Merge pull request #4216 from HollyGurza/T6641

T6641: Add vyos-network-event-logger Service

9 files changed, 394 insertions, 0 deletions

diff --git a/python/vyos/include/__init__.py b/python/vyos/include/__init__.py
new file mode 100644
index 000000000..22e836531
--- /dev/null
+++ b/python/vyos/include/__init__.py
@@ -0,0 +1,15 @@
+# Copyright 2025 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
diff --git a/python/vyos/include/uapi/__init__.py b/python/vyos/include/uapi/__init__.py
new file mode 100644
index 000000000..22e836531
--- /dev/null
+++ b/python/vyos/include/uapi/__init__.py
@@ -0,0 +1,15 @@
+# Copyright 2025 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
diff --git a/python/vyos/include/uapi/linux/__init__.py b/python/vyos/include/uapi/linux/__init__.py
new file mode 100644
index 000000000..22e836531
--- /dev/null
+++ b/python/vyos/include/uapi/linux/__init__.py
@@ -0,0 +1,15 @@
+# Copyright 2025 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
diff --git a/python/vyos/include/uapi/linux/fib_rules.py b/python/vyos/include/uapi/linux/fib_rules.py
new file mode 100644
index 000000000..72f0b18cb
--- /dev/null
+++ b/python/vyos/include/uapi/linux/fib_rules.py
@@ -0,0 +1,20 @@
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+FIB_RULE_PERMANENT = 0x00000001
+FIB_RULE_INVERT = 0x00000002
+FIB_RULE_UNRESOLVED = 0x00000004
+FIB_RULE_IIF_DETACHED = 0x00000008
+FIB_RULE_DEV_DETACHED = FIB_RULE_IIF_DETACHED
+FIB_RULE_OIF_DETACHED = 0x00000010
diff --git a/python/vyos/include/uapi/linux/icmpv6.py b/python/vyos/include/uapi/linux/icmpv6.py
new file mode 100644
index 000000000..47e0c723c
--- /dev/null
+++ b/python/vyos/include/uapi/linux/icmpv6.py
@@ -0,0 +1,18 @@
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ICMPV6_ROUTER_PREF_LOW = 3
+ICMPV6_ROUTER_PREF_MEDIUM = 0
+ICMPV6_ROUTER_PREF_HIGH = 1
+ICMPV6_ROUTER_PREF_INVALID = 2
diff --git a/python/vyos/include/uapi/linux/if_arp.py b/python/vyos/include/uapi/linux/if_arp.py
new file mode 100644
index 000000000..90cb66ebd
--- /dev/null
+++ b/python/vyos/include/uapi/linux/if_arp.py
@@ -0,0 +1,176 @@
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# ARP protocol HARDWARE identifiers
+ARPHRD_NETROM = 0        # from KA9Q: NET/ROM pseudo
+ARPHRD_ETHER = 1         # Ethernet 10Mbps
+ARPHRD_EETHER = 2        # Experimental Ethernet
+ARPHRD_AX25 = 3          # AX.25 Level 2
+ARPHRD_PRONET = 4        # PROnet token ring
+ARPHRD_CHAOS = 5         # Chaosnet
+ARPHRD_IEEE802 = 6       # IEEE 802.2 Ethernet/TR/TB
+ARPHRD_ARCNET = 7        # ARCnet
+ARPHRD_APPLETLK = 8      # APPLEtalk
+ARPHRD_DLCI = 15         # Frame Relay DLCI
+ARPHRD_ATM = 19          # ATM
