Use SNMPv3 contexts for collecting logical BRIDGE-MIB instances (primarily Cisco) by lunkwill42 · Pull Request #3668 · Uninett/nav

lunkwill42 · 2025-12-05T13:24:19Z

Scope and purpose

Fixes #2811. Dependent on #3664 (merged a long time ago by now)

I have been able to preliminarily verify this against actual Cisco switches now, but the need for configuring the proper context access for accessing VLAN contexts using SNMPv3 on a Cisco switch is not intuitive and may need a FAQ or some supporting documentation in NAV.

So, things still potentially missing from this PR:

Proper test coverage
Documenting how to configure Cisco switches for SNMPv3 access
- The SNMPv3 user must be allowed to query context with the vlan- prefix, as these are added dynamically by the switch. References used:
  - https://community.cisco.com/t5/network-management/bridge-mib-with-snmp-v3/td-p/1179194
  - https://www.switchportmapper.com/support-mapping-a-cisco-switch-using-snmpv3.htm
~~Decide whether we need special handling of authentication failures~~
- I think I recall seeing nasty errors on Cisco switches that were incorrectly configured, but currently, when simulating the issue, I am only able to see nondescript errors from pynetsnmp like [ERROR zen.pynetsnmp.callback] Unknown operation: 7, while for the multimib-implementation this seems to be handled just like a "no response" from that particular instance.
- It seems to me that this will be a valid report to add and fix only if it appears in production. There doesn't currently seem to be anything crash-inducing I am able to provoke.

Contributor Checklist

Every pull request should have this checklist filled out, no matter how small it is.
More information about contributing to NAV can be found in the
Hacker's guide to NAV.

sonarqubecloud · 2025-12-05T13:34:38Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-actions · 2025-12-05T13:46:45Z

Test results

21 files 21 suites 24m 26s ⏱️
2 817 tests 2 817 ✅ 0 💤 0 ❌
15 750 runs 15 750 ✅ 0 💤 0 ❌

Results for commit bf6cf88.

♻️ This comment has been updated with latest results.

codecov · 2025-12-05T13:48:10Z

Codecov Report

❌ Patch coverage is 94.33962% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.16%. Comparing base (7d7a8a9) to head (bf6cf88).
⚠️ Report is 83 commits behind head on master.

Files with missing lines	Patch %	Lines
python/nav/mibs/mibretriever.py	92.00%	2 Missing ⚠️
python/nav/mibs/cisco_vtp_mib.py	66.66%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3668      +/-   ##
==========================================
+ Coverage   63.04%   63.16%   +0.11%     
==========================================
  Files         614      615       +1     
  Lines       45438    45484      +46     
  Branches       43       43              
==========================================
+ Hits        28648    28728      +80     
+ Misses      16780    16746      -34     
  Partials       10       10

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Henceforth, a logical MIB instance identifier may also include an optional SNMPv3 context name, and an optional context engine ID, if such things were discovered. Since a community value makes no sense for SNMPv3 communication, the community field should also be optional.

Some code still expected a BRIDGE-MIB instance descriptor to be a two-tuple value, but should really produce LogicalMibInstance named tuples.

We need to fetch context name and context engine ID values from logical MIB instances to know how to configure our SNMPv3 requests to fetch these logical instances.

In order to support SNMPv3 contexts, this adds `context_name` and `context_engine_id` as optional attributes on SNMPParameters objects, and ensures the correct Net-SNMP command line arguments are generated for them.

Making alternate agent proxy instances need to consider which SNMP version is represented, as changing the community makes no sense on SNMPv3 sessions, while changing context name (and optionally adding a context engine id) does. It's also easier and more portable to manipulate parameters selectively by modifying the `snmp_parameters` of the existing session: That way, all other parameters of the session are carried through to the alternate agent proxies.

Only care about debug logging that we got results from alternate agent proxies, as timeouts would be silently ignored.

Some tests broke from the introduction of the new namedtuple

Adds test coverage for functionality added or changed in this branch.

Also noticed there was no mention of SNMPv3 profiles in management profiles docs, so this was a suitable place to add and mention potential issues.

This code was changed enough by this branch that it provoked coverage complaints from CodeCov.

hmpf

See comments

hmpf · 2026-02-05T08:48:40Z

python/nav/ipdevpoll/utils.py

 #
 """Utility functions for ipdevpoll."""

+from __future__ import annotations


This __future__ import will be removed (add link)

hmpf · 2026-02-05T08:50:27Z

python/nav/mibs/cisco_vtp_mib.py

        community = self.agent_proxy.community
-        return [("vlan%s" % vlan, "%s@%s" % (community, vlan)) for vlan in vlans]
+        return [
+            LogicalMibInstance(f"vlan{vlan}", f"{community}@{vlan}") for vlan in vlans


Maybe dataclass instead?

