Improved Error Reporting and Thread-Safe Use of the SNMP Library

There is a need in some environments to support multiple threads
in a single application.  The SNMP Library provides the Single Session
functions which support thread-safe operation when certain precautions
are taken.  This document describes the operation of the SNMP Library
with a focus on its session management functions.  The Traditional API
and the Single API functions are compared and contrasted.
A working understanding of the CMU or UCD SNMP Library
API is recommended to fully appreciate the concepts discussed.
The document ends with a list of restrictions for using the Single API
in a multi-threaded application.

Unfortunately, the SNMPv3 support was added about the same time as
the thread support and since they occurred in parallel the SNMPv3
support was never checked for multi-threading correctness.  It is
most likely that it is not thread-safe at this time.

  ***** IMPORTANT ANNOUNCEMENT *****
  To the point, no resource locks are applied within the SNMP Library.
  The APDU encoding and some session management functions can be used
  in thread-safe manners. The MIB file parsing is not thread-safe.
  The Single Session API was made available in November 1998.
  Existing applications use the Traditional API, which is not thread-safe.
  The thread-safe considerations are discussed throughout this document.

The research and development of the Single Session API that I've completed
was wholly funded by my employer, Internet Security Systems, Inc.
and is distributed freely to the Internet community.

-Mike Slifcak, 23 April 1999

09 July 1999 Removed references to snmp_synch_setup and snmp_synch_reset


Availability

The Single Session API is integrated into the currently available
versions of the CMU SNMP library and the UC-Davis SNMP package.

 ftp://ftp.net.cmu.edu/pub/snmp/cmu-snmp-V1.13.tar.gz and later
  Read : snmp_sess_api.3, Changes.SingleSession

 ftp://ucd-snmp.ucdavis.edu/ucd-snmp-3.6.tar.gz and later
  Read : snmp_sess_api.3, README.thread (after version 3.6.1)

Both libraries work equally well in Windows NT and various
UNIX platforms.  Please read this document and refer to
the snmp_sess_api section 3 manual page.

Glossary of Terms

APDU    Application Protocol Data Unit
API     Application Programming Interface
CMU     Carnegie-Mellon University, Pittsburgh, PA.
Library The SNMP library; Both CMU and UCD versions are applicable.
Session Concept embodying the management of transacting SNMP APDUS.
SNMP    Simple Network Management Protocol
UCD     University of California at Davis, CA.

Introduction

The Library extends the UNIX file concept (open, close, read, write) to a Session.
Opening a Session binds a local socket to a well-known port and creates internal
structures to help with controlling the transaction of SNMP APDUs.  Closing a
Session releases the memory and system resources used for these purposes.

Since the mid-1980s, many SNMP applications have used the Traditional Session
API to transact SNMP APDUs between the local host and SNMP-enabled devices.

  The Traditional Session API does not support multi-threaded applications:

  1)  There are no resource locks to prevent exposing the Library's
      global data resources to corruption in a multi-threaded application;

  2)  The Traditional API functions that receive SNMP APDUs
      do not provide an interface for one of many sessions;

  3)  Errors discovered by the Library are communicated through global
      data structures and are not associated with the session
      in which the error occurred.

  The Single Session API provides these capabilities:

  1)  Manage a single SNMP session safely, in multi-threaded or
      non-threaded applications, by avoiding access to data structures
      that the Traditional Session API may share between Sessions;

  2)  Associate errors with the session context for threaded
      and non-threaded applications.


Contrasting and Comparing Traditional API and Single API

The Traditional API uses the struct snmp_session pointer returned
from snmp_open() to identify one SNMP session.  The Single API uses
the opaque pointer returned from snmp_sess_open() to identify one
SNMP session.

   Helpful Hint : The Library copies the contents of the
   structure which is input to snmp_open() and snmp_sess_open().
   Once copied, changing that input structure's data
   has no effect on the opened SNMP Session.

The Traditional API uses the snmp_error() function to identify any
library and system errors that occurred during the processing for
one SNMP session.   The Single API uses snmp_sess_error() for the
same purpose.

The Traditional API manages the private Sessions list structure;
adding to the list during snmp_open(), removing during snmp_close.

