netsnmp 0.5.0 → 0.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5119f7e6ec751a4d3ba54076e5597b0667de904eda86802e5e3544e40a753172
-  data.tar.gz: 35924abe6afc24d8a41c8b6429a0566644d6bf4674b2b83704ac3f215e217487
+  metadata.gz: 93b380d735dc2250a9c3528e7ab1e6c70147124a6dc439fe7dd4eac1f4c0fd55
+  data.tar.gz: 52db8f559bc3485ab4802d72ccba98fb29429a0b9a0cceec13fc5a489409e35e
 SHA512:
-  metadata.gz: 7662ff27d3242840034b7e72f0a85132fa7007ef44ab4e207ac79f13cfdc29c3709884b098bba97d83e0f157618a8ca8c4dab5d8919bc6686aba4452b990213f
-  data.tar.gz: 673c3ce56ca0154f5efc6247204ffebbd9d0966d43ba4371ba2cee98d10f1496e579eef84acf24349109315d35febb7c42716a8b88c432200cee3eeddd63cca3
+  metadata.gz: 1a7573fe1ca2f0d78a3ca4d88d8054b9fd872078352d8ed3f700525e049719d601fe8f7dda94f0ff77b866e75961eb26af80a4acd332e04d390c433405970fd7
+  data.tar.gz: 3524298a40a89f5364a27cfe0444f7e298016822439020c04b203960cc4c77622453f9a48d6c01ea1e072c3a004705299b6a8f34a89cb1ce00f66a98f3919d7a

data/README.md

@@ -31,6 +31,7 @@ $ gem install netsnmp
 This gem provides:
 
 * Implementation in ruby of the SNMP Protocol for v3, v2c and v1 (most notable the rfc3414 and 3826).
+* SNMPv3 USM supporting MD5/SHA/SHA256 auth and DES/AES128 privacy crypto algorithms.
 * Client/Manager API with simple interface for get, genext, set and walk.
 * Pure Ruby.
 * Support for concurrency and evented I/O.
@@ -80,7 +81,7 @@ manager.get(oid: "sysName.0") #=> 'tt'
 # SNMP walk
 # sysORDescr
 manager.walk(oid: "sysORDescr").each do |oid_code, value|
-  # do something with them  
+  # do something with them
   puts "for #{oid_code}: #{value}"
 end
 
@@ -214,8 +215,8 @@ gem 'netsnmp'
 
 # or, in the command line
 
-$ gem install netsnmp      
-```                        
+$ gem install netsnmp
+```
 
 and `netsnmp` will automatically pick it up.
 

data/lib/netsnmp/message.rb

@@ -7,8 +7,7 @@ module NETSNMP
 
     prepend Loggable
 
-    AUTHNONE               = OpenSSL::ASN1::OctetString.new("\x00" * 12).with_label(:auth_mask)
-    PRIVNONE               = OpenSSL::ASN1::OctetString.new("")
+    PRIVNONE           = OpenSSL::ASN1::OctetString.new("")
     MSG_MAX_SIZE       = OpenSSL::ASN1::Integer.new(65507).with_label(:max_message_size)
     MSG_SECURITY_MODEL = OpenSSL::ASN1::Integer.new(3).with_label(:security_model) # usmSecurityModel
     MSG_VERSION        = OpenSSL::ASN1::Integer.new(3).with_label(:message_version)
@@ -17,7 +16,7 @@ module NETSNMP
     def initialize(**); end
 
     def verify(stream, auth_param, security_level, security_parameters:)
-      security_parameters.verify(stream.sub(auth_param, AUTHNONE.value), auth_param, security_level: security_level)
+      security_parameters.verify(stream.sub(auth_param, authnone(security_parameters.auth_protocol).value), auth_param, security_level: security_level)
     end
 
