Network Working Group J. Schoenwaelder
Request for Comments: 3179 TU Braunschweig
Obsoletes: 2593 J. Quittek
Category: Experimental NEC Europe Ltd.
October 2001
Network Working Group J. Schoenwaelder
Request for Comments: 3179 TU Braunschweig
Obsoletes: 2593 J. Quittek
Category: Experimental NEC Europe Ltd.
October 2001
Script MIB Extensibility Protocol Version 1.1
脚本MIB扩展性协议版本1.1
Status of this Memo
本备忘录的状况
This memo defines an Experimental Protocol for the Internet community. It does not specify an Internet standard of any kind. Discussion and suggestions for improvement are requested. Distribution of this memo is unlimited.
这份备忘录为互联网社区定义了一个实验性协议。它没有规定任何类型的互联网标准。要求进行讨论并提出改进建议。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
Abstract
摘要
The Script MIB extensibility protocol (SMX) defined in this memo separates language specific runtime systems from language independent Script MIB implementations. The IETF Script MIB defines an interface for the delegation of management functions based on the Internet management framework. A management script is a set of instructions that are executed by a language specific runtime system.
本备忘录中定义的脚本MIB可扩展性协议（SMX）将特定于语言的运行时系统与独立于语言的脚本MIB实现分开。IETF脚本MIB定义了基于Internet管理框架的管理功能委托接口。管理脚本是由特定于语言的运行时系统执行的一组指令。
Table of Contents
目录
1 Introduction ................................................. 2
2 Process Model and Communication Model ........................ 3
3 Security Profiles ............................................ 4
4 Start of Runtime Systems and Connection Establishment ........ 4
5 SMX Messages ................................................. 5
5.1 Common Definitions ......................................... 5
5.2 Commands ................................................... 7
5.3 Replies .................................................... 7
6 Elements of Procedure ........................................ 9
6.1 SMX Message Processing on the Runtime Systems .............. 9
6.1.1 Processing the `hello' Command ........................... 10
6.1.2 Processing the `start' Command ........................... 10
6.1.3 Processing the `suspend' Command ......................... 11
6.1.4 Processing the `resume' Command .......................... 12
6.1.5 Processing the `abort' Command ........................... 12
6.1.6 Processing the `status' Command .......................... 12
6.1.7 Generation of Asynchronous Notifications ................. 13
1 Introduction ................................................. 2
2 Process Model and Communication Model ........................ 3
3 Security Profiles ............................................ 4
4 Start of Runtime Systems and Connection Establishment ........ 4
5 SMX Messages ................................................. 5
5.1 Common Definitions ......................................... 5
5.2 Commands ................................................... 7
5.3 Replies .................................................... 7
6 Elements of Procedure ........................................ 9
6.1 SMX Message Processing on the Runtime Systems .............. 9
6.1.1 Processing the `hello' Command ........................... 10
6.1.2 Processing the `start' Command ........................... 10
6.1.3 Processing the `suspend' Command ......................... 11
6.1.4 Processing the `resume' Command .......................... 12
6.1.5 Processing the `abort' Command ........................... 12
6.1.6 Processing the `status' Command .......................... 12
6.1.7 Generation of Asynchronous Notifications ................. 13
6.2 SMX Message Processing on the SNMP Agent ................... 13
6.2.1 Creating a Runtime System ................................ 14
6.2.2 Generating the `hello' Command ........................... 14
6.2.3 Generating the `start' Command ........................... 15
6.2.4 Generating the `suspend' Command ......................... 16
6.2.5 Generating the `resume' Command .......................... 16
6.2.6 Generating the `abort' Command ........................... 17
6.2.7 Generating the `status' Command .......................... 18
6.2.8 Processing Asynchronous Notifications .................... 19
7 Example SMX Message Flow ..................................... 20
8 Transport Mappings ........................................... 20
8.1 SMX over Bi-directional Pipes .............................. 21
8.2 SMX over TCP ............................................... 21
9 Security Considerations ...................................... 21
10 Changes from RFC 2593 ....................................... 22
11 Acknowledgments ............................................. 23
12 References .................................................. 23
13 Authors' Addresses .......................................... 24
14 Full Copyright Statement .................................... 25
6.2 SMX Message Processing on the SNMP Agent ................... 13
6.2.1 Creating a Runtime System ................................ 14
6.2.2 Generating the `hello' Command ........................... 14
6.2.3 Generating the `start' Command ........................... 15
6.2.4 Generating the `suspend' Command ......................... 16
6.2.5 Generating the `resume' Command .......................... 16
6.2.6 Generating the `abort' Command ........................... 17
6.2.7 Generating the `status' Command .......................... 18
6.2.8 Processing Asynchronous Notifications .................... 19
7 Example SMX Message Flow ..................................... 20
8 Transport Mappings ........................................... 20
8.1 SMX over Bi-directional Pipes .............................. 21
8.2 SMX over TCP ............................................... 21
9 Security Considerations ...................................... 21
10 Changes from RFC 2593 ....................................... 22
11 Acknowledgments ............................................. 23
12 References .................................................. 23
13 Authors' Addresses .......................................... 24
14 Full Copyright Statement .................................... 25
The Script MIB [1] defines a standard interface for the delegation of management functions based on the Internet management framework. In particular, it provides the following capabilities:
脚本MIB[1]定义了基于Internet管理框架的管理功能委托的标准接口。特别是，它提供了以下功能：
1. Transfer of management scripts to a distributed manager.
1. 将管理脚本传输到分布式管理器。
2. Initiating, suspending, resuming and terminating management scripts.
2. 启动、挂起、恢复和终止管理脚本。
3. Transfer of arguments for management scripts.
3. 管理脚本的参数传输。
4. Monitoring and control of running management scripts.
4. 监视和控制正在运行的管理脚本。
5. Transfer of results produced by management scripts.
5. 转移管理脚本产生的结果。
A management script is a set of instructions executed by a language specific runtime system. The Script MIB does not prescribe a specific language. Instead, it allows to control scripts written in different languages that are executing concurrently.
管理脚本是由特定于语言的运行时系统执行的一组指令。脚本MIB没有规定特定的语言。相反，它允许控制以不同语言编写的脚本并发执行。
The Script MIB Extensibility protocol (SMX) defined in this memo can be used to separate language specific runtime systems from the runtime system independent Script MIB implementations. The lightweight SMX protocol can be used to support different runtime systems without any changes to the language neutral part of a Script MIB implementation.
本备忘录中定义的脚本MIB可扩展性协议（SMX）可用于将特定于语言的运行时系统与独立于运行时系统的脚本MIB实现分开。轻量级SMX协议可用于支持不同的运行时系统，而无需对脚本MIB实现中与语言无关的部分进行任何更改。
Examples of languages and runtime systems considered during the design of the SMX protocol are the Java virtual machine [2] and the Tool Command Language (Tcl) [3]. Other languages with comparable features should be easy to integrate as well.
SMX协议设计过程中考虑的语言和运行时系统示例有Java虚拟机[2]和工具命令语言（Tcl）[3]。具有类似功能的其他语言也应该易于集成。
Figure 1 shows the process and communication model underlying the SMX protocol. The language and runtime system independent SNMP agent implementing the Script MIB communicates with one ore more runtime systems via the SMX protocol. A runtime system may be able to execute one or multiple scripts simultaneously (multi-threading). The SMX protocol supports multi-threading, but it does not require multi-threaded runtime systems.
图1显示了SMX协议的流程和通信模型。实现脚本MIB的独立于语言和运行时系统的SNMP代理通过SMX协议与一个或多个运行时系统通信。运行时系统可以同时执行一个或多个脚本（多线程）。SMX协议支持多线程，但不需要多线程运行时系统。
The SMX protocol uses a local storage device (usually implemented on top of the local file system) to transfer scripts from the SNMP agent to the runtime systems. The SNMP agent has read and write access to the script storage device while the runtime systems only need read access. The SMX protocol passes the location of a script in the local storage device to the runtime engines. It is then the responsibility of the runtime engines to load the script from the specified location.
SMX协议使用本地存储设备（通常在本地文件系统上实现）将脚本从SNMP代理传输到运行时系统。SNMP代理对脚本存储设备具有读写访问权限，而运行时系统只需要读访问权限。SMX协议将脚本在本地存储设备中的位置传递给运行时引擎。然后，运行时引擎负责从指定位置加载脚本。
runtime 1
+--------------+ SMX +---------+
| |<-------------->| O O O |<-+
SNMP | Script MIB | +---------+ |
<---------->| | |
| SNMP Agent | runtime 2 |
| | SMX +---------+ |
| |<-------------->| O | |
+--------------+ +---------+ |
^ ^ |
| +---------+ | |
| | script |----------+ |
+------>| storage |------------------+
+---------+
runtime 1
+--------------+ SMX +---------+
| |<-------------->| O O O |<-+
SNMP | Script MIB | +---------+ |
<---------->| | |
| SNMP Agent | runtime 2 |
| | SMX +---------+ |
| |<-------------->| O | |
+--------------+ +---------+ |
^ ^ |
| +---------+ | |
| | script |----------+ |
+------>| storage |------------------+
+---------+
Figure 1: SMX process and communication model
图1:SMX过程和通信模型
Security profiles control what a running script is allowed to do. It is useful to distinguish two different classes of security profiles:
安全配置文件控制允许运行的脚本执行的操作。区分两类不同的安全配置文件很有用：
- The operating system security profile specifies the set of operating system services that can be used by the operating system level process which executes a script. Under UNIX, this maps to the effective user and group identity for the running process. In addition, many UNIX versions allow to set other resource limits, such as the number of open files or the maximum stack sizes. Another mechanism in UNIX is the chroot() system call which changes the file system root for a process. The chroot() mechanism can be used to prevent runtime systems from accessing any system files. It is suggested to make use of all applicable operating system security mechanism in order to protect the operating system from malicious scripts or runtime systems.
