fix: restore safe SNMPv3 session construction - #620

Open

somethingwithproof wants to merge 26 commits into

Cacti:developfrom

somethingwithproof:fix/597-snmpv3-safety

Commits on Sep 6, 2026

fix: restore the SNMPv3 noAuthNoPriv and authNoPriv security levels
somethingwithproof
committed
e56fffc
build: probe for usmDESPrivProtocol instead of trusting the macro
somethingwithproof
committed
f1ddcca
fix: validate the SNMPv3 auth protocol whenever one is set
somethingwithproof
committed
55e6f58
fix: refuse SNMPv3 privacy that has no authentication, and cover the levels
somethingwithproof
committed
875cd55
fix: release the authNoPriv passphrase copy, and make CI run the ping tests
somethingwithproof
committed
0735bd5
fix: wipe the local SNMPv3 passphrase copies before freeing them
somethingwithproof
committed
ba7dc97
fix(snmp): harden authentication protocol fallbacks
somethingwithproof
committed
0ee8b21
fix(snmp): close reviewed SNMPv3 safety gaps
somethingwithproof
committed
7772d47
test: use the platform ICMP unreachable spelling
somethingwithproof
committed
6c7f65e
fix(snmp): fail closed when session secrets cannot be installed
somethingwithproof
committed
13f7f32
test(snmp): make session coverage deterministic
somethingwithproof
committed
68ff9e4
fix(snmp): reject incomplete privacy sessions
somethingwithproof
committed
aaac9d2
fix(snmp): preserve incomplete privacy compatibility
somethingwithproof
committed
c39fcd1
fix(snmp): narrow privacy refusal to configured encryption
somethingwithproof
committed
48f1707
fix(snmp): preserve authentication refusal boundary
somethingwithproof
committed
370fc73
fix(snmp): refuse incomplete security settings
somethingwithproof
committed
2da3a86
fix(snmp): match Cacti security-level selection
somethingwithproof
committed
e25805c
fix(snmp): distinguish empty protocols from none
somethingwithproof
committed
114481c
fix(snmp): make refusal handling explicit
somethingwithproof
committed
99b2548
fix(snmp): avoid promising a successful downgrade
somethingwithproof
committed
c31cf56
test(snmp): respect optional Net-SNMP transforms
somethingwithproof
committed
80277a2
fix(snmp): show downgrades at default verbosity
somethingwithproof
committed
aad0f1e
fix(snmp): validate privacy algorithms at every level
somethingwithproof
committed
0c89142
fix(snmp): validate privacy only when it is used
somethingwithproof
committed
e8b9d7d
fix(snmp): reject multi-get without a session
somethingwithproof
committed
90a4e69
test(snmp): keep bounded string copies
somethingwithproof
committed
b5a8d62

Navigation Menu

Uh oh!

fix: restore safe SNMPv3 session construction - #620

fix: restore safe SNMPv3 session construction#620
somethingwithproof wants to merge 26 commits into
Cacti:developfrom
somethingwithproof:fix/597-snmpv3-safety

Commits on Sep 6, 2026

fix: restore the SNMPv3 noAuthNoPriv and authNoPriv security levels

build: probe for usmDESPrivProtocol instead of trusting the macro

fix: validate the SNMPv3 auth protocol whenever one is set

fix: refuse SNMPv3 privacy that has no authentication, and cover the levels

fix: release the authNoPriv passphrase copy, and make CI run the ping tests

fix: wipe the local SNMPv3 passphrase copies before freeing them

fix(snmp): harden authentication protocol fallbacks

fix(snmp): close reviewed SNMPv3 safety gaps

test: use the platform ICMP unreachable spelling

fix(snmp): fail closed when session secrets cannot be installed

test(snmp): make session coverage deterministic

fix(snmp): reject incomplete privacy sessions

fix(snmp): preserve incomplete privacy compatibility

fix(snmp): narrow privacy refusal to configured encryption

fix(snmp): preserve authentication refusal boundary

fix(snmp): refuse incomplete security settings

fix(snmp): match Cacti security-level selection

fix(snmp): distinguish empty protocols from none

fix(snmp): make refusal handling explicit

fix(snmp): avoid promising a successful downgrade

test(snmp): respect optional Net-SNMP transforms

fix(snmp): show downgrades at default verbosity

fix(snmp): validate privacy algorithms at every level

fix(snmp): validate privacy only when it is used

fix(snmp): reject multi-get without a session

test(snmp): keep bounded string copies