From 18e14cf71b3597112357b58e24fbe7aa9a7d7f4c Mon Sep 17 00:00:00 2001 From: Lee Clements Date: Fri, 3 Apr 2026 16:46:58 -0400 Subject: T8454: fix VRF-bind port availability check in service_https When service https is configured with a listen-address on a VRF interface, adding or changing the vrf option causes the commit to fail with "TCP port 443 is used by another service!" even though no conflict exists. Root cause: check_port_availability() performs a socket.bind() in the default network namespace. When the listen-address belongs to a VRF interface the address is unreachable from the default namespace, so the bind fails with OSError which is misinterpreted as "port in use". The secondary check via is_listen_port_bind_service() also fails because psutil cannot see sockets bound inside a VRF. Fix: add an optional vrf parameter to check_port_availability(). When set, the test socket is bound to the VRF master device via SO_BINDTODEVICE before the bind() call, so that the address is resolved in the correct L3 domain. This is done in-process (no subprocess) and works for both IPv4 and IPv6. service_https verify() now passes the configured VRF (if any) to check_port_availability(). Non-VRF configurations are unaffected. Add smoke test for HTTPS with listen-address inside a VRF. Co-authored-by: Christian Breunig --- python/vyos/utils/network.py | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) (limited to 'python') diff --git a/python/vyos/utils/network.py b/python/vyos/utils/network.py index 8985224f3..8544b2163 100644 --- a/python/vyos/utils/network.py +++ b/python/vyos/utils/network.py @@ -305,7 +305,9 @@ def mac2eui64(mac, prefix=None): except: # pylint: disable=bare-except return -def check_port_availability(address: str=None, port: int=0, protocol: str='tcp') -> bool: + +def check_port_availability(address: str = None, port: int = 0, + protocol: str = 'tcp', vrf: str = None) -> bool: """ Check if given port is available and not used by any service. @@ -315,7 +317,9 @@ def check_port_availability(address: str=None, port: int=0, protocol: str='tcp') Args: address: IPv4 or IPv6 address - if None, checks on all interfaces port: TCP/UDP port number. - + vrf: VRF name to test the bind in - when set, the socket is bound + to the VRF master device via SO_BINDTODEVICE so that the + port check runs in the correct L3 domain. Returns: False if a port is busy or IP address does not exists @@ -348,12 +352,15 @@ def check_port_availability(address: str=None, port: int=0, protocol: str='tcp') try: with socket.socket(family, socktype, proto) as s: s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) + # When a VRF is specified, bind the socket to the VRF master + # device so the address is resolved in that VRF's L3 domain. + if vrf: + s.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE, + (vrf + '\0').encode()) s.bind(sockaddr) - # port is free to use - return True + return True # port is free to use except OSError: - # port is already in use - return False + return False # port is already in use # if we reach this point, no socket was tested and we assume the port is # already in use - better safe then sorry -- cgit v1.2.3