- 操作系统安全配置文件指定可由执行脚本的操作系统级进程使用的操作系统服务集。在UNIX下，这映射到运行进程的有效用户和组标识。此外，许多UNIX版本允许设置其他资源限制，例如打开文件的数量或最大堆栈大小。UNIX中的另一种机制是chroot（）系统调用，它更改进程的文件系统根。chroot（）机制可用于防止运行时系统访问任何系统文件。建议使用所有适用的操作系统安全机制，以保护操作系统免受恶意脚本或运行时系统的攻击。
- Secure runtime systems provide fine grained control over the set of services that can be used by a running script at a particular point during script execution. A runtime security profile specifying fine grained access control is runtime system dependent. For a Java virtual machine, the runtime security profile is interpreted by the SecurityManager and ClassLoader classes[4]. For Tcl, the runtime security profile maps to the interpreter's security profile [5].
- 安全运行时系统提供对服务集的细粒度控制，在脚本执行期间，运行脚本可以在特定点使用这些服务。指定细粒度访问控制的运行时安全配置文件依赖于运行时系统。对于Java虚拟机，运行时安全配置文件由SecurityManager和ClassLoader类解释[4]。对于Tcl，运行时安全配置文件映射到解释器的安全配置文件[5]。
The SMX protocol allows to execute scripts under different operating system profiles and runtime system profiles. Multiple operating system security profiles are realized by using multiple runtime systems which execute in operating system processes with different security profiles. Multiple runtime security profiles are supported by passing a security profile name to a runtime system during script invocation.
SMX协议允许在不同的操作系统配置文件和运行时系统配置文件下执行脚本。通过使用在具有不同安全配置文件的操作系统进程中执行的多个运行时系统，可以实现多个操作系统安全配置文件。通过在脚本调用期间将安全配置文件名称传递给运行时系统，支持多个运行时安全配置文件。
The Script MIB does not define how operating system or runtime system security profiles are identified. This memo suggests that the smLaunchOwner is mapped to an operating system security profile and a runtime system security profile when a script is started.
脚本MIB没有定义如何识别操作系统或运行时系统安全配置文件。此备忘录建议启动脚本时，smLaunchOwner映射到操作系统安全配置文件和运行时系统安全配置文件。
The SNMP agent starts runtime systems based on the static properties of the runtime system (multi-threaded or single-threaded) and the operating system security profiles. Starting a new runtime system requires to create a process environment which matches the operating system security profile.
SNMP代理根据运行时系统（多线程或单线程）的静态属性和操作系统安全配置文件启动运行时系统。启动新的运行时系统需要创建与操作系统安全配置文件匹配的进程环境。
In order to prevent SMX communication from untrusted peers the SNMP agent has to choose a secure SMX transport. This memo defines two transports in Section 8: (a) a bi-directional pipe using standard input/output streams on the runtime engine side, and (b) a TCP connection where the SNMP agent acts as a listening server that accepts only connections from local runtime engines that authenticate themselves with a secret shared between the agent and the runtime engine.
为了防止来自不受信任的对等方的SMX通信，SNMP代理必须选择安全的SMX传输。本备忘录在第8节中定义了两种传输：（a）在运行时引擎端使用标准输入/输出流的双向管道，以及（b）一种TCP连接，其中SNMP代理充当侦听服务器，只接受来自本地运行时引擎的连接，这些引擎使用代理和运行时引擎之间共享的秘密对自己进行身份验证。
The message formats described below are defined using the Augmented BNF (ABNF) defined in RFC 2234 [6]. The definitions for `ALPHA', `DIGIT', `HEXDIG', `WSP', `CRLF', `CR', `LF', `HTAB', `VCHAR' and `DQUOTE' are imported from appendix A of RFC 2234 and not repeated here.
下面描述的消息格式是使用RFC 2234[6]中定义的扩充BNF（ABNF）定义的。“ALPHA”、“DIGIT”、“HEXDIG”、“WSP”、“CRLF”、“CR”、“LF”、“HTAB”、“VCHAR”和“DQUOTE”的定义从RFC 2234的附录A中引入，此处不再重复。
The following ABNF definitions are used in subsequent sections to define the SMX protocol messages.
以下ABNF定义在后续章节中用于定义SMX协议消息。
Zero = %x30 ; the ASCII character '0'
Zero = %x30 ; the ASCII character '0'
ProfileChars = DIGIT / ALPHA / %x2D-2F / %x3A / %x5F
; digits, alphas, and the characters
; '-', '.', '/', ':', '_'
ProfileChars = DIGIT / ALPHA / %x2D-2F / %x3A / %x5F
; digits, alphas, and the characters
; '-', '.', '/', ':', '_'
QuotedString = DQUOTE *(VCHAR / WSP) DQUOTE
QuotedString = DQUOTE *(VCHAR / WSP) DQUOTE
HexString = 1*(HEXDIG HEXDIG)
HexString = 1*(HEXDIG HEXDIG)
Id = 1*DIGIT ; identifier for an SMX transaction
Id = 1*DIGIT ; identifier for an SMX transaction
Script = QuotedString ; script file name
Script=QuotedString；脚本文件名
RunId = 1*DIGIT ; globally unique identifier for a
; running script (note, smRunIndex
; is only unique for a smLaunchOwner,
; smLaunchName pair)
RunId = 1*DIGIT ; globally unique identifier for a
; running script (note, smRunIndex
; is only unique for a smLaunchOwner,
; smLaunchName pair)
Profile = 1*ProfileChars ; security profile name
Profile = 1*ProfileChars ; security profile name
RunState = "1" ; smRunState `initializing'
RunState =/ "2" ; smRunState `executing'
RunState =/ "3" ; smRunState `suspending'
RunState =/ "4" ; smRunState `suspended'
RunState =/ "5" ; smRunState `resuming'
RunState = "1" ; smRunState `initializing'
RunState =/ "2" ; smRunState `executing'
RunState =/ "3" ; smRunState `suspending'
RunState =/ "4" ; smRunState `suspended'
RunState =/ "5" ; smRunState `resuming'
RunState =/ "6" ; smRunState `aborting'
RunState =/ "7" ; smRunState `terminated'
RunState =/ "6" ; smRunState `aborting'
RunState =/ "7" ; smRunState `terminated'
ExitCode = "1" ; smRunExitCode `noError'
ExitCode =/ "2" ; smRunExitCode `halted'
ExitCode =/ "3" ; smRunExitCode `lifeTimeExceeded'
ExitCode =/ "4" ; smRunExitCode `noResourcesLeft'
ExitCode =/ "5" ; smRunExitCode `languageError'
ExitCode =/ "6" ; smRunExitCode `runtimeError'
ExitCode =/ "7" ; smRunExitCode `invalidArgument'
ExitCode =/ "8" ; smRunExitCode `securityViolation'
ExitCode =/ "9" ; smRunExitCode `genericError'
ExitCode = "1" ; smRunExitCode `noError'
ExitCode =/ "2" ; smRunExitCode `halted'
ExitCode =/ "3" ; smRunExitCode `lifeTimeExceeded'
ExitCode =/ "4" ; smRunExitCode `noResourcesLeft'
ExitCode =/ "5" ; smRunExitCode `languageError'
ExitCode =/ "6" ; smRunExitCode `runtimeError'
ExitCode =/ "7" ; smRunExitCode `invalidArgument'
ExitCode =/ "8" ; smRunExitCode `securityViolation'
ExitCode =/ "9" ; smRunExitCode `genericError'
Authenticator = HexString ; authentication cookie
验证器=十六进制字符串；身份验证cookie
Version = "SMX/1.1" ; current version of the SMX protocol
Version = "SMX/1.1" ; current version of the SMX protocol
Argument = HexString / QuotedString ; see smRunArgument
Argument = HexString / QuotedString ; see smRunArgument
Result = HexString / QuotedString ; see smRunResult
Result = HexString / QuotedString ; see smRunResult
ErrorMsg = HexString / QuotedString ; see smRunError
ErrorMsg = HexString / QuotedString ; see smRunError
The definition of QuotedString requires further explanation. A quoted string may contain special character sequences, all starting with the backslash character (%x5C). The interpretation of these sequences is as follows:
QuotedString的定义需要进一步解释。带引号的字符串可能包含特殊字符序列，所有字符序列都以反斜杠（%x5C）开头。这些层序的解释如下：
`\\' backslash character (`%x5C') `\t' tab character (`HTAB') `\n' newline character (`LF') `\r' carriage-return character (`CR') `\"' quote character (`DQUOTE')
`\\'反斜杠字符（`x5C'）`\t'制表符（`HTAB'）`\n'换行符（`LF'）`\r'回车符（`CR'）`\'引号字符（`DQUOTE'））
In all other cases not listed above, the backslash is dropped and the following character is treated as an ordinary character.
