[ZBXNEXT-5718] Add support of AES192/256 privacy protocol for SNMP checks (focus on Cisco "standard") Created: 2020 Jan 27 Updated: 2023 Oct 26 Resolved: 2021 Mar 09 |
|
Status: | Closed |
Project: | ZABBIX FEATURE REQUESTS |
Component/s: | Frontend (F), Proxy (P), Server (S) |
Affects Version/s: | 4.0.16, 4.4.4 |
Fix Version/s: | None |
Type: | New Feature Request | Priority: | Medium |
Reporter: | Oleksii Zagorskyi | Assignee: | Valdis Murzins |
Resolution: | Duplicate | Votes: | 9 |
Labels: | snmp, snmpv3 | ||
Remaining Estimate: | Not Specified | ||
Time Spent: | Not Specified | ||
Original Estimate: | Not Specified |
Attachments: |
![]() ![]() ![]() ![]() ![]() ![]() |
||||||||||||
Issue Links: |
|
Description |
This link describes some details why AES192/256 has some complexity and what is history for this challenge. This page says that it's really possible starting from version 5.8: In short: there was an attempt to add AES192/256 support to RFCs, but it never happened officially. Currently many Cisco devices support AES192/256 and some NMS (as a manager) too. Unfortunately any example in the Internet or in man pages for any net-snmp package does not mention specificity for new AES modes and how to use them. Some details can be found only in source code. #ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04 { "AES-192", USM_CREATE_USER_PRIV_AES192 }, { "AES192", USM_CREATE_USER_PRIV_AES192 }, { "AES-256", USM_CREATE_USER_PRIV_AES256 }, { "AES256", USM_CREATE_USER_PRIV_AES256 }, /** cisco / pysnmp variations */ { "AES-192-C", USM_CREATE_USER_PRIV_AES192_CISCO }, { "AES192C", USM_CREATE_USER_PRIV_AES192_CISCO }, { "AES-256-C", USM_CREATE_USER_PRIV_AES256_CISCO }, { "AES256C", USM_CREATE_USER_PRIV_AES256_CISCO }, #endif Options available for command line are defined in net-snmp-5.8/include/net-snmp/library/transform_oids.h:
#ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
NETSNMP_IMPORT oid usmAES192PrivProtocol[9];
NETSNMP_IMPORT oid usmAES256PrivProtocol[9];
NETSNMP_IMPORT oid usmAES192CiscoPrivProtocol[11];
NETSNMP_IMPORT oid usmAES256CiscoPrivProtocol[11];
NETSNMP_IMPORT oid usmAES192Cisco2PrivProtocol[11];
NETSNMP_IMPORT oid usmAES256Cisco2PrivProtocol[11];
#endif /* NETSNMP_DRAFT_BLUMENTHAL_AES_04 */
We can see that there basically are 2 "versions" of AES256: Cisco's and pre-RFC's. I've prepared patch to test it (for zabbix 4.0). And it works, tested on Cisco virtual router. Interesting that in Wireshark, when configuring SNMP user (to decrypt traffic), there is only one option "AES256" (without C), but it works exactly and only for Cisco's encryption. I.e. it does not work for pre-RFC mode. Using "net-snmp-config --configure-options" we can see options net-snmp compiled with. Important detail that net-snmp version 5.8 bumped version for "soname" in library (30->35), so currently it's libnetsnmp.so.35, while v5.7 provided libnetsnmp.so.30 Note: if use zabbix server with the patch and use new modes, but dynamically loaded library does not support the new modes, host interface will become unavailable (red) with this error:
"Unsupported privacy protocol [3]"
In my patch I've added support only for Cisco's modes, and I feel it's reasonable and enough. |
Comments |
Comment by Oleksii Zagorskyi [ 2021 Jan 07 ] |
|
Comment by Rostislav Palivoda (Inactive) [ 2021 Mar 09 ] |
Please follow |