Skip to content

Commit 7fea591

Browse files
samaityMichelMoriniaux
samaity
authored and
MichelMoriniaux
committed
[dockers]: Upgrade SNMP docker to stretch build (sonic-net#2620)
* [dockers]: Upgrade SNMP docker to stretch build * Removed patch-> 0003-CHANGES-BUG-2743-snmpd-crashes-when-receiving-a-GetN.patch * update platform-common submodule * adding PyYAML package to stretch dockerfile * Installing redis package via pip in stretch dockerfile * again updating platform-common submodule * revert back the snmpd version to 5.7.3+dfsg-1.5 * upgrading the snmpd version to 5.7.3+dfsg-1.7+deb9u1 with openssl backport support * update sonic-snmpagent submodule * purge libdpkg-perl package in Dockerfile * revert back the snmpd version to 5.7.3+dfsg-1.5 * minor change in series file
1 parent a8c7ac2 commit 7fea591

File tree

7 files changed

+202
-5
lines changed

7 files changed

+202
-5
lines changed

‎dockers/docker-snmp-sv2/Dockerfile.j2

+6-2
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM docker-config-engine
1+
FROM docker-config-engine-stretch
22

33
ARG docker_container_name
44
RUN [ -f /etc/rsyslog.conf ] && sed -ri "s/%syslogtag%/$docker_container_name#%syslogtag%/;" /etc/rsyslog.conf
@@ -19,6 +19,10 @@ RUN apt-get install -y curl ca-certificates
1919
# Install gcc which is required for installing hiredis
2020
RUN apt-get install -y gcc make
2121

22+
# Install libdpkg-perl which is required for python3.6-3.6.0 as one of its specs i.e. no-pie-compile.specs
23+
# The file referenced (`/usr/share/dpkg/no-pie-compile.specs`) is in the `libdpkg-perl` package on Debian
24+
RUN apt-get install -y libdpkg-perl
25+
2226
{% if docker_snmp_sv2_debs.strip() -%}
2327
# Copy locally-built Debian package dependencies
2428
{%- for deb in docker_snmp_sv2_debs.split(' ') %}
@@ -56,7 +60,7 @@ RUN pip install /python-wheels/{{ whl }}
5660
RUN python3.6 -m sonic_ax_impl install
5761

5862
# Clean up
59-
RUN apt-get -y purge libpython3.6-dev curl gcc make
63+
RUN apt-get -y purge libpython3.6-dev curl gcc make libdpkg-perl
6064
RUN apt-get clean -y && apt-get autoclean -y && apt-get autoremove -y --purge
6165
RUN find / | grep -E "__pycache__" | xargs rm -rf
6266
RUN rm -rf /debs /python-wheels ~/.cache

‎rules/docker-snmp-sv2.mk

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,10 @@ $(DOCKER_SNMP_SV2)_PATH = $(DOCKERS_PATH)/docker-snmp-sv2
55
## TODO: remove LIBPY3_DEV if we can get pip3 directly
66
$(DOCKER_SNMP_SV2)_DEPENDS += $(SNMP) $(SNMPD) $(PY3) $(LIBPY3_DEV)
77
$(DOCKER_SNMP_SV2)_PYTHON_WHEELS += $(SONIC_PLATFORM_COMMON_PY3) $(SWSSSDK_PY3) $(ASYNCSNMP_PY3)
8-
$(DOCKER_SNMP_SV2)_LOAD_DOCKERS += $(DOCKER_CONFIG_ENGINE)
8+
$(DOCKER_SNMP_SV2)_LOAD_DOCKERS += $(DOCKER_CONFIG_ENGINE_STRETCH)
99
SONIC_DOCKER_IMAGES += $(DOCKER_SNMP_SV2)
1010
SONIC_INSTALL_DOCKER_IMAGES += $(DOCKER_SNMP_SV2)
11+
SONIC_STRETCH_DOCKERS += $(DOCKER_SNMP_SV2)
1112

1213
$(DOCKER_SNMP_SV2)_CONTAINER_NAME = snmp
1314
$(DOCKER_SNMP_SV2)_RUN_OPT += --net=host --privileged -t

‎sonic-slave-stretch/Dockerfile

+7
Original file line numberDiff line numberDiff line change
@@ -259,6 +259,13 @@ RUN pip install j2cli
259259
# For sonic utilities testing
260260
RUN pip install click-default-group click natsort tabulate netifaces==0.10.7 fastentrypoints
261261

262+
# For sonic snmpagent mock testing
263+
RUN pip3 install mockredispy==2.9.3
264+
RUN pip3 install PyYAML>=5.1
265+
266+
# For sonic-platform-common testing
267+
RUN pip3 install redis
268+
262269
# For supervisor build
263270
RUN pip install meld3 mock
264271

