Bug 464764

This is actually a regression in net-snmp on RHEL4.7 

net-snmp-5.1.2-11.x86_64.rpm:

    # snmpwalk -d -v1 -c public localhost 1.3.6.1.2.1.4.20.1.1

    Received 52 bytes from 127.0.0.1
    0000: 30 32 02 01  00 04 06 70  75 62 6C 69  63 A2 25 02    02.....public.%.
    0016: 04 3D 2D 40  09 02 01 00  02 01 00 30  17 30 15 06    .=-@.......0.0..
    0032: 0D 2B 06 01  02 01 04 14  01 01 7F 00  00 01 40 04    .+............@.
    0048: 7F 00 00 01                                  ^^^^^    ....
          ^^^^^^^^^^^

==> Ok

net-snmp-5.1.2-11.EL4.6.x86_64.rpm:

    # snmpwalk -d -v1 -c public localhost 1.3.6.1.2.1.4.20.1.1

    Received 52 bytes from 127.0.0.1
    0000: 30 32 02 01  00 04 06 70  75 62 6C 69  63 A2 25 02    02.....public.%.
    0016: 04 47 19 15  53 02 01 00  02 01 00 30  17 30 15 06    .G..S......0.0..
    0032: 0D 2B 06 01  02 01 04 14  01 01 7F 00  00 01 40 04    .+............@.
    0048: 7F 00 00 01                                  ^^^^^    ....
          ^^^^^^^^^^^
      
==> Ok

So this is indeed a regression that was introduced in 4.7.

The regression was sactually introduced by this patch in RHEL4.7:

    net-snmp-5.1.2-int-sizes.patch

Which introduced this:

    +    switch (vars->type) {
    +    case ASN_INTEGER:
    +    case ASN_UNSIGNED:
    +    case ASN_TIMETICKS:
    +    case ASN_IPADDRESS:
    +    case ASN_COUNTER:
    +        if (value) {
    +            if (largeval) {
    +                snmp_log(LOG_ERR,"bad size for integer-like type (%d)\n",
    +                         vars->val_len);
    +                return (1);
    +            } else if (vars->val_len == sizeof(int)) {
    +                if (ASN_INTEGER == vars->type) {
    +                    val_int = (const int *) value;
    +                    *(vars->val.integer) = (long) *val_int;
    +                } else {
    +                    val_uint = (const u_int *) value;
    +                    *(vars->val.integer) = (long) *val_uint;
    +                }
    +            } else {
    +                val_long = (const long *) value;
    +                *(vars->val.integer) = *val_long;
    +            }
             }
    -        memmove(newvar->val.string, val_str, val_len);
    -        newvar->val_len = val_len;
    -    } else if (val_str) {
    +        vars->val_len = sizeof(long);
    +        break;
    +

So actually, that part of the patch should suffice to fix the issue:

    --- net-snmp-5.1.2/snmplib/snmp_client.c.ip-size        2008-09-30 11:06:42.000000000 +0100
    +++ net-snmp-5.1.2/snmplib/snmp_client.c        2008-09-30 11:07:25.000000000 +0100
    @@ -752,7 +752,6 @@ snmp_set_var_value(netsnmp_variable_list
         case ASN_INTEGER:
         case ASN_UNSIGNED:
         case ASN_TIMETICKS:
    -    case ASN_IPADDRESS:
         case ASN_COUNTER:
             if (value) {
                 if (largeval) {
    @@ -789,6 +788,11 @@ snmp_set_var_value(netsnmp_variable_list
             memmove(vars->val.objid, value, vars->val_len);
             break;
     
    +    case ASN_IPADDRESS: /* snmp_build_var_op treats IPADDR like a string */
    +        if (4 != vars->val_len) {
    +            netsnmp_assert("ipaddress length == 4");
    +        }
    +        /** FALL THROUGH */
         case ASN_PRIV_IMPLIED_OCTET_STR:
         case ASN_OCTET_STR:
         case ASN_BIT_STR:

Example

    # snmpwalk -d -v1 -c public localhost 1.3.6.1.2.1.4.20.1.1
    [...]

    Received 52 bytes from 127.0.0.1
    0000: 30 32 02 01  00 04 06 70  75 62 6C 69  63 A2 25 02    02.....public.%.
    0016: 04 11 98 0D  C9 02 01 00  02 01 00 30  17 30 15 06    ...........0.0..
    0032: 0D 2B 06 01  02 01 04 14  01 01 7F 00  00 01 40 04    .+............@.
    0048: 7F 00 00 01                                  ^^^^^    ....
          ^^^^^^^^^^^
    IP-MIB::ipAdEntAddr.127.0.0.1 = IpAddress: 127.0.0.1

    [...]

    Received 55 bytes from 127.0.0.1
    0000: 30 35 02 01  00 04 06 70  75 62 6C 69  63 A2 28 02    05.....public.(.
    0016: 04 11 98 0D  CA 02 01 00  02 01 00 30  1A 30 18 06    ...........0.0..
    0032: 10 2B 06 01  02 01 04 14  01 01 81 2C  10 81 6F 81    .+.........,..o.
    0048: 08 40 04 AC  10 EF 88                                 .@.....
             ^^^^^^^^  ^^^^^^^^
    IP-MIB::ipAdEntAddr.172.16.239.136 = IpAddress: 172.16.239.136

Created attachment 319537 [details]
Much less intrusive and simpler patch 

Proposed patch.

This patch fixes just the part that changed in snmplib/snmp_client.c as explained above (and drops all the backport from 5.3)

This bugzilla has Keywords: Regression.  

Since no regressions are allowed between releases, 
it is also being proposed as a blocker for this release.  

Please resolve ASAP.

Release note added. If any revisions are required, please set the 
"requires_release_notes" flag to "?" and edit the "Release Notes" field accordingly.
All revisions will be proofread by the Engineering Content Services team.

New Contents:
* the snmpd daemon reported IP address values with an incorrect length of 8 bytes on 64-bit architectures. This has been corrected by asserting within the snmp_client that an IP address has a length of 4 bytes.

*** Bug 484639 has been marked as a duplicate of this bug. ***

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2009-0984.html