forked from net-snmp/net-snmp
-
Notifications
You must be signed in to change notification settings - Fork 0
/
NEWS
1833 lines (1532 loc) · 72.2 KB
/
NEWS
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
This file contains a summary of the major changes in released revisions.
Please see the CHANGES file for a more detailed list of specific bugs/patches
that have been fixed/applied, and the ChangeLog file for a comprehensive
listing of all changes made to the code.
*5.9.4*:
IMPORTANT: SNMP over TLS and/or DTLS are not functioning properly
in this release with various versions of OpenSSL and will be fixed
in a future release.
libsnmp:
- Remove the SNMP_SWIPE_MEM() macro Remove this macro since it is not
used in the Net-SNMP code base.
- DISPLAY-HINT fixes
- Miscellanious improvements to the transports
- Handle multiple oldEngineID configuration lines
- fixes for DNS names longer than 63 characters
agent:
- Added a ignoremount configuration option for the HOST-MIB
- disallow SETs with a NULL varbind
- fix the --enable-minimalist build
apps:
- snmpset: allow SET with NULL varbind for testing
- snmptrapd: improved MySQL logging code
general:
- configure: Remove -Wno-deprecated as it is no longer needed
- miscellanious ther bug fixes, build fixes and cleanups
*5.9.3*:
security:
- These two CVEs can be exploited by a user with read-only credentials:
- CVE-2022-24805 A buffer overflow in the handling of the INDEX of
NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.
- CVE-2022-24809 A malformed OID in a GET-NEXT to the nsVacmAccessTable
can cause a NULL pointer dereference.
- These CVEs can be exploited by a user with read-write credentials:
- CVE-2022-24806 Improper Input Validation when SETing malformed
OIDs in master agent and subagent simultaneously
- CVE-2022-24807 A malformed OID in a SET request to
SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an
out-of-bounds memory access.
- CVE-2022-24808 A malformed OID in a SET request to
NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference
- CVE-2022-24810 A malformed OID in a SET to the nsVacmAccessTable
can cause a NULL pointer dereference.
- To avoid these flaws, use strong SNMPv3 credentials and do not share them.
If you must use SNMPv1 or SNMPv2c, use a complex community string
and enhance the protection by restricting access to a given IP address range.
- Thanks are due to Yu Zhang of VARAS@IIE and Nanyu Zhong of VARAS@IIE for
reporting the following CVEs that have been fixed in this release, and
to Arista Networks for providing fixes.
misc:
- Snmp-create-v3-user: Fix the snmpd.conf path @datadir@ is
expanded in ${datarootdir} so datarootdir must be set before
@datadir@ is used.
general: Many bug fixes
*5.9.2*:
skipped due to a last minute library versioning found bug -- use 5.9.3 instead
*5.9.1*:
General: Many bug fixes
*5.9*
snmplib:
- Add IPv6 support to DTLSUDP transport CHANGES: snmplib: use new
netsnmp_sockaddr_storage in netsnmp_addr_pair CHANGES: snmplib: add
base_transport ptr for tunneled transports
snmpd:
- Security vulnerabilty in the ping MIB reported by Christopher Ertl
from Microsoft fixed
- Changing to a different uid/gid can only be done once
- The extend mib is now read-only by default
snmptrap:
- BUG: 2899: Patch from Drew Roedersheimer to set library
engineboots/time values before sending
unspecified:
- Add pkg-config support for building applications and sub-agents Use
the netsnmp package when building Net-SNMP applications. Use the
netsnmp-agent package when building Net-SNMP subagents.
*5.8*
snmplib:
- TLS/DTLS fixes
- fix usm keychanges for new algorithms and longer keylengths
- IP address formatting fixes
- BUG: 2592: from Stuart Kendrick - increase MAXTC to 16384
- add new sha2 auth protocols
- Restore AES-192 and AES-256 privacy protocols - from
draft-blumenthal-aes-usm-04 (precursor to RFC 3826)
- Use OIDs from http://www.snmp.com/eso/esoConsortiumMIB.txt
- Some code borrowed from PATCH 1346, thanks to
Alexander Ivanov and Vladimir Sukhorukov.
- BUG: 2622: Fix excessive indents in log file
- new config tokens:
- sendMessageMaxSize
- disableSNMPv1 / disableSNMPv2c
- new api for dynamic debug log level (netsnmp_set_debug_log_level)
snmpd:
- SNMP-TARGET-MIB: Fix snmpTargetAddrTAddress
- Com2sec and com2sec6 SOURCE values may deny sources as well as
permit.
