| Age | Commit message (Collapse) | Author |
|---|
|
http-api: T8989: Hotfix to enforce audience validation if OIDC is configured
|
|
|
|
"connect interface" and "disconnect interface" cannot be combined to restart a
dialer interface when the CLI session runs over that very interface, yet the
command which does cover it was filed under an unrelated top-level node and
was hard to find.
It is now "reconnect interface <ifname>", mirroring the existing connect and
disconnect commands. "reset connection" is removed, no alias is kept.
The removed command was reachable through the REST API as a "reset" path. A
dedicated "/reconnect" endpoint takes its place, so the operation stays
available to API consumers.
|
|
- Remove fallback 'oidc-client' identity - tokens without sub/client_id
are now rejected
- Suppress OIDC validation error details from stdout
- Cache discovered JWKS URI back to session to avoid per-request discovery
- token_op now accepts X-API-Key header alongside form field
- Reset REST/OIDC session attributes on SIGHUP reload to prevent stale
config persisting after nodes are removed
|
|
- Restore mask_dict/config_dict variable names in _execute_configure_op
(shadowing of Config object was causing potential crash on delete ops)
- Fix load_section_tree() call to pass correct 3 arguments
- Pass data.destructive to merge_config() to preserve destructive behavior
|
|
|
|
- Use OpenID Connect discovery (/.well-known/openid-configuration) to
resolve JWKS URI when jwks-url is not explicitly configured
- Add optional audience validation via new oidc audience config node
- Require exp claim in OIDC tokens
- Reject jwks-url without issuer at commit time
|
|
Add support for validating OIDC Bearer tokens issued by external identity
providers (Keycloak, Azure AD, Okta, Vault, etc.) against the configured
JWKS endpoint.
Configuration:
set service https api rest authentication oidc issuer <url>
set service https api rest authentication oidc jwks-url <url>
If jwks-url is not set, it is derived from the issuer URL using the
standard OpenID Connect discovery path.
Auth priority: mTLS -> VyOS JWT -> OIDC -> API key
|
|
- Make ApiModel.key optional to allow Bearer/X-API-Key/mTLS auth
without requiring a dummy key field in the request body
- Add thread safety to REST token secret initialization
- Cast rest_token_exp and rest_secret_len to int on load
- Use defensive dict.get() for authentication config access
|
|
Co-authored-by: Viacheslav Hletenko <seversss265@gmail.com>
|
|
|
|
Add support for mutual TLS (mTLS) authentication to the VyOS REST API.
When configured, nginx requests a client certificate and verifies it
against the configured CA chain. FastAPI reads the X-Client-Verify
header set by nginx and bypasses API key/token authentication when
the client certificate is valid.
Configuration:
set service https certificates ca-certificate <name>
set service https certificates verify-client <optional|required>
Note: requires TLSv1.2 due to nginx 1.22 TLSv1.3 post-handshake
authentication limitations. TLSv1.3 support pending nginx upgrade.
|
|
Add JWT Bearer token support to the REST API, as an additional
authentication method alongside the existing form-field key and
X-API-Key header.
- New POST /token endpoint mints a JWT for a valid API key
- auth_required() accepts Authorization: Bearer <token> alongside
existing key/X-API-Key auth
- New config nodes: service https api rest authentication
{expiration, secret-length} (defaults: 3600s / 32 bytes)
- REST tokens use an independent signing secret from GraphQL's,
since GraphQL may not be enabled on all deployments and the two
subsystems have different expiry requirements
- nginx location regex updated to allow /token
- service_https.py default-value merge generalized to also apply
to the rest node, not just graphql, so REST authentication
defaults populate correctly on commit
|
|
|
|
|
|
Reaches a clean typos baseline for the T8490 ruleset pilot. Categories:
- Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError;
"ned" -> "new" (migration comments).
- Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is".
- Local variables (all refs in-function): commited, formating, presistent;
inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision).
- Self-contained renames (definition + all references in-file): formated_stats,
_get_formatted_output_conections -> ..._connections, expension_failure ->
expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required.
False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed
here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's
"U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert
the real upstream `vppctl` output). Verified: typos clean, py_compile of every
edited .py, zero remaining old-identifier references.
🤖 Generated by [robots](https://vyos.io)
|
|
|
|
Fix typos and mistakes in the commands and comments
No functional changes
|
|
The HTTPS API config-file handler previously used a blocking
threading.Lock in an async FastAPI endpoint, which can block the
event loop and make the API unresponsive under concurrent load.
This commit replaces the blocking lock with an asyncio.Lock to
serialize config operations without blocking async execution,
resolving the reported deadlock when concurrent /config-file
load operations occur.
The behavior of run_in_threadpool and background task scheduling
remains consistent with prior logic, so the handler preserves
existing commit and commit-confirm semantics.
|
|
Large config commits (`service config-sync`) can block the REST API request
path and sometimes must be deferred (e.g., when changing `service https`).
This commit introduces an in-memory background operation manager
that queues (FIFO) full configure operations (commands + commit/commit-confirm)
as single jobs, tracks status/result, and exposes active operations
via `/retrieve/background-operations`.
|
|
|
|
This is needed due to the recent change of the underlying method
_configure_op to async.
|
|
|
|
Refactor the blocking code in config handlers (endpoints /configure,
/config-file) to run in a threadpool; this allows defining the handler
as async. Consequently, the handler itself runs in the main thread,
avoiding the need for thread registration for libvyosconfig function
calls.
|
|
The legal team says years are not necessary so we can go ahead with it, since
it will simplify backporting.
Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \
's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g'
In addition we will error-out during "make" if someone re-adds a legacy
copyright notice
|
|
|
|
http-api: T7498: allow passing config string in body of 'load' or 'merge' request
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Avoid duplicate entries in the list of routes when adding/deleting
endpoints.
|
|
The GraphQL API was implemented as an addition to the existing REST API.
As there is no necessary dependency, separate the initialization of the
respective endpoints. Factor out the REST Pydantic models and FastAPI
routes for symmetry and clarity.
|
|
as opposed to entire subsystems
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Schema had been dynamically generated, based on configuration setting
for authentication. Add nullable field 'key' for static generation of
schema regardless of key/token use.
|
|
|
