summaryrefslogtreecommitdiff
path: root/usr.sbin/snmpd
AgeCommit message (Collapse)Author
2023-04-25tiny markup fix: add missing Ic before `group' in the `agentx' ruleOmar Polo
OK martijn@
2023-03-08Delete obsolete /* ARGSUSED */ lint comments.Philip Guenther
ok miod@ millert@
2023-03-02improve the Nd lines such that the format is consistent for theJason McIntyre
various *d, *conf, *ctl files (where relevant) and simple; also makes "man -k routing" more useful; help from claudio and florian ok claudio florian millert
2023-02-15proc_ispeer() is not used anywhere anymore so remove it everywhere.Tobias Heider
ok florian@ bluhm@ ok for vmd mlarkin@
2022-12-28spelling fixes; from paul tagliamonteJason McIntyre
any parts of his diff not taken are noted on tech
2022-12-20Apply proper bounds checking to non-repeaters and max-repetitions.Martijn van Duren
OK sthen@, kn@
2022-12-20Make ar[du]_{nonrepeaters,maxrepetitions} uint16_t instead of int16_t.Martijn van Duren
snmp uses signed 32 bits integers and agentx uses unsigned 16 bits integers. I somehow ended up somewhere in between. OK sthen@, kn@
2022-12-20When writing out a PDU with authpriv that's larger than READ_BUF_SIZEMartijn van Duren
we overflow the encbuf. Allocate encbuf on the fly so that we always have enough room. Give decryption the same treatment, although this one is not at risk, since the input is limited to READ_BUF_SIZE. OK sthen@, kn@
2022-12-20When writing a message out over tcp that's too large to fit in a singleMartijn van Duren
write(2), make sure that we don't restart the message on the next write out, but continue where we left of. OK sthen@, kn@
2022-10-25Fix LDADD and DPADD.Martijn van Duren
DPADD bit pointed out by deraadt@ "No kidding" deraadt@
2022-10-06Remove a lot of old (dead) code that's either been superseded, or moved toMartijn van Duren
snmpd_metrics. OK benno@ sthen@
2022-09-13varbind was designed to allow both a ber NULL and a NULL pointer forMartijn van Duren
value. The ber NULL case is there for when it was received via a PDU. The NULL pointer case can happen if application.c runs into a timeout or when a backend runs into problems. The NULL pointer case however was overlooked in appl_varbind_valid and results in an "missing value" error, (needlessly) terminating the connection to the backend. Found the hard way by Mischa Peters while stress testing agentx support for vmd. OK tb@, sthen@
2022-09-01Add privilege separation to snmpd.Martijn van Duren
This uses the just imported snmpd_metrics as a new (agentx-based) backend. Snmpd(8) executes all files in /usr/libexec/snmpd and treats regions registered by these binaries as authorative, so that no other agentx backends can overwrite them. The snmpe process is now pledged "stdio recvfd inet unix". This removes quite a few entries from the sysORTable, but the current entries are non-compliant anyway and should be completely revisisted at a later time. Reduces the time for a full walk by about a factor of 4, bringing us close to the original speed before application.c was introduced. General design discussed with claudio@ Tested by and OK sthen Release build test and OK tb@
2022-08-31Rewrite the searchrange end calculation routine.Martijn van Duren
The old one had a bug which allowed it to move backwards on overlapping regions and also didn't always returned the optimal end position. OK tb@
2022-08-30Remove now unused search variable. Missed in previous.Martijn van Duren
OK tb@
2022-08-30Remove the downwards check for overlapping regions when the subtree flag isMartijn van Duren
set. There's a bit of inverted logic in there and this feature will probably get in the way of the blocklist feature (and maybe others) OK tb@
2022-08-30copy over av_oid_end.bo_n instead of av_oid.bo_n bytes when copying overMartijn van Duren
the searchrange end oid. OK tb@
2022-08-29Clean up a couple of log lines.Martijn van Duren
OK tb@
2022-08-29Allow overlapping regions (if subtree claim flag is set) when the backendsMartijn van Duren
are identical. OK tb@
2022-08-29Make sure oidbuf is initialized when we hit the overlap case.Martijn van Duren
OK tb@
2022-08-29When there are two overlapping regions handled by the same backend we mightMartijn van Duren
traverse back in the tree; Make sure this doesn't happen. OK tb@
2022-08-29When a backend disappears while handling a request, make sure that theMartijn van Duren
outstanding requests are handled by the next backend, instead of leaking memory. OK tb@
2022-08-29Let snmpd check a response package against the requested searchrange end.Martijn van Duren
If the returned OID is beyond the searchrange end we have two cases: - If the backend supports searchranges (agentx) we generate a GENERR and close the connection. - If the backend doesn't support searchranges (legacy and maybe a future snmp proxy) we simply fix-up the result. OK tb@
2022-08-23(Re)add support for agentx in snmpdMartijn van Duren
Current omissions in protocol support are notifications, index (de)allocation, and agent capabilities. Help testing sthen@ Feedback/tweaks/OK jmatthew@
2022-06-30Be more explicit in filter-pf-addresses deprication message by mentioningMartijn van Duren
blocklist pfTblAddrTable in full. Requested by and OK sthen@, who also OKed the previous commit.
