Subject: Re: Master Agent mib instrumentation

From: Randy Presuhn <[email-masked]>
Date: Mon, 17 Jan 2000 10:58:30 -0800 (PST)

Hi -

> Message-ID: <[email-masked]>
> Date: Mon, 17 Jan 2000 09:35:35 -0500
> From: Mike Daniele <[email-masked]>
> To: gopal krishna <[email-masked]>
> Cc: [email-masked]
> Subject: Re: Master Agent mib instrumentation
> References: <[email-masked]>
> List-Id: IETF Agentx Working Group mailing list <[email-masked]>
...
> > B)also,is there any guidelines on how the master agent
> > should dispatch when it recieves varbind list in which
> >   some of the snmp OIDs have instrumentation provided
> > by master agent itself   & for other OIDs  subagents
> > provide instrumentation.
> 
> That's really a question on how you want to design  your implementation,
> not something that should be covered in the RFC.
> 
> For our implementation on Tru64 UNIX, there is no special handling
> within master agent dispatching.  All sessions/registered regions are handled identically.
...

We've taken a similar approach in our implementation as well.
This works well for other subagent protocols, since their
service definitions are remarkably similar.

However, there are a couple of annoying objects in RFC 2574
whose semantics require information not carried by an AgentX
service: usmUserOwnAuthKeyChange and usmUserOwnPrivKeyChange.

Specifically, 

|usmUserOwnPrivKeyChange OBJECT-TYPE
|    SYNTAX       KeyChange  -- typically (SIZE (0 | 32)) for DES
|    MAX-ACCESS   read-create
|    STATUS       current
|    DESCRIPTION "Behaves exactly as usmUserPrivKeyChange, with one
|                 notable difference: in order for the Set operation
|                 to succeed, the usmUserName of the operation
|                 requester must match the usmUserName that indexes
|                 the row which is targeted by this operation.
|                 In addition, the USM security model must be
|                 used for this operation.

So, although the operation dispatch can procede just as it would for
any other subagent, one needs to take care to pass the user name and
security model through some non-agentx mechanism.

Another area where there are subtle "gotchas" is in the sending of
responses to key changes; whether the key change is successful or
not, the old keying material is used for the response.

 ------------------------------------------------------------------------
 Randy Presuhn           [email-masked]       http://www.bmc.com/
 Voice: +1 408 546-1006  BMC Software, Inc.  1-3141  2141 N. First Street
 Fax:   +1 408 965-0359  San Jose, California 95131  USA
 ------------------------------------------------------------------------
 Any relationship between my opinions and BMC's should be coincidental.
 ------------------------------------------------------------------------