https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7283
Summary: SNMPv3 EngineID decode error
Product: Wireshark
Version: unspecified
Platform: All
OS/Version: All
Status: NEW
Severity: Normal
Priority: Low
Component: Wireshark
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: songhao@xxxxxxx
Created attachment 8485
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=8485
picture in wireshark
Build Information:
>From source: wireshark-1.7.1.tar.bz2
--
I think it is a bug that if an enterprise uses 128 as the fifth octet while the
very first bit is set 1, the WireShark shows <Data not Conforming to RFC3411>.
the EngineID is defined in RFC3411 as follow:
SnmpEngineID ::= TEXTUAL-CONVENTION
......
3) The length of the octet string varies.
......
The fifth octet indicates how the rest (6th and
following octets) are formatted. The values for
the fifth octet are:
......
128-255 - as defined by the enterprise
Maximum remaining length 27
If the fifth octet uses 128-255, it indicates that follow enterprise encode,
but I found there is a bug in the source code.
I download the source of V1.7.1, but I think it could be in all version of
WireShark.
/* In function dissect_snmp_engineid
asn1\snmp\packet-snmp-template.c
epan\dissectors\packet-snmp.c */
switch(format) {
......
case 128:
/* most common enterprise-specific format: (ucd|net)-snmp random */
if ((enterpriseid==2021)||(enterpriseid==8072)) {
proto_item_append_text(item, (enterpriseid==2021) ? ": UCD-SNMP Random" :
": Net-SNMP Random");
/* demystify: 4B random, 4B epoch seconds */
if (len_remain==8) {
proto_tree_add_item(tree, hf_snmp_engineid_data, tvb, offset, 4,
ENC_NA);
seconds = tvb_get_letohl(tvb, offset+4);
ts.secs = seconds;
ts.nsecs = 0;
proto_tree_add_time_format_value(tree, hf_snmp_engineid_time, tvb,
offset+4, 4,
&ts, "%s",
abs_time_secs_to_str(seconds, ABSOLUTE_TIME_LOCAL,
TRUE));
offset+=8;
len_remain=0;
}
}
break;
case SNMP_ENGINEID_FORMAT_OCTETS:
default:
/* max. 27 bytes, administratively assigned or unknown format */
if (len_remain<=27) {
proto_tree_add_item(tree, hf_snmp_engineid_data, tvb, offset, len_remain,
ENC_NA);
offset+=len_remain;
len_remain=0;
}
break;
}
}
if (len_remain>0) {
proto_tree_add_text(tree, tvb, offset, len_remain, "<Data not conforming
to RFC3411>");
offset+=len_remain;
}
This code think 128 is just for UCD-SNMP and Net-SNMP and the follow octets
must encode as their rules.
May be it is better to write as:
/* case 128: */ /* move case 128 to the default branch */
case SNMP_ENGINEID_FORMAT_OCTETS:
default:
if (format == 128) {
/* most common enterprise-specific format: (ucd|net)-snmp random */
if ((enterpriseid==2021)||(enterpriseid==8072)) {
proto_item_append_text(item, (enterpriseid==2021) ? ": UCD-SNMP Random"
: ": Net-SNMP Random");
/* demystify: 4B random, 4B epoch seconds */
if (len_remain==8) {
proto_tree_add_item(tree, hf_snmp_engineid_data, tvb, offset, 4,
ENC_NA);
seconds = tvb_get_letohl(tvb, offset+4);
ts.secs = seconds;
ts.nsecs = 0;
proto_tree_add_time_format_value(tree, hf_snmp_engineid_time, tvb,
offset+4, 4,
&ts, "%s",
abs_time_secs_to_str(seconds, ABSOLUTE_TIME_LOCAL,
TRUE));
offset+=8;
len_remain=0;
}
}
}
else
{
/* max. 27 bytes, administratively assigned or unknown format */
if (len_remain<=27) {
proto_tree_add_item(tree, hf_snmp_engineid_data, tvb, offset,
len_remain, ENC_NA);
offset+=len_remain;
len_remain=0;
}
}
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
