~ubuntu-branches/ubuntu/trusty/net-snmp/trusty

This file contains a summary of the major changes in released revisions.

Please see the CHANGES file for a more detailed list of specific bugs/patches

that have been fixed/applied, and the ChangeLog file for a comprehensive

listing of all changes made to the code.

*5.4.3*

    snmpd:

      - Change default AgentX target from 0.0.0.0:705 to localhost:705

      - Fix CVE-2008-4309 (GETBULK issue reported by Oscar Mira-Sanchez)

      - Fix handling of multiple matching VACM entries

        (Use the "best" match, rather than the first one).

            Note that this could potentially affect the behaviour of

            existing access control configurations.

      - Latch large-disk statistics at 2Tb (rather than wrapping)

    Linux:

      - Fix build on modern distributions (using rpm-4.6)

    Windows:

      - Fix various builds (recent MSVC, MinGW, IPv6, winExtDLL)

*5.4.2*

    snmplib:

      - [PATCH 1921861]: Avoid endless loop after truncating 64bit int

      - Better handling of CONTAINER_INSERT failures with multiple indices

    snmpd:

      - [PATCH 2023633]: add SCTP-MIB implementation (Linux only)

      - suppress annoying "registration != duplicate" warning for root oids

    build:

      - [BUG 2023803]: Compilation problems on HP-UX 11.31

      - Update to libtool 1.5.26

    AIX:

      - Add support for AIX 6.x.

*5.4.1*

    snmplib:

      - [BUG 1619827]: link libraries against needed external libraries

      - [PATCH 1616912]: fix memory leak in UDP transport code

      - [PATCH 1592706]: fix memory leak when cloning varbinds

      - Change snmp_sess_add_ex to consistently close and delete the

        transport argument on failure, earlier the liveness of the

        transport argument was undecided.

    snmpd:

      - [BUG 1558823]: fix ipAddressTable memory leak

      - [BUG 1596638]: fix memory leak in ipCidrRouteTable, inetCidrRouteTable

      - [BUG 1611524]: fix tcp connection table file descriptor leak

      - handle row deletion issues in dataset tables

      - [BUG 1712988]: default and configurable maximum number of

        varbinds returnable to a GETBULK request.

      - [PATCH 1666737]: include ipv6 counts in

	udpInDatagrams, udpNoPorts, udpInErrors, udpOutDatagrams

      - [PATCH 1700157]: fixes ordering of exec tokens in the resulting mib tree

      - [PATCH 1719253]: fix skipNFSInHostResources so it does not break on the

	second walk of the table.

    perl:

      - link Perl modules against the exact set of libraries needed

      - [BUG 1619827]: properly link against libperl when configured with

	--enable-as-needed

      - [PATCH 1725049]: fix bulkwalk in cases of non-repeater

    build:

      - update to libtool 1.5.24 (from 1.5.22)

    python:

      - [PATCH 1716114]: Let python build in the Net-SNMP source tree

    MacOSX:

      - [PATCH 1600522]: CPU Hardware Abstraction Layer (HAL)

        implementation for mach/darwin

      - IF-MIB rewrite now enabled by default

    Win32:

      - fix AES support

      - [PATCH 1706344]: fix compilation with cygwin

    IRIX:

      - [PATCH 1709748]: Optimized IRIX cpu stats

    AIX:

      - Fix default shared library building instead of forcing static use

    FreeBSD:

      - [BUG 1633483]: Support CPU HAL on FreeBSD4.x

*5.4*

  Important Changes:

    - The default configuration now enables embedded Perl and the Perl

      modules by default when possible unless explicitly disabled. You

      may use the --disable-embedded-perl and --without-perl-modules

      configure options, respectively, to revert to the former default

      configuration.

  New:

    python:

      - Python bindings to the Net-SNMP project are now available in

        the python sub-directory.  See the README file there for details. 

    build:

      - Some preliminary support for automatic building of dynamically

        loadable mib module code.

      - Most net-snmp specific defines are now (also) available under

        a proper NETSNMP_ prefix. The older, potentially conflicting

        names as well as the autoconf variables can now be turned off

        easily within 3rd party code.

      - libtool update to 1.5.22

      - enable-as-needed will try to link built libraries against needed

	libraries at library link time, rather than application link time.

        This is preliminary support for what will likely be better in 5.5.

    snmplib:

      - [PATCH 1282566]: to rework transport creation to allow for

        alternative interpretations of the address and a more flexible

        transport registration system

      - [PATCH 1509943]: responses will get sent from the original dest IP

        address when possible.

    snmpd:

      - new MIB table for managing Net-SNMP access control extensions

        (see NET-SNMP-VACM-MIB).  These extensions to the VACM MIB are

        Net-SNMP specific and are used primarily by snmptrapd at this point.

      - [PATCH 1550725]: A new uint instance helper to match the existing

        int, long and ulong helpers

      - [PATCH 1534877]: to add support for skipping NFS entries in the

        host resources hrStorageTable.	See the skipNFSInHostResources

        token in the snmpd.conf file for details.

      - A "hardware abstraction layer", to localise the O/S-specific

        aspects of retrieving system data.  This first appeared in the

        5.3.x line, but this release now starts to actively use it for

        implementing particular MIB modules.

        This has resulted in some minor changes in behaviour - some index

        values in the hrStorageTable have changed from earlier releases,

        and the (non-raw) memory statistics are now consistent, reporting

        percentage usage calculated over the last minute on _all_ systems.

      - Agent builds default module list from a default_mibs.h rather than

        a hard coded configure list

      - [PATCH 1568150]: Extend pass_persist error messages that can be

	passed back from the script

      - [PATCH 1570982]: Solaris IF-MIB: Support for IPv6-only interfaces

    snmptrapd:

      - the traphandle directive now supports a -t switch to indicate

        matching any OID in the tree below the specified OID

    mib2c:

      - New mib2c.emulation.conf provides a quick way to do simplistic

        emulation of an entire MIB or MIB branch.

      - A new perl module NetSNMP::agent::Support provides easier embedded 

        perl support. (patch 1369996 from Peter Martin)

        Run "mib2c -c mib2c.perl.conf OID" to help you start using it.

    perl:

      - gettable() now supports asynchronous callback functions

      - update default_store module to latest default_store c-binding

	tokens

    snmpusm:

      - performance improvement when changing localized keys

      - new option -Cp to set usmUserPublic value

    snmpvacm:

      - new commands to manipulate Net-SNMP access control extensions

 Ports:

   Linux:

      - add IPv6 aware UDP and TCP mibs to default module list

   Solaris, FreeBSD, OpenBSD:

      - Experimental support for 64bit interface counters (ifXTable). Enable

        via '--with-mib-modules=if-mib --enable-mfd-rewrites'.

      - [PATCH 1569537,1569539]: new UDP-MIB and TCP-MIB implementation

	(enable through --with-mib-modules=udp-mib,tcp-mib)

   Win32:

      - new winExtDLL extension module to allow snmpd to load Windows SNMP

        Service extension DLLs to provide support for HOST-RESOURCES-MIB

        and other MIBs provided with Windows.

   AIX:

      - HOST-RESOURCES-MIB implementation added to default module list

   uCLinux

      - [PATCH 1551948]: Make pass_persist usable on uClinux

  Fixes:

    snmplib:

      - fix OID lookups for fully qualified object names (eg .iso.org)

        (official patch 1421725)

      - UDPIPv6 and TCPIPv6 transports now compile on recent UN*X platforms

    snmpd:

      - fix disman/event monitoring crashes (official patch 1429059)

      - fix re-init of daemons after SIGHUP (official patch 1473289)

      - fix trap processing from SMUX peers (patch 1430824)

      - [BUG 1527930]: fix smux authentication

      - [BUG 1427410]: Set auth engineID for SNMPv3 traps.

      - [BUG 1535903]: Support spaces within security names

      - fix 8 byte IpAddress in at, ip and route MIBs.

      - [PATCH 1562688]: fix ping/reattach agentx code

    snmptrapd:

      - fix bug 1420758/1458815: snmptrapd aborts/loops in select()

        (official patch 1420758)

      - fix re-init of daemons after SIGHUP (official patch 1473289)

    perl:

      - Fixed the perl bulkwalk function

      - gettable() was fairly broken in prior versions 

      - OID handling was fully broken on various 64bit platforms

      - fixes for 64-bit platforms

    misc:

      - Many misc fixes

*5.3.0.1*

  *** Security Fix ***

    - In version 5.3 much of the authorization control was rewritten.

      There was a bug in the new code that resulted in granting write

      access to read-only users or communities which were configured

      using the "rocommunity" or "rouser" snmpd.conf tokens.  5.3.0.1

      fixes this problem.  Users are encouraged to immediately update

      their installations if they use either of these tokens.

*5.3*

 *** Important Notes ***

    Several very significant changes have been made in Net-SNMP for this

    release that warrant special attention.

