diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-05-19 12:09:56 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-05-22 17:50:22 +0300 |
| commit | 81e8f14c5b9b322a998e6530184b07e9e9187ff5 (patch) | |
| tree | 0637a42ef04642439d38f02c1241dfec3c4187ee /data | |
| parent | 51ab39e51bb925307c0f9ad1d905d450ceecc0f5 (diff) | |
| download | vyos-1x-81e8f14c5b9b322a998e6530184b07e9e9187ff5.tar.gz vyos-1x-81e8f14c5b9b322a998e6530184b07e9e9187ff5.zip | |
snmp: T8538: Persist engineBoots counter across reboots
Per RFC 3414 section 2.2 (Replay Protection), the `snmpEngineBoots`
counter must be stored in non-volatile storage and incremented on
every snmpd restart. VyOS was not persisting this value, causing
it to reset to 1 after every reboot.
SNMP managers cache the engineBoots value from previous sessions.
When VyOS resets the counter to 1 after reboot, managers reject
incoming SNMPv3 trap packets as "too old", producing errors such as:
```
usm: Message too old.
reboot count invalid
```
This change introduces `/config/snmp/engineboots.count` as a disk-backed
persist file and it uses to sync the counter into snmpd's conf
before the daemon starts.
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/snmp/override.conf.j2 | 2 | ||||
| -rw-r--r-- | data/templates/snmp/var.snmpd.conf.j2 | 2 |
2 files changed, 4 insertions, 0 deletions
diff --git a/data/templates/snmp/override.conf.j2 b/data/templates/snmp/override.conf.j2 index 42dc7a9d2..33b610fe3 100644 --- a/data/templates/snmp/override.conf.j2 +++ b/data/templates/snmp/override.conf.j2 @@ -8,5 +8,7 @@ Environment= Environment="MIBDIRS=/usr/share/snmp/mibs:/usr/share/snmp/mibs/iana:/usr/share/snmp/mibs/ietf:/usr/share/vyos/mibs" ExecStart= ExecStart={{ vrf_command }}/usr/sbin/snmpd -LS0-5d -Lf /dev/null -u Debian-snmp -g Debian-snmp -f -p /run/snmpd.pid +# Sync engineBoot value between snmpd.conf and engineboots.count when user restarts the service manually +ExecStartPost=!/usr/bin/python3 /usr/libexec/vyos/system/sync-snmp-engine-boots.py Restart=always RestartSec=10 diff --git a/data/templates/snmp/var.snmpd.conf.j2 b/data/templates/snmp/var.snmpd.conf.j2 index afab88abc..29abaa81c 100644 --- a/data/templates/snmp/var.snmpd.conf.j2 +++ b/data/templates/snmp/var.snmpd.conf.j2 @@ -14,3 +14,5 @@ createUser {{ vyos_user }} MD5 "{{ vyos_user_pass }}" DES oldEngineID 0x{{ v3.engineid }} {% endif %} {% endif %} + +engineBoots {{ engine_boots }} |