Skip to content

fix(yang-push): use system-chosen source IP for NETCONF SSH - #5

Merged
riccardo-negri merged 1 commit into
network-analytics:mainfrom
riccardo-negri:netconf-avoid-explicit-ip-bind
Jul 28, 2026
Merged

fix(yang-push): use system-chosen source IP for NETCONF SSH#5
riccardo-negri merged 1 commit into
network-analytics:mainfrom
riccardo-negri:netconf-avoid-explicit-ip-bind

Conversation

@riccardo-negri

Copy link
Copy Markdown
Member

YANG Push notifications arrive on the anycast address (e.g. 1.1.1.45). The YANG schema fetcher was reusing that collector address as the explicit local bind address for the NETCONF SSH connection. When the NETCONF server is only reachable via the site-local unicast address (.46 or .47), the connection fails because the source IP is wrong.

Solution

Remove the explicit socket.bind(local_addr) for NETCONF SSH connections in the schema fetcher by passing None as local_address in both fetch_from_device and fetch_from_device_by_id. The Linux routing stack now selects the correct unicast source address based on the destination.

SO_BINDTODEVICE / local_interface is unchanged — interface selection still works as before.

Files changed:

  • crates/yang-push/src/cache/fetcher.rs: pass None instead of Some(collector) for local_address in both NetconfSshConnectConfig::new call sites.

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes NETCONF SSH schema-fetch failures when YANG Push notifications arrive via an anycast collector address by no longer forcing the SSH client’s TCP socket to bind to that collector IP as its source address. Instead, it lets the OS routing stack choose an appropriate unicast source address based on the destination, while keeping interface pinning (SO_BINDTODEVICE) unchanged.

Changes:

  • Pass None for local_address when building NetconfSshConnectConfig in fetch_from_device.
  • Pass None for local_address when building NetconfSshConnectConfig in fetch_from_device_by_id.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@riccardo-negri
riccardo-negri force-pushed the netconf-avoid-explicit-ip-bind branch from b7431bb to 4b00cd6 Compare July 28, 2026 08:14
YANG Push notifications arrive on the anycast address (e.g. 1.1.1.45).
The YANG schema fetcher was reusing that collector address as the explicit
local bind address for the NETCONF SSH connection. When the NETCONF server
is only reachable via the site-local unicast address (.46 or .47),
the connection fails because the source IP is wrong.

Solution

Remove the explicit socket.bind(local_addr) for NETCONF SSH connections
in the schema fetcher by passing None as local_address in both
fetch_from_device and fetch_from_device_by_id. The Linux routing
stack now selects the correct unicast source address based on the destination.

SO_BINDTODEVICE / local_interface is unchanged — interface selection still works as before.

Files changed:
- crates/yang-push/src/cache/fetcher.rs: pass None instead of Some(collector)
  for local_address in both NetconfSshConnectConfig::new call sites.
@riccardo-negri
riccardo-negri force-pushed the netconf-avoid-explicit-ip-bind branch from 4b00cd6 to 4c31b4b Compare July 28, 2026 08:19
@riccardo-negri
riccardo-negri merged commit ba41aa2 into network-analytics:main Jul 28, 2026
17 of 19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants