-
Type:
Problem report
-
Resolution: Unresolved
-
Priority:
Trivial
-
Affects Version/s: 6.0.47, 6.0.48, 7.0.29, 7.0.30, 7.4.13, 7.4.14
-
Component/s: Proxy (P), Server (S)
-
None
Building Zabbix against a Net-SNMP configured with --disable-md5 fails to compile:
checks_snmp.c: In function 'zbx_snmpv3_set_auth_protocol': checks_snmp.c:809:54: error: 'usmHMACMD5AuthProtocol' undeclared (first use in this function); did you mean 'usmHMACSHA1AuthProtocol'? 809 | session->securityAuthProto = usmHMACMD5AuthProtocol; | ^~~~~~~~~~~~~~~~~~~~~~ | usmHMACSHA1AuthProtocol checks_snmp.c:809:54: note: each undeclared identifier is reported only once for each function it appears in
Every other optional Net-SNMP algorithm Zabbix supports is already guarded by a configure check: HAVE_NETSNMP_STRONG_AUTH, HAVE_NETSNMP_STRONG_PRIV and HAVE_NETSNMP_SESSION_DES. MD5 is the only one without one, which is why --disable-des builds succeed and --disable-md5 builds do not.
Steps to reproduce:
./bootstrap.sh CFLAGS=-DNETSNMP_DISABLE_MD5=1 ./configure --enable-proxy --with-sqlite3 --with-net-snmp make -C src/libs/zbxpoller
Proposed fix
Attached patch against release/7.4 (7.4.14), following the existing DES handling:
- m4/netsnmp.m4: add a configure check defining HAVE_NETSNMP_SESSION_MD5, using AC_COMPILE_IFELSE as the DES check does.
- src/libs/zbxpoller/checks_snmp.c: wrap the MD5 case in #ifdef HAVE_NETSNMP_SESSION_MD5.
On a build without MD5, an SNMPv3 item configured to use MD5 authentication fails to open its session and reports "Unsupported authentication protocol". That is the same path DES items already go through under --disable-des. Items using any other authentication protocol are unaffected, as are builds where MD5 is available.
with this the build without MD5 enabled would show:
checking for MD5 auth protocol support... no
otherwise
checking for MD5 auth protocol support... yes
Backporting
The same unguarded reference exists on master and release/7.0 at the same path. On release/7.0 it sits at the same line as 7.4, so the patch should apply unchanged; on master it should apply with a line offset.
release/6.0 has it at src/zabbix_server/poller/checks_snmp.c and needs the path adjusted.