*** Security Fix ***
Changes 5.3:
*** Important Notes ***
Several very significant changes have been made in Net-SNMP for this
release that warrant special attention.
- shared library version number no longer matches the release number. We
now follow the versioning scheme recommended by libtool. For the 5.3
release this means that the libraries now have a SONAME ending with
".so.10", e.g. libnetsnmp.so.10.
- snmpd has not been truncating log files at startup, as documented in
the man pages, for a while now. This default behaviour has been restored.
Please use the '-A' flag if you want to continue appending to your log
files at startup.
- snmptrapd will no longer accept all traps by default. It must be
configured with authorized SNMPv1/v2c community strings and/or SNMPv3
users. Non-authorized traps/informs will be dropped.
- Due to a copyright statement that didn't allow modifications,
snmpnetstat has been completely rewritten. The new version now
accepts the same command-line options as the other tools, which
has introduced a number of incompatible changes. However, it
does now finally support SNMPv3.
Fixes:
Building:
- configure --disable-snmpv2c now works
- fix make test tests for rfc1213
- bug 1049607: net-snmp-config --compile-subagent broken
library:
- bug 1084413: Can't disable file logging
- bug 1072406: invalid operator precedence in opendir()
agent library:
- disconnected AgentX subagents now reconnect with correct context
- fix table_array row insert/delete during set processing
agent:
- don't override clientAddr setting for local trapsinks
- bug 1088765: Agent fails to send traps to remote target
- bug 1034008: memory leak using SET for table_dataset
- patch 1052460: fix agent deadlock on exec
- bug 1055781: get-next fails to step into interfaces group correctly
- bug 1056760: agent ignores ifspeed, type settings in snmpd.conf
- bug 1062986: pass and pass_persist fail and crash snmpd
- fix snmpd.conf table token to handle augments tables
snmptrapd:
- bug 1085981: snmptrapd complains about logging and access control
- bug 1040711: snmptrapd: SIGHUP duplicates traphandlers (repeatedly)
MFD:
- Misc updates to MFD templates
- add auto-handling of cache update for row insert/delete
Ports:
- Win32
- fixes for compiling without the Microsoft PSDK installed
- fix Win32 getenv crash
- Mac OS X compile error fix
- HP-UX configure now detects and won't use unavailable function
- Linux
- patch 1055036: if-mib init order fix
- patch 1057057: ipSystemStatsTable index fix, add ipv6
- patch 1073897: fix if-mib data access 64bit counter wrap detection
MIBs:
- update IP-FORWARD-MIB from an ID set to become an RFC
New:
- test suite supports testing over other transports (tcp, udp6, unix, ...)
(see the -P switch to the testing/RUNTESTS script)
- Solaris supports the use of it's PKCS#11 library for supporting
cryptographic functions (OpenSSL isn't required if PKCS#11 is available)
(see configure's --with-pkcs flag)
Fixes:
- Improvements on 64 bit architectures.
- A few minor memory leaks fixed.
- An extremely large number of minor bug fixes.
- Many perl module specific bug fixes.
- snmpd will safely handle more signals.
Ports:
- Many many significant Windows improvements.
- A win32 build script in win32/build.pl
- Support for the MinGW compiler
- (see the README.win32 file for details on new ports)
- Various helpful win32/*.bat files for installation, etc.
- Some linux 2.6 support improvements
Changes from NEWS file:
--------8<--------8<--------8<--------8<--------8<--------8<--------8<
*5.0.9*
SECURITY:
- An existing user/community could get access to data in MIB
objects that were explicitly excluded from their view.
Fixes:
- Perl build environment should better under Windows
- Misc kerberos support fixes.
- Improvements on various manual pages.
- A annoying bug with SETs being passed to pass scripts was fixed.
- The often talked about VACM optimization improvement was fixed again.
- mib2c handles augmentation tables better now.
- Various 64 bit issues have been addressed.
*5.0.8*
New:
- No new features will be added to the 5.0.x line.
Ports:
- Update libtool to version 1.4.3, for the benefit of Darwin
- diskio support for Darwin
- Updates for OpenBSD 3.
- Updates to solaris README
Fixes:
- find libwrap w/nsl on RedHat
- fix for openssl 0.9.7
- Fix some AgentX memory leaks
- use macro for inline function prototypes
- Attempt to find unused port before running tests
- Use SNMP_SLEEP environment variable when running tests
- calculate a proper ifSpeed under linux when possible
- better daemonization of snmpd
- close and reopen snmptrapd log files on HUP
- support for 16 bit reuqest ids
- Recognize new 't' code in display hints
- misc other fixes
*5.0.7*
New:
- VACM (access control) optimizations which will greatly benefit
people who wish to exclude large portions of the MIB tree from
some people. Previously this was a large resource drain.
- Add command line option to snmpd to set syslog facility
- Reverse DISPLAY-HINT processing, i.e. it allows you to input data
formatted like a DISPLAY-HINT prescribes
- Support setting of sysDescr and sysObjectID via snmpd.conf
configuration directives
- New output option to force display of strings as hex
- Persistent directory can be specified at runtime
- Add support for Linux virtual interfaces in the ipAddressTable.
- implemented the mteEventTable and the mteEventNotificationTable
form the DISMAN-EVENT-MIB.
Fixes:
- AgentX no longer flagged as experimental
- A few memory leak fixes for the table_iterator agent API.
- Processed flag cleared before each pass of a set request
- Remove snmpd pid file on exit
- Restore default behaviour of building shared libraries
- misc other fixes
--------8<--------8<--------8<--------8<--------8<--------8<--------8<
on net/net-snmp-current and on the FreeBSD net-snmp port, and may be
considered as an update to ucd-snmp. Changes since ucd-snmp include:
* complete rewrite of the agent internals
* new agent module API
* SNMPv3
* improved AgentX subagent handling
* many, many bugfixes in plugged memory leaks
* prevent DoS attacks from authenticated users