‎src/snmpd/patch-5.7.3+dfsg/0005-Port-OpenSSL-1.1.0-with-support-for-1.0.2.patch

+184
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
From: Andreas Henriksson <[email protected]>
2+
Date: Sat, 23 Dec 2017 22:25:41 +0000
3+
Subject: [PATCH] Port OpenSSL 1.1.0 with support for 1.0.2
4+
5+
Initial support for OpenSSL 1.1.0
6+
7+
Changes by [email protected]:
8+
- added OpenSSL 1.0.2 glue layer for backwarts compatibility
9+
- dropped HAVE_EVP_MD_CTX_CREATE + DESTROY and added a check for OpenSSL
10+
version instead (and currently 1.0.2 is the only one supported).
11+
12+
BTS: https://bugs.debian.org/828449
13+
Signed-off-by: Sebastian Andrzej Siewior <[email protected]>
14+
---
15+
apps/snmpusm.c | 43 ++++++++++++++++++++++++++++++++++++-------
16+
configure.d/config_os_libs2 | 6 ------
17+
snmplib/keytools.c | 13 ++++++-------
18+
snmplib/scapi.c | 17 +++++------------
19+
4 files changed, 47 insertions(+), 32 deletions(-)
20+
21+
--- a/apps/snmpusm.c
22+
+++ b/apps/snmpusm.c
23+
@@ -183,6 +183,31 @@ setup_oid(oid * it, size_t * len, u_char
24+
}
25+
26+
#if defined(HAVE_OPENSSL_DH_H) && defined(HAVE_LIBCRYPTO)
27+
+
28+
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
29+
+
30+
+static void DH_get0_pqg(const DH *dh,
31+
+ const BIGNUM **p, const BIGNUM **q, const BIGNUM **g)
32+
+{
33+
+ if (p != NULL)
34+
+ *p = dh->p;
35+
+ if (q != NULL)
36+
+ *q = dh->q;
37+
+ if (g != NULL)
38+
+ *g = dh->g;
39+
+}
40+
+
41+
+static void DH_get0_key(const DH *dh, const BIGNUM **pub_key,
42+
+ const BIGNUM **priv_key)
43+
+{
44+
+ if (pub_key != NULL)
45+
+ *pub_key = dh->pub_key;
46+
+ if (priv_key != NULL)
47+
+ *priv_key = dh->priv_key;
48+
+}
49+
+
50+
+#endif
51+
+
52+
int
53+
get_USM_DH_key(netsnmp_variable_list *vars, netsnmp_variable_list *dhvar,
54+
size_t outkey_len,
55+
@@ -190,7 +215,7 @@ get_USM_DH_key(netsnmp_variable_list *va
56+
oid *keyoid, size_t keyoid_len) {
57+
u_char *dhkeychange;
58+
DH *dh;
59+
- BIGNUM *other_pub;
60+
+ const BIGNUM *p, *g, *pub_key, *other_pub;
61+
u_char *key;
62+
size_t key_len;
63+
64+
@@ -205,25 +230,29 @@ get_USM_DH_key(netsnmp_variable_list *va
65+
dh = d2i_DHparams(NULL, &cp, dhvar->val_len);
66+
}
67+
68+
- if (!dh || !dh->g || !dh->p) {
69+
+ if (dh)
70+
+ DH_get0_pqg(dh, &p, NULL, &g);
71+
+
72+
+ if (!dh || !g || !p) {
73+
SNMP_FREE(dhkeychange);
74+
return SNMPERR_GENERR;
75+
}
76+
77+
- DH_generate_key(dh);
78+
- if (!dh->pub_key) {
79+
+ if (!DH_generate_key(dh)) {
80+
SNMP_FREE(dhkeychange);
81+
return SNMPERR_GENERR;
82+
}
83+
84+
- if (vars->val_len != (unsigned int)BN_num_bytes(dh->pub_key)) {
85+
+ DH_get0_key(dh, &pub_key, NULL);
86+
+
87+
+ if (vars->val_len != (unsigned int)BN_num_bytes(pub_key)) {
88+
SNMP_FREE(dhkeychange);
89+
fprintf(stderr,"incorrect diffie-helman lengths (%lu != %d)\n",
90+
- (unsigned long)vars->val_len, BN_num_bytes(dh->pub_key));
91+
+ (unsigned long)vars->val_len, BN_num_bytes(pub_key));
92+
return SNMPERR_GENERR;
93+
}
94+
95+
- BN_bn2bin(dh->pub_key, dhkeychange + vars->val_len);
96+
+ BN_bn2bin(pub_key, dhkeychange + vars->val_len);
97+
98+
key_len = DH_size(dh);
99+
if (!key_len) {
100+
--- a/configure.d/config_os_libs2
101+
