import CS net-snmp-5.8-30.el8

import UBI net-snmp-5.8-28.el8
import UBI net-snmp-5.8-27.el8_8.1
2024-05-22 10:45:17 +00:00 · 2023-11-14 19:54:41 +00:00 · 2023-11-08 12:37:46 +00:00 · 2023-05-16 06:33:36 +00:00 · 2023-01-12 09:28:02 +00:00 · 2022-05-10 07:21:23 +00:00
39 changed files with 3235 additions and 8 deletions
--- a/.net-snmp.metadata
+++ b/.net-snmp.metadata
@ -1 +1 @@
-78f70731df9dcdb13fe8f60eb7d80d7583da4d2c SOURCES/net-snmp-5.8.tar.gz
+81654b086af051edbe7e03ba49672aa0c2ab1d38 SOURCES/net-snmp-5.8.tar.gz
--- a/SOURCES/net-snmp-5.7.2-CVE-2020-15862.patch
+++ b/SOURCES/net-snmp-5.7.2-CVE-2020-15862.patch
@ -0,0 +1,70 @@
+diff -urNp old/agent/mibgroup/agent/extend.c new/agent/mibgroup/agent/extend.c
+--- old/agent/mibgroup/agent/extend.c	2020-11-11 12:41:46.377115142 +0100
+++ new/agent/mibgroup/agent/extend.c	2020-11-11 12:50:28.047142105 +0100
+@@ -16,6 +16,12 @@
+ #define SHELLCOMMAND 3
+ #endif
+ 
+/*  This mib is potentially dangerous to turn on by default, since it
+ *  allows arbitrary commands to be set by anyone with SNMP WRITE
+ *  access to the MIB table.  If all of your users are "root" level
+ *  users, then it may be safe to turn on. */
+#define ENABLE_EXTEND_WRITE_ACCESS 0
+
+ netsnmp_feature_require(extract_table_row_data)
+ netsnmp_feature_require(table_data_delete_table)
+ #ifndef NETSNMP_NO_WRITE_SUPPORT
+@@ -723,7 +729,7 @@ handle_nsExtendConfigTable(netsnmp_mib_h
+          *
+          **********/
+ 
+-#ifndef NETSNMP_NO_WRITE_SUPPORT
+#if !defined(NETSNMP_NO_WRITE_SUPPORT) && ENABLE_EXTEND_WRITE_ACCESS
+         case MODE_SET_RESERVE1:
+             /*
+              * Validate the new assignments
+@@ -1049,7 +1055,7 @@ handle_nsExtendConfigTable(netsnmp_mib_h
+                 }
+             }
+             break;
+-#endif /* !NETSNMP_NO_WRITE_SUPPORT */ 
+#endif /* !NETSNMP_NO_WRITE_SUPPORT and ENABLE_EXTEND_WRITE_ACCESS */
+ 
+         default:
+             netsnmp_set_request_error(reqinfo, request, SNMP_ERR_GENERR);
+@@ -1057,7 +1063,7 @@ handle_nsExtendConfigTable(netsnmp_mib_h
+         }
+     }
+ 
+-#ifndef NETSNMP_NO_WRITE_SUPPORT
+#if !defined(NETSNMP_NO_WRITE_SUPPORT) && ENABLE_EXTEND_WRITE_ACCESS
+     /*
+      * If we're marking a given row as active,
+      *  then we need to check that it's ready.
+@@ -1082,7 +1088,7 @@ handle_nsExtendConfigTable(netsnmp_mib_h
+             }
+         }
+     }
+-#endif /* !NETSNMP_NO_WRITE_SUPPORT */
+#endif /* !NETSNMP_NO_WRITE_SUPPORT && ENABLE_EXTEND_WRITE_ACCESS */
+     
+     return SNMP_ERR_NOERROR;
+ }
+@@ -1571,7 +1577,7 @@ fixExec2Error(int action,
+     idx = name[name_len-1] -1;
+     exten = &compatability_entries[ idx ];
+ 
+-#ifndef NETSNMP_NO_WRITE_SUPPORT
+#if !defined(NETSNMP_NO_WRITE_SUPPORT) && ENABLE_EXTEND_WRITE_ACCESS
+     switch (action) {
+     case MODE_SET_RESERVE1:
+         if (var_val_type != ASN_INTEGER) {
+@@ -1592,7 +1598,7 @@ fixExec2Error(int action,
+     case MODE_SET_COMMIT:
+         netsnmp_cache_check_and_reload( exten->efix_entry->cache );
+     }
+-#endif /* !NETSNMP_NO_WRITE_SUPPORT */
+#endif /* !NETSNMP_NO_WRITE_SUPPORT && ENABLE_EXTEND_WRITE_ACCESS */
+     return SNMP_ERR_NOERROR;
+ }
+ #endif /* USING_UCD_SNMP_EXTENSIBLE_MODULE */
--- a/SOURCES/net-snmp-5.8-CVE-2022-24805-24810.patch
+++ b/SOURCES/net-snmp-5.8-CVE-2022-24805-24810.patch
@ -0,0 +1,163 @@
+From 9a0cd7c00947d5e1c6ceb54558d454f87c3b8341 Mon Sep 17 00:00:00 2001
+From: Bill Fenner <fenner@gmail.com>
+Date: Tue, 24 Aug 2021 07:55:00 -0700
+Subject: [PATCH] CHANGES: snmpd: recover SET status from delegated request
+
+Reported by: Yu Zhang of VARAS@IIE, Nanyu Zhong of VARAS@IIE
+Fixes by: Arista Networks
+
+When a SET request includes a mix of delegated and
+non-delegated requests (e.g., objects handled by master
+agent and agentx sub-agent), the status can get lost while
+waiting for the reply from the sub-agent.  Recover the status
+into the session from the requests even if it has already
+been processed.
+---
+ agent/snmp_agent.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c
+index 84fbb42b47..095ee70985 100644
+--- a/agent/snmp_agent.c
+++ b/agent/snmp_agent.c
+@@ -2965,7 +2965,7 @@ netsnmp_check_requests_status(netsnmp_agent_session *asp,
+         if (requests->status != SNMP_ERR_NOERROR &&
+             (!look_for_specific || requests->status == look_for_specific)
+             && (look_for_specific || asp->index == 0
+-                || requests->index < asp->index)) {
+                || requests->index <= asp->index)) {
+             asp->index = requests->index;
+             asp->status = requests->status;
+         }
+From 67ebb43e9038b2dae6e74ae8838b36fcc10fc937 Mon Sep 17 00:00:00 2001
+From: Bill Fenner <fenner@gmail.com>
+Date: Wed, 30 Jun 2021 14:00:28 -0700
+Subject: [PATCH] CHANGES: snmpd: fix bounds checking in NET-SNMP-AGENT-MIB,
+ NET-SNMP-VACM-MIB, SNMP-VIEW-BASED-ACM-MIB, SNMP-USER-BASED-SM-MIB
+
+Reported by: Yu Zhang of VARAS@IIE, Nanyu Zhong of VARAS@IIE
+Fixes by: Arista Networks
+---
+ agent/mibgroup/agent/nsLogging.c         |  6 ++++++
+ agent/mibgroup/agent/nsVacmAccessTable.c | 16 ++++++++++++++--
+ agent/mibgroup/mibII/vacm_vars.c         |  3 +++
+ agent/mibgroup/snmpv3/usmUser.c          |  2 --
+ 4 files changed, 23 insertions(+), 4 deletions(-)
+
+diff --git a/agent/mibgroup/agent/nsLogging.c b/agent/mibgroup/agent/nsLogging.c
+index 9abdeb5bb7..7f4290490a 100644
+--- a/agent/mibgroup/agent/nsLogging.c
+++ b/agent/mibgroup/agent/nsLogging.c
+@@ -147,6 +147,8 @@ handle_nsLoggingTable(netsnmp_mib_handler *handler,
+                 continue;
+             logh = (netsnmp_log_handler*)netsnmp_extract_iterator_context(request);
+             table_info  =                netsnmp_extract_table_info(request);
+            if (!table_info || !table_info->indexes)
+                continue;
+ 
+             switch (table_info->colnum) {
+             case NSLOGGING_TYPE:
+@@ -201,6 +203,8 @@ handle_nsLoggingTable(netsnmp_mib_handler *handler,
+             }
+             logh = (netsnmp_log_handler*)netsnmp_extract_iterator_context(request);
+             table_info  =                 netsnmp_extract_table_info(request);
+            if (!table_info || !table_info->indexes)
+                continue;
+ 
+             switch (table_info->colnum) {
+             case NSLOGGING_TYPE:
+@@ -394,6 +398,8 @@ handle_nsLoggingTable(netsnmp_mib_handler *handler,
+                 continue;
+             logh = (netsnmp_log_handler*)netsnmp_extract_iterator_context(request);
+             table_info  =                 netsnmp_extract_table_info(request);
+            if (!table_info || !table_info->indexes)
+                continue;
+ 
+             switch (table_info->colnum) {
+             case NSLOGGING_TYPE:
+diff --git a/agent/mibgroup/agent/nsVacmAccessTable.c b/agent/mibgroup/agent/nsVacmAccessTable.c
+index cc61fce7e6..6c43210074 100644
+--- a/agent/mibgroup/agent/nsVacmAccessTable.c
+++ b/agent/mibgroup/agent/nsVacmAccessTable.c
+@@ -170,9 +170,13 @@ nsVacmAccessTable_handler(netsnmp_mib_handler *handler,
+             entry = (struct vacm_accessEntry *)
+                 netsnmp_extract_iterator_context(request);
+             table_info = netsnmp_extract_table_info(request);
+            if (!table_info || !table_info->indexes)
+                continue;
+ 
+             /* Extract the authType token from the list of indexes */
+             idx = table_info->indexes->next_variable->next_variable->next_variable->next_variable;
+            if (idx->val_len >= sizeof(atype))
+                continue;
+             memset(atype, 0, sizeof(atype));
+             memcpy(atype, (char *)idx->val.string, idx->val_len);
+             viewIdx = se_find_value_in_slist(VACM_VIEW_ENUM_NAME, atype);
+@@ -212,6 +216,8 @@ nsVacmAccessTable_handler(netsnmp_mib_handler *handler,
+             entry = (struct vacm_accessEntry *)
+                 netsnmp_extract_iterator_context(request);
+             table_info = netsnmp_extract_table_info(request);
+            if (!table_info || !table_info->indexes)
+                continue;
+             ret = SNMP_ERR_NOERROR;
+ 
+             switch (table_info->colnum) {
+@@ -247,6 +253,8 @@ nsVacmAccessTable_handler(netsnmp_mib_handler *handler,
+                  * Extract the authType token from the list of indexes
+                  */
+                 idx = table_info->indexes->next_variable->next_variable->next_variable->next_variable;
+                if (idx->val_len >= sizeof(atype))
+                    continue;
+                 memset(atype, 0, sizeof(atype));
+                 memcpy(atype, (char *)idx->val.string, idx->val_len);
+                 viewIdx = se_find_value_in_slist(VACM_VIEW_ENUM_NAME, atype);
+@@ -294,8 +302,10 @@ nsVacmAccessTable_handler(netsnmp_mib_handler *handler,
+                          idx = idx->next_variable;  model = *idx->val.integer;
+                          idx = idx->next_variable;  level = *idx->val.integer;
+                          entry = vacm_createAccessEntry( gName, cPrefix, model, level );
+-                         entry->storageType = ST_NONVOLATILE;
+-                         netsnmp_insert_iterator_context(request, (void*)entry);
+                         if (entry) {
+                             entry->storageType = ST_NONVOLATILE;
+                             netsnmp_insert_iterator_context(request, (void*)entry);
+                         }
+                     }
+                 }
+             }
+@@ -321,6 +331,8 @@ nsVacmAccessTable_handler(netsnmp_mib_handler *handler,
+ 
+             /* Extract the authType token from the list of indexes */
+             idx = table_info->indexes->next_variable->next_variable->next_variable->next_variable;
+            if (idx->val_len >= sizeof(atype))
+                continue;
+             memset(atype, 0, sizeof(atype));
+             memcpy(atype, (char *)idx->val.string, idx->val_len);
+             viewIdx = se_find_value_in_slist(VACM_VIEW_ENUM_NAME, atype);
+diff --git a/agent/mibgroup/mibII/vacm_vars.c b/agent/mibgroup/mibII/vacm_vars.c
+index 469a1eba59..62c9a3d051 100644
+--- a/agent/mibgroup/mibII/vacm_vars.c
+++ b/agent/mibgroup/mibII/vacm_vars.c
+@@ -997,6 +997,9 @@ access_parse_oid(oid * oidIndex, size_t oidLen,
+         return 1;
+     }
+     groupNameL = oidIndex[0];
+    if ((groupNameL + 1) > (int) oidLen) {
+        return 1;
+    }
+     contextPrefixL = oidIndex[groupNameL + 1];  /* the initial name length */
+     if ((int) oidLen != groupNameL + contextPrefixL + 4) {
+         return 1;
+diff --git a/agent/mibgroup/snmpv3/usmUser.c b/agent/mibgroup/snmpv3/usmUser.c
+index 0f52aaba49..0edea53cfb 100644
+--- a/agent/mibgroup/snmpv3/usmUser.c
+++ b/agent/mibgroup/snmpv3/usmUser.c
+@@ -1505,8 +1505,6 @@ write_usmUserStatus(int action,
+                 if (usmStatusCheck(uptr)) {
+                     uptr->userStatus = RS_ACTIVE;
+                 } else {
+-                    SNMP_FREE(engineID);
+-                    SNMP_FREE(newName);
+                     return SNMP_ERR_INCONSISTENTVALUE;
+                 }
+             } else if (long_ret == RS_CREATEANDWAIT) {
+
--- a/SOURCES/net-snmp-5.8-CVE-2022-44792-44793.patch
+++ b/SOURCES/net-snmp-5.8-CVE-2022-44792-44793.patch
@ -0,0 +1,129 @@
+From 4589352dac3ae111c7621298cf231742209efd9b Mon Sep 17 00:00:00 2001
+From: Bill Fenner <fenner@gmail.com>
+Date: Fri, 25 Nov 2022 08:41:24 -0800
+Subject: [PATCH 1/3] snmp_agent: disallow SET with NULL varbind
+
+---
+ agent/snmp_agent.c | 32 ++++++++++++++++++++++++++++++++
+ 1 file changed, 32 insertions(+)
+
+diff --git a/agent/snmp_agent.c b/agent/snmp_agent.c
+index 867d0c166f..3f678fe2df 100644
+--- a/agent/snmp_agent.c
+++ b/agent/snmp_agent.c
+@@ -3719,12 +3719,44 @@ netsnmp_handle_request(netsnmp_agent_session *asp, int status)
+     return 1;
+ }
+ 
+static int
+check_set_pdu_for_null_varbind(netsnmp_agent_session *asp)
+{
+    int i;
+    netsnmp_variable_list *v = NULL;
+
+    for (i = 1, v = asp->pdu->variables; v != NULL; i++, v = v->next_variable) {
+	if (v->type == ASN_NULL) {
+	    /*
+	     * Protect SET implementations that do not protect themselves
+	     * against wrong type.
+	     */
+	    DEBUGMSGTL(("snmp_agent", "disallowing SET with NULL var for varbind %d\n", i));
+	    asp->index = i;
+	    return SNMP_ERR_WRONGTYPE;
+	}
+    }
+    return SNMP_ERR_NOERROR;
+}
+
+ int
+ handle_pdu(netsnmp_agent_session *asp)
+ {
+     int             status, inclusives = 0;
+     netsnmp_variable_list *v = NULL;
+ 
+#ifndef NETSNMP_NO_WRITE_SUPPORT
+    /*
+     * Check for ASN_NULL in SET request
+     */
+    if (asp->pdu->command == SNMP_MSG_SET) {
+	status = check_set_pdu_for_null_varbind(asp);
+	if (status != SNMP_ERR_NOERROR) {
+	    return status;
+	}
+    }
+#endif /* NETSNMP_NO_WRITE_SUPPORT */
+
+     /*
+      * for illegal requests, mark all nodes as ASN_NULL 
+      */
+
+From 7f4ac4051cc7fec6a5944661923acb95cec359c7 Mon Sep 17 00:00:00 2001
+From: Bill Fenner <fenner@gmail.com>
+Date: Fri, 25 Nov 2022 08:41:46 -0800
+Subject: [PATCH 2/3] apps: snmpset: allow SET with NULL varbind for testing
+
+---
+ apps/snmpset.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/apps/snmpset.c b/apps/snmpset.c
+index 48e14bd513..d542713e1b 100644
+--- a/apps/snmpset.c
+++ b/apps/snmpset.c
+@@ -182,6 +182,7 @@ main(int argc, char *argv[])
+             case 'x':
+             case 'd':
+             case 'b':
+            case 'n': /* undocumented */
+ #ifdef NETSNMP_WITH_OPAQUE_SPECIAL_TYPES
+             case 'I':
+             case 'U':
+
+From 15f9d7f7e5b90c9b419832ed8e6413feb6570d83 Mon Sep 17 00:00:00 2001
+From: Bill Fenner <fenner@gmail.com>
+Date: Fri, 25 Nov 2022 10:23:32 -0800
+Subject: [PATCH 3/3] Add test for NULL varbind set
+
+---
+ .../default/T0142snmpv2csetnull_simple        | 31 +++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+ create mode 100644 testing/fulltests/default/T0142snmpv2csetnull_simple
+
+diff --git a/testing/fulltests/default/T0142snmpv2csetnull_simple b/testing/fulltests/default/T0142snmpv2csetnull_simple
+new file mode 100644
+index 0000000000..0f1b8f386b
+--- /dev/null
+++ b/testing/fulltests/default/T0142snmpv2csetnull_simple
+@@ -0,0 +1,31 @@
+#!/bin/sh
+
+. ../support/simple_eval_tools.sh
+
+HEADER SNMPv2c set of system.sysContact.0 with NULL varbind
+
+SKIPIF NETSNMP_DISABLE_SET_SUPPORT
+SKIPIF NETSNMP_NO_WRITE_SUPPORT
+SKIPIF NETSNMP_DISABLE_SNMPV2C
+SKIPIFNOT USING_MIBII_SYSTEM_MIB_MODULE
+
+#
+# Begin test
+#
+
+# standard V2C configuration: testcomunnity
+snmp_write_access='all'
+. ./Sv2cconfig
+STARTAGENT
+
+CAPTURE "snmpget -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0"
+
+CHECK ".1.3.6.1.2.1.1.4.0 = STRING:"
+
+CAPTURE "snmpset -On $SNMP_FLAGS -c testcommunity -v 2c $SNMP_TRANSPORT_SPEC:$SNMP_TEST_DEST$SNMP_SNMPD_PORT .1.3.6.1.2.1.1.4.0 n x"
+
+CHECK "Reason: wrongType"
+
+STOPAGENT
+
+FINISHED
+
--- a/SOURCES/net-snmp-5.8-aes-config.patch
+++ b/SOURCES/net-snmp-5.8-aes-config.patch
@ -0,0 +1,100 @@
+From 0be093688013b90896f2db3204bb20e790d70149 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 27 Apr 2020 08:23:16 -0700
+Subject: [PATCH] configure: Report supported authentication and encryption
+ modes correctly
+
+Commit 9e49de2e03b1 ("NEWS: snmplib: AES-192/AES-256 compatibility with SNMP
+Research / CISCO") removed SHA-128 and SHA-192 support and added support for
+SHA-224, SHA-256, SHA-384 and SHA-512. Commit 329a9d3c9d63 ("revamp auth/priv
+protocol constants handling") added support for several AES encryption modes.
+Make the configure script report which modes are supported.
+---
+ configure                   | 15 ++++++++++++++-
+ configure.d/config_os_misc2 | 15 ++++++++++++++-
+ 2 files changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/configure b/configure
+index 46402589f..7481ebd07 100755
+--- a/configure
+++ b/configure
+@@ -26453,7 +26453,13 @@ $as_echo "#define NETSNMP_USE_INTERNAL_CRYPTO 1" >>confdefs.h
+     { $as_echo "$as_me:${as_lineno-$LINENO}: result: Internal Crypto Support" >&5
+ $as_echo "Internal Crypto Support" >&6; }
+ elif test "x$useopenssl" != "xno" ; then
+-    authmodes="MD5 SHA1 SHA512 SHA384 SHA256 SHA192"
+    authmodes="MD5 SHA1"
+    if test "x$ac_cv_func_EVP_sha224" = xyes; then
+        authmodes="$authmodes SHA224 SHA256"
+    fi
+    if test "x$ac_cv_func_EVP_sha384" = xyes; then
+        authmodes="$authmodes SHA384 SHA512"
+    fi
+     if test "x$enable_privacy" != "xno" ; then
+         if test "x$ac_cv_header_openssl_aes_h" = "xyes" ; then
+             encrmodes="DES AES"
+@@ -26492,6 +26498,13 @@ fi
+ if test "x$enable_md5" = "xno"; then
+     authmodes=`echo $authmodes | $SED 's/MD5 *//;'`
+ fi
+if test "x$ac_cv_func_AES_cfb128_encrypt" = xyes ||
+   test "x$CRYPTO" = xinternal; then
+    encrmodes="$encrmodes AES128"
+    if test "x$aes_capable" = "xyes"; then
+        encrmodes="$encrmodes AES192 AES192C AES256 AES256C"
+    fi
+fi
+ 
+ 
+ 
+diff --git a/configure.d/config_os_misc2 b/configure.d/config_os_misc2
+index 1df9bf0a2..be0bccec0 100644
+--- a/configure.d/config_os_misc2
+++ b/configure.d/config_os_misc2
+@@ -53,7 +53,13 @@ if test "x$CRYPTO" = "xinternal" ; then
+     AC_DEFINE(NETSNMP_USE_INTERNAL_CRYPTO, 1, "Define if internal cryptography code should be used")
+     AC_MSG_RESULT(Internal Crypto Support)
+ elif test "x$useopenssl" != "xno" ; then
+-    authmodes="MD5 SHA1 SHA512 SHA384 SHA256 SHA192"
+    authmodes="MD5 SHA1"
+    if test "x$ac_cv_func_EVP_sha224" = xyes; then
+        authmodes="$authmodes SHA224 SHA256"
+    fi
+    if test "x$ac_cv_func_EVP_sha384" = xyes; then
+        authmodes="$authmodes SHA384 SHA512"
+    fi
+     if test "x$enable_privacy" != "xno" ; then
+         if test "x$ac_cv_header_openssl_aes_h" = "xyes" ; then
+             encrmodes="DES AES"
+@@ -86,6 +92,13 @@ fi
+ if test "x$enable_md5" = "xno"; then
+     authmodes=`echo $authmodes | $SED 's/MD5 *//;'`
+ fi
+if test "x$ac_cv_func_AES_cfb128_encrypt" = xyes ||
+   test "x$CRYPTO" = xinternal; then
+    encrmodes="$encrmodes AES128"
+    if test "x$aes_capable" = "xyes"; then
+        encrmodes="$encrmodes AES192 AES192C AES256 AES256C"
+    fi
+fi
+ AC_SUBST(LNETSNMPLIBS)
+ AC_SUBST(LAGENTLIBS)
+ 
+
+diff -urNp a/net-snmp-create-v3-user.in b/net-snmp-create-v3-user.in
+--- a/net-snmp-create-v3-user.in	2020-06-15 12:59:05.117432700 +0200
+++ b/net-snmp-create-v3-user.in	2020-06-15 13:01:36.151905241 +0200
+@@ -58,11 +58,11 @@ case $1 in
+ 	    exit 1
+ 	fi
+         case $1 in
+-            DES|AES|AES128)
+            DES|AES|AES128|AES192|AES256)
+ 	    Xalgorithm=$1
+ 	    shift
+ 	    ;;
+-            des|aes|aes128)
+            des|aes|aes128|aes192|aes256)
+ 	    Xalgorithm=`echo $1 | tr a-z A-Z`
+ 	    shift
+ 	    ;;
--- a/SOURCES/net-snmp-5.8-asn-parse-nlength.patch
+++ b/SOURCES/net-snmp-5.8-asn-parse-nlength.patch
@ -0,0 +1,86 @@
+From 92f0fe9e0dc3cf7ab6e8cc94d7962df83d0ddbec Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 4 Jan 2021 12:21:59 -0800
+Subject: [PATCH] libsnmp: Fix asn_parse_nlength()
+
+Handle length zero correctly.
+
+Fixes: https://github.com/net-snmp/net-snmp/issues/253
+Fixes: a9850f4445cf ("asn parse: add NULL checks, check length lengths")
+---
+ snmplib/asn1.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/snmplib/asn1.c b/snmplib/asn1.c
+index e983500e7..33c272768 100644
+--- a/snmplib/asn1.c
+++ b/snmplib/asn1.c
+@@ -345,7 +345,7 @@ asn_parse_nlength(u_char *pkt, size_t pkt_len, u_long *data_len)
+          * long length; first byte is length of length (after masking high bit)
+          */
+         len_len = (int) ((*pkt & ~0x80) + 1);
+-        if ((int) pkt_len <= len_len )
+        if (pkt_len < len_len)
+             return NULL;           /* still too short for length and data */
+ 
+         /* now we know we have enough data to parse length */
+From baef04f9c6fe0eb3ac74dd4d26a19264eeaf7fa1 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Mon, 4 Jan 2021 10:00:33 -0800
+Subject: [PATCH] testing/fulltests/unit-tests/T105trap_parse_clib: Add this
+ test
+
+Add a reproducer for the bug fixed by the previous patch.
+---
+ .../unit-tests/T105trap_parse_clib.c          | 41 +++++++++++++++++++
+ 1 file changed, 41 insertions(+)
+ create mode 100644 testing/fulltests/unit-tests/T105trap_parse_clib.c
+
+diff --git a/testing/fulltests/unit-tests/T105trap_parse_clib.c b/testing/fulltests/unit-tests/T105trap_parse_clib.c
+new file mode 100644
+index 000000000..5c21ccdc7
+--- /dev/null
+++ b/testing/fulltests/unit-tests/T105trap_parse_clib.c
+@@ -0,0 +1,41 @@
+/* HEADER Parsing of an SNMP trap with no varbinds */
+netsnmp_pdu pdu;
+int rc;
+static u_char trap_pdu[] = {
+    /* Sequence with length of 0x2d = 45 bytes. */
+    [ 0] = 0x30, [ 1] = 0x82, [ 2] = 0x00, [ 3] = 0x2d,
+    /* version = INTEGER 0 */
+    [ 4] = 0x02, [ 5] = 0x01, [ 6] = 0x00,
+    /* community = public (OCTET STRING 0x70 0x75 0x62 0x6c 0x69 0x63) */
+    [ 7] = 0x04, [ 8] = 0x06, [ 9] = 0x70, [10] = 0x75,
+    [11] = 0x62, [12] = 0x6c, [13] = 0x69, [14] = 0x63,
+    /* SNMP_MSG_TRAP; 32 bytes. */
+    [15] = 0xa4, [16] = 0x20,
+    /* enterprise = OBJECT IDENTIFIER .1.3.6.1.6.3.1.1.5 = snmpTraps */
+    [17] = 0x06, [18] = 0x08,
+    [19] = 0x2b, [20] = 0x06, [21] = 0x01, [22] = 0x06,
+    [23] = 0x03, [24] = 0x01, [25] = 0x01, [26] = 0x05,
+    /* agent-addr = ASN_IPADDRESS 192.168.1.34 */
+    [27] = 0x40, [28] = 0x04, [29] = 0xc0, [30] = 0xa8,
+    [31] = 0x01, [32] = 0x22,
+    /* generic-trap = INTEGER 0 */
+    [33] = 0x02, [34] = 0x01, [35] = 0x00,
+    /* specific-trap = INTEGER 0 */
+    [36] = 0x02, [37] = 0x01, [38] = 0x00,
+    /* ASN_TIMETICKS 0x117f243a */
+    [39] = 0x43, [40] = 0x04, [41] = 0x11, [42] = 0x7f,
+    [43] = 0x24, [44] = 0x3a,
+    /* varbind list */
+    [45] = 0x30, [46] = 0x82, [47] = 0x00, [48] = 0x00,
+};
+static size_t trap_pdu_length = sizeof(trap_pdu);
+netsnmp_session session;
+
+snmp_set_do_debugging(TRUE);
+debug_register_tokens("dumpv_recv,dumpv_send,asn,recv");
+memset(&session, 0, sizeof(session));
+snmp_sess_init(&session);
+memset(&pdu, 0, sizeof(pdu));
+rc = snmp_parse(NULL, &session, &pdu, trap_pdu, trap_pdu_length);
+
+OKF((rc == 0), ("Parsing of a trap PDU"));
+
--- a/SOURCES/net-snmp-5.8-broken-errmsg.patch
+++ b/SOURCES/net-snmp-5.8-broken-errmsg.patch
@ -0,0 +1,90 @@
+diff -urNp a/agent/mibgroup/host/hrh_filesys.c b/agent/mibgroup/host/hrh_filesys.c
+--- a/agent/mibgroup/host/hrh_filesys.c	2021-06-09 10:30:07.744455758 +0200
+++ b/agent/mibgroup/host/hrh_filesys.c	2021-06-09 10:32:50.657160232 +0200
+@@ -219,6 +219,7 @@ var_hrhfilesys(struct variable *vp,
+ {
+     int             fsys_idx;
+     static char    *string;
+    static char     empty_str[1];
+ 
+     fsys_idx =
+         header_hrhfilesys(vp, name, length, exact, var_len, write_method);
+@@ -235,7 +236,7 @@ var_hrhfilesys(struct variable *vp,
+         *var_len = 0;
+         if (asprintf(&string, "%s", HRFS_entry->path) >= 0)
+             *var_len = strlen(string);
+-        return (u_char *) string;
+        return (u_char *)(string ? string : empty_str);
+     case HRFSYS_RMOUNT:
+         free(string);
+         if (HRFS_entry->flags & NETSNMP_FS_FLAG_REMOTE) {
+@@ -245,7 +246,7 @@ var_hrhfilesys(struct variable *vp,
+             string = strdup("");
+         }
+         *var_len = string ? strlen(string) : 0;
+-        return (u_char *) string;
+        return (u_char *)(string ? string : empty_str);
+ 
+     case HRFSYS_TYPE:
+         fsys_type_id[fsys_type_len - 1] = 