在上面未列出的所有其他情况下，将删除反斜杠，并将以下字符视为普通字符。
`Argument' and `Result' is either a QuotedString or a HexString. The Script MIB defines script arguments and results as arbitrary octet strings. The SMX protocol supports a binary and a human readable representation since it is likely that printable argument and result strings will be used frequently. However, an implementation must be able to handle both formats in order to be compliant with the Script MIB.
`参数“”和“结果”是QuotedString或HexString。脚本MIB将脚本参数和结果定义为任意八位字节字符串。SMX协议支持二进制和人类可读的表示，因为可能会经常使用可打印的参数和结果字符串。但是，实现必须能够处理这两种格式，才能与脚本MIB兼容。
The `Authenticator' is a HexString which does not carry any semantics other than being a random sequence of bytes. It is therefore not necessary to have a human readable representation.
“Authenticator”是一个十六进制字符串，除了是一个随机的字节序列外，它不带任何语义。因此，不需要具有人类可读的表示。
The following ABNF definitions define the set of SMX commands which can be sent from the SNMP agent to a runtime system.
以下ABNF定义定义了可以从SNMP代理发送到运行时系统的SMX命令集。
Command = "hello" WSP Id CRLF
Command=“hello”WSP Id CRLF
Command =/ "start" WSP Id WSP RunId WSP Script WSP Profile WSP Argument CRLF
Command=/“start”WSP Id WSP RunId WSP脚本WSP Profile WSP参数CRLF
Command =/ "suspend" WSP Id WSP RunId CRLF
命令=/“挂起”WSP Id WSP RunId CRLF
Command =/ "resume" WSP Id WSP RunId CRLF
命令=/“恢复”WSP Id WSP RunId CRLF
Command =/ "abort" WSP Id WSP RunId CRLF
命令=/“中止”WSP Id WSP RunId CRLF
Command =/ "status" WSP Id WSP RunId CRLF
命令=/“状态”WSP Id WSP RunId CRLF
The `hello' command is always the first command sent over a SMX connection. It is used to identify and authenticate the runtime system. The `start' command starts the execution of a script. The `suspend', `resume' and `abort' commands can be used to change the status of a running script. The `status' command is used to retrieve status information for a running script.
“hello”命令始终是通过SMX连接发送的第一个命令。它用于识别和验证运行时系统。“start”命令开始执行脚本。“suspend”、“resume”和“abort”命令可用于更改正在运行的脚本的状态。“status”命令用于检索正在运行的脚本的状态信息。
There is no compile command. It is the responsibility of the SNMP agent to perform any compilation steps as needed before using the SMX `start' command. There is no SMX command to shutdown a runtime system. Closing the connection must be interpreted as a request to terminate all running scripts in that runtime system and to shutdown the runtime system.
没有编译命令。SNMP代理负责在使用SMX“start”命令之前根据需要执行任何编译步骤。没有用于关闭运行时系统的SMX命令。关闭连接必须解释为请求终止该运行时系统中所有正在运行的脚本并关闭运行时系统。
Every reply message starts with a three digit reply code and ends with `CRLF'. The three digits in a reply code have a special meaning. The first digit identifies the class of a reply message. The following classes exist:
每条回复信息以三位数字的回复代码开头，以“CRLF”结尾。回复代码中的三位数字具有特殊含义。第一个数字标识回复消息的类别。存在以下类别：
1yz transient positive response 2yz permanent positive response 3yz transient negative response 4yz permanent negative response 5yz asynchronous notification
1yz瞬时正响应2yz永久正响应3yz瞬时负响应4yz永久负响应5yz异步通知
The classes 1yz and 3yz are currently not used by SMX version 1.1. They are defined only for future SMX extensions.
SMX版本1.1目前未使用1yz和3yz类。它们仅为将来的SMX扩展而定义。
The second digit encodes the specific category. The following categories exist:
第二个数字对特定类别进行编码。存在以下类别：
x0z syntax errors that don't fit any other category x1z replies for commands targeted at the whole runtime system x2z replies for commands targeted at scripts x3z replies for commands targeted at running instances of scripts
x0z语法错误不适合任何其他类别x1z回复针对整个运行时系统的命令x2z回复针对脚本的命令x3z回复针对脚本运行实例的命令
The third digit gives a finer gradation of meaning in each category specified by the second digit. Below is the ABNF definition of all reply messages and codes:
第三个数字在第二个数字指定的每个类别中给出了更精细的意义层次。以下是ABNF对所有回复消息和代码的定义：
Reply = "211" WSP Id WSP Version *1(WSP Authenticator) CRLF
; identification of the
; runtime system
Reply = "211" WSP Id WSP Version *1(WSP Authenticator) CRLF
; identification of the
; runtime system
Reply =/ "231" WSP Id WSP RunState CRLF ; status of a running script
回复=/“231”WSP Id WSP运行状态CRLF；正在运行的脚本的状态
Reply =/ "232" WSP Id CRLF ; abort of a running script
Reply =/ "232" WSP Id CRLF ; abort of a running script
Reply =/ "401" WSP Id CRLF ; syntax error in command
Reply =/ "401" WSP Id CRLF ; syntax error in command
Reply =/ "402" WSP Id CRLF ; unknown command
Reply =/ "402" WSP Id CRLF ; unknown command
Reply =/ "421" WSP Id CRLF ; unknown or illegal Script
Reply =/ "421" WSP Id CRLF ; unknown or illegal Script
Reply =/ "431" WSP Id CRLF ; unknown or illegal RunId
Reply =/ "431" WSP Id CRLF ; unknown or illegal RunId
Reply =/ "432" WSP Id CRLF ; unknown or illegal Profile
Reply =/ "432" WSP Id CRLF ; unknown or illegal Profile
Reply =/ "433" WSP Id CRLF ; illegal Argument
Reply =/ "433" WSP Id CRLF ; illegal Argument
Reply =/ "434" WSP Id CRLF ; unable to change the status of
; a running script
Reply =/ "434" WSP Id CRLF ; unable to change the status of
; a running script
Reply =/ "511" WSP Zero WSP QuotedString CRLF ; an arbitrary message send from ; the runtime system
回复=/“511”WSP零WSP QuotedString CRLF；从发送的任意消息；运行时系统
Reply =/ "531" WSP Zero WSP RunId WSP RunState CRLF ; asynchronous running script ; status change
回复=/“531”WSP零WSP运行ID WSP运行状态CRLF；异步运行脚本；身份变更
Reply =/ "532" WSP Zero WSP RunId WSP RunState WSP Result CRLF ; intermediate script result
回复=/“532”WSP零WSP运行ID WSP运行状态WSP结果CRLF；中间脚本结果
Reply =/ "533" WSP Zero WSP RunId WSP RunState WSP Result CRLF ; intermediate script result that ; triggers an event report
回复=/“533”WSP零WSP运行ID WSP运行状态WSP结果CRLF；中间脚本结果是；触发事件报告
Reply =/ "534" WSP Zero WSP RunId WSP Result CRLF ; normal script termination, ; deprecated
回复=/“534”WSP零WSP RunId WSP结果CRLF；正常脚本终止；不赞成
Reply =/ "535" WSP Zero WSP RunId WSP ExitCode WSP ErrorMsg CRLF ; abnormal script termination, ; deprecated
回复=/“535”WSP Zero WSP RunId WSP ExitCode WSP ERRORMMSG CRLF；异常脚本终止；不赞成
Reply =/ "536" WSP Zero WSP RunId WSP RunState WSP ErrorMsg CRLF ; script error
回复=/“536”WSP Zero WSP RunId WSP RunState WSP ERRORMMSG CRLF；脚本错误
Reply =/ "537" WSP Zero WSP RunId WSP RunState WSP ErrorMsg CRLF ; script error that ; triggers an event report
回复=/“537”WSP Zero WSP RunId WSP RunState WSP ERRORMMSG CRLF；脚本错误说明；触发事件报告
Reply =/ "538" WSP Zero WSP RunId WSP ExitCode CRLF ; script termination
回复=/“538”WSP零WSP RunId WSP ExitCode CRLF；脚本终止
This section describes in detail the processing steps performed by the SNMP agent and the runtime system with regard to the SMX protocol.
本节详细介绍SNMP代理和运行时系统针对SMX协议执行的处理步骤。
This section describes the processing of SMX command messages by a runtime engine and the conditions under which asynchronous notifications are generated.
本节介绍运行时引擎对SMX命令消息的处理以及生成异步通知的条件。
When the runtime system receives a message, it first tries to recognize a command consisting of the command string and the transaction identifier. If the runtime system is not able to extract both the command string and the transaction identifier, then the message is discarded. An asynchronous `511' reply may be generated in this case. Otherwise, the command string is checked to be valid, i.e. to be one of the strings `hello', `start', `suspend', `resume', `abort', or `status'. If the string is invalid, a `402' reply is sent and processing of the message stops. If a valid command has been detected, further processing of the message depends on the command as described below.
