[php-src] master: snmp: Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) security protocols (#21451)

Author: eskyuu (eskyuu)
Committer: GitHub (web-flow)
Pusher: Girgias
Date: 2026-08-19T17:40:39+01:00

Commit: https://github.com/php/php-src/commit/1f604fcdb78cff4fe0a7f0ec614a3ed4a246d028
Raw diff: https://github.com/php/php-src/commit/1f604fcdb78cff4fe0a7f0ec614a3ed4a246d028.diff

snmp: Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) security protocols (#21451)

RFC: https://wiki.php.net/rfc/snmp_improvements_2026#increase_the_number_of_snmpv3_security_protocols_supported

Changed paths:
  M  ext/snmp/snmp.c
  M  ext/snmp/tests/snmp-object-setSecurity_error.phpt
  M  ext/snmp/tests/snmp3-error.phpt


Diff:

diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c
index c45e3a6522b8..0c3e53614a6a 100644
--- a/ext/snmp/snmp.c
+++ b/ext/snmp/snmp.c
@@ -1061,20 +1061,48 @@ static ZEND_ATTRIBUTE_NONNULL bool snmp_session_set_sec_protocol(struct snmp_ses
 		s->securityPrivProtoLen = USM_PRIV_PROTO_AES_LEN;
 		return true;
 	}
+
+# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
+	if (zend_string_equals_literal_ci(prot, "AES192")) {
+		s->securityPrivProto = usmAES192PrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES192PrivProtocol);
+		return true;
+	}
+
+	if (zend_string_equals_literal_ci(prot, "AES256")) {
+		s->securityPrivProto = usmAES256PrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES256PrivProtocol);
+		return true;
+	}
+
+	if (zend_string_equals_literal_ci(prot, "AES192C")) {
+		s->securityPrivProto = usmAES192CiscoPrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES192CiscoPrivProtocol);
+		return true;
+	}
+
+	if (zend_string_equals_literal_ci(prot, "AES256C")) {
+		s->securityPrivProto = usmAES256CiscoPrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES256CiscoPrivProtocol);
+		return true;
+	}
+# endif
 #endif
 
 #ifdef HAVE_AES
-# ifndef NETSNMP_DISABLE_DES
-	zend_value_error("Security protocol must be one of \"DES\", \"AES128\", or \"AES\"");
-# else
-	zend_value_error("Security protocol must be one of \"AES128\", or \"AES\"");
+zend_value_error("Security protocol must be one of "
+#  ifndef NETSNMP_DISABLE_DES
+    "\"DES\", "
+#  endif
+# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
+ "\"AES256\", \"AES256C\", \"AES192\", \"AES192C\", "
 # endif
-#else
-# ifndef NETSNMP_DISABLE_DES
+ "\"AES128\", or \"AES\""
+);
+#elif !defined(NETSNMP_DISABLE_DES)
 	zend_value_error("Security protocol must be \"DES\"");
-# else
+#else
 	zend_value_error("No security protocol supported");
-# endif
 #endif
 	return false;
 }
diff --git a/ext/snmp/tests/snmp-object-setSecurity_error.phpt b/ext/snmp/tests/snmp-object-setSecurity_error.phpt
index 576ec8380804..56565bf5855e 100644
--- a/ext/snmp/tests/snmp-object-setSecurity_error.phpt
+++ b/ext/snmp/tests/snmp-object-setSecurity_error.phpt
@@ -72,8 +72,8 @@ bool(false)
 
 Warning: SNMP::setSecurity(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)
-Security protocol must be one of "DES", "AES128", or "AES"
-Security protocol must be one of "DES", "AES128", or "AES"
+Security protocol must be one of %s
+Security protocol must be one of %s
 
 Warning: SNMP::setSecurity(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)
diff --git a/ext/snmp/tests/snmp3-error.phpt b/ext/snmp/tests/snmp3-error.phpt
index 5f39f88ffe14..8dd6c87b011e 100644
--- a/ext/snmp/tests/snmp3-error.phpt
+++ b/ext/snmp/tests/snmp3-error.phpt
@@ -69,7 +69,7 @@ bool(false)
 
 Warning: snmp3_get(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)
-Security protocol must be one of "DES", "AES128", or "AES"
+Security protocol must be one of %s "AES128", or "AES"
 
 Warning: snmp3_get(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)