- allow trap sinks to set Target-MIB characteristics (name, tag, profile)
- add source addr/port option to trapsink/trap2sink/informsink
- packet filtering by source ip (enableSourceFiltering/filtersource)
- several getbulk handling improvements
- several new APIs introduced for run-time configuration of agent:
- netsnmp_vacm_simple_usm_add/del
- usm_create_usmUser_*
- netsnmp_udp_com2SecEntry_create/netsnmp_udp_com2SecList_remove
- netsnmp_agent_listen_on to open agent port
Win32:
- Add support for the DTLS-UDP and TLS-TCP transports
scripts:
- A new 'checkbandwidth' script to check host min/max bandwidth
snmptranslate:
- Introduce bulk translation mode The special argument "-" causes
snmptranslate to enter bulk translation mode, in which it expects
one OID per line. Whitespace is treated as the end of the OID, and
only that portion of the line is replaced, meaning that this can be
used to translate, e.g., "snmpwalk" output without the proper MIBs
loaded: snmptranslate -m all -OX < numeric.txt > symbolic.txt
building:
- Add Travis and Appveyor CI support
- IPv6 support is now compiled by default. If you need an IPv4-only
agent, use --disable-ipv6.
- Fixed/improved support for several non-Linux platforms
- Many fixes found by Coverity anf Fortify scans
*5.7.3*
Many many bug fixes and minor improvements
snmpd, snmptrapd and apps:
- Patch 2525: from Ryan Steinmetz: Fix argument length parsing of the
host resources mib
- Make ENV_SEPARATOR_CHAR configurable
- SECURITY: a denial of service attack vector was discovered on
the linux implementation of the ICMP-MIB. This release fixes
this bug and all users are encouraged to update their SNMP
agent if they make use of the ICMP-MIB table objects.
perl:
- BUG: 2402: Add support for SNMPv3 traps
Windows:
- Port batch build infrastructure to Visual Studio 2010 and later
From Visual Studio 2010 on it is no longer possible to specify
include or library directories globally - these have to be
specified per project. Hence two additional menu entries in
build.bat that allow to specify these directories.
- Patch from Bart Van Assche to improve cygwin building
*5.7.2*
snmp:
- BUG: 3526549: CVE-2012-2141 Array index error leading to crash
snmpd:
- BUG: 3532090: Fix high ifIndex values crashing hrDeviceDescr
building:
- PATCH: 2091156: correctly declare dependencies in Makefile. 'make
-j <N>' should work now. Backport this to V5-4 as it is needed for
correct operation in the single threaded case of make miblib as
well.
Many other miscellaneous minor bug fixes
*5.7.1*
libnetsnmp:
- Fixed the mib-parsing-bug introduced shortly before 5.7
agent:
- fixed rounding errors for disk percentage calculations
openbsd:
- better support for recent openbsd releases
features:
- bug fixes with minimalist support after additional user feedback
Many other miscellaneous minor bug fixes
*5.7*
snmpd:
- Delivery of data via regularily scheduled notifications.
(see "Data Delivery via Notfications" in snmpd.conf)
- Many time-based config options can take (m)ins, (h)ours, ... arguments
(see the snmpd.conf manual page)
- The PING and TRACEROUTE MIBs now compile and work-ish on linux
http://www.net-snmp.org/wiki/index.php/DISMAN
- Mib handlers can now implement a data_clone function for
cloning the myvoid structure variable to avoid dangling pointers
- Fixed persistent storage of VACM MIB configuration
- Multi-homed agents send UDP responses from the proper IP address
- The hrStorageTable implementation now supports large filesystems better
- optimizations for large route tables
- Added a deliveryByNotify config token for regular data delivery
(see the snmpd.conf manual page and the NET-SNMP-PERIODIC-NOTIFY-MIB)
- [PATCH 3141462]: fix agentx subagent issues with multiple-object requests
- [PATCH 3057093]: linux uses libpci for creating useful ifDescr strings
- [PATCH 3131397]: huge speedups of the TCP/UDP Tables
libnetsnmp:
- Removed the older CMU compatibility support
- The SSH transport is now configurable
TLS/DTLS support:
- The SNMP over DTLS transport now properly supports IPv6
- Introduced new configuration tokens: localCert/peerCert
(deprecating serverCert, clientCert, defX509ServerPub, defX509ClientPub)
- Various fixes for the TLS/DTLS transports
apps:
- Added a per-variable timed output support to snmpwalk using -CT
- snmpinform now correctly uses the local engineID for informs
- A number of mib2c bug fixes
- New snmp.conf tokens for timeouts and retries
building:
- New flags to reduce the amount of compiled code to bare minimums.