+diff -urNp a/agent/mibgroup/ucd-snmp/disk.c b/agent/mibgroup/ucd-snmp/disk.c
+--- a/agent/mibgroup/ucd-snmp/disk.c	2021-06-09 10:30:07.728455689 +0200
+++ b/agent/mibgroup/ucd-snmp/disk.c	2021-06-09 10:34:32.722597366 +0200
+@@ -842,6 +842,7 @@ var_extensible_disk(struct variable *vp,
+     struct dsk_entry entry;
+     static long     long_ret;
+     static char    *errmsg;
+    static char     empty_str[1];
+ 
+     int i;
+     for (i = 0; i < numdisks; i++){
+@@ -950,7 +951,7 @@ tryAgain:
+                 *var_len = strlen(errmsg);
+             }
+         }
+-        return (u_char *) (errmsg);
+        return (u_char *)(errmsg ? errmsg : empty_str);
+     }
+     return NULL;
+ }
+diff -urNp a/agent/mibgroup/ucd-snmp/disk_hw.c b/agent/mibgroup/ucd-snmp/disk_hw.c
+--- a/agent/mibgroup/ucd-snmp/disk_hw.c	2021-06-09 10:30:07.727455684 +0200
+++ b/agent/mibgroup/ucd-snmp/disk_hw.c	2021-06-09 10:35:53.420943010 +0200
+@@ -314,6 +314,7 @@ var_extensible_disk(struct variable *vp,
+     unsigned long long val;
+     static long     long_ret;
+     static char    *errmsg;
+    static char     empty_str[1];
+     netsnmp_cache  *cache;
+ 
+     /* Update the fsys H/W module */
+@@ -432,7 +433,7 @@ tryAgain:
+              >= 0)) {
+             *var_len = strlen(errmsg);
+         }
+-        return (u_char *) errmsg;
+        return (u_char *)(errmsg ? errmsg : empty_str);
+     }
+     return NULL;
+ }
+diff -urNp a/agent/mibgroup/ucd-snmp/proc.c b/agent/mibgroup/ucd-snmp/proc.c
+--- a/agent/mibgroup/ucd-snmp/proc.c	2021-06-09 10:30:07.725455676 +0200
+++ b/agent/mibgroup/ucd-snmp/proc.c	2021-06-09 10:37:31.143361548 +0200
+@@ -267,7 +267,7 @@ var_extensible_proc(struct variable *vp,
+     struct myproc  *proc;
+     static long     long_ret;
+     static char    *errmsg;
+-
+    static char     empty_str[1];
+ 
+     if (header_simple_table
+         (vp, name, length, exact, var_len, write_method, numprocs))
+@@ -330,7 +330,7 @@ var_extensible_proc(struct variable *vp,
+                 }
+             }
+             *var_len = errmsg ? strlen(errmsg) : 0;
+-            return ((u_char *) errmsg);
+            return (u_char *)(errmsg ? errmsg : empty_str);
+         case ERRORFIX:
+             *write_method = fixProcError;
+             long_return = fixproc.result;
--- a/SOURCES/net-snmp-5.8-bulk.patch
+++ b/SOURCES/net-snmp-5.8-bulk.patch
@ -0,0 +1,51 @@
+diff -urNp a/snmplib/snmp_api.c b/snmplib/snmp_api.c
+--- a/snmplib/snmp_api.c	2020-09-29 14:08:09.821479662 +0200
+++ b/snmplib/snmp_api.c	2020-10-01 10:15:46.607374362 +0200
+@@ -769,7 +769,7 @@ snmp_sess_init(netsnmp_session * session
+     session->retries = SNMP_DEFAULT_RETRIES;
+     session->version = SNMP_DEFAULT_VERSION;
+     session->securityModel = SNMP_DEFAULT_SECMODEL;
+-    session->rcvMsgMaxSize = SNMP_MAX_MSG_SIZE;
+    session->rcvMsgMaxSize = netsnmp_max_send_msg_size();
+     session->sndMsgMaxSize = netsnmp_max_send_msg_size();
+     session->flags |= SNMP_FLAGS_DONT_PROBE;
+ }
+@@ -2731,7 +2731,7 @@ snmpv3_packet_build(netsnmp_session * se
+     /*
+      * build a scopedPDU structure into spdu_buf
+      */
+-    spdu_buf_len = SNMP_MAX_MSG_SIZE;
+    spdu_buf_len = sizeof(spdu_buf);
+     DEBUGDUMPSECTION("send", "ScopedPdu");
+     cp = snmpv3_scopedPDU_header_build(pdu, spdu_buf, &spdu_buf_len,
+                                        &spdu_hdr_e);
+@@ -2743,6 +2743,11 @@ snmpv3_packet_build(netsnmp_session * se
+      */
+     DEBUGPRINTPDUTYPE("send", ((pdu_data) ? *pdu_data : 0x00));
+     if (pdu_data) {
+        if (cp + pdu_data_len > spdu_buf + sizeof(spdu_buf)) {
+            snmp_log(LOG_ERR, "%s: PDU too big (%" NETSNMP_PRIz "d > %" NETSNMP_PRIz "d)\n",
+                     __func__, pdu_data_len, sizeof(spdu_buf));
+            return -1;
+        }
+         memcpy(cp, pdu_data, pdu_data_len);
+         cp += pdu_data_len;
+     } else {
+@@ -2756,7 +2761,7 @@ snmpv3_packet_build(netsnmp_session * se
+      * re-encode the actual ASN.1 length of the scopedPdu
+      */
+     spdu_len = cp - spdu_hdr_e; /* length of scopedPdu minus ASN.1 headers */
+-    spdu_buf_len = SNMP_MAX_MSG_SIZE;
+    spdu_buf_len = sizeof(spdu_buf);
+     if (asn_build_sequence(spdu_buf, &spdu_buf_len,
+                            (u_char) (ASN_SEQUENCE | ASN_CONSTRUCTOR),
+                            spdu_len) == NULL)
+@@ -2769,7 +2774,7 @@ snmpv3_packet_build(netsnmp_session * se
+      * message - the entire message to transmitted on the wire is returned
+      */
+     cp = NULL;
+-    *out_length = SNMP_MAX_MSG_SIZE;
+    *out_length = sizeof(spdu_buf);
+     DEBUGDUMPSECTION("send", "SM msgSecurityParameters");
+     sptr = find_sec_mod(pdu->securityModel);
+     if (sptr && sptr->encode_forward) {
--- a/SOURCES/net-snmp-5.8-certs.patch
+++ b/SOURCES/net-snmp-5.8-certs.patch
@ -0,0 +1,12 @@
+diff -urNp a/local/net-snmp-cert b/local/net-snmp-cert
+--- a/local/net-snmp-cert	2021-10-11 09:08:53.451970484 +0200
+++ b/local/net-snmp-cert	2021-10-11 09:11:36.765386413 +0200
+@@ -1002,7 +1002,7 @@ sub make_openssl_conf {
+ rdir            = .
+ dir		= $ENV::DIR
+ RANDFILE	= $rdir/.rand
+-MD		= sha1
+MD		= sha512
+ KSIZE		= 2048
+ CN		= net-snmp.org
+ EMAIL		= admin@net-snmp.org
--- a/SOURCES/net-snmp-5.8-clientaddr-error-message.patch
+++ b/SOURCES/net-snmp-5.8-clientaddr-error-message.patch
@ -0,0 +1,35 @@
+diff -urNp a/snmplib/snmp_api.c b/snmplib/snmp_api.c
+--- a/snmplib/snmp_api.c	2020-11-26 11:05:51.084788775 +0100
+++ b/snmplib/snmp_api.c	2020-11-26 11:08:27.850751397 +0100
+@@ -235,7 +235,7 @@ static const char *api_errors[-SNMPERR_M
+     "No error",                 /* SNMPERR_SUCCESS */
+     "Generic error",            /* SNMPERR_GENERR */
+     "Invalid local port",       /* SNMPERR_BAD_LOCPORT */
+-    "Unknown host",             /* SNMPERR_BAD_ADDRESS */
+    "Invalid address",          /* SNMPERR_BAD_ADDRESS */
+     "Unknown session",          /* SNMPERR_BAD_SESSION */
+     "Too long",                 /* SNMPERR_TOO_LONG */
+     "No socket",                /* SNMPERR_NO_SOCKET */
+@@ -1662,7 +1662,9 @@ _sess_open(netsnmp_session * in_session)
+         DEBUGMSGTL(("_sess_open", "couldn't interpret peername\n"));
+         in_session->s_snmp_errno = SNMPERR_BAD_ADDRESS;
+         in_session->s_errno = errno;
+-        snmp_set_detail(in_session->peername);
+        if (!netsnmp_ds_get_string(NETSNMP_DS_LIBRARY_ID,
+                                    NETSNMP_DS_LIB_CLIENT_ADDR))
+            snmp_set_detail(in_session->peername);
+         return NULL;
+     }
+ 
+diff -ruNp a/snmplib/transports/snmpUDPIPv4BaseDomain.c b/snmplib/transports/snmpUDPIPv4BaseDomain.c
+--- a/snmplib/transports/snmpUDPIPv4BaseDomain.c	2021-01-06 12:51:51.948106797 +0100
+++ b/snmplib/transports/snmpUDPIPv4BaseDomain.c	2021-01-06 14:17:31.029745744 +0100
+@@ -209,6 +209,8 @@ netsnmp_udpipv4base_transport_bind(netsn
+         DEBUGMSGTL(("netsnmp_udpbase",
+                     "failed to bind for clientaddr: %d %s\n",
+                     errno, strerror(errno)));
+        NETSNMP_LOGONCE((LOG_ERR, "Cannot bind for clientaddr: %s\n",
+                    strerror(errno)));
+         netsnmp_socketbase_close(t);
+         return 1;
+     }
--- a/SOURCES/net-snmp-5.8-deleted-iface.patch
+++ b/SOURCES/net-snmp-5.8-deleted-iface.patch
@ -0,0 +1,41 @@
+diff -up net-snmp-5.8/agent/mibgroup/if-mib/data_access/interface_linux.c.original net-snmp-5.8/agent/mibgroup/if-mib/data_access/interface_linux.c
+--- net-snmp-5.8/agent/mibgroup/if-mib/data_access/interface_linux.c.original	2022-02-02 15:06:29.382119898 +0900
+++ net-snmp-5.8/agent/mibgroup/if-mib/data_access/interface_linux.c	2022-02-02 15:15:39.298280447 +0900
+@@ -600,7 +600,6 @@ netsnmp_arch_interface_container_load(ne
+ {
+     FILE           *devin;
+     char            line[256];
+-    netsnmp_interface_entry *entry = NULL;
+     static char     scan_expected = 0;
+     int             fd;
+ #ifdef NETSNMP_ENABLE_IPV6
+@@ -669,6 +668,7 @@ netsnmp_arch_interface_container_load(ne
+      *   and retrieve (or create) the corresponding data structure.
+      */
+     while (fgets(line, sizeof(line), devin)) {
+        netsnmp_interface_entry *entry = NULL;
+         char           *stats, *ifstart = line;
+         u_int           flags;
+         oid             if_index;
+@@ -701,6 +701,11 @@ netsnmp_arch_interface_container_load(ne
+         *stats++ = 0; /* null terminate name */
+ 
+         if_index = netsnmp_arch_interface_index_find(ifstart);
+        if (if_index == 0) {
+            DEBUGMSGTL(("access:interface", "network interface %s is gone",
+                        ifstart));
+            continue;
+        }
+ 
+         /*
+          * set address type flags.
+@@ -726,7 +731,7 @@ netsnmp_arch_interface_container_load(ne
+             continue;
+         }
+ 
+-        entry = netsnmp_access_interface_entry_create(ifstart, 0);
+        entry = netsnmp_access_interface_entry_create(ifstart, if_index);
+         if(NULL == entry) {
+ #ifdef NETSNMP_ENABLE_IPV6
+             netsnmp_access_ipaddress_container_free(addr_container, 0);
+
--- a/SOURCES/net-snmp-5.8-dev-mem-leak.patch
+++ b/SOURCES/net-snmp-5.8-dev-mem-leak.patch
@ -0,0 +1,35 @@
+From 8bb544fbd2d6986a9b73d3fab49235a4baa96c23 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Sat, 31 Jul 2021 16:21:16 -0700
+Subject: [PATCH] Linux: IF-MIB: Fix a memory leak
+
+The Linux kernel regenerates proc files in their entirety every time a 4 KiB
+boundary is crossed. This can result in reading the same network interface
+twice if network information changes while it is being read. Fix a memory
+leak that can be triggered if /proc/net/dev changes while being read.
+---
+ agent/mibgroup/if-mib/data_access/interface_linux.c | 10 +++++++++-
+ 1 file changed, 9 insertions(+), 1 deletion(-)
+
+diff --git a/agent/mibgroup/if-mib/data_access/interface_linux.c b/agent/mibgroup/if-mib/data_access/interface_linux.c
+index e99360a216..215b30e806 100644
+--- a/agent/mibgroup/if-mib/data_access/interface_linux.c
+++ b/agent/mibgroup/if-mib/data_access/interface_linux.c
+@@ -921,7 +921,15 @@ netsnmp_arch_interface_container_load(netsnmp_container* container,
+         /*
+          * add to container
+          */
+-        CONTAINER_INSERT(container, entry);
+        if (CONTAINER_INSERT(container, entry) != 0) {
+            netsnmp_interface_entry *existing =
+                CONTAINER_FIND(container, entry);
+            NETSNMP_LOGONCE((LOG_WARNING,
+                             "Encountered interface with index %" NETSNMP_PRIz "u twice: %s <> %s",
+                             entry->index, existing ? existing->name : "(?)",
+                             entry->name));
+            netsnmp_access_interface_entry_free(entry);
+        }
+     }
+ #ifdef NETSNMP_ENABLE_IPV6
+     netsnmp_access_ipaddress_container_free(addr_container, 0);
+
--- a/SOURCES/net-snmp-5.8-digest-from-ECC.patch
+++ b/SOURCES/net-snmp-5.8-digest-from-ECC.patch
@ -0,0 +1,98 @@
+From a1968db524e087a36a19a351b89bf6f1633819aa Mon Sep 17 00:00:00 2001
+From: minfrin <minfrin@users.noreply.github.com>
+Date: Tue, 5 Jan 2021 23:17:14 +0000
+Subject: [PATCH] Add support for digests detected from ECC certificates
+
+Previously, the digest could be detected on RSA certificates only. This
+patch adds detection for ECC certificates.
