summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorChristian Breunig <christian@breunig.cc>2025-10-02 23:10:09 +0200
committerChristian Breunig <christian@breunig.cc>2025-10-02 23:39:35 +0200
commit008bd2463ee2cba05470768e11d634c2461ea5fa (patch)
treed64d0494f261c53268f9ab0d962aaa856ecf85cd /src
parent2323b1ba6d7218c36434cfe988b1a2c9b517221c (diff)
downloadvyos-1x-008bd2463ee2cba05470768e11d634c2461ea5fa.tar.gz
vyos-1x-008bd2463ee2cba05470768e11d634c2461ea5fa.zip
pki: T7885: check_port_availability() can't be used during system boot
A call to check_port_availability() will always fail during system boot when listen_address is set and the address is not yet assigned to an interface. This happens b/c PKI subsystem is called prior to any inteface - e.g. ethernet - and thus the OS will always be unable to bind() a socket() to a non existing IP address.
Diffstat (limited to 'src')
-rwxr-xr-xsrc/conf_mode/pki.py9
1 files changed, 7 insertions, 2 deletions
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index fa6958130..d1695cb4f 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -185,7 +185,7 @@ def get_config(config=None):
pki.update({'changed':{}})
pki['changed'].update({key.replace('-', '_') : tmp})
- # We only merge on the defaults of there is a configuration at all
+ # We only merge on the defaults if there is a configuration at all
if conf.exists(base):
# We have gathered the dict representation of the CLI, but there are default
# options which we need to update into the dictionary retrived.
@@ -369,7 +369,12 @@ def verify(pki):
listen_address = cert_conf['acme']['listen_address']
if 'used_by' not in cert_conf['acme']:
- if not check_port_availability(listen_address, 80):
+ # A call to check_port_availability() will always fail during system
+ # boot when listen_address is set and the address is not yet assigned
+ # to an interface. This happens b/c PKI subsystem is called prior
+ # to any inteface - e.g. ethernet - and thus the OS will always
+ # be unable to bind() a socket() to a non existing IP address.
+ if boot_configuration_complete() and not check_port_availability(listen_address, 80):
raise ConfigError('Port 80 is already in use and not available '\
f'to provide ACME challenge for "{name}"!')