login: T8024: show user warning for unconfigured RADIUS source-address

Add a commit-time check and warning to the user if the RADIUS source-address
(IPv4 or IPv6) is not configured on the system or the given VRF.

1 files changed, 7 insertions, 2 deletions

diff --git a/src/conf_mode/system_login.py b/src/conf_mode/system_login.py
index 07fefbea1..369232f34 100755
--- a/src/conf_mode/system_login.py
+++ b/src/conf_mode/system_login.py
@@ -45,6 +45,7 @@ from vyos.utils.configfs import delete_cli_node
 from vyos.utils.configfs import add_cli_node
 from vyos.utils.dict import dict_search
 from vyos.utils.file import move_recursive
+from vyos.utils.network import is_addr_assigned
 from vyos.utils.permission import chown
 from vyos.utils.process import cmd
 from vyos.utils.process import call
@@ -212,13 +213,17 @@ def verify(login):
 
         verify_vrf(login['radius'])
 
-        if 'source_address' in login['radius']:
+        if addresses := dict_search('radius.source_address', login):
             ipv4_count = 0
             ipv6_count = 0
-            for address in login['radius']['source_address']:
+            radius_vrf = dict_search('radius.vrf', login)
+            for address in addresses:
                 if is_ipv4(address): ipv4_count += 1
                 else:                ipv6_count += 1
 
+                if not is_addr_assigned(address, vrf=radius_vrf):
+                    Warning(f'Specified RADIUS source-address "{address}" is not assigned!')
+
             if ipv4_count > 1:
                 raise ConfigError('Only one IPv4 source-address can be set!')
             if ipv6_count > 1: