buglwIP - A Lightweight TCP/IP stack - Bugs: bug #52911, SNMPv3 time window check is not...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #52911: SNMPv3 time window check is not the same as RFC3414

Submitter:  xuguizhou <xuguizhou>
Submitted:  Tue 16 Jan 2018 12:12:20 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  Change Request Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Planned Release:  None
lwIP version:  2.0.3

Tue 16 Jan 2018 12:30:53 PM UTC, comment #1: 

Fixed, thanks for reporting!

Dirk Ziegelmeier <dziegel>
Group administrator
Tue 16 Jan 2018 12:12:20 PM UTC, original submission:  

In RFC3414 PAGE 27
   7)  If the securityLevel indicates an authenticated message, then the
       local values of snmpEngineBoots, snmpEngineTime and
       latestReceivedEngineTime corresponding to the value of the
       msgAuthoritativeEngineID field are extracted from the Local
       Configuration Datastore.

       a) If the extracted value of msgAuthoritativeEngineID is the same
          as the value of snmpEngineID of the processing SNMP engine
          (meaning this is the authoritative SNMP engine), then if any
          of the following conditions is true, then the message is
          considered to be outside of the Time Window:

          - the local value of snmpEngineBoots is 2147483647;

          - the value of the msgAuthoritativeEngineBoots field differs
            from the local value of snmpEngineBoots; or,

          - the value of the msgAuthoritativeEngineTime field differs
            from the local notion of snmpEngineTime by more than +/- 150
            seconds.

The time window should be +/- 150 seconds by local notion of snmpEngineTime.
So the msg_authoritative_engine_time check should be as follow:
snmp_msg.c
1050: if (request->msg_authoritative_engine_time > (time + 150))

Or see attach picture.


xuguizhou <xuguizhou>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #42924:  1516104422.jpg added by xuguizhou (22KiB - image/jpeg)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dziegel (Posted a comment)
  • -email is unavailable- added by xuguizhou (Submitted the item)
  • -email is unavailable- added by xuguizhou
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2018-01-16 dziegel StatusNone Fixed
        Open/ClosedOpen Closed
    2018-01-16 xuguizhou Attached File- Added 1516104422.jpg, #42924
        Carbon-Copy- Added -email is unavailable-

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code