This is provided by a new generic feature marking/selection mechanism.
http://www.net-snmp.org/wiki/index.php/Feature_Marking_and_Selection
- It's now possible to build without SNMPv3/USM
(e.g., if you only want TLS/DTLS with SNMPv3/TSM)
- It's possible to build the suite with no SET support
configure using --enable-read-only
- It's possible to build the agent as a notify-only agent
configure using --enable-notify-only
- Added a script to test memory usage with various config options
(see the local/minimalist/sizetests script)
- Net-SNMP can now be built to perform local DNSSEC validation
(install DNSSEC-Tools' libval and use --with-local-dnssec-validation)
testing:
- a number of new API unit-tests have been added to the suite
(to run the tests: cd testing && ./RUNFULLTESTS -g unit-tests)
- The unit tests can be more easily run under valgrind
(See http://bit.ly/jsgRnv for details)
openbsd:
- Support for updating the routing table via SNMP
win32:
- The testing suite works better under win32 environments
- Many building fixes for the win32 environment(s)
solaris:
- Net-SNMP now supports the SCTP-MIB
DragonFlyBSD, FreeBSD8:
- Net-SNMP should now work on DragonFlyBSD and FreeBSD8
And of course:
- Many other bug fixes. See the CHANGES and ChangeLog for details.
*5.6*
all:
- Implemented the SNMP over TLS and SNMP over DTLS protocols [RFC-to-be]
See http://www.net-snmp.org/wiki/index.php/TUT:Using_TLS
- Implemented the "Transport Security Model" [RFC5591]
- Generic host-specific configuration .conf files are now read.
See the HOST-SPECIFIC FILES section of the snmp.conf manual page
and http://www.net-snmp.org/wiki/index.php/Configuration
- Include statements can now be used in .conf files.
See http://www.net-snmp.org/wiki/index.php/Configuration
snmpd:
- Fix handling of multiple matching VACM entries. (Use the "best"
match, rather than the first one). Reported by Adam Lewis. Note
that this could potentially affect the behaviour of existing access
control configurations.
- Agent will no longer call table handlers if a set request for the
handler has invalid indexes
- table_data/tdata next handler will not be called during get
processing if no valid rows are found for the handler
- [PATCH 2952708]: Added Perl implementation of BRIDGE-MIB
- moved all functions defined in libnetsnmphelpers to
libnetsnmpagent. libnetsnmphelpers is now an empty library.
- Implemented the TSM-MIB and the TLSTM-MIB
- new API for indicating that persistent store needs to be saved
after the current request finishes processing
- [PATCH 2931446]: make the load averages writable.
apps:
- A new tool 'net-snmp-cert' that easily creates and manages
X.509 certificates for use with the SNMP over (D)TLS protocols.
- Added an 'agentxtrap' command to send notifications via AgentX
(See http://www.net-snmp.org/wiki/index.php/TUT:agentxtrap for details)
- -T command line flag can be used to pass configuration
directly to transports that can accept configuration tokens
- A new 'snmptls' command for manipulating the agent's TLS configuration
snmplib:
- A more modular transport subsystem that allows third party
extensions and dependencies for code reuse.
- New transport functions: f_config, f_open, f_copy and f_setup_session
- Transports can now specify session defaults
- E.G. dtlsudp: auto-sets the SNMP version and the security model.
- [PATCH 2942940]: Add a new function, netsnmp_parse_args, that is
like snmp_parse_args but takes an additional bitmask, flags, to
affect the behaviour. Also remove the magic handling of some
application names.
- A new X.509 certificate API for indexing and reading certificates
- new experimental row creation API which uses a state machine
to try really hard to create a row from a given varbind list
- netsnmp_container enhancements:
- added a free_item function
- added a CONTAINER_FREE_ALL macro/function
- added an interface for duplicating a container (CONTAINER_DUP)
- added a remove function to container_iterators
- added an ability to set options on binary_array containers
- new snmp token logOption allows specifying log destinations
via configuration conf files
- A very significant reduction in compiler warning output
- new experimental simple state machine handling API
building:
- Support for a stream-line stripped down version of internal
OpenSSL support using --with-openssl=internal.
- Do not require that the UDP transport is included.
- Building Net-SNMP with dmalloc support enabled is again possible.
mib2c:
- mib2c can now optionally run sed on generated code
testing:
- A brand new test infrastructure supporting multiple test suites
See perldoc testing/RUNFULLTESTS for details
python:
- walking broken agents won't cause an infinite loop
win32:
- IPv6 is only supported under Cygwin 1.7 or later.
- [BUG 2939168]: byte order of udpLocalPort is now correct.
- [BUG 2939168]: fixed test infrastructure ("make test"). This has
been fixed by using the proper environment separator character and
by adding the path of the netstat executable for Cygwin in
testing/TESTCONF.sh.
- building with another OpenSSL package than the Cygwin-provided
packages openssl and openssl-devel is again possible.
- running the regression test suite is again possible ('make test').
- winExtDLL compiles now under MinGW.
