pvxput denied via EPICS_PVA_NAME_SERVERS but works via EPICS_PVA_ADDR_LIST --- (pvxs 1.5.1 / p4p 4.1.7)

["Williams Jr., Ernest L. via Tech-talk" <tech-talk at aps.anl.gov>]

Hi ,

I am doing some testing with a PVA gateway and ran into a behavior difference that I wanted to ask about.

My goal is to move some of our client configurations to use TCP name-server mode via the EPICS_PVA_NAME_SERVERS environment variable instead of the traditional UDP search mechanism.

This is particularly useful for Kubernetes-based deployments where UDP broadcast discovery is undesirable. In this case, I am pointing the environment variable at our PVA gateway.

However, I am seeing a difference in behavior between the two discovery methods.

Client Environment

Client tool: pvxs 1.5.1
Gateway implementation: p4p 4.1.7

Test PV

SIOC:SYS0:ML06:AO007  or Fred

---

Test 1 — Directed UDP search

Environment:

EPICS_PVA_ADDR_LIST=<pva-gateway-ip>:5167
EPICS_PVA_AUTO_ADDR_LIST=NO

Results:

• pvxget works
• pvxput works

Endpoint reported by pvxinfo:

SIOC:SYS0:ML06:AO007 from <pva-gateway-ip>:32925

---

Test 2 — TCP name-server mode

Environment:

EPICS_PVA_NAME_SERVERS=<pva-gateway-ip>:5169
EPICS_PVA_AUTO_ADDR_LIST=NO
EPICS_PVA_ADDR_LIST=

Results:

• pvxget works
• pvxput fails with:

ERROR RemoteError: Put permission denied by gateway

Endpoint reported by pvxinfo:

SIOC:SYS0:ML06:AO007 from <pva-gateway-ip>:5169

---

Observation

The PV resolves to different TCP endpoints depending on the discovery mechanism:

Mode	Resolved Endpoint
UDP search (EPICS_PVA_ADDR_LIST)	<pva-gateway-ip>:32925
TCP name-server (EPICS_PVA_NAME_SERVERS)	<pva-gateway-ip>:5169

Reads succeed in both cases, but writes only succeed when the connection goes through the dynamically advertised endpoint.

---

Question

Is it expected that the p4p gateway behaves differently for put authorization depending on whether the PV was resolved through:

• UDP search (EPICS_PVA_ADDR_LIST)
• TCP name-server mode (EPICS_PVA_NAME_SERVERS) ?

In particular, should both mechanisms ultimately route the client through the same gateway path and authorization logic, or is there a known difference in how these endpoints are handled?

Our longer-term goal is to standardize on EPICS_PVA_NAME_SERVERS, since it works much better for containerized environments and controlled network paths. Before moving forward with that approach, I wanted to confirm whether the behavior I am seeing is expected or if I might be missing something in the gateway configuration.

If helpful, I can also provide packet traces or additional logs from the gateway side.

Thanks very much for any guidance.

Cheers,

Ernest Williams
Dept. Head, Controls Software Engineering
Instrumentation Division, Technology Innovation Directorate
SLAC National Laboratory, Stanford University