2022-06-30Introduce a blocklist backend and keyword.Martijn van Duren
This allows the admin to specify a full region of the OID tree to be blocked and simply returns NOSUCHOBJECT/ENDOFMIBVIEW. This deprecates filter-pf-addresses in favour of: blocklist pfTblAddrTable OK tb@
2022-06-30Rewrite smi_print_element to be more concise and complete.Martijn van Duren
Keep the old implementation around as smi_print_element_legacy for the trap handler scripts, so these don't break. Should help with request tracing. OK sthen@
2022-06-28Use smi_string2oid instead of ober_string2oid in parse.y's oid definition.Martijn van Duren
This allows admins to configure oids as pretty symbolic names, next to the current numeric names. OK sthen@
2022-06-27Mostly rewrite appl_request_upstream_reply.Martijn van Duren
The old code had a potential off by one underflow, which is unlikely to be hit with the current builtin backend, and didn't show the returned varbindlist correct. OK sthen@
2022-06-27Initialize oidbuf and regionbuf when registering a region in appl_region.Martijn van Duren
This prevents us from spewing garbage on error. regionbuf case pointed out by tb@ OK deraadt@ tb@
2022-03-31man pages: add missing commas between subordinate and main clausesChristian Weisgerber
jmc@ dislikes a comma before "then" in a conditional, so leave those untouched. ok jmc@
2022-02-22requestid is a 32 bit integer, make sure that we request that withMartijn van Duren
ober_scanf_elements. Found the hard way on octeon and patch tested by sebastian <at> rostwald <dot> de OK tb
2022-01-30Add missing NULL check.Martijn van Duren
OK benno@
2022-01-30When walking a pf table, we only are supposed to return IPv4 addresses.Martijn van Duren
If a table has mixed IPv4 and IPv6 addresses and we walk over it an IPv6 address could be returned if it followed an IPv4 address, causing an error. Found by florian@ OK florian@ millert@
2022-01-19Hook up the new application layer.Martijn van Duren
OK jmatthew@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-19Add the new application layer. Changes include:Martijn van Duren
- Asynchronous design, which should allow us to cleanly implement agentx support. - Cluster requests when sending them to backends - Return a better error code in a lot of cases. - Allow bulkget to return row by row instead of column by column (as per RFC3416) - Better SNMPv1 mapping as per RFC3584 - Allow registration of overlapping regions. - Stricter OID comparison. - We loose write support. Previous write support didn't guarantee atomicity, wasn't persistent across restarts and didn't implement anything useful. This can be added later if it's missed. - This is quite a bit slower, but this should clear up once the current mps.c and mib.c code gets pushed out. Other tricks could help speed things up, but I don't want to resort to extra tricks if it's not needed. - More detailed debugging output. This commit is stand-alone and gets hooked in with the following commit. "Looks good at first glance" benno@ minor issues pointed out by and OK jmatthew@ Performance loss aceptable to sthen@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-19Implement snmpe_send to allow to allow the new application layer to sendMartijn van Duren
messages through the current transport mapping code. OK jmatthew@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-19Make sure that we ASN1 verify the varbindlist as soon as we unpack it.Martijn van Duren
OK jmatthew@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-19Add definitions for SNMP-TARGET-MIB. These are needed for the newMartijn van Duren
application layer. OK jmatthew@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-19Move some smi.c functions to their own header.Martijn van Duren
These are needed for a new application layer, where a lot of the snmpd.h stuff just clutter. OK jmatthew@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-19Move some snmpe.c functions to their own header.Martijn van Duren
These functions are needed from the new application layer and don't really belong in snmpd.h. OK jmatthew@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-19Move log.c functions to their own header.Martijn van Duren
This is needed for a new application layer where, where a lot of the snmpd.h stuff just clutter. Requested by benno@ OK jmatthew@ tested as part of larger diff by sthen@ and Joel Carnat
2022-01-05Switch snmpd(8) to using EVP_Digest{Init,Final}_ex() and drop a noTheo Buehler
longer needed EVP_MD_CTX_reset(). ok martijn
2022-01-05Add error checking for EVP_Digest* to snmpd(8).Theo Buehler
ok martijn
2022-01-05snmpd: Straightforward conversion to EVP_* on the heap.Theo Buehler
It would be nice if someone added error checking for the EVP_Digest* calls. tested by & ok martijn
2021-11-21getaddrinfo doesn't resolve numeric hostname in the !AI_NUMERICHOST caseMartijn van Duren
if family in resolv.conf is not set to its specific family. e.g. 0.0.0.0 will not resolve if family is set to "family inet6" Fix this by first trying to resolve with AI_NUMERIC set and if EAI_NONAME is returned (it's an actual hostname) retry with an empty ai_flags. bug reported by and OK sthen@
2021-10-25If we use type to SNMP_V2 we should check against that.Martijn van Duren
Reported by Johan Huldtgren (jhuldtgren <at> gmail <dot> com) via sthen@ OK sthen@
2021-10-21Clean up the naming of SNMP_C_GETNEXTREQ and SNMP_C_RESPONSE insideMartijn van Duren
smi_debug_elements OK sthen@
2021-10-21s/SNMP_C_GETRESP/SNMP_C_RESPONSEMartijn van Duren
OK sthen@
2021-10-21Retrieve the actual engineid instead of a pointer value.Martijn van Duren
OK tb@
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-25 07:30:03 +0000