Commit 1f604fcdb78 for php.net

commit 1f604fcdb78cff4fe0a7f0ec614a3ed4a246d028
Author: eskyuu <swilton@fluentit.au>
Date:   Thu Aug 20 00:40:39 2026 +0800

    snmp: Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) security protocols (#21451)

    RFC: https://wiki.php.net/rfc/snmp_improvements_2026#increase_the_number_of_snmpv3_security_protocols_supported

diff --git a/ext/snmp/snmp.c b/ext/snmp/snmp.c
index c45e3a6522b..0c3e53614a6 100644
--- a/ext/snmp/snmp.c
+++ b/ext/snmp/snmp.c
@@ -1061,20 +1061,48 @@ static ZEND_ATTRIBUTE_NONNULL bool snmp_session_set_sec_protocol(struct snmp_ses
 		s->securityPrivProtoLen = USM_PRIV_PROTO_AES_LEN;
 		return true;
 	}
+
+# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
+	if (zend_string_equals_literal_ci(prot, "AES192")) {
+		s->securityPrivProto = usmAES192PrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES192PrivProtocol);
+		return true;
+	}
+
+	if (zend_string_equals_literal_ci(prot, "AES256")) {
+		s->securityPrivProto = usmAES256PrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES256PrivProtocol);
+		return true;
+	}
+
+	if (zend_string_equals_literal_ci(prot, "AES192C")) {
+		s->securityPrivProto = usmAES192CiscoPrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES192CiscoPrivProtocol);
+		return true;
+	}
+
+	if (zend_string_equals_literal_ci(prot, "AES256C")) {
+		s->securityPrivProto = usmAES256CiscoPrivProtocol;
+		s->securityPrivProtoLen = OID_LENGTH(usmAES256CiscoPrivProtocol);
+		return true;
+	}
+# endif
 #endif

 #ifdef HAVE_AES
-# ifndef NETSNMP_DISABLE_DES
-	zend_value_error("Security protocol must be one of \"DES\", \"AES128\", or \"AES\"");
-# else
-	zend_value_error("Security protocol must be one of \"AES128\", or \"AES\"");
+zend_value_error("Security protocol must be one of "
+#  ifndef NETSNMP_DISABLE_DES
+    "\"DES\", "
+#  endif
+# ifdef NETSNMP_DRAFT_BLUMENTHAL_AES_04
+ "\"AES256\", \"AES256C\", \"AES192\", \"AES192C\", "
 # endif
-#else
-# ifndef NETSNMP_DISABLE_DES
+ "\"AES128\", or \"AES\""
+);
+#elif !defined(NETSNMP_DISABLE_DES)
 	zend_value_error("Security protocol must be \"DES\"");
-# else
+#else
 	zend_value_error("No security protocol supported");
-# endif
 #endif
 	return false;
 }
diff --git a/ext/snmp/tests/snmp-object-setSecurity_error.phpt b/ext/snmp/tests/snmp-object-setSecurity_error.phpt
index 576ec838080..56565bf5855 100644
--- a/ext/snmp/tests/snmp-object-setSecurity_error.phpt
+++ b/ext/snmp/tests/snmp-object-setSecurity_error.phpt
@@ -72,8 +72,8 @@

 Warning: SNMP::setSecurity(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)
-Security protocol must be one of "DES", "AES128", or "AES"
-Security protocol must be one of "DES", "AES128", or "AES"
+Security protocol must be one of %s
+Security protocol must be one of %s

 Warning: SNMP::setSecurity(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)
diff --git a/ext/snmp/tests/snmp3-error.phpt b/ext/snmp/tests/snmp3-error.phpt
index 5f39f88ffe1..8dd6c87b011 100644
--- a/ext/snmp/tests/snmp3-error.phpt
+++ b/ext/snmp/tests/snmp3-error.phpt
@@ -69,7 +69,7 @@

 Warning: snmp3_get(): Error generating a key for authentication pass phrase 'te': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)
-Security protocol must be one of "DES", "AES128", or "AES"
+Security protocol must be one of %s "AES128", or "AES"

 Warning: snmp3_get(): Error generating a key for privacy pass phrase '': Generic error (The supplied password length is too short.) in %s on line %d
 bool(false)