From 98e906969d617446f06f7387e4c9e3e2d79d3545 Mon Sep 17 00:00:00 2001 From: Steve Wilton Date: Sun, 15 Mar 2026 14:21:10 +0800 Subject: [PATCH 1/4] Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) security protocols (#21451) --- ext/snmp/snmp.c | 38 ++++++++++++++++++- .../tests/snmp-object-setSecurity_error.phpt | 4 +- ext/snmp/tests/snmp3-error.phpt | 2 +- 3 files changed, 39 insertions(+), 5 deletions(-) diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c index 44f714bf0368..ca660dbaedd9 100644 --- a/ext/snmp/snmp.c +++ b/ext/snmp/snmp.c @@ -1060,13 +1060,47 @@ static ZEND_ATTRIBUTE_NONNULL bool snmp_session_set_sec_protocol(struct snmp_ses s->securityPrivProtoLen = USM_PRIV_PROTO_AES_LEN; return true; } + +# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04 + if (zend_string_equals_literal_ci(prot, "AES192")) { + s->securityPrivProto = usmAES192PrivProtocol; + s->securityPrivProtoLen = OID_LENGTH(usmAES192PrivProtocol); + return true; + } + + if (zend_string_equals_literal_ci(prot, "AES256")) { + s->securityPrivProto = usmAES256PrivProtocol; + s->securityPrivProtoLen = OID_LENGTH(usmAES256PrivProtocol); + return true; + } + + if (zend_string_equals_literal_ci(prot, "AES192C")) { + s->securityPrivProto = usmAES192CiscoPrivProtocol; + s->securityPrivProtoLen = OID_LENGTH(usmAES192CiscoPrivProtocol); + return true; + } + + if (zend_string_equals_literal_ci(prot, "AES256C")) { + s->securityPrivProto = usmAES256CiscoPrivProtocol; + s->securityPrivProtoLen = OID_LENGTH(usmAES256CiscoPrivProtocol); + return true; + } +# endif #endif #ifdef HAVE_AES -# ifndef NETSNMP_DISABLE_DES - zend_value_error("Security protocol must be one of \"DES\", \"AES128\", or \"AES\""); +# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04 +# ifndef NETSNMP_DISABLE_DES + zend_value_error("Security protocol must be one of \"AES256\", \"AES256C\", \"AES192\", \"AES192C\", \"AES128\", \"AES\", or \"DES\""); +# else + zend_value_error("Security protocol must be one of \"AES256\", \"AES256C\", \"AES192\", \"AES192C\", \"AES128\", or \"AES\""); +# endif # else +# ifndef NETSNMP_DISABLE_DES + zend_value_error("Security protocol must be one of \"AES128\", \"AES\", or \"DES\""); +# else zend_value_error("Security protocol must be one of \"AES128\", or \"AES\""); +# endif # endif #else # ifndef NETSNMP_DISABLE_DES diff --git a/ext/snmp/tests/snmp-object-setSecurity_error.phpt b/ext/snmp/tests/snmp-object-setSecurity_error.phpt index 576ec8380804..56565bf5855e 100644 --- a/ext/snmp/tests/snmp-object-setSecurity_error.phpt +++ b/ext/snmp/tests/snmp-object-setSecurity_error.phpt @@ -72,8 +72,8 @@ bool(false) Warning: SNMP::setSecurity(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d bool(false) -Security protocol must be one of "DES", "AES128", or "AES" -Security protocol must be one of "DES", "AES128", or "AES" +Security protocol must be one of %s +Security protocol must be one of %s Warning: SNMP::setSecurity(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d bool(false) diff --git a/ext/snmp/tests/snmp3-error.phpt b/ext/snmp/tests/snmp3-error.phpt index 27cba5b48416..fbe7f500455d 100644 --- a/ext/snmp/tests/snmp3-error.phpt +++ b/ext/snmp/tests/snmp3-error.phpt @@ -68,7 +68,7 @@ bool(false) Warning: snmp3_get(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d bool(false) -Security protocol must be one of "DES", "AES128", or "AES" +Security protocol must be one of %s Warning: