command line.

The net-snmp project primarily provide source code so that should not be an
issue as seen from our point of view.

Further, you failed to specify

 * what platform you are installing on,
 * where you got the binaries you are trying to install,
 * what you did, and
 * what you expected would happen.

Could you please tell us that then helping you would be a lot easier.

With all this said I would guess you are trying to install some extended
net-snmp package you have picked up from some equipment vendor but they
based their package on a 32-bit build, probably from RHEL4, and you want
to install it on a freshly installed RHEL8 system and now dnf complains?

> Regards,
> Bhanu Jendal


> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders

Need solution to suppress Warning for 32 bit net-SNMP installing on 64 bit

[Jendal, B. <bha...@si...>]

Hello Team,

Can you please help on the below scenario:
Need solution to suppress Warning for 32 bit net-SNMP installing on 64 bit while installing through the command line.

Regards,
Bhanu Jendal

Re: Diffie-Hellman Key

[Wes H. <har...@us...>]

Simon Chamlian <sim...@mp...> writes:

> So once it is compiled in, how do you add the Diffie-Hellman in createUser 
> instruction in the snmpd.conf file?

You still create users per normal, but can change passwords with the
snmpusm command.  See the snmpusm manual in the "CHANGING PASS PHRASES"
section.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Diffie-Hellman Key

[Simon C. <sim...@mp...>]

So once it is compiled in, how do you add the Diffie-Hellman in
createUser instruction
in the snmpd.conf file?

-Simon


On Wed, Sep 7, 2022 at 11:21 AM Wes Hardaker <har...@us...>
wrote:

> Craig Small via Net-snmp-coders <net...@li...>
> writes:
>
> > My understanding is the only way of adding the key is with the snmpusm
> > command.  Except it doesn't work for me.
>
> snmpusm is used to change a key, but isn't really doing DH for each
> transaction after that.  It's still using a shared-secret.
>
> (D)TLS support is available, however, for using certificates instead
> which is a more modern cryptographic mechanism.
>
> > $ snmpusm -v3 -u simon -l authPriv -a SHA1 -A simon-pass -x AES128 -X
> simon-priv
> > localhost changekey simon
> > snmpusm:
> > Can't get diffie-helman exchange from the agent
> >   (maybe it doesn't support the SNMP-USM-DH-OBJECTS-MIB MIB)
>
> That may have meant it wasn't complied in.  Make sure the
> snmp-usm-dh-objects-mib module is complied into the agent.
>
> --
> Wes Hardaker
> Please mail all replies to net...@li...
>

Re: Security fixes in net-snmp 5.9.3

[Wes H. <har...@us...>]

Craig Small <csmall@dropbear.xyz> writes:

>   The 5.9.3 release fixes several security issues.  Could someone confirm if it
> was only the following two patches that fixed it, or give me a list of the
> patches if not?

I think those two patches look right, but I'm not sure I'd promise those
were the only critical fixes.

> Debian has 5.9 in stable and 5.7.3 in old stable I'm going to try to
> fix.

Is there any reason you can't push stable to 5.9.3?  Because that is
supposed to be an incremental upgrade such that systems are able to
upgrade safely without concern about backward compatibily.
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Diffie-Hellman Key

[Wes H. <har...@us...>]

Craig Small via Net-snmp-coders <net...@li...>
writes:

> My understanding is the only way of adding the key is with the snmpusm
> command.  Except it doesn't work for me.

snmpusm is used to change a key, but isn't really doing DH for each
transaction after that.  It's still using a shared-secret.

(D)TLS support is available, however, for using certificates instead
which is a more modern cryptographic mechanism.

> $ snmpusm -v3 -u simon -l authPriv -a SHA1 -A simon-pass -x AES128 -X simon-priv
> localhost changekey simon
> snmpusm:
> Can't get diffie-helman exchange from the agent
>   (maybe it doesn't support the SNMP-USM-DH-OBJECTS-MIB MIB)

That may have meant it wasn't complied in.  Make sure the
snmp-usm-dh-objects-mib module is complied into the agent.

