Page MenuHomeVyOS Platform
Create Task
Maniphest T8977

Regression in network.py is_addr_assigned, function rejects floating addresses (HAProxy and maybe other affected)
In progress, NormalPublicBUG
Actions

Description

This is something that must have broken between 29-04-2026 and 09-06-2026:

cloud-init can no longer deploy haproxy config on a VRRP floating listen address. Checking the vyos-configd-script-stdout yields the following:

~$ cat /tmp/vyos-configd-script-stdout 
listen-address "194.x.x.x" not assigned on any interface!

Leaving the resulting config tree functional, but the haproxy section completely empty. As nothing was changed in the cloud-init file, I’m pretty sure this is a regression on the VyOS side. It might also be some timing issue, as I’m not 100% sure the haproxy check looks at the device config or the actual interface. It is important to note, that setting it up like this also worked on the backup instances, which don’t get this floating IP set to their interface to begin with.

Details

Version
rolling on commit 0b27f39ae61acc644d31687ffca6ef85f0123c04
Is it a breaking change?
Unspecified (possibly destroys the router)
Issue type
Bug (incorrect behavior)
Forum thread
https://forum.vyos.io/t/cloud-init-fails-to-configure-haproxy-to-listen-on-vrrp-floating-address/17502

Related Objects

Event Timeline

MPStudyly created this task.Jun 10 2026, 8:41 AM
MPStudyly added a comment.Jun 10 2026, 8:58 AM

I found the culprit: https://github.com/vyos/vyos-1x/pull/5186 introduced a check if the address is assigned. I think this should be changed to check for an address, that is generally available (via config), not minding if it is actually configured. Open for suggestions to send in a PR.

pasik subscribed.Jun 10 2026, 8:59 AM
WanWizard subscribed.Jun 10 2026, 11:30 AM

I think it should check the state of net.ipv4.ip_nonlocal_bind / net.ipv6.ip_nonlocal_bind, and if set to 1, skip the check.

Viacheslav triaged this task as Normal priority.Jun 10 2026, 12:11 PM
MPStudyly added a comment.Jun 10 2026, 1:37 PM

I tried to work around the issue by leveraging VRRP transition scripts, when I’ve noticed haproxy by default listens to every interface (i.e. binds to *) when no explicit listen-address is set. However due to this behavior it is no longer possible to add a listen-address when haproxy is already running, as the on-commit check refuses to apply due to the port being occupied. For obvious reasons it should ignore the port being in use in such cases. The only solution for now is completely removing all haproxy config before reapplying all of it, which is very much suboptimal.

MPStudyly added a comment.Jun 10 2026, 1:47 PM

If somebody could explain to me what value addr (at https://github.com/vyos/vyos-1x/blob/a6ad73d72ba8d5256ff77978e63c07143787eb44/python/vyos/utils/network.py#L400) is set to when the current listen address is *, I might be able to come up with a PR to fix this.

MPStudyly added a comment.Jun 10 2026, 3:40 PM

Created an initial pull request at https://github.com/vyos/vyos-1x/pull/5266

Viacheslav changed the task status from Open to In progress.Jun 10 2026, 3:45 PM
Viacheslav assigned this task to MPStudyly.
MPStudyly added a comment.EditedWed, Aug 26, 4:34 PM

Reminder for myself, update initial post as soon as that is possible to:

Title: Regression in network.py is_addr_assigned, function rejects floating addresses (HAProxy and maybe other affected)

Content:

This broke with https://github.com/vyos/vyos-1x/pull/5186

To verify the issue happening, try to setup haproxy on a VRRP floating listen address. Committing the change fill fail with:

...
listen-address "194.x.x.x" not assigned on any interface!

To fix it, is_addr_assigned must consider sysctls net.ipvX.ip_nonlocal_bind and allow non local binds accordingly.
A PR with a proper fix is already open at: https://github.com/vyos/vyos-1x/pull/5266

Viacheslav renamed this task from Cloud-init fails to configure haproxy to listen on VRRP floating address to Regression in network.py is_addr_assigned, function rejects floating addresses (HAProxy and maybe other affected).Wed, Aug 26, 4:40 PM
rherold mentioned this in T9322: is_intf_addr_assigned() has no input validation and builds its netns command as a shell string.Tue, Sep 15, 11:57 AM