RFC 1503
Algorithms for Automating Administration in SNMPv2 Managers
Algorithms for Automating Administration in SNMPv2 Managers ✨
okay bestie, this is RFC 1503 💖 It was written by K. McCloghrie (Hughes LAN Systems) and M. Rose (Dover Beach Consulting, Inc.) in August 1993. It's an informational memo, so it's sharing ideas rather than setting a standard 🎀 The title block doesn't list any RFCs it obsoletes or updates, so it isn't replacing or patching anything 🧚
Status of This Memo 📜
ngl this part is short and sweet 🍓 This memo provides information for the Internet community. It does not specify an Internet standard. Distribution of this memo is unlimited.
Table of Contents 💌
1. Introduction .......................................... 1
2. Implementation Model .................................. 1
3. Configuration Assumptions ............................. 3
4. Normal Operations ..................................... 4
4.1 Getting a Context Handle ............................. 4
4.2 Requesting an Operation .............................. 7
5. Determining and Using Maintenance Knowledge ........... 8
5.1 Determination of Synchronization Knowledge ........... 9
5.2 Use of Clock Synchronization Knowledge ............... 10
5.3 Determination of Secret Update Knowledge ............. 11
5.4 Use of Secret Update Knowledge ....................... 13
6. Other Kinds and Uses of Maintenance Knowledge ......... 13
7. Security Considerations ............................... 13
8. Acknowledgements ...................................... 13
9. References ............................................ 14
10. Authors' Addresses ................................... 141. Introduction 🌸
okay so when a user starts up an SNMPv2 [1] management app, it may be super useful if they only have to give the bare minimum info needed to set up and keep SNMPv2 communications going 🫶 This memo suggests one way to hit that goal ✨
2. Implementation Model 🧩
to talk about the approach in this memo, it helps to have a picture of how all the pieces of an SNMPv2 manager fit together 👀 The model we're using is in Figure 2.1. it's just for explaining things, and the approach should be easy to adapt to other models 💅
(Human) User
*
*
===========User Interface (UI)===========
*
+--------------------------+
... | Management Application N |
+---------------------------+ |
| Management Application 2 |-----+
+--------------------------+ | *
| Management Application 1 |----+ *
+--------------------------+ * *
* * *
========Management API======================
* *
* ________ *
+-------------+ / Local \ +---------------+
| Context |***/ Party \***| SNMP protocol |
| Resolver(s) | \ Database / | engine(s) |
+-------------+ \________/ +---------------+
*
*
===========Transport APIs============
*
+---------------------------------+
| Transport Stacks (e.g., UDP/IP) |
+---------------------------------+
*
Network(s)
Figure 2.1 SNMPv2 Manager Implementation Modelheads up, there could be just one SNMP protocol engine and one "context resolver" that every local management app shares 🔥 OR every app could bring its own engine and its own "context resolver". either way, they all get shared access to the local party database [2] 🦋
besides what's in the figure, the admin needs some way to get into the local party database, like to set up the starting info (secrets included) 🔐 there might also be stuff like different users having different access privileges, and/or other reasons to have multiple (coordinated) subsets of the local party database 🌈
3. Configuration Assumptions 🎀
okay so let's pretend the admin already set up a local party database for the management app 💖 it looks something like this:
partyIdentifier: initialPartyId.a.b.c.d.1
partyIndex: 1
partyTAddress: a.b.c.d:161
partyLocal: false
partyAuthProtocol: noAuth
partyPrivProtocol: noPriv
partyIdentifier: initialPartyId.a.b.c.d.2
partyIndex: 2
partyTAddress: local address
partyLocal: true
partyAuthProtocol: noAuth
partyPrivProtocol: noPriv
partyIdentifier: initialPartyId.a.b.c.d.3
partyIndex: 3
partyTAddress: a.b.c.d:161
partyLocal: false
partyAuthProtocol: md5Auth
partyPrivProtocol: noPriv
partyIdentifier: initialPartyId.a.b.c.d.4
partyIndex: 4
partyTAddress: local address
partyLocal: true
partyAuthProtocol: md5Auth
partyPrivProtocol: noPriv
contextIdentifier: initialContextId.a.b.c.d.1
contextIndex: 1
contextLocal: false
textual handle: router.xyz.com-public
contextIdentifier: initialContextId.a.b.c.d.2
contextIndex: 2
contextLocal: false
textual handle: router.xyz.com-all
aclTarget (dest. party): 1
aclSubject (src party): 2
aclResources (context): 1
aclPrivileges: get, get-next, get-bulk
aclTarget (dest. party): 3
aclSubject (src party): 4
aclResources (context): 2
aclPrivileges: get, get-next, get-bulk, setok the vibe here is that each context gets a "textual handle" attached to it 🏷️ it's just a string the admin picks to make it easier to find the right context 💅
4. Normal Operations 🦋
when the user tells the management app to do something, they shouldn't have to deal with party or context info at all 👑 that's main character energy for the user, honestly ✨
one way to pull this off: the user gives a text string naming the managed objects to work on, and the management app calls the "context resolver" to turn that into a "context handle" 🪄 later, when an SNMPv2 operation actually runs, the "context handle" and a minimal set of security requirements get handed to the management API 🔐
4.1. Getting a Context Handle ✨
Okay so a "context handle" gets made when the management application is handed a textual string, probably something the user typed in 💅. The "context resolver" then works through these steps based on what the app gave it:
(1) In the local party database, every context has its own unique string called its "textual handle". If a context's textual handle exactly matches the string, the "context resolver" returns a handle for that context.
