RFC 3413, "Simple Network Management Protocol (SNMP) Applications", December 2002

Errata ID: 7694
Status: Rejected
Type: Technical
Publication Format(s) : TEXT
Reported By: Blake Nemura
Date Reported: 2023-11-02
Rejected by: Rob Wilton
Date Rejected: 2024-01-15

Section 3.2 says:

       - If the isAccessAllowed ASI returns a noSuchView, noAccessEntry,
         or noGroupName error, processing of the management operation is
         halted, a PDU value is constructed using the values from the
         originally received PDU, but replacing the error-status with an
         authorizationError code, and error-index value of 0, and
         control is passed to step (6) below.

       - If the isAccessAllowed ASI returns an otherError, processing of
         the management operation is halted, a different PDU value is
         constructed using the values from the originally received PDU,
         but replacing the error-status with a genError code and the
         error-index with the index of the failed variable binding, and
         control is passed to step (6) below.

It should say:

       - If the isAccessAllowed ASI returns a notInView error for a
         Write-Class viewType (e.g. for a SetRequest-PDU), processing
         of the management operation is halted, a different PDU value is
         constructed using the values from the originally received PDU,
         but replacing the error-status with a noAccess code and the
         error-index with the index of the failed variable binding, and
         control is passed to step (6) below.

       - If the isAccessAllowed ASI returns a noSuchView, noAccessEntry,
         or noGroupName error, processing of the management operation is
         halted, a PDU value is constructed using the values from the
         originally received PDU, but replacing the error-status with an
         authorizationError code, and error-index value of 0, and
         control is passed to step (6) below.

       - If the isAccessAllowed ASI returns an otherError, processing of
         the management operation is halted, a different PDU value is
         constructed using the values from the originally received PDU,
         but replacing the error-status with a genError code and the
         error-index with the index of the failed variable binding, and
         control is passed to step (6) below.

Notes:

RFC3415, Section 3, defines 6 distinct errorIndication types for the isAccessAllowed ASI: notInView, noSuchView, noSuchContext, noGroupName, noAccessEntry, and otherError.

Whereas RFC3413 does not define handling of the notInView error. Whereby one might, presumably mistakenly, assume that notInView should be handled as "an otherError". However otherError is a distinct errorIndication for "undefined error" (presumably as a catch-all for possible implementation-level errors), whereas notInView is a defined error.

Additionally, RFC3416, Section 4.2.5, and only for SetRequest-PDU, clearly defines noAccess error-status as the first-priority validation check for "not...in the appropriate MIB view" case:
(1) If the variable binding's name specifies an existing or non-
existent variable to which this request is/would be denied
access because it is/would not be in the appropriate MIB view,
then the value of the Response-PDU's error-status field is set
to "noAccess", and the value of its error-index field is set to
the index of the failed variable binding.
--VERIFIER NOTES--
This change is too significant to do as part of an errata update to a 20 year old RFC, and there is not clear consensus as to whether any changes are required here at all (hence rejected rather than marked as "held for document update").

There has been some further discussion of this errata here:
https://mailarchive.ietf.org/arch/msg/opsawg/TDMmdSZpDYIqGYHa5SvW1cfnW4c/`
https://mailarchive.ietf.org/arch/msg/opsawg/xnXWL9fTjOhVaiAFD6kmqa-ZeNc/

Report New Errata