当运行时系统收到消息时，它首先尝试识别由命令字符串和事务标识符组成的命令。如果运行时系统无法同时提取命令字符串和事务标识符，则消息将被丢弃。在这种情况下，可能会生成异步“511”回复。否则，将检查命令字符串是否有效，即是否为字符串“hello”、“start”、“suspend”、“resume”、“abort”或“status”之一。如果字符串无效，则发送“402”回复并停止对消息的处理。如果检测到有效命令，则消息的进一步处理取决于如下所述的命令。
The command specific processing describes several possible syntax errors for which specific reply messages are generated. If the runtime engine detects any syntax error which is not explicitly mentioned or which cannot be identified uniquely, a generic `401' reply is sent indicating that the command cannot be executed.
特定于命令的处理描述了生成特定回复消息的几个可能的语法错误。如果运行时引擎检测到任何未明确提及或无法唯一标识的语法错误，则会发送一个通用的“401”回复，指示无法执行该命令。
When the runtime system receives a `hello' command, it processes it as follows:
当运行时系统收到“hello”命令时，它将按如下方式处理该命令：
1. The runtime system sends a `211' reply. If the runtime system has access to a shared secret, then the reply must contain the optional `Authenticator', which is a function of the shared secret.
1. 运行时系统发送“211”回复。如果运行时系统可以访问共享机密，则回复必须包含可选的“验证器”，这是共享机密的一个函数。
When the runtime system receives a `start' command, it processes it as follows:
当运行时系统收到“启动”命令时，它将按如下方式处理该命令：
1. The syntax of the arguments of the `start' command is checked. The following four checks must be made:
1. 检查“start”命令参数的语法。必须进行以下四项检查：
(a) The syntax of the `RunId' parameter is checked and a `431' reply is sent if any syntax error is detected.
(a) 如果检测到任何语法错误，将检查“RunId”参数的语法并发送“431”回复。
(b) The syntax of the `Script' parameter is checked and a `421' reply is sent if any syntax error is detected.
(b) 如果检测到任何语法错误，将检查'Script'参数的语法并发送'421'回复。
(c) The syntax of the `Profile' parameter is checked and a `432' reply is sent if any syntax error is detected.
(c) 检查'Profile'参数的语法，如果检测到任何语法错误，则发送'432'回复。
(d) If syntax of the `Argument' parameter is checked and a `433' reply is sent if any syntax error is detected.
(d) 如果检查了'Argument'参数的语法，并在检测到任何语法错误时发送'433'回复。
2. The runtime system checks whether the new `RunId' is already in use. If yes, a `431' reply is sent and processing stops.
2. 运行时系统检查新的“RunId”是否已在使用中。如果是，则发送“431”答复并停止处理。
3. The runtime system checks whether the `Script' parameter is the name of a file on the local storage device, that can be read. A `421' reply is sent and processing stops if the file does not exist or is not readable.
3. 运行时系统检查“Script”参数是否是本地存储设备上可读取的文件名。如果文件不存在或不可读，则发送“421”回复并停止处理。
4. The runtime system checks whether the security profile is known and sends a `432' reply and stops processing if not.
4. 运行时系统检查安全配置文件是否已知，并发送“432”回复，如果不知道，则停止处理。
5. The runtime engine starts the script given by the script name.
5. 运行时引擎启动由脚本名称给定的脚本。
When the script has been started, a `231' reply is sent including the current run state.
脚本启动后，将发送一个包含当前运行状态的“231”回复。
Processing of the `start' command stops, when the script reaches the state `running'. For each asynchronous state change of the running script, a `531' reply is sent. Processing of the `start' command is also stopped if an error occurs before the state `running' is reached. In this case, the run is aborted and a `538' reply is generated. An optional `536' reply can be send before the `538' reply to report an error message.
当脚本达到“正在运行”状态时，“start”命令的处理停止。对于正在运行的脚本的每个异步状态更改，都会发送“531”回复。如果在达到“running”状态之前发生错误，“start”命令的处理也将停止。在这种情况下，将中止运行并生成“538”回复。可以在“538”回复之前发送可选的“536”回复，以报告错误消息。
If an `abort' command or a `suspend' command for the running script is received before processing of the `start' command is complete, then the processing of the `start' command may be stopped before the state `running' is reached. In this case, the resulting status of the running script is given by the respective reply to the `abort' or `suspend' command, and no reply with the transaction identifier of the `start' command is generated.
如果在“开始”命令的处理完成之前收到运行脚本的“中止”命令或“暂停”命令，则“开始”命令的处理可能在达到“运行”状态之前停止。在这种情况下，运行脚本的结果状态由对“abort”或“suspend”命令的相应回复给出，并且不会生成带有“start”命令事务标识符的回复。
When the runtime system receives a `suspend' command, it processes it as follows:
当运行时系统收到“suspend”命令时，它将按如下方式处理该命令：
1. If there is a syntax error in the running script identifier or if there is no running script matching the identifier, a `431' reply is sent and processing of the command is stopped.
1. 如果正在运行的脚本标识符中存在语法错误，或者如果没有与该标识符匹配的正在运行的脚本，则会发送“431”回复并停止对该命令的处理。
2. If the running script is already in the state `suspended', a `231' reply is sent and processing of the command is stopped.
2. 如果正在运行的脚本已处于“挂起”状态，则发送“231”回复并停止对命令的处理。
3. If the running script is in the state `running', it is suspended and a `231' reply is sent after suspending. If suspending fails, a `434' reply is sent and processing of the command is stopped.
3. 如果正在运行的脚本处于“running”状态，它将被挂起，挂起后将发送“231”回复。如果挂起失败，将发送“434”回复并停止对命令的处理。
4. If the running script has not yet reached the state `running' (the `start' command still being processed), it may reach the state `suspended' without having been in the state `running'. After reaching the state `suspended', a `231' reply is sent.
4. 如果正在运行的脚本尚未达到“running”状态（“start”命令仍在处理中），则它可能会在未处于“running”状态的情况下达到“suspended”状态。到达“暂停”状态后，将发送“231”回复。
5. If the running script is in any other state, a `434' reply is sent.
5. 如果正在运行的脚本处于任何其他状态，则会发送“434”回复。
When the runtime system receives a `resume' command, it processes it as follows:
当运行时系统收到“恢复”命令时，它将按如下方式处理该命令：
1. If there is a syntax error in the running script identifier or if there is no running script matching the identifier, a `431' reply is sent and processing of the command is stopped.
1. 如果正在运行的脚本标识符中存在语法错误，或者如果没有与该标识符匹配的正在运行的脚本，则会发送“431”回复并停止对该命令的处理。
2. If the running script is already in the state `running', a `231' reply is sent and processing of the command is stopped.
2. 如果正在运行的脚本已处于“正在运行”状态，则发送“231”回复并停止对命令的处理。
3. If the running script is in the state `suspended', it is resumed and a `231' reply is sent after resuming. If resuming fails, a `434' reply is sent and processing of the command is stopped.
3. 如果正在运行的脚本处于“暂停”状态，则会继续运行，并在恢复后发送“231”回复。如果恢复失败，将发送“434”回复并停止对命令的处理。
4. If the `start' command is still being processed for the script, a `231' reply is sent when the state `running' has been reached.
4. 如果仍在为脚本处理“start”命令，则在达到“running”状态时将发送“231”回复。
5. If the running script is in any other state, a `434' reply is sent.
5. 如果正在运行的脚本处于任何其他状态，则会发送“434”回复。
When the runtime system receives an `abort' command, it processes it as follows:
当运行时系统收到“中止”命令时，它将按如下方式处理该命令：
1. If there is a syntax error in the running script identifier or if there is no running script matching the identifier, a `431' reply is sent and processing of the command is stopped.
1. 如果正在运行的脚本标识符中存在语法错误，或者如果没有与该标识符匹配的正在运行的脚本，则会发送“431”回复并停止对该命令的处理。
2. If the running script is already aborted, a `232' reply is sent and processing of the command is stopped.
2. 如果正在运行的脚本已中止，则会发送“232”回复并停止对命令的处理。
3. The running script is aborted and a `232' reply is sent after aborting. If aborting fails, a `434' reply is sent and processing is stopped.
3. 正在运行的脚本被中止，中止后将发送“232”回复。如果中止失败，将发送“434”答复并停止处理。
When the runtime system receives a `status' command, it processes it as follows:
当运行时系统收到“status”命令时，它将按如下方式处理该命令：
1. If there is a syntax error in the running script identifier or if there is no running script matching the identifier, a `431' reply is sent and processing of the command is stopped.
1. 如果正在运行的脚本标识符中存在语法错误，或者如果没有与该标识符匹配的正在运行的脚本，则会发送“431”回复并停止对该命令的处理。
2. The status of the script is obtained and a `231' reply is sent.
2. 获取脚本的状态并发送“231”回复。
The runtime system generates or may generate the following notifications:
运行时系统生成或可能生成以下通知：
1. If a change of the status of a running script is observed by the runtime system, a `531' reply is sent.
1. 如果运行时系统观察到正在运行的脚本的状态发生变化，则会发送“531”回复。
2. A `534' reply is sent if a running script terminates normally. This reply is deprecated. You can emulate this reply with a combination of a `532' reply and a `538' reply.