    - shared library version number no longer matches the release number. We

      now follow the versioning scheme recommended by libtool. For the 5.3

      release this means that the libraries now have a SONAME ending with

      ".so.10", e.g. libnetsnmp.so.10.

    - snmpd has not been truncating log files at startup, as documented in

      the man pages, for a while now. This default behaviour has been restored.

      Please use the '-A' flag if you want to continue appending to your log

      files at startup.

    - snmptrapd will no longer accept all traps by default. It must be

      configured with authorized SNMPv1/v2c community strings and/or SNMPv3

      users. Non-authorized traps/informs will be dropped.

    - Due to a copyright statement that didn't allow modifications, 

      snmpnetstat has been completely rewritten.  The new version now

      accepts the same command-line options as the other tools, which

      has introduced a number of incompatible changes.  However, it

      does now finally support SNMPv3.

 New:

    Building:

      - new option to disable set support in the agent (--disable-set-support)

   snmpd:

     - implement notification logging

     - implement notification filtering

     - AgentX, host resources and disman/event mibs added to default module list

     - updated and new disman mib implementations

   snmptrapd:

     - allow a non-default AgentX socket

     - a brand new authorization scheme that is based on the VACM

       authorization scheme from snmpd.

       - Note: now drops unauthenticated notifications by default

     - registers the snmpEngine MIB group under the "snmptrapd" context

   snmplib:

     - new helper for ascii file based scalar integers (think Linux /proc/)

     - new utilities for dealing with files

     - new utilities for parsing text files

     - granular config/persistent file disablement (noPersistentLoad and

       noPersistentSave snmp.conf tokens)

    mib2c:

      - mib2c.mfd.conf now generates code for persistence row storage

      - many enhancements and bug fixes

    snmpusm:

      - allows to use old and/or new localized key instead of passphrase with

        option -Ck

      - new option -CE to specify usmUserEngineID (necessary to manage

        snmptrapd's usmUserTable)

 Ports:

   Linux:

       - new experimental tables

         - tcpConnectionTable, tcpListenerTable

         - ipAddressPrefixTable

         - udpEndpointTable

         - ipv4InterfaceTable, ipv6InterfaceTable

       - inetCidrRouteTable supports dynamic ipv4 route creation/deletion

       - added ipv6IpForwarding.0 and ipv6IpDefaultHopLimit.0 (read-write)

   Win32:

     - Cygwin compiler fixes

     - MSVC: agent (snmpd) support for pass and pass_persist

     - MinGW: agent (snmpd) support for pass

     - Fix for 'select: No such file or directory' in snmpdelta

 Fixes:

   - Persistent files in directory defined by snmp.conf persistentDir were 

     not being loaded at startup

   - Perl getnext didn't honor explicit reference to MIB file

   - AgentX sub-agent connection delayed til after config files read

   - Build fixes for --disable-agent, --disable-snmpv1 and --disable-snmpv2c

   - Lots of bug fixes

*5.2*

 New:

    For the security paranoid (like Wes):

      - Insecure versions of SNMP may be completely disabled at compile time.

          (configure using one or both of --disable-snmpv1 --disable-snmpv2c)

      - Less secure versions of SNMPv3 authentication and encryption

          algorithms may be completely disabled at compile time.

          (configure using one or both of --disable-des --disable-md5)

          (This requires you have OpenSSL to support SHA1 and AES instead)

      - Diffie-Helman key negotiation (perfect-forward-secrecy - RFC2786)

          has been implemented in both the agent and "snmpusm".

      - Better support for direct use of localized and master keys

        (randomly generated keys have more entropy than passwords). See

        the -3m -3M -3k and -3K options, and the defAuthLocalizedKey,

        defPrivLocalizedKey, defAuthMasterKey, defPrivMasterKey

        snmp.conf tokens)

    library:

      - send and receive buffer sizes for UDP/TCP are configurable

      - .conf file token registration can now search multiple files

        (separate file names to search by a :.  IE, "snmpd:agentx")

    snmptrapd:

      - Embedded perl support for trap handlers (much faster than traphandles).

          (configure --with-embedded-perl ; see 'perldoc NetSNMP::TrapReceiver')

      - the snmptrapd usmUser table can be controlled through SNMP & AgentX

          (the snmptrapd registers MIBs under the "snmptrapd" SNMPv3 context)

    agent:

      - community strings can be mapped to individual SNMPv3 contexts

          (see the snmpd.conf manual on "com2sec").

      - AgentX should work properly with SNMPv3 contexts now.

      - improved version of "exec" extension directive - "extend":

          supports multi-line output, configurable command input, SET

          handling, a valid relocatable MIB output structure, etc

      - more flexibility added to netsnmp_cache helper, including periodic

          refreshing of caches and cache pre-loading.