+
+[ bvanassche: changed _htmap2 into a two-dimensional array and renamed _htmap2
+  back to _htmap ]
+---
+ snmplib/snmp_openssl.c | 60 +++++++++++++++++++++++++++++++++++-------
+ 1 file changed, 50 insertions(+), 10 deletions(-)
+
+diff --git a/snmplib/snmp_openssl.c b/snmplib/snmp_openssl.c
+index c092a007af..432cb5c27c 100644
+--- a/snmplib/snmp_openssl.c
+++ b/snmplib/snmp_openssl.c
+@@ -521,18 +521,54 @@ netsnmp_openssl_cert_dump_extensions(X509 *ocert)
+     }
+ }
+ 
+-static int _htmap[NS_HASH_MAX + 1] = {
+-    0, NID_md5WithRSAEncryption, NID_sha1WithRSAEncryption,
+-    NID_sha224WithRSAEncryption, NID_sha256WithRSAEncryption,
+-    NID_sha384WithRSAEncryption, NID_sha512WithRSAEncryption };
+static const struct {
+    uint16_t nid;
+    uint16_t ht;
+} _htmap[] = {
+    { 0, NS_HASH_NONE },
+#ifdef NID_md5WithRSAEncryption
+    { NID_md5WithRSAEncryption, NS_HASH_MD5 },
+#endif
+#ifdef NID_sha1WithRSAEncryption
+    { NID_sha1WithRSAEncryption, NS_HASH_SHA1 },
+#endif
+#ifdef NID_ecdsa_with_SHA1
+    { NID_ecdsa_with_SHA1, NS_HASH_SHA1 },
+#endif
+#ifdef NID_sha224WithRSAEncryption
+    { NID_sha224WithRSAEncryption, NS_HASH_SHA224 },
+#endif
+#ifdef NID_ecdsa_with_SHA224
+    { NID_ecdsa_with_SHA224, NS_HASH_SHA224 },
+#endif
+#ifdef NID_sha256WithRSAEncryption
+    { NID_sha256WithRSAEncryption, NS_HASH_SHA256 },
+#endif
+#ifdef NID_ecdsa_with_SHA256
+    { NID_ecdsa_with_SHA256, NS_HASH_SHA256 },
+#endif
+#ifdef NID_sha384WithRSAEncryption
+    { NID_sha384WithRSAEncryption, NS_HASH_SHA384 },
+#endif
+#ifdef NID_ecdsa_with_SHA384
+    { NID_ecdsa_with_SHA384, NS_HASH_SHA384 },
+#endif
+#ifdef NID_sha512WithRSAEncryption
+    { NID_sha512WithRSAEncryption, NS_HASH_SHA512 },
+#endif
+#ifdef NID_ecdsa_with_SHA512
+    { NID_ecdsa_with_SHA512, NS_HASH_SHA512 },
+#endif
+};
+ 
+ int
+ _nid2ht(int nid)
+ {
+     int i;
+-    for (i=1; i<= NS_HASH_MAX; ++i) {
+-        if (nid == _htmap[i])
+-            return i;
+
+    for (i = 0; i < sizeof(_htmap) / sizeof(_htmap[0]); i++) {
+        if (_htmap[i].nid == nid)
+            return _htmap[i].ht;
+     }
+     return 0;
+ }
+@@ -541,9 +577,13 @@ _nid2ht(int nid)
+ int
+ _ht2nid(int ht)
+ {
+-    if ((ht < 0) || (ht > NS_HASH_MAX))
+-        return 0;
+-    return _htmap[ht];
+    int i;
+
+    for (i = 0; i < sizeof(_htmap) / sizeof(_htmap[0]); i++) {
+        if (_htmap[i].ht == ht)
+            return _htmap[i].nid;
+    }
+    return 0;
+ }
+ #endif /* NETSNMP_FEATURE_REMOVE_OPENSSL_HT2NID */
+ 
+
--- a/SOURCES/net-snmp-5.8-double-IP-parsing.patch
+++ b/SOURCES/net-snmp-5.8-double-IP-parsing.patch
@ -0,0 +1,48 @@
+From 1bb941d6fcd7ac2db5a54b95ee0ed07ec9861e70 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Josef=20=C5=98=C3=ADdk=C3=BD?= <jridky@redhat.com>
+Date: Fri, 12 Mar 2021 10:15:30 +0100
+Subject: [PATCH] Prevent parsing IP address twice (#199)
+
+This fixes issue, that is caused by parsing IP address twice.
+First as IPv4 and as IPv6 at second, even thow the address was
+properly parsed as a valid IPv4 address.
+---
+ snmplib/transports/snmpUDPDomain.c     |  2 +-
+ snmplib/transports/snmpUDPIPv6Domain.c | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/snmplib/transports/snmpUDPDomain.c b/snmplib/transports/snmpUDPDomain.c
+index b96497f3a3..b594a389b9 100644
+--- a/snmplib/transports/snmpUDPDomain.c
+++ b/snmplib/transports/snmpUDPDomain.c
+@@ -387,7 +387,7 @@ netsnmp_udp_parse_security(const char *token, char *param)
+             /* Nope, wasn't a dotted quad.  Must be a hostname. */
+             int ret = netsnmp_gethostbyname_v4(sourcep, &network.s_addr);
+             if (ret < 0) {
+-                config_perror("cannot resolve source hostname");
+                config_perror("cannot resolve IPv4 source hostname");
+                 return;
+             }
+         }
+diff --git a/snmplib/transports/snmpUDPIPv6Domain.c b/snmplib/transports/snmpUDPIPv6Domain.c
+index 238c8a9d63..7db19c5c02 100644
+--- a/snmplib/transports/snmpUDPIPv6Domain.c
+++ b/snmplib/transports/snmpUDPIPv6Domain.c
+@@ -736,7 +736,15 @@ netsnmp_udp6_parse_security(const char *token, char *param)
+                 memset(&pton_addr.sin6_addr.s6_addr, '\0',
+                        sizeof(struct in6_addr));
+             } else if (inet_pton(AF_INET6, sourcep, &pton_addr.sin6_addr) != 1) {
+-                /* Nope, wasn't a numeric address. Must be a hostname. */
+                /* Nope, wasn't a numeric IPv6 address. Must be IPv4 or a hostname. */
+
+                /* Try interpreting as dotted quad - IPv4 */
+                struct in_addr network;
+                if (inet_pton(AF_INET, sourcep, &network) > 0){
+                    /* Yes, it's IPv4 - so it's already parsed and we can return. */
+                    DEBUGMSGTL(("com2sec6", "IPv4 detected for IPv6 parser. Skipping.\n"));
+                    return;
+                }
+ #if HAVE_GETADDRINFO
+                 int             gai_error;
+ 
+
--- a/SOURCES/net-snmp-5.8-dskTable-dynamic.patch
+++ b/SOURCES/net-snmp-5.8-dskTable-dynamic.patch
@ -0,0 +1,181 @@
+diff -ruNp a/agent/mibgroup/ucd-snmp/disk.c b/agent/mibgroup/ucd-snmp/disk.c
+--- a/agent/mibgroup/ucd-snmp/disk.c	2020-06-10 09:29:35.867328760 +0200
+++ b/agent/mibgroup/ucd-snmp/disk.c	2020-06-10 09:44:13.053535421 +0200
+@@ -153,9 +153,10 @@ static void       disk_free_config(void)
+ static void       disk_parse_config(const char *, char *);
+ static void       disk_parse_config_all(const char *, char *);
+ #if HAVE_FSTAB_H || HAVE_GETMNTENT || HAVE_STATFS
+-static void       find_and_add_allDisks(int minpercent);
+static void       refresh_disk_table(int addNewDisks, int minpercent);
+ static void       add_device(char *path, char *device,
+-	                     int minspace, int minpercent, int override);
+	                     int minspace, int minpercent, int addNewDisks,
+	                     int override);
+ static void       modify_disk_parameters(int index, int minspace,
+ 	                                 int minpercent);
+ static int        disk_exists(char *path);
+@@ -167,6 +168,7 @@ struct diskpart {
+     char            path[STRMAX];
+     int             minimumspace;
+     int             minpercent;
+    int             alive;
+ };
+ 
+ #define MAX_INT_32 0x7fffffff
+@@ -174,6 +176,7 @@ struct diskpart {
+ 
+ unsigned int    numdisks;
+ int             allDisksIncluded = 0;
+int             allDisksMinPercent = 0;
+ unsigned int    maxdisks = 0;
+ struct diskpart *disks;
+ 
+@@ -238,6 +241,7 @@ init_disk(void)
+ 				disk_free_config,
+ 				"minpercent%");
+   allDisksIncluded = 0;
+  allDisksMinPercent = 0;
+ }
+ 
+ static void
+@@ -253,6 +257,7 @@ disk_free_config(void)
+     disks[i].minpercent = -1;
+   }
+   allDisksIncluded = 0;
+  allDisksMinPercent = 0;
+ }
+ 
+ static void 
+@@ -313,7 +318,7 @@ disk_parse_config(const char *token, cha
+    * check if the disk already exists, if so then modify its
+    * parameters. if it does not exist then add it
+    */
+-  add_device(path, find_device(path), minspace, minpercent, 1);
+  add_device(path, find_device(path), minspace, minpercent, 1, 1);
+ #endif /* HAVE_FSTAB_H || HAVE_GETMNTENT || HAVE_STATFS */
+ }
+ 
+@@ -372,7 +377,7 @@ disk_parse_config_all(const char *token,
+ 
+ #if HAVE_FSTAB_H || HAVE_GETMNTENT || HAVE_STATFS
+ static void
+-add_device(char *path, char *device, int minspace, int minpercent, int override) 
+add_device(char *path, char *device, int minspace, int minpercent, int addNewDisks, int override) 
+ {
+   int index;
+ 
+@@ -402,10 +407,16 @@ add_device(char *path, char *device, int
+   }
+ 
+   index = disk_exists(path);
+-  if((index != -1) && (index < maxdisks) && (override==1)) {
+-    modify_disk_parameters(index, minspace, minpercent);
+  if((index != -1) && (index < maxdisks)) {
+    /* the path is already in the table */
+    disks[index].alive = 1;
+    /* -> update its device */
+    strlcpy(disks[index].device, device, sizeof(disks[index].device));
+    if (override == 1) {
+        modify_disk_parameters(index, minspace, minpercent);
+    }
+   }
+-  else if(index == -1){
+  else if(index == -1 && addNewDisks){
+     /* add if and only if the device was found */
+     if(device[0] != 0) {
+       /* The following buffers are cleared above, no need to add '\0' */
+@@ -413,6 +424,7 @@ add_device(char *path, char *device, int
+       strlcpy(disks[numdisks].device, device, sizeof(disks[numdisks].device));
+       disks[numdisks].minimumspace = minspace;
+       disks[numdisks].minpercent   = minpercent;
+      disks[numdisks].alive        = 1;
+       numdisks++;  
+     }
+     else {
+@@ -420,6 +432,7 @@ add_device(char *path, char *device, int
+       disks[numdisks].minpercent = -1;
+       disks[numdisks].path[0] = 0;
+       disks[numdisks].device[0] = 0;
+      disks[numdisks].alive = 0;
+     }
+   }
+ }
+@@ -444,7 +457,7 @@ int disk_exists(char *path)
+ }
+ 
+ static void 
+-find_and_add_allDisks(int minpercent)
+refresh_disk_table(int addNewDisks, int minpercent)
+ {
+ #if HAVE_GETMNTENT
+ #if HAVE_SYS_MNTTAB_H
+@@ -480,7 +493,7 @@ find_and_add_allDisks(int minpercent)
+       return;
+   }
+   while (mntfp && NULL != (mntent = getmntent(mntfp))) {
+-    add_device(mntent->mnt_dir, mntent->mnt_fsname, -1, minpercent, 0);
+    add_device(mntent->mnt_dir, mntent->mnt_fsname, -1, minpercent, addNewDisks, 0);
+     dummy = 1;
+   }
+   if (mntfp)
+@@ -497,7 +510,7 @@ find_and_add_allDisks(int minpercent)
+       return;
+   }
+   while ((i = getmntent(mntfp, &mnttab)) == 0) {
+-    add_device(mnttab.mnt_mountp, mnttab.mnt_special, -1, minpercent, 0);
+    add_device(mnttab.mnt_mountp, mnttab.mnt_special, -1, minpercent, addNewDisks, 0);
+     dummy = 1;
+   }
+   fclose(mntfp);
+@@ -510,7 +523,7 @@ find_and_add_allDisks(int minpercent)
+ #elif HAVE_FSTAB_H
+   setfsent();			/* open /etc/fstab */
+   while((fstab1 = getfsent()) != NULL) {
+-    add_device(fstab1->fs_file, fstab1->fs_spec, -1, minpercent, 0);
+    add_device(fstab1->fs_file, fstab1->fs_spec, -1, minpercent, addNewDisks, 0);
+     dummy = 1;
+   }
+   endfsent();			/* close /etc/fstab */
+@@ -521,7 +534,7 @@ find_and_add_allDisks(int minpercent)
+     mntsize = getmntinfo(&mntbuf, MNT_NOWAIT);
+     for (i = 0; i < mntsize; i++) {
+       if (strncmp(mntbuf[i].f_fstypename, "zfs", 3) == 0) {
+-	add_device(mntbuf[i].f_mntonname, mntbuf[i].f_mntfromname, -1, minpercent, 0);
+    	add_device(mntbuf[i].f_mntonname, mntbuf[i].f_mntfromname, -1, minpercent, addNewDisks, 0);
+       }
+     }
+   }
+@@ -537,7 +550,7 @@ find_and_add_allDisks(int minpercent)
+    * statfs we default to the root partition "/"
+    */
+   if (statfs("/", &statf) == 0) {
+-    add_device("/", statf.f_mntfromname, -1, minpercent, 0);
+    add_device("/", statf.f_mntfromname, -1, minpercent, addNewDisks, 0);
+   }
+ #endif
+   else {
+@@ -696,6 +709,10 @@ fill_dsk_entry(int disknum, struct dsk_e
+ #endif
+ #endif
+ 
+    if (disks[disknum].alive == 0){
+        return -1;
+    }
+
+     entry->dskPercentInode = -1;
+ 
+ #if defined(HAVE_STATVFS) || defined(HAVE_STATFS)
+@@ -826,6 +843,13 @@ var_extensible_disk(struct variable *vp,
+     static long     long_ret;
+     static char    *errmsg;
+ 
+    int i;
+    for (i = 0; i < numdisks; i++){
+        disks[i].alive = 0;
+    }
+    /* dynamically add new disks + update alive flag */
+    refresh_disk_table(allDisksIncluded, allDisksMinPercent);
+
+ tryAgain:
+     if (header_simple_table
+         (vp, name, length, exact, var_len, write_method, numdisks))
--- a/SOURCES/net-snmp-5.8-duplicate-ipAddress.patch
+++ b/SOURCES/net-snmp-5.8-duplicate-ipAddress.patch
@ -0,0 +1,11 @@
+diff -urNp a/agent/mibgroup/ip-mib/data_access/ipaddress_common.c b/agent/mibgroup/ip-mib/data_access/ipaddress_common.c
+--- a/agent/mibgroup/ip-mib/data_access/ipaddress_common.c	2020-06-10 13:27:03.213904398 +0200
+++ b/agent/mibgroup/ip-mib/data_access/ipaddress_common.c	2020-06-10 13:28:41.025863050 +0200
+@@ -121,6 +121,7 @@ _remove_duplicates(netsnmp_container *co
+ 	for (entry = ITERATOR_FIRST(it); entry; entry = ITERATOR_NEXT(it)) {
+ 		if (prev_entry && _access_ipaddress_entry_compare_addr(prev_entry, entry) == 0) {
+ 			/* 'entry' is duplicate of the previous one -> delete it */
+            NETSNMP_LOGONCE((LOG_ERR, "Duplicate IPv4 address detected, some interfaces may not be visible in IP-MIB\n"));
+ 			netsnmp_access_ipaddress_entry_free(entry);
+ 		} else {
+ 			CONTAINER_INSERT(ret, entry);
--- a/SOURCES/net-snmp-5.8-empty-passphrase.patch
+++ b/SOURCES/net-snmp-5.8-empty-passphrase.patch
@ -0,0 +1,30 @@
+From 09a0c9005fb72102bf4f4499b28282f823e3e526 Mon Sep 17 00:00:00 2001
+From: Josef Ridky <jridky@redhat.com>
+Date: Wed, 18 Nov 2020 20:54:34 -0800
+Subject: [PATCH] net-snmp-create-v3-user: Handle empty passphrases correctly
+
+See also https://github.com/net-snmp/net-snmp/issues/86.