2. 如果正在运行的脚本正常终止，则会发送“534”回复。此答复不受欢迎。您可以使用“532”回复和“538”回复的组合来模拟此回复。
3. A `535' reply is sent if a running script terminates abnormally. This reply is deprecated. You can emulate this reply with a combination of a `536' reply and a `538' reply.
3. 如果正在运行的脚本异常终止，将发送“535”回复。此答复不受欢迎。您可以使用“536”回复和“538”回复的组合来模拟此回复。
4. A `532' reply is sent if a script generates an intermediate result.
4. 如果脚本生成中间结果，则发送“532”回复。
5. A `533' reply is sent if a script generates an intermediate result which causes the generation of a `smScriptResult' notification.
5. 如果脚本生成导致生成“smScriptResult”通知的中间结果，则会发送“533”回复。
6. A `536' reply is sent if a running script produces an error. If the error is fatal, the script execution will be terminated and a 538 reply will follow. Otherwise, if the error is non-fatal, the script continues execution.
6. 如果正在运行的脚本产生错误，将发送“536”回复。如果错误是致命的，则脚本执行将终止，随后将出现538回复。否则，如果错误不是致命的，脚本将继续执行。
7. A `537' reply is sent if a running script produces an error which should cause the generation of a `smScriptException' notification. If the error is fatal, the script execution will be terminated and a 538 reply will follow. Otherwise, if the error is non-fatal, the script continues execution.
7. 如果正在运行的脚本产生错误，导致生成“smScriptException”通知，则会发送“537”回复。如果错误是致命的，则脚本执行将终止，随后将出现538回复。否则，如果错误不是致命的，脚本将继续执行。
8. A `538' reply is sent if a running script terminates. The ExitCode is used to distinguish between normal termination (`noError') or abnormal termination.
8. 如果正在运行的脚本终止，将发送“538”回复。ExitCode用于区分正常终止（`noError'）或异常终止。
9. Besides the notifications mentioned above, the runtime system may generate arbitrary `511' replies, which are logged or displayed by the SNMP agent.
9. 除了上述通知外，运行时系统还可以生成任意“511”回复，这些回复由SNMP代理记录或显示。
This section describes the conditions under which an SNMP agent implementing the Script MIB generates SMX commands. It also describes how the SNMP agent processes replies to SMX commands.
本节描述实现脚本MIB的SNMP代理生成SMX命令的条件。它还描述了SNMP代理如何处理对SMX命令的响应。
New runtime systems are started by the SNMP agent while processing set requests for a `smLaunchStart' variable. The SNMP agent first searches for an already running runtime systems which matches the security profiles associated with the `smLaunchStart' variable. If no suitable runtime system is available, a new runtime system is started by either
新的运行时系统由SNMP代理在处理“smLaunchStart”变量的set请求时启动。SNMP代理首先搜索已运行的运行时系统，该系统与与“smLaunchStart”变量关联的安全配置文件相匹配。如果没有合适的运行时系统可用，则由以下任一方启动新的运行时系统：
(a) starting the executable for the runtime system in a new process which conforms to the operating system security profile, and establishing a bi-directional pipe to the runtime systems standard input/output streams to be used for SMX transport, or
(a) 在符合操作系统安全配置文件的新进程中启动运行时系统的可执行文件，并建立指向运行时系统标准输入/输出流的双向管道，以用于SMX传输，或
(b) preparing the environment for the new runtime system and starting the executable for the runtime system in a new process which conforms to the operating system security profile. The SNMP agent prepares to accept a connection from the new runtime system.
(b) 准备新运行时系统的环境，并在符合操作系统安全配置文件的新进程中启动运行时系统的可执行文件。SNMP代理准备接受来自新运行时系统的连接。
The `smRunState' of all scripts that should be executed in the new runtime system is set to `initializing'.
应在新运行时系统中执行的所有脚本的“smRunState”设置为“initialization”。
The `hello' command is generated once an SMX connection is established. The SNMP agent sends the `hello' command as defined in section 5.2. The SNMP agent then expects a reply from the runtime system within a reasonable timeout interval.
一旦建立SMX连接，就会生成“hello”命令。SNMP代理发送第5.2节中定义的“hello”命令。然后，SNMP代理期望运行时系统在合理的超时时间间隔内作出响应。
1. If the timeout expires before the SNMP agent received a reply, then the connection is closed and all data associated with it is deleted. Any scripts that should be running in this runtime system are aborted, the `smRunExitCode' is set to `genericError' and `smRunError' is modified to describe the error situation.
1. 如果在SNMP代理收到回复之前超时过期，则连接将关闭，并删除与之相关的所有数据。应在此运行时系统中运行的任何脚本都将被中止，`smRunExitCode'设置为`genericError'，`smRunError'将被修改以描述错误情况。
2. If the received message can not be analyzed because it does not have the required format, then the connection is closed and all data associated with it is deleted. Any scripts that should be running in this runtime system are aborted, the `smRunExitCode' is set to `genericError' and `smRunError' is modified to describe the error situation.
2. 如果由于接收到的消息没有所需的格式而无法对其进行分析，则会关闭连接并删除与之相关的所有数据。应在此运行时系统中运行的任何脚本都将被中止，`smRunExitCode'设置为`genericError'，`smRunError'将被修改以描述错误情况。
3. If the received message is a `211' reply, then the `Id' is checked whether it matches the `Id' used in the `hello' command. If the `Id' matches, then the `Version' is checked. If the `Version' matches a supported SMX protocol version, then, if present, the `Authenticator' is checked. If any of the tests fails or if the
3. 如果收到的消息是“211”回复，则会检查“Id”是否与“hello”命令中使用的“Id”匹配。如果'Id'匹配，则检查'Version'。如果“版本”与支持的SMX协议版本相匹配，则检查“身份验证器”（如果存在）。如果任何测试失败，或者
SNMP agent requires an authenticator and it did not receive a matching `Authenticator' with the `211' reply, then the connection is closed and all data associated with this runtime system is deleted. Any scripts that should be running in this runtime system are aborted, the `smRunExitCode' is set to `genericError' and `smRunError' is modified to describe the error situation.
SNMP代理需要身份验证器，但它没有收到与“211”回复匹配的“身份验证器”，然后关闭连接并删除与此运行时系统关联的所有数据。应在此运行时系统中运行的任何脚本都将被中止，`smRunExitCode'设置为`genericError'，`smRunError'将被修改以描述错误情况。
4. Received messages are discarded if none of the previous rules applies.
4. 如果前面的任何规则都不适用，则会丢弃接收到的消息。
The `start' command is generated while processing set-requests for a `smLaunchStart' variable. The `start' command assumes that the SNMP agent already determined a runtime system suitable to execute the script associated with the `smLaunchStart' variable. The SNMP agent sends the `start' command as defined in section 5.2 to the selected runtime system. The SNMP agent then expects a reply from the runtime system within a reasonable timeout interval.
“start”命令是在处理“smLaunchStart”变量的set请求时生成的。“start”命令假定SNMP代理已确定适合执行与“smLaunchStart”变量关联的脚本的运行时系统。SNMP代理将第5.2节中定义的“启动”命令发送到选定的运行时系统。然后，SNMP代理期望运行时系统在合理的超时时间间隔内作出响应。
1. If the timeout expires before the SNMP agent received a reply, then the SNMP agent sends an `abort' command to abort the running script and sets the `RunState' of the running script to `terminated', the `smRunExitCode' to `genericError' and `smRunError' is modified to describe the timeout situation.
1. 如果在SNMP代理收到回复之前超时过期，则SNMP代理将发送“abort”命令中止运行脚本，并将运行脚本的“RunState”设置为“terminated”，将“smRunExitCode”设置为“genericError”，并修改“smRunError”以描述超时情况。
2. If the received message can not be analyzed because it does not have the required format, then the message is ignored. The SNMP agent continues to wait for a valid reply message until the timeout expires.
2. 如果由于接收到的消息没有所需的格式而无法对其进行分析，则忽略该消息。SNMP代理将继续等待有效的回复消息，直到超时过期。
3. If the received message is a `4yz' reply and the `Id' matches the `Id' of the `start' command, then the SNMP agent assumes that the script can not be started. The `smRunState' of the running script is set to `terminated', the `smRunExitCode' to `genericError' and the `smRunError' is modified to contain a message describing the error situation.
3. 如果收到的消息是“4yz”回复，且“Id”与“start”命令的“Id”匹配，则SNMP代理假定脚本无法启动。正在运行的脚本的“smRunState”设置为“terminated”，“smRunExitCode”设置为“genericError”，“smRunError”被修改为包含描述错误情况的消息。
4. If the received message is a `231' reply and the `Id' matches the `Id' of the `start' command, then the `smRunState' variable of the running script is updated.
4. 如果收到的消息是'231'回复，且'Id'与'start'命令的'Id'匹配，则运行脚本的'smRunState'变量将被更新。
5. Received messages are discarded if none of the previous rules applies.
5. 如果前面的任何规则都不适用，则会丢弃接收到的消息。
The `suspend' command is generated while processing set-requests for the `smLaunchControl' and `smRunControl' variables which change the value to `suspend'. The SNMP agent sets the `smRunState' variable to `suspending' and sends the `suspend' command as defined in section 5.2. The SNMP agent then expects a reply from the runtime system within a reasonable timeout interval.
