[AGENT++] error on manage when receiving atrap notfication withafinite number of variable bindings

[Karthik Venkataraman]

Hi Jochen,

I am using RedHat ES 4 Update 4/ AMD64 system. I am building only a 32-bit
library.I did a printf for asn_length,(bufp -data) and *datalength, and
here's the output:
20070831.08:16:52: 10494: (1)DEBUG  : Bind to 0.0.0.0/10162 for
notifications, f
d 4.
Waiting for traps/informs...
press return to stop
20070831.08:16:58: 10494: (1)DEBUG  : ++ SNMP++: data received from
10.100.100.9
4/1055.
20070831.08:16:58: 10494: (3)DEBUG  : 30 81 EA 02  01 01 04 06  70 75 62 6C
69
63 A7 81
20070831.08:16:58: 10494: (3)DEBUG  : DC 02 02 11  36 02 01 00  02 01 00 30
81
CF 30 0D
20070831.08:16:58: 10494: (3)DEBUG  : 06 08 2B 06  01 02 01 01  03 00 43 01
69
30 1D 06
20070831.08:16:58: 10494: (3)DEBUG  : 0A 2B 06 01  06 03 01 01  04 01 00 06
0F
2B 06 01
20070831.08:16:58: 10494: (3)DEBUG  : 04 01 81 8B  40 01 01 04  01 04 05 00
30
14 06 0E
20070831.08:16:58: 10494: (3)DEBUG  : 2B 06 01 04  01 81 8B 40  01 01 04 01
03
14 02 02
20070831.08:16:58: 10494: (3)DEBUG  : 17 74 30 29  06 0E 2B 06  01 04 01 81
8B
40 01 01
20070831.08:16:58: 10494: (3)DEBUG  : 04 01 03 15  04 17 32 30  30 37 3A 30
38
3A 32 39
20070831.08:16:58: 10494: (3)DEBUG  : 3A 31 32 3A  32 38 3A 31  30 3A 45 44
54
30 3F 06
20070831.08:16:58: 10494: (3)DEBUG  : 0E 2B 06 01  04 01 81 8B  40 01 01 04
01
03 16 04
20070831.08:16:58: 10494: (3)DEBUG  : 2D 4E 75 6D  62 65 72 20  6F 66 20 4C
69
73 74 65
20070831.08:16:58: 10494: (3)DEBUG  : 6E 65 72 20  74 68 72 65  61 64 73 20
3E
20 74 68
20070831.08:16:58: 10494: (3)DEBUG  : 72 65 61 64  20 74 68 72  65 73 68 6F
6C
64 30 1D
20070831.08:16:58: 10494: (3)DEBUG  : 06 0E 2B 06  01 04 01 81  8B 40 01 01
04
01 03 17
20070831.08:16:58: 10494: (3)DEBUG  : 04 0B 52 65  70 6C 69 63  61 74 69 6F
6E

asn_length = 1
bufp - data = 2
*datalength = 0
20070831.08:16:58: 10494: (1)DEBUG  : ASN parse error (overflow of message)

20070831.08:16:58: 10494: (1)WARNING: Testing for v3 message: Bad parse of
versi
on
asn_length = 1
bufp - data = 2
*datalength = 0
20070831.08:16:58: 10494: (1)DEBUG  : ASN parse error (overflow of message)

20070831.08:16:58: 10494: (1)DEBUG  : ASN parse error (bad parse of version)


20070831.08:17:14: 10494: (1)DEBUG  : Closing notifications port
0.0.0.0/10162,
fd 4.

Thanks,
Karthik

-----Original Message-----
From: agentpp-bounces at agentpp.org [mailto:agentpp-bounces at agentpp.org] On
Behalf Of Jochen Katz
Sent: Thursday, August 30, 2007 5:09 PM
To: agentpp at agentpp.org
Subject: Re: [AGENT++] error on manage when receiving atrap notfication
withafinite number of variable bindings

Hi Karthik,

> I rebuilt the receive_trap src with _DEBUG and here's what I see now:
> 
> 20070830.14:11:07: 9448: (1)DEBUG  : ++ SNMP++: data received from
> 10.100.100.94/1049.
> 20070830.14:11:07: 9448: (3)DEBUG  : 30 81 EA 02  01 01 04 06  70 75 62 6C

this message is valid. it decodes here to:
msg: SNMP++: Received SNMP Notification (trap or inform)
from: 127.0.0.1/32856
ID:  1.3.6.1.4.1.17856.1.1.4.1.4.5.0
Type:167
Oid: 1.3.6.1.4.1.17856.1.1.4.1.3.20
Val: 6004
Oid: 1.3.6.1.4.1.17856.1.1.4.1.3.21
Val: 2007:08:29:12:28:10:EDT
Oid: 1.3.6.1.4.1.17856.1.1.4.1.3.22
Val: Number of Listener threads > thread threshold
Oid: 1.3.6.1.4.1.17856.1.1.4.1.3.23
Val: Replication

> 20070830.14:11:07: 9448: (1)DEBUG  : ASN parse error (overflow of message)
> 20070830.14:11:07: 9448: (1)WARNING: Testing for v3 message: Bad parse of
> version

This is strange, as this does not happen here. On what platform (CPU,
operating system, compiler) are you testing?

The error occurs in asn_parse_int() at the following test:
  if ((asn_length + (bufp - data)) > (unsigned long)(*datalength)){
Can you add some printf to get these values?

> 20070830.14:11:07: 9471: (1)EVENT  : NotificationGenerator: sent trap
> (vers)(id)
> (tdomain)(addr)(vbs)(community/secName)(status): (1),
> (1.3.6.1.4.1.17856.1.1.4.1.4.5.0), (1), (127.0.0.1/10162), (4),
(public),(0)
> 20070830.14:11:17: 9471: (1)EVENT  : NotificationGenerator: sent trap
> 
> If you look at the messages above, the version shows up as 1, but am
sending
> a v2 trap using the following code on the agent: 

This is ok, as 0 is SNMPv1 and 1 is SNMPv2c. SNMPv3 would be 3.

Regards,
  Jochen
_______________________________________________
AGENTPP mailing list
AGENTPP at agentpp.org
http://lists.agentpp.org/mailman/listinfo/agentpp