buglwIP - A Lightweight TCP/IP stack - Bugs: bug #52911, SNMPv3 time window check is not...


You are not allowed to post comments on this tracker with your current authentication level.

bug #52911: SNMPv3 time window check is not the same as RFC3414

Submitted by:  xuguizhou <xuguizhou>
Submitted on:  Tue 16 Jan 2018 12:12:20 PM UTC  
Category:  None Severity:  3 - Normal
Item Group:  Change Request Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.0.3

Tue 16 Jan 2018 12:30:53 PM UTC, comment #1: 

Fixed, thanks for reporting!

Dirk Ziegelmeier <dziegel>
Project Administrator
Tue 16 Jan 2018 12:12:20 PM UTC, original submission:  

In RFC3414 PAGE 27
   7)  If the securityLevel indicates an authenticated message, then the
       local values of snmpEngineBoots, snmpEngineTime and
       latestReceivedEngineTime corresponding to the value of the
       msgAuthoritativeEngineID field are extracted from the Local
       Configuration Datastore.

       a) If the extracted value of msgAuthoritativeEngineID is the same
          as the value of snmpEngineID of the processing SNMP engine
          (meaning this is the authoritative SNMP engine), then if any
          of the following conditions is true, then the message is
          considered to be outside of the Time Window:

          - the local value of snmpEngineBoots is 2147483647;

          - the value of the msgAuthoritativeEngineBoots field differs
            from the local value of snmpEngineBoots; or,

          - the value of the msgAuthoritativeEngineTime field differs
            from the local notion of snmpEngineTime by more than +/- 150

The time window should be +/- 150 seconds by local notion of snmpEngineTime.
So the msg_authoritative_engine_time check should be as follow:
1050: if (request->msg_authoritative_engine_time > (time + 150))

Or see attach picture.

xuguizhou <xuguizhou>


Attached Files
file #42924:  1516104422.jpg added by xuguizhou (22KiB - image/jpeg)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by xuguizhou (Submitted the item)
  • -email is unavailable- added by xuguizhou

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-01-16 dziegel StatusNone => Fixed
        Open/ClosedOpen => Closed
    2018-01-16 xuguizhou Attached File- => Added 1516104422.jpg, #42924
        Carbon-Copy- => Added jake1121@163.com

    Back to the top

    Powered by Savane 3.5