5. SNMP 管理框架的托管对象定义
5. SNMP 管理框架的托管对象定义 (Managed Object Definitions for SNMP Management Frameworks)
本节定义 SNMP-FRAMEWORK-MIB 模块, 其中包含 SNMPv3 框架的托管对象 (managed objects). 该 MIB 模块为 SNMP engine 提供标识和配置信息.
SNMP-FRAMEWORK-MIB DEFINITIONS ::= BEGIN
IMPORTS
MODULE-IDENTITY, OBJECT-TYPE,
OBJECT-IDENTITY,
snmpModules FROM SNMPv2-SMI
TEXTUAL-CONVENTION FROM SNMPv2-TC
MODULE-COMPLIANCE, OBJECT-GROUP FROM SNMPv2-CONF;
snmpFrameworkMIB MODULE-IDENTITY
LAST-UPDATED "200210140000Z"
ORGANIZATION "SNMPv3 Working Group"
CONTACT-INFO
"WG-EMail: [email protected]
Subscribe: [email protected]
Co-Chair: Russ Mundy
Network Associates Laboratories
postal: 15204 Omega Drive, Suite 300
Rockville, MD 20850-4601
USA
EMail: [email protected]
phone: +1 301-947-7107
Co-Chair: David Harrington
Enterasys Networks
postal: 35 Industrial Way
P. O. Box 5005
Rochester, NH 03866-5005
USA
EMail: [email protected]
phone: +1 603-337-2614
Co-editor: Randy Presuhn
BMC Software, Inc.
postal: 2141 North First Street
San Jose, CA 95131
USA
EMail: [email protected]
phone: +1 408-546-1006
Co-editor: Bert Wijnen
Lucent Technologies
postal: Schagen 33
3461 GL Linschoten
Netherlands
EMail: [email protected]
phone: +31 348-680-685"
DESCRIPTION
"The SNMP Management Architecture MIB
Copyright (C) The Internet Society (2002). This
version of this MIB module is part of RFC 3411;
see the RFC itself for full legal notices."
REVISION "200210140000Z"
DESCRIPTION "Changes in this revision:
- Updated various administrative information.
- Corrected some typos.
This revision published as RFC 3411."
REVISION "199901190000Z"
DESCRIPTION "Initial version, published as RFC 2571."
::= { snmpModules 10 }
-- Administrative assignments ***************************************
snmpFrameworkAdmin
OBJECT IDENTIFIER ::= { snmpFrameworkMIB 1 }
snmpFrameworkMIBObjects
OBJECT IDENTIFIER ::= { snmpFrameworkMIB 2 }
snmpFrameworkMIBConformance
OBJECT IDENTIFIER ::= { snmpFrameworkMIB 3 }
-- Textual Conventions ***********************************************
SnmpEngineID ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION "An SNMP engine's administratively-unique identifier.
Objects of this type are for identification, not for
addressing, even though it is possible that an
address may have been used in the generation of
a specific value.
The value for this object may not be all zeros or
all 'ff'H or the empty (zero length) string.
The initial value for this object may be configured
via an operator console entry or via an algorithmic
function. In the latter case, the following
example algorithm is recommended.
In cases where there are multiple engines on the
same system, the use of this algorithm is NOT
appropriate, as it would result in all of those
engines ending up with the same ID value."
SYNTAX OCTET STRING (SIZE(5..32))
SnmpSecurityModel ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION "An identifier that uniquely identifies a
Security Model of the Security Subsystem within
this SNMP Management Architecture.
The values for securityModel are allocated as
follows:
- The zero value does not identify any particular
security model.
- Values between 1 and 255, inclusive, are reserved
for standards-track Security Models and are
managed by the Internet Assigned Numbers Authority
(IANA).
- Values greater than 255 are allocated to
enterprise-specific Security Models. An
enterprise-specific securityModel value is defined
to be:
enterpriseID * 256 + security model within
enterprise
For example, the fourth Security Model defined by
the enterprise whose enterpriseID is 1 would be
260."
SYNTAX INTEGER(0 .. 2147483647)
SnmpMessageProcessingModel ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION "An identifier that uniquely identifies a Message
Processing Model of the Message Processing
Subsystem within this SNMP Management Architecture.
The values for messageProcessingModel are
allocated as follows:
- Values between 0 and 255, inclusive, are
reserved for standards-track Message Processing
Models and are managed by the Internet Assigned
Numbers Authority (IANA).
- Values greater than 255 are allocated to
enterprise-specific Message Processing Models.
