SNMP++ 4.0.0 Release

Announcements
1

SNMP++ new major version 4.0.0 has been released 2026-08-12T22:00:00Z with a couple of USM/MPv3 security improvements and support for TCP and TLS transport mappings.

CHANGES

Summary

  • Introducing a modular transport architecture with TCP and TLS support.
  • Removed the obsolete IpxAddress and added a fully functional TcpAddress and TlsAddress classes.
  • Implemented a TransportMapping framework (UDP and TCP) to decouple low-level networking from the SNMP logic.
  • Fixed multiple -Woverloaded-virtual warnings where derived classes unintentionally hid virtual assignment
    operators from their base classes.
  • Resolved inheritance-related member hiding in Oid and OctetStr subclasses.
  • Fixed the USM statistics counter and the Report counter OID selected when incoming message authentication fails,
    to conform to RFC 3414 §3.2 (6).
  • SECURITY: Verify the identity of the (D)TLS server, reject empty tmSecurityName
  • SECURITY: Do not let unauthenticated messages poison the engine id cache
  • SECURITY: Bind a received response to the request it claims to answer
  • SECURITY: Bound the number of usmTimeTable entries engine discovery creates
  • SECURITY: Validate a v3 response/report before consuming its cache entry

Detailed Changes

  • Address Hierarchy: Refactored Address as an abstract base with a public get_socket_address method.
    Port management was centralized in IpAddress to support UdpAddress, TcpAddress, and TlsAddress.
  • Transport Mappings: Created TransportMapping (base), UdpTransportMapping, and TcpTransportMapping.
    These classes now handle socket creation, sending, and receiving.
  • Snmp Class: Updated Snmp to manage a collection of transport mappings. snmp_engine and send_raw_data
    were refactored to dynamically select the appropriate transport based on the target address.
  • SNMPv3/USM: Refactored v3MP and USM classes to use the abstract Address class,
    enabling SNMPv3 over any supported transport (e.g., TCP, TLS).
  • Multi-homed Support: Updated receiving logic in uxsnmp.cpp to correctly associate incoming packets
    with their specific transport mappings.
  • Project Configuration: Updated CMakeLists.txt and config_snmp_pp.h to reflect version 4.0.0 and
    include the new transport files.
  • OID Definitions: Added using Oid::operator=; to snmpTrapsOid, snmpTrapEnterpriseOid,
    and their subclasses in oid_def.h. This ensures that the base class assignment operators remain accessible
    and are not hidden by the implicitly generated copy assignment operators of the derived classes.
  • Opaque String: Added using OctetStr::operator=; to OpaqueStr in octet.h to maintain visibility of
    OctetStr assignment operators.
  • Inheritance Consistency: Verified that other key classes in the SnmpSyntax hierarchy
    (IpAddress, UdpAddress, TcpAddress, Counter32, Gauge32, TimeTicks) already have the necessary
    using declarations or explicit overloads to avoid similar warnings.
  • USM Statistics (RFC 3414 §3.2 (6)): USM::process_msg now increments usmStatsWrongDigests for any
    failure reported by the authentication module, instead of usmStatsUnsupportedSecLevels. The latter belongs
    to step (5) of the same section, which checks the securityLevel the user supports and is already handled
    before authentication is attempted. The return code is normalized to SNMPv3_USM_AUTHENTICATION_FAILURE
    so that the generated Report carries the OID and value of the counter that was actually incremented.
    Note that this code path is only reachable if an Auth implementation reports a failure other than
    SNMPv3_USM_AUTHENTICATION_FAILURE or SNMPv3_USM_UNSUPPORTED_AUTHPROTOCOL.
  • Report Counter OID: v3MP::send_report now maps SNMPv3_USM_UNSUPPORTED_AUTHPROTOCOL to
    usmStatsUnsupportedSecLevels, which is the counter USM increments for it. Previously this code fell through
    to the default branch and reported snmpInvalidMsgs, a counter that had not been incremented.