+
+Fixes: e5ad10de8e17 ("Quote provided encryption key in createUser line")
+Reported-by: Chris Cheney
+---
+ net-snmp-create-v3-user.in | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/net-snmp-create-v3-user.in b/net-snmp-create-v3-user.in
+index 452c2699d..31b4c58c1 100644
+--- a/net-snmp-create-v3-user.in
+++ b/net-snmp-create-v3-user.in
+@@ -120,7 +120,11 @@ fi
+ fi
+ outdir="@PERSISTENT_DIRECTORY@"
+ outfile="$outdir/snmpd.conf"
+-line="createUser $user $Aalgorithm \"$apassphrase\" $Xalgorithm \"$xpassphrase\""
+if test "x$xpassphrase" = "x" ; then
+    line="createUser $user $Aalgorithm \"$apassphrase\" $Xalgorithm"
+else
+    line="createUser $user $Aalgorithm \"$apassphrase\" $Xalgorithm \"$xpassphrase\""
+fi
+ echo "adding the following line to $outfile:"
+ echo "  " $line
+ # in case it hasn't ever been started yet, start it.
--- a/SOURCES/net-snmp-5.8-engine-id.patch
+++ b/SOURCES/net-snmp-5.8-engine-id.patch
@ -0,0 +1,25 @@
+From 79f014464ba761e2430cc767b021993ab9379822 Mon Sep 17 00:00:00 2001
+From: Wes Hardaker <opensource@hardakers.net>
+Date: Tue, 8 Jan 2019 08:52:29 -0800
+Subject: [PATCH] NEWS: snmptrap: BUG: 2899: Patch from Drew Roedersheimer to
+ set library engineboots/time values before sending
+
+---
+ apps/snmptrap.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/apps/snmptrap.c b/apps/snmptrap.c
+index d16d2fa671..12808d07e4 100644
+--- a/apps/snmptrap.c
+++ b/apps/snmptrap.c
+@@ -237,6 +237,9 @@ main(int argc, char *argv[])
+             session.engineBoots = 1;
+         if (session.engineTime == 0)    /* not really correct, */
+             session.engineTime = get_uptime();  /* but it'll work. Sort of. */
+
+        set_enginetime(session.securityEngineID, session.securityEngineIDLen,
+                       session.engineBoots, session.engineTime, TRUE);
+     }
+ 
+     ss = snmp_add(&session,
+
--- a/SOURCES/net-snmp-5.8-expand-SNMPCONFPATH.patch
+++ b/SOURCES/net-snmp-5.8-expand-SNMPCONFPATH.patch
@ -0,0 +1,12 @@
+diff -ruNp a/snmplib/read_config.c b/snmplib/read_config.c
+--- a/snmplib/read_config.c	2020-06-10 09:51:57.184786510 +0200
+++ b/snmplib/read_config.c	2020-06-10 09:53:13.257507112 +0200
+@@ -1642,7 +1642,7 @@ snmp_save_persistent(const char *type)
+      * save a warning header to the top of the new file 
+      */
+     snprintf(fileold, sizeof(fileold),
+-            "%s%s# Please save normal configuration tokens for %s in SNMPCONFPATH/%s.conf.\n# Only \"createUser\" tokens should be placed here by %s administrators.\n%s",
+            "%s%s# Please save normal configuration tokens for %s in /etc/snmp/%s.conf.\n# Only \"createUser\" tokens should be placed here by %s administrators.\n%s",
+             "#\n# net-snmp (or ucd-snmp) persistent data file.\n#\n############################################################################\n# STOP STOP STOP STOP STOP STOP STOP STOP STOP \n",
+             "#\n#          **** DO NOT EDIT THIS FILE ****\n#\n# STOP STOP STOP STOP STOP STOP STOP STOP STOP \n############################################################################\n#\n# DO NOT STORE CONFIGURATION ENTRIES HERE.\n",
+             type, type, type,
--- a/SOURCES/net-snmp-5.8-fix-cert-crash.patch
+++ b/SOURCES/net-snmp-5.8-fix-cert-crash.patch
@ -0,0 +1,67 @@
+diff -urNp a/snmplib/snmp_openssl.c b/snmplib/snmp_openssl.c
+--- a/snmplib/snmp_openssl.c	2021-06-09 12:38:23.196037329 +0200
+++ b/snmplib/snmp_openssl.c	2021-06-09 12:44:11.782503048 +0200
+@@ -284,31 +284,30 @@ _cert_get_extension(X509_EXTENSION  *oex
+     }
+     if (X509V3_EXT_print(bio, oext, 0, 0) != 1) {
+         snmp_log(LOG_ERR, "could not print extension!\n");
+-        BIO_vfree(bio);
+-        return NULL;
+        goto out;
+     }
+ 
+     space = BIO_get_mem_data(bio, &data);
+     if (buf && *buf) {
+-        if (*len < space) 
+-            buf_ptr = NULL;
+-        else
+-            buf_ptr = *buf;
+        if (*len < space +1) {
+            snmp_log(LOG_ERR, "not enough buffer space to print extension\n"); 
+            goto out;
+        }
+        buf_ptr = *buf;    
+    } else {
+        buf_ptr = calloc(1, space + 1);
+     }
+-    else
+-        buf_ptr = calloc(1,space + 1);
+     
+     if (!buf_ptr) {
+-        snmp_log(LOG_ERR,
+-                 "not enough space or error in allocation for extenstion\n");
+-        BIO_vfree(bio);
+-        return NULL;
+        snmp_log(LOG_ERR, "error in allocation for extenstion\n");
+        goto out;
+     }
+     memcpy(buf_ptr, data, space);
+     buf_ptr[space] = 0;
+     if (len)
+         *len = space;
+ 
+out:
+     BIO_vfree(bio);
+ 
+     return buf_ptr;
+@@ -479,7 +478,7 @@ netsnmp_openssl_cert_dump_extensions(X50
+ {
+     X509_EXTENSION  *extension;
+     const char      *extension_name;
+-    char             buf[SNMP_MAXBUF_SMALL], *buf_ptr = buf, *str, *lf;
+    char             buf[SNMP_MAXBUF], *buf_ptr = buf, *str, *lf;
+     int              i, num_extensions, buf_len, nid;
+ 
+     if (NULL == ocert)
+@@ -499,6 +498,11 @@ netsnmp_openssl_cert_dump_extensions(X50
+         extension_name = OBJ_nid2sn(nid);
+         buf_len = sizeof(buf);
+         str = _cert_get_extension_str_at(ocert, i, &buf_ptr, &buf_len, 0);
+        if (!str) {
+            DEBUGMSGT(("9:cert:dump", "    %2d: %s\n", i,
+                        extension_name));
+            continue;
+        }
+         lf = strchr(str, '\n'); /* look for multiline strings */
+         if (NULL != lf)
+             *lf = '\0'; /* only log first line of multiline here */
--- a/SOURCES/net-snmp-5.8-intermediate-certs.patch
+++ b/SOURCES/net-snmp-5.8-intermediate-certs.patch
--- a/SOURCES/net-snmp-5.8-ipAddress-faster-load.patch
+++ b/SOURCES/net-snmp-5.8-ipAddress-faster-load.patch
@ -0,0 +1,82 @@
+diff -urNp a/agent/mibgroup/mibII/ipAddr.c b/agent/mibgroup/mibII/ipAddr.c
+--- a/agent/mibgroup/mibII/ipAddr.c	2020-06-10 14:14:30.113696471 +0200
+++ b/agent/mibgroup/mibII/ipAddr.c	2020-06-10 14:27:15.345354018 +0200
+@@ -495,14 +495,16 @@ Address_Scan_Next(Index, Retin_ifaddr)
+ }
+ 
+ #elif defined(linux)
+#include <errno.h>
+ static struct ifreq *ifr;
+ static int ifr_counter;
+ 
+ static void
+ Address_Scan_Init(void)
+ {
+-    int num_interfaces = 0;
+    int i;
+     int fd;
+    int lastlen = 0;
+ 
+     /* get info about all interfaces */
+ 
+@@ -510,28 +512,45 @@ Address_Scan_Init(void)
+     SNMP_FREE(ifc.ifc_buf);
+     ifr_counter = 0;
+ 
+-    do
+-    {
+ 	if ((fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
+ 	{
+ 	    DEBUGMSGTL(("snmpd", "socket open failure in Address_Scan_Init\n"));
+ 	    return;
+ 	}
+-	num_interfaces += 16;
+ 
+-	ifc.ifc_len = sizeof(struct ifreq) * num_interfaces;
+-	ifc.ifc_buf = (char*) realloc(ifc.ifc_buf, ifc.ifc_len);
+-	
+-	    if (ioctl(fd, SIOCGIFCONF, &ifc) < 0)
+-	    {
+-		ifr=NULL;
+-		close(fd);
+-	   	return;
+-	    }
+-	    close(fd);
+    /*
+     * Cope with lots of interfaces and brokenness of ioctl SIOCGIFCONF
+     * on some platforms; see W. R. Stevens, ``Unix Network Programming
+     * Volume I'', p.435...
+     */
+
+    for (i = 8;; i *= 2) {
+        ifc.ifc_len = sizeof(struct ifreq) * i;
+        ifc.ifc_req = calloc(i, sizeof(struct ifreq));
+
+        if (ioctl(fd, SIOCGIFCONF, &ifc) < 0) {
+            if (errno != EINVAL || lastlen != 0) {
+                /*
+                 * Something has gone genuinely wrong...
+                 */
+                snmp_log(LOG_ERR, "bad rc from ioctl, errno %d", errno);
+                SNMP_FREE(ifc.ifc_buf);
+                close(fd);
+                return;
+            }
+        } else {
+            if (ifc.ifc_len == lastlen) {
+                /*
+                 * The length is the same as the last time; we're done...
+                 */
+                break;
+            }
+            lastlen = ifc.ifc_len;
+        }
+        free(ifc.ifc_buf); /* no SNMP_FREE, getting ready to reassign */
+     }
+-    while (ifc.ifc_len >= (sizeof(struct ifreq) * num_interfaces));
+-    
+
+    close(fd);
+     ifr = ifc.ifc_req;
+ }
+ 
--- a/SOURCES/net-snmp-5.8-ipv6-disable-leak.patch
+++ b/SOURCES/net-snmp-5.8-ipv6-disable-leak.patch
@ -0,0 +1,38 @@
+diff -up net-snmp-5.7.2/agent/mibgroup/ip-mib/data_access/systemstats_linux.c.rhbz2134359 net-snmp-5.7.2/agent/mibgroup/ip-mib/data_access/systemstats_linux.c
+--- net-snmp-5.7.2/agent/mibgroup/ip-mib/data_access/systemstats_linux.c.rhbz2134359	2022-10-13 11:10:12.206072210 +0200
+++ net-snmp-5.7.2/agent/mibgroup/ip-mib/data_access/systemstats_linux.c	2022-10-13 11:10:40.893111569 +0200
+@@ -566,6 +566,7 @@ _systemstats_v6_load_systemstats(netsnmp
+         DEBUGMSGTL(("access:systemstats",
+                 "Failed to load Systemstats Table (linux1), cannot open %s\n",
+                 filename));
+        netsnmp_access_systemstats_entry_free(entry);
+         return 0;
+     }
+     
+diff --git a/agent/mibgroup/ucd-snmp/lmsensorsMib.c b/agent/mibgroup/ucd-snmp/lmsensorsMib.c
+index f709812fdc..ef93eeedc9 100644
+--- a/agent/mibgroup/ucd-snmp/lmsensorsMib.c
+++ b/agent/mibgroup/ucd-snmp/lmsensorsMib.c
+@@ -94,7 +94,9 @@ initialize_lmSensorsTable(const char *tableName, const oid *tableOID,
+     netsnmp_table_helper_add_indexes(table_info, ASN_INTEGER, 0);
+     table_info->min_column = COLUMN_LMSENSORS_INDEX;
+     table_info->max_column = COLUMN_LMSENSORS_VALUE;
+-    netsnmp_container_table_register( reg, table_info, container, 0 );
+    if (netsnmp_container_table_register(reg, table_info, container, 0) !=
+        SNMPERR_SUCCESS)
+        return;
+ 
+     /*
+      * If the HAL sensors module was configured as an on-demand caching
+diff -up net-snmp-5.7.2/snmplib/snmp_logging.c.rhbz2134359 net-snmp-5.7.2/snmplib/snmp_logging.c
+--- net-snmp-5.7.2/snmplib/snmp_logging.c.rhbz2134359	2022-10-13 11:11:25.599172905 +0200
+++ net-snmp-5.7.2/snmplib/snmp_logging.c	2022-10-13 11:12:26.986257126 +0200
+@@ -534,7 +534,7 @@ snmp_log_options(char *optarg, int argc,
+ char *
+ snmp_log_syslogname(const char *pstr)
+ {
+-  if (pstr)
+  if (pstr && (pstr != syslogname))
+     strlcpy (syslogname, pstr, sizeof(syslogname));
+ 
+   return syslogname;
--- a/SOURCES/net-snmp-5.8-ipv6-disabled.patch
+++ b/SOURCES/net-snmp-5.8-ipv6-disabled.patch
@ -0,0 +1,31 @@
+diff -urNp a/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c b/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c
+--- a/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c	2020-09-29 14:08:09.742478965 +0200
+++ b/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c	2020-10-01 14:20:25.575174851 +0200
+@@ -19,6 +19,7 @@
+ 
+ #include <errno.h>
+ #include <sys/ioctl.h>
+#include <sys/stat.h>
+ 
+ netsnmp_feature_require(prefix_info)
+ netsnmp_feature_require(find_prefix_info)
+@@ -234,7 +235,18 @@ _load_v6(netsnmp_container *container, i
+ 
+ #define PROCFILE "/proc/net/if_inet6"
+     if (!(in = fopen(PROCFILE, "r"))) {
+-        NETSNMP_LOGONCE((LOG_ERR, "ipaddress_linux: could not open " PROCFILE));
+
+        /* 
+         * If PROCFILE exists, but isn't readable, file ERROR message.
+         * Otherwise log nothing, due of IPv6 support on this machine is
+         * intentionaly disabled/unavailable.