Agreed this is a good idea, but I will be adding it as a separate refactoring PR

lunkwill42 · 2026-02-06T13:11:13Z

I might add that although @hmpf did not actually push the approve-button, the team did approve this PR as is in an F2F review session yesterday.

sonarqubecloud · 2026-02-06T13:15:56Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

lunkwill42 self-assigned this Dec 5, 2025

lunkwill42 added cisco snmpv3 nonews No news fragment is necessary for this PR (e.g. refactoring, cleanups, workflow/development changes) labels Dec 5, 2025

Base automatically changed from refactor/multibridgemib-inlinecallbacks to master December 5, 2025 13:28

lunkwill42 force-pushed the feature/snmpv3-multibridgemib-contexts branch from e870583 to 0feea79 Compare December 5, 2025 13:28

lunkwill42 changed the title ~~Feature/snmpv3 multibridgemib contexts~~ Use SNMPv3 contexts for collecting logical BRIDGE-MIB instances (primarily Cisco) Dec 5, 2025

lunkwill42 force-pushed the feature/snmpv3-multibridgemib-contexts branch from 0feea79 to 6c555bb Compare December 5, 2025 13:34

lunkwill42 added 9 commits January 27, 2026 15:06

Add LogicalMibInstance namedtuple

8f8397c

Use LogicalMibInstance where appropriate

993e0ee

Replace pure tuples with LogicalMibInstance

9d296f4

Some code still expected a BRIDGE-MIB instance descriptor to be a two-tuple value, but should really produce LogicalMibInstance named tuples.

Get context data from ENTITY-MIB::entLogicalTable

88ba6cc

We need to fetch context name and context engine ID values from logical MIB instances to know how to configure our SNMPv3 requests to fetch these logical instances.

Add context name and engine id to SNMPParameters

c7a343a

In order to support SNMPv3 contexts, this adds `context_name` and `context_engine_id` as optional attributes on SNMPParameters objects, and ensures the correct Net-SNMP command line arguments are generated for them.

Debug log MultiMibMixIn results

7f4bf02

Only care about debug logging that we got results from alternate agent proxies, as timeouts would be silently ignored.

Add news fragment

35ff230

lunkwill42 force-pushed the feature/snmpv3-multibridgemib-contexts branch from 6c555bb to 35ff230 Compare January 27, 2026 14:40

lunkwill42 removed the nonews No news fragment is necessary for this PR (e.g. refactoring, cleanups, workflow/development changes) label Jan 27, 2026

lunkwill42 requested a review from johannaengland January 27, 2026 14:41

lunkwill42 mentioned this pull request Jan 27, 2026

Implement SNMPv3 contexts as alternative to community indexing for retrieval of logical BRIDGE-MIB instances on Cisco switches #2811

Closed

lunkwill42 added 4 commits January 27, 2026 16:03

Fix tests that broke due to LogicalMibInstance

1375005

Some tests broke from the introduction of the new namedtuple

Test new and modified SNMPv3-related functionality

10ccf11

Adds test coverage for functionality added or changed in this branch.

Document SNMPv3 BRIDGE-MIB changes for Cisco.

27ce5dd

Also noticed there was no mention of SNMPv3 profiles in management profiles docs, so this was a suitable place to add and mention potential issues.

Add test coverage for Aruba workarounds

7ec4204

This code was changed enough by this branch that it provoked coverage complaints from CodeCov.

lunkwill42 marked this pull request as ready for review January 28, 2026 11:54

lunkwill42 requested a review from a team January 28, 2026 11:55

hmpf reviewed Feb 5, 2026

View reviewed changes

lunkwill42 mentioned this pull request Feb 6, 2026

Refactor LogicalMibInstance to dataclass with explicit kwargs #3767

Merged

10 tasks

Remove unnecessary future import

bf6cf88

lunkwill42 merged commit 21d8df2 into master Feb 6, 2026
19 checks passed

lunkwill42 deleted the feature/snmpv3-multibridgemib-contexts branch February 6, 2026 13:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Use SNMPv3 contexts for collecting logical BRIDGE-MIB instances (primarily Cisco)#3668

Use SNMPv3 contexts for collecting logical BRIDGE-MIB instances (primarily Cisco)#3668
lunkwill42 merged 14 commits intomasterfrom
feature/snmpv3-multibridgemib-contexts

lunkwill42 commented Dec 5, 2025 •

edited

Loading

Uh oh!

sonarqubecloud bot commented Dec 5, 2025

Uh oh!

github-actions bot commented Dec 5, 2025 •

edited

Loading

Uh oh!

codecov bot commented Dec 5, 2025 •

edited

Loading

Uh oh!

hmpf left a comment

Uh oh!

hmpf Feb 5, 2026 •

edited

Loading

Uh oh!

hmpf Feb 5, 2026

Uh oh!

lunkwill42 Feb 6, 2026

Uh oh!

lunkwill42 commented Feb 6, 2026

Uh oh!

sonarqubecloud bot commented Feb 6, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

lunkwill42 commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Scope and purpose

Contributor Checklist

Uh oh!

sonarqubecloud bot commented Dec 5, 2025

Quality Gate passed

Uh oh!

github-actions bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test results

Uh oh!

codecov bot commented Dec 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

hmpf left a comment

Choose a reason for hiding this comment

Uh oh!

hmpf Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

hmpf Feb 5, 2026

Choose a reason for hiding this comment

Uh oh!

lunkwill42 Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

lunkwill42 commented Feb 6, 2026

Uh oh!

sonarqubecloud bot commented Feb 6, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

lunkwill42 commented Dec 5, 2025 •

edited

Loading

github-actions bot commented Dec 5, 2025 •

edited

Loading

codecov bot commented Dec 5, 2025 •

edited

Loading

hmpf Feb 5, 2026 •

edited

Loading