From bc1a054e14eaabd17326d63fa99c19c0a867130d Mon Sep 17 00:00:00 2001 From: Yuriy Andamasov Date: Tue, 2 Jun 2026 17:49:20 +0300 Subject: http-api-client: T8955: enable TLS verification by default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ApiClientConfig.verify_tls defaulted to False and ApiClient unconditionally silenced urllib3's InsecureRequestWarning, so TLS peer verification was off by default. The sole consumer, src/op_mode/config_sync.py, builds the client without passing verify_tls and therefore connected to a *remote* secondary VyOS node over HTTPS without verifying the certificate -- a MITM exposure on the channel that carries the API key and the full configuration. - ApiClientConfig.verify_tls now defaults to True and accepts bool | str; a string is forwarded to requests as a CA bundle path (verify=). - InsecureRequestWarning is suppressed only when verification is explicitly disabled (verify_tls is False), not when a CA path or True is set. - config_sync reads an optional verify_tls from the secondary runtime settings, defaulting to False to preserve current behaviour for self-signed secondaries. The insecurity is now explicit at the call site instead of hidden in the library default. Exposing a CA certificate (PKI reference) and peer fingerprint pinning under service config-sync secondary is follow-up T9396. 🤖 Generated by [robots](https://vyos.io) --- src/op_mode/config_sync.py | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/op_mode/config_sync.py b/src/op_mode/config_sync.py index 8d473cc70..828cd8623 100644 --- a/src/op_mode/config_sync.py +++ b/src/op_mode/config_sync.py @@ -73,13 +73,22 @@ def _load_config_sync_settings() -> dict: key = secondary.get('key') port = int(secondary.get('port', 443)) timeout = int(secondary.get('timeout')) if secondary.get('timeout') else None + # config-sync talks to a remote secondary over HTTPS. TLS verification is + # off by default because secondary nodes typically present a self-signed + # certificate; an operator can opt in (True, or a CA bundle path) once the + # runtime config exposes it. + # TODO(T9396): expose ca-certificate / peer-fingerprint under + # service config-sync secondary + verify_tls = secondary.get('verify_tls', False) if not address or not key: raise opmode.UnconfiguredObject( 'Config-sync is not fully configured: missing secondary address/key' ) - return dict(host=address, key=key, port=port, timeout=timeout) + return dict( + host=address, key=key, port=port, timeout=timeout, verify_tls=verify_tls + ) class ConfigSyncDiffManager: -- cgit v1.2.3