Subject: VACM reports/responses

From: "Sean Lawless" <[email-masked]>
Date: Thu, 8 May 2003 09:29:16 -0700 (PDT)

Greetings,

We are having difficulty locating a specification document for View based
Access Control Model (VACM) error responses/reports.  Specifically, from a
Command Responder perspective, what should be sent in response to a
request that results in the VACM function isAccessAllowed returning
notInView, noSuchView, etc.

From rfc3414 and rfc3415, the best guess we can ascertain is to return a
standard endOfMibView for GetNext requests that encounter any VACM problem
and noSuchName for Get and Set requests.

Is this correct and does anyone know a document (rfc) that specifies this?

Thank you much and good day.

Sean Lawless
Mibtonix, Inc.

---

From: Steve Moulton <[email-masked]>
Date: Thu, 08 May 2003 17:37:32 -0400

Hi, Sean,

The general design philosophy is that objects that are out 
of a MIB (VACM) view are treated as if they don't exist.
For get and set operations, if the entire object is out of view,
a noSuchObject exception should be returned.  If the object
is partially in view, but the particular instance you want is
not, a noSuchInstance exception should be returned.

Ref: RFC3416, 4.2.1 for get, which has more precise language than this.

In the case of getnext operations, the next instance that is in
the VACM view should be returned.  The instance may not be of the
object requested, if the remainder of the instances for that
object are out of view.  If there are no further instances (of 
any object) in the MIB view, then an endOfMibView exception should
be returned.

Ref: RFC3416, 4.2.2 for getnext  (for more precise language)

Note that SNMPv3 command responders will not generate noSuchName
errors in response to SNMPv3 requests.  See RFC2576 for more on this.

Best Regards,

Steve

> Thank you much and good day.

---
Steve Moulton        SNMP Research, Inc            voice: +1 865 573 1434
Sr Software Engineer 3001 Kimberlin Heights Rd.    fax: +1 865 573 9197
[email-masked]     Knoxville, TN 37920-9716 USA  http://www.snmp.com

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 8 May 2003 13:01:03 -0700

Hi -

I think you'd find RFC 3413, especially section 3.2 (page 11 or so)
helpful.  The endOfMibView would be correct only if there is nothing
else lexicographically later in the context to which access could be
permitted.  RFC 2741 might also be helpful in explaining the things
that need to happen during get-next and get-bulk proccessing when
access control enters the picture.

Randy

---

From: "Randy Presuhn" <[email-masked]>
Date: Thu, 8 May 2003 16:33:38 -0700

Hi -

(I dropped Sean from the CC list because his mail service has blacklisted
my ISP, Earthlink/Mindspring)

> From: "Steve Moulton" <[email-masked]>
> To: <[email-masked]>
> Cc: <[email-masked]>
> Sent: Thursday, May 08, 2003 2:37 PM
> Subject: Re: VACM reports/responses
...
> errors in response to SNMPv3 requests.  See RFC2576 for more on this.
...

But do keep RFC 3416 section 4.2.4 in mind.  There are cases where
command responders are doing things that are proxy in the classic sense,
but not in the RFC 2576 sense, and will not necessarily be able to make
the fine-grained distinctions.  One case that's probably more wide-spread
than anyone would like is access via underlying RFC 1227 machinery.  These
will generate noSuchName errors when the modern codes would be better.

Randy