ExportXMLWordPrintable

    • Type: Problem report
    • Resolution: Unresolved
    • Priority: Trivial
    • 7.4.14
    • Affects Version/s: 6.0.47, 6.0.48, 7.0.29, 7.0.30, 7.4.13, 7.4.14
    • Component/s: Proxy (P), Server (S)
    • None

      Building Zabbix against a Net-SNMP configured with --disable-md5 fails to compile:

      checks_snmp.c: In function 'zbx_snmpv3_set_auth_protocol':
        checks_snmp.c:809:54: error: 'usmHMACMD5AuthProtocol' undeclared (first use in this function); did you mean 'usmHMACSHA1AuthProtocol'?
          809 |                         session->securityAuthProto = usmHMACMD5AuthProtocol;
              |                                                      ^~~~~~~~~~~~~~~~~~~~~~
              |                                                      usmHMACSHA1AuthProtocol
        checks_snmp.c:809:54: note: each undeclared identifier is reported only once for each function it appears in
      

      Every other optional Net-SNMP algorithm Zabbix supports is already guarded by a configure check: HAVE_NETSNMP_STRONG_AUTH, HAVE_NETSNMP_STRONG_PRIV and HAVE_NETSNMP_SESSION_DES. MD5 is the only one without one, which is why --disable-des builds succeed and --disable-md5 builds do not.

       

      Steps to reproduce:

      ./bootstrap.sh
      CFLAGS=-DNETSNMP_DISABLE_MD5=1 ./configure --enable-proxy --with-sqlite3 --with-net-snmp
      make -C src/libs/zbxpoller

       

      Proposed fix

      Attached patch against release/7.4 (7.4.14),  following the existing DES handling:

      • m4/netsnmp.m4: add a configure check defining HAVE_NETSNMP_SESSION_MD5, using AC_COMPILE_IFELSE as the DES check does.
      • src/libs/zbxpoller/checks_snmp.c: wrap the MD5 case in #ifdef HAVE_NETSNMP_SESSION_MD5.

      On a build without MD5, an SNMPv3 item configured to use MD5 authentication fails to open its session and reports "Unsupported authentication protocol". That is the same path DES items already go through under --disable-des. Items using any other authentication protocol are unaffected, as are builds where MD5 is available.

      with this the build without MD5 enabled would show:

       

      checking for MD5 auth protocol support... no
      

      otherwise

       

       

      checking for MD5 auth protocol support... yes

       

      Backporting

      The same unguarded reference exists on master and release/7.0 at the same path. On release/7.0 it sits at the same line as 7.4, so the patch should apply unchanged; on master it should apply with a line offset.
      release/6.0 has it at src/zabbix_server/poller/checks_snmp.c and needs the path adjusted.

            Assignee:
            Zabbix Support Team
            Reporter:
            Francesco Bartolini
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: