vyos-1x.git/src/services, branch fix/T8955-http-api-verify-tls

Merge pull request #5491 from omnom62/T8989-hotfix-oidc_aud_validation

2026-09-29T19:07:04+00:00

http-api: T8989: Hotfix to enforce audience validation if OIDC is configured

Merge pull request #5499 from c-po/wwan-improvements

2026-09-29T04:42:46+00:00

wwan: T9350: possible dead interface after boot, disconnect does not stick

https: T8989: Hotfix to enforce audience settings with OIDC is configured

2026-09-28T20:58:05+00:00

Merge pull request #5503 from c-po/T9354

2026-09-28T19:18:12+00:00

op-mode: T9354: replace "reset connection" with "reconnect interface"

vyos.utils: T8977: let a caller accept a non-local address as assigned

2026-09-26T07:46:08+00:00

Whether an address may be bound is not the same question as whether it is currently configured somewhere: the kernel permits binding a foreign address once the non-local bind sysctl is set, which is how a failover address is commonly handed over after the commit. Callers can now opt into that, the default is unchanged. A lookup no longer skips the VRF device itself, which carries the addresses of its own L3 domain, and an interface name can be retrieved for an address without the caller asking a yes/no question in the first place. Address and range validation is split into separate checks, so a caller no longer has to accept ranges where only an address is meaningful. The two duplicated version checks are dropped in favour of the existing ones. Co-authored-by: Christian Breunig

op-mode: T9354: replace "reset connection" with "reconnect interface"

2026-09-25T19:02:06+00:00

"connect interface" and "disconnect interface" cannot be combined to restart a dialer interface when the CLI session runs over that very interface, yet the command which does cover it was filed under an unrelated top-level node and was hard to find. It is now "reconnect interface ", mirroring the existing connect and disconnect commands. "reset connection" is removed, no alias is kept. The removed command was reachable through the REST API as a "reset" path. A dedicated "/reconnect" endpoint takes its place, so the operation stays available to API consumers.

wwan: T9350: wait for the modem to become dialable, not merely listed

2026-09-24T19:48:13+00:00

A modem is on the bus while still probing, so a dial could start too early and leave the interface without a session until something re-dialled it.

wwan: T9350: properly disconnect "disconnect interface wwanN"

2026-09-24T15:27:27+00:00

Two things kept an operator disconnect from taking effect. vyos-netlinkd re-dials every configured WWAN interface that has lost its session. It cannot tell a session lost to RF signal loss from one that was taken down on purpose, so the disconnect was undone on the next reconcile pass, at most 30 seconds later: $ disconnect interface wwan0 08:53:33 t+10s state=registered 08:53:43 t+20s state=registered 08:53:53 t+30s state=connected <- re-dialled 08:54:03 t+40s state=connected vyos-netlinkd: WWAN interface wwan0 is not connected, re-dialling... vyos-netlinkd: Re-dialled WWAN interface wwan0 Record the intent instead of inferring it from the session state. op-mode "disconnect" drops a marker in /run/vyos-wwan, which _reconcile_wwan() honours and "connect" removes again. conf_mode removes it too, so a commit keeps re-asserting the configured state - the marker only survives for as long as nobody says otherwise, and never across a reboot.

wwan: T9350: move session re-dial from cron into vyos-netlinkd

2026-09-24T15:26:28+00:00

/etc/cron.d/vyos-wwan re-ran the conf_mode script every 5 minutes via op-mode "connect interface wwanN" to re-establish a session lost to RF signal loss. Re-entering conf_mode from cron is unsafe: the cron job knows nothing about the boot commit or about a commit in flight, so when a tick lands before the running config is populated, get_config() returns nothing but {'ifname', 'deleted'} and apply() takes the teardown branch instead of dialling. It then stops the DHCP clients, stops ModemManager and unlinks its own cron file, leaving wwan0 down with no way to recover until the next commit: CRON[1869]: (root) CMD (/usr/libexec/vyos/vyos-check-wwan.py) systemd[1]: Stopping DHCP client on wwan0... systemd[1]: Stopping Modem Manager... This is timing dependent - it only bites when a */5 tick coincides with boot - which is why it presents as an intermittently dead WWAN interface. Move the re-dial into vyos-netlinkd, which already tracks these interfaces for DHCP and already gates all of its work behind boot_configuration_complete() and commit_in_progress2(). A re-dial can therefore no longer land on a half-applied configuration. It also dials ModemManager directly rather than re-entering conf_mode, so the teardown branch is no longer reachable from the recovery path at all.

http-api: T8989: address Copilot review comments

2026-09-02T00:35:35+00:00

- Remove fallback 'oidc-client' identity - tokens without sub/client_id are now rejected - Suppress OIDC validation error details from stdout - Cache discovered JWKS URI back to session to avoid per-request discovery - token_op now accepts X-API-Key header alongside form field - Reset REST/OIDC session attributes on SIGHUP reload to prevent stale config persisting after nodes are removed