So if the app supplies router.xyz.com-public, the resolver hands back a handle to the first context. If it supplies router.xyz.com-all, you get the second one 🦋
(2) Otherwise, if any contexts have a textual handle that is longer than the string and starts with the entire string, the "context resolver" returns a handle covering all of those contexts 🌸
So if the app supplies router.xyz.com, the resolver returns a handle to both contexts 👯♀️
(3) Otherwise, if the textual string is an IP address or a domain name that resolves to a single IP address, the "context resolver" adds a bunch of stuff to the local party database. That's a volatile noAuth/noPriv party pair, a volatile context, and a volatile access control entry allowing interrogation operations, all using the "initialPartyId" and "initialContextId" conventions. Then it returns a handle for the newly created context 🧚
So if the app supplies 89.0.0.1, the "context resolver" adds this to the local party database:
partyIdentifier: initialPartyId.89.0.0.1.1
partyIndex: 101
partyTAddress: 89.0.0.1:161
partyLocal: false
partyAuthProtocol: noAuth
partyPrivProtocol: noPriv
partyStorageType: volatile
partyIdentifier: initialPartyId.89.0.0.1.2
partyIndex: 102
partyTAddress: local address
partyLocal: true
partyAuthProtocol: noAuth
partyPrivProtocol: noPriv
partyStorageType: volatile
contextIdentifier: initialContextId.89.0.0.1.1
contextIndex: 101
contextLocal: false
contextStorageType: volatile
textual handle: 89.0.0.1
aclTarget (dest. party): 101
aclSubject (src party): 102
aclResources (context): 101
aclPrivileges: get, get-next, get-bulk
aclStorageType: volatileAnd then the resolver hands back a handle to the newly created context. Slay 💖
(4) Otherwise, if the textual string is a domain name that resolves to multiple IP addresses, then for each of those IP addresses, the "context resolver" adds a volatile noAuth/noPriv party pair, a volatile context, and a volatile access control entry allowing interrogation operations. These all use the "initialPartyId" and "initialContextId" conventions. After that, the resolver returns one handle that covers all of those newly created contexts 🎀
(5) Otherwise, if the textual string contains a '/' character, and everything to the left of the first '/' is an IP address or a domain name that resolves to a single IP address, the "context resolver" adds a volatile SNMPv1 party, a volatile context, and a volatile access control entry allowing interrogation operations to the local party database. (The SNMPv1 community string is whatever characters come after the first '/' in the textual string 🔐.) Then the resolver returns a handle for the newly created context.
