Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(snmp): Add secret support for auth_password and priv_password #14975

Merged
merged 2 commits into from
Mar 13, 2024
Merged

feat(snmp): Add secret support for auth_password and priv_password #14975

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b3ea93d
feat(snmp): Add secret support for auth_password and priv_password
srebhan Mar 12, 2024
a9cd7a1
Update READMEs
srebhan Mar 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
42 changes: 19 additions & 23 deletions internal/snmp/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,10 @@ import (

type ClientConfig struct {
// Timeout to wait for a response.
Timeout config.Duration `toml:"timeout"`
Retries int `toml:"retries"`
// Values: 1, 2, 3
Version uint8 `toml:"version"`
UnconnectedUDPSocket bool `toml:"unconnected_udp_socket"`
// Path to mib files
Path []string `toml:"path"`
// Translator implementation
Translator string `toml:"-"`
Timeout config.Duration `toml:"timeout"`
Retries int `toml:"retries"`
Version uint8 `toml:"version"`
UnconnectedUDPSocket bool `toml:"unconnected_udp_socket"`

// Parameters for Version 1 & 2
Community string `toml:"community"`
Expand All @@ -25,19 +20,20 @@ type ClientConfig struct {
MaxRepetitions uint32 `toml:"max_repetitions"`

// Parameters for Version 3
ContextName string `toml:"context_name"`
// Values: "noAuthNoPriv", "authNoPriv", "authPriv"
SecLevel string `toml:"sec_level"`
SecName string `toml:"sec_name"`
// Values: "MD5", "SHA", "". Default: ""
AuthProtocol string `toml:"auth_protocol"`
AuthPassword string `toml:"auth_password"`
// Values: "DES", "AES", "". Default: ""
PrivProtocol string `toml:"priv_protocol"`
PrivPassword string `toml:"priv_password"`
EngineID string `toml:"-"`
EngineBoots uint32 `toml:"-"`
EngineTime uint32 `toml:"-"`
ContextName string `toml:"context_name"`
SecLevel string `toml:"sec_level"`
SecName string `toml:"sec_name"`
AuthProtocol string `toml:"auth_protocol"`
AuthPassword config.Secret `toml:"auth_password"`
PrivProtocol string `toml:"priv_protocol"`
PrivPassword config.Secret `toml:"priv_password"`
EngineID string `toml:"-"`
EngineBoots uint32 `toml:"-"`
EngineTime uint32 `toml:"-"`

// Path to mib files
Path []string `toml:"path"`
Translator string `toml:"-"`
}

func DefaultClientConfig() *ClientConfig {
Expand All @@ -52,6 +48,6 @@ func DefaultClientConfig() *ClientConfig {
SecLevel: "authNoPriv",
SecName: "myuser",
AuthProtocol: "MD5",
AuthPassword: "pass",
AuthPassword: config.NewSecret([]byte("pass")),
}
}
21 changes: 16 additions & 5 deletions internal/snmp/wrapper.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,7 +109,14 @@ func NewWrapper(s ClientConfig) (GosnmpWrapper, error) {
return GosnmpWrapper{}, errors.New("invalid authProtocol")
}

sp.AuthenticationPassphrase = s.AuthPassword
if !s.AuthPassword.Empty() {
p, err := s.AuthPassword.Get()
if err != nil {
return GosnmpWrapper{}, fmt.Errorf("getting authentication password failed: %w", err)
}
sp.AuthenticationPassphrase = p.String()
p.Destroy()
}

switch strings.ToLower(s.PrivProtocol) {
case "des":
Expand All @@ -130,12 +137,16 @@ func NewWrapper(s ClientConfig) (GosnmpWrapper, error) {
return GosnmpWrapper{}, errors.New("invalid privProtocol")
}

sp.PrivacyPassphrase = s.PrivPassword

if !s.PrivPassword.Empty() {
p, err := s.PrivPassword.Get()
if err != nil {
return GosnmpWrapper{}, fmt.Errorf("getting private password failed: %w", err)
Copy link
Contributor

@Hipska Hipska Apr 23, 2024 •
edited

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

-				return GosnmpWrapper{}, fmt.Errorf("getting private password failed: %w", err)
+				return GosnmpWrapper{}, fmt.Errorf("getting privacy password failed: %w", err)

}
sp.PrivacyPassphrase = p.String()
p.Destroy()
}
sp.AuthoritativeEngineID = s.EngineID

sp.AuthoritativeEngineBoots = s.EngineBoots

sp.AuthoritativeEngineTime = s.EngineTime
}
return gs, nil
Expand Down
9 changes: 9 additions & 0 deletions plugins/inputs/snmp/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,15 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.

