net-snmp 3.28.0 → 3.29.0

package/README.md

@@ -157,6 +157,18 @@ constants are defined in this object:
  * `NotWritable`
  * `InconsistentName`
 
+Only the first six of these - `NoError` through `GeneralError` - are defined by
+SNMPv1.  The agent produces error statuses using the full SNMPv2 set regardless
+of the version of the request, then translates them when responding to an
+SNMPv1 request, using the mapping given in RFC 2089 section 2.1 (repeated in
+RFC 3584 section 4.4).  So an SNMPv1 manager sees `NoSuchName` where an SNMPv2c
+or SNMPv3 manager would see `NoAccess`, `NoCreation`, `NotWritable`,
+`InconsistentName` or `AuthorizationError`; `BadValue` in place of `WrongType`,
+`WrongLength`, `WrongEncoding`, `WrongValue` or `InconsistentValue`; and
+`GeneralError` in place of `ResourceUnavailable`, `CommitFailed` or
+`UndoFailed`.  `ReadOnly` is listed for completeness, since SNMPv1 defines it,
+but no conformant agent generates it - see RFC 1908 section 3.1.2.
+
 ## snmp.ObjectType
 
 This object contains constants used to specify syntax for varbind objects,
@@ -2171,7 +2183,12 @@ level provided by this provider. The allowable values are the
 numeric values from the MaxAccess export. If a `maxAccess` value is
 specified, a `get` request to the agent will return a `noAccess`
 error if `maxAccess` is not at least "read-only" (2). `maxAccess`
-must be at least "read-write" (3) for a `set` request to succeed.
+must be at least "read-write" (3) for a `set` request to succeed;
+a `set` below that level returns a `notWritable` error, which is the
+code RFC 3416 section 4.2.5 reserves for a variable that exists but
+cannot be modified whatever value is supplied. Note that `noAccess`
+there means something narrower - a variable denied because it is not
+in the requester's MIB view.
  * `defVal` *(optional)* - the default value to assign for scalar
 objects automatically created, when `maxAccess` is set to
 "read-create" (4). Note that table columns can specify such `defVal`
@@ -3779,6 +3796,18 @@ Example programs are included under the module's `example` directory.
 
  * Replace `.npmignore` with a `files` allowlist in `package.json`, so the published package ships only the module, its libraries, examples and reference files
 
+# Version 3.28.1 - 12/09/2026
+
+ * Reject table instance OIDs whose row index encoding is malformed, instead of silently decoding them to a different row - a SetRequest naming a non-implied `OctetString` or OID index that claimed a different length than it supplied, or that carried unexpected trailing components, would create a row at the decoded index while answering `NoSuchInstance` for the OID that was requested
+
+ * Decode index parts declared with a fixed `length` without consuming a leading length component, matching the way they are encoded - an index value of `AB` in such a column previously read back as `B`
+
+# Version 3.29.0 - 13/09/2026
+
+ * Answer a SetRequest for an object whose `maxAccess` is below "read-write" with a `notWritable` error instead of `noAccess`, for both the agent and the AgentX subagent - RFC 3416 section 4.2.5 reserves `noAccess` for a variable denied because it is not in the requester's MIB view, and gives `notWritable` for one that exists but cannot be modified whatever value is supplied
+
+ * Translate error statuses to their SNMPv1 equivalents when the agent responds to a version 1 request, using the mapping in RFC 2089 section 2.1 - the agent produces statuses from the SNMPv2 set whatever version it is answering, and previously sent codes such as `noAccess` and `notWritable` to SNMPv1 managers unchanged, even though SNMPv1 defines no such values. A SetRequest for a read-only object now returns `noSuchName` to an SNMPv1 manager
+
 # License
 
 Copyright (c) 2020 Mark Abrahams <mark@abrahams.co.nz>

package/index.js

@@ -71,6 +71,27 @@ var ErrorStatus = {
 
 _expandConstantObject (ErrorStatus);
 
