vyos-1x.git/smoketest/scripts/cli/test_service_https.py, branch rolling

https: T9022: serve the full CA certificate chain

2026-06-27T05:34:17+00:00

When a certificate is assigned to the HTTPS service, nginx was only sent the leaf certificate. An intermediate CA was included only when an operator manually configured "ca-certificate", and even then just that single CA - the rest of the issuer chain was never followed. As a result, clients that do not already trust the issuing intermediate CA (for example Let's Encrypt's newer E- and R-series intermediates) could not build a path to a trusted root and rejected the connection. Build the complete chain from the CA certificates present in the PKI using find_chain(), the same helper already used by HAProxy, OpenConnect, stunnel and the other PKI consumers. The intermediate chain is now discovered automatically, so configuring "ca-certificate" is no longer required; it remains accepted for backwards compatibility.

T8454: fix VRF-bind port availability check in service_https

2026-05-27T20:15:40+00:00

When service https is configured with a listen-address on a VRF interface, adding or changing the vrf option causes the commit to fail with "TCP port 443 is used by another service!" even though no conflict exists. Root cause: check_port_availability() performs a socket.bind() in the default network namespace. When the listen-address belongs to a VRF interface the address is unreachable from the default namespace, so the bind fails with OSError which is misinterpreted as "port in use". The secondary check via is_listen_port_bind_service() also fails because psutil cannot see sockets bound inside a VRF. Fix: add an optional vrf parameter to check_port_availability(). When set, the test socket is bound to the VRF master device via SO_BINDTODEVICE before the bind() call, so that the address is resolved in the correct L3 domain. This is done in-process (no subprocess) and works for both IPv4 and IPv6. service_https verify() now passes the configured VRF (if any) to check_port_availability(). Non-VRF configurations are unaffected. Add smoke test for HTTPS with listen-address inside a VRF. Co-authored-by: Christian Breunig

http-api: T7090: Implement background configure operations for REST API

2026-01-28T06:57:55+00:00

Large config commits (`service config-sync`) can block the REST API request path and sometimes must be deferred (e.g., when changing `service https`). This commit introduces an in-memory background operation manager that queues (FIFO) full configure operations (commands + commit/commit-confirm) as single jobs, tracks status/result, and exposes active operations via `/retrieve/background-operations`.

T7948: always call setUp() and tearDown() base class methods

2025-10-21T19:03:16+00:00

While working on task T7664 (FRR 10.4 upgrade), I identified the need for additional validation and safeguards around the FRR management daemon. The most appropriate place for this logic is in the setUp() and tearDown() methods of the smoketest base class, VyOSUnitTestSHIM. However, during implementation, it became apparent that test cases do not consistently invoke the base class's setup and teardown methods. This inconsistency complicates the process of capturing the FRR mgmtd PID at the start of a test and verifying that it remains unchanged by the end - a key step in detecting crashes or unexpected terminations (e.g., SIGSEGV) of the FRR management daemon during tests.

T7591: remove copyright years from source files

2025-06-28T21:16:52+00:00

The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors /g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice

https: T7393: add smoketest for https listen-address

2025-04-30T02:04:52+00:00

http-api: T6736: normalize formatting

2024-10-01T02:56:06+00:00

http-api: T6736: update smoketest for syntax change

2024-09-30T03:21:21+00:00

T5786: Add set/show system image to /image endpoint

2024-05-27T14:34:52+00:00

T6199: start validating smoketests against real CLI defaultValues

2024-04-06T10:51:18+00:00

Use vyos.xml_ref.default_value to query XML default values and take them into account when validating properly applied defaults in individual smoketests instead of using hardcoded values like 443 for https port.