-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: SHA Version

[Wes H. <har...@us...>]

Feroz <fer...@gm...> writes:

> On net-snmp 5.8, with the following configuration in snmpd.conf file, which
> version of SHA (i.e SHA1/SHA-192/SHA-256/SHA-284/SHA-512) is used?
> 
> createUser feroz SHA feroz123 AES feroz123
> rwuser feroz priv

If you specify SHA generically, that's an alias for SHA1.  Instead, use
SHA256 for example to get a stronger token.
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: SNMP context details are not removing from cache

[Wes H. <har...@us...>]

Abhishek Singh <abh...@gm...> writes:

> 1. The issue was existing snmpv3 details were not updated in the net-snmp cache.
> Used clear_user_list() to clear users details. The patch is in attachments. Is
> this the correct way to go forward?

If you're always trying to re-create users that patch may work.

> 2. SNMP context details are not removed from the net-snmp cache after deleting
> context details.
> Do we have any API to clear SNMPv3 context details from cache?

Unfortunately, there are parts of the agent that don't really handle
re-loads of config properly.  What contexts are you referring to exactly
that isn't getting cleared?  Are you referring to a mib module
registration on a particular v3 context, or?
-- 
Wes Hardaker
Please mail all replies to net...@li...

Re: Diffie-Hellman Key

[Craig S. <cs...@dr...>]

Hi Simon,
  My understanding is the only way of adding the key is with the snmpusm
command. Except it doesn't work for me.

$ snmpusm -v3 -u simon -l authPriv -a SHA1 -A simon-pass -x AES128 -X
simon-priv localhost changekey simon
snmpusm:
Can't get diffie-helman exchange from the agent
  (maybe it doesn't support the SNMP-USM-DH-OBJECTS-MIB MIB)

I should be getting a set of keys but I'm not. Turning on debugging for usm
shows the user being authenticated but no usmDH processing happening.

 - Craig





On Wed, 31 Aug 2022 at 23:46, Simon Chamlian <sim...@mp...> wrote:

>
>
> Hi,
>
> Does NET-SNMP 5.9.x support Diffie-Hellman?
> If so, how do I configure it in snmpd.configuration?
>
> For example, if I have the following in snmpd.conf:
>
> createUser simon  SHA "simon-pass" AES128   "simon-priv"
> rwuser simon
>
>
> How do I add a DH key?
>
> Thanks,
> S.
>
>
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>

Diffie-Hellman Key

[Simon C. <sim...@mp...>]

Hi,

Does NET-SNMP 5.9.x support Diffie-Hellman?
If so, how do I configure it in snmpd.configuration?

For example, if I have the following in snmpd.conf:

createUser simon  SHA "simon-pass" AES128   "simon-priv"
rwuser simon


How do I add a DH key?

Thanks,
S.

SHA Version

[Feroz <fer...@gm...>]

Hi,
On net-snmp 5.8, with the following configuration in snmpd.conf file, which
version of *SHA *(i.e SHA1/SHA-192/SHA-256/SHA-284/SHA-512) is used?

createUser feroz *SHA *feroz123 AES feroz123
rwuser feroz priv

-- 
Regards,
Feroz Ahmed

Re: Setting IPV6 Source IP for Traps not working

[Feroz <fer...@gm...>]

Any inputs on the correct format of IPv6 address that needs to be passed to
the following function?
Or is there a bug here?

