vyos-1x.git/src, branch fix/T8955-http-api-verify-tls

http-api-client: T8955: enable TLS verification by default

2026-06-02T14:49:20+00:00

ApiClientConfig.verify_tls defaulted to False and ApiClient unconditionally silenced urllib3's InsecureRequestWarning, so TLS peer verification was off by default. The sole consumer, src/op_mode/config_sync.py, builds the client without passing verify_tls and therefore connected to a *remote* secondary VyOS node over HTTPS without verifying the certificate -- a MITM exposure on the channel that carries the API key and the full configuration. - ApiClientConfig.verify_tls now defaults to True and accepts Union[bool, str]; a string is forwarded to requests as a CA bundle path (verify=). - InsecureRequestWarning is suppressed only when verification is explicitly disabled (verify_tls is False), not when a CA path or True is set. - config_sync reads an optional verify_tls from the secondary runtime settings, defaulting to False to preserve current behaviour for self-signed secondaries. The insecurity is now explicit at the call site instead of hidden in the library default. A first-class CLI knob (set service config-sync secondary verify-tls / ca-certificate, with XML + migration) is the follow-up. 🤖 Generated by [robots](https://vyos.io)

Merge pull request #5109 from statio/fix/vrf-aware-port-check

2026-05-28T14:39:35+00:00

T8454: fix VRF-bind port availability check in service_https

Merge pull request #5169 from jestabro/exclusive-mask-config-sync

2026-05-28T13:40:57+00:00

T8502: Add exclusion mask to config-sync

T8916: add simple nosetest for subtree_from_partial utility

2026-05-28T13:31:32+00:00

T8502: add util for updating config-sync-exclude.json

2026-05-28T13:31:26+00:00

T8502: add client support for config-sync excluded paths

2026-05-28T13:31:26+00:00

T8502: add server support for config-sync excluded paths

2026-05-28T13:31:26+00:00

Merge pull request #5074 from vyos/fix/bare-except-clauses

2026-05-28T11:42:05+00:00

python: T8857: replace bare except clauses with except Exception in config scripts

T8454: fix VRF-bind port availability check in service_https

2026-05-27T20:15:40+00:00

When service https is configured with a listen-address on a VRF interface, adding or changing the vrf option causes the commit to fail with "TCP port 443 is used by another service!" even though no conflict exists. Root cause: check_port_availability() performs a socket.bind() in the default network namespace. When the listen-address belongs to a VRF interface the address is unreachable from the default namespace, so the bind fails with OSError which is misinterpreted as "port in use". The secondary check via is_listen_port_bind_service() also fails because psutil cannot see sockets bound inside a VRF. Fix: add an optional vrf parameter to check_port_availability(). When set, the test socket is bound to the VRF master device via SO_BINDTODEVICE before the bind() call, so that the address is resolved in the correct L3 domain. This is done in-process (no subprocess) and works for both IPv4 and IPv6. service_https verify() now passes the configured VRF (if any) to check_port_availability(). Non-VRF configurations are unaffected. Add smoke test for HTTPS with listen-address inside a VRF. Co-authored-by: Christian Breunig

Merge pull request #5208 from alexandr-san4ez/T8538-current

2026-05-27T19:42:01+00:00

snmp: T8538: Persist engineBoots counter across reboots