+ARPHRD_METRICOM = 23     # Metricom STRIP (new IANA id)
+ARPHRD_IEEE1394 = 24     # IEEE 1394 IPv4 - RFC 2734
+ARPHRD_EUI64 = 27        # EUI-64
+ARPHRD_INFINIBAND = 32   # InfiniBand
+
+# Dummy types for non-ARP hardware
+ARPHRD_SLIP = 256
+ARPHRD_CSLIP = 257
+ARPHRD_SLIP6 = 258
+ARPHRD_CSLIP6 = 259
+ARPHRD_RSRVD = 260       # Notional KISS type
+ARPHRD_ADAPT = 264
+ARPHRD_ROSE = 270
+ARPHRD_X25 = 271         # CCITT X.25
+ARPHRD_HWX25 = 272       # Boards with X.25 in firmware
+ARPHRD_CAN = 280         # Controller Area Network
+ARPHRD_MCTP = 290
+ARPHRD_PPP = 512
+ARPHRD_CISCO = 513       # Cisco HDLC
+ARPHRD_HDLC = ARPHRD_CISCO  # Alias for CISCO
+ARPHRD_LAPB = 516        # LAPB
+ARPHRD_DDCMP = 517       # Digital's DDCMP protocol
+ARPHRD_RAWHDLC = 518     # Raw HDLC
+ARPHRD_RAWIP = 519       # Raw IP
+
+ARPHRD_TUNNEL = 768      # IPIP tunnel
+ARPHRD_TUNNEL6 = 769     # IP6IP6 tunnel
+ARPHRD_FRAD = 770        # Frame Relay Access Device
+ARPHRD_SKIP = 771        # SKIP vif
+ARPHRD_LOOPBACK = 772    # Loopback device
+ARPHRD_LOCALTLK = 773    # Localtalk device
+ARPHRD_FDDI = 774        # Fiber Distributed Data Interface
+ARPHRD_BIF = 775         # AP1000 BIF
+ARPHRD_SIT = 776         # sit0 device - IPv6-in-IPv4
+ARPHRD_IPDDP = 777       # IP over DDP tunneller
+ARPHRD_IPGRE = 778       # GRE over IP
+ARPHRD_PIMREG = 779      # PIMSM register interface
+ARPHRD_HIPPI = 780       # High Performance Parallel Interface
+ARPHRD_ASH = 781         # Nexus 64Mbps Ash
+ARPHRD_ECONET = 782      # Acorn Econet
+ARPHRD_IRDA = 783        # Linux-IrDA
+ARPHRD_FCPP = 784        # Point to point fibrechannel
+ARPHRD_FCAL = 785        # Fibrechannel arbitrated loop
+ARPHRD_FCPL = 786        # Fibrechannel public loop
+ARPHRD_FCFABRIC = 787    # Fibrechannel fabric
+
+ARPHRD_IEEE802_TR = 800  # Magic type ident for TR
+ARPHRD_IEEE80211 = 801   # IEEE 802.11
+ARPHRD_IEEE80211_PRISM = 802  # IEEE 802.11 + Prism2 header
+ARPHRD_IEEE80211_RADIOTAP = 803  # IEEE 802.11 + radiotap header
+ARPHRD_IEEE802154 = 804
+ARPHRD_IEEE802154_MONITOR = 805  # IEEE 802.15.4 network monitor
+
+ARPHRD_PHONET = 820      # PhoNet media type
+ARPHRD_PHONET_PIPE = 821 # PhoNet pipe header
+ARPHRD_CAIF = 822        # CAIF media type
+ARPHRD_IP6GRE = 823      # GRE over IPv6
+ARPHRD_NETLINK = 824     # Netlink header
+ARPHRD_6LOWPAN = 825     # IPv6 over LoWPAN
+ARPHRD_VSOCKMON = 826    # Vsock monitor header
+
+ARPHRD_VOID = 0xFFFF     # Void type, nothing is known
+ARPHRD_NONE = 0xFFFE     # Zero header length
+
+# ARP protocol opcodes
+ARPOP_REQUEST = 1        # ARP request
+ARPOP_REPLY = 2          # ARP reply
+ARPOP_RREQUEST = 3       # RARP request