- the snmpd.conf keyword 'extend' is now supported under MinGW
- the snmptrapd.conf keyword traphandle is now supported under MinGW
qnx6:
- [PATCH 2836895]: support for QNX6
*5.5*
All applications:
- Added the ability to "alias" transports to a more simple name
(see the "alias" keyword in the snmp.conf manual page)
- The -t (timeout) switch will accept floating point numbers (eg: .1)
snmpd:
- [BUG 1712988]: default/configurable max # varbinds returned by GETBULK
- [PATCH 1585146]: Extend range of available error codes
- [PATCH 1654424]: Handle row deletion issues in dataset tables
- [PATCH 1666737]: Include IPv6 traffic in various UDP counters
- [PATCH 1700157]: Fix ordering of exec tokens in MIB output
- [PATCH 1719253]: fix skipNFSInHostResources for multiple walks
- [PATCH 1723611]: New implementation of the RMON alarmTable
- [PATCH 1737439]: automatic link up/down traps on a walk
- [PATCH 1806501]: Add API for sending traps with a snmpv3 context
- [PATCH 1882621]: Add LVM support to the partition table
- [PATCH 1893468]: fixed registration of OIDs with ranges
- [PATCH 1901764]: Support date-based logwatch files
- [PATCH 1909813]: fix table_iterator handling of SORTED hint
- [PATCH 1916840]: new config option to set SNMPv1 trap agent address
- [PATCH 2103492]: implement RMON-MIB::etherStatsJabbers
- [PATCH 2449210]: add 64-bit usage statistics to UCD-SNMP-MIB::dskTable
- Add support for a user provided length variable
and C string values to the watcher helper.
- Automatically reregister sysORTable entries from AgentX subagents.
- Fix various memory leaks
- Implement ipAddressSpinLock
- Implement ipNetToPhysicalLastUpdated
- Suppress annoying "registration != duplicate" warning for root oids
snmptrapd:
- [PATCH 1908288]: Run perl END block on termination
- Add trap handler for logging traps to a mysql database
- Withdraw deprecated options.
snmpnetstat:
- [PATCH 2564538]: Support GETBULK in v2c+ snmp versions
snmpusm:
- [PATCH 1591355]: Allow cloning to arbitrary engineIDs
snmplib:
- [BUG 1619827]: Improve handling of link dependencies
- [PATCH 700681]: limited support for UDPv4 broadcast addresses
- [PATCH 1882069]: Add token for specifying an exact SNMPv3 engineID
- Fix assorted memory leaks
- Implemented RFC5343 contextEngineID probing.
- Support for the TSM security model for use with tunneling
misc:
- Add config reread support to "net-snmp-config --compile-subagent" code
- Preliminary (alpha) support for SNMP over SSH and DTLS/UDP.
- Preliminary (alpha) support for the TSM security model
- Separate user management into new net-snmp-create-v3-user script
building:
- Improved cross-compilation support
- Improved library layering & dependency handling when linking apps
- Improved RPM spec files, for consistency with vendor-provided packages.
- Mechanism for selecting build environment based on version
- New test scripts to test Net-SNMP transport functionality
- Restructure configure template
- Update to autoconf 2.63 & libtool 2.2.6
perl:
- [BUG 1619827]: improve handling of link dependencies
- [PATCH 1956193]: beta threadable perl module code for SNMPv1/2c usage.
python:
- [PATCH 1716114]: Let python build in source tree (Debian patch #38)
Linux:
- [PATCH 1704105]: Add IPv6 support to the inetNetToMediaTable
- [PATCH 1705594]: Various fixes to ipAddressPrefixTable reporting
- [PATCH 1708243]: Implement ipDefaultRouteTable
- [PATCH 1715405]: Implement ipv6ScopeZoneIndexTable
- [PATCH 1724602]: MfD-based ipDefaultRouterTable implementation
- [PATCH 1828602]: Support ipDefaultTTL and ipForwarding SETs
- [PATCH 1927751]: Implement icmpMsgStatsTable
- [PATCH 2023633]: Implement SCTP-MIB
- [PATCH 2053273]: Implement EtherLike MIB
AIX:
- Add support for AIX 6.x
- Fix default shared library building instead of forcing static
FreeBSD:
- [BUG 1633483]: Support CPU HAL on FreeBSD4.x
- [PATCH 1623874]: add GNU/kFreeBSD support
IRIX:
- [PATCH 1709748]: Optimized IRIX cpu stats
- [PATCH 1675869]: CPU statistics for IRIX based on PCP
MacOSX:
- [PATCH 1600522]: CPU HAL implementation for mach/darwin
Solaris:
- [PATCH 1719730]: support for ipSystemStatsTable and ipAddressTable
Win32:
- [PATCH 2686248]: Fix several winExtDLL bugs.