[CONFIGURATION.md]: ../../../docs/CONFIGURATION.md#plugins

## Secret-store support

This plugin supports secrets from secret-stores for the `auth_password` and
`priv_password` option.
See the [secret-store documentation][SECRETSTORE] for more details on how
to use them.

[SECRETSTORE]: ../../../docs/CONFIGURATION.md#secret-store-secrets

## SNMP backend: gosmi and netsnmp

Telegraf has two backends to translate SNMP objects. By default, Telegraf will
Expand Down
20 changes: 10 additions & 10 deletions plugins/inputs/snmp/snmp_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,9 +245,9 @@ func TestGetSNMPConnection_v3(t *testing.T) {
SecLevel: "authPriv",
SecName: "myuser",
AuthProtocol: "md5",
AuthPassword: "password123",
AuthPassword: config.NewSecret([]byte("password123")),
PrivProtocol: "des",
PrivPassword: "321drowssap",
PrivPassword: config.NewSecret([]byte("321drowssap")),
EngineID: "myengineid",
EngineBoots: 1,
EngineTime: 2,
Expand Down Expand Up @@ -294,9 +294,9 @@ func TestGetSNMPConnection_v3_blumenthal(t *testing.T) {
SecLevel: "authPriv",
SecName: "myuser",
AuthProtocol: "md5",
AuthPassword: "password123",
AuthPassword: config.NewSecret([]byte("password123")),
PrivProtocol: "AES192",
PrivPassword: "password123",
PrivPassword: config.NewSecret([]byte("password123")),
EngineID: "myengineid",
EngineBoots: 1,
EngineTime: 2,
Expand All @@ -316,9 +316,9 @@ func TestGetSNMPConnection_v3_blumenthal(t *testing.T) {
SecLevel: "authPriv",
SecName: "myuser",
AuthProtocol: "md5",
AuthPassword: "password123",
AuthPassword: config.NewSecret([]byte("password123")),
PrivProtocol: "AES192C",
PrivPassword: "password123",
PrivPassword: config.NewSecret([]byte("password123")),
EngineID: "myengineid",
EngineBoots: 1,
EngineTime: 2,
Expand All @@ -338,9 +338,9 @@ func TestGetSNMPConnection_v3_blumenthal(t *testing.T) {
SecLevel: "authPriv",
SecName: "myuser",
AuthProtocol: "md5",
AuthPassword: "password123",
AuthPassword: config.NewSecret([]byte("password123")),
PrivProtocol: "AES256",
PrivPassword: "password123",
PrivPassword: config.NewSecret([]byte("password123")),
EngineID: "myengineid",
EngineBoots: 1,
EngineTime: 2,
Expand All @@ -360,9 +360,9 @@ func TestGetSNMPConnection_v3_blumenthal(t *testing.T) {
SecLevel: "authPriv",
SecName: "myuser",
AuthProtocol: "md5",
AuthPassword: "password123",
AuthPassword: config.NewSecret([]byte("password123")),
PrivProtocol: "AES256C",
PrivPassword: "password123",
PrivPassword: config.NewSecret([]byte("password123")),
EngineID: "myengineid",
EngineBoots: 1,
EngineTime: 2,
Expand Down
9 changes: 9 additions & 0 deletions plugins/processors/ifname/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,15 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.

[CONFIGURATION.md]: ../../../docs/CONFIGURATION.md#plugins

## Secret-store support

This plugin supports secrets from secret-stores for the `auth_password` and
`priv_password` option.
See the [secret-store documentation][SECRETSTORE] for more details on how
to use them.

[SECRETSTORE]: ../../../docs/CONFIGURATION.md#secret-store-secrets

## Configuration

```toml @sample.conf
Expand Down
9 changes: 9 additions & 0 deletions plugins/processors/snmp_lookup/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,15 @@ See the [CONFIGURATION.md][CONFIGURATION.md] for more details.

[CONFIGURATION.md]: ../../../docs/CONFIGURATION.md#plugins

## Secret-store support

This plugin supports secrets from secret-stores for the `auth_password` and
`priv_password` option.
See the [secret-store documentation][SECRETSTORE] for more details on how
to use them.

[SECRETSTORE]: ../../../docs/CONFIGURATION.md#secret-store-secrets

## Configuration

```toml @sample.conf
Expand Down