VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=feature%2FT9082-codeql-cpp 2026-05-12T17:57:27+00:00 2026-05-12T17:57:27+00:00 doctorpangloss 2229300+doctorpangloss@users.noreply.github.com 2026-05-11T22:44:50+00:00 urn:sha1:33ac35a45b813ab408c7ce0ccb511608a637fc68 2026-05-12T17:57:08+00:00 doctorpangloss 2229300+doctorpangloss@users.noreply.github.com 2026-04-12T01:24:13+00:00 urn:sha1:2df14cbbc0e4e5e6657bb02938768d48f7294684 WLB per-interface routing tables only contain a default route. When LAN traffic is fwmarked by WLB nftables rules, ip rule policy routes it to these tables where internal destinations (BGP, connected, DNAT) have no matching route and incorrectly exit via WAN. Add ip rule with table main suppress_prefixlength 0 before each per-interface table rule. This checks the main routing table first for specific routes but suppresses the default route, so only internet-bound traffic falls through to WLB per-interface tables. Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> 2026-05-12T13:58:51+00:00 Simon 965089+sarthurdev@users.noreply.github.com 2026-05-12T13:58:51+00:00 urn:sha1:ab28ff732ca159438ef911cd91fd86ddd5000970 * wan: T8481: scope flush-connections to WLB connection marks flush-connections runs conntrack --delete which destroys all conntrack entries system-wide, including unrelated NAT translations and established connections that have nothing to do with WLB. WLB tags every connection it manages with a conntrack mark via the wlb_mangle_isp_<ifname> chain (ct mark set 0xc9, 0xca, etc.). Scope the flush to these marks so only WLB-managed connections are affected. Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> * wan: T8481: replace conntrack deletion from state changed block --------- Signed-off-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> Co-authored-by: doctorpangloss <2229300+doctorpangloss@users.noreply.github.com> 2025-10-30T23:47:06+00:00 l0crian1 ryan.claridge13@gmail.com 2025-10-30T23:47:06+00:00 urn:sha1:7e5fd62fcf585fa2b72161a7b1d0ba37b565c9eb 2025-10-29T13:22:16+00:00 l0crian1 ryan.claridge13@gmail.com 2025-10-29T13:22:16+00:00 urn:sha1:c3bc42001e478da712bd6c31befd11f56cbd4236 2025-09-10T10:09:09+00:00 sarthurdev 965089+sarthurdev@users.noreply.github.com 2025-09-10T08:44:15+00:00 urn:sha1:ae732fb0eb1dd352ba0b97b07aaf3db9c514ea19 2025-07-14T07:53:24+00:00 Matthew Kobayashi matthew@kobayashi.au 2025-07-14T07:50:03+00:00 urn:sha1:42897120a6b233046060981442501e792156f339 2025-06-28T21:16:52+00:00 Christian Breunig christian@breunig.cc 2025-06-28T18:51:21+00:00 urn:sha1:1478516ae437f19ebeb7d6ff9b83dd74f8e76758 The legal team says years are not necessary so we can go ahead with it, since it will simplify backporting. Automatically removed using: git ls-files | grep -v libvyosconfig | xargs sed -i -E \ 's/^# Copyright (19|20)[0-9]{2}(-[0-9]{4})? VyOS maintainers.*/# Copyright VyOS maintainers and contributors <maintainers@vyos.io>/g' In addition we will error-out during "make" if someone re-adds a legacy copyright notice 2025-06-24T16:03:14+00:00 Abhishek Safui abhishek.safui@cdot.in 2025-06-24T16:03:14+00:00 urn:sha1:5ef422734a5c4f8c211c0fa10a3c0fced9e3f8f0 Write the health-status on the very first run of the script, without waiting for any change in status, to show the current state to the show command. In show command use the same api to get the now timestamp as used in state change timestamp. 2025-02-26T22:11:35+00:00 Simon 965089+sarthurdev@users.noreply.github.com 2025-02-26T22:11:35+00:00 urn:sha1:92ad401f0b7459fa3c50092a1bdd8255946e5661 * wlb: T7196: Migrate interface wildcards to nftables format * wlb: T7196: Fix exclude/interface verify check * wlb: T7196: Extra sanity check on ipv4 address function