- [PATCH 1706344]: Fix compilation with cygwin
- Fix AES support
*5.4*
Important Changes:
- The default configuration now enables embedded Perl and the Perl
modules by default when possible unless explicitly disabled. You
may use the --disable-embedded-perl and --without-perl-modules
configure options, respectively, to revert to the former default
configuration.
New:
python:
- Python bindings to the Net-SNMP project are now available in
the python sub-directory. See the README file there for details.
build:
- Some preliminary support for automatic building of dynamically
loadable mib module code.
- Most net-snmp specific defines are now (also) available under
a proper NETSNMP_ prefix. The older, potentially conflicting
names as well as the autoconf variables can now be turned off
easily within 3rd party code.
- libtool update to 1.5.22
- enable-as-needed will try to link built libraries against needed
libraries at library link time, rather than application link time.
This is preliminary support for what will likely be better in 5.5.
snmplib:
- [PATCH 1282566]: to rework transport creation to allow for
alternative interpretations of the address and a more flexible
transport registration system
- [PATCH 1509943]: responses will get sent from the original dest IP
address when possible.
snmpd:
- new MIB table for managing Net-SNMP access control extensions
(see NET-SNMP-VACM-MIB). These extensions to the VACM MIB are
Net-SNMP specific and are used primarily by snmptrapd at this point.
- [PATCH 1550725]: A new uint instance helper to match the existing
int, long and ulong helpers
- [PATCH 1534877]: to add support for skipping NFS entries in the
host resources hrStorageTable. See the skipNFSInHostResources
token in the snmpd.conf file for details.
- A "hardware abstraction layer", to localise the O/S-specific
aspects of retrieving system data. This first appeared in the
5.3.x line, but this release now starts to actively use it for
implementing particular MIB modules.
This has resulted in some minor changes in behaviour - some index
values in the hrStorageTable have changed from earlier releases,
and the (non-raw) memory statistics are now consistent, reporting
percentage usage calculated over the last minute on _all_ systems.
- Agent builds default module list from a default_mibs.h rather than
a hard coded configure list
- [PATCH 1568150]: Extend pass_persist error messages that can be
passed back from the script
- [PATCH 1570982]: Solaris IF-MIB: Support for IPv6-only interfaces
snmptrapd:
- the traphandle directive now supports a -t switch to indicate
matching any OID in the tree below the specified OID
mib2c:
- New mib2c.emulation.conf provides a quick way to do simplistic
emulation of an entire MIB or MIB branch.
- A new perl module NetSNMP::agent::Support provides easier embedded
perl support. (patch 1369996 from Peter Martin)
Run "mib2c -c mib2c.perl.conf OID" to help you start using it.
perl:
- gettable() now supports asynchronous callback functions
- update default_store module to latest default_store c-binding
tokens
snmpusm:
- performance improvement when changing localized keys
- new option -Cp to set usmUserPublic value
snmpvacm:
- new commands to manipulate Net-SNMP access control extensions
Ports:
Linux:
- add IPv6 aware UDP and TCP mibs to default module list
Solaris, FreeBSD, OpenBSD:
- Experimental support for 64bit interface counters (ifXTable). Enable
via '--with-mib-modules=if-mib --enable-mfd-rewrites'.
- [PATCH 1569537,1569539]: new UDP-MIB and TCP-MIB implementation
(enable through --with-mib-modules=udp-mib,tcp-mib)
Win32:
- new winExtDLL extension module to allow snmpd to load Windows SNMP
Service extension DLLs to provide support for HOST-RESOURCES-MIB
and other MIBs provided with Windows.
AIX:
- HOST-RESOURCES-MIB implementation added to default module list
uCLinux
- [PATCH 1551948]: Make pass_persist usable on uClinux
Fixes:
snmplib:
- fix OID lookups for fully qualified object names (eg .iso.org)
(official patch 1421725)
- UDPIPv6 and TCPIPv6 transports now compile on recent UN*X platforms
snmpd:
- fix disman/event monitoring crashes (official patch 1429059)
- fix re-init of daemons after SIGHUP (official patch 1473289)
- fix trap processing from SMUX peers (patch 1430824)
- [BUG 1527930]: fix smux authentication
- [BUG 1427410]: Set auth engineID for SNMPv3 traps.
- [BUG 1535903]: Support spaces within security names
- fix 8 byte IpAddress in at, ip and route MIBs.
- [PATCH 1562688]: fix ping/reattach agentx code
snmptrapd:
- fix bug 1420758/1458815: snmptrapd aborts/loops in select()
(official patch 1420758)
- fix re-init of daemons after SIGHUP (official patch 1473289)
perl:
- Fixed the perl bulkwalk function
- gettable() was fairly broken in prior versions
- OID handling was fully broken on various 64bit platforms
- fixes for 64-bit platforms
misc:
- Many misc fixes
*5.3.0.1*
*** Security Fix ***
- In version 5.3 much of the authorization control was rewritten.
There was a bug in the new code that resulted in granting write
access to read-only users or communities which were configured
using the "rocommunity" or "rouser" snmpd.conf tokens. 5.3.0.1
fixes this problem. Users are encouraged to immediately update
their installations if they use either of these tokens.
*5.3*
*** Important Notes ***
Several very significant changes have been made in Net-SNMP for this
release that warrant special attention.
- shared library version number no longer matches the release number. We
now follow the versioning scheme recommended by libtool. For the 5.3
release this means that the libraries now have a SONAME ending with
".so.10", e.g. libnetsnmp.so.10.
- snmpd has not been truncating log files at startup, as documented in
the man pages, for a while now. This default behaviour has been restored.
Please use the '-A' flag if you want to continue appending to your log
files at startup.
- snmptrapd will no longer accept all traps by default. It must be
configured with authorized SNMPv1/v2c community strings and/or SNMPv3
users. Non-authorized traps/informs will be dropped.
- Due to a copyright statement that didn't allow modifications,
snmpnetstat has been completely rewritten. The new version now
accepts the same command-line options as the other tools, which
has introduced a number of incompatible changes. However, it
does now finally support SNMPv3.
New:
Building:
- new option to disable set support in the agent (--disable-set-support)
snmpd:
- implement notification logging
- implement notification filtering
- AgentX, host resources and disman/event mibs added to default module list
- updated and new disman mib implementations
snmptrapd:
- allow a non-default AgentX socket
- a brand new authorization scheme that is based on the VACM
authorization scheme from snmpd.
- Note: now drops unauthenticated notifications by default
- registers the snmpEngine MIB group under the "snmptrapd" context
snmplib:
- new helper for ascii file based scalar integers (think Linux /proc/)
- new utilities for dealing with files
- new utilities for parsing text files
- granular config/persistent file disablement (noPersistentLoad and
noPersistentSave snmp.conf tokens)
mib2c:
- mib2c.mfd.conf now generates code for persistence row storage
- many enhancements and bug fixes
snmpusm:
- allows to use old and/or new localized key instead of passphrase with
option -Ck
- new option -CE to specify usmUserEngineID (necessary to manage
snmptrapd's usmUserTable)
Ports:
Linux:
- new experimental tables
- tcpConnectionTable, tcpListenerTable
- ipAddressPrefixTable
- udpEndpointTable
- ipv4InterfaceTable, ipv6InterfaceTable
- inetCidrRouteTable supports dynamic ipv4 route creation/deletion
- added ipv6IpForwarding.0 and ipv6IpDefaultHopLimit.0 (read-write)
Win32:
- Cygwin compiler fixes
- MSVC: agent (snmpd) support for pass and pass_persist
- MinGW: agent (snmpd) support for pass
- Fix for 'select: No such file or directory' in snmpdelta
Fixes:
- Persistent files in directory defined by snmp.conf persistentDir were
not being loaded at startup
- Perl getnext didn't honor explicit reference to MIB file
- AgentX sub-agent connection delayed til after config files read
- Build fixes for --disable-agent, --disable-snmpv1 and --disable-snmpv2c
- Lots of bug fixes
*5.2*
New:
For the security paranoid (like Wes):
- Insecure versions of SNMP may be completely disabled at compile time.
(configure using one or both of --disable-snmpv1 --disable-snmpv2c)
- Less secure versions of SNMPv3 authentication and encryption
algorithms may be completely disabled at compile time.
(configure using one or both of --disable-des --disable-md5)
(This requires you have OpenSSL to support SHA1 and AES instead)
- Diffie-Helman key negotiation (perfect-forward-secrecy - RFC2786)
has been implemented in both the agent and "snmpusm".
- Better support for direct use of localized and master keys
(randomly generated keys have more entropy than passwords). See
the -3m -3M -3k and -3K options, and the defAuthLocalizedKey,
defPrivLocalizedKey, defAuthMasterKey, defPrivMasterKey
snmp.conf tokens)
library:
- send and receive buffer sizes for UDP/TCP are configurable
- .conf file token registration can now search multiple files
(separate file names to search by a :. IE, "snmpd:agentx")
snmptrapd:
- Embedded perl support for trap handlers (much faster than traphandles).
(configure --with-embedded-perl ; see 'perldoc NetSNMP::TrapReceiver')
- the snmptrapd usmUser table can be controlled through SNMP & AgentX
(the snmptrapd registers MIBs under the "snmptrapd" SNMPv3 context)
agent:
- community strings can be mapped to individual SNMPv3 contexts
(see the snmpd.conf manual on "com2sec").
- AgentX should work properly with SNMPv3 contexts now.
- improved version of "exec" extension directive - "extend":
supports multi-line output, configurable command input, SET
handling, a valid relocatable MIB output structure, etc
- more flexibility added to netsnmp_cache helper, including periodic
refreshing of caches and cache pre-loading.
- experimental implementation of DisMan Remote Operations MIB groups
(remote nslookup, ping, traceroute and expressions via SNMP)
- The proxy supports a new -Cc flag which passes the community
name through to the other side rather than hard-coding it.
- The config_require() and other modules can now be placed
inside of CPP directievs (#if, /* ... */) as header files are
now passed through CPP processing first.
- new config_exclude() macro for excluding certain modules
- new config_belongs_in() macro to specify if a chunk of code
found by --with-mib-modules belongs in the agent library or
the mib module library.
- Uses a smaller function stack.
commands:
- snmpusm: A number of key-change improvements
(EG, changing localized keys supported, diffie-helman support, ...)
- New -Ln option to completely disable logging.
mib2c:
- a number of new or updated configuration templates:
- mib2c.iterate.conf: the iterator-based table config
now produces fuller template code than before.
- mib2c.table_data.conf and mib2c.container.conf:
two new "internal-row" style configs
- mib2c.mfd.conf: "MIBs for Dummies" (or MFD) - intended to
reduce the SNMP knowledge needed to develop MIB modules
and add flexibility at the same time. Run "mib2c -S
mfd_interactive_setup=1 -c mib2c.mfd.conf OID" and follow
its guided instructions to help you tailor its results to
meet your needs.
- mib2c.genhtml.conf: Generates an easier-to-read HTML view of
a MIB tree structure. (See http://www.Net-SNMP.org/mibs/
for example output.)
- more node tags available for conf file writers
- additional search directories may be set via MIB2C_DIRS env var.
- mib2c-update: new utility to help update mib2c generated code
when conf file changes.
- a mib2c.conf manual page to describe how to write mib2c .conf files.
- support for embedded perl code in mib2c.conf files
documentation:
- New README.agent-mibs: an attempt to start documenting what
MIBs are implemented in the agent and on what architectures.
perl:
- An improved SNMP::gettable() method. Uses GETBULK if possible and
better GETNEXT requests if not, decodes indexes from OIDs,
requests multiple variables at once, ... ("perldoc SNMP" for details)
- A NetSNMP::OID::get_indexes() function to extract index values
from an OID.
Ports:
Linux:
- new experimental tables/rewrites for Linux, including:
ifTable, ifXTable, inetCidrRouteTable, ipCidrRouteTable,
ipAddressTable, ipSystemStatsTable, ipNetToPhysicalTable.
- Enable these talbles by specifying --enable-mfd-rewrites to configure.
- Most of these tables have IPv6 support as well.
- ifIndex no longer changes when interfaces are added/removed, and all
tables/object will now use the same ifIndex for the same interface.
Solaris:
- new experimental support for ucd-snmp/lmSensors MIB module
Win32:
- Support for the MinGW compiler
- Support for snmptrapd running as a service
- A Win32 specific build and install script
- Support for a .exe installer
(we'll make binaries available using it)
Fixes:
- AgentX memory leak on sets
- SNMPv3 not-in-time window after 248 days
- Agent hang in HOST-RESOURCES MIB
- double free on duplicate registration
- OIDs with IP Addresses as indexes now print prettier
-'Lazy' installation of headers (only install if newer)
- allow whitespace in rocommunity/rwcommunity
- many miscellaneous bug reports
*5.1.2*
New:
- Minor improvements to snmpdelta (error reporting)
- Minor improvements to snmpnetstat (IPv6 output)
Fixes:
- Misc 64bit processor fixes.
- Misc perl build and install fixes.
Ports:
- Linux 2.6 improvements
- Win32 support for TCP and UDP over IPv6 via Winsock version 2
- Win32 fixes in many places.
- Win32 service support for snmptrapd
- Win32 support for snmpconf
*5.1.1*
New:
- test suite supports testing over other transports (tcp, udp6, unix, ...)
(see the -P switch to the testing/RUNTESTS script)
- Solaris supports the use of it's PKCS#11 library for supporting
cryptographic functions (OpenSSL isn't required if PKCS#11 is available)
(see configure's --with-pkcs flag)
Fixes:
- Improvements on 64 bit architectures.
- A few minor memory leaks fixed.
- An extremely large number of minor bug fixes.
- Many perl module specific bug fixes.
- snmpd will safely handle more signals.
Ports:
- Many many significant Windows improvements.
- AgentX support is working again under windows.
- SCM support is built into the agent to allow the agent to be
started as a windows service.
- MSDOS names are supported in path names.
- A win32 build script in win32/build.pl
- Support for the MinGW compiler
- (see the README.win32 file for details on new ports)
- Various helpful win32/*.bat files for installation, etc.