+++ b/configure.d/config_os_libs2
102+
@@ -291,12 +291,6 @@ if test "x$tryopenssl" != "xno" -a "x$tr
103+
AC_CHECK_LIB(${CRYPTO}, AES_cfb128_encrypt,
104+
AC_DEFINE(HAVE_AES_CFB128_ENCRYPT, 1,
105+
[Define to 1 if you have the `AES_cfb128_encrypt' function.]))
106+
-
107+
- AC_CHECK_LIB(${CRYPTO}, EVP_MD_CTX_create,
108+
- AC_DEFINE([HAVE_EVP_MD_CTX_CREATE], [],
109+
- [Define to 1 if you have the `EVP_MD_CTX_create' function.])
110+
- AC_DEFINE([HAVE_EVP_MD_CTX_DESTROY], [],
111+
- [Define to 1 if you have the `EVP_MD_CTX_destroy' function.]))
112+
fi
113+
if echo " $transport_result_list " | $GREP "DTLS" > /dev/null; then
114+
AC_CHECK_LIB(ssl, DTLSv1_method,
115+
--- a/snmplib/keytools.c
116+
+++ b/snmplib/keytools.c
117+
@@ -149,13 +149,13 @@ generate_Ku(const oid * hashtype, u_int
118+
*/
119+
#ifdef NETSNMP_USE_OPENSSL
120+
121+
-#ifdef HAVE_EVP_MD_CTX_CREATE
122+
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
123+
ctx = EVP_MD_CTX_create();
124+
#else
125+
- ctx = malloc(sizeof(*ctx));
126+
- if (!EVP_MD_CTX_init(ctx))
127+
- return SNMPERR_GENERR;
128+
+ ctx = EVP_MD_CTX_new();
129+
#endif
130+
+ if (!ctx)
131+
+ return SNMPERR_GENERR;
132+
#ifndef NETSNMP_DISABLE_MD5
133+
if (ISTRANSFORM(hashtype, HMACMD5Auth)) {
134+
if (!EVP_DigestInit(ctx, EVP_md5()))
135+
@@ -259,11 +259,10 @@ generate_Ku(const oid * hashtype, u_int
136+
memset(buf, 0, sizeof(buf));
137+
#ifdef NETSNMP_USE_OPENSSL
138+
if (ctx) {
139+
-#ifdef HAVE_EVP_MD_CTX_DESTROY
140+
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
141+
EVP_MD_CTX_destroy(ctx);
142+
#else
143+
- EVP_MD_CTX_cleanup(ctx);
144+
- free(ctx);
145+
+ EVP_MD_CTX_free(ctx);
146+
#endif
147+
}
148+
#endif
149+
--- a/snmplib/scapi.c
150+
+++ b/snmplib/scapi.c
151+
@@ -486,15 +486,10 @@ sc_hash(const oid * hashtype, size_t has
152+
}
153+
154+
/** initialize the pointer */
155+
-#ifdef HAVE_EVP_MD_CTX_CREATE
156+
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
157+
cptr = EVP_MD_CTX_create();
158+
#else
159+
- cptr = malloc(sizeof(*cptr));
160+
-#if defined(OLD_DES)
161+
- memset(cptr, 0, sizeof(*cptr));
162+
-#else
163+
- EVP_MD_CTX_init(cptr);
164+
-#endif
165+
+ cptr = EVP_MD_CTX_new();
166+
#endif
167+
if (!EVP_DigestInit(cptr, hashfn)) {
168+
/* requested hash function is not available */
169+
@@ -507,13 +502,11 @@ sc_hash(const oid * hashtype, size_t has
170+
/** do the final pass */
171+
EVP_DigestFinal(cptr, MAC, &tmp_len);
172+
*MAC_len = tmp_len;
173+
-#ifdef HAVE_EVP_MD_CTX_DESTROY
174+
+
175+
+#if (OPENSSL_VERSION_NUMBER < 0x10100000L) || defined(LIBRESSL_VERSION_NUMBER)
176+
EVP_MD_CTX_destroy(cptr);
177+
#else
178+
-#if !defined(OLD_DES)
179+
- EVP_MD_CTX_cleanup(cptr);
180+
-#endif
181+
- free(cptr);
182+
+ EVP_MD_CTX_free(cptr);
183+
#endif
184+
return (rval);

‎src/snmpd/patch-5.7.3+dfsg/series

+1
Original file line numberDiff line numberDiff line change
@@ -2,3 +2,4 @@
22
0002-at.c-properly-check-return-status-from-realloc.-Than.patch
33
0003-CHANGES-BUG-2743-snmpd-crashes-when-receiving-a-GetN.patch
44
0004-Disable-SNMPv1.patch
5+
0005-Port-OpenSSL-1.1.0-with-support-for-1.0.2.patch

‎src/sonic-platform-common

‎src/sonic-snmpagent

0 commit comments

Comments
 (0)