*netsnmp_ds_set_string(NETSNMP_DS_LIBRARY_ID,NETSNMP_DS_LIB_CLIENT_ADDR_V6,effective_ipv6);*

We tried to pass the following format of IP address to the above function,
but nothing seems to work.
[IPv6_Address]:161
[IPv6_Address]
IPv6_Address

On Thu, Jul 28, 2022 at 3:29 PM Vivek Aditya <viv...@gm...> wrote:

> Hi
>
> This query is regarding setting ipv6 source ip for traps.
> *Query 1*
>
> We are using this api
> *netsnmp_ds_set_string(NETSNMP_DS_LIBRARY_ID,NETSNMP_DS_LIB_CLIENT_ADDR_V6,effective_ipv6);*
>  to set the source-ip.Currently we are passing the ipv6 address as 2001::1
> (without enclosing in brackets). But it was *not working* so I made a fix
> in this net-snmp function and *post that it works*. + indicates the line
> added. Is this a correct fix? any comments would be helpful.
>
> netsnmp_transport *
> netsnmp_udp6_transport(const struct sockaddr_in6 *addr, int local)
> {
>     if (!local) {
>         const char *client_socket;
>         client_socket = netsnmp_ds_get_string(NETSNMP_DS_LIBRARY_ID,
>
> NETSNMP_DS_LIB_CLIENT_ADDR_V6);
>         if (client_socket) {
>             struct sockaddr_in6 client_addr;
>             if(netsnmp_sockaddr_in6_2(&client_addr, client_socket, NULL)) {
>             +   client_addr.sin6_port = 0;
>                 return netsnmp_udp6_transport_with_source(addr, local,
>                                                           &client_addr);
>             }
>         }
>     }
>     return netsnmp_udp6_transport_with_source(addr, local, NULL);
> }
> *Query 2*
>
> What should be the format to pass the ipv6 address in this api
> *netsnmp_ds_set_string(NETSNMP_DS_LIBRARY_ID,NETSNMP_DS_LIB_CLIENT_ADDR_V6,effective_ipv6);*.
> for example, should we pass it as 2001::1, or [2001::1] or both are correct
> ?
>
> --
> Warm Regards,
> Vivek Aditya
> _______________________________________________
> Net-snmp-coders mailing list
> Net...@li...
> https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
>


-- 
Regards,
Feroz Ahmed

Re: wolfSSL support in net-snmp

[Hayden R. <ha...@wo...>]

Hi Bart,

The changes look great. Go ahead with the merge to master.

Hayden

On Thu, Aug 4, 2022 at 2:39 PM Bart Van Assche <bva...@ac...> wrote:

> On 7/28/22 20:48, Bart Van Assche wrote:
> > On 7/27/22 09:27, Hayden Roche wrote:
> >> A while back, we (wolfSSL) added support for wolfSSL to net-snmp 5.9.1
> >> for a
> >> customer. You can find the patch here:
> >> https://github.com/wolfSSL/osp/tree/master/net-snmp
> >>
> >> Is this something you'd be interested in having upstream?
> >
> > Support for wolfSSL seems a useful addition to me but I'm not enthusiast
> > about the patch the above link points at. I think that patch will need
> > significant editing before it's suitable for integration in the Net-SNMP
> > code base.
>
> (replying to my own email)
>
> A modified version of the patches referred to above is available here:
> https://github.com/bvanassche/net-snmp/tree/master-wolf-ssl. If you
> agree with these patches I will merge them into the master branch.
>
> Thanks,
>
> Bart.
>
>

SNMP context details are not removing from cache

[Abhishek S. <abh...@gm...>]

Hello,

I have a requirement not to restart snmpd for SNMP config changes.
Am using the SIGHUP signal to reread for any snmp configuration changes.
I was facing two issues while using SIGHUP.
1. The issue was existing snmpv3 details were not updated in the net-snmp
cache. Used clear_user_list() to clear users details. The patch is in
attachments. Is this the correct way to go forward?
2. SNMP context details are not removed from the net-snmp cache after
deleting context details.
Do we have any API to clear SNMPv3 context details from cache?

Please share API or any other way to solve this problem.