“suspend”命令是在处理将值更改为“suspend”的“smLaunchControl”和“smRunControl”变量的set请求时生成的。SNMP代理将'smRunState'变量设置为'suspending'，并发送第5.2节中定义的'suspend'命令。然后，SNMP代理期望运行时系统在合理的超时时间间隔内作出响应。
1. If the timeout expires before the SNMP agent received a reply, then the SNMP agent sends an `abort' command to abort the running script and sets the `smRunState' of the running script to `terminated', the `smRunExitCode' to `genericError' and `smRunError' is modified to describe the timeout situation.
1. 如果在SNMP代理收到回复之前超时过期，则SNMP代理将发送“abort”命令中止运行脚本，并将运行脚本的“smRunState”设置为“terminated”，将“smRunExitCode”设置为“genericError”，并修改“smRunError”以描述超时情况。
2. If the received message can not be analyzed because it does not have the required format, then the message is ignored. The SNMP agent continues to wait for a valid reply message until the timeout expires.
2. 如果由于接收到的消息没有所需的格式而无法对其进行分析，则忽略该消息。SNMP代理将继续等待有效的回复消息，直到超时过期。
3. If the received message is a `401', `402' or a `431' reply and the `Id' matches the `Id' of the `suspend' command, then the runtime systems is assumed to not provide the suspend/resume capability and processing of the `suspend' command stops.
3. 如果收到的消息是'401'、'402'或'431'回复，并且'Id'与'suspend'命令的'Id'匹配，则假定运行时系统不提供挂起/恢复功能，并且'suspend'命令的处理停止。
4. If the received message is a `231' reply and the `Id' matches the `Id' of the `suspend' command, then the `smRunState' variable of the running script is updated.
4. 如果收到的消息是'231'回复，且'Id'与'suspend'命令的'Id'匹配，则运行脚本的'smRunState'变量将被更新。
5. Received messages are discarded if none of the previous rules applies.
5. 如果前面的任何规则都不适用，则会丢弃接收到的消息。
The `resume' command is generated while processing set-requests for the `smLaunchControl' and `smRunControl' variables which change the value to `resume'. The SNMP agent sets the `smRunState' variable to `resuming' and sends the `resume' command as defined in section 5.2. The SNMP agent then expects a reply from the runtime system within a reasonable timeout interval.
“resume”命令是在处理将值更改为“resume”的“smLaunchControl”和“smRunControl”变量的set请求时生成的。SNMP代理将“smRunState”变量设置为“resuming”，并发送第5.2节中定义的“resume”命令。然后，SNMP代理期望运行时系统在合理的超时时间间隔内作出响应。
1. If the timeout expires before the SNMP agent received a reply, then the SNMP agent sends an `abort' command to abort the running script and sets the `smRunState' of the running script to `terminated', the `smRunExitCode' to `genericError' and `smRunError' is modified to describe the timeout situation.
1. 如果在SNMP代理收到回复之前超时过期，则SNMP代理将发送“abort”命令中止运行脚本，并将运行脚本的“smRunState”设置为“terminated”，将“smRunExitCode”设置为“genericError”，并修改“smRunError”以描述超时情况。
2. If the received message can not be analyzed because it does not have the required format, then the message is ignored. The SNMP agent continues to wait for a valid reply message until the timeout expires.
2. 如果由于接收到的消息没有所需的格式而无法对其进行分析，则忽略该消息。SNMP代理将继续等待有效的回复消息，直到超时过期。
3. If the received message is a `401', `402' or a `431' reply and the `Id' matches the `Id' of the `resume' command, then the runtime systems is assumed to not provide the suspend/resume capability and processing of the `resume' command stops.
3. 如果收到的消息是“401”、“402”或“431”回复，且“Id”与“resume”命令的“Id”匹配，则假定运行时系统不提供挂起/恢复功能，并且“resume”命令的处理停止。
4. If the received message is a `231' reply and the `Id' matches the `Id' of the `resume' command, then the `smRunState' variable of the running script is updated.
4. 如果收到的消息是'231'回复，且'Id'与'resume'命令的'Id'匹配，则运行脚本的'smRunState'变量将被更新。
5. Received messages are discarded if none of the previous rules applies.
5. 如果前面的任何规则都不适用，则会丢弃接收到的消息。
The `abort' command is generated while processing set-requests for the `smLaunchControl' and `smRunControl' variables which change the value to `abort'. In addition, the `abort' command is also generated if the `smRunLifeTime' variable reaches the value 0. The SNMP agent sends the `abort' command as defined in section 5.2. The SNMP agent then expects a reply from the runtime system within a reasonable timeout interval.
“abort”命令是在处理将值更改为“abort”的“smLaunchControl”和“smRunControl”变量的set请求时生成的。此外，如果'smrunlife'变量达到值0，也会生成'abort'命令。SNMP代理发送第5.2节中定义的“中止”命令。然后，SNMP代理期望运行时系统在合理的超时时间间隔内作出响应。
1. If the timeout expires before the SNMP agent received a reply, then the SNMP agent sets the `smRunState' of the running script to `terminated', the `smRunExitCode' to `genericError' and `smRunError' is modified to describe the timeout situation.
1. 如果在SNMP代理收到答复之前超时过期，则SNMP代理会将正在运行的脚本的“smRunState”设置为“terminated”，将“smRunExitCode”设置为“genericError”，并修改“smRunError”以描述超时情况。
2. If the received message can not be analyzed because it does not have the required format, then the message is ignored. The SNMP agent continues to wait for a valid reply message until the timeout expires.
2. 如果由于接收到的消息没有所需的格式而无法对其进行分析，则忽略该消息。SNMP代理将继续等待有效的回复消息，直到超时过期。
3. If the received message is a `4yz' reply and the `Id' matches the `Id' of the `abort' command, then the SNMP agent assumes that the script can not be aborted. The `smRunState' of the running script is set to `terminated', the `smRunExitCode' to `genericError' and the `smRunResult' is modified to describe the error situation.
3. 如果收到的消息是'4yz'回复，且'Id'与'abort'命令的'Id'匹配，则SNMP代理假定无法中止脚本。正在运行的脚本的“smRunState”设置为“terminated”，将“smRunExitCode”设置为“genericError”，并修改“smRunResult”以描述错误情况。
4. If the received message is a `232' reply and the `Id' matches the `Id' of the `abort' command, then the `smRunExitCode' variable of the terminated script is changed to either `halted' (when processing a set-request for the `smLaunchControl' and `smRunControl' variables) or `lifeTimeExceeded' (if the `abort'
4. 如果收到的消息是'232'回复，且'Id'与'abort'命令的'Id'匹配，则终止脚本的'smRunExitCode'变量将更改为'stopped'（在处理'smLaunchControl'和'smRunControl'变量的设置请求时）或'lifetimeomexted'（如果'abort'
command was generated because the `smRunLifeTime' variable reached the value 0). The `smRunState' variable is changed to the value `terminated'.
由于'SMRUNLIFITE'变量达到值0），因此生成了命令。“smRunState”变量更改为值“terminated”。
5. Received messages are discarded if none of the previous rules applies.
5. 如果前面的任何规则都不适用，则会丢弃接收到的消息。
The `status' command is generated either periodically or on demand by the SNMP agent in order to retrieve status information from running scripts. The SNMP agent sends the `status' command as defined in 5.2. The SNMP agent then expects a reply from the runtime system within a reasonable timeout interval.
SNMP代理定期或按需生成“status”命令，以便从正在运行的脚本中检索状态信息。SNMP代理发送5.2中定义的“status”命令。然后，SNMP代理期望运行时系统在合理的超时时间间隔内作出响应。
1. If the timeout expires before the SNMP agent received a reply, then the SNMP agent sends an `abort' command to abort the running script and sets the `smRunState' of the running script to `terminated', the `smRunExitCode' to `genericError' and `smRunError' is modified to describe the timeout situation.
1. 如果在SNMP代理收到回复之前超时过期，则SNMP代理将发送“abort”命令中止运行脚本，并将运行脚本的“smRunState”设置为“terminated”，将“smRunExitCode”设置为“genericError”，并修改“smRunError”以描述超时情况。
2. If the received message can not be analyzed because it does not have the required format, then the message is ignored. The SNMP agent continues to wait for a valid reply message until the timeout expires.
2. 如果由于接收到的消息没有所需的格式而无法对其进行分析，则忽略该消息。SNMP代理将继续等待有效的回复消息，直到超时过期。
3. If the received message is a `4yz' reply and the `Id' matches the `Id' of the `status' command, then the SNMP agent assumes that the script status can not be read, which is a fatal error condition. The SNMP agent sends an `abort' command to abort the running script. The `smRunState' of the running script is set to `terminated', the `smRunExitCode' to `genericError' and the `smRunError' is modified to describe the error situation.
