buglwIP - A Lightweight TCP/IP stack - Bugs: bug #52911, SNMPv3 time window check is not...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #52911: SNMPv3 time window check is not the same as RFC3414

Submitted by:  xuguizhou <xuguizhou>
Submitted on:  Tue 16 Jan 2018 12:12:20 PM UTC  
 
Category:  None Severity:  3 - Normal
Item Group:  Change Request Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.0.3

Tue 16 Jan 2018 12:30:53 PM UTC, comment #1:

Fixed, thanks for reporting!

Dirk Ziegelmeier <dziegel>
Project Administrator
Tue 16 Jan 2018 12:12:20 PM UTC, original submission:

In RFC3414 PAGE 27
7) If the securityLevel indicates an authenticated message, then the
local values of snmpEngineBoots, snmpEngineTime and
latestReceivedEngineTime corresponding to the value of the
msgAuthoritativeEngineID field are extracted from the Local
Configuration Datastore.

a) If the extracted value of msgAuthoritativeEngineID is the same
as the value of snmpEngineID of the processing SNMP engine
(meaning this is the authoritative SNMP engine), then if any
of the following conditions is true, then the message is
considered to be outside of the Time Window:

- the local value of snmpEngineBoots is 2147483647;

- the value of the msgAuthoritativeEngineBoots field differs
from the local value of snmpEngineBoots; or,

- the value of the msgAuthoritativeEngineTime field differs
from the local notion of snmpEngineTime by more than +/- 150
seconds.

The time window should be +/- 150 seconds by local notion of snmpEngineTime.
So the msg_authoritative_engine_time check should be as follow:
snmp_msg.c
1050: if (request->msg_authoritative_engine_time > (time + 150))

Or see attach picture.

xuguizhou <xuguizhou>

 

Attached Files
file #42924:  1516104422.jpg added by xuguizhou (22KiB - image/jpeg)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by xuguizhou (Submitted the item)
  • -email is unavailable- added by xuguizhou
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-01-16 dziegel StatusNone => Fixed
        Open/ClosedOpen => Closed
    2018-01-16 xuguizhou Attached File- => Added 1516104422.jpg, #42924
        Carbon-Copy- => Added -email is unavailable-

    Back to the top


    Powered by Savane 3.4