Thanks,
Abhishek Singh

Re: wolfSSL support in net-snmp

[Bart V. A. <bva...@ac...>]

On 7/28/22 20:48, Bart Van Assche wrote:
> On 7/27/22 09:27, Hayden Roche wrote:
>> A while back, we (wolfSSL) added support for wolfSSL to net-snmp 5.9.1 
>> for a
>> customer. You can find the patch here:
>> https://github.com/wolfSSL/osp/tree/master/net-snmp
>>
>> Is this something you'd be interested in having upstream?
> 
> Support for wolfSSL seems a useful addition to me but I'm not enthusiast 
> about the patch the above link points at. I think that patch will need 
> significant editing before it's suitable for integration in the Net-SNMP 
> code base.

(replying to my own email)

A modified version of the patches referred to above is available here: 
https://github.com/bvanassche/net-snmp/tree/master-wolf-ssl. If you 
agree with these patches I will merge them into the master branch.

Thanks,

Bart.

Re: wolfSSL support in net-snmp

[Bart V. A. <bva...@ac...>]

On 7/27/22 09:27, Hayden Roche wrote:
> A while back, we (wolfSSL) added support for wolfSSL to net-snmp 5.9.1 
> for a
> customer. You can find the patch here:
> https://github.com/wolfSSL/osp/tree/master/net-snmp
>
> Is this something you'd be interested in having upstream?

Support for wolfSSL seems a useful addition to me but I'm not enthusiast 
about the patch the above link points at. I think that patch will need 
significant editing before it's suitable for integration in the Net-SNMP 
code base.

Thanks,

Bart.

Security fixes in net-snmp 5.9.3

[Craig S. <cs...@dr...>]

Hi,
  The 5.9.3 release fixes several security issues.  Could someone confirm
if it was only the following two patches that fixed it, or give me a list
of the patches if not?

snmpd: fix bounds checking in NET-SNMP-AGENT-MIB, NET-SNMP-VACM-MIB,
SNMP-VIEW-BASED-ACM-MIB, SNMP-USER-BASED-SM-MIB
https://github.com/net-snmp/net-snmp/commit/67ebb43e9038b2dae6e74ae8838b36fcc10fc937

snmpd: recover SET status from delegated request
https://github.com/net-snmp/net-snmp/commit/9a0cd7c00947d5e1c6ceb54558d454f87c3b8341

Debian has 5.9 in stable and 5.7.3 in old stable I'm going to try to fix.

 - Craig


-- 

Craig Small             https://dropbear.xyz/  csmall at : dropbear.xyz
Debian GNU/Linux        https://www.debian.org/
<http://www.debian.org/>  csmall at : debian.org
GPG fingerprint:     5D2F B320 B825 D939 04D2  0519 3938 F96B DF50 FEA5

Setting IPV6 Source IP for Traps not working

[Vivek A. <viv...@gm...>]

Hi

This query is regarding setting ipv6 source ip for traps.
*Query 1*

We are using this api
*netsnmp_ds_set_string(NETSNMP_DS_LIBRARY_ID,NETSNMP_DS_LIB_CLIENT_ADDR_V6,effective_ipv6);*
 to set the source-ip.Currently we are passing the ipv6 address as 2001::1
(without enclosing in brackets). But it was *not working* so I made a fix
in this net-snmp function and *post that it works*. + indicates the line
added. Is this a correct fix? any comments would be helpful.

netsnmp_transport *
netsnmp_udp6_transport(const struct sockaddr_in6 *addr, int local)
{
    if (!local) {
        const char *client_socket;
        client_socket = netsnmp_ds_get_string(NETSNMP_DS_LIBRARY_ID,

NETSNMP_DS_LIB_CLIENT_ADDR_V6);
        if (client_socket) {
            struct sockaddr_in6 client_addr;
            if(netsnmp_sockaddr_in6_2(&client_addr, client_socket, NULL)) {
            +   client_addr.sin6_port = 0;
                return netsnmp_udp6_transport_with_source(addr, local,
                                                          &client_addr);
            }
        }
    }
    return netsnmp_udp6_transport_with_source(addr, local, NULL);
}
*Query 2*

What should be the format to pass the ipv6 address in this api
*netsnmp_ds_set_string(NETSNMP_DS_LIBRARY_ID,NETSNMP_DS_LIB_CLIENT_ADDR_V6,effective_ipv6);*.
for example, should we pass it as 2001::1, or [2001::1] or both are correct
?