      - experimental implementation of DisMan Remote Operations MIB groups

        (remote nslookup, ping, traceroute and expressions via SNMP)

      - The proxy supports a new -Cc flag which passes the community

        name through to the other side rather than hard-coding it.

      - The config_require() and other modules can now be placed

        inside of CPP directievs (#if, /* ... */) as header files are

        now passed through CPP processing first.

      - new config_exclude() macro for excluding certain modules

      - new config_belongs_in() macro to specify if a chunk of code

        found by --with-mib-modules belongs in the agent library or

        the mib module library.

      - Uses a smaller function stack.

    commands:

      - snmpusm: A number of key-change improvements

        (EG, changing localized keys supported, diffie-helman support, ...)

      - New -Ln option to completely disable logging.

    mib2c:

      - a number of new or updated configuration templates:

        - mib2c.iterate.conf: the iterator-based table config

            now produces fuller template code than before.

        - mib2c.table_data.conf and mib2c.container.conf:

            two new "internal-row" style configs

        - mib2c.mfd.conf: "MIBs for Dummies" (or MFD) - intended to

            reduce the SNMP knowledge needed to develop MIB modules

            and add flexibility at the same time.  Run "mib2c -S

            mfd_interactive_setup=1 -c mib2c.mfd.conf OID" and follow

            its guided instructions to help you tailor its results to

            meet your needs.

        - mib2c.genhtml.conf: Generates an easier-to-read HTML view of

          a MIB tree structure.  (See http://www.Net-SNMP.org/mibs/

          for example output.)

      - more node tags available for conf file writers

      - additional search directories may be set via MIB2C_DIRS env var.

      - mib2c-update: new utility to help update mib2c generated code

          when conf file changes.

      - a mib2c.conf manual page to describe how to write mib2c .conf files.

      - support for embedded perl code in mib2c.conf files

    documentation:

      - New README.agent-mibs: an attempt to start documenting what

          MIBs are implemented in the agent and on what architectures.

    perl:

      - An improved SNMP::gettable() method.  Uses GETBULK if possible and

        better GETNEXT requests if not, decodes indexes from OIDs,

        requests multiple variables at once, ...  ("perldoc SNMP" for details)

      - A NetSNMP::OID::get_indexes() function to extract index values

        from an OID.

 Ports:

   Linux:

     - new experimental tables/rewrites for Linux, including:

           ifTable, ifXTable, inetCidrRouteTable, ipCidrRouteTable,

           ipAddressTable, ipSystemStatsTable, ipNetToPhysicalTable.

       - Enable these talbles by specifying --enable-mfd-rewrites to configure.

       - Most of these tables have IPv6 support as well.

     - ifIndex no longer changes when interfaces are added/removed, and all

         tables/object wiil now use the same ifIndex for the same interface.

   Solaris:

     - new experimental support for ucd-snmp/lmSensors MIB module

   Win32:

     - Support for the MinGW compiler

     - Support for snmptrapd running as a service

     - A Win32 specific build and install script

     - Support for a .exe installer

       (we'll make binaries available using it)

 Fixes:

   - AgentX memory leak on sets

   - SNMPv3 not-in-time window after 248 days

   - Agent hang in HOST-RESOURCES MIB

   - double free on duplicate registration

   - OIDs with IP Addresses as indexes now print prettier

   -'Lazy' installation of headers (only install if newer)

   - allow whitespace in rocommunity/rwcommunity

   - many miscellaneous bug reports

*5.1.2*

 New:

   - Minor improvements to snmpdelta (error reporting)

   - Minor improvements to snmpnetstat (IPv6 output)

 Fixes:

   - Misc 64bit processor fixes.

   - Misc perl build and install fixes.

 Ports:

   - Linux 2.6 improvements

   - Win32 Suport for TCP and UDP over IPv6 via Winsock version 2

   - Win32 fixes in many places.

   - Win32 service support for snmptrapd

   - Win32 support for snmpconf

*5.1.1*

 New:

   - test suite supports testing over other transports (tcp, udp6, unix, ...)

     (see the -P switch to the testing/RUNTESTS script)

   - Solaris supports the use of it's PKCS#11 library for supporting

     cryptographic functions (OpenSSL isn't required if PKCS#11 is available)

     (see configure's --with-pkcs flag)

 Fixes:

   - Improvements on 64 bit architectures.

   - A few minor memory leaks fixed.

   - An extremely large number of minor bug fixes.

