Re: net-snmp-5.4.1 tcp wrappers

Dave Shield <[email protected]>:
> On 21/11/2007, Brian Kroth <[email protected]> wrote:
> > I'm running into a problem with the upgrade of net-snmp from 5.4 to 5.4.1-r1
> > and my hosts.allow, hosts.deny files.
> 
> Were these two versions built using exactly the configuration,
> and on the same systems?

Yes.  I have the same problem on ~30 other hosts.  Exact same configs and
builds.

> 
> The hosts.allow/deny processing is basically handled by the "hosts_ctl"
> call within the "netsnmp_agent_check_packet()" routine (in snmp_agent.c).
> 
> I've compared the 5.4 and 5.4.1 code, and the only different between the
> two is the plugging of a memory leak - see
> http://net-snmp.svn.sourceforge.net/viewvc/net-snmp/branches/V5-4-patches/net-snmp/agent/snmp_agent.c?r1=15632&r2=15931&sortby=date
> 
> I don't see how this could possibly be causing the behaviour you are seeing.
> 
> 
> It feels much more likely that something has changed in the O/S environment
> of the systems that you are running these two agents on.
> 
I'm unfamiliar with the coding details of how to use tcpd wrappers, but I
would assume that it basically provides you with a function to ask, can this
host/user access me (the service), and you call it.  So while I would agree, I
can't find what that would be.  If I roll back to 5.4 it works just as before.
Other tcpd services are not affected.  The only thing I can think is that
since adding the localhost's public IP allows the traffic, there might be
some sort of loopback traffic in snmpd, or perhaps they way it specified it's
outgoing interface has changed?  While that is an easy workaround, it's not
very scalable when you have lots of hosts to manage.  The only other thing I
can think is that I've over looked something in my hosts.* configuration, but
I can't see where that would be either.
> 
> 
> If you compile the 5.4. and 5.4.1 tarballs on the same box (with the same
> configure directives), and compare the two agents - do you still see the
> same problem?
> 
> Dave

Thanks.  I'll try this out and have a look at the code a little more either
later tonight or tomorrow.

Happy Thanksgiving :)

Brian

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Net-snmp-users mailing list
[email protected]
Please see the following page to unsubscribe or change other options:
https://lists.sourceforge.net/lists/listinfo/net-snmp-users