Page MenuHomeVyOS Platform

snmp settings allowing access via IPv6 when it should not
Closed, ResolvedPublicBUG

Description

When doing this:

set service snmp community test123 client '10.88.87.11'

The generated snmpd.conf looks like this:

rocommunity test123 10.88.87.11
rocommunity6 test123

Which means all IPv6 addresses can query it via SNMP if they know the community string.
I'd expect the rocommunity6 statement to be left out in this scenario.

Details

Difficulty level
Normal (likely a few hours)
Version
VyOS 1.2.0-epa2
Why the issue appeared?
Implementation mistake

Event Timeline

syncer triaged this task as Normal priority.
syncer added a project: VyOS 1.3 Equuleus.
syncer added a subscriber: syncer.

IMHO this is a general CLI design issue.

  • set service snmp community foo will allow all IPv4/IPv6 clients to connect
  • set service snmp community bar network 172.16.0.0/12 will allow all IPv6 clients to connect but only 172.16.0.0/12 from the IPv4 range
  • set service snmp community baz network 2001:db8::/64 will allow all IPv4 clients to connect but only 2001:db8::/64 from the IPv6 range
[email protected]# cat /etc/snmp/snmpd.conf  | grep rocommunity
rocommunity bar 172.16.0.0/12
rocommunity6 bar
rocommunity baz
rocommunity6 baz 2001:db8::/64
rocommunity foo
rocommunity6 foo

But what should be the desired behavior?

  • When no network or client is speciefied we allow allo but as soon as one network/client is specified we limit it down?
c-po changed the task status from Open to Confirmed.Jan 28 2019, 5:38 AM
c-po changed Difficulty level from Unknown (require assessment) to Normal (likely a few hours).
c-po changed Why the issue appeared? from Will be filled on close to Implementation mistake.
In T1160#31671, @c-po wrote:

But what should be the desired behavior?

  • When no network or client is speciefied we allow allo but as soon as one network/client is specified we limit it down?

Sounds right to me.

@danhusan is this your expected behavior?

[email protected]# show service snmp
 community bar {
     network 172.16.0.0/12
 }
 community baz {
     network 2001:db8::/64
 }
 community foo {
 }
 community hhhhhh{
     authorization ro
     network 172.16.100.0/24
 }
 listen-address 172.16.254.36 {
 }

resulting in

[email protected]#  cat /etc/snmp/snmpd.conf  | grep rocommunity
rocommunity bar 172.16.0.0/12
rocommunity6 baz 2001:db8::/64
rocommunity foo
rocommunity6 foo
rocommunity hhhhhh 172.16.100.0/24