+// SNMPv2 introduced error-status values that carry no meaning for an SNMPv1
+// manager, whose ErrorStatus ASN.1 stops at genErr(5). A multi-lingual agent
+// must therefore translate before responding to a version 1 request. Table
+// from RFC 2089 section 2.1, repeated in RFC 3584 section 4.4. Values absent
+// from this table - noError, tooBig, noSuchName, badValue, readOnly and
+// genErr - are already valid in SNMPv1 and pass through untouched.
+var ErrorStatusV2ToV1 = {};
+ErrorStatusV2ToV1[ErrorStatus.NoAccess] = ErrorStatus.NoSuchName;
+ErrorStatusV2ToV1[ErrorStatus.WrongType] = ErrorStatus.BadValue;
+ErrorStatusV2ToV1[ErrorStatus.WrongLength] = ErrorStatus.BadValue;
+ErrorStatusV2ToV1[ErrorStatus.WrongEncoding] = ErrorStatus.BadValue;
+ErrorStatusV2ToV1[ErrorStatus.WrongValue] = ErrorStatus.BadValue;
+ErrorStatusV2ToV1[ErrorStatus.NoCreation] = ErrorStatus.NoSuchName;
+ErrorStatusV2ToV1[ErrorStatus.InconsistentValue] = ErrorStatus.BadValue;
+ErrorStatusV2ToV1[ErrorStatus.ResourceUnavailable] = ErrorStatus.GeneralError;
+ErrorStatusV2ToV1[ErrorStatus.CommitFailed] = ErrorStatus.GeneralError;
+ErrorStatusV2ToV1[ErrorStatus.UndoFailed] = ErrorStatus.GeneralError;
+ErrorStatusV2ToV1[ErrorStatus.AuthorizationError] = ErrorStatus.NoSuchName;
+ErrorStatusV2ToV1[ErrorStatus.NotWritable] = ErrorStatus.NoSuchName;
+ErrorStatusV2ToV1[ErrorStatus.InconsistentName] = ErrorStatus.NoSuchName;
+
 var ObjectType = {
 	1: "Boolean",
 	2: "Integer",
@@ -4707,41 +4728,73 @@ Mib.prototype.getTableRowInstanceFromRow = function (provider, row) {
 	return rowIndex;
 };
 
+// Splices exactly `length` components off the front of an index address,
+// rejecting encodings that claim more components than they supply.
+Mib.spliceIndexValue = function (addressRemaining, length, oid) {
+	var value = addressRemaining.splice (0, length);
+	if ( value.length !== length ) {
+		throw new RangeError ("Index encoding in \"" + oid + "\" claims " + length +
+			" components but supplies " + value.length);
+	}
+	return value;
+};
+
+// Determines how many OID components an index part occupies, consuming a
+// leading length component for variable-length parts that are neither
+// implied nor of a fixed length.
+Mib.getIndexPartLength = function (indexPart, addressRemaining, oid) {
+	var length;
+	if ( indexPart.implied ) {
+		return addressRemaining.length;
+	}
+	if ( indexPart.length ) {
+		return indexPart.length;
+	}
+	length = Number (addressRemaining.shift ());
+	if ( ! Number.isInteger (length) || length < 0 ) {
+		throw new RangeError ("Index encoding in \"" + oid + "\" has a missing or invalid length component");
+	}
+	return length;
+};
+
 Mib.getRowIndexFromOid = function (oid, index) {
-	var addressRemaining = oid.split (".");
+	var addressRemaining = oid === "" ? [] : oid.split (".");
 	var length = 0;
 	var values = [];
 	var value;
 	for ( var indexPart of index ) {
 		switch ( indexPart.type ) {
 			case ObjectType.OID:
-				if ( indexPart.implied ) {
-					length = addressRemaining.length;
-				} else {
-					length = addressRemaining.shift ();
-				}
-				value = addressRemaining.splice (0, length);
+				length = Mib.getIndexPartLength (indexPart, addressRemaining, oid);
+				value = Mib.spliceIndexValue (addressRemaining, length, oid);
 				values.push (value.join ("."));
 				break;
 			case ObjectType.IpAddress:
 				length = 4;
-				value = addressRemaining.splice (0, length);
+				value = Mib.spliceIndexValue (addressRemaining, length, oid);
 				values.push (value.join ("."));
 				break;
 			case ObjectType.OctetString:
-				if ( indexPart.implied ) {
-					length = addressRemaining.length;
-				} else {
-					length = addressRemaining.shift ();
-				}
-				value = addressRemaining.splice (0, length);
+				length = Mib.getIndexPartLength (indexPart, addressRemaining, oid);
+				value = Mib.spliceIndexValue (addressRemaining, length, oid);
 				value = value.map (c => String.fromCharCode(c)).join ("");
 				values.push (value);
 				break;
 			default:
-				values.push (parseInt (addressRemaining.shift ()) );
+				if ( addressRemaining.length === 0 ) {
+					throw new RangeError ("Index encoding in \"" + oid + "\" is missing a component");
+				}
+				value = parseInt (addressRemaining.shift ());
+				if ( Number.isNaN (value) ) {
+					throw new RangeError ("Index encoding in \"" + oid + "\" has a non-numeric component");
+				}
+				values.push (value);
 		}
 	}
+	if ( addressRemaining.length > 0 ) {
+		throw new RangeError ("Index encoding in \"" + oid + "\" has " + addressRemaining.length +
+			" unexpected trailing component(s)");
+	}
 	return values;
 };
 
