Re: would a single group with different access right to access different views?

Dave Shield <[email protected]>
Newsgroups gmane.network.net-snmp.user
Message-ID <[email protected]>
On 16 March 2010 09:49, Dave Shield <[email protected]> wrote:
>> Could we configure:
>>
>> Group name    access right         ReadView
>> ---------------------------------------------------
>> group1               noAuthNoPriv    none
>> group1               AuthPriv                all
>
> In principal, yes.
> See the description text for vacmAccessTable in the
> SNMP-VIEW-BASED-ACM-MIB
>   The explains how to choose which access entry to use,
> and explicitly covers the possibility of mutliple matches.
>
> In practise, none of the released Net-SNMP agents
> support this.  The current development code (which
> will eventually appear as 5.6) does, but none of the
> active branches.


If you wish to experiment with this, please try the attached patch
which implements the correct VACM behaviour.

This may or may not appear in upcoming releases.

Dave

------------------------------------------------------------------------------
Download Intel&#174; Parallel Studio Eval
Try the new software tools for yourself. Speed compiling, find bugs
proactively, and fine-tune applications for parallel performance.
See why Intel Parallel Studio got high marks during beta.
http://p.sf.net/sfu/intel-sw-dev

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users
vacm-best-match.patch (text/x-patch, 2.4 KB)
Index: snmplib/vacm.c
===================================================================
--- snmplib/vacm.c	(revision 18350)
+++ snmplib/vacm.c	(working copy)
@@ -881,11 +881,50 @@
 }
 
 struct vacm_accessEntry *
+_vacm_choose_best( struct vacm_accessEntry *current,
+                   struct vacm_accessEntry *candidate)
+{
+    /*
+     * RFC 3415: vacmAccessTable:
+     *    2) if this set has [more than] one member, ...
+     *       it comes down to deciding how to weight the
+     *       preferences between ContextPrefixes,
+     *       SecurityModels, and SecurityLevels
+     */
+    if (( !current ) ||
+        /* a) if the subset of entries with securityModel
+         *    matching the securityModel in the message is
+         *    not empty, then discard the rest
+         */
+        (  current->securityModel == SNMP_SEC_MODEL_ANY &&
+         candidate->securityModel != SNMP_SEC_MODEL_ANY ) ||
+        /* b) if the subset of entries with vacmAccessContextPrefix
+         *    matching the contextName in the message is
+         *    not empty, then discard the rest
+         */
+        (  current->contextMatch  == CONTEXT_MATCH_PREFIX &&
+         candidate->contextMatch  == CONTEXT_MATCH_EXACT ) ||
+        /* c) discard all entries with ContextPrefixes shorter
+         *    than the longest one remaining in the set
+         */
+        (  current->contextMatch  == CONTEXT_MATCH_PREFIX &&
+           current->contextPrefix[0] < candidate->contextPrefix[0] ) ||
+        /* d) select the entry with the highest securityLevel
+         */
+        (  current->securityLevel < candidate->securityLevel )) {
+
+        return candidate;
+    }
+
+    return current;
+}
+
+struct vacm_accessEntry *
 vacm_getAccessEntry(const char *groupName,
                     const char *contextPrefix,
                     int securityModel, int securityLevel)
 {
-    struct vacm_accessEntry *vp;
+    struct vacm_accessEntry *vp, *best=NULL;
     char            group[VACMSTRINGLEN];
     char            context[VACMSTRINGLEN];
     int             glen, clen;
@@ -914,9 +953,9 @@
                  && clen >= vp->contextPrefix[0]
                  && (memcmp(vp->contextPrefix + 1, context + 1,
                             vp->contextPrefix[0]) == 0))))
-            return vp;
+            best = _vacm_choose_best( best, vp );
     }
-    return NULL;
+    return best;
 }
 
 void
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.