3. 如果收到的消息是“4yz”回复，且“Id”与“status”命令的“Id”匹配，则SNMP代理假定无法读取脚本状态，这是一种致命错误情况。SNMP代理发送“abort”命令以中止正在运行的脚本。正在运行的脚本的“smRunState”设置为“terminated”，将“smRunExitCode”设置为“genericError”，并修改“smRunError”以描述错误情况。
4. If the received message is a `231' reply and the `Id' matches the `Id' of the `status' command, then the `smRunState' variable of the running script is updated.
4. 如果收到的消息是'231'回复，且'Id'与'status'命令的'Id'匹配，则运行脚本的'smRunState'变量将被更新。
5. Received messages are discarded if none of the previous rules applies.
5. 如果前面的任何规则都不适用，则会丢弃接收到的消息。
The runtime system can send asynchronous status change notifications. These `5yz' replies are processed as described below.
运行时系统可以发送异步状态更改通知。这些“5yz”答复的处理如下所述。
1. If the received message is a `511' reply, then the message is displayed or logged appropriately and processing stops.
1. 如果收到的消息是“511”回复，则会适当显示或记录该消息，并停止处理。
2. If the received message is a `531' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing of the notification stops if there is no running script with the `RunId'. Otherwise, the `smRunState' is updated.
2. 如果收到的消息是“531”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果不存在具有“RunId”的正在运行的脚本，则通知的处理将停止。否则，“smRunState”将被更新。
3. If the received message is a `532' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing of the notification stops if there is no running script with the `RunId'. Otherwise, `smRunState' and `smRunResult' are updated.
3. 如果收到的消息是“532”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果不存在具有“RunId”的正在运行的脚本，则通知的处理将停止。否则，将更新'smRunState'和'smRunResult'。
4. If the received message is a `533' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing of the notification stops if there is no running script with the `RunId'. Otherwise, `smRunState' and `smRunResult' are updated and the `smScriptResult' notification is generated.
4. 如果收到的消息是“533”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果不存在具有“RunId”的正在运行的脚本，则通知的处理将停止。否则，将更新'smRunState'和'smRunResult'，并生成'smScriptResult'通知。
5. If the received message is a `534' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing stops if there is no running script with the `RunId'. Otherwise, `smExitCode' is set to `noError', `smRunState' is set to `terminated' and `smRunResult' is updated.
5. 如果收到的消息是“534”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果没有具有“RunId”的正在运行的脚本，则处理将停止。否则，`smExitCode'设置为`noError'，`smRunState'设置为`terminated'，`smRunResult'更新。
6. If the received message is a `535' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing stops if there is no running script with the `RunId'. Otherwise, `smRunState' is set to `terminated' and `smExitCode' and `smRunError' are updated.
6. 如果收到的消息是“535”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果没有具有“RunId”的正在运行的脚本，则处理将停止。否则，`smRunState'将设置为`terminated'，`smExitCode'和`SMRUNRERROR'将被更新。
7. If the received message is a `536' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing of the notification stops if there is no running script with the `RunId'. Otherwise, `smRunState' and `smRunError' are updated.
7. 如果收到的消息是“536”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果不存在具有“RunId”的正在运行的脚本，则通知的处理将停止。否则，将更新'smRunState'和'smRunError'。
8. If the received message is a `537' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing of the notification stops if there is no running script with the `RunId'. Otherwise, `smRunState' and `smRunError' are updated and the `smScriptException' notification is generated.
8. 如果收到的消息是“537”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果不存在具有“RunId”的正在运行的脚本，则通知的处理将停止。否则，将更新'smRunState'和'smRunError'，并生成'smScriptException'通知。
9. If the received message is a `538' reply, then the SNMP agent checks whether a running script with the given `RunId' exists in the runtime system. Processing of the notification stops if there is no running script with the `RunId'. Otherwise, `smRunState' is set to `terminated' and the `smExitCode' is updated.
9. 如果收到的消息是“538”回复，则SNMP代理将检查运行时系统中是否存在具有给定“RunId”的运行脚本。如果不存在具有“RunId”的正在运行的脚本，则通知的处理将停止。否则，“smRunState”设置为“terminated”，并更新“smExitCode”。
Below is an example SMX message exchange. Messages sent from the SNMP agent are marked with `>' while replies sent from the runtime system are marked with `<'. Line terminators (`CRLF') are not shown in order to make the example more readable.
下面是一个SMX消息交换示例。从SNMP代理发送的消息标记为“>”，而从运行时系统发送的回复标记为“<”。为了使示例更具可读性，未显示行终止符（`CRLF'）。
> hello 1
< 211 1 SMX/1.1 0AF0BAED6F877FBC
> start 2 42 "/var/snmp/scripts/foo.jar" untrusted ""
> start 5 44 "/var/snmp/scripts/bar.jar" trusted "www.ietf.org"
< 231 2 2
> start 12 48 "/var/snmp/scripts/foo.jar" funny ""
< 231 5 2
< 532 0 44 2 "waiting for response"
> status 18 42
> status 19 44
< 432 12
< 231 19 2
< 231 18 2
> hello 578
< 211 578 SMX/1.1 0AF0BAED6F877FBC
> suspend 581 42
< 231 581 4
< 532 0 44 7 "test completed"
< 538 0 44 1
> abort 611 42
< 232 611
> hello 1
< 211 1 SMX/1.1 0AF0BAED6F877FBC
> start 2 42 "/var/snmp/scripts/foo.jar" untrusted ""
> start 5 44 "/var/snmp/scripts/bar.jar" trusted "www.ietf.org"
< 231 2 2
> start 12 48 "/var/snmp/scripts/foo.jar" funny ""
< 231 5 2
< 532 0 44 2 "waiting for response"
> status 18 42
> status 19 44
< 432 12
< 231 19 2
< 231 18 2
> hello 578
< 211 578 SMX/1.1 0AF0BAED6F877FBC
> suspend 581 42
< 231 581 4
< 532 0 44 7 "test completed"
< 538 0 44 1
> abort 611 42
< 232 611
In order to prevent SMX communication from untrusted peers the SNMP agent has to choose a secure SMX transport. This memo defines two transports in Section 8: (a) a bi-directional pipe using standard input/output streams on the runtime engine side, and (b) a TCP
为了防止来自不受信任的对等方的SMX通信，SNMP代理必须选择安全的SMX传输。本备忘录在第8节中定义了两种传输：（a）在运行时引擎端使用标准输入/输出流的双向管道，以及（b）TCP
connection where the SNMP agent acts as a listening server that accepts only connections from local runtime engines that authenticate themselves with a secret shared between the agent and the runtime engine.
SNMP代理充当侦听服务器的连接，该服务器只接受来自本地运行时引擎的连接，这些引擎使用代理和运行时引擎之间共享的机密对自己进行身份验证。
For simplicity and security reasons the transport over bi-directional pipes is the preferred transport.
出于简单和安全原因，首选通过双向管道进行运输。
Further transports (e.g., UNIX domain sockets) are possible but not defined at this point in time. The reason for choosing pipes and TCP connections as the transport for SMX was that these IPC mechanisms are supported by most potential runtime systems, while other transports are not universally available.
进一步的传输（例如UNIX域套接字）是可能的，但目前尚未定义。选择管道和TCP连接作为SMX传输的原因是，大多数潜在的运行时系统都支持这些IPC机制，而其他传输并不普遍可用。
The SNMP agent first creates a bi-directional pipe. Then the agent creates the runtime system process with its standard input and standard output streams connected to the pipe. Further authentication mechanisms are not required.
SNMP代理首先创建一个双向管道。然后，代理使用连接到管道的标准输入和标准输出流创建运行时系统进程。不需要进一步的身份验证机制。
The SNMP agent first creates a listening TCP socket which accepts connections from runtime systems. Then the agent creates the runtime system process. It is then the responsibility of the runtime system to establish a connection to the agent's TCP socket once it has been started. The SNMP agent must ensure that only authorized runtime systems establish a connection to the listening TCP socket. The following rules are used for this purpose:
SNMP代理首先创建一个侦听TCP套接字，该套接字接受来自运行时系统的连接。然后代理创建运行时系统进程。然后，运行时系统负责在代理的TCP套接字启动后建立连接。SNMP代理必须确保只有经过授权的运行时系统才能建立到侦听TCP套接字的连接。以下规则用于此目的：
- The TCP connection must originate from the local host.
- TCP连接必须来自本地主机。
- The SNMP agent must check the `Authenticator' in the `211' reply if authentication is required and it must close the TCP connection if no valid response is received within a given time interval.
- 如果需要身份验证，SNMP代理必须检查“211”回复中的“Authenticator”，如果在给定时间间隔内未收到有效响应，则必须关闭TCP连接。
The SMX protocol as specified in this memo runs over a bi-directional pipe or over a local TCP connection between the agent and the runtime system. Protocol messages never leave the local system. It is therefore not possible to attack the message exchanges if the underlying operating system protects bi-directional pipes and local TCP connections from other users on the same machine.
本备忘录中指定的SMX协议通过双向管道或代理和运行时系统之间的本地TCP连接运行。协议消息永远不会离开本地系统。因此，如果底层操作系统保护来自同一机器上其他用户的双向管道和本地TCP连接，则不可能攻击消息交换。
The transport over a bi-directional pipe specifies that the pipe is created and connected to the standard input/output stream of the runtime engine by the agent before the runtime engine is started. It is therefore not possible that an unauthorized process can exchange SMX messages over the bi-directional pipe.
