Re: would a single group with different access right to access different views?
Dave Shield <[email protected]>
| Newsgroups | gmane.network.net-snmp.user |
|---|---|
| Message-ID | <[email protected]> |
On 16 March 2010 09:49, Dave Shield <[email protected]> wrote: >> Could we configure: >> >> Group name access right ReadView >> --------------------------------------------------- >> group1 noAuthNoPriv none >> group1 AuthPriv all > > In principal, yes. > See the description text for vacmAccessTable in the > SNMP-VIEW-BASED-ACM-MIB > The explains how to choose which access entry to use, > and explicitly covers the possibility of mutliple matches. > > In practise, none of the released Net-SNMP agents > support this. The current development code (which > will eventually appear as 5.6) does, but none of the > active branches. If you wish to experiment with this, please try the attached patch which implements the correct VACM behaviour. This may or may not appear in upcoming releases. Dave ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Net-snmp-users mailing list [email protected] Please see the following page to unsubscribe or change other options: https://lists.sourceforge.net/lists/listinfo/net-snmp-users
vacm-best-match.patch
(text/x-patch, 2.4 KB)
Index: snmplib/vacm.c
===================================================================
--- snmplib/vacm.c (revision 18350)
+++ snmplib/vacm.c (working copy)
@@ -881,11 +881,50 @@
}
struct vacm_accessEntry *
+_vacm_choose_best( struct vacm_accessEntry *current,
+ struct vacm_accessEntry *candidate)
+{
+ /*
+ * RFC 3415: vacmAccessTable:
+ * 2) if this set has [more than] one member, ...
+ * it comes down to deciding how to weight the
+ * preferences between ContextPrefixes,
+ * SecurityModels, and SecurityLevels
+ */
+ if (( !current ) ||
+ /* a) if the subset of entries with securityModel
+ * matching the securityModel in the message is
+ * not empty, then discard the rest
+ */
+ ( current->securityModel == SNMP_SEC_MODEL_ANY &&
+ candidate->securityModel != SNMP_SEC_MODEL_ANY ) ||
+ /* b) if the subset of entries with vacmAccessContextPrefix
+ * matching the contextName in the message is
+ * not empty, then discard the rest
+ */
+ ( current->contextMatch == CONTEXT_MATCH_PREFIX &&
+ candidate->contextMatch == CONTEXT_MATCH_EXACT ) ||
+ /* c) discard all entries with ContextPrefixes shorter
+ * than the longest one remaining in the set
+ */
+ ( current->contextMatch == CONTEXT_MATCH_PREFIX &&
+ current->contextPrefix[0] < candidate->contextPrefix[0] ) ||
+ /* d) select the entry with the highest securityLevel
+ */
+ ( current->securityLevel < candidate->securityLevel )) {
+
+ return candidate;
+ }
+
+ return current;
+}
+
+struct vacm_accessEntry *
vacm_getAccessEntry(const char *groupName,
const char *contextPrefix,
int securityModel, int securityLevel)
{
- struct vacm_accessEntry *vp;
+ struct vacm_accessEntry *vp, *best=NULL;
char group[VACMSTRINGLEN];
char context[VACMSTRINGLEN];
int glen, clen;
@@ -914,9 +953,9 @@
&& clen >= vp->contextPrefix[0]
&& (memcmp(vp->contextPrefix + 1, context + 1,
vp->contextPrefix[0]) == 0))))
- return vp;
+ best = _vacm_choose_best( best, vp );
}
- return NULL;
+ return best;
}
void