     # @param [String] payload of an snmp v3 message which can be decoded
@@ -91,7 +90,7 @@ module NETSNMP
                                                  OpenSSL::ASN1::Integer.new(engine_boots).with_label(:engine_boots),
                                                  OpenSSL::ASN1::Integer.new(engine_time).with_label(:engine_time),
                                                  OpenSSL::ASN1::OctetString.new(security_parameters.username).with_label(:username),
-                                                 AUTHNONE,
+                                                 authnone(security_parameters.auth_protocol),
                                                  salt_param
                                                ]).with_label(:security_params)
       log(level: 2) { sec_params.to_hex }
@@ -120,11 +119,22 @@ module NETSNMP
         log { "signing V3 message..." }
         auth_salt = OpenSSL::ASN1::OctetString.new(signature).with_label(:auth)
         log(level: 2) { auth_salt.to_hex }
-        none_der = AUTHNONE.to_der
+        none_der = authnone(security_parameters.auth_protocol).to_der
         encoded[encoded.index(none_der), none_der.size] = auth_salt.to_der
         log { Hexdump.dump(encoded) }
       end
       encoded
     end
+
+    private
+
+    # https://datatracker.ietf.org/doc/html/rfc7860#section-4.2.2 part 3
+    # https://datatracker.ietf.org/doc/html/rfc3414#section-6.3.2 part 3
+    def authnone(auth_protocol)
+      # The digest in the msgAuthenticationParameters field is replaced by the 12 zero octets.
+      # 24 octets for sha256
+      number_of_octets = auth_protocol == :sha256 ? 24 : 12
+      OpenSSL::ASN1::OctetString.new("\x00" * number_of_octets).with_label(:auth_mask)
+    end
   end
 end

data/lib/netsnmp/security_parameters.rb

@@ -22,13 +22,13 @@ module NETSNMP
     # The 150 Seconds is specified in https://www.ietf.org/rfc/rfc2574.txt 2.2.3
     TIMELINESS_THRESHOLD = 150
 
-    attr_reader :security_level, :username
+    attr_reader :security_level, :username, :auth_protocol
     attr_reader :engine_id
 
     # @param [String] username the snmp v3 username
     # @param [String] engine_id the device engine id (initialized to '' for report)
     # @param [Symbol, integer] security_level allowed snmp v3 security level (:auth_priv, :auth_no_priv, etc)
-    # @param [Symbol, nil] auth_protocol a supported authentication protocol (currently supported: :md5, :sha)
+    # @param [Symbol, nil] auth_protocol a supported authentication protocol (currently supported: :md5, :sha, :sha256)
     # @param [Symbol, nil] priv_protocol a supported privacy protocol (currently supported: :des, :aes)
     # @param [String, nil] auth_password the authentication password
     # @param [String, nil] priv_password the privacy password
@@ -110,6 +110,12 @@ module NETSNMP
 
       key = auth_key.dup
 
+      # SHA256 => https://datatracker.ietf.org/doc/html/rfc7860#section-4.2.2
+      # The 24 first octets of HMAC are taken as the computed MAC value
+      return OpenSSL::HMAC.digest("SHA256", key, message)[0, 24] if @auth_protocol == :sha256
+
+      # MD5 => https://datatracker.ietf.org/doc/html/rfc3414#section-6.3.2
+      # SHA1 => https://datatracker.ietf.org/doc/html/rfc3414#section-7.3.2
       key << "\x00" * (@auth_protocol == :md5 ? 48 : 44)
       k1 = key.xor(IPAD)
       k2 = key.xor(OPAD)
@@ -120,6 +126,7 @@ module NETSNMP
 
       digest.reset
       digest << (k2 + d1)
+      # The 12 first octets of the digest are taken as the computed MAC value
       digest.digest[0, 12]
     end
 
@@ -204,6 +211,7 @@ module NETSNMP
       @digest ||= case @auth_protocol
                   when :md5 then OpenSSL::Digest::MD5.new
                   when :sha then OpenSSL::Digest::SHA1.new
+                  when :sha256 then OpenSSL::Digest::SHA256.new
                   else
                     raise Error, "unsupported auth protocol: #{@auth_protocol}"
                   end

data/lib/netsnmp/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module NETSNMP
-  VERSION = "0.5.0"
+  VERSION = "0.6.0"
 end

data/sig/message.rbs

@@ -7,5 +7,9 @@ module NETSNMP
     def decode: (String stream, security_parameters: SecurityParameters) -> [ScopedPDU, String, Integer, Integer]
 
     def encode: (ScopedPDU pdu, security_parameters: SecurityParameters, ?engine_boots: Integer, ?engine_time: Integer) -> String
+
+    private
+
+    def authnone: (SecurityParameters::auth_protocol?) -> OpenSSL::ASN1::ASN1Data
   end
 end

data/sig/security_parameters.rbs

@@ -4,11 +4,10 @@ module NETSNMP
 
     type security_level = :noauth | :auth_no_priv | :auth_priv | 0 | 1 | 3 | nil
 
-    type auth_protocol = :md5 | :sha
+    type auth_protocol = :md5 | :sha | :sha256
     type priv_protocol = :des | :aes
 
 
-    @auth_protocol: auth_protocol?
     @auth_password: String?
     @priv_protocol: priv_protocol?
     @priv_password: String?
@@ -18,6 +17,7 @@ module NETSNMP
     attr_reader security_level: security_level
     attr_reader username: String
     attr_reader engine_id: String
+    attr_reader auth_protocol: auth_protocol?
 
     def engine_id=: (String id) -> void
 

data/spec/client_spec.rb

@@ -23,19 +23,19 @@ RSpec.describe NETSNMP::Client do
       let(:next_oid) { "1.3.6.1.2.1.1.6.0" }
       let(:walk_oid) { "1.3.6.1.2.1.1" }
       let(:set_oid) { "sysUpTime.0" } # sysUpTimeInstance
-      let(:get_result) { "DEVICE-192.168.1.1" }
-      let(:next_result) { "The Cloud" }
+      let(:get_result) { "zeus.snmplabs.com (you can change this!)" }
+      let(:next_result) { "San Francisco, California, United States" }
       let(:walk_result) do
-        <<-WALK
-1.3.6.1.2.1.1.1.0: Device description
-1.3.6.1.2.1.1.2.0: 1.3.6.1.4.1.3454
-1.3.6.1.2.1.1.3.0: Timeticks: (78171676) 9 days, 1:8:36.76
-1.3.6.1.2.1.1.4.0: The Owner
-1.3.6.1.2.1.1.5.0: DEVICE-192.168.1.1
-1.3.6.1.2.1.1.6.0: The Cloud
-1.3.6.1.2.1.1.7.0: 72
-1.3.6.1.2.1.1.8.0: Timeticks: (0) 0 days, 0:0:0.0
-        WALK
+        {
+          "1.3.6.1.2.1.1.1.0" => "Linux zeus 4.8.6.5-smp #2 SMP Sun Nov 13 14:58:11 CDT 2016 i686",
+          "1.3.6.1.2.1.1.2.0" => "1.3.6.1.4.1.8072.3.2.10",
+          "1.3.6.1.2.1.1.3.0" => /Timeticks: \(\d+\) \d+ days, \d+:\d+:\d+\.\d+/,
+          "1.3.6.1.2.1.1.4.0" => "SNMP Laboratories, info@snmplabs.com",
+          "1.3.6.1.2.1.1.5.0" => "zeus.snmplabs.com (you can change this!)",
+          "1.3.6.1.2.1.1.6.0" => "San Francisco, California, United States",
+          "1.3.6.1.2.1.1.7.0" => "72",
+          "1.3.6.1.2.1.1.8.0" => /Timeticks: \(\d+\) \d+ days, \d+:\d+:\d+\.\d+/
+        }
       end
       let(:set_oid_result) { 43 }
     end
@@ -52,19 +52,19 @@ RSpec.describe NETSNMP::Client do
       let(:next_oid) { "1.3.6.1.2.1.1.6.0" }
       let(:walk_oid) { "system" }
       let(:set_oid) { "sysUpTime.0" }
-      let(:get_result) { "DEVICE-192.168.1.1" }
-      let(:next_result) { "The Cloud" }
+      let(:get_result) { "zeus.snmplabs.com (you can change this!)" }
+      let(:next_result) { "San Francisco, California, United States" }
       let(:walk_result) do
-        <<-WALK
-1.3.6.1.2.1.1.1.0: Device description
-1.3.6.1.2.1.1.2.0: 1.3.6.1.4.1.3454
-1.3.6.1.2.1.1.3.0: Timeticks: (78171676) 9 days, 1:8:36.76
-1.3.6.1.2.1.1.4.0: The Owner
-1.3.6.1.2.1.1.5.0: DEVICE-192.168.1.1
-1.3.6.1.2.1.1.6.0: The Cloud
-1.3.6.1.2.1.1.7.0: 72
-1.3.6.1.2.1.1.8.0: Timeticks: (0) 0 days, 0:0:0.0
-        WALK
+        {
+          "1.3.6.1.2.1.1.1.0" =>  "Linux zeus 4.8.6.5-smp #2 SMP Sun Nov 13 14:58:11 CDT 2016 i686",
+          "1.3.6.1.2.1.1.2.0" =>  "1.3.6.1.4.1.8072.3.2.10",
+          "1.3.6.1.2.1.1.3.0" =>  /Timeticks: \(\d+\) \d+ days, \d+:\d+:\d+\.\d+/,
+          "1.3.6.1.2.1.1.4.0" =>  "SNMP Laboratories, info@snmplabs.com",
+          "1.3.6.1.2.1.1.5.0" =>  "zeus.snmplabs.com (you can change this!)",
+          "1.3.6.1.2.1.1.6.0" =>  "San Francisco, California, United States",
+          "1.3.6.1.2.1.1.7.0" =>  "72",
+          "1.3.6.1.2.1.1.8.0" =>  /Timeticks: \(\d+\) \d+ days, \d+:\d+:\d+\.\d+/
+        }
       end
       let(:set_oid_result) { 43 }
 
@@ -101,18 +101,18 @@ RSpec.describe NETSNMP::Client do
     let(:set_oid) { "sysUpTime.0" } # sysUpTimeInstance
     let(:walk_oid) { "1.3.6.1.2.1.1.9.1.3" }
     let(:get_result) { "tt" }
-    let(:next_result) { "KK12" }
+    let(:next_result) { "KK12 (edit /etc/snmp/snmpd.conf)" }
     let(:walk_result) do
-      <<-WALK
-1.3.6.1.2.1.1.9.1.3.1: The SNMP Management Architecture MIB.
-1.3.6.1.2.1.1.9.1.3.2: The MIB for Message Processing and Dispatching.
-1.3.6.1.2.1.1.9.1.3.3: The management information definitions for the SNMP User-based Security Model.
-1.3.6.1.2.1.1.9.1.3.4: The MIB module for SNMPv2 entities
-1.3.6.1.2.1.1.9.1.3.5: The MIB module for managing TCP implementations
-1.3.6.1.2.1.1.9.1.3.6: The MIB module for managing IP and ICMP implementations
-1.3.6.1.2.1.1.9.1.3.7: The MIB module for managing UDP implementations
-1.3.6.1.2.1.1.9.1.3.8: View-based Access Control Model for SNMP.
-      WALK
+      {
+        "1.3.6.1.2.1.1.9.1.3.1" => "The SNMP Management Architecture MIB.",
+        "1.3.6.1.2.1.1.9.1.3.2" => "The MIB for Message Processing and Dispatching.",
+        "1.3.6.1.2.1.1.9.1.3.3" => "The management information definitions for the SNMP User-based Security Model.",
+        "1.3.6.1.2.1.1.9.1.3.4" => "The MIB module for SNMPv2 entities",
+        "1.3.6.1.2.1.1.9.1.3.5" => "The MIB module for managing TCP implementations",
+        "1.3.6.1.2.1.1.9.1.3.6" => "The MIB module for managing IP and ICMP implementations",
+        "1.3.6.1.2.1.1.9.1.3.7" => "The MIB module for managing UDP implementations",
+        "1.3.6.1.2.1.1.9.1.3.8" => "View-based Access Control Model for SNMP."
+      }
     end
     let(:set_oid_result) { 43 }
     context "with a no auth no priv policy" do
@@ -157,6 +157,15 @@ RSpec.describe NETSNMP::Client do
           let(:protocol_options) { version_options.merge(user_options).merge(extra_options) }
         end
       end
+      context "speaking sha256" do
+        let(:user_options) do
+          { username: "authsha256", security_level: :auth_no_priv,
+            auth_password: "maplesyrup", auth_protocol: :sha256 }
+        end
+        it_behaves_like "an snmp client" do
+          let(:protocol_options) { version_options.merge(user_options).merge(extra_options) }
+        end
+      end
     end
     context "with an auth priv policy" do
       context "auth in md5, encrypting in des" do

data/spec/handlers/celluloid_spec.rb

@@ -17,18 +17,18 @@ RSpec.describe "with cellulloid", type: :celluloid do
   let(:set_oid) { "1.3.6.1.2.1.1.3.0" } # sysUpTimeInstance
   let(:walk_oid) { "1.3.6.1.2.1.1.9.1.3" }
   let(:get_result) { "tt" }
-  let(:next_result) { "KK12" }
+  let(:next_result) { "KK12 (edit /etc/snmp/snmpd.conf)" }
   let(:walk_result) do
-    <<-WALK
-1.3.6.1.2.1.1.9.1.3.1: The SNMP Management Architecture MIB.
-1.3.6.1.2.1.1.9.1.3.2: The MIB for Message Processing and Dispatching.
-1.3.6.1.2.1.1.9.1.3.3: The management information definitions for the SNMP User-based Security Model.
-1.3.6.1.2.1.1.9.1.3.4: The MIB module for SNMPv2 entities
-1.3.6.1.2.1.1.9.1.3.5: The MIB module for managing TCP implementations
-1.3.6.1.2.1.1.9.1.3.6: The MIB module for managing IP and ICMP implementations
-1.3.6.1.2.1.1.9.1.3.7: The MIB module for managing UDP implementations
-1.3.6.1.2.1.1.9.1.3.8: View-based Access Control Model for SNMP.
-    WALK
+    {
+      "1.3.6.1.2.1.1.9.1.3.1" => "The SNMP Management Architecture MIB.",
+      "1.3.6.1.2.1.1.9.1.3.2" => "The MIB for Message Processing and Dispatching.",
+      "1.3.6.1.2.1.1.9.1.3.3" => "The management information definitions for the SNMP User-based Security Model.",
+      "1.3.6.1.2.1.1.9.1.3.4" => "The MIB module for SNMPv2 entities",
+      "1.3.6.1.2.1.1.9.1.3.5" => "The MIB module for managing TCP implementations",
+      "1.3.6.1.2.1.1.9.1.3.6" => "The MIB module for managing IP and ICMP implementations",
+      "1.3.6.1.2.1.1.9.1.3.7" => "The MIB module for managing UDP implementations",
+      "1.3.6.1.2.1.1.9.1.3.8" => "View-based Access Control Model for SNMP."
+    }
   end
 