An enterprise messageProcessingModel value is
defined to be:
enterpriseID * 256 +
messageProcessingModel within enterprise
For example, the fourth Message Processing Model
defined by the enterprise whose enterpriseID
is 1 would be 260."
SYNTAX INTEGER(0 .. 2147483647)
SnmpSecurityLevel ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION "A Level of Security at which SNMP messages can be
sent or with which operations are being processed;
in particular, one of:
noAuthNoPriv - without authentication and
without privacy,
authNoPriv - with authentication but
without privacy,
authPriv - with authentication and
with privacy.
These three values are ordered such that
noAuthNoPriv is less than authNoPriv and
authNoPriv is less than authPriv."
SYNTAX INTEGER { noAuthNoPriv(1),
authNoPriv(2),
authPriv(3)
}
SnmpAdminString ::= TEXTUAL-CONVENTION
DISPLAY-HINT "255t"
STATUS current
DESCRIPTION "An octet string containing administrative
information, preferably in human-readable form.
To facilitate internationalization, this
information is represented using the ISO/IEC
IS 10646-1 character set, encoded as an octet
string using the UTF-8 transformation format
described in [RFC2279].
Since additional code points are added by
amendments to the 10646 standard from time
to time, implementations must be prepared to
encounter any code point from 0x00000000 to
0x7fffffff. Byte sequences that do not
correspond to the valid UTF-8 encoding of a
code point or are outside this range are
prohibited.
The use of control codes should be avoided.
When it is necessary to represent a newline,
the control code sequence CR LF should be used.
The use of leading or trailing white space should
be avoided.
For code points not directly supported by user
interface hardware or software, an alternative
means of entry and display, such as hexadecimal,
may be provided.
For information encoded in 7-bit US-ASCII,
the UTF-8 encoding is identical to the
US-ASCII encoding.
UTF-8 may require multiple bytes to represent a
single character / code point; thus the length
of this object in octets may be different from
the number of characters encoded. Similarly,
size constraints refer to the number of encoded
octets, not the number of characters represented
by an encoding.
Note that when this TC is used for an object that
is used or envisioned to be used as an index, then
a SIZE restriction MUST be specified so that the
number of sub-identifiers stays reasonable. Note
that the size of a SnmpAdminString object is
measured in octets, not characters."
SYNTAX OCTET STRING (SIZE (0..255))
-- SNMP Engine Objects ***********************************************
snmpEngine OBJECT IDENTIFIER ::= { snmpFrameworkMIBObjects 1 }
snmpEngineID OBJECT-TYPE
SYNTAX SnmpEngineID
MAX-ACCESS read-only
STATUS current
DESCRIPTION "An SNMP engine's administratively-unique identifier.
This information SHOULD be stored in non-volatile
storage so that it remains constant across
re-initializations of the SNMP engine."
::= { snmpEngine 1 }
snmpEngineBoots OBJECT-TYPE
SYNTAX INTEGER (1..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The number of times that the SNMP engine has
(re-)initialized itself since snmpEngineID
was last configured."
::= { snmpEngine 2 }
snmpEngineTime OBJECT-TYPE
SYNTAX INTEGER (0..2147483647)
UNITS "seconds"
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The number of seconds since the value of
the snmpEngineBoots object last changed.
When incrementing this object's value would
cause it to exceed its maximum,
snmpEngineBoots is incremented as if the
agent had re-booted, and this object's value
consequently reverts to zero."
::= { snmpEngine 3 }
snmpEngineMaxMessageSize OBJECT-TYPE
SYNTAX INTEGER (484..2147483647)
MAX-ACCESS read-only
STATUS current
DESCRIPTION "The maximum length in octets of an SNMP message
which this SNMP engine can send or receive and
process, determined as the minimum of the maximum
message size values supported among all of the
transports available to and supported by the engine."
::= { snmpEngine 4 }
-- Registration Points for Authentication Protocols *****************
snmpAuthProtocols OBJECT-IDENTITY
STATUS current
DESCRIPTION "Registration point for standards-track
authentication protocols used in SNMP Management
Frameworks."
::= { snmpFrameworkAdmin 1 }
-- Registration Points for Privacy Protocols ************************
snmpPrivProtocols OBJECT-IDENTITY
STATUS current
DESCRIPTION "Registration point for standards-track privacy
protocols used in SNMP Management Frameworks."
::= { snmpFrameworkAdmin 2 }
-- Conformance Information *******************************************
snmpFrameworkMIBCompliances
OBJECT IDENTIFIER ::= { snmpFrameworkMIBConformance 1 }
snmpFrameworkMIBGroups
OBJECT IDENTIFIER ::= { snmpFrameworkMIBConformance 2 }
-- Compliance Statements *********************************************
snmpFrameworkMIBCompliance MODULE-COMPLIANCE
STATUS current
DESCRIPTION "The compliance statement for SNMP engines which
implement the SNMP Management Framework MIB."