- Some linux 2.6 support improvements
*5.1*
New:
Building:
- configure is now generated using autoconf 2.57.
- The make system now supports "make uninstall"
- configure & make supports a --with-install-prefix option
- new configure options to disable building of the agent, apps, ...
./configure --help for a list of package sections that can be excluded.
- new configure option to remove specific code pieces (mib reading, ...)
./configure --help for a list of code areas that can be excluded.
snmpd:
- linkUp and linkDown notifications can be enabled
(see the linkUpDownNotifications snmpd.conf token documentation)
- notifications (traps) can be generated for disman/monitor events.
(see the snmpd.conf documentation on "monitor" and "notificatonEvent")
- new snmpd.conf tokens: includeAllDisks
- the UCD-DISKIO-MIB will now work on linux.
- com2sec mappings for SNMP over unix sockets.
- some speed improvements have been made that should increase the
speed of the agent's processing time.
- for mib code using the table iterator, an auto-caching mechanism
which can greatly speed up access at the cost of caching.
(see "stash_cache" in the injectHandler token docs in snmpd.conf(5))
- Some of the agent modules were completely rewritten (and
should be faster and cleaner).
- A number of new APIs and helper modules are available, but
there is no major summary to easily list.
- A number of new Net-SNMP specific MIBs now exist.
snmptrapd:
- snmptrapd now supports forwarding of notifications.
(see the snmptrapd.conf manual for details)
- snmptrapd's new -t switch can be used to disable syslog.
(useful for a no-output snmptrapd with only traphandle support)
apps:
- snmptable sports 3 new options: fixed width, max-repeaters,
left-justify. (see snmptable -h for details)
- mib2c walks you through instructions to help you generate code
"just for you". Including some new forms of output code, like
notification code generation. Run mib2c SOMETHING for details.
- mib2c has about a billion other improvements, including the
ability to generate trap generation code templates.
- snmpwalk supports a new -Ct option for timing how long a walk takes.
- net-snmp-config supports a number of new options.
- All applications support a consistent -L flag for turning on
which forms of output logging should be used.
perl:
- the SNMP module supports a new get_table() call.
Fixes:
- More patches to properly demonize snmpd (close std*, double fork, ...).
- Version numbers of all packages/perl-modules/etc are better synchronized.
- more documentation, especially for APIs
- all perl module version numbers are synchronized with the
net-snmp package.
- Many many misc bug fixes, as always.
Ports:
- diskio MIB support for Darwin.
- ifSpeed under Linux should now be correct for most network cards.
- more windows build fixes
*5.0.9*
SECURITY:
- An existing user/community could get access to data in MIB
objects that were explicitly excluded from their view.
Fixes:
- Perl build environment should better under Windows
- Misc kerberos support fixes.
- Improvements on various manual pages.
- A annoying bug with SETs being passed to pass scripts was fixed.
- The often talked about VACM optimization improvement was fixed again.
- mib2c handles augmentation tables better now.
- Various 64 bit issues have been addressed.
*5.0.8*
New:
- No new features will be added to the 5.0.x line.
Ports:
- Update libtool to version 1.4.3, for the benefit of Darwin
- diskio support for Darwin
- Updates for OpenBSD 3.
- Updates to solaris README
Fixes:
- find libwrap w/nsl on RedHat
- fix for openssl 0.9.7
- Fix some AgentX memory leaks
- use macro for inline function prototypes
- Attempt to find unused port before running tests
- Use SNMP_SLEEP environment variable when running tests
- calculate a proper ifSpeed under linux when possible
- better daemonization of snmpd
- close and reopen snmptrapd log files on HUP
- support for 16 bit reuqest ids
- Recognize new 't' code in display hints
- misc other fixes
*5.0.7*
New:
- VACM (access control) optimizations which will greatly benefit
people who wish to exclude large portions of the MIB tree from
some people. Previously this was a large resource drain.
- Add command line option to snmpd to set syslog facility
- Reverse DISPLAY-HINT processing, i.e. it allows you to input data
formatted like a DISPLAY-HINT prescribes
- Support setting of sysDescr and sysObjectID via snmpd.conf
configuration directives
- New output option to force display of strings as hex
- Persistent directory can be specified at runtime
- Add support for Linux virtual interfaces in the ipAddressTable.
- implemented the mteEventTable and the mteEventNotificationTable
form the DISMAN-EVENT-MIB.
Fixes:
- AgentX no longer flagged as experimental
- A few memory leak fixes for the table_iterator agent API.
- Processed flag cleared before each pass of a set request
- Remove snmpd pid file on exit
- Restore default behaviour of building shared libraries
- misc other fixes
*5.0.6*
Fixes:
- prevent denial of service attack from authenticated users
(really this time).
- misc other fixes