+         */
+
+        struct stat filestat;
+
+        if(stat(PROCFILE, &filestat) == 0){
+            NETSNMP_LOGONCE((LOG_ERR, "ipaddress_linux: could not open " PROCFILE));
+        }
+         return -2;
+     }
+ 
--- a/SOURCES/net-snmp-5.8-man-page.patch
+++ b/SOURCES/net-snmp-5.8-man-page.patch
@ -0,0 +1,36 @@
+diff -urNp a/man/net-snmp-create-v3-user.1.def b/man/net-snmp-create-v3-user.1.def
+--- a/man/net-snmp-create-v3-user.1.def	2020-06-10 13:43:18.443070961 +0200
+++ b/man/net-snmp-create-v3-user.1.def	2020-06-10 13:49:25.975363441 +0200
+@@ -3,7 +3,7 @@
+ net-snmp-create-v3-user \- create a SNMPv3 user in net-snmp configuration file
+ .SH SYNOPSIS
+ .PP
+-.B net-snmp-create-v3-user [-ro] [-a authpass] [-x privpass] [-X DES|AES]
+.B net-snmp-create-v3-user [-ro] [-A authpass] [-a MD5|SHA] [-X privpass] [-x DES|AES]
+ .B [username]
+ .SH DESCRIPTION
+ .PP
+@@ -16,13 +16,16 @@ new user in net-snmp configuration file
+ displays the net-snmp version number
+ .TP
+ \fB\-ro\fR
+-create an user with read-only permissions
+creates a user with read-only permissions
+ .TP
+-\fB\-a authpass\fR
+-specify authentication password
+\fB\-A authpass\fR
+specifies the authentication password
+ .TP
+-\fB\-x privpass\fR
+-specify encryption password
+\fB\-a MD5|SHA\fR
+specifies the authentication password hashing algorithm
+ .TP
+-\fB\-X DES|AES\fR
+-specify encryption algorithm
+\fB\-X privpass\fR
+specifies the encryption password
+.TP
+\fB\-x DES|AES\fR
+specifies the encryption algorithm
--- a/SOURCES/net-snmp-5.8-memavailable.patch
+++ b/SOURCES/net-snmp-5.8-memavailable.patch
@ -0,0 +1,143 @@
+From 5b8bf5d4130761c3374f9ad618e8a76bb75eb634 Mon Sep 17 00:00:00 2001
+From: Yuwei Ba <i@xiaoba.me>
+Date: Fri, 21 Aug 2020 15:06:10 +0800
+Subject: [PATCH] snmpd: support MemAvailable on Linux
+
+See also https://github.com/net-snmp/net-snmp/pull/167 .
+
+[bvanassche: modified the behavior of this patch]
+---
+ agent/mibgroup/hardware/memory/memory_linux.c | 20 ++++++++++++++++++-
+ agent/mibgroup/ucd-snmp/memory.c              | 12 ++++++++++-
+ agent/mibgroup/ucd-snmp/memory.h              |  1 +
+ include/net-snmp/agent/hardware/memory.h      |  1 +
+ mibs/UCD-SNMP-MIB.txt                         | 16 +++++++++++++++
+ 5 files changed, 48 insertions(+), 2 deletions(-)
+
+diff --git a/agent/mibgroup/hardware/memory/memory_linux.c b/agent/mibgroup/hardware/memory/memory_linux.c
+index 6d5e86cde4..4ae235c2d0 100644
+--- a/agent/mibgroup/hardware/memory/memory_linux.c
+++ b/agent/mibgroup/hardware/memory/memory_linux.c
+@@ -24,7 +24,8 @@ int netsnmp_mem_arch_load( netsnmp_cache *cache, void *magic ) {
+     static int   first = 1;
+     ssize_t      bytes_read;
+     char        *b;
+-    unsigned long memtotal = 0,  memfree = 0, memshared = 0,
+    int          have_memavail = 0;
+    unsigned long memtotal = 0,  memavail = 0, memfree = 0, memshared = 0,
+                   buffers = 0,   cached = 0, sreclaimable = 0,
+                   swaptotal = 0, swapfree = 0;
+ 
+@@ -81,6 +82,11 @@ int netsnmp_mem_arch_load( netsnmp_cache *cache, void *magic ) {
+         if (first)
+             snmp_log(LOG_ERR, "No MemTotal line in /proc/meminfo\n");
+     }
+    b = strstr(buff, "MemAvailable: ");
+    if (b) {
+        have_memavail = 1;
+        sscanf(b, "MemAvailable: %lu", &memavail);
+    }
+     b = strstr(buff, "MemFree: ");
+     if (b) 
+         sscanf(b, "MemFree: %lu", &memfree);
+@@ -151,6 +157,18 @@ int netsnmp_mem_arch_load( netsnmp_cache *cache, void *magic ) {
+         mem->other = -1;
+     }
+ 
+    if (have_memavail) {
+        mem = netsnmp_memory_get_byIdx(NETSNMP_MEM_TYPE_AVAILMEM, 1);
+        if (mem) {
+            if (!mem->descr)
+                mem->descr = strdup("Available memory");
+            mem->units = 1024;
+            mem->size  = memavail;
+            mem->free  = memavail;
+            mem->other = -1;
+        }
+    }
+
+     mem = netsnmp_memory_get_byIdx( NETSNMP_MEM_TYPE_VIRTMEM, 1 );
+     if (!mem) {
+         snmp_log_perror("No Virtual Memory info entry");
+diff --git a/agent/mibgroup/ucd-snmp/memory.c b/agent/mibgroup/ucd-snmp/memory.c
+index 371a77e9a5..158b28e67b 100644
+--- a/agent/mibgroup/ucd-snmp/memory.c
+++ b/agent/mibgroup/ucd-snmp/memory.c
+@@ -26,7 +26,7 @@ init_memory(void)
+         netsnmp_create_handler_registration("memory", handle_memory,
+                                  memory_oid, OID_LENGTH(memory_oid),
+                                              HANDLER_CAN_RONLY),
+-                                 1, 26);
+                                 1, 27);
+     netsnmp_register_scalar(
+         netsnmp_create_handler_registration("memSwapError", handle_memory,
+                            memSwapError_oid, OID_LENGTH(memSwapError_oid),
+@@ -272,6 +272,16 @@ handle_memory(netsnmp_mib_handler *handler,
+ 	    c64.low = val & 0xFFFFFFFF;
+ 	    c64.high = val >>32;
+             break;
+        case MEMORY_SYS_AVAIL:
+	    type = ASN_COUNTER64;
+            mem_info = netsnmp_memory_get_byIdx(NETSNMP_MEM_TYPE_AVAILMEM, 0);
+            if (!mem_info)
+                goto NOSUCH;
+            val = mem_info->size;       /* memavail */
+            val *= (mem_info->units/1024);
+	    c64.low = val & 0xFFFFFFFF;
+	    c64.high = val >> 32;
+            break;
+         case MEMORY_SWAP_ERROR:
+             mem_info = netsnmp_memory_get_byIdx( NETSNMP_MEM_TYPE_SWAP, 0 );
+             if (!mem_info)
+diff --git a/agent/mibgroup/ucd-snmp/memory.h b/agent/mibgroup/ucd-snmp/memory.h
+index ded2140227..54a56a2fdb 100644
+--- a/agent/mibgroup/ucd-snmp/memory.h
+++ b/agent/mibgroup/ucd-snmp/memory.h
+@@ -41,6 +41,7 @@ Netsnmp_Node_Handler handle_memory;
+ #define MEMORY_SHARED_X     24
+ #define MEMORY_BUFFER_X     25
+ #define MEMORY_CACHED_X     26
+#define MEMORY_SYS_AVAIL    27
+ #define MEMORY_SWAP_ERROR  100
+ #define MEMORY_SWAP_ERRMSG 101
+ #endif                          /* MEMORY_H */
+diff --git a/include/net-snmp/agent/hardware/memory.h b/include/net-snmp/agent/hardware/memory.h
+index 54265cf22a..aca3a4d00d 100644
+--- a/include/net-snmp/agent/hardware/memory.h
+++ b/include/net-snmp/agent/hardware/memory.h
+@@ -10,6 +10,7 @@ typedef struct netsnmp_memory_info_s netsnmp_memory_info;
+ #define NETSNMP_MEM_TYPE_SHARED   8
+ #define NETSNMP_MEM_TYPE_SHARED2  9
+ #define NETSNMP_MEM_TYPE_SWAP    10
+#define NETSNMP_MEM_TYPE_AVAILMEM 11
+     /* Leave space for individual swap devices */
+ #define NETSNMP_MEM_TYPE_MAX     30
+ 
+diff --git a/mibs/UCD-SNMP-MIB.txt b/mibs/UCD-SNMP-MIB.txt
+index cde67feb50..d360bad025 100644
+--- a/mibs/UCD-SNMP-MIB.txt
+++ b/mibs/UCD-SNMP-MIB.txt
+@@ -746,6 +746,22 @@ memCachedX OBJECT-TYPE
+          memory as specifically reserved for this purpose."
+     ::= { memory 26 }
+ 
+memSysAvail OBJECT-TYPE
+    SYNTAX	CounterBasedGauge64
+    UNITS       "kB"
+    MAX-ACCESS	read-only
+    STATUS	current
+    DESCRIPTION
+        "The total amount of available memory, which is an estimate
+         of how much memory is available for starting new applications,
+         without swapping.
+
+         This object will not be implemented on hosts where the
+         underlying operating system does not explicitly identify
+         memory as specifically reserved for this purpose."
+    ::= { memory 27 }
+
+
+ memSwapError OBJECT-TYPE
+     SYNTAX	UCDErrorFlag
+     MAX-ACCESS	read-only
+
--- a/SOURCES/net-snmp-5.8-memleak-backport.patch
+++ b/SOURCES/net-snmp-5.8-memleak-backport.patch
@ -0,0 +1,92 @@
+From c6facf2f080c9e1ea803e4884dc92889ec83d990 Mon Sep 17 00:00:00 2001
+From: Drew A Roedersheimer <Drew.A.Roedersheimer@leidos.com>
+Date: Wed, 10 Oct 2018 21:42:35 -0700
+Subject: [PATCH] snmplib/keytools: Fix a memory leak
+
+Avoid that Valgrind reports the following memory leak:
+
+17,328 bytes in 361 blocks are definitely lost in loss record 696 of 704
+   at 0x4C29BE3: malloc (vg_replace_malloc.c:299)
+   by 0x52223B7: CRYPTO_malloc (in /usr/lib64/libcrypto.so.1.0.2k)
+   by 0x52DDB06: EVP_MD_CTX_create (in /usr/lib64/libcrypto.so.1.0.2k)
+   by 0x4E9885D: generate_Ku (keytools.c:186)
+   by 0x40171F: asynchronous (leaktest.c:276)
+   by 0x400FE7: main (leaktest.c:356)
+---
+ snmplib/keytools.c | 12 ++++++++----
+ 1 file changed, 8 insertions(+), 4 deletions(-)
+
+diff --git a/snmplib/keytools.c b/snmplib/keytools.c
+index 2cf0240abf..dcdae044ac 100644
+--- a/snmplib/keytools.c
+++ b/snmplib/keytools.c
+@@ -186,11 +186,15 @@ generate_Ku(const oid * hashtype, u_int hashtype_len,
+     ctx = EVP_MD_CTX_create();
+ #else
+     ctx = malloc(sizeof(*ctx));
+-    if (!EVP_MD_CTX_init(ctx))
+-        return SNMPERR_GENERR;
+    if (!EVP_MD_CTX_init(ctx)) {
+        rval = SNMPERR_GENERR;
+        goto generate_Ku_quit;
+    }
+ #endif
+-    if (!EVP_DigestInit(ctx, hashfn))
+-        return SNMPERR_GENERR;
+    if (!EVP_DigestInit(ctx, hashfn)) {
+        rval = SNMPERR_GENERR;
+        goto generate_Ku_quit;
+    }
+ 
+ #elif NETSNMP_USE_INTERNAL_CRYPTO
+ #ifndef NETSNMP_DISABLE_MD5
+From 67726f2a74007b5b4117fe49ca1e02c86110b624 Mon Sep 17 00:00:00 2001
+From: Drew A Roedersheimer <Drew.A.Roedersheimer@leidos.com>
+Date: Tue, 9 Oct 2018 23:28:25 +0000
+Subject: [PATCH] snmplib: Fix a memory leak in scapi.c
+
+This patch avoids that Valgrind reports the following leak:
+
+==1069== 3,456 bytes in 72 blocks are definitely lost in loss record 1,568 of 1,616
+==1069==    at 0x4C29BE3: malloc (vg_replace_malloc.c:299)
+==1069==    by 0x70A63B7: CRYPTO_malloc (in /usr/lib64/libcrypto.so.1.0.2k)
+==1069==    by 0x7161B06: EVP_MD_CTX_create (in /usr/lib64/libcrypto.so.1.0.2k)
+==1069==    by 0x4EA3017: sc_hash (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4EA1CD8: hash_engineID (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4EA1DEC: search_enginetime_list (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4EA2256: set_enginetime (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4EC495E: usm_process_in_msg (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4EC58CA: usm_secmod_process_in_msg (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4E7B91D: snmpv3_parse (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4E7C1F6: ??? (in /usr/lib64/libnetsnmp.so.31.0.2)
+==1069==    by 0x4E7CE94: ??? (in /usr/lib64/libnetsnmp.so.31.0.2)
+
+[ bvanassche: minimized diffs / edited commit message ]
+---
+ snmplib/scapi.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/snmplib/scapi.c b/snmplib/scapi.c
+index 8ad1d70d90..54310099d8 100644
+--- a/snmplib/scapi.c
+++ b/snmplib/scapi.c
+@@ -967,7 +967,8 @@ sc_hash_type(int auth_type, const u_char * buf, size_t buf_len, u_char * MAC,
+ #endif
+     if (!EVP_DigestInit(cptr, hashfn)) {
+         /* requested hash function is not available */
+-        return SNMPERR_SC_NOT_CONFIGURED;
+        rval = SNMPERR_SC_NOT_CONFIGURED;
+        goto sc_hash_type_quit;
+     }
+ 
+ /** pass the data */
+@@ -976,6 +977,8 @@ sc_hash_type(int auth_type, const u_char * buf, size_t buf_len, u_char * MAC,
+ /** do the final pass */
+     EVP_DigestFinal(cptr, MAC, &tmp_len);
+     *MAC_len = tmp_len;
+
+sc_hash_type_quit:
+ #if defined(HAVE_EVP_MD_CTX_FREE)
+     EVP_MD_CTX_free(cptr);
+ #elif defined(HAVE_EVP_MD_CTX_DESTROY)
+
--- a/SOURCES/net-snmp-5.8-memory-reporting.patch
+++ b/SOURCES/net-snmp-5.8-memory-reporting.patch
@ -0,0 +1,35 @@
+diff -urNp a/agent/mibgroup/hardware/memory/memory_linux.c b/agent/mibgroup/hardware/memory/memory_linux.c
+--- a/agent/mibgroup/hardware/memory/memory_linux.c	2020-06-10 13:36:40.164588176 +0200
+++ b/agent/mibgroup/hardware/memory/memory_linux.c	2020-06-10 13:38:59.398944829 +0200
+@@ -29,7 +29,7 @@ int netsnmp_mem_arch_load( netsnmp_cache
+     ssize_t      bytes_read;
+     char        *b;
+     unsigned long memtotal = 0,  memfree = 0, memshared = 0,
+-                  buffers = 0,   cached = 0,
+                  buffers = 0,   cached = 0, sreclaimable = 0,
+                   swaptotal = 0, swapfree = 0;
+ 
+     netsnmp_memory_info *mem;
+@@ -127,6 +127,13 @@ int netsnmp_mem_arch_load( netsnmp_cache
+         if (first)
+             snmp_log(LOG_ERR, "No SwapTotal line in /proc/meminfo\n");
+     }
+    b = strstr(buff, "SReclaimable: ");
+    if (b)
+        sscanf(b, "SReclaimable: %lu", &sreclaimable);
+    else {
+        if (first)
+            snmp_log(LOG_ERR, "No SReclaimable line in /proc/meminfo\n");
+    }
+     b = strstr(buff, "SwapFree: ");
+     if (b)
+         sscanf(b, "SwapFree: %lu", &swapfree);
+@@ -183,7 +190,7 @@ int netsnmp_mem_arch_load( netsnmp_cache
+         if (!mem->descr)
+              mem->descr = strdup("Cached memory");
+         mem->units = 1024;
+-        mem->size  = cached;
+        mem->size  = cached+sreclaimable;
+         mem->free  = 0;     /* Report cached size/used as equal */
+         mem->other = -1;
+     }
--- a/SOURCES/net-snmp-5.8-proxy-getnext.patch
+++ b/SOURCES/net-snmp-5.8-proxy-getnext.patch
@ -0,0 +1,12 @@
+diff -ruNp a/agent/mibgroup/ucd-snmp/proxy.c b/agent/mibgroup/ucd-snmp/proxy.c
+--- a/agent/mibgroup/ucd-snmp/proxy.c	2020-06-10 09:24:24.933347483 +0200
+++ b/agent/mibgroup/ucd-snmp/proxy.c	2020-06-10 09:25:49.007148474 +0200
+@@ -460,7 +460,7 @@ proxy_handler(netsnmp_mib_handler *handl
+         if (sp->base_len &&
+             reqinfo->mode == MODE_GETNEXT &&
+             (snmp_oid_compare(ourname, ourlength,
+-                              sp->base, sp->base_len) < 0)) {
+                              sp->name, sp->name_len) < 0)) {
+             DEBUGMSGTL(( "proxy", "request is out of registered range\n"));
+             /*
+              * Create GETNEXT request with an OID so the
--- a/SOURCES/net-snmp-5.8-proxy-time-out.patch
+++ b/SOURCES/net-snmp-5.8-proxy-time-out.patch
@ -0,0 +1,33 @@
+From 6fd7499ccaafdf244a74306972562b2091cb91b1 Mon Sep 17 00:00:00 2001
+From: fisabelle <fisabelle@broadsoft.com>
+Date: Thu, 9 Jul 2020 15:49:35 -0400
+Subject: [PATCH] Issue#147: Net-SNMP not responding when proxy requests times
+ out
+
+---
+ agent/mibgroup/ucd-snmp/proxy.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/agent/mibgroup/ucd-snmp/proxy.c b/agent/mibgroup/ucd-snmp/proxy.c
+index 24ae9322bd..e0ee96b29a 100644
+--- a/agent/mibgroup/ucd-snmp/proxy.c
+++ b/agent/mibgroup/ucd-snmp/proxy.c
+@@ -572,6 +572,17 @@ proxy_got_response(int operation, netsnmp_session * sess, int reqid,
+     }
+ 
+     switch (operation) {
+    case NETSNMP_CALLBACK_OP_RESEND:
+         /*
+         * Issue#147: Net-SNMP not responding when proxy requests times out
+         *
+         * When snmp_api issue a resend, the default case was hit and the 
+         * delagated cache was freed.