@@ -5297,7 +5350,15 @@ Agent.prototype.tryCreateInstance = function (varbind, requestType) {
 			subOid = Mib.getSubOidFromBaseOid (oid, provider.oid);
 			subAddr = subOid.split(".");
 			column = parseInt(subAddr.shift(), 10);
-			row = Mib.getRowIndexFromOid(subAddr.join("."), provider.tableIndex);
+			try {
+				row = Mib.getRowIndexFromOid(subAddr.join("."), provider.tableIndex);
+			} catch (error) {
+				// The OID is not a valid index encoding for this table, so it names no
+				// row and there is nothing to create. Leave the varbind to be answered
+				// as NoSuchInstance.
+				debug (error);
+				return undefined;
+			}
 			rowStatusColumn = provider.tableColumns.reduce( (acc, current) => current.rowStatus ? current.number : acc, null );
 
 			if ( requestType === PduType.SetRequest &&
@@ -5468,14 +5529,19 @@ Agent.prototype.request = function (socket, requestMessage, rinfo) {
 					});
 				};
 			} else if ( ! this.isAllowed(requestPdu.type, providerNode.provider, instanceNode ) ) {
-				// requested access not allowed (by MAX-ACCESS)
+				// Requested access not allowed (by MAX-ACCESS). RFC 3416 section
+				// 4.2.5 reserves noAccess for a variable denied because it is not
+				// in the appropriate MIB view (rule 1); a variable that exists but
+				// can not be modified no matter what value is supplied is
+				// notWritable (rule 2). MAX-ACCESS below read-write is the latter.
+				const accessErrorStatus = isSetRequest ? ErrorStatus.NotWritable : ErrorStatus.NoAccess;
 				mibRequests[i] = new MibRequest ({
 					operation: requestPdu.type,
 					oid: requestPdu.varbinds[i].oid
 				});
 				mibRequests[i].handler = function getRanaHandler (mibRequestForRana) {
 					mibRequestForRana.done ({
-						errorStatus: ErrorStatus.NoAccess,
+						errorStatus: accessErrorStatus,
 						type: ObjectType.Null,
 						value: null
 					});
@@ -5880,6 +5946,16 @@ Agent.prototype.setSingleVarbind = function (responsePdu, index, responseVarbind
 };
 
 Agent.prototype.sendResponse = function (socket, rinfo, requestMessage, responsePdu) {
+	// The agent is multi-lingual: it answers each request in the version that
+	// request arrived with. Error statuses are produced internally using the
+	// SNMPv2 set, so a response to a version 1 request must be translated down
+	// to something an SNMPv1 manager understands - RFC 2089 section 2.1.
+	if ( requestMessage.version == Version1 ) {
+		const version1ErrorStatus = ErrorStatusV2ToV1[responsePdu.errorStatus];
+		if ( version1ErrorStatus !== undefined ) {
+			responsePdu.errorStatus = version1ErrorStatus;
+		}
+	}
 	var responseMessage = requestMessage.createResponseForRequest (responsePdu);
 	this.listener.send (responseMessage, rinfo, socket);
 	this.callback (null, Listener.formatCallbackData (responseMessage.pdu, rinfo) );
@@ -6709,8 +6785,11 @@ Subagent.prototype.request = function (pdu, requestVarbinds) {
 				});
 				mibRequests[i].handler = providerNode.provider.handler;
 				if ( ! me.isAllowed(pdu.pduType, mibRequests[i].providerNode?.provider, mibRequests[i].instanceNode) ) {
+					// A set below read-write MAX-ACCESS is notWritable, not
+					// noAccess - RFC 3416 section 4.2.5 rule 2, and RFC 2741
+					// section 7.2.1.4 for the AgentX TestSet phase.
 					mibRequests[i].error = {
-						errorStatus: ErrorStatus.NoAccess,
+						errorStatus: isSetRequest ? ErrorStatus.NotWritable : ErrorStatus.NoAccess,
 						errorIndex: i + 1,
 						type: ObjectType.Null,
 						value: null

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "net-snmp",
-  "version": "3.28.0",
+  "version": "3.29.0",
   "description": "JavaScript implementation of the Simple Network Management Protocol (SNMP)",
   "author": "Mark Abrahams <mark@abrahams.co.nz>",
   "license": "MIT",