wireguard: T3763: Added check for listening port availability

Each wireguard interface requires a unique port for in and out
connections. This commit adds the new `vyos.util` function -
`check_port_availability`, and uses it to be sure that a port
that is planned to be used for wireguard interface is truly
available and not used by any other services (not only other
wireguard interfaces).

1 files changed, 5 insertions, 0 deletions

diff --git a/src/conf_mode/interfaces-wireguard.py b/src/conf_mode/interfaces-wireguard.py
index 4c566a5ad..ad3ddcba2 100755
--- a/src/conf_mode/interfaces-wireguard.py
+++ b/src/conf_mode/interfaces-wireguard.py
@@ -30,6 +30,7 @@ from vyos.configverify import verify_bridge_delete
 from vyos.configverify import verify_mtu_ipv6
 from vyos.ifconfig import WireGuardIf
 from vyos.util import check_kmod
+from vyos.util import check_port_availability
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
@@ -73,6 +74,10 @@ def verify(wireguard):
     if 'peer' not in wireguard:
         raise ConfigError('At least one Wireguard peer is required!')
 
+    if 'port' in wireguard and check_port_availability(
+            '0.0.0.0', int(wireguard['port']), 'udp') is not True:
+        raise ConfigError('The port cannot be used for the interface')
+
     # run checks on individual configured WireGuard peer
     for tmp in wireguard['peer']:
         peer = wireguard['peer'][tmp]