fix!: the SNMP agent takes the caller's values and opens only to its sources (0.2.0) #21

2026-10-17T06:26:16Z

christianmanivong commented

2026-10-17 06:26:16 +00:00

Security fix #13 and step 4 of NetOrk/netork#1105.

fix_snmp enabled community public and opened UDP/161 from any source on every interface. Now configure_snmp_agent(settings) (napalm-device-types 4.13):

install os-net-snmp only when missing;
community/contact/location/listen from the caller (DNS name → listen everywhere; refused save fails the fix);
one floating pass rule per allowed source; the old [netork] Allow SNMP any-source rule and rules of an earlier run are replaced, operators' rules untouched; no sources → firewall unchanged;
restart net-snmp. The hand-built UDP probe goes.

The REST API cannot tell which address netOrk comes from (get_management_peer not implemented), so netOrk needs the snmp_allowed_sources setting for OPNsense; without it the firewall is left as it is.

Not in this PR (#16): the other [netork] markers (DNS overrides, certificates, ping jobs) — the DNS tag interacts with netork-01's DNS work (#1123).

Closes #13. Merge order: independent; netOrk already asks for the template first (#1130), so it needs only the pin bump in netOrk.

Security fix #13 and step 4 of NetOrk/netork#1105. `fix_snmp` enabled community `public` and opened UDP/161 **from any source on every interface**. Now `configure_snmp_agent(settings)` (napalm-device-types 4.13): - install os-net-snmp only when missing; - community/contact/location/listen from the caller (DNS name → listen everywhere; refused save fails the fix); - one floating pass rule **per allowed source**; the old `[netork] Allow SNMP` any-source rule and rules of an earlier run are replaced, operators' rules untouched; no sources → firewall unchanged; - restart net-snmp. The hand-built UDP probe goes. The REST API cannot tell which address netOrk comes from (`get_management_peer` not implemented), so netOrk needs the `snmp_allowed_sources` setting for OPNsense; without it the firewall is left as it is. Not in this PR (#16): the other `[netork]` markers (DNS overrides, certificates, ping jobs) — the DNS tag interacts with netork-01's DNS work (#1123). Closes #13. **Merge order:** independent; netOrk already asks for the template first (#1130), so it needs only the pin bump in netOrk.

christianmanivong added 1 commit 2026-10-17 06:26:16 +00:00

fix!: the SNMP agent takes the caller's values and opens only to its sources (0.2.0)

CI / test (3.10) (push) Successful in 38s

Details

CI / test (3.11) (push) Successful in 32s

Details

CI / test (3.12) (push) Successful in 30s

Details

CI / test (3.10) (pull_request) Successful in 29s

Details

CI / test (3.11) (pull_request) Successful in 28s

Details

CI / test (3.12) (pull_request) Successful in 31s

Details

c4edfc88e4

fix_snmp enabled os-net-snmp with community "public", contact
netork@localhost and location "Managed by netOrk", and added a
floating pass rule for UDP/161 from any source on every interface: a
firewall managed over WAN answered its SNMP tree to anyone there (#13).

The driver implements napalm-device-types 4.13's configure_snmp_agent
steps instead:
- install: os-net-snmp only when missing (a reinstall resets it);
- configure: community, contact, location and listen address from the
  caller; a DNS name is not a listen address; a refused save fails;
- firewall: one floating pass rule per allowed source, the old
  any-source rule and rules of an earlier run replaced, operators'
  rules untouched; no sources, no change;
- start: restart net-snmp.
The hand-built UDP probe goes; the caller asks the agent itself.

BREAKING CHANGE: run_device_action is removed. Requires
napalm-device-types 4.13.

Closes #13

christianmanivong merged commit 39cc177bf2 into master

2026-10-17 06:48:18 +00:00

christianmanivong deleted branch feat/snmp-agent-template

2026-10-17 06:48:18 +00:00

christianmanivong referenced this pull request

2026-10-18 12:44:03 +00:00

Agnostic structure: fix_snmp template, ping batch, neutral markers #16

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-opnsense#21