+ARPOP_RREPLY = 4         # RARP reply
+ARPOP_InREQUEST = 8      # InARP request
+ARPOP_InREPLY = 9        # InARP reply
+ARPOP_NAK = 10           # (ATM)ARP NAK
+
+ARPHRD_TO_NAME = {
+    ARPHRD_NETROM: "netrom",
+    ARPHRD_ETHER: "ether",
+    ARPHRD_EETHER: "eether",
+    ARPHRD_AX25: "ax25",
+    ARPHRD_PRONET: "pronet",
+    ARPHRD_CHAOS: "chaos",
+    ARPHRD_IEEE802: "ieee802",
+    ARPHRD_ARCNET: "arcnet",
+    ARPHRD_APPLETLK: "atalk",
+    ARPHRD_DLCI: "dlci",
+    ARPHRD_ATM: "atm",
+    ARPHRD_METRICOM: "metricom",
+    ARPHRD_IEEE1394: "ieee1394",
+    ARPHRD_INFINIBAND: "infiniband",
+    ARPHRD_SLIP: "slip",
+    ARPHRD_CSLIP: "cslip",
+    ARPHRD_SLIP6: "slip6",
+    ARPHRD_CSLIP6: "cslip6",
+    ARPHRD_RSRVD: "rsrvd",
+    ARPHRD_ADAPT: "adapt",
+    ARPHRD_ROSE: "rose",
+    ARPHRD_X25: "x25",
+    ARPHRD_HWX25: "hwx25",
+    ARPHRD_CAN: "can",
+    ARPHRD_PPP: "ppp",
+    ARPHRD_HDLC: "hdlc",
+    ARPHRD_LAPB: "lapb",
+    ARPHRD_DDCMP: "ddcmp",
+    ARPHRD_RAWHDLC: "rawhdlc",
+    ARPHRD_TUNNEL: "ipip",
+    ARPHRD_TUNNEL6: "tunnel6",
+    ARPHRD_FRAD: "frad",
+    ARPHRD_SKIP: "skip",
+    ARPHRD_LOOPBACK: "loopback",
+    ARPHRD_LOCALTLK: "ltalk",
+    ARPHRD_FDDI: "fddi",
+    ARPHRD_BIF: "bif",
+    ARPHRD_SIT: "sit",
+    ARPHRD_IPDDP: "ip/ddp",
+    ARPHRD_IPGRE: "gre",
+    ARPHRD_PIMREG: "pimreg",
+    ARPHRD_HIPPI: "hippi",
+    ARPHRD_ASH: "ash",
+    ARPHRD_ECONET: "econet",
+    ARPHRD_IRDA: "irda",
+    ARPHRD_FCPP: "fcpp",
+    ARPHRD_FCAL: "fcal",
+    ARPHRD_FCPL: "fcpl",
+    ARPHRD_FCFABRIC: "fcfb0",
+    ARPHRD_FCFABRIC+1: "fcfb1",
+    ARPHRD_FCFABRIC+2: "fcfb2",
+    ARPHRD_FCFABRIC+3: "fcfb3",
+    ARPHRD_FCFABRIC+4: "fcfb4",
+    ARPHRD_FCFABRIC+5: "fcfb5",
+    ARPHRD_FCFABRIC+6: "fcfb6",
+    ARPHRD_FCFABRIC+7: "fcfb7",
+    ARPHRD_FCFABRIC+8: "fcfb8",
+    ARPHRD_FCFABRIC+9: "fcfb9",
+    ARPHRD_FCFABRIC+10: "fcfb10",
+    ARPHRD_FCFABRIC+11: "fcfb11",
+    ARPHRD_FCFABRIC+12: "fcfb12",
+    ARPHRD_IEEE802_TR: "tr",
+    ARPHRD_IEEE80211: "ieee802.11",
+    ARPHRD_IEEE80211_PRISM: "ieee802.11/prism",
+    ARPHRD_IEEE80211_RADIOTAP: "ieee802.11/radiotap",
+    ARPHRD_IEEE802154: "ieee802.15.4",
+    ARPHRD_IEEE802154_MONITOR: "ieee802.15.4/monitor",
+    ARPHRD_PHONET: "phonet",
+    ARPHRD_PHONET_PIPE: "phonet_pipe",
+    ARPHRD_CAIF: "caif",
+    ARPHRD_IP6GRE: "gre6",
+    ARPHRD_NETLINK: "netlink",
+    ARPHRD_6LOWPAN: "6lowpan",
+    ARPHRD_NONE: "none",
+    ARPHRD_VOID: "void",
+}
\ No newline at end of file
diff --git a/python/vyos/include/uapi/linux/lwtunnel.py b/python/vyos/include/uapi/linux/lwtunnel.py
new file mode 100644
index 000000000..6797a762b
--- /dev/null
