Merge pull request #4769 from c-po/pki-acme-listen-address

pki: T7885: check_port_availability() can't be used during system boot

1 files changed, 14 insertions, 2 deletions

diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index fa6958130..98e5840a9 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -185,7 +185,7 @@ def get_config(config=None):
             pki.update({'changed':{}})
         pki['changed'].update({key.replace('-', '_') : tmp})
 
-    # We only merge on the defaults of there is a configuration at all
+    # We only merge on the defaults if there is a configuration at all
     if conf.exists(base):
         # We have gathered the dict representation of the CLI, but there are default
         # options which we need to update into the dictionary retrived.
@@ -265,11 +265,18 @@ def get_config(config=None):
                 continue
             if not dict_search('system.load_balancing.haproxy', pki):
                 continue
+            # Determine which service depends on ACME issued certificates
             used_by = []
+            # We start with HAProxy
             for cert_list, _ in dict_search_recursive(
                 pki['system']['load_balancing']['haproxy'], 'certificate'):
                 if name in cert_list:
                     used_by.append('haproxy')
+            # Check if OpenConnect consumes an ACME certificate
+            tmp = dict_search('system.vpn.openconnect.ssl.certificate', pki)
+            if tmp and tmp in cert_list:
+                used_by.append('openconnect')
+
             if used_by:
                 pki['certificate'][name]['acme'].update({'used_by': used_by})
 
@@ -369,7 +376,12 @@ def verify(pki):
                     listen_address = cert_conf['acme']['listen_address']
 
                 if 'used_by' not in cert_conf['acme']:
-                    if not check_port_availability(listen_address, 80):
+                    # A call to check_port_availability() will always fail during system
+                    # boot when listen_address is set and the address is not yet assigned
+                    # to an interface. This happens b/c PKI subsystem is called prior
+                    # to any inteface - e.g. ethernet - and thus the OS will always
+                    # be unable to bind() a socket() to a non existing IP address.
+                    if boot_configuration_complete() and not check_port_availability(listen_address, 80):
                         raise ConfigError('Port 80 is already in use and not available '\
                                           f'to provide ACME challenge for "{name}"!')