On Fri, 2022-12-09 at 13:35 -0700, Byron Klippert wrote:
> On Fri, Dec 9, 2022, at 12:57, Stuart Henderson wrote:
> > On 2022-12-09, Byron Klippert <byronklipp...@ml1.net> wrote:
> > > Hello,
> > > 
> > > I get an snmp protocol error response when attempting to `snmp get` 
> > > certain OIDs on various devices. However `tcpdump` shows that the device 
> > > is actually responding with the anticipated result but it appears snmp 
> > > isn't able to parse the response correctly? Any suggestions on how to 
> > > troubleshoot further are welcome.
> > > 
> > > 
> > > I'm requesting the mntrFreq OID which is formatted as such:
> > > Name: mntrFreq
> > > OID: .1.3.6.1.4.1.35833.12.3.1
> > > MIB: DB7000-MIB
> > > Syntax: INTEGER32 (87100..108100)
> > > Access: read-only
> > > Status: current
> > > DefVal:
> > > Indexes:
> > > Descr: "mntr Freq"
> > 
> > btw, the information in the mib file doesn't necessarily correspond
> > to what the device actually sends, "snmp get" doesn't care about the
> > mib file at all, just whether the pdu is correctly formatted.
> 
> Yup, understood. I've seen a few half-baked snmp implementations in the wild 
> to know the MIB docs are often only suggestions as to how devices actually 
> respond. 
> 
> > 
> > > imac:/home/admin $ snmp get -v 2c -r 0 -c *redacted* 
> > > udp:paint-receiver:161 .1.3.6.1.4.1.35833.12.3.1.0
> > > snmp: get: Protocol error
> > > 
> > > imac:/home/admin $ doas tcpdump host paint-receiver
> > > tcpdump: listening on bge0, link-type EN10MB
> > > 10:10:02.804614 192.168.0.4.21246 > paint-receiver.snmp: C=*redacted* 
> > > GetRequest(32) E:35833.12.3.1.0
> > > 10:10:03.231863 paint-receiver.snmp > 192.168.0.4.21246: C=*redacted* 
> > > GetResponse(40) E:35833.12.3.1.0=103500
> > 
> > It might be useful to use -X to do a hexdump (and maybe -s1500 to make
> > sure you get full packets); if you need to redact the snmp community
> > (although it probably doesn't really matter all that much seeing as
> > it's on a private lan address) make sure you get the hex digits too
> > 
> > That way we can get a better idea of what's actually sent on the wire
> > 
> > 
> > -- 
> > Please keep replies on the mailing list.
> 
> imac:/home/admin $ snmp get -v 2c -r 0 -c *redacted* udp:paint-receiver:161 
> .1.3.6.1.4.1.35833.12.3.1.0
> snmp: get: Protocol error
> 
> imac:/home/admin $ clear; doas tcpdump -X -s1500 host paint-receiver
> tcpdump: listening on bge0, link-type EN10MB
> 13:23:16.478673 192.168.0.4.11162 > paint-receiver.snmp: C=*redacted* 
> GetRequest(32) E:35833.12.3.1.0
>   0000: 4500 004d ce0a 0000 4011 0000 c0a8 0004  E..M....@.......
>   0010: c0a8 050c 2b9a 00a1 0039 aac2 302f 0201  ....+....9..0/..
>   0020: 0104 082a 2a2a 2a2a 2a2a 2aa0 2002 0428  ...********. ..(
>   0030: f7c4 fb02 0100 0201 0030 1230 1006 0c2b  .........0.0...+
>   0040: 0601 0401 8297 790c 0301 0005 00         ......y......
> 
> 13:23:17.366836 paint-receiver.snmp > 192.168.0.4.11162: C=*redacted* 
> GetResponse(40) E:35833.12.3.1.0=103500
>   0000: 4500 0059 f938 0000 fd11 3dfa c0a8 050c  E..Y.8....=.....
>   0010: c0a8 0004 00a1 2b9a 0045 c089 3082 0039  ......+..E..0..9
>   0020: 0201 0104 082a 2a2a 2a2a 2a2a 2aa2 8200  .....********...
>   0030: 2802 0428 f7c4 fb02 0100 0201 0030 8200  (..(.........0..
>   0040: 1830 8200 1406 0c2b 0601 0401 8297 790c  .0.....+......y.
>   0050: 0301 0002 0400 0194 4c                   ........L

The problem is here in the final 4 bytes: 0x0001944c, which is the int
value of the response (0x0204 is the integer preamble).
According to X.690 section 8.3.2:
If the contents octets of an integer value encoding consist of more than
one octet, then the bits of the first octet and bit 8 of the second 
octet:
a) shall not all be ones; and
b) shall not all be zero.
NOTE - These rules ensure that an integer value is always encoded in the 
smallest possible number of octets

In this case the 1st byte is all zeroes, violating the rule. A check for
this was introduced to ber.c by rob@ to enforce this:
revision 1.5
date: 2019/05/12 20:13:08;  author: rob;  state: Exp;  lines: +9 -2;  commitid: 
7FpdY7sgslPEOJU0;
Enforce smallest number of contents octets for int (and enum).

ok claudio@

Although the additional byte(s) don't really hurt I'm not sure if
reverting this diff for a single misbehaving device is worth it.
Unless anyone thinks differently I think it'd be better to first
go to the vendor of your device and ask them to fix this.

martijn@
> 
> 
> And here's the OID that responds correctly...
> 
> imac:/home/admin $ snmp get -v 2c -r 0 -c *redacted* udp:paint-receiver:161 
> .1.3.6.1.4.1.35833.12.2.10.1.0
> enterprises.35833.12.2.10.1.0 = STRING: DB7000: Paint Mt
> 
> imac:/home/admin $ clear; doas tcpdump -X -s1500 host paint-receiver
> tcpdump: listening on bge0, link-type EN10MB
> 13:32:08.168829 192.168.0.4.44771 > paint-receiver.snmp: C=*redacted* 
> GetRequest(33) E:35833.12.2.10.1.0
>   0000: 4500 004e 36ee 0000 4011 0000 c0a8 0004  E..N6...@.......
>   0010: c0a8 050c aee3 00a1 003a caeb 3030 0201  .........:..00..
>   0020: 0104 082a 2a2a 2a2a 2a2a 2aa0 2102 0459  ...********.!..Y
>   0030: f71a 4f02 0100 0201 0030 1330 1106 0d2b  ..O......0.0...+
>   0040: 0601 0401 8297 790c 020a 0100 0500       ......y.......
> 
> 13:32:08.988687 paint-receiver.snmp > 192.168.0.4.44771: C=*redacted* 
> GetResponse(53) E:35833.12.2.10.1.0="DB7000: Paint Mt"
>   0000: 4500 0066 f967 0000 fd11 3dbe c0a8 050c  E..f.g....=.....
>   0010: c0a8 0004 00a1 aee3 0052 ade8 3082 0046  .........R..0..F
>   0020: 0201 0104 082a 2a2a 2a2a 2a2a 2aa2 8200  .....********...
>   0030: 3502 0459 f71a 4f02 0100 0201 0030 8200  5..Y..O......0..
>   0040: 2530 8200 2106 0d2b 0601 0401 8297 790c  %0..!..+......y.
>   0050: 020a 0100 0410 4442 3730 3030 3a20 5061  ......DB7000: Pa
>   0060: 696e 7420 4d74                           int Mt
> 

Reply via email to