   - Many perl module specific bug fixes.

   - snmpd will safely handle more signals.

 Ports:

   - Many many significant Windows improvements.

     - AgentX support is working again under windows.

     - SCM support is built into the agent to allow the agent to be

       started as a windows service.

     - MSDOS names are supported in path names.

     - A win32 build script in win32/build.pl

     - Support for the MinGW compiler

     - (see the README.win32 file for details on new ports)

     - Various helpful win32/*.bat files for installation, etc.

   - Some linux 2.6 support improvements

*5.1*

 New:

    Building:

      - configure is now generated using autoconf 2.57.

      - The make system now supports "make uninstall"

      - configure & make supports a --with-install-prefix option

      - new configure options to disable building of the agent, apps, ...

        ./configure --help for a list of package sections that can be excluded.

      - new configure option to remove specific code pieces (mib reading, ...)

        ./configure --help for a list of code areas that can be excluded.

    snmpd:

      - linkUp and linkDown notifications can be enabled

        (see the linkUpDownNotifications snmpd.conf token documentation)

      - notifications (traps) can be generated for disman/monitor events.

        (see the snmpd.conf documentation on "monitor" and "notificatonEvent")

      - new snmpd.conf tokens:  includeAllDisks

      - the UCD-DISKIO-MIB will now work on linux.

      - com2sec mappings for SNMP over unix sockets.

      - some speed improvements have been made that should increase the

        speed of the agent's processing time.

      - for mib code using the table iterator, an auto-caching mechanism

        which can greatly speed up access at the cost of caching.

        (see "stash_cache" in the injectHandler token docs in snmpd.conf(5))

      - Some of the agent modules were completely rewritten (and

        should be faster and cleaner).

      - A number of new APIs and helper modules are available, but

        there is no major summary to easily list.

      - A number of new Net-SNMP specific MIBs now exist.

    snmptrapd:

      - snmptrapd now supports forwarding of notifications.

        (see the snmptrapd.conf manual for details)

      - snmptrapd's new -t switch can be used to disable syslog.

        (useful for a no-output snmptrapd with only traphandle support)

    apps:

      - snmptable sports 3 new options: fixed width, max-repeaters,

        left-justify.  (see snmptable -h for details)

      - mib2c walks you through instructions to help you generate code

        "just for you".  Including some new forms of output code, like

        notification code generation.  Run mib2c SOMETHING for details.

      - mib2c has about a billion other improvements, including the

        ability to generate trap generation code templates.

      - snmpwalk supports a new -Ct option for timing how long a walk takes.

      - net-snmp-config supports a number of new options.

      - All applications support a consistent -L flag for turning on

        which forms of output logging should be used.

    perl:

      - the SNMP module supports a new get_table() call.

 Fixes:

    - More patches to properly demonize snmpd (close std*, double fork, ...).

    - Version numbers of all packages/perl-modules/etc are better synchronized.

    - more documentation, especially for APIs

    - all perl module version numbers are synchronized with the

      net-snmp package.

    - Many many misc bug fixes, as always.

 Ports:

    - diskio MIB support for Darwin.

    - ifSpeed under Linux should now be correct for most network cards.

    - more windows build fixes

*5.0.9*

 SECURITY:

    - An existing user/community could get access to data in MIB

      objects that were explicitly excluded from their view.

 Fixes:

    - Perl build environment should better under Windows

    - Misc kerberos support fixes.

    - Improvements on various manual pages.

    - A annoying bug with SETs being passed to pass scripts was fixed.

    - The often talked about VACM optimization improvement was fixed again.

    - mib2c handles augmentation tables better now.

    - Various 64 bit issues have been addressed.

*5.0.8*

 New:

    - No new features will be added to the 5.0.x line.

 Ports:

    - Update libtool to version 1.4.3, for the benefit of Darwin

    - diskio support for Darwin

    - Updates for OpenBSD 3. 

    - Updates to solaris README

 Fixes:

    - find libwrap w/nsl on RedHat

    - fix for openssl 0.9.7

    - Fix some AgentX memory leaks

    - use macro for inline function prototypes

    - Attempt to find unused port before running tests

    - Use SNMP_SLEEP environment variable when running tests

    - calculate a proper ifSpeed under linux when possible

    - better daemonization of snmpd

    - close and reopen snmptrapd log files on HUP

    - support for 16 bit reuqest ids

    - Recognize new 't' code in display hints

    - misc other fixes

*5.0.7*

 New:

    - VACM (access control) optimizations which will greatly benefit

      people who wish to exclude large portions of the MIB tree from