So if the application supplied 89.0.0.2/public, the "context resolver" adds this:
partyIdentifier: initialPartyId.89.0.0.2.1
partyIndex: 201
partyTDomain: rfc1157Domain
partyTAddress: 89.0.0.2:161
partyLocal: false
partyAuthProtocol: rfc1157noAuth
partyAuthPrivate: public
partyPrivProtocol: noPriv
partyStorageType: volatile
contextIdentifier: initialContextId.89.0.0.2.1
contextIndex: 201
contextLocal: false
contextStorageType: volatile
textual handle: 89.0.0.2
aclTarget (dest. party): 201
aclSubject (src party): 201
aclResources (context): 201
aclPrivileges: get, get-next, get-bulk
aclStorageType: volatileand the resolver returns a handle to the newly created context 🥰
(6) Otherwise, if the textual string contains a '/' character, and everything to the left of the first '/' is a domain name that resolves to multiple IP addresses, then for each of those IP addresses, the "context resolver" adds a volatile SNMPv1 party, a volatile context, and a volatile access control entry allowing interrogation operations. The SNMPv1 community string is again whatever comes after the first '/' in the textual string. Then the resolver returns one handle identifying all of those newly created contexts 🌈
(7) Otherwise, an error is raised 💀
4.2. Requesting an Operation 🚀
Later, when an SNMPv2 operation needs to happen, the management application gives the management API a "context handle" plus a minimal set of security requirements 🫶
(1) If the "context handle" refers to a single context, then we look for all access control entries that do the following. They have that context as their aclResources, they allow the specified operation, and they have a non-local SNMPv2 party as their aclTarget that satisfies the privacy requirements. They also have a local party as their aclSubject that satisfies the authentication requirements. Those entries get identified 👑
So if the application wants to issue a get-next operation with no security requirements and supplies a "context handle" for context #1, then acl #1 gets identified ✨
(2) For each of those access control entries, the one that minimally meets the security requirements is selected for use. If no such entry is identified, and authentication requirements are present, then the operation will not be performed 😭
So if the application requests a get-next operation with no security requirements and supplies a "context handle" for context #1, and step 1 identified acl #1, then acl #1 is used because it satisfies the no-security requirements. The operation gets generated using acl #1, which means party #1, party #2, and context #1 💅
(3) Otherwise, we look for all access control entries that have that single context as their aclResources, allow the specified operation, and have a non-local SNMPv1 party as their aclTarget. If no such entry is identified, then the operation will not be performed. Otherwise, any of the identified access control entries may be selected for use 🙈
The whole point of separating out step 3 is to prefer SNMPv2 communications over SNMPv1 communications. Main character energy for SNMPv2 🌸
(4) If the "context handle" refers to more than one context, then all access control entries whose aclResources refers to any one of those contexts get identified. For each of those contexts, step 2 is performed, and any (e.g., the first) access control entry identified is selected for use. If no access control entry is identified, then step 3 is performed for each of those contexts, and any (e.g., the first) access control entry identified is selected for use 🦋
So if the application wants to issue a get-bulk operation with no security requirements and supplies a "context handle" that identifies contexts #1 and #2, then acls #1 and #2 get identified in step 1. In step 2, party #1, party #2, and context #1 get selected 🍓
But if the application wants to issue an authenticated get-bulk operation and supplies a "context handle" that identifies contexts #1 and #2, then acls #1 and #2 still get identified in step 1. This time, though, in step 2 only acl #2 satisfies the security requirement. So party #3, party #4, and context #2 get selected 🔥
(5) If no access control entry is identified, then an error is raised 💀
Note that for steps 1 and 3, an implementation might choose to pre-compute (i.e., cache) the access control entries for each context, meaning those that have that context as their aclResources 🧠
5. Determining and Using Maintenance Knowledge ✨
okay so when you're using authentication services, there are two "maintenance" jobs that have to happen: clock synchronization and secret update 🕰️🔐. These should happen transparently, totally independent of the management apps, with zero user or admin intervention. Main character energy for the engine 💅. To be invisible like that, the SNMP protocol engine has to keep "maintenance knowledge" (which parties and contexts to use) 🧠. It's way better if that knowledge gets figured out at run-time instead of an admin typing it in by hand 🙈.
One way to make that happen: the first time the SNMP protocol engine realizes it's going to be talking to another SNMPv2 entity, it checks its own local party database first, then interrogates its peer, and only then starts the actual communications 🦋.
Here's the tea 🍵: both the clock synchronization knowledge and the secret update knowledge tied to a party can each be represented as (a pointer to) an access control entry 💜. And once an implementation has worked all this out, it's allowed to keep that knowledge across restarts so it doesn't have to redo the whole dance 🌸.
5.1. Determination of Synchronization Knowledge
To figure out the maintenance knowledge for clock synchronization, here's the routine 🎀:
(1) The SNMP protocol engine checks out each active, non-local, noAuth party.
So, this is party #1 🌷.
(2) For each of those parties, P, we find all the access control entries that have that party as their aclTarget AND that allow the get-bulk operation 🔍.
