snmp: T8039: fix v3 trap targets

The generated Net-SNMP configuration for SNMPv3 trap-targets was fundamentally
broken. Not only was the auth/priv type not written in uppercase letters, but
also the ordering of transport protocol, IP(v6) address and port was wrong.

To complete the issues above - IPv6 addresses did not get wrapped into
mandatory [] brackets.

2 files changed, 41 insertions, 4 deletions

diff --git a/data/templates/snmp/etc.snmpd.conf.j2 b/data/templates/snmp/etc.snmpd.conf.j2
index 9d91192fc..978ea9b7e 100644
--- a/data/templates/snmp/etc.snmpd.conf.j2
+++ b/data/templates/snmp/etc.snmpd.conf.j2
@@ -164,6 +164,10 @@ access {{ group }} "" usm {{ group_config.seclevel }} exact {{ group_config.view
 # trap-target
 {%     if v3.trap_target is vyos_defined %}
 {%         for trap, trap_config in v3.trap_target.items() %}
+{%             set protocol = trap_config.protocol %}
+{%             if trap | is_ipv6 %}
+{%                 set protocol = protocol ~ '6' %}
+{%             endif %}
 {%             set options = '' %}
 {%             if trap_config.type == 'inform' %}
 {%                 set options = options ~ ' -Ci' %}
@@ -175,14 +179,14 @@ access {{ group }} "" usm {{ group_config.seclevel }} exact {{ group_config.view
 {%                 set options = options ~ ' -u ' ~ trap_config.user %}
 {%             endif %}
 {%             if trap_config.auth.plaintext_password is vyos_defined or trap_config.auth.encrypted_password is vyos_defined %}
-{%                 set options = options ~ ' -a ' ~ trap_config.auth.type %}
+{%                 set options = options ~ ' -a ' ~ trap_config.auth.type | upper %}
 {%                 if trap_config.auth.plaintext_password is vyos_defined %}
 {%                     set options = options ~ ' -A ' ~ trap_config.auth.plaintext_password %}
 {%                 elif trap_config.auth.encrypted_password is vyos_defined %}
 {%                     set options = options ~ ' -3m ' ~ trap_config.auth.encrypted_password %}
 {%                 endif %}
 {%                 if trap_config.privacy.plaintext_password is vyos_defined or trap_config.privacy.encrypted_password is vyos_defined %}
-{%                     set options = options ~ ' -x ' ~ trap_config.privacy.type %}
+{%                     set options = options ~ ' -x ' ~ trap_config.privacy.type | upper %}
 {%                     if trap_config.privacy.plaintext_password is vyos_defined %}
 {%                         set options = options ~ ' -X ' ~ trap_config.privacy.plaintext_password %}
 {%                     elif trap_config.privacy.encrypted_password is vyos_defined %}
@@ -195,7 +199,7 @@ access {{ group }} "" usm {{ group_config.seclevel }} exact {{ group_config.view
 {%             else %}
 {%                 set options = options ~ ' -l noAuthNoPriv' %}
 {%             endif %}
-trapsess -v 3 {{ options }} {{ trap }}:{{ trap_config.protocol }}:{{ trap_config.port }}
+trapsess -v 3 {{ options }} {{ protocol }}:{{ trap | bracketize_ipv6 }}:{{ trap_config.port }}
 {%         endfor %}
 {%     endif %}
 
diff --git a/smoketest/scripts/cli/test_service_snmp.py b/smoketest/scripts/cli/test_service_snmp.py
index 6f6aeb7b6..a23692982 100755
--- a/smoketest/scripts/cli/test_service_snmp.py
+++ b/smoketest/scripts/cli/test_service_snmp.py
@@ -20,13 +20,16 @@ import unittest
 from base_vyostest_shim import VyOSUnitTestSHIM
 
 from vyos.configsession import ConfigSessionError
-from vyos.template import is_ipv4
 from vyos.template import address_from_cidr
+from vyos.template import bracketize_ipv6
+from vyos.template import is_ipv4
+from vyos.template import is_ipv6
 from vyos.utils.process import call
 from vyos.utils.process import DEVNULL
 from vyos.utils.file import read_file
 from vyos.utils.process import process_named_running
 from vyos.version import get_version_data
+from vyos.xml_ref import default_value
 
 PROCESS_NAME = 'snmpd'
 SNMPD_CONF = '/etc/snmp/snmpd.conf'
@@ -246,6 +249,36 @@ class TestSNMPService(VyOSUnitTestSHIM.TestCase):
         for excluded in snmpv3_view_oid_exclude:
             self.assertIn(f'view {snmpv3_view} excluded .{excluded}', tmp)
 
+    def test_snmpv3_trap(self):
+        trap_targets = ['192.0.2.55', '2001:db8::1']
+
+        self.cli_set(base_path + ['v3', 'engineid', snmpv3_engine_id])
+        self.cli_set(base_path + ['v3', 'group', snmpv3_group, 'view', snmpv3_view])
+        self.cli_set(base_path + ['v3', 'view', snmpv3_view, 'oid', snmpv3_view_oid])
+
+        for trap_target in trap_targets:
+            trap_base = base_path + ['v3', 'trap-target', trap_target]
+
+            self.cli_set(trap_base + ['auth', 'plaintext-password', snmpv3_auth_pw])
+            self.cli_set(trap_base + ['auth', 'type', 'sha'])
+            self.cli_set(trap_base + ['privacy', 'plaintext-password', snmpv3_priv_pw])
+            self.cli_set(trap_base + ['privacy', 'type', 'aes'])
+            self.cli_set(trap_base + ['type', 'trap'])
+            self.cli_set(trap_base + ['user', snmpv3_user])
+
+        self.cli_commit()
+
+        tmp = read_file(SNMPD_CONF)
+        for trap_target in trap_targets:
+            cli_default_trap_port = default_value(base_path + ['v3', 'trap-target', trap_target, 'port'])
+            cli_default_trap_protocol = default_value(base_path + ['v3', 'trap-target', trap_target, 'protocol'])
+            if is_ipv6(trap_target):
+                cli_default_trap_protocol = f'{cli_default_trap_protocol}6'
+
+            self.assertIn(f'trapsess -v 3  -e "{snmpv3_engine_id}" -u {snmpv3_user} -a SHA -A {snmpv3_auth_pw} ' \
+                          f'-x AES -X {snmpv3_priv_pw} -l authPriv ' \
+                          f'{cli_default_trap_protocol}:{bracketize_ipv6(trap_target)}:{cli_default_trap_port}', tmp)
+
     def test_snmp_script_extensions(self):
         extensions = {
             'default': 'snmp_smoketest_extension_script.sh',