With few exceptions, the Traditional API calls the Single API
for each session that appears on the Sessions list.

The Traditional API reads from all Sessions on the Sessions list;
The Single API does not use the Sessions list.
The Single API can read from only one Session.

   Helpful Hint :
   This is the basis for thread-safe-ness of the Library.
   There are no resource locks applied.


Using the Single API

A multi-threaded application that deploys the SNMP Library should
should complete all MIB file parsing before additional threads
are activated.  Drawing from the parsed contents of the MIB does
not incur any data corruption exposure once the internal MIB structures
are initialised.

The application may create threads such that a single thread may manage
a single SNMP session.  The thread should call snmp_sess_init()
to prepare a struct snmp_session structure.  The thread can adjust
session parameters such as the remote UDP port or the local UDP port,
which must be set prior to invoking snmp_sess_open().

The first call to snmp_sess_init() initialises the SNMP Library,
including the MIB parse trees, before any SNMP sessions are created.
Applications that call snmp_sess_init() do not need to read MIBs
nor setup environment variables to utilize the Library.

After the struct snmp_session is setup, the thread must call
snmp_sess_open() to create an SNMP session.  If at any time
the thread must change the Session configuration,
snmp_sess_session() returns the pointer to the internal configuration
structure (a struct snmp_session, copied from snmp_sess_open).
The thread can adjust parameters such as the session timeout
or the community string with this returned struct snmp_session pointer.
Changes to the remote or local port values have no effect on an opened Session.
 
The thread can build PDUs and bind variables to PDUs, as it performs its duties.
The thread then calls snmp_sess_send() or snmp_sess_async_send() to build and send
an SNMP APDU to the remote device. If a Get-Response-PDU is expected, the thread
should call snmp_sess_synch_response() instead.

When the thread is finished using the session, it must free the resources
that the Library used to manage the session.
Finally, the thread must call snmp_sess_close() to end the Session.

Snmp_sess_init(), snmp_open(), and snmp_sess_open()
must use the same calling parameter for a given Session.
Other methods should use only the returned parameter from
snmp_open() and snmp_sess_open() to access the opened SNMP Session.


Error Processing

Two calls were added : snmp_error() and snmp_sess_error() return the
"errno" and "snmp_errno" values from the per session data, and a string
that describes the errors that they represent.  The string must be freed
by the caller.

Use snmp_error() to process failures after Traditional API calls,
or snmp_sess_error() to process failure after Single API calls.
In the case where an SNMP session could not be opened,
call snmp_error() using the struct snmp_session supplied to either snmp_open()
or snmp_sess_open().


The following variables and functions are obsolete and may create problems
in a multi-threaded application :

  int    snmp_errno
  char * snmp_detail
  snmp_set_detail()
  snmp_api_errstring()


Function Summary
 
The functions in the following table are functionally equivalent,
with the exception of these behaviors:
- The Traditional API manages many sessions
- The Traditional API passes a struct snmp_session pointer,
       and touches the Sessions list
- The Single API manages only one session
- The Single API passes an opaque pointer, and does not use Sessions list
 
  Traditional        Single                    Comment
  ===========        ==============            =======
  snmp_sess_init     snmp_sess_init            Call before either open
  snmp_open          snmp_sess_open            Single not on Sessions list
                     snmp_sess_session         Exposes snmp_session pointer
  snmp_send          snmp_sess_send            Send one APDU
  snmp_async_send    snmp_sess_async_send      Send one APDU with callback
  snmp_select_info   snmp_sess_select_info     Which session(s) have input
  snmp_read          snmp_sess_read            Read APDUs
  snmp_timeout       snmp_sess_timeout         Check for timeout
  snmp_close         snmp_sess_close           Single not on Sessions list
 snmp_synch_response snmp_sess_synch_response  Send/receive one APDU
  snmp_error         snmp_sess_error           Get library,system errno


Example 1 : Traditional API use.

