Bug 710667

Summary: Net-SNMP python bindings core dump with SNMPv3
Product: Red Hat Enterprise Linux 6 Reporter: Erinn Looney-Triggs <erinn.looneytriggs>
Component: net-snmpAssignee: Jan Safranek <jsafrane>
Status: CLOSED ERRATA QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: medium Docs Contact:
Priority: medium    
Version: 6.1CC: ksrot, rvokal, spoyarek
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
The netsnmp python module did not properly initialize SNMP session with SNMPv3 authentication and crashed. With this update, the SNMP session with SNMPv3 authentication is properly initialized and can be used in python modules. (BZ#710667).
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-12-06 17:12:05 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Erinn Looney-Triggs 2011-06-03 23:55:54 UTC
Description of problem:
Works with SNMPv2c but not SNMPv3

Version 2:
erinn@aug ~ $ python
Python 2.6.6 (r266:84292, Apr 11 2011, 15:50:32) 
[GCC 4.4.4 20100726 (Red Hat 4.4.4-13)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import netsnmp
>>> f = netsnmp.Session(DestHost='localhost', Version=2, Community='public')
>>> vars = netsnmp.VarList(netsnmp.Varbind('sysDescr', '0'))
>>> f.get(vars)
('Linux aug.abaqis.com 2.6.32-131.2.1.el6.x86_64 #1 SMP Wed May 18 07:07:37 EDT 2011 x86_64',)

Version 3:
Python 2.6.6 (r266:84292, Apr 11 2011, 15:50:32) 
[GCC 4.4.4 20100726 (Red Hat 4.4.4-13)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import netsnmp
>>> f = netsnmp.Session(DestHost='localhost', Version=3, SecLevel='authPriv', AuthProto='SHA', AuthPass='foo', PrivProto='AES', PrivPass='foo', SecName='snmpuser')
>>> vars = netsnmp.VarList(netsnmp.Varbind('sysDescr', '0'))
>>> f.get(vars)
Segmentation fault (core dumped)


Version-Release number of selected component (if applicable):
net-snmp-libs-5.5-31.el6.x86_64
net-snmp-python-5.5-31.el6.x86_64
net-snmp-5.5-31.el6.x86_64
net-snmp-devel-5.5-31.el6.x86_64
net-snmp-utils-5.5-31.el6.x86_64


How reproducible:
As show above

  
Actual results:
Core dump

Expected results:
It to work

Additional info:
Because it is a core dump most likely the issue lies in /usr/lib64/python2.6/site-packages/netsnmp/client_intf.so

This issue is fixed in Fedora 15, perhaps a rebase is in order?

