Merge pull request #4858 from c-po/login-warning

login: T8024: show user warning for unconfigured RADIUS/TACACS source-address

Author: dmbaturin

src/conf_mode/system_login.py

@@ -45,6 +45,7 @@
 from vyos.utils.configfs import add_cli_node
 from vyos.utils.dict import dict_search
 from vyos.utils.file import move_recursive
+from vyos.utils.network import is_addr_assigned
 from vyos.utils.permission import chown
 from vyos.utils.process import cmd
 from vyos.utils.process import call
@@ -212,13 +213,17 @@ def verify(login):
 
         verify_vrf(login['radius'])
 
-        if 'source_address' in login['radius']:
+        if addresses := dict_search('radius.source_address', login):
             ipv4_count = 0
             ipv6_count = 0
-            for address in login['radius']['source_address']:
+            radius_vrf = dict_search('radius.vrf', login)
+            for address in addresses:
                 if is_ipv4(address): ipv4_count += 1
                 else:                ipv6_count += 1
 
+                if not is_addr_assigned(address, vrf=radius_vrf):
+                    Warning(f'Specified RADIUS source-address "{address}" is not assigned!')
+
             if ipv4_count > 1:
                 raise ConfigError('Only one IPv4 source-address can be set!')
             if ipv6_count > 1:
@@ -235,13 +240,18 @@ def verify(login):
                 fail = False
 
         if fail:
-            raise ConfigError('All RADIUS servers are disabled')
+            raise ConfigError('All TACACS servers are disabled')
 
         if tacacs_servers_count > MAX_TACACS_COUNT:
             raise ConfigError(f'Number of TACACS servers exceeded maximum of {MAX_TACACS_COUNT}!')
 
         verify_vrf(login['tacacs'])
 
+        if tmp := dict_search('tacacs.source_address', login):
+            tacacs_vrf = dict_search('tacacs.vrf', login)
+            if not is_addr_assigned(tmp, vrf=tacacs_vrf):
+                Warning(f'Specified TACACS source-address "{tmp}" is not assigned!')
+
     if 'max_login_session' in login and 'timeout' not in login:
         raise ConfigError('"login timeout" must be configured!')