双向管道上的传输指定在运行时引擎启动之前由代理创建管道并将其连接到运行时引擎的标准输入/输出流。因此，未经授权的进程不可能通过双向管道交换SMX消息。
In case of the TCP transport, the only critical situation is the connection establishment phase. The rules defined in section 8 ensure that only local connections are accepted and that a runtime system has to authenticate itself with an authenticator if the agent requires authentication. It is strongly suggested that agents require authentication, especially on multiuser systems.
在TCP传输的情况下，唯一的关键情况是连接建立阶段。第8节中定义的规则确保只接受本地连接，并且如果代理需要身份验证，则运行时系统必须使用身份验证程序对自身进行身份验证。强烈建议代理需要身份验证，特别是在多用户系统上。
The SMX 1.0 specification in RFC 2593 suggested a scheme where the authenticator was passed to the runtime engines as part of the process environment. This scheme relies on the protection of process environments by the operating system against unauthorized access. Some operating systems allow users to read the process environment of arbitrary processes. Hence the scheme proposed in RFC 2593 is considered unsecure on these operating systems. This memo does not dictate the mechanism by which the runtime obtains the shares secret. It is the responsibility of implementors or administrators to select a mechanism which is secure on the target platforms.
RFC2593中的SMX 1.0规范提出了一种方案，其中身份验证器作为流程环境的一部分传递给运行时引擎。此方案依赖于操作系统对进程环境的保护，以防止未经授权的访问。某些操作系统允许用户读取任意进程的进程环境。因此，RFC2593中提出的方案在这些操作系统上被认为是不安全的。此备忘录不指定运行时获取共享机密的机制。实现者或管理员有责任选择在目标平台上安全的机制。
The SMX protocol assumes a local script storage area which is used to pass script code from the SNMP agent to the runtime systems. The SMX protocol passes file names from the agent to the runtime engines. It is necessary that the script files in the local script storage area are properly protected so that only the SNMP agent has write access. Failure to properly protect write access to the local script storage area can allow attackers to execute arbitrary code in runtime systems that might have special privileges.
SMX协议假定有一个本地脚本存储区域，用于将脚本代码从SNMP代理传递到运行时系统。SMX协议将文件名从代理传递到运行时引擎。必须正确保护本地脚本存储区域中的脚本文件，以便只有SNMP代理具有写访问权限。如果未能正确保护对本地脚本存储区域的写访问，攻击者可能会在运行时系统中执行可能具有特殊权限的任意代码。
The SMX protocol allows to execute script under different operating system and runtime system security profiles. The memo suggests to map the smLaunchOwner value to an operating system and a runtime system security profile. The operating system security profile is enforced by the operating system by setting up a proper process environment. The runtime security profile is enforced by a secure runtime system (e.g., the Java virtual machine or a safe Tcl interpreter) [7].
SMX协议允许在不同的操作系统和运行时系统安全配置文件下执行脚本。备忘录建议将smLaunchOwner值映射到操作系统和运行时系统安全配置文件。操作系统通过设置适当的进程环境来强制执行操作系统安全配置文件。运行时安全配置文件由安全的运行时系统（例如，Java虚拟机或安全的Tcl解释器）强制执行[7]。
The following non-editorial changes have been made:
进行了以下非编辑性更改：
1. Added the `536' and `537' replies which may be generated asynchronously by runtime engines to report error conditions.
1. 添加了“536”和“537”回复，它们可以由运行时引擎异步生成以报告错误情况。
2. Added the `538' reply which can be used to signal the (normal or abnormal) termination of a running script. This new reply replaces the `534' and `535' replies, which are now deprecated.
2. 添加了“538”回复，可用于发出运行脚本（正常或异常）终止的信号。这一新答复取代了“534”和“535”答复，这两个答复现在已被弃用。
3. Relaxed the rules for ProfileChars to also include the characters ':' and '_', which are frequently used in namespaces and identifiers.
3. 放宽了ProfileChars的规则，使其还包括字符“：”和“389;”，这两个字符在名称空间和标识符中经常使用。
4. Changed the SMX protocol version number from 1.0 to 1.1.
4. 将SMX协议版本号从1.0更改为1.1。
5. Added a second (and preferred) transport over a bi-directional pipe due to security risks when a shared secret is passed through an operating system's environment variable.
5. 由于共享机密通过操作系统的环境变量时存在安全风险，因此添加了第二个（也是首选的）双向管道传输。
6. Made the `Authenticator' in the `211' reply optional.
6. 使“211”回复中的“验证器”为可选。
The protocol described in this memo is the result of a joint project between the Technical University of Braunschweig and C&C Research Laboratories of NEC Europe Ltd. in Heidelberg. The authors like to thank Matthias Bolz, Cornelia Kappler, Andreas Kind, Sven Mertens, Jan Nicklisch, and Frank Strauss for their contributions to the design and the implementation of the protocol described in this memo. The authors also like to thank David Wallis for pointing out a security risk in SMX 1.0 with passing a cookie via an operating system environment variable.
本备忘录中描述的协议是Brunswitg技术大学与海德堡NEC欧洲有限公司C＆C研究实验室之间的联合项目的结果。作者感谢Matthias Bolz、Cornelia Kappler、Andreas Kind、Sven Mertens、Jan Nicklisch和Frank Strauss为本备忘录所述协议的设计和实施做出的贡献。作者还想感谢David Wallis指出了SMX 1.0中通过操作系统环境变量传递cookie存在的安全风险。
[1] Levi, D. and J. Schoenwaelder, "Definitions of Managed Objects for the Delegation of Management Scripts", RFC 3165, September 2001.
[1] Levi，D.和J.Schoenwaeld，“管理脚本委托的托管对象定义”，RFC 3165，2001年9月。
[2] Lindholm, T., and F. Yellin, "The Java Virtual Machine Specification", Addison Wesley, 1997.
[2] Lindholm，T.和F.Yellin，“Java虚拟机规范”，Addison-Wesley，1997年。
[3] J.K. Ousterhout, "Tcl and the Tk Toolkit", Addison Wesley, 1994.
[3] J.K.Ousterhout，“Tcl和传统知识工具包”，Addison-Wesley，1994年。
[4] Fritzinger, J.S., and M. Mueller, "Java Security", White Paper, Sun Microsystems, Inc., 1996.
[4] Fritzinger，J.S.和M.Mueller，“Java安全”，白皮书，太阳微系统公司，1996年。
[5] Levy, J.Y., Demailly, L., Ousterhout, J.K., and B. Welch, "The Safe-Tcl Security Model", Proc. USENIX Annual Technical Conference, June 1998.
[5] Levy，J.Y.，Demaily，L.，Ousterhout，J.K.，和B.Welch，“安全Tcl安全模型”，Proc。USENIX年度技术会议，1998年6月。
[6] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 2234, November 1997.
[6] Crocker，D.和P.Overell，“语法规范的扩充BNF:ABNF”，RFC 2234，1997年11月。
[7] Schoenwaelder, J., and J. Quittek, "Secure Internet Management by Delegation", Computer Networks 35(1), January 2001.
[7] Schoenwaeld，J.和J.Quitek，“通过授权进行安全互联网管理”，计算机网络35（1），2001年1月。
Juergen Schoenwaelder TU Braunschweig Bueltenweg 74/75 38106 Braunschweig Germany
德国布埃尔滕韦格布伦瑞克大学74/75 38106
Phone: +49 531 391-3283
EMail: schoenw@ibr.cs.tu-bs.de
Phone: +49 531 391-3283
EMail: schoenw@ibr.cs.tu-bs.de
Juergen Quittek NEC Europe Ltd. C&C Research Laboratories Adenauerplatz 6 69115 Heidelberg Germany
Juergen Quittek NEC欧洲有限公司C&C研究实验室Adenauerplatz 6 69115德国海德堡
Phone: +49 6221 90511-15
EMail: quittek@ccrle.nec.de
Phone: +49 6221 90511-15
EMail: quittek@ccrle.nec.de
Copyright (C) The Internet Society (2001). All Rights Reserved.
版权所有（C）互联网协会（2001年）。版权所有。
This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations, except as needed for the purpose of developing Internet standards in which case the procedures for copyrights defined in the Internet Standards process must be followed, or as required to translate it into languages other than English.
本文件及其译本可复制并提供给他人，对其进行评论或解释或协助其实施的衍生作品可全部或部分编制、复制、出版和分发，不受任何限制，前提是上述版权声明和本段包含在所有此类副本和衍生作品中。但是，不得以任何方式修改本文件本身，例如删除版权通知或对互联网协会或其他互联网组织的引用，除非出于制定互联网标准的需要，在这种情况下，必须遵循互联网标准过程中定义的版权程序，或根据需要将其翻译成英语以外的其他语言。
The limited permissions granted above are perpetual and will not be revoked by the Internet Society or its successors or assigns.
上述授予的有限许可是永久性的，互联网协会或其继承人或受让人不会撤销。
This document and the information contained herein is provided on an "AS IS" basis and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件和其中包含的信息是按“原样”提供的，互联网协会和互联网工程任务组否认所有明示或暗示的保证，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。