VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp 2026-03-19T21:37:45+00:00 2026-03-19T21:37:45+00:00 Christian Breunig christian@breunig.cc 2025-11-07T21:05:59+00:00 urn:sha1:b84bdbf8dd25995aa564081632de6251ecf5ad4e Implementing a daemon that listens for netlink messages in Python was discussed for many years. This is a proof-of-concept implementation how we can listen for netlink messages and process them in Python. Python 3.10 minimum is required due to the use of case statements which mimics C-style switch/case instructions. Add example: set interfaces ethernet eth1 vif 21 address dhcp set interfaces ethernet eth1 vif 21 address dhcpv6 commit If network cable is unplugged: vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e vyos-netlinkd[12681]: Stopping dhclient@eth3.10.service... vyos-netlinkd[12681]: Stopping dhcp6c@eth3.10.service... If cable is plugged back in: vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=DOWN, mac=00:50:56:b3:9d:8e vyos-netlinkd[12681]: RTM_NEWLINK -> eth3.10, state=UP, mac=00:50:56:b3:9d:8e vyos-netlinkd[12681]: Restarting dhclient@eth3.10.service... vyos-netlinkd[12681]: Restarting dhcp6c@eth3.10.service... 2025-10-10T18:26:34+00:00 Christian Breunig christian@breunig.cc 2025-10-10T18:22:20+00:00 urn:sha1:2aec74e5219325434a73ad01718861169db001ac CRON is not used for certbot as pki starts the certbot timer. 2025-01-30T17:46:03+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2025-01-30T17:46:03+00:00 urn:sha1:170541686cab7c2ba3fc0f376353d665c9a3040b 2024-07-04T18:07:08+00:00 Christian Breunig christian@breunig.cc 2024-07-04T18:07:08+00:00 urn:sha1:a414190447c32be0775a077cde13cef0cf2b8c54 This fixes an error during ISO assembly: update-alternatives: error: no alternatives for regulatory.db dpkg: error processing archive /tmp/apt-dpkg-install-PJplR3/00-vyos-1x_1.5dev0-1880-gecaa44498_amd64.deb (--unpack): new vyos-1x package pre-installation script subprocess returned error exit status 2 2024-07-03T20:28:26+00:00 Christian Breunig christian@breunig.cc 2024-07-03T20:28:26+00:00 urn:sha1:9263965071289b6e51e22669b6d588a8d8fbcc1f Most likely b/c of our non signed Kernel binary we do not trust the Debian signed wireless regulatory database. Fallback to the upstream database instead. 2023-11-09T17:53:17+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2023-11-09T17:53:17+00:00 urn:sha1:e10cf9f42514799d10b9c495d585bb9f41fd2330 2023-11-04T12:15:38+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2023-11-04T12:15:38+00:00 urn:sha1:ca9cc86233520eb495c17602bf7a110094c1d8e7 Add custom systemd udev rules to exclude some regular and dynamic interfaces from "systemd-sysctl" calls. It fixes high CPU utilization (100%) as we have a lot of calls per interface for dynamic interfaces like ppp|ipoe|sstp etc. /lib/systemd/systemd-udevd should not be called for those interfaces 2023-09-29T05:26:31+00:00 Christian Breunig christian@breunig.cc 2023-09-29T05:26:31+00:00 urn:sha1:400df973d3518e9f18cb84b52ca89e08a399e461 T5577: Optimized PAM configs for RADIUS/TACACS+ 2023-09-13T18:02:32+00:00 zsdc taras@vyos.io 2023-09-13T10:16:20+00:00 urn:sha1:1c804685d05ad639bcb1a9ebce68a7a14268500f In CLI we can choose authentication logic: - `mandatory` - if TACACS+ answered with `REJECT`, authentication must be stopped and access denied immediately. - `optional` (default) - if TACACS+ answers with `REJECT`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if TACACS+ clearly answered that access should be denied (no user in TACACS+ database, wrong password, etc.). If TACACS+ is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode. 2023-09-13T17:41:43+00:00 zsdc taras@vyos.io 2023-09-13T09:41:04+00:00 urn:sha1:5181ab60bb6d936505967d6667adc12c5ecb9b64 In CLI we can choose authentication logic: - `mandatory` - if RADIUS answered with `Access-Reject`, authentication must be stopped and access denied immediately. - `optional` (default) - if RADIUS answers with `Access-Reject`, authentication continues using the next module. In `mandatory` mode authentication will be stopped only if RADIUS clearly answered that access should be denied (no user in RADIUS database, wrong password, etc.). If RADIUS is not available or other errors happen, it will be skipped and authentication will continue with the next module, like in `optional` mode.