-- 
Warm Regards,
Vivek Aditya

wolfSSL support in net-snmp

[Hayden R. <ha...@wo...>]

Hi,

A while back, we (wolfSSL) added support for wolfSSL to net-snmp 5.9.1 for a
customer. You can find the patch here:
https://github.com/wolfSSL/osp/tree/master/net-snmp

Is this something you'd be interested in having upstream?

Best,

Hayden Roche

Re: Integrating Debian patches

[Craig S. <cs...@dr...>]

On Fri, 22 Jul 2022 at 17:54, Magnus Fromreide <ma...@ly...> wrote:

> 06_extramibs.patch - which adds the Gnome MIB - touches on something I have
> pondering - how should a distribution add MIBs?
>
> On Debian we have this patch.
>
> On RedHat Net-SNMP ships one heap of MIBs and libsmi ships another,
> slightly
> different, heap of MIBs - when one wish to depend on MIBs present in one
> but
> not the other set things becomes interesting.
>
Debian has snmp-mibs-downloader which gets around the MIBs licensing issue.
Most of the ones that come with net-snmp we have to strip out.

The single MIB added in the Debian package is the Gnome one with the
corrected enterprises OID. I think some of the dependent MIBs use the wrong
one.

I do not know where one should even discuss this issue as it touches on
> integration of multiple projects in multiple distributions.
>
Nor do I, for procps we use the upstream list.

 - Craig

Re: Integrating Debian patches

[Magnus F. <ma...@ly...>]

On Thu, Jul 21, 2022 at 08:37:29PM +1000, Craig Small wrote:
> Hi,
>   I'd like to see how I can reduce the number of patches carried by the
> Debian net-snmp packages. Some of these will have to stay because we have a
> particular way of storing files for example. That will also mean these
> fixes will be everywhere and not just in Debian.
> 
> If you want to see them all, they're located at [1].  Some of them are
> simple fixes for typos or making groff happy, others are updating the
> lm-sensors API and many other things.
> 
> My question is, what is the best way to send them? Porting says "use CVS
> diff -u" so I'm assuming then patches are ok (they're the easiest for me).
> I wasn't planning on sending all 43 and grouping some similar ones up,
> starting with the simplest/least controversial ones.
> 
>  - Craig
> 
> 
> 1: https://salsa.debian.org/debian/net-snmp/-/tree/master/debian/patches

06_extramibs.patch - which adds the Gnome MIB - touches on something I have
pondering - how should a distribution add MIBs?

On Debian we have this patch.

On RedHat Net-SNMP ships one heap of MIBs and libsmi ships another, slightly
different, heap of MIBs - when one wish to depend on MIBs present in one but
not the other set things becomes interesting.

I do not know where one should even discuss this issue as it touches on
integration of multiple projects in multiple distributions.

Integrating Debian patches

[Craig S. <cs...@dr...>]

Hi,
  I'd like to see how I can reduce the number of patches carried by the
Debian net-snmp packages. Some of these will have to stay because we have a
particular way of storing files for example. That will also mean these
fixes will be everywhere and not just in Debian.

If you want to see them all, they're located at [1].  Some of them are
simple fixes for typos or making groff happy, others are updating the
lm-sensors API and many other things.

My question is, what is the best way to send them? Porting says "use CVS
diff -u" so I'm assuming then patches are ok (they're the easiest for me).
I wasn't planning on sending all 43 and grouping some similar ones up,
starting with the simplest/least controversial ones.

 - Craig


1: https://salsa.debian.org/debian/net-snmp/-/tree/master/debian/patches
-- 

Craig Small             https://dropbear.xyz/  csmall at : dropbear.xyz
Debian GNU/Linux        https://www.debian.org/
<http://www.debian.org/>  csmall at : debian.org
GPG fingerprint:     5D2F B320 B825 D939 04D2  0519 3938 F96B DF50 FEA5