MODULE -- this module
MANDATORY-GROUPS { snmpEngineGroup }
::= { snmpFrameworkMIBCompliances 1 }
-- Units of Conformance **********************************************
snmpEngineGroup OBJECT-GROUP
OBJECTS {
snmpEngineID,
snmpEngineBoots,
snmpEngineTime,
snmpEngineMaxMessageSize
}
STATUS current
DESCRIPTION "A collection of objects for identifying and
determining the configuration and current timeliness
values of an SNMP engine."
::= { snmpFrameworkMIBGroups 1 }
END
上面的 SNMP-FRAMEWORK-MIB 模块给出了 SNMP 管理架构 MIB 的完整 ASN.1 定义. 其中 MODULE-IDENTITY 记录模块的组织, 联系方式, 修订历史和对象标识符分配; 文本约定部分定义 SNMP engine 标识符, 安全模型编号, 消息处理模型编号, 安全级别和管理字符串的通用语义; SNMP engine 对象部分暴露 engine 的标识, 启动计数, 运行时间和最大消息大小; 注册点部分为标准轨道认证协议和隐私协议保留 OID 位置; 一致性部分说明实现 SNMP Management Framework MIB 的 SNMP engines 必须支持的对象组. 这些定义共同提供了 SNMPv3 framework 中识别 engine, 选择安全/消息处理模型, 以及管理相关参数的基础.
SnmpEngineID 是管理上唯一的 engine 标识符, 用于识别而不是寻址, 其值禁止为全零, 全 ffH 或空字符串. SnmpSecurityModel 和 SnmpMessageProcessingModel 为标准轨道模型和企业特定模型划分编号空间, 标准轨道范围由 IANA 管理, 企业特定范围按 enterpriseID 与企业内部编号组合. SnmpSecurityLevel 定义 noAuthNoPriv, authNoPriv 和 authPriv 三个有序安全级别. SnmpAdminString 用 UTF-8 表示面向管理员的信息, 并说明字符集, 控制码, 换行, 空白和长度约束的处理方式. snmpEngineID 应保存在非易失性存储中以跨重新初始化保持稳定; snmpEngineBoots 记录自 snmpEngineID 上次配置以来 engine 重新初始化的次数; snmpEngineTime 记录 snmpEngineBoots 上次变化后的秒数; snmpEngineMaxMessageSize 表示该 engine 可发送, 接收和处理的最大 SNMP 消息长度.
实现者在使用这些对象时应保持其语义稳定. snmpEngineID 的目的不是网络寻址, 因此地址只是在生成某个值时可能使用的输入之一. 如果同一系统上存在多个 engine, 不能使用会为所有 engine 生成相同 ID 的算法. SnmpAdminString 的长度约束按编码后的八位字节计算, 而不是按字符数计算; 当它用作索引或预期用作索引时, 必须指定 SIZE 限制, 以避免子标识符数量过大. snmpAuthProtocols 和 snmpPrivProtocols 作为标准轨道协议注册点, 使后续认证协议和隐私协议能够在统一 OID 空间中分配. snmpEngineGroup 汇集 engine 识别和及时性相关对象, 构成一致性声明要求的基本支持单元.
这些约束有助于不同厂商实现保持互操作性, 并减少重新初始化, 模型编号冲突和字符串编码差异带来的管理风险.
该 MIB 模块定义以下关键对象:
文本约定 (Textual Conventions)
- SnmpEngineID: SNMP engine 的唯一标识符.
- SnmpSecurityModel: Security Model 的标识符.
- SnmpMessageProcessingModel: Message Processing Model 的标识符.
- SnmpSecurityLevel: 安全级别 (noAuthNoPriv, authNoPriv, authPriv).
- SnmpAdminString: 用于管理信息的字符串 (UTF-8 编码).
SNMP Engine 对象
- snmpEngineID: 此 SNMP engine 的唯一标识符.
- snmpEngineBoots: 该 engine 被重新初始化的次数.
- snmpEngineTime: 自上次重新初始化以来经过的秒数.
- snmpEngineMaxMessageSize: 该 engine 能够处理的最大消息大小.
注册点 (Registration Points)
- snmpAuthProtocols: 认证协议的注册点.
- snmpPrivProtocols: 隐私协议的注册点.
这些对象为管理 SNMP engine 提供基础, 对 SNMPv3 框架的运行至关重要.