vyos-1x.git/python, branch fix/T8955-http-api-verify-tls

http-api-client: T8955: enable TLS verification by default

2026-06-02T14:49:20+00:00

ApiClientConfig.verify_tls defaulted to False and ApiClient unconditionally silenced urllib3's InsecureRequestWarning, so TLS peer verification was off by default. The sole consumer, src/op_mode/config_sync.py, builds the client without passing verify_tls and therefore connected to a *remote* secondary VyOS node over HTTPS without verifying the certificate -- a MITM exposure on the channel that carries the API key and the full configuration. - ApiClientConfig.verify_tls now defaults to True and accepts Union[bool, str]; a string is forwarded to requests as a CA bundle path (verify=). - InsecureRequestWarning is suppressed only when verification is explicitly disabled (verify_tls is False), not when a CA path or True is set. - config_sync reads an optional verify_tls from the secondary runtime settings, defaulting to False to preserve current behaviour for self-signed secondaries. The insecurity is now explicit at the call site instead of hidden in the library default. A first-class CLI knob (set service config-sync secondary verify-tls / ca-certificate, with XML + migration) is the follow-up. 🤖 Generated by [robots](https://vyos.io)

nat: T8939: fix KeyError: 'group' exception

2026-05-28T20:03:40+00:00

Prevent access to missing dictionary key by probing for availability. On removal of inbound-interface or outbound-interface name CLI node, there was a guard missing when accessing the CLI dictionary containing the config data.

Merge pull request #5109 from statio/fix/vrf-aware-port-check

2026-05-28T14:39:35+00:00

T8454: fix VRF-bind port availability check in service_https

T8916: allow passing ReferenceTree instance to subtree_from_partial

2026-05-28T13:31:32+00:00

For use in nosetests or other, allow passing ReferenceTree from an internal cache in a non-standard location.

T8502: add server support for config-sync excluded paths

2026-05-28T13:31:26+00:00

T8502: add library support for config-sync exclude paths

2026-05-28T13:31:26+00:00

T8502: add list of global config-sync exclude paths

2026-05-28T13:31:21+00:00

T8454: fix VRF-bind port availability check in service_https

2026-05-27T20:15:40+00:00

When service https is configured with a listen-address on a VRF interface, adding or changing the vrf option causes the commit to fail with "TCP port 443 is used by another service!" even though no conflict exists. Root cause: check_port_availability() performs a socket.bind() in the default network namespace. When the listen-address belongs to a VRF interface the address is unreachable from the default namespace, so the bind fails with OSError which is misinterpreted as "port in use". The secondary check via is_listen_port_bind_service() also fails because psutil cannot see sockets bound inside a VRF. Fix: add an optional vrf parameter to check_port_availability(). When set, the test socket is bound to the VRF master device via SO_BINDTODEVICE before the bind() call, so that the address is resolved in the correct L3 domain. This is done in-process (no subprocess) and works for both IPv4 and IPv6. service_https verify() now passes the configured VRF (if any) to check_port_availability(). Non-VRF configurations are unaffected. Add smoke test for HTTPS with listen-address inside a VRF. Co-authored-by: Christian Breunig

Merge pull request #5157 from xTITUSMAXIMUSX/current

2026-05-26T15:27:03+00:00

geoip: T8590: fix initialization failure and set clobbering on boot and commit

wwan: T8412: Fix commit failure when modem is absent or not connected

2026-05-22T13:54:27+00:00

`mmcli --simple-disconnect` can be called when the modem bearer is not active. This causes cmd() to raise a `PermissionError` and abort the commit. Handle the case gracefully so the configuration can be committed before the modem is physically present or fully connected.