+         * As a result, the NETSNMP_CALLBACK_OP_TIMED_OUT never came in.
+         */
+        DEBUGMSGTL(("proxy", "pdu has been resent for request = %8p\n", requests));
+        return SNMP_ERR_NOERROR;
+
+     case NETSNMP_CALLBACK_OP_TIMED_OUT:
+         /*
+          * WWWXXX: don't leave requests delayed if operation is
+
--- a/SOURCES/net-snmp-5.8-proxy.patch
+++ b/SOURCES/net-snmp-5.8-proxy.patch
@ -0,0 +1,46 @@
+From b67afb81eb0f7ad89496cd3e672654bfd8c55d0e Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Sat, 21 Mar 2020 20:03:13 -0700
+Subject: [PATCH] snmpd: UCD-SNMP proxy: Fix a crash triggered by a wrong
+ passphrase
+
+See also https://github.com/net-snmp/net-snmp/issues/82 .
+---
+ agent/mibgroup/ucd-snmp/proxy.c | 9 ---------
+ 1 file changed, 9 deletions(-)
+
+diff --git a/agent/mibgroup/ucd-snmp/proxy.c b/agent/mibgroup/ucd-snmp/proxy.c
+index f4eb03ef6f..548ae7588f 100644
+--- a/agent/mibgroup/ucd-snmp/proxy.c
+++ b/agent/mibgroup/ucd-snmp/proxy.c
+@@ -698,8 +698,6 @@ proxy_got_response(int operation, netsnmp_session * sess, int reqid,
+                                  "proxy OID return length too long.\n");
+                         netsnmp_set_request_error(cache->reqinfo, requests,
+                                                   SNMP_ERR_GENERR);
+-                        if (pdu)
+-                            snmp_free_pdu(pdu);
+                         netsnmp_free_delegated_cache(cache);
+                         return 1;
+                     }
+@@ -723,8 +721,6 @@ proxy_got_response(int operation, netsnmp_session * sess, int reqid,
+              * ack, this is bad.  The # of varbinds don't match and
+              * there is no way to fix the problem 
+              */
+-            if (pdu)
+-                snmp_free_pdu(pdu);
+             snmp_log(LOG_ERR,
+                      "response to proxy request illegal.  We're screwed.\n");
+             netsnmp_set_request_error(cache->reqinfo, requests,
+@@ -735,11 +731,6 @@ proxy_got_response(int operation, netsnmp_session * sess, int reqid,
+         if (cache->reqinfo->mode == MODE_GETBULK)
+             netsnmp_bulk_to_next_fix_requests(requests);
+         
+-        /*
+-         * free the response 
+-         */
+-        if (pdu && 0)
+-            snmp_free_pdu(pdu);
+ 	break;
+ 
+     default:
+
--- a/SOURCES/net-snmp-5.8-rpm-memory-leak.patch
+++ b/SOURCES/net-snmp-5.8-rpm-memory-leak.patch
@ -0,0 +1,26 @@
+diff -urNp a/agent/mibgroup/host/data_access/swinst_rpm.c b/agent/mibgroup/host/data_access/swinst_rpm.c
+--- a/agent/mibgroup/host/data_access/swinst_rpm.c	2020-06-10 14:32:43.330486233 +0200
+++ b/agent/mibgroup/host/data_access/swinst_rpm.c	2020-06-10 14:35:46.672298741 +0200
+@@ -75,6 +75,9 @@ netsnmp_swinst_arch_init(void)
+     snprintf( pkg_directory, SNMP_MAXPATH, "%s/Packages", dbpath );
+     SNMP_FREE(rpmdbpath);
+     dbpath = NULL;
+#ifdef HAVE_RPMGETPATH
+    rpmFreeRpmrc();
+#endif
+     if (-1 == stat( pkg_directory, &stat_buf )) {
+         snmp_log(LOG_ERR, "Can't find directory of RPM packages");
+         pkg_directory[0] = '\0';
+diff -urNp a/agent/mibgroup/host/hr_swinst.c b/agent/mibgroup/host/hr_swinst.c
+--- a/agent/mibgroup/host/hr_swinst.c	2020-06-10 14:32:43.325486184 +0200
+++ b/agent/mibgroup/host/hr_swinst.c	2020-06-10 14:36:44.423872418 +0200
+@@ -231,6 +231,9 @@ init_hr_swinst(void)
+             snprintf(path, sizeof(path), "%s/packages.rpm", swi->swi_dbpath);
+         path[ sizeof(path)-1 ] = 0;
+         swi->swi_directory = strdup(path);
+#ifdef HAVE_RPMGETPATH
+        rpmFreeRpmrc();
+#endif
+     }
+ #else
+ #  ifdef _PATH_HRSW_directory
--- a/SOURCES/net-snmp-5.8-sec-memory-leak.patch
+++ b/SOURCES/net-snmp-5.8-sec-memory-leak.patch
@ -0,0 +1,84 @@
+diff -urNp a/agent/snmp_agent.c b/agent/snmp_agent.c
+--- a/agent/snmp_agent.c	2020-06-11 10:20:31.646339191 +0200
+++ b/agent/snmp_agent.c	2020-06-11 10:23:41.178056889 +0200
+@@ -1605,12 +1605,6 @@ free_agent_snmp_session(netsnmp_agent_se
+     DEBUGMSGTL(("verbose:asp", "asp %p reqinfo %p freed\n",
+                 asp, asp->reqinfo));
+ 
+-    /* Clean up securityStateRef here to prevent a double free */
+-    if (asp->orig_pdu && asp->orig_pdu->securityStateRef)
+-	snmp_free_securityStateRef(asp->orig_pdu);
+-    if (asp->pdu && asp->pdu->securityStateRef)
+-	snmp_free_securityStateRef(asp->pdu);
+-
+     if (asp->orig_pdu)
+         snmp_free_pdu(asp->orig_pdu);
+     if (asp->pdu)
+diff -urNp a/include/net-snmp/pdu_api.h b/include/net-snmp/pdu_api.h
+--- a/include/net-snmp/pdu_api.h	2020-06-11 10:20:31.631339058 +0200
+++ b/include/net-snmp/pdu_api.h	2020-06-11 10:24:17.261390028 +0200
+@@ -19,8 +19,6 @@ NETSNMP_IMPORT
+ netsnmp_pdu    *snmp_fix_pdu(  netsnmp_pdu *pdu, int idx);
+ NETSNMP_IMPORT
+ void            snmp_free_pdu( netsnmp_pdu *pdu);
+-NETSNMP_IMPORT
+-void            snmp_free_securityStateRef( netsnmp_pdu *pdu);
+ 
+ #ifdef __cplusplus
+ }
+diff -urNp a/snmplib/snmp_api.c b/snmplib/snmp_api.c
+--- a/snmplib/snmp_api.c	2020-06-11 10:20:31.695339627 +0200
+++ b/snmplib/snmp_api.c	2020-06-11 10:33:55.510891945 +0200
+@@ -4034,17 +4034,6 @@ free_securityStateRef(netsnmp_pdu* pdu)
+     pdu->securityStateRef = NULL;
+ }
+ 
+-/*
+- * This function is here to provide a separate call to
+- * free the securityStateRef memory. This is needed to prevent
+- * a double free if this memory is freed in snmp_free_pdu.
+- */
+-void
+-snmp_free_securityStateRef(netsnmp_pdu* pdu)
+-{
+-   free_securityStateRef(pdu);
+-}
+-
+ #define ERROR_STAT_LENGTH 11
+ 
+ int
+@@ -5473,6 +5462,8 @@ snmp_free_pdu(netsnmp_pdu *pdu)
+     if (!pdu)
+         return;
+ 
+    free_securityStateRef(pdu);
+
+     /*
+      * If the command field is empty, that probably indicates
+      *   that this PDU structure has already been freed.
+@@ -5647,12 +5638,6 @@ _sess_process_packet_parse_pdu(void *ses
+   }
+ 
+   if (ret != SNMP_ERR_NOERROR) {
+-    /*
+-     * Call the security model to free any securityStateRef supplied w/ msg.  
+-     */
+-    if (pdu->securityStateRef != NULL) {
+-      free_securityStateRef(pdu);
+-    }
+     snmp_free_pdu(pdu);
+     return NULL;
+   }
+@@ -5826,12 +5811,6 @@ _sess_process_packet_handle_pdu(void *se
+     }
+   }
+ 
+-  /*
+-   * Call USM to free any securityStateRef supplied with the message.  
+-   */
+-  if (pdu->securityStateRef && pdu->command == SNMP_MSG_TRAP2)
+-    free_securityStateRef(pdu);
+-
+   if (!handled) {
+     if (sp->flags & SNMP_FLAGS_SHARED_SOCKET)
+       return -2;
--- a/SOURCES/net-snmp-5.8-sendmsg-error-code.patch
+++ b/SOURCES/net-snmp-5.8-sendmsg-error-code.patch
@ -0,0 +1,12 @@
+diff -urNp a/snmplib/transports/snmpUDPBaseDomain.c b/snmplib/transports/snmpUDPBaseDomain.c
+--- a/snmplib/transports/snmpUDPBaseDomain.c	2023-08-01 08:20:56.776099134 +0200
+++ b/snmplib/transports/snmpUDPBaseDomain.c	2023-08-01 08:23:18.921323874 +0200
+@@ -293,7 +293,7 @@ int netsnmp_udpbase_sendto(int fd, const
+         }
+ 
+         rc = sendmsg(fd, &m, MSG_NOSIGNAL|MSG_DONTWAIT);
+-        if (rc >= 0 || errno != EINVAL)
+        if (rc >= 0 || (errno != EINVAL && errno != ENETUNREACH))
+             return rc;
+ 
+         /*
--- a/SOURCES/net-snmp-5.8-truncating-log-once.patch
+++ b/SOURCES/net-snmp-5.8-truncating-log-once.patch
@ -0,0 +1,48 @@
+From 7330e3e3e08d9baff23332e764f9a53561939fff Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Thu, 2 Sep 2021 21:06:54 -0700
+Subject: [PATCH] libsnmp: Log "Truncating integer value >32 bits" once
+
+Log this message once instead of every time sysUpTime and/or
+hrSystemUptime are accessed after snmpd is running for more than 497 days.
