Commit Graph

204 Commits

Author SHA1 Message Date
Ed Maste
54e9e4e72d bsnmp: add asn1 message length validation
admbugs:	780
Submitted by:	Guido Vranken, bz
Reported by:	Guido Vranken
Security:	CVE-2019-5610
2019-08-06 16:09:06 +00:00
Andrey V. Elsukov
48e091f99d Follow the declared behaviour that specifies server string format in
bsnmpclient(3).

snmp_parse_server() function accepts string where some fields can be
omitted: [trans::][community@][server][:port]

"trans" field can be "udp", "udp6", "dgram" and "stream".
"community" can be empty string, if it is omitted, the default value
will be used. For read_community it is "public", for write_comminity
it is "private". "server" field can be hostname, IPv4 address or IPv6
address. IPv6 address should be specified in brackets "[]".
If port is omitted, the default value "snmp" will be used for "udp"
and "udp6" transports. So, now for bsnmpget(1) and bsnmwalk(1) it is
not required to specify all fields in argument of '-s' option. E.g.

  # bsnmpget -s 127.1 sysName.0
  # bsnmpget -s "udp::127.1" sysName.0
  # bsnmpget -s "udp::public@127.1" sysName.0
  # bsnmpget -s "udp::public@127.1:161" sysName.0
  # bsnmpget -s "udp::[::1]" sysName.0
  # bsnmpget -s "udp6::[::1]" sysName.0
  # bsnmpget -s "[fe80::1%lo0]" sysName.0

PR:		236664
Reported by:	olivier
MFC after:	1 month
2019-04-03 12:47:49 +00:00
Andrey V. Elsukov
8581fc9ad5 Create 64bit mibII counters for all interfaces.
PR:		157015
Obtained from:	Yandex LLC
MFC after:	1 month
2019-04-02 13:38:00 +00:00
Andrey V. Elsukov
04d1781439 Add IPv6 transport for bsnmp.
This patch adds a new table begemotSnmpdTransInetTable that uses the
InetAddressType textual convention and can be used to create listening
ports for IPv4, IPv6, zoned IPv6 and based on DNS names. It also supports
future extension beyond UDP by adding a protocol identifier to the table
index. In order to support this gensnmptree had to be modified.

Submitted by:   harti
MFC after:      1 month
Relnotes:       yes
Differential Revision:  https://reviews.freebsd.org/D16654
2019-04-02 12:50:01 +00:00
Andrey V. Elsukov
e95923a228 Correct a port number assignment.
PR:		236930
MFC after:	1 week
2019-04-01 12:14:45 +00:00
Gleb Smirnoff
3231251399 Timer interval is correctly counted in ticks (1/100 s) in
mibif_reset_hc_timer().  Multiplication by 10 is erroneous
and is probably a blind copy and paste from next function.

PR:		132993
Submitted by:	Vitezslav Novy <vnovy vnovy.net>
2019-01-09 05:53:59 +00:00
Jung-uk Kim
d66820f2c8 Make libbsnmp buildable. 2018-09-19 06:39:10 +00:00
Eugene Grosbein
1a498d2e68 bsnmpd(8): fix and optimize interface description processing
* correctly prepare a buffer to obtain interface description from a kernel and
  truncate long description instead of dropping it altogether and
  spamming logs;
* skip calling strlen() for each description and each SNMP request
  for MIB-II/ifXTable's ifAlias.
* teach bsnmpd to allocate memory dynamically for interface descriptions
  to decrease memory usage for common case and not to break
  if long description occurs;

PR:			217763
Reviewed by:		harti and others
MFC after:		1 week
Differential Revision:	https://reviews.freebsd.org/D16459
2018-08-18 10:58:44 +00:00
Hartmut Brandt
8e9b3e7071 Update bsnmp to version 1.13. This does not bring user-visible changes.
For developers gensnmptree can now generate functions for enums to convert
between enums and strings and to check the validity of a value.
The sources in FreeBSD are now in sync with the upstream which allows to
bring in IPv6 modifications.
2018-07-03 08:44:40 +00:00
Edward Tomasz Napierala
604f1c416c Don't put multiple names on a single .Nm line. This fixes apropos(1)
output, from this:

strnlen, strlen, strlen,(3) - find length of string                                                                                                                                                     │·······

... to this:

strlen, strnlen(3) - find length of string

PR:		223525
MFC after:	2 weeks
2018-04-17 09:05:46 +00:00
Brooks Davis
3a4fc8a8a1 Remove support for the Arcnet protocol.
While Arcnet has some continued deployment in industrial controls, the
lack of drivers for any of the PCI, USB, or PCIe NICs on the market
suggests such users aren't running FreeBSD.