So, for party #1, this is acl #1 ✨.
(3) For each of those access control entries, A, there has to be at least one active, non-local, md5Auth party, Q, that meets all of these criteria 📋:
- the transport domain and address of P and Q are identical;
- an access control entry, B, exists that has either Q as its
aclTargetand a local party, R, as itsaclSubject, OR Q as itsaclSubjectand a local party, R, as itsaclTarget; and, - no clock synchronization knowledge is known for R.
So, for acl #1, party #3 is the one that matches: it has the same transport domain and address as party #1, and it shows up as the aclTarget in acl #2, which has local party #4 as the aclSubject 🥰.
(4) Whenever a party, Q, like that is present, then all the instances of the partyAuthProtocol and partyAuthClock objects get pulled via the get-bulk operator, using the parties and context from the access control entry, A 📦.
So, party #1, party #2, and context #1 are used to sweep these two columns on the agent 🧹.
(5) Only the instances that match parties in the local database, which have no clock synchronization knowledge, AND are local mdAuth parties, get examined 👀.
So, only the instances for party #4 get examined 💅.
(6) For each instance of partyAuthProtocol: if its value doesn't match the value in the local database, a configuration error gets signalled and that party gets marked as unavailable for maintenance knowledge 🚨.
So, we make sure the manager and the agent agree that party #4 is an md5Auth party 🤝.
(7) For each instance of partyAuthClock: if its value is greater than the value in the local database, the party's authentication clock gets warped according to the procedures in Section 5.3 of [3] 🌀. Either way, A gets recorded as the clock synchronization knowledge for the matching party 📝.
So, if the column sweep returns info for party #4, then party #4's authentication clock gets advanced if it needs to be, and the clock synchronization knowledge for party #4 is recorded as acl #1 🎉.
5.2. Use of Clock Synchronization Knowledge
Whenever a response to an authenticated operation doesn't come back, the SNMP protocol engine may suspect that a clock synchronization problem for the source party is the culprit [3] 🕵️♀️. The engine can use different criteria to make that call 💭. For example: on a retrieval operation, the operation might get retried using an exponential back-off algorithm 🔁. On a modification operation, though, it would NOT get automatically retried 🙅♀️.
Now, when clock mis-synchronization for a source party, S, is suspected, and clock synchronization knowledge for S is present, that knowledge gets used to run steps 4-7 from above 🔄. Those steps should retrieve the instances of the partyAuthProtocol and partyAuthClock objects that match S (and maybe other parties too) 🍓. If info on those objects can't be determined, then S gets marked as no longer having clock synchronization knowledge 💔. Otherwise, if the value of the matching partyAuthClock instance is greater than the value in the local database, the party's authentication clock gets warped according to Section 5.3 of [3], and the original operation gets retried, if that's appropriate 🔁✨.
So, if traffic from party #4 times out, a column sweep kicks off automatically, using acl #1 (party #1, party #2, context #1) 🚀.
Now, when clock mis-synchronization for a source party, S, is suspected, and clock synchronization knowledge for S is NOT present, then the full algorithm above can be used 🧩. In this case, if clock synchronization knowledge for S can be determined, and as a result the partyAuthClock value for S in the local database gets warped according to Section 5.3 of [3], then the original operation gets retried, if that's appropriate 🌈.
5.3. Determination of Secret Update Knowledge
To figure out the maintenance knowledge for secret update 🔑:
(1) The SNMP protocol engine checks out each active, non-local, md5Auth party.
So, this is party #3 🥳.
(2) For each of those parties, P, we find all the access control entries that have that party as their aclTarget AND that allow the get-bulk AND set operations 🔎.
So, for party #3, this is acl #2 💜.
(3) For each of those access control entries, A, there has to be at least one active, non-local, md5Auth party, Q, that meets all of these criteria 📋:
- the transport domain and address of P and Q are identical;
- an access control entry, B, exists that has either Q as its
aclTargetand a local party, R, as itsaclSubject, OR Q as itsaclSubjectand a local party, R, as itsaclTarget; and, - no secret update knowledge is known for R.
So, for acl #2, party #3 is (redundantly) identified as having the same transport domain and address as party #3, and it shows up as the aclTarget in acl #2, which has local party #4 as the aclSubject 🙃.
(4) Whenever a party, Q, like that is present, then all the instances of the partyAuthProtocol, partyAuthClock, and partyAuthPrivate objects get pulled via the get-bulk operator, using the parties and context from the access control entry, A 📦.
So, party #3, party #4, and context #2 are used to sweep these three columns on the agent 🧹.
(5) Only the instances that match parties in the local database, which have no secret update knowledge AND are md5Auth parties, get examined 👀.
So, only the instances for parties #3 and #4 get examined 💁♀️.
(6) For each instance of partyAuthProtocol: if its value doesn't match the value in the local database, a configuration error gets signalled and this party gets marked as unavailable for maintenance knowledge 🚫.
So, we make sure the manager and the agent agree that both party #3 and party #4 are md5Auth parties 🫶.
(7) For each instance of partyAuthPrivate: if a matching instance of partyAuthClock was also returned, then A gets recorded as the secret update knowledge for this party 📜.
So, if the column sweep returned info on party #3, then the clock synchronization knowledge for party #3 would be recorded as acl #2. Further, if the column sweep returned info on party #4, then the clock synchronization knowledge for party #4 would be recorded as acl #2 💖. (Yes, that's the secret update knowledge being saved, bestie, just wearing a different outfit 😌.)
5.4. Use of Secret Update Knowledge
Whenever the SNMP protocol engine figures out that the authentication clock of a party, S, is approaching an upper limit, AND secret update knowledge for S is present, that knowledge gets used to modify the current secret of S and reset the authentication clock of S, following the procedures in Section 5.4 of [3] 🔄🔐✨.
So, whenever the SNMP protocol engine decides to update the secrets for party #4, it can automatically use acl #2 (party #3, party #4, context #2) for this purpose 🎯.
6. Other Kinds and Uses of Maintenance Knowledge 🌸
Heads up, readers 👀: there are other kinds of maintenance knowledge that an SNMPv2 manager could work out and use too 💫. To keep things short, we'll only look at one example: when an SNMPv2 manager first talks to an agent, it may want to sync up the maximum-message size values that it and the agent each hold 📏.
For the parties that run at the agent, the manager retrieves the matching instances of partyMaxMessageSize (preferrably using authentication) and, if it needs to, adjusts the values in the manager's local party database 🛠️. So the maintenance knowledge that gets determined has to allow for retrieval of partyMaxMessageSize 🧠.
For the parties that run at the manager, the manager retrieves the matching instances of partyMaxMessageSize (using authentication) and, if it needs to, adjusts the values in the agent's local party database using the set operation 🪄. So the maintenance knowledge that gets determined has to allow for BOTH retrieval AND modification of partyMaxMessageSize 👑.
7. Security Considerations 🚨
Security issues are not discussed in this memo. 🙈 Please keep this in mind, bestie: this document does not cover them 🥺.
8. Acknowledgements 🫶
Jeffrey D. Case of SNMP Research and the University of Tennessee, and Robert L. Stewart of Xyplex, both gave helpful comments on the ideas in this document and how those ideas were presented 💜🙌.
9. References 🧾
okay bestie, here are the receipts 💅 These are the sources the doc leans on, listed with every detail so nothing gets lost.
- [1] Case, J., McCloghrie, K., Rose, M., and S. Waldbusser, "Introduction to version 2 of the Internet-standard Network Management Framework", RFC 1441, SNMP Research, Inc., Hughes LAN Systems, Dover Beach Consulting, Inc., Carnegie Mellon University, April 1993.
- [2] McCloghrie, K., and J. Galvin, "Party MIB for version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1447, Hughes LAN Systems, Trusted Information Systems, April 1993.
- [3] Galvin, J., and K. McCloghrie, "Security Protocols for version 2 of the Simple Network Management Protocol (SNMPv2)", RFC 1446, Trusted Information Systems, Hughes LAN Systems, April 1993.
10. Authors' Addresses 💌
and finally, who to slide into the DMs 🫶 These are the authors' contact details, copied exactly.
Keith McCloghrie
Hughes LAN Systems
1225 Charleston Road
Mountain View, CA 94043
US
Phone: +1 415 966 7934
EMail: kzm@hls.com
Marshall T. Rose
Dover Beach Consulting, Inc.
420 Whisman Court
Mountain View, CA 94043-2186
US
Phone: +1 415 968 1052
EMail: mrose@dbc.mtview.ca.usand that's the whole doc, periodt 🌈✨
📦 where this page comes from
- ietf: rfc1503 1993-08
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms