netplan.io's secondary IP address feature causes snmpd errors

[Leroy Tennison]

netplan doesn't provide for interface aliases (for example: eth0:0), however, assigning two IP addresses to an interface the way netplan does causes snmpd to produce numerous "error on subcontainer 'ia_addr' insert (-1)" entries in syslog reported by snmpd. This should'nt happen and is either a problem with snmpd or netplan. This also occurs on non-netplan systems (for example, Ubuntu 16.04 using keepalived) when a secondary IP address is added without making it an alias. Ubuntu 16.04 systems using interface aliases do not experience this problem. If needed, I can supply information from the Ubuntu 16.04 systems.

apt-cache policy netplan.io
netplan.io:
  Installed: 0.40.1~18.04.4
  Candidate: 0.40.1~18.04.4
  Version table:
 *** 0.40.1~18.04.4 500
        500 http://archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://archive.ubuntu.com/ubuntu bionic-security/main amd64 Packages
        100 /var/lib/dpkg/status
     0.36.1 500
        500 http://archive.ubuntu.com/ubuntu bionic/main amd64 Packages

apt-cache policy snmpd
snmpd:
  Installed: 5.7.3+dfsg-1.8ubuntu3.1
  Candidate: 5.7.3+dfsg-1.8ubuntu3.1
  Version table:
 *** 5.7.3+dfsg-1.8ubuntu3.1 500
        500 http://archive.ubuntu.com/ubuntu bionic-updates/main amd64 Packages
        500 http://archive.ubuntu.com/ubuntu bionic-security/main amd64 Packages
        100 /var/lib/dpkg/status
     5.7.3+dfsg-1.8ubuntu3 500
        500 http://archive.ubuntu.com/ubuntu bionic/main amd64 Packages

[Leroy Tennison (ltennison)]

apport-collect is not cooperating on this headless system. Hopefully the attached apport-cli runs against snmpd and netplan will help.

[Leroy Tennison (ltennison)]

Apparently only one attachment per post, here's snmpd

[Leroy Tennison (ltennison)]

Below are the non-sensitive parts of snmpd.conf:

agentAddress udp:161
view systemonly included .1.3.6.1.2.1.1
view systemonly included .1.3.6.1.2.1.25.1
view systemonly included .1 80

sysServices 72
proc mountd
proc ntalkd 4
proc sendmail 10 1
disk / 10000
disk /var 5%
includeAllDisks 10%
load 12 10 5
 trapsink localhost public
iquerySecName internalUser
rouser internalUser
defaultMonitors yes
linkUpDownNotifications yes
 extend test1 /bin/echo Hello, world!
 extend-sh test2 echo Hello, world! ; echo Hi there ; exit 35
 master agentx

All that's missing are the rocommunities, sysLocation and sysContact.

[Juhani Numminen (jsonic)]

Marked as affecting the two packages that you've mentioned.

[Leroy Tennison (ltennison)]

I should mention that "numerous" above means about 500 log entries per day.

[Robie Basak (racb)]

Thank you for taking the time to report this bug and helping to make Ubuntu better.

Based on your description I can make a guess as to what is going on.

The "old" kernel interface for network interfaces (still supported under Linux's interface stability promise) allowed named aliases. This is what "ifconfig" uses ("ifconfig eth0:1 ..." etc).

The new interface, used by "ip" and everything new, generalises that to a list - no specific alias names required - but supports a "label" for backwards compatibility. See ip-address(8) for details (search for "label").

I suspect that snmpd doesn't understand additional addresses attached to a network interface that don't have a label.

I'm going to make an executive call here and say that a workaround in netplan to always add a label is not feasible because that would require a suitable implementation to exist in all of its backends as well as maintenance of the labels to avoid conflicts, etc.

Therefore I think this bug can only realistically be fixed in net-snmp by supporting the new kernel interface.

With this background (that I hope is accurate), could someone verify if the latest upstream version of net-snmp still has this issue? I think it's unlikely we'll be able to fix this in Ubuntu without an implementation upstream.

Accordingly I'm marking the netplan.io task Invalid, but feel free to reopen if you think my assessment is incorrect.

[Robie Basak (racb)]

Oh, reading again, are you saying that snmpd is merely reporting an error generated elsewhere? In that case it would be a bug in netplan.io or one of its backend implementations and not in snmpd. Please could you clarify?

[Leroy Tennison (ltennison)]

As best as I can tell this is an snmpd-generated error, the system this is reported for isn't in production yet and no snmp requests should be being made to it. All that is required to generate/stop the syslog messages is to add/delete a secondary IP address to an interface in netplan's configuration file and run 'netplan try' (which is successful). My only question (and I don't have an answer or even an opinion) is whether the snmpd rfcs have some prohibition against the situation causing the error messages.

[Robie Basak (racb)]

I'm not sure I follow exactly where this error message is coming from. I suspect that it's an implementation detail in snmpd, rather than anything defined by any standard.

[Andreas Hasenack (ahasenack)]

This may have nothing to do with netplan indeed, and I think it's a duplicate of https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1246347

A while back I came up with these reproduction steps:

- install snmpd
- install snmp-mibs-downloader
- add a nic alias. With ifconfig I did:
ifconfig eth0:1 10.0.100.209 netmask 255.255.255.0

- restart snmpd
- journalctl -u snmpd --follow

Wait a bit. The error should show up every 30s.

[Robie Basak (racb)]

I came to say that having just seen the other bug. Let's mark it as a dupe for now, and we can undo if someone disagrees.

[Leroy Tennison (ltennison)]

Unfortunately, the solution for the other bug (changing /etc/default/snmpd options to -LS6d from -Lsd) did not stop the ia_addr message spewing in syslog. I note that on Ubuntu 16.04.5 i386 that using 'dpkg -l | grep snmpd' reports: "5.7.3+dfsg-1ubuntu4.2 i386" whereas Ubuntu 18.04.1 amd64 that using "dpkg -l | grep snmpd" reports "5.7.3+dfsg-1.8ubuntu3.1 amd64" which is possibly the source of the discrepancy.