Skip to content

Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) security protocols #21451

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
eskyuu wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) security protocols #21451

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
d81bbc7
Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) s…
eskyuu Mar 15, 2026
070a8d0
Update SNMP tests
eskyuu Mar 15, 2026
5a9a4bb
Update tests to handle SNMP agent not supporting SNMPv3
eskyuu Mar 15, 2026
e8572b1
Remove AES192+ tests because snmpd does not support it, and it crashe…
eskyuu Mar 15, 2026
a335539
Handle different security outputs for windows vs lonux
eskyuu Mar 15, 2026
2ae7125
Fix for error message
eskyuu Mar 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 36 additions & 2 deletions ext/snmp/snmp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1071,13 +1071,47 @@ static ZEND_ATTRIBUTE_NONNULL bool snmp_session_set_sec_protocol(struct snmp_ses
s->securityPrivProtoLen = USM_PRIV_PROTO_AES_LEN;
return true;
}

# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
if (zend_string_equals_literal_ci(prot, "AES192")) {
s->securityPrivProto = usmAES192PrivProtocol;
s->securityPrivProtoLen = OID_LENGTH(usmAES192PrivProtocol);
return true;
}

if (zend_string_equals_literal_ci(prot, "AES256")) {
s->securityPrivProto = usmAES256PrivProtocol;
s->securityPrivProtoLen = OID_LENGTH(usmAES256PrivProtocol);
return true;
}

if (zend_string_equals_literal_ci(prot, "AES192C")) {
s->securityPrivProto = usmAES192CiscoPrivProtocol;
s->securityPrivProtoLen = OID_LENGTH(usmAES192CiscoPrivProtocol);
return true;
}

if (zend_string_equals_literal_ci(prot, "AES256C")) {
s->securityPrivProto = usmAES256CiscoPrivProtocol;
s->securityPrivProtoLen = OID_LENGTH(usmAES256CiscoPrivProtocol);
return true;
}
# endif
#endif

#ifdef HAVE_AES
# ifndef NETSNMP_DISABLE_DES
zend_value_error("Security protocol must be one of \"DES\", \"AES128\", or \"AES\"");
# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
# ifndef NETSNMP_DISABLE_DES
zend_value_error("Security protocol must be one of \"AES256\", \"AES256C\", \"AES192\", \"AES192C\", \"AES128\", \"AES\", or \"DES\"");
# else
zend_value_error("Security protocol must be one of \"AES256\", \"AES256C\", \"AES192\", \"AES192C\", \"AES128\", or \"AES\"");
# endif
# else
# ifndef NETSNMP_DISABLE_DES
zend_value_error("Security protocol must be one of \"AES128\", \"AES\", or \"DES\"");
# else
zend_value_error("Security protocol must be one of \"AES128\", or \"AES\"");
# endif
# endif
#else
# ifndef NETSNMP_DISABLE_DES
Expand Down
4 changes: 2 additions & 2 deletions ext/snmp/tests/snmp-object-setSecurity_error.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,8 +68,8 @@ bool(false)

Warning: SNMP::setSecurity(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d
bool(false)
Security protocol must be one of "DES", "AES128", or "AES"
Security protocol must be one of "DES", "AES128", or "AES"
Security protocol must be one of %s
Security protocol must be one of %s

Warning: SNMP::setSecurity(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d
bool(false)
Expand Down
2 changes: 1 addition & 1 deletion ext/snmp/tests/snmp3-error.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ bool(false)

Warning: snmp3_get(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d
bool(false)
Security protocol must be one of "DES", "AES128", or "AES"
Security protocol must be one of %s

Warning: snmp3_get(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d
bool(false)
Expand Down
Loading