+
+Fixes: https://github.com/net-snmp/net-snmp/issues/144
+---
+ snmplib/snmp_client.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+diff --git a/snmplib/snmp_client.c b/snmplib/snmp_client.c
+index 0f539c63fe..b00670d973 100644
+--- a/snmplib/snmp_client.c
+++ b/snmplib/snmp_client.c
+@@ -853,7 +853,8 @@ snmp_set_var_value(netsnmp_variable_list * vars,
+                 = (const u_long *) value;
+             *(vars->val.integer) = *val_ulong;
+             if (*(vars->val.integer) > 0xffffffff) {
+-                snmp_log(LOG_ERR,"truncating integer value > 32 bits\n");
+                NETSNMP_LOGONCE((LOG_INFO,
+                                 "truncating integer value > 32 bits\n"));
+                 *(vars->val.integer) &= 0xffffffff;
+             }
+         }
+@@ -865,7 +866,8 @@ snmp_set_var_value(netsnmp_variable_list * vars,
+                 = (const unsigned long long *) value;
+             *(vars->val.integer) = (long) *val_ullong;
+             if (*(vars->val.integer) > 0xffffffff) {
+-                snmp_log(LOG_ERR,"truncating integer value > 32 bits\n");
+                NETSNMP_LOGONCE((LOG_INFO,
+                                 "truncating integer value > 32 bits\n"));
+                 *(vars->val.integer) &= 0xffffffff;
+             }
+         }
+@@ -877,7 +879,8 @@ snmp_set_var_value(netsnmp_variable_list * vars,
+                 = (const uintmax_t *) value;
+             *(vars->val.integer) = (long) *val_uintmax_t;
+             if (*(vars->val.integer) > 0xffffffff) {
+-                snmp_log(LOG_ERR,"truncating integer value > 32 bits\n");
+                NETSNMP_LOGONCE((LOG_INFO,
+                                 "truncating integer value > 32 bits\n"));
+                 *(vars->val.integer) &= 0xffffffff;
+             }
+         }
+
--- a/SOURCES/net-snmp-5.8-util-fix.patch
+++ b/SOURCES/net-snmp-5.8-util-fix.patch
@ -0,0 +1,13 @@
+diff -urNp a/snmplib/cert_util.c b/snmplib/cert_util.c
+--- a/snmplib/cert_util.c	2021-12-09 08:45:23.217942229 +0100
+++ b/snmplib/cert_util.c	2021-12-09 08:46:56.567562352 +0100
+@@ -1368,8 +1368,7 @@ _add_certfile(const char* dirname, const
+ 
+            okey = PEM_read_bio_PrivateKey(certbio, NULL, NULL, NULL);
+            if (NULL == okey)
+-               snmp_log(LOG_ERR, "error parsing key file %s\n",
+-                     key->info.filename);
+               snmp_log(LOG_ERR, "error parsing key file %s\n", filename);
+            else {
+                key = _add_key(okey, dirname, filename, index);
+                if (NULL == key) {
--- a/SOURCES/snmpd.service
+++ b/SOURCES/snmpd.service
@ -1,6 +1,6 @@
 [Unit]
 Description=Simple Network Management Protocol (SNMP) Daemon.
-After=syslog.target network.target
+After=syslog.target network-online.target

 [Service]
 Type=notify
--- a/SOURCES/snmptrapd.service
+++ b/SOURCES/snmptrapd.service
@ -1,6 +1,6 @@
 [Unit]
 Description=Simple Network Management Protocol (SNMP) Trap Daemon.
-After=syslog.target network.target
+After=syslog.target network-online.target

 [Service]
 Type=notify
--- a/SPECS/net-snmp.spec
+++ b/SPECS/net-snmp.spec
@ -10,7 +10,7 @@
 Summary:    A collection of SNMP protocol tools and libraries
 Name:       net-snmp
 Version:    5.8
-Release:    14%{?dist}
+Release:    30%{?dist}
 Epoch:      1

 License:    BSD
@ -46,6 +46,41 @@ Patch17:    net-snmp-5.8-trapsink.patch
 Patch18:    net-snmp-5.8-flood-messages.patch
 Patch19:    net-snmp-5.8-v3-forward.patch
 Patch20:    net-snmp-5.8-sec-counter.patch
+Patch21:    net-snmp-5.8-proxy-getnext.patch
+Patch22:    net-snmp-5.8-dskTable-dynamic.patch
+Patch23:    net-snmp-5.8-expand-SNMPCONFPATH.patch
+Patch24:    net-snmp-5.8-duplicate-ipAddress.patch
+Patch25:    net-snmp-5.8-memory-reporting.patch
+Patch26:    net-snmp-5.8-man-page.patch
+Patch27:    net-snmp-5.8-ipAddress-faster-load.patch
+Patch28:    net-snmp-5.8-rpm-memory-leak.patch
+Patch29:    net-snmp-5.8-sec-memory-leak.patch
+Patch30:    net-snmp-5.8-aes-config.patch
+Patch31:    net-snmp-5.7.2-CVE-2020-15862.patch
+Patch32:    net-snmp-5.8-bulk.patch
+Patch33:    net-snmp-5.8-clientaddr-error-message.patch
+Patch34:    net-snmp-5.8-ipv6-disabled.patch
+Patch35:    net-snmp-5.8-empty-passphrase.patch
+Patch36:    net-snmp-5.8-asn-parse-nlength.patch
+Patch37:    net-snmp-5.8-double-IP-parsing.patch
+Patch38:    net-snmp-5.8-digest-from-ECC.patch
+Patch39:    net-snmp-5.8-broken-errmsg.patch
+Patch40:    net-snmp-5.8-intermediate-certs.patch
+Patch41:    net-snmp-5.8-fix-cert-crash.patch
+Patch42:    net-snmp-5.8-engine-id.patch
+Patch43:    net-snmp-5.8-certs.patch
+Patch44:    net-snmp-5.8-util-fix.patch
+Patch45:    net-snmp-5.8-deleted-iface.patch
+Patch46:    net-snmp-5.8-memleak-backport.patch
+Patch47:    net-snmp-5.8-dev-mem-leak.patch
+Patch48:    net-snmp-5.8-CVE-2022-44792-44793.patch
+Patch49:    net-snmp-5.8-ipv6-disable-leak.patch
+Patch50:    net-snmp-5.8-proxy-time-out.patch
+Patch51:    net-snmp-5.8-sendmsg-error-code.patch
+Patch52:    net-snmp-5.8-memavailable.patch
+Patch53:    net-snmp-5.8-proxy.patch
+Patch54:    net-snmp-5.8-truncating-log-once.patch
+Patch55:    net-snmp-5.8-CVE-2022-24805-24810.patch

 # Modern RPM API means at least EL6
 Patch101:   net-snmp-5.8-modern-rpm-api.patch
@ -191,6 +226,41 @@ rm -r python
 %patch18 -p1 -b .flood-messages
 %patch19 -p1 -b .v3-forward
 %patch20 -p1 -b .sec-counter
+%patch21 -p1 -b .proxy-getnext
+%patch22 -p1 -b .dskTable-dynamic
+%patch23 -p1 -b .expand-SNMPCONFPATH
+%patch24 -p1 -b .duplicate-ipAddress
+%patch25 -p1 -b .memory-reporting
+%patch26 -p1 -b .man-page
+%patch27 -p1 -b .ipAddress-faster-load
+%patch28 -p1 -b .rpm-memory-leak
+%patch29 -p1 -b .sec-memory-leak
+%patch30 -p1 -b .aes-config
+%patch31 -p1 -b .CVE-2020-15862
+%patch32 -p1 -b .bulk
+%patch33 -p1 -b .clientaddr-error-message
+%patch34 -p1 -b .ipv6-disabled
+%patch35 -p1 -b .empty-passphrase
+%patch36 -p1 -b .asn-parse-nlength
+%patch37 -p1 -b .double-IP-parsing
+%patch38 -p1 -b .digest-from-ECC
+%patch39 -p1 -b .broken-errmsg
+%patch40 -p1 -b .intermediate-certs
+%patch41 -p1 -b .fix-cert-crash
+%patch42 -p1 -b .engine-id
+%patch43 -p1 -b .certs
+%patch44 -p1 -b .utils
+%patch45 -p1 -b .ifaces
+%patch46 -p1 -b .memleak-backport
+%patch47 -p1 -b .dev-mem-leak
+%patch48 -p1 
+%patch49 -p1 -b .ipv6-disable-leak
+%patch50 -p1 -b .proxy-time-out
+%patch51 -p1 -b .sendmsg-error-code
+%patch52 -p1 -b .memavailable
+%patch53 -p1 -b .proxy
+%patch54 -p1 -b .truncating-log-once
+%patch55 -p1 -b .CVE-2022-24805-24810

 %patch101 -p1 -b .modern-rpm-api

@ -220,6 +290,7 @@ MIBS="$MIBS ucd-snmp/lmsensorsMib"
 %configure \
    --disable-static --enable-shared \
    --enable-as-needed \
+    --enable-blumenthal-aes \
    --enable-embedded-perl \
    --enable-ipv6 \
    --enable-local-smux \
@ -227,7 +298,7 @@ MIBS="$MIBS ucd-snmp/lmsensorsMib"
    --enable-ucd-snmp-compatibility \
    --sysconfdir=%{_sysconfdir} \
    --with-cflags="$RPM_OPT_FLAGS" \
-    --with-ldflags="-Wl,-z,relro -Wl,-z,now" \
+    --with-ldflags="-Wl,-z,relro -Wl,-z,now -lm" \
    --with-logfile="/var/log/snmpd.log" \
    --with-mib-modules="$MIBS" \
    --with-mysql \
@ -368,8 +439,8 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
 %doc README.thread AGENT.txt PORTING local/README.mib2c
 %doc IETF-MIB-LICENSE.txt
 %dir %{_sysconfdir}/snmp
-%config(noreplace) %attr(0650,root,root) %{_sysconfdir}/snmp/snmpd.conf
-%config(noreplace) %attr(0650,root,root) %{_sysconfdir}/snmp/snmptrapd.conf
+%config(noreplace) %attr(0600,root,root) %{_sysconfdir}/snmp/snmpd.conf
+%config(noreplace) %attr(0600,root,root) %{_sysconfdir}/snmp/snmptrapd.conf
 %{_bindir}/snmpconf
 %{_bindir}/net-snmp-create-v3-user
 %{_sbindir}/*
@ -444,6 +515,81 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test
 %{_libdir}/libnetsnmptrapd*.so.%{soname}*

 %changelog
+* Mon Mar 04 2024 Josef Ridky <jridky@redhat.com> - 1:5.8-30
+- fix crash when configured as proxy - issue 82 (RHEL-14454)
+- log once truncating issue (RHEL-13597)
+- fix CVE-2022-24805, CVE-2022-24806, CVE-2022-24807, CVE-2022-24808,
+  CVE-2022-24809 and CVE-2022-24810 (RHEL-26650)
+
+* Tue Jan 23 2024 Josef Ridky <jridky@redhat.com> - 1:5.8-29
+- backport MemAvailable report from upstream (RHEL-21780)
+
+* Wed Aug 02 2023 Josef Ridky <jridky@redhat.com> - 1:5.8-28
+- fix sendmsg error code for new kernel (#2185787)
+
+* Tue Jan 31 2023 Josef Ridky <jridky@redhat.com> - 1:5.8-27
+- fix memory leak due of proc file creating (#2105957)
+- fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
+- fix memory leak when ipv6 disable set to 1 (#2151537)
+- fix proxy timeout issue (#2160723)
+
+* Mon Oct 17 2022 Josef Ridky <jridky@redhat.com> - 1:5.8-26
+- backport two memory leaks from upstream (#2134635)
+
+* Mon Feb 21 2022 Josef Ridky <jridky@redhat.com> - 1:5.8-25
+- fix segfault with error on subcontainer (#2051370)
+
+* Thu Dec 09 2021 Josef Ridky <jridky@redhat.com> - 1:5.8-24
+- fix dereferencing null pointer (#2021403)
+
+* Mon Oct 11 2021 Josef Ridky <jridky@redhat.com> - 1:5.8-23
+- net-snmp-cert gencert create SHA512 (#1908331)
+
+* Mon Jun 28 2021 Josef Ridky <jridky@redhat.com> - 1:5.8-22
+- update engineTime when sending traps (#1973252)
+
+* Wed Jun 09 2021 Josef Ridky <jridky@redhat.com> - 1:5.8-21
+- prevent parsing IP address twice (#1768908)
+- add support for digests detected from ECC certs (#1919714)
+- fix broken ErrorMsg at ucd-snmp (#1933150)
+- add support for intermediate certs (#1914656)
+- fix crash of certs with longer extension (#1908718)
+
+* Tue Jan 05 2021 Josef Ridky <jridky@redhat.com> - 1:5.8-20
+- fix issue with parsing of long traps (#1912242)
+- modify fix for #1877375
+
+* Tue Dec 01 2020 Josef Ridky <jridky@redhat.com> - 1:5.8-19
+- revert permission of config files to 600 (#1601060)
+- fix error message when the address specified by clientaddr option
+  is wrong or cannot be bound (#1877375)
+- log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
+- fix issue with quoting empty passphrase (#1817225)
+
+* Wed Nov 11 2020 Josef Ridky <jridky@redhat.com> - 1:5.8-18
+- fix CVE-2020-15862 (#1875497)
+- fix bulk responses for invalid PID (#1817190)
+
+* Tue Aug 11 2020 Josef Ridky <jridky@redhat.com> - 1:5.8-17
+- add math library in LDFLAGS (#1846252)
+
+* Thu Jul 16 2020 Josef Ridky <jridky@redhat.com> - 1:5.8-16
+- remove file due licensing issues (#1690936)
+
+* Wed Jun 10 2020 Josef Ridky <jridky@redhat.com> - 1:5.8-15
+- proxied OIDs unspecified in proxy statement in snmpd.conf (#1658134)
+- UCD-SNMP-MIB::dskTable doesn't update dynamically (#1658185)
+- expand SNMPCONFPATH variable (#1660146)
+- remove file with Apple license (#1690936)
+- log meningful message on duplicate IP address (#1692286)
+- memory reporting adjustment (#1695497 and #1766521)
+- fix typos in man page (#1700262)
+- speedup ipAddressTable loading(#1700391)
+- fix memory leak when shut down librpm (#1763008)
+- services starts after network-online.target (#1775304)
+- add missing part of memory leak patch (#1829860)
+- add support for AES192 and AES256 (#1846252)
+
 * Mon Mar 16 2020 Josef Ridky <jridky@redhat.com> - 1:5.8-14
 - fix double free or corruption error when freeing security context (#1809077)
 - remove deprecated CFLAG
@ -483,7 +629,7 @@ LD_LIBRARY_PATH=%{buildroot}/%{_libdir} make test

 * Mon Aug 13 2018 Josef Ridky <jridky@redhat.com> - 1:5.8-2
 - fix default configuration file (#1589480 and #1594147)
- modify permissions for /var/log files (#1601060)
+- modify permissions for config files (#1601060)

 * Thu Aug 09 2018 Josef Ridky <jridky@redhat.com> - 1:5.8-1
 - remove python package and update to the last upstream version (#1584510)
Author	SHA1	Message	Date
eabdullin	b8ced33253	import CS net-snmp-5.8-30.el8	2024-05-22 10:45:17 +00:00
eabdullin	e3bf1b1cee	import UBI net-snmp-5.8-28.el8	2023-11-14 19:54:41 +00:00
eabdullin	0be656ad1e	import UBI net-snmp-5.8-27.el8_8.1	2023-11-08 12:37:46 +00:00
CentOS Sources	6fb28e4191	import net-snmp-5.8-27.el8	2023-05-16 06:33:36 +00:00
CentOS Sources	580fa80fa9	import net-snmp-5.8-25.el8_7.1	2023-01-12 09:28:02 +00:00
CentOS Sources	cc0f6f0120	import net-snmp-5.8-25.el8	2022-05-10 07:21:23 +00:00
CentOS Sources	7424c1f06f	import net-snmp-5.8-22.el8	2021-12-07 17:55:14 +00:00
CentOS Sources	401c2d01c1	import net-snmp-5.8-20.el8	2021-09-09 22:45:10 +00:00
CentOS Sources	d21b2d74cd	import net-snmp-5.8-18.el8_3.1	2021-09-09 22:45:07 +00:00
CentOS Sources	102cd86e60	import net-snmp-5.8-17.el8	2021-09-09 22:45:04 +00:00
CentOS Sources	7179fe21b8	import net-snmp-5.8-14.el8_2.1	2021-09-09 22:45:01 +00:00