Comment 2 Jan Safranek 2011-06-07 11:14:21 UTC
It generates following stack trace:
#0  snmp_sess_synch_response (sessp=0x0, pdu=0x25f0d50, response=0x7fff42c01618) at snmp_client.c:1093
#1  0x00007fba6fc26e99 in __send_sync_pdu (ss=0x0, pdu=0x25f0d50, response=0x7fff42c01618, retry_nosuch=0, err_str=0x7fff42c01640 "", err_num=0x7fff42c01630, err_ind=0x7fff42c01634)
    at netsnmp/client_intf.c:1013
#2  0x00007fba6fc28ce3 in netsnmp_get (self=<value optimized out>, args=<value optimized out>) at netsnmp/client_intf.c:1469
#3  0x00007fba769d5ba4 in call_function (f=<value optimized out>, throwflag=<value optimized out>) at Python/ceval.c:3794
#4  PyEval_EvalFrameEx (f=<value optimized out>, throwflag=<value optimized out>) at Python/ceval.c:2453
#5  0x00007fba769d6d4f in fast_function (f=<value optimized out>, throwflag=<value optimized out>) at Python/ceval.c:3880
#6  call_function (f=<value optimized out>, throwflag=<value optimized out>) at Python/ceval.c:3815
#7  PyEval_EvalFrameEx (f=<value optimized out>, throwflag=<value optimized out>) at Python/ceval.c:2453
#8  0x00007fba769d781c in PyEval_EvalCodeEx (co=0x7fba76de1738, globals=<value optimized out>, locals=<value optimized out>, args=<value optimized out>, argcount=0, kws=0x0, kwcount=0, defs=0x0, 
    defcount=0, closure=0x0) at Python/ceval.c:3044
#9  0x00007fba769d78f2 in PyEval_EvalCode (co=<value optimized out>, globals=<value optimized out>, locals=<value optimized out>) at Python/ceval.c:545
#10 0x00007fba769f296c in run_mod (mod=<value optimized out>, filename=<value optimized out>, globals=
    {'vars': <VarList(varbinds=[<Varbind(iid='0', tag='sysDescr', type=None, val=None) at remote 0x7fba76df9290>]) at remote 0x7fba76d9b3d0>, 'f': <Session(Timeout=1000000, PrivProto='AES', SecLevel='authPriv', sess_ptr=0, Version=3, ErrorInd=0, SecName='snmpuser', BestGuess=0, UseLongNames=0, LocalPort=0, ErrorStr='', AuthPass='foo', ErrorNum=0, ContextEngineId='', SecEngineId='', UseSprintValue=0, UseNumeric=0, Retries=3, AuthProto='SHA', RemotePort=161, DestHost='localhost', Context='', Engineboots=0, PrivPass='foo', RetryNoSuch=0, Community='public', UseEnums=0, Enginetime=0) at remote 0x7fba76d9b390>, '__builtins__': <module at remote 0x7fba76e96868>, 'netsnmp': <module at remote 0x7fba76df6c90>, '__file__': 'test.py', '__package__': None, 'r': ('Linux rhel6 2.6.32-125.el6.x86_64 #1 SMP Mon Mar 21 10:06:08 EDT 2011 x86_64',), '__name__': '__main__', '__doc__': None}, locals=
    {'vars': <VarList(varbinds=[<Varbind(iid='0', tag='sysDescr', type=None, val=None) at remote 0x7fba76df9290>]) at remote 0x7fba76d9b3d0>, 'f': <Session(Timeout=1000000, PrivProto='AES', SecLevel='authPriv', sess_ptr=0, Version=3, ErrorInd=0, SecName='snmpuser', BestGuess=0, UseLongNames=0, LocalPort=0, ErrorStr='', AuthPass='foo', ErrorNum=0, ContextEngineId='', SecEngineId='', UseSprintValue=0, UseNumeric=0, Retries=3, AuthProto='SHA', RemotePort=161, DestHost='localhost', Context='', Engineboots=0, PrivPass='foo', RetryNoSuch=0, Community='public', UseEnums=0, Enginetime=0) at remote 0x7fba76d9b390>, '__builtins__': <module at remote 0x7fba76e96868>, 'netsnmp': <module at remote 0x7fba76df6c90>, '__file__': 'test.py', '__package__': None, 'r': ('Linux rhel6 2.6.32-125.el6.x86_64 #1 SMP Mon Mar 21 10:06:08 EDT 2011 x86_64',), '__name__': '__main__', '__doc__': None}, flags=<value optimized out>, arena=<value optimized out>) at Python/pythonrun.c:1351
#11 0x00007fba769f2a40 in PyRun_FileExFlags (fp=0x25b5d60, filename=0x7fff42c048df "test.py", start=<value optimized out>, globals=
    {'vars': <VarList(varbinds=[<Varbind(iid='0', tag='sysDescr', type=None, val=None) at remote 0x7fba76df9290>]) at remote 0x7fba76d9b3d0>, 'f': <Session(Timeout=1000000, PrivProto='AES', SecLevel='authPriv', sess_ptr=0, Version=3, ErrorInd=0, SecName='snmpuser', BestGuess=0, UseLongNames=0, LocalPort=0, ErrorStr='', AuthPass='foo', ErrorNum=0, ContextEngineId='', SecEngineId='', UseSprintValue=0, UseNumeric=0, Retries=3, AuthProto='SHA', RemotePort=161, DestHost='localhost', Context='', Engineboots=0, PrivPass='foo', RetryNoSuch=0, Community='public', UseEnums=0, Enginetime=0) at remote 0x7fba76d9b390>, '__builtins__': <module at remote 0x7fba76e96868>, 'netsnmp': <module at remote 0x7fba76df6c90>, '__file__': 'test.py', '__package__': None, 'r': ('Linux rhel6 2.6.32-125.el6.x86_64 #1 SMP Mon Mar 21 10:06:08 EDT 2011 x86_64',), '__name__': '__main__', '__doc__': None}, locals=
    {'vars': <VarList(varbinds=[<Varbind(iid='0', tag='sysDescr', type=None, val=None) at remote 0x7fba76df9290>]) at remote 0x7fba76d9b3d0>, 'f': <Session(Timeout=1000000, PrivProto='AES', SecLevel='authPriv', sess_ptr=0, Version=3, ErrorInd=0, SecName='snmpuser', BestGuess=0, UseLongNames=0, LocalPort=0, ErrorStr='', AuthPass='foo', ErrorNum=0, ContextEngineId='', SecEngineId='', UseSprintValue=0, UseNumeric=0, Retries=3, AuthProto='SHA', RemotePort=161, DestHost='localhost', Context='', Engineboots=0, PrivPass='foo', RetryNoSuch=0, Community='public', UseEnums=0, Enginetime=0) at remote 0x7fba76d9b390>, '__builtins__': <module at remote 0x7fba76e96868>, 'netsnmp': <module at remote 0x7fba76df6c90>, '__file__': 'test.py', '__package__': None, 'r': ('Linux rhel6 2.6.32-125.el6.x86_64 #1 SMP Mon Mar 21 10:06:08 EDT 2011 x86_64',), '__name__': '__main__', '__doc__': None}, closeit=1, flags=0x7fff42c03c60) at Python/pythonrun.c:1337
#12 0x00007fba769f3f2c in PyRun_SimpleFileExFlags (fp=0x25b5d60, filename=0x7fff42c048df "test.py", closeit=1, flags=0x7fff42c03c60) at Python/pythonrun.c:941
#13 0x00007fba76a005af in Py_Main (argc=<value optimized out>, argv=<value optimized out>) at Modules/main.c:577

Comment 5 Jan Safranek 2011-08-11 11:53:19 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
/* intentionally skipped from errata description */

Comment 6 Jan Safranek 2011-08-11 11:57:42 UTC
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1 +1 @@
-/* intentionally skipped from errata description */+The snmp python module did not properly initialize SNMP session with SNMPv3 authentication and crashed. With this update, the SNMP session with SNMPv3 authentication is properly initialized and can be used in python modules. (BZ#710667).

Comment 7 Jan Safranek 2011-08-11 11:58:38 UTC
    Technical note updated. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    Diffed Contents:
@@ -1 +1 @@
-The snmp python module did not properly initialize SNMP session with SNMPv3 authentication and crashed. With this update, the SNMP session with SNMPv3 authentication is properly initialized and can be used in python modules. (BZ#710667).+The netsnmp python module did not properly initialize SNMP session with SNMPv3 authentication and crashed. With this update, the SNMP session with SNMPv3 authentication is properly initialized and can be used in python modules. (BZ#710667).

Comment 9 Karel Srot 2011-08-22 15:03:46 UTC
I still see the segfault on ppc64 and s390x platforms with net-snmp-5.5-34.el6. Unfortunately I am unable to get a backtrace.

Comment 10 Jan Safranek 2011-08-23 14:44:01 UTC
Generated stack trace is different:

#0  snmp_sess_session (sessp=0x3e914bb0) at snmp_api.c:7465
#1  0x00000fff7bcf6090 in snmp_sess_synch_response (sessp=<value optimized out>, pdu=<value optimized out>, response=<value optimized out>) at snmp_client.c:1090
#2  0x00000fff7be047e0 in __send_sync_pdu (ss=0x3e914bb0, pdu=0x1003e85ee30, response=0xfffd8cc2300, retry_nosuch=<value optimized out>, err_str=0xfffd8cc2328 "", err_num=0xfffd8cc2318, err_ind=
    0xfffd8cc231c) at netsnmp/client_intf.c:1013
#3  0x00000fff7be06e58 in netsnmp_get (self=<value optimized out>, args=<value optimized out>) at netsnmp/client_intf.c:1470

Comment 11 Jan Safranek 2011-08-23 16:24:46 UTC
This has been already fixed upstream in commit 7e1cae42bd79a0cdfb70521558a0dedc5aa0c42d. I've chosen a bit different approach though (PyInt_AsVoidPtr is not available on RHEL6???)

Comment 13 errata-xmlrpc 2011-12-06 17:12:05 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1524.html