Merge pull request #5631 from c-po/T9559

https: T9559: fix bogus port conflict with "vrf default"

3 files changed, 30 insertions, 10 deletions

diff --git a/python/vyos/utils/network.py b/python/vyos/utils/network.py
index 4a4414f56..c7304d15b 100644
--- a/python/vyos/utils/network.py
+++ b/python/vyos/utils/network.py
@@ -417,19 +417,23 @@ def check_port_availability(address: str = None, port: int = 0,
         print(f'Invalid address: {address}')
         return False
 
+    # the default VRF has no master device - an unbound socket already uses it
+    if vrf == 'default':
+        vrf = None
+
     for family, socktype, proto, canonname, sockaddr in addr_info:
-        try:
-            with socket.socket(family, socktype, proto) as s:
-                s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
-                # When a VRF is specified, bind the socket to the VRF master
-                # device so the address is resolved in that VRF's L3 domain.
-                if vrf:
-                    s.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
-                                 (vrf + '\0').encode())
+        with socket.socket(family, socktype, proto) as s:
+            s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            # When a VRF is specified, bind the socket to the VRF master
+            # device so the address is resolved in that VRF's L3 domain.
+            if vrf:
+                s.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE,
+                             (vrf + '\0').encode())
+            try:
                 s.bind(sockaddr)
                 return True # port is free to use
-        except OSError:
-            return False # port is already in use
+            except OSError:
+                return False # port is already in use
 
     # if we reach this point, no socket was tested and we assume the port is
     # already in use - better safe then sorry
diff --git a/smoketest/scripts/cli/test_service_https.py b/smoketest/scripts/cli/test_service_https.py
index f432b4d57..f4176107a 100755
--- a/smoketest/scripts/cli/test_service_https.py
+++ b/smoketest/scripts/cli/test_service_https.py
@@ -252,6 +252,20 @@ class TestHTTPSService(VyOSUnitTestSHIM.TestCase):
         self.cli_delete(['interfaces', 'dummy', interface])
         self.cli_delete(['vrf', 'name', vrf])
 
+    def test_vrf_default(self):
+        # "vrf default" has no VRF master device and must behave like no VRF
+        # at all - the port check used to report a bogus port conflict
+        self.cli_set(
+            base_path + ['api', 'keys', 'id', 'key-01', 'key', 'MySuperSecretVyOS']
+        )
+        self.cli_set(base_path + ['vrf', 'default'])
+        self.cli_commit()
+
+        self.assertTrue(process_named_running(PROCESS_NAME))
+        ports = {c.laddr.port for c in psutil.net_connections(kind='tcp')
+                 if c.status == psutil.CONN_LISTEN}
+        self.assertIn(443, ports)
+
     def test_certificate(self):
         cert_name = 'test_https'
         dh_name = 'dh-test'
diff --git a/src/tests/test_utils_network.py b/src/tests/test_utils_network.py
index 708b6e064..83cf57ffc 100644
--- a/src/tests/test_utils_network.py
+++ b/src/tests/test_utils_network.py
@@ -61,6 +61,8 @@ class TestVyOSUtilsNetwork(TestCase):
         self.assertFalse(vyos.utils.network.check_port_availability('192.0.2.1', 443))
         # We do not have 2001:db8::1 configured on this system
         self.assertFalse(vyos.utils.network.check_port_availability('2001:db8::1', 80, protocol='udp'))
+        # the default VRF is not a device and must behave like no VRF at all
+        self.assertTrue(vyos.utils.network.check_port_availability('127.0.0.1', 8080, vrf='default'))
 
     def test_normalize_prefix(self):
         normalize_prefix = vyos.utils.network.normalize_prefix