    #include "snmp_api.h"
      ...
      int liberr, syserr;
      char *errstr;
      struct snmp_session Session, *sptr;
      ...
      snmp_sess_init(&Session);
      Session.peername = "foo.bar.net";
      sptr = snmp_open(&Session);
      if (sptr == NULL) {
          /* Error codes found in open calling argument */
          snmp_error(&Session, &liberr, &syserr, &errstr);
          printf("SNMP create error %s.\n", errstr);
          free(errstr);
          return 0;
      }
      /* Pass sptr to snmp_error from here forward */
      ...
      /* Change the community name */
      free(sptr->community);
      sptr->community = strdup("public");
      sptr->community_len = strlen("public");
      ...
      if (0 == snmp_send(sptr, pdu)) {
          snmp_error(sptr, &liberr, &syserr, &errstr);
          printf("SNMP write error %s.\n", errstr);
          free(errstr);
          return 0;
      }
      snmp_close(sptr);


Example 2 : Single API use.

    #include "snmp_api.h"
      ...
      int liberr, syserr;
      char *errstr;
      void *sessp;  /* <-- an opaque pointer, not a struct pointer */
      struct snmp_session Session, *sptr;
      ...
      snmp_sess_init(&Session);
      Session.peername = "foo.bar.net";
      sessp = snmp_sess_open(&Session);
      if (sessp == NULL) {
          /* Error codes found in open calling argument */
          snmp_error(&Session, &liberr, &syserr, &errstr);
          printf("SNMP create error %s.\n", errstr);
          free(errstr);
          return 0;
      }
      sptr = snmp_sess_session(sessp); /* <-- get the snmp_session pointer */

      /* Pass sptr to snmp_sess_error from here forward */
      ...
      /* Change the community name */
      free(sptr->community);
      sptr->community = strdup("public");
      sptr->community_len = strlen("public");
      ...
      if (0 == snmp_sess_send(sessp, pdu)) {
          snmp_sess_error(sessp, &liberr, &syserr, &errstr);
          printf("SNMP write error %s.\n", errstr);
          free(errstr);
          return 0;
      }
      snmp_sess_close(sessp);
 
Example 3. Differences Between Traditional API and Single API Usage
5a6
>       void *sessp;  /* <-- an opaque pointer, not a struct pointer */
11,13c12,14
<       sptr = snmp_open(&Session);
<       if (sptr == NULL) {
---
>       sessp = snmp_sess_open(&Session);
>       if (sessp == NULL) {
19c20,22
<       /* Pass sptr to snmp_error from here forward */
---
>       sptr = snmp_sess_session(sessp); /* <-- get the snmp_session pointer */
> 
>       /* Pass sptr to snmp_sess_error from here forward */
26,27c29,30
<       if (0 == snmp_send(sptr, pdu)) {
<           snmp_error(sptr, &liberr, &syserr, &errstr);
---
>       if (0 == snmp_sess_send(sessp, pdu)) {
>           snmp_sess_error(sessp, &liberr, &syserr, &errstr);
33c36
<       snmp_close(sptr);
---
>       snmp_sess_close(sessp);


Restrictions on Multi-threaded Use of the SNMP Library

  1. Invoke SOCK_STARTUP or SOCK_CLEANUP from the main thread only.

  2. The MIB parsing functions use global shared data and are not
     multi-thread safe when the MIB tree is under construction.
     Once the tree is built, the data can be safely referenced from
     any thread.  There is no provision for freeing the MIB tree.
     Suggestion: Read the MIB files before an SNMP session is created.
     This can be accomplished by invoking snmp_sess_init from the main
     thread and discarding the buffer which is initialised.

  3. Invoke the SNMPv2p initialisation before an SNMP session is created,
     for reasons similar to reading the MIB file.
     The SNMPv2p structures should be available to all SNMP sessions.
     CAUTION: These structures have not been tested in a multi-threaded
     application.

  4. Sessions created using the Single API do not interact with other
     SNMP sessions.  If you choose to use Traditional API calls, call
     them from a single thread.  The Library cannot reference an SNMP
     session using both Traditional and Single API calls.

  5. Using the callback mechanism for asynchronous response PDUs
     requires additional caution in a multi-threaded application.
     This means a callback function probably should probably not use
     Single API calls to further process the session.

  6. Each call to snmp_sess_open() creates an IDS.  Only a call to
     snmp_sess_close() releases the resources used by the IDS.