snmp3_get(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d bool(false) From 81051bcde1c8437ce4e1d1f117f67525da955582 Mon Sep 17 00:00:00 2001 From: Steve Wilton Date: Thu, 9 Jul 2026 22:37:15 +0800 Subject: [PATCH 2/4] Tidy up error messages --- ext/snmp/snmp.c | 22 ++++++++-------------- ext/snmp/tests/snmp3-error.phpt | 2 +- 2 files changed, 9 insertions(+), 15 deletions(-) diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c index ca660dbaedd9..219511e53479 100644 --- a/ext/snmp/snmp.c +++ b/ext/snmp/snmp.c @@ -1089,25 +1089,19 @@ static ZEND_ATTRIBUTE_NONNULL bool snmp_session_set_sec_protocol(struct snmp_ses #endif #ifdef HAVE_AES -# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04 -# ifndef NETSNMP_DISABLE_DES - zend_value_error("Security protocol must be one of \"AES256\", \"AES256C\", \"AES192\", \"AES192C\", \"AES128\", \"AES\", or \"DES\""); -# else - zend_value_error("Security protocol must be one of \"AES256\", \"AES256C\", \"AES192\", \"AES192C\", \"AES128\", or \"AES\""); -# endif -# else +zend_value_error("Security protocol must be one of " # ifndef NETSNMP_DISABLE_DES - zend_value_error("Security protocol must be one of \"AES128\", \"AES\", or \"DES\""); -# else - zend_value_error("Security protocol must be one of \"AES128\", or \"AES\""); + "\"DES\", " # endif +# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04 + "\"AES256\", \"AES256C\", \"AES192\", \"AES192C\", " # endif -#else -# ifndef NETSNMP_DISABLE_DES + \"AES128\", or \"AES\"" +); +#elifndef NETSNMP_DISABLE_DES zend_value_error("Security protocol must be \"DES\""); -# else +#else zend_value_error("No security protocol supported"); -# endif #endif return false; } diff --git a/ext/snmp/tests/snmp3-error.phpt b/ext/snmp/tests/snmp3-error.phpt index fbe7f500455d..6397c001c4eb 100644 --- a/ext/snmp/tests/snmp3-error.phpt +++ b/ext/snmp/tests/snmp3-error.phpt @@ -68,7 +68,7 @@ bool(false) Warning: snmp3_get(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d bool(false) -Security protocol must be one of %s +Security protocol must be one of %s "AES128", or "AES" Warning: snmp3_get(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d bool(false) From 444120a741f8c1c670efaec9e4b803d2f5edcb43 Mon Sep 17 00:00:00 2001 From: Steve Wilton Date: Thu, 9 Jul 2026 22:51:17 +0800 Subject: [PATCH 3/4] Missing quote --- ext/snmp/snmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c index 219511e53479..4193a075a498 100644 --- a/ext/snmp/snmp.c +++ b/ext/snmp/snmp.c @@ -1096,7 +1096,7 @@ zend_value_error("Security protocol must be one of " # ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04 "\"AES256\", \"AES256C\", \"AES192\", \"AES192C\", " # endif - \"AES128\", or \"AES\"" + "\"AES128\", or \"AES\"" ); #elifndef NETSNMP_DISABLE_DES zend_value_error("Security protocol must be \"DES\""); From bb38d2b6532ae63be433bdc235e1bacf91bf098b Mon Sep 17 00:00:00 2001 From: Steve Wilton Date: Sat, 11 Jul 2026 12:33:22 +0800 Subject: [PATCH 4/4] Change elifndef to elif !defined() --- ext/snmp/snmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c index 4193a075a498..8c84146c5107 100644 --- a/ext/snmp/snmp.c +++ b/ext/snmp/snmp.c @@ -1098,7 +1098,7 @@ zend_value_error("Security protocol must be one of " # endif "\"AES128\", or \"AES\"" ); -#elifndef NETSNMP_DISABLE_DES +#elif !defined(NETSNMP_DISABLE_DES) zend_value_error("Security protocol must be \"DES\""); #else zend_value_error("No security protocol supported");