Evidence in the PR database suggests that the cm(4) driver (our sole
Arcnet NIC) was broken in 5.0 and has not worked since.

PR:		182297
Reviewed by:	jhibbits, vangyzen
Relnotes:	yes
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D15057
2018-04-13 21:18:04 +00:00
Andrey V. Elsukov
7e03e18104 Rename "index" variable to "idx" since gcc complains that it shadows
index(3) function declaration.

Reported by:	lwhsu
MFC after:	2 weeks
2018-01-19 20:33:47 +00:00
Andrey V. Elsukov
f3afd27f5f Add to bsnmpd(1) ability to specify multiple community strings with
different access rights.

By default there are two community strings with index 1 and 2, one for
read-only access and second for read-write access:

  begemotSnmpdCommunityString.0.1 = $(read)
  begemotSnmpdCommunityString.0.2 = $(write)

Now it is possible to define additional community strings using different
indexes:

  begemotSnmpdCommunityString.0.3 = "SomeString1"
  begemotSnmpdCommunityPermission.0.3 = 1
  begemotSnmpdCommunityString.0.4 = "SomeString2"
  begemotSnmpdCommunityPermission.0.4 = 2
  begemotSnmpdCommunityString.0.5 = "SomeString3"
  begemotSnmpdCommunityString.0.6 = "SomeString4"

New attribute begemotSnmpdCommunityPermission can be used to specify access
rights: 1 means "read-only" access, 2 means "read-write" access. If
attribute is not specified for some index this means "read-only" rights.

Community strings must be unique, i.e. must not be the same for different
indexes.

Obtained from:		Yandex LLC
MFC after:		2 weeks
Sponsored by:		Yandex LLC
Differential Revision:	https://reviews.freebsd.org/D13785
2018-01-19 08:48:14 +00:00
Andrey V. Elsukov
49ba44e765 Fix format string warning with enabled DEBUGGING.
MFC after:	1 week
2017-12-04 09:17:28 +00:00
Gleb Smirnoff
cc65eb4e79 Hide struct inpcb, struct tcpcb from the userland.
This is a painful change, but it is needed.  On the one hand, we avoid
modifying them, and this slows down some ideas, on the other hand we still
eventually modify them and tools like netstat(1) never work on next version of
FreeBSD.  We maintain a ton of spares in them, and we already got some ifdef
hell at the end of tcpcb.

Details:
- Hide struct inpcb, struct tcpcb under _KERNEL || _WANT_FOO.
- Make struct xinpcb, struct xtcpcb pure API structures, not including
  kernel structures inpcb and tcpcb inside.  Export into these structures
  the fields from inpcb and tcpcb that are known to be used, and put there
  a ton of spare space.
- Make kernel and userland utilities compilable after these changes.
- Bump __FreeBSD_version.

Reviewed by:	rrs, gnn
Differential Revision:	D10018
2017-03-21 06:39:49 +00:00
Enji Cooper
295685c5c1 bsnmp: explicitly test the return value for open_client_{local,udp} in snmp_open(..)
open_client_* returns -1 on failure; 0 on success. Ensure that the return value is
0 -- otherwise exit snmp_open(..).

MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-20 17:26:13 +00:00
Enji Cooper
7583dc2785 bsnmp: don't leak snmp_client.fd in open_client_udp(..) on connect(2) failure
MFC after:	1 week
Sponsored by:	Dell EMC Isilon
2017-03-20 17:17:54 +00:00
Enji Cooper
f321675a98 bsnmpd: fix segfault when trans_insert_port(..) is called with multiple
out of order addresses

Move `port->transport` initialization before the TAILQ_FOREACH(..) loop
to ensure that the value is properly initialized before it's inserted
into the TAILQ.

MFC after:	1 week
PR:		217760
Submitted by:	eugen
Sponsored by:	Dell EMC Isilon
2017-03-13 18:01:01 +00:00
Gleb Smirnoff
1897a4f168 Fix regression from r310655, which broke operation of bsnmpd if it is bound
to a non-wildcard address.  As documented in ip(4), doing sendmsg(2) with
IP_SENDSRCADDR on a socket that is bound to non-wildcard address is
completely different to using this control message on a wildcard one.

A fix is to add a bool to mark whether we did setsockopt(IP_RECVDSTADDR)
on the socket, and use IP_SENDSRCADDR control message only if we did.

While here, garbage collect absolutely useless udp_recv() function that
establishes some structures on stack to never use them later.
2017-01-17 03:52:57 +00:00
Enji Cooper
818d3ff977 Add a REVISION section to track changes for the BEGEMOT-MIB MIB file
There haven't been any changes to the MIB definition, so the REVISION
remains static at the version it was imported at

MFC after:	1 week
2017-01-09 06:27:30 +00:00
Enji Cooper
0c72a43f3f Add a REVISION section to track changes for the FOKUS-MIB MIB file
There haven't been any changes to the MIB definition, so the REVISION
remains static at the version it was imported at

MFC after:	1 week
2017-01-09 06:24:28 +00:00
Enji Cooper
b55d259a14 Similar to r311750, check for the result from smiGetModule to avoid a segfault
when dereferencing a NULL pointer later on.

Choose to just check for the NULL pointer in the next for-loop for now to fix
the issue with a minimal amount of code churn

sys/queue.h use here would make more sense than using a static table

MFC after:	5 days
2017-01-09 06:13:27 +00:00
Enji Cooper
8406423362 Use calloc instead of malloc + memset(.., 0, ..)
MFC after:	5 days
2017-01-09 06:03:49 +00:00
Enji Cooper
c5f8d75113 Check result from smiGetFirstNode and smiGetNodeByOID
This avoids a segfault with malformed or unanticipated files,
like IPV6-TC.txt (a file containing just TEXTUAL-CONVENTIONS).

MFC after:	5 days
Found with:	gensnmpdef /usr/local/share/snmp/mibs/IPV6-TC.txt
2017-01-09 05:51:38 +00:00
Enji Cooper
fbd43e4c99 Add a REVISION section to track changes for the BEGEMOT-IP-MIB MIB file
There haven't been any changes to the MIB definition, so the REVISION
remains static at the version it was imported at

MFC after:	1 week
2017-01-09 03:21:21 +00:00
Enji Cooper
0ab7046959 Use nitems(mib) instead of hardcoding mib's length when calling sysctl(3)
MFC after:	3 days
2017-01-09 01:47:00 +00:00
Enji Cooper
08235f2408 Remove unnecessary __unused attribute attached to ctx in op_begemot_mibII(..)
MFC after:	3 days
2017-01-06 07:57:45 +00:00
Enji Cooper
60c2226f89 op_usm_users: don't deref uusers if it's NULL when SETting the value
Add an XXX comment to note that the conditional seems suspect given
how it's handled elsewhere in the SNMP_OP_SET case.

MFC after:	2 weeks
Reported by:	Coverity
CID:		1008573
2017-01-05 09:46:36 +00:00
Enji Cooper
3daec7ae72 snmp_table_fetch_async: don't leak work if snmp_pdu_send(..) fails
MFC after:	1 week
Reported by:	Coverity
CID:		1017276
2017-01-05 08:49:06 +00:00
Enji Cooper
994c8618ec op_usm_users: fix indentation in SNMP_OP_SET block
MFC after:	3 days
2017-01-05 08:27:23 +00:00
Enji Cooper
446bd8a476 Use calloc instead of malloc + memset(.., 0, ..)
MFC after:	3 days
2017-01-05 08:17:17 +00:00
Enji Cooper
70157df618 lsock_init_port: address issues with initializing sockaddr_un object
- Use strlcpy to ensure p->name doesn't overflow sa.sun_path [*].
- Use SUN_LEN(..) instead of spelling out calculation longhand (inspired
  by comment by jmallett).

Tested with:	dgram and stream support with both bsnmpwalk and snmpwalk

MFC after:	1 week
Reported by:	Coverity
CID:		1006825
2017-01-05 08:14:20 +00:00
Enji Cooper
10a0306a2e lm_load: fix string copying issues
- Ensure `section` doesn't overrun section by using strlcpy instead of
  strcpy [*].
- Use strdup instead of malloc + strcpy (this wasn't flagged by Coverity,
  but is an opportunistic change).

MFC after:	1 week
Reported by:	Coverity
CID:		1006826 [*]
2017-01-05 07:55:17 +00:00
Enji Cooper
ccd0cf8ffa snmp_mibII(3) requires net/if.h and net/if_mib.h
Document that requirement

MFC after:	1 week
2017-01-04 10:08:18 +00:00
Enji Cooper
2e590d595e Use calloc instead of malloc with buffers in snmp_{recv,send}_packet
This doesn't fix the issue noted in the PR, but at the very least it
cleans up the error so it looks a bit more sane, and in the event
that bsnmp did wander off into the weeds, the likelihood of it
crashing with more sensible output is greater, in my opinion

MFC counter set high so I have enough time to resolve the real
underlying bug in bsnmpwalk

MFC after:	1 month
PR:		215721
2017-01-04 07:53:01 +00:00
Enji Cooper
1a55af1fb9 Initialize msg.msg_flags to 0
This mutes a valid coverity warning about it being uninitialized
when passed in to sendmsg(2).

MFC after:	2 weeks
Reported by:	Coverity
CID:		1368202
2017-01-04 01:38:07 +00:00
Enji Cooper
84d0b89e96 Fix spelling errors; bump .Dd for the change
MFC after:	3 days
2017-01-01 05:23:01 +00:00
Enji Cooper
d1b4c796ac Bump .Dd for the spelling and .Nm updates
MFC after:	3 days
2017-01-01 05:16:24 +00:00
Enji Cooper
d075380571 Fix spelling errors
MFC after:	3 days
Reported by:	igor
2017-01-01 05:14:58 +00:00
Enji Cooper
ad52f0d10c bsnmpclient(3) also documents snmp_client_init, snmp_client_set_host,
and snmp_client_set_port. Add them to the NAME section

MFC after:	3 days
2017-01-01 05:13:54 +00:00
Enji Cooper
1cc49661ec snmp_discover_engine: fix up req/resp (PDU object) handling a bit
- Call snmp_pdu_free on req and resp when done with the objects
- Call snmp_pdu_free on req before calling snmp_pdu_create on it
  again

MFC after:	1 week
2016-12-31 23:20:57 +00:00
Enji Cooper
560c5ef9a2 Similar to r310954, set .len to 0 on malloc failure and to len only
on success

MFC after:	1 week
2016-12-31 12:37:53 +00:00
Enji Cooper
39ebb4e1e0 Initialize ret to SNMPD_INPUT_OK at the top of snmp_input_start(..) to
avoid returning an uninitialized value

There are some really complicated, snakey if-statements combined with
switch statements that could result in an invalid value being returned
as `ret`

MFC after:	1 week
Reported by:	Coverity
CID:		1006551
2016-12-31 12:30:14 +00:00
Enji Cooper
8e02b381d3 Use strlcpy when copying com to pdu->community to avoid potential
buffer overruns

MFC after:	1 week
Reported by:	Coverity
CID:		1006823, 1006824
2016-12-31 12:18:17 +00:00
Enji Cooper
a0e0e1ffa5 MIB-II: use strlcpy instead of strcpy when copying {descr,name}
This is of course to avoid buffer overruns

The remaining strcpy instance in the module needs to be audited for
correctness

MFC after:	1 week
Reported by:	Coverity
CID:		1006827, 1006828
2016-12-31 12:03:25 +00:00
Enji Cooper
02ff676c4d MIB-II: use strlcpy when copying interface names to .ifr_name
.ifra_name is assumed to be NUL terminated; using strlcpy(3)
ensures that it's indeed NUL terminated whereas strncpy does
not.

Tested and verified as follows with a combination of ifconfig,
snmpget, and snmpset:

  % ifconfig create lo1 127.0.0.2/8
  % SNMPARGS="-v 3 -n '' -u bsnmp -A bsnmptest -l authPriv -a sha -x des -X bsnmptest localhost"
  % snmpget $SNMPARGS IF-MIB::ifAdminStatus.4
  IF-MIB::ifAdminStatus.4 = INTEGER: up(1)
  % snmpset $SNMPARGS IF-MIB::ifAdminStatus.4 i 2
  IF-MIB::ifAdminStatus.4 = INTEGER: down(2)
  % snmpget $SNMPARGS IF-MIB::ifAdminStatus.4
  IF-MIB::ifAdminStatus.4 = INTEGER: down(2)
  % snmpset $SNMPARGS IF-MIB::ifAdminStatus.4 i 1
  IF-MIB::ifAdminStatus.4 = INTEGER: up(1)
  % snmpget $SNMPARGS IF-MIB::ifAdminStatus.4
  IF-MIB::ifAdminStatus.4 = INTEGER: up(1)

MFC after:	2 weeks
Reported by:	Coverity
CID:		1009652-1009656, 1349850
2016-12-31 11:50:36 +00:00
Enji Cooper
1e5211d238 Unbreak the build by passing the string to strdup, not its length
MFC after:	1 week
X-MFC with:	r310931
Pointyhat to:	ngie
2016-12-31 11:24:12 +00:00
Enji Cooper
bfb81e6524 Use strdup in snmp_parse_server(..) when possible instead of malloc+strcpy
This simplifies the code and mutes a Coverity warning about sc->cport being
improperly allocated

Reported by:	Coverity
CID:		1018247
MFC after:	1 week
2016-12-31 11:13:00 +00:00
Enji Cooper
8373993535 Guard against use-after-free after calling mibif_free(..)
Set variables to NULL after calling free.

Also, remove unnecessary if (x != NULL) checks before calling free(x)

MFC after:	1 week
2016-12-30 23:44:39 +00:00
Enji Cooper
2fd30e016e Fix whitespace in a comment and fixing a spelling error in a comment
MFC after:	3 days
2016-12-30 21:41:01 +00:00