Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

MACaddresses gets encoded as base64 twice.

Description

Traps containing a MACaddress gets through to the web interface like this:

wmanIfBsSsStatusNotificationTrap trap received ifIndex=2
wmanIfBsSsNotificationMacAddr=QUJCdEZkS2E= wmanIfBsSsStatusValue=12
wmanIfBsSsStatusInfo=SF success

The QUJCdEZkS2E part is gibberish.

trapd.log reports:
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor: V2 trap -
trapInterface: 192.168.99.2
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor: V2 trap
numVars or pdu length: 6
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor: V2 trap
first varbind value: 0d 11h 3m 54s 410ms
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor: V2 trap
first varbind value is of type TIMETICKS (correct)
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor:
snmpTrapOID: .1.3.6.1.2.1.10.184.1.1.4.2.0.1
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor: V2 trap -
trapInterface: 192.168.99.2
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor: snmp
specific/generic/eid: 1 6 .1.3.6.1.2.1.10.184.1.1.4.2
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor:
snmpReceivedTrap: string varbind:
.1.3.6.1.2.1.10.184.1.1.4.2.1.1.3.2.0.16.109.21.210.154 State change
2006-08-07 13:45:07,819 DEBUG [TrapQueueProcessor] TrapQueueProcessor: V2 Trap
successfully converted and sent to eventd

Notice how .1.3.6.1.2.1.10.184.1.1.4.2.1.1.3.2.0.16.109.21.210.154 contains the
MACaddress 00:10:6D:15:D2:9A

In eventd.log, this comes through as:

2006-08-07 13:40:42,782 DEBUG [EventHandlerPool-fiber2] EventHandler: Event {
2006-08-07 13:40:42,782 DEBUG [EventHandlerPool-fiber2] EventHandler: uuid =
<not-set>
2006-08-07 13:40:42,782 DEBUG [EventHandlerPool-fiber2] EventHandler: uei = null
2006-08-07 13:40:42,782 DEBUG [EventHandlerPool-fiber2] EventHandler: src =
trapd
2006-08-07 13:40:42,782 DEBUG [EventHandlerPool-fiber2] EventHandler: iface =
192.168.99.2
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler: time =
Monday, August 7, 2006 11:40:42 AM GMT
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler: parms {
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler:
(.1.3.6.1.2.1.2.2.1.1.2, 2)
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler:
(.1.3.6.1.2.1.10.184.1.1.4.2.1.1.1.2.0.16.109.21.210.154, ABBtFdKa)
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler:
(.1.3.6.1.2.1.10.184.1.1.4.2.1.1.2.2.0.16.109.21.210.154, 12)
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler:
(.1.3.6.1.2.1.10.184.1.1.4.2.1.1.3.2.0.16.109.21.210.154, SF success)
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler: }
2006-08-07 13:40:42,793 DEBUG [EventHandlerPool-fiber2] EventHandler: }
2006-08-07 13:40:42,795 DEBUG [EventHandlerPool-fiber2] EventConfData: Match
found using key: EventKey

The MACaddress is now encoded as 'ABBtFdKa', and the end result 'QUJCdEZkS2E='
is the base64 representation of 'ABBtFdKa'.

The trap definition is typically something like:
wmanIfBsSsRssiStatusChangeTrap NOTIFICATION-TYPE
OBJECTS {ifIndex,
wmanIfBsSsNotificationMacAddr,
wmanIfBsSsRssiStatus,
wmanIfBsSsRssiStatusInfo}
STATUS current
DESCRIPTION
"An event to report that the uplink RSSI is below
wmanIfBsLowRssiThreshold, or above
wmanIfBsHighRssiThreshold after restore."
::= { wmanIfBsTrapPrefix 3 }

where the second object, wmanIfBsSsNotificationMacAddr, is of type MacAddress.

Thanks to djgregor for helping out.

Environment

Operating System: Linux Platform: PC

Acceptance / Success Criteria

None

Attachments

2

Lucidchart Diagrams

Activity

Benjamin Reed October 3, 2008 at 3:08 PM

looks like it to me

  •  

    •  

      • This bug has been marked as a duplicate of ***

Mike Huot December 14, 2006 at 2:59 PM

I am thinking we might close this and mark it as a dupe to 1663, anyone have any
thoughts?

Mike Huot December 14, 2006 at 2:53 PM

Is this really the same as ? It appears that the syntax for the Mac
Address is octet string and hte textual convention is Mac Address.

Johan Edstrom December 13, 2006 at 12:09 PM

Created an attachment (id=386)
Patch for Decode

Martial Fol December 1, 2006 at 4:49 AM

I think this was due to an method mistake in
org.opennms.netmgt.eventd/EventUtil.java.

At line 293, there is :

result = new String(Base64.encodeBase64(((String) value).getBytes()));

instead of

result = new String(Base64.decodeBase64(((String)value).toCharArray()));

I think there is the same mistake when construct trap to send but "decode"
instead of "encode".

Duplicate

Details

Assignee

Reporter

Components

Fix versions

Affects versions

Priority

PagerDuty

Created August 7, 2006 at 8:25 AM
Updated January 27, 2017 at 4:31 PM
Resolved October 3, 2008 at 3:08 PM