   before(:all) { Celluloid.boot }

data/spec/security_parameters_spec.rb

@@ -13,6 +13,13 @@ RSpec.describe NETSNMP::SecurityParameters do
       subject { described_class.new(security_level: :auth_priv, auth_protocol: :sha, username: "username", engine_id: engine_id, auth_password: "maplesyrup", priv_password: "maplesyrup") }
       it { expect(subject.send(:passkey, password).b).to eq("\x9f\xb5\xcc\x03\x81\x49\x7b\x37\x93\x52\x89\x39\xff\x78\x8d\x5d\x79\x14\x52\x11".b) }
     end
+    context "sha256" do
+      subject do
+        described_class.new(security_level: :auth_priv, auth_protocol: :sha256, username: "username", engine_id: engine_id, auth_password: "maplesyrup", priv_password: "maplesyrup")
+      end
+
+      it { expect(subject.send(:passkey, password).b).to eq("\xABQ\x01M\x1E\a\x7F`\x17\xDF+\x12\xBE\xE5\xF5\xAAr\x991w\xE9\xBBV\x9CM\xFFZL\xA0\xB4\xAF\xAC".b) }
+    end
   end
 
   describe "keys" do
@@ -34,11 +41,22 @@ RSpec.describe NETSNMP::SecurityParameters do
                           priv_password: password,
                           engine_id: engine_id)
     end
+    let(:sha256_sec) do
+      described_class.new(security_level: :auth_priv,
+                          auth_protocol: :sha256,
+                          priv_protocol: :des,
+                          username: "username",
+                          auth_password: password,
+                          priv_password: password,
+                          engine_id: engine_id)
+    end
     it do
       expect(md5_sec.send(:auth_key)).to eq("\x52\x6f\x5e\xed\x9f\xcc\xe2\x6f\x89\x64\xc2\x93\x07\x87\xd8\x2b".b)
       expect(md5_sec.send(:priv_key)).to eq("\x52\x6f\x5e\xed\x9f\xcc\xe2\x6f\x89\x64\xc2\x93\x07\x87\xd8\x2b".b)
       expect(sha_sec.send(:auth_key)).to eq("\x66\x95\xfe\xbc\x92\x88\xe3\x62\x82\x23\x5f\xc7\x15\x1f\x12\x84\x97\xb3\x8f\x3f".b)
       expect(sha_sec.send(:priv_key)).to eq("\x66\x95\xfe\xbc\x92\x88\xe3\x62\x82\x23\x5f\xc7\x15\x1f\x12\x84\x97\xb3\x8f\x3f".b)
+      expect(sha256_sec.send(:auth_key)).to eq("\x89\x82\xE0\xE5I\xE8f\xDB6\x1Akb]\x84\xCC\xCC\x11\x16-E>\xE8\xCE:dE\xC2\xD6wo\x0F\x8B".b)
+      expect(sha256_sec.send(:priv_key)).to eq("\x89\x82\xE0\xE5I\xE8f\xDB6\x1Akb]\x84\xCC\xCC\x11\x16-E>\xE8\xCE:dE\xC2\xD6wo\x0F\x8B".b)
     end
   end
 

data/spec/support/request_examples.rb

@@ -22,8 +22,8 @@ RSpec.shared_examples "an snmp client" do
       let(:value) { subject.get({ oid: get_oid }, oid: next_oid) }
       it "returns the values for both" do
         expect(value).to be_a(Array)
-        expect(value).to include(/#{get_result}/)
-        expect(value).to include(/#{next_result}/)
+        expect(value).to include(get_result)
+        expect(value).to include(next_result)
       end
     end
   end
@@ -40,8 +40,17 @@ RSpec.shared_examples "an snmp client" do
   describe "#walk" do
     let(:value) { subject.walk(oid: walk_oid) }
     it "fetches the varbinds for the next oid" do
-      values = value.map { |oid, val| "#{oid}: #{val}" }.join("\n") << "\n"
-      expect(values).to eq(walk_result)
+      value.each do |oid, val|
+        match = walk_result[oid]
+        case match
+        when String
+          expect(val.to_s).to eq(match)
+        when Regexp
+          expect(val.to_s).to match(match)
+        else
+          next
+        end
+      end
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: netsnmp
 version: !ruby/object:Gem::Version
-  version: 0.5.0
+  version: 0.6.0
 platform: ruby
 authors:
 - Tiago Cardoso
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2021-07-05 00:00:00.000000000 Z
+date: 2021-07-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: parslet