vyos-1x.git/src, branch current

Merge pull request #5109 from statio/fix/vrf-aware-port-check

2026-05-28T14:39:35+00:00

T8454: fix VRF-bind port availability check in service_https

Merge pull request #5169 from jestabro/exclusive-mask-config-sync

2026-05-28T13:40:57+00:00

T8502: Add exclusion mask to config-sync

T8916: add simple nosetest for subtree_from_partial utility

2026-05-28T13:31:32+00:00

T8502: add util for updating config-sync-exclude.json

2026-05-28T13:31:26+00:00

T8502: add client support for config-sync excluded paths

2026-05-28T13:31:26+00:00

T8502: add server support for config-sync excluded paths

2026-05-28T13:31:26+00:00

Merge pull request #5074 from vyos/fix/bare-except-clauses

2026-05-28T11:42:05+00:00

python: T8857: replace bare except clauses with except Exception in config scripts

T8454: fix VRF-bind port availability check in service_https

2026-05-27T20:15:40+00:00

When service https is configured with a listen-address on a VRF interface, adding or changing the vrf option causes the commit to fail with "TCP port 443 is used by another service!" even though no conflict exists. Root cause: check_port_availability() performs a socket.bind() in the default network namespace. When the listen-address belongs to a VRF interface the address is unreachable from the default namespace, so the bind fails with OSError which is misinterpreted as "port in use". The secondary check via is_listen_port_bind_service() also fails because psutil cannot see sockets bound inside a VRF. Fix: add an optional vrf parameter to check_port_availability(). When set, the test socket is bound to the VRF master device via SO_BINDTODEVICE before the bind() call, so that the address is resolved in the correct L3 domain. This is done in-process (no subprocess) and works for both IPv4 and IPv6. service_https verify() now passes the configured VRF (if any) to check_port_availability(). Non-VRF configurations are unaffected. Add smoke test for HTTPS with listen-address inside a VRF. Co-authored-by: Christian Breunig

Merge pull request #5208 from alexandr-san4ez/T8538-current

2026-05-27T19:42:01+00:00

snmp: T8538: Persist engineBoots counter across reboots

ipsec: T8912: Fix log level not respected in system journal

2026-05-27T14:04:17+00:00

When setting 'vpn ipsec logging log-level 0', DPD informational messages (log level 1) were still appearing in the system journal. The root cause is that charon-systemd reads both `charon-systemd.conf` and `charon-logging.conf` and applies the higher of the two log levels to the journal. The VyOS only managed `charon-systemd.conf`, leaving `charon-logging.conf` at its default level of 1, which silently overrode the user-configured level. Fix this by rendering `charon-logging.conf` on every commit with syslog backend set to -1 (silent), making `charon-systemd.conf` the sole authoritative source for journal log verbosity. This also eliminates duplicate log entries in the journal that occurred when both backends were active and writing to the same destination.