From 18e14cf71b3597112357b58e24fbe7aa9a7d7f4c Mon Sep 17 00:00:00 2001 From: Lee Clements Date: Fri, 3 Apr 2026 16:46:58 -0400 Subject: T8454: fix VRF-bind port availability check in service_https When service https is configured with a listen-address on a VRF interface, adding or changing the vrf option causes the commit to fail with "TCP port 443 is used by another service!" even though no conflict exists. Root cause: check_port_availability() performs a socket.bind() in the default network namespace. When the listen-address belongs to a VRF interface the address is unreachable from the default namespace, so the bind fails with OSError which is misinterpreted as "port in use". The secondary check via is_listen_port_bind_service() also fails because psutil cannot see sockets bound inside a VRF. Fix: add an optional vrf parameter to check_port_availability(). When set, the test socket is bound to the VRF master device via SO_BINDTODEVICE before the bind() call, so that the address is resolved in the correct L3 domain. This is done in-process (no subprocess) and works for both IPv4 and IPv6. service_https verify() now passes the configured VRF (if any) to check_port_availability(). Non-VRF configurations are unaffected. Add smoke test for HTTPS with listen-address inside a VRF. Co-authored-by: Christian Breunig --- smoketest/scripts/cli/test_service_https.py | 30 +++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'smoketest/scripts/cli/test_service_https.py') diff --git a/smoketest/scripts/cli/test_service_https.py b/smoketest/scripts/cli/test_service_https.py index 4585bb0bd..b29be9eda 100755 --- a/smoketest/scripts/cli/test_service_https.py +++ b/smoketest/scripts/cli/test_service_https.py @@ -28,6 +28,7 @@ from base_vyostest_shim import ignore_warning from vyos.utils.file import read_file from vyos.utils.file import write_file from vyos.utils.process import call +from vyos.utils.process import cmd from vyos.utils.process import process_named_running from vyos.xml_ref import default_value @@ -177,6 +178,35 @@ class TestHTTPSService(VyOSUnitTestSHIM.TestCase): self.assertEqual(res, set(test_addr)) + def test_listen_address_vrf(self): + # Verify that HTTPS service can be configured with a listen-address + # inside a VRF. Regression test: the port availability check used to + # fail because it ran in the default namespace where the VRF address + # is unreachable. + vrf = 'mgmt' + vrf_table = '1337' + test_addr = '192.0.2.1' + test_prefix = f'{test_addr}/26' + interface = 'dum0' + + self.cli_set(['interfaces', 'dummy', interface, 'address', test_prefix]) + self.cli_set(['interfaces', 'dummy', interface, 'vrf', vrf]) + self.cli_set(['vrf', 'name', vrf, 'table', vrf_table]) + + self.cli_set( + base_path + ['api', 'keys', 'id', 'key-01', 'key', 'MySuperSecretVyOS'] + ) + self.cli_set(base_path + ['listen-address', test_addr]) + self.cli_set(base_path + ['vrf', vrf]) + self.cli_commit() + + # Verify nginx is running inside the VRF + tmp = cmd(f'ip vrf pids {vrf}') + self.assertIn(PROCESS_NAME, tmp) + + self.cli_delete(['interfaces', 'dummy', interface]) + self.cli_delete(['vrf', 'name', vrf]) + def test_certificate(self): cert_name = 'test_https' dh_name = 'dh-test' -- cgit v1.2.3