[Bastion] Fixing Bastion tunnel establishment issue #8952
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When running az network bastion tunnel inside WSL2, the command hangs for ~60 seconds before opening the tunnel. This is caused by a port availability check using socket.connect_ex(('', port)), which resolves to 0.0.0.0 and causes a timeout in WSL.
See examples
```
strace -f -tt python3 -c "import socket; import time; s=socket.socket(); s.settimeout(5); t=time.time(); r=s.connect_ex(('', 44444)); print(f'Result: {r}, Time: {time.time()-t:.2f}s')"
```
Output:
```
00:03:27.779861 socket(AF_INET, SOCK_STREAM|SOCK_CLOEXEC, IPPROTO_IP) = 3 00:03:27.780376 ioctl(3, FIONBIO, [1]) = 0 00:03:27.780642 connect(3, {sa_family=AF_INET, sin_port=htons(44444), sin_addr=inet_addr("0.0.0.0")}, 16) = -1 EINPROGRESS (Operation now in progress) 00:03:27.781179 poll([{fd=3, events=POLLOUT|POLLERR}], 1, 5000) = 0 (Timeout) 00:03:32.787945 write(1, "Result: 11, Time: 5.01s\n", 24Result: 11, Time: 5.01s ) = 24 00:03:32.788904 rt_sigaction(SIGINT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK, sa_restorer=0x7db0bc045330}, {sa_handler=0x6e7170, sa_mask=[], sa_flags=SA_RESTORER|SA_ONSTACK, sa_restorer=0x7db0bc045330}, 8) = 0 00:03:32.792342 getsockname(3, {sa_family=AF_INET, sin_port=htons(47226), sin_addr=inet_addr("127.0.0.1")}, [16]) = 0
```
vs
```
strace -f -tt python3 -c "import socket; import time; s=socket.socket(); s.settimeout(5); t=time.time(); r=s.connect_ex(('127.0.0.1', 44444)); print(f'Result: {r}, Time: {time.time()-t:.2f}s')"
```
Output:
```
00:03:32.793450 getpeername(3, 0x7ffde75bdb70, [16]) = -1 ENOTCONN (Transport endpoint is not connected) 00:03:32.794071 close(3) = 0 00:03:32.800493 munmap(0x7db0bc531000, 16384) = 0 00:03:32.801438 exit_group(0) = ? 00:03:32.803541 +++ exited with 0 +++
```
The logic was inverted. `sock.connect_ex` returns 0 if the connection is successful, hence when the port is open.
This reverts commit b19cb03.
Attempting to fix the test case
️✔️Azure CLI Extensions Breaking Change Test
|
Collaborator
|
Thank you for your contribution! We will review the pull request and get back to you soon. |
|
The git hooks are available for azure-cli and azure-cli-extensions repos. They could help you run required checks before creating the PR. Please sync the latest code with latest dev branch (for azure-cli) or main branch (for azure-cli-extensions). pip install azdev --upgrade
azdev setup -c <your azure-cli repo path> -r <your azure-cli-extensions repo path>
|
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR updates the bastion extension to v1.4.2 and fixes the tunnel port check by explicitly specifying the local address to avoid falling back to 0.0.0.0.
- Bump extension version to 1.4.2.
- Change
connect_excall to useself.local_addrwhen checking port availability. - Add HISTORY entry for the new version.
Reviewed Changes
Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
| src/bastion/setup.py | Updated VERSION constant to 1.4.2. |
| src/bastion/azext_bastion/tunnel.py | Changed port check to connect_ex((self.local_addr, local_port)). |
| src/bastion/HISTORY.rst | Added 1.4.2 release notes. |
Comments suppressed due to low confidence (2)
src/bastion/azext_bastion/tunnel.py:73
- Add unit tests for
is_port_opento verify behavior when specifyinglocal_addr(e.g., 127.0.0.1) and ensure it avoids fallback to 0.0.0.0 as intended.
if sock.connect_ex((self.local_addr, self.local_port)) == 0:
src/bastion/HISTORY.rst:7
- [nitpick] Consider expanding this release note to describe the specific issue resolved (explicitly specifying
local_addrto avoid fallback to0.0.0.0causing errors) for better clarity.
* Bug fix for tunnel.
microsoft-github-policy-service
bot
requested review from
jsntcy,
kairu-ms,
necusjz,
yanzhudd,
yonzhan and
zhoxing-ms
CodeGen Tools Feedback CollectionThank you for using our CodeGen tool. We value your feedback, and we would like to know how we can improve our product. Please take a few minutes to fill our codegen survey |
4 tasks
|
anvrao1
approved these changes
Jul 9, 2025
yanzhudd
changed the title
yanzhudd
approved these changes
Jul 10, 2025
Collaborator
|
[Release] Update index.json for extension [ bastion-1.4.2 ] : https://dev.azure.com/msazure/One/_build/results?buildId=129866627&view=results |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
8 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This checklist is used to make sure that common guidelines for a pull request are followed.
Related command
az aks bastion tunnelWhen testing whether the local port is occupied, explicitly specify the local addr (127.0.0.1), otherwise it may fall back to 0.0.0.0 and cause an error.
Replacing #8916
General Guidelines
azdev style <YOUR_EXT>locally? (pip install azdevrequired)python scripts/ci/test_index.py -qlocally? (pip install wheel==0.30.0required)For new extensions:
About Extension Publish
There is a pipeline to automatically build, upload and publish extension wheels.
Once your pull request is merged into main branch, a new pull request will be created to update
src/index.jsonautomatically.You only need to update the version information in file setup.py and historical information in file HISTORY.rst in your PR but do not modify
src/index.json.