netsnmp 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c87bf65264474758aed741b992dadbd6bbb277aae52b925254da2e5fea56c5b3
-  data.tar.gz: cf7134f2e8b451c619aabdf9dcd6b931404ab51afd7953c785e4013a348cce02
+  metadata.gz: 8b92d6d77d4874c6d3d76ed0bbbb3358a72fd33131d9a971e41b73cb5584cfbd
+  data.tar.gz: c2ae854a2a1f8268115291447bdd1ede0686258840aa41ba1778e41bb6c94c22
 SHA512:
-  metadata.gz: 1cade51302613f51f8da018351401b27c2d0fe08a43b915a79252ff420d5efdfe4a405ce29a60f10ade2d0f0f4a03dc2302117653043c451dd01683e8eb2c7a5
-  data.tar.gz: 0ce54aa2fb2cba42f47ccab2fd83e2536e8fd9e73d29d2f7a85aef4ab90d9e0c956f64f0f8fbe19f95c36a048ab2911492f55c4ca95ada0843941a896564b2cf
+  metadata.gz: f439b2ebd5777390ed34ec9bd893e943918b201f81fcfa1f9e55cb5800d1eba20712d5ebd2e9660b291383ba6d413977691842124cb97dad909283cbf1483fff
+  data.tar.gz: fde5a6b1ec4340505e65c2f8dc49f04b6621136f4fc48c366742d8acb32e8f157f25554790fe2e64d672801307289f0b00d7f9945c561970729bc326dd5af34d

data/lib/netsnmp/message.rb

@@ -16,6 +16,10 @@ module NETSNMP
 
     def initialize(**); end
 
+    def verify(stream, auth_param, security_level, security_parameters:)
+      security_parameters.verify(stream.sub(auth_param, AUTHNONE.value), auth_param, security_level: security_level)
+    end
+
     # @param [String] payload of an snmp v3 message which can be decoded
     # @param [NETSMP::SecurityParameters, #decode] security_parameters knowns how to decode the stream
     #
@@ -51,9 +55,7 @@ module NETSNMP
       log(level: 2) { asn_tree.to_hex }
       log(level: 2) { sec_params_asn.to_hex }
 
-      # validate_authentication
       auth_param = auth_param.value
-      security_parameters.verify(stream.sub(auth_param, AUTHNONE.value), auth_param, security_level: security_level)
 
       engine_boots = engine_boots.value.to_i
       engine_time = engine_time.value.to_i
@@ -65,6 +67,9 @@ module NETSNMP
 
       log { "received response PDU" }
       pdu = ScopedPDU.decode(encoded_pdu)
+      pdu.auth_param = auth_param
+      pdu.security_level = security_level
+
       log(level: 2) { pdu.to_hex }
       [pdu, engine_id.value, engine_boots, engine_time]
     end

data/lib/netsnmp/scoped_pdu.rb

@@ -6,6 +6,8 @@ module NETSNMP
 
     attr_reader :engine_id
 
+    attr_accessor :security_level, :auth_param
+
     def initialize(type:, headers:, **options)
       @engine_id, @context = headers
       super(type: type, headers: [3, nil], **options)

data/lib/netsnmp/v3_session.rb

@@ -24,14 +24,7 @@ module NETSNMP
       log { "sending request..." }
       encoded_request = encode(pdu)
       encoded_response = @transport.send(encoded_request)
-      response_pdu, *args = decode(encoded_response)
-      if response_pdu.type == 8
-        varbind = response_pdu.varbinds.first
-        if varbind.oid == "1.3.6.1.6.3.15.1.1.2.0" # IdNotInTimeWindow
-          _, @engine_boots, @engine_time = args
-          raise IdNotInTimeWindowError, "request timestamp is already out of time window"
-        end
-      end
+      response_pdu, * = decode(encoded_response)
       response_pdu
     end
 
@@ -85,7 +78,33 @@ module NETSNMP
     end
 
     def decode(stream, security_parameters: @security_parameters)
-      @message_serializer.decode(stream, security_parameters: security_parameters)
+      return_pdu = @message_serializer.decode(stream, security_parameters: security_parameters)
+
+      pdu, *args = return_pdu
+
+      # usmStats: http://oidref.com/1.3.6.1.6.3.15.1.1
+      if pdu.type == 8
+        case pdu.varbinds.first.oid
+        when "1.3.6.1.6.3.15.1.1.1.0" # usmStatsUnsupportedSecLevels
+          raise Error, "Unsupported security level"
+        when "1.3.6.1.6.3.15.1.1.2.0" # usmStatsNotInTimeWindows
+          _, @engine_boots, @engine_time = args
+          raise IdNotInTimeWindowError, "Not in time window"
+        when "1.3.6.1.6.3.15.1.1.3.0" # usmStatsUnknownUserNames
+          raise Error, "Unknown user name"
+        when "1.3.6.1.6.3.15.1.1.4.0" # usmStatsUnknownEngineIDs
+          raise Error, "Unknown engine ID" unless @security_parameters.must_revalidate?
+        when "1.3.6.1.6.3.15.1.1.5.0" # usmStatsWrongDigests
+          raise Error, "Authentication failure (incorrect password, community or key)"
+        when "1.3.6.1.6.3.15.1.1.6.0" # usmStatsDecryptionErrors
+          raise Error, "Decryption error"
+        end
+      end
+
+      # validate_authentication
+      @message_serializer.verify(stream, pdu.auth_param, pdu.security_level, security_parameters: @security_parameters)
+
+      return_pdu
     end
   end
 end

data/lib/netsnmp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NETSNMP
-  VERSION = "0.4.1"
+  VERSION = "0.4.2"
 end

data/sig/message.rbs

@@ -2,6 +2,8 @@ module NETSNMP
   class Message
     prepend Loggable
 
+    def verify: (String stream, String auth_param, Integer? security_level, security_parameters: SecurityParameters) -> void
+
     def decode: (String stream, security_parameters: SecurityParameters) -> [ScopedPDU, String, Integer, Integer]
 
     def encode: (ScopedPDU pdu, security_parameters: SecurityParameters, ?engine_boots: Integer, ?engine_time: Integer) -> String

data/sig/scoped_pdu.rbs

@@ -1,6 +1,8 @@
 module NETSNMP
   class ScopedPDU < PDU
     attr_reader engine_id: String
+    attr_reader auth_param: String?
+    attr_reader security_level: Integer?
 
     private
 

data/spec/client_spec.rb

@@ -177,6 +177,18 @@ RSpec.describe NETSNMP::Client do
         end
         it_behaves_like "an snmp client" do
           let(:protocol_options) { version_options.merge(user_options).merge(extra_options) }
+
+          context "with wrong auth password and wrong encrypting password" do
+            let(:user_options) do
+              { username: "authprivmd5des", auth_password: "wrongpassword",
+                auth_protocol: :md5, priv_password: "maplesyrup",
+                priv_protocol: :des }
+            end
+            let(:protocol_options) { version_options.merge(user_options).merge(extra_options) }
+            it "raises authentication error" do
+              expect { subject.get(oid: get_oid) }.to raise_error(NETSNMP::Error, "Authentication failure (incorrect password, community or key)")
+            end
+          end
         end
       end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: netsnmp
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-05-28 00:00:00.000000000 Z
+date: 2021-06-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: parslet