+++ b/python/vyos/include/uapi/linux/lwtunnel.py
@@ -0,0 +1,38 @@
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+LWTUNNEL_ENCAP_NONE = 0
+LWTUNNEL_ENCAP_MPLS = 1
+LWTUNNEL_ENCAP_IP = 2
+LWTUNNEL_ENCAP_ILA = 3
+LWTUNNEL_ENCAP_IP6 = 4
+LWTUNNEL_ENCAP_SEG6 = 5
+LWTUNNEL_ENCAP_BPF = 6
+LWTUNNEL_ENCAP_SEG6_LOCAL = 7
+LWTUNNEL_ENCAP_RPL = 8
+LWTUNNEL_ENCAP_IOAM6 = 9
+LWTUNNEL_ENCAP_XFRM = 10
+
+ENCAP_TO_NAME = {
+    LWTUNNEL_ENCAP_MPLS: 'mpls',
+    LWTUNNEL_ENCAP_IP: 'ip',
+    LWTUNNEL_ENCAP_IP6: 'ip6',
+    LWTUNNEL_ENCAP_ILA: 'ila',
+    LWTUNNEL_ENCAP_BPF: 'bpf',
+    LWTUNNEL_ENCAP_SEG6: 'seg6',
+    LWTUNNEL_ENCAP_SEG6_LOCAL: 'seg6local',
+    LWTUNNEL_ENCAP_RPL: 'rpl',
+    LWTUNNEL_ENCAP_IOAM6: 'ioam6',
+    LWTUNNEL_ENCAP_XFRM: 'xfrm',
+}
diff --git a/python/vyos/include/uapi/linux/neighbour.py b/python/vyos/include/uapi/linux/neighbour.py
new file mode 100644
index 000000000..d5caf44b9
--- /dev/null
+++ b/python/vyos/include/uapi/linux/neighbour.py
@@ -0,0 +1,34 @@
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+NTF_USE = (1 << 0)
+NTF_SELF = (1 << 1)
+NTF_MASTER = (1 << 2)
+NTF_PROXY = (1 << 3)
+NTF_EXT_LEARNED = (1 << 4)
+NTF_OFFLOADED = (1 << 5)
+NTF_STICKY = (1 << 6)
+NTF_ROUTER = (1 << 7)
+NTF_EXT_MANAGED = (1 << 0)
+NTF_EXT_LOCKED = (1 << 1)
+
+NTF_FlAGS = {
+    'self': NTF_SELF,
+    'router': NTF_ROUTER,
+    'extern_learn': NTF_EXT_LEARNED,
+    'offload': NTF_OFFLOADED,
+    'master': NTF_MASTER,
+    'sticky': NTF_STICKY,
+    'locked': NTF_EXT_LOCKED,
+}
diff --git a/python/vyos/include/uapi/linux/rtnetlink.py b/python/vyos/include/uapi/linux/rtnetlink.py
new file mode 100644
index 000000000..e31272460
--- /dev/null
+++ b/python/vyos/include/uapi/linux/rtnetlink.py
@@ -0,0 +1,63 @@
+# Copyright (C) 2025 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+RTM_F_NOTIFY = 0x100
+RTM_F_CLONED = 0x200
+RTM_F_EQUALIZE = 0x400
+RTM_F_PREFIX = 0x800
+RTM_F_LOOKUP_TABLE = 0x1000
+RTM_F_FIB_MATCH = 0x2000
+RTM_F_OFFLOAD = 0x4000
+RTM_F_TRAP = 0x8000
+RTM_F_OFFLOAD_FAILED = 0x20000000
+
+RTNH_F_DEAD = 1
+RTNH_F_PERVASIVE = 2
+RTNH_F_ONLINK = 4
+RTNH_F_OFFLOAD = 8
+RTNH_F_LINKDOWN = 16
+RTNH_F_UNRESOLVED = 32
+RTNH_F_TRAP = 64
+
+RT_TABLE_COMPAT = 252
+RT_TABLE_DEFAULT = 253
+RT_TABLE_MAIN = 254
+RT_TABLE_LOCAL = 255
+
+RTAX_FEATURE_ECN = (1 << 0)
+RTAX_FEATURE_SACK = (1 << 1)
+RTAX_FEATURE_TIMESTAMP = (1 << 2)
+RTAX_FEATURE_ALLFRAG = (1 << 3)
+RTAX_FEATURE_TCP_USEC_TS = (1 << 4)
+
+RT_FlAGS = {
+    'dead': RTNH_F_DEAD,
+    'onlink': RTNH_F_ONLINK,
+    'pervasive':  RTNH_F_PERVASIVE,
+    'offload': RTNH_F_OFFLOAD,
+    'trap': RTNH_F_TRAP,
+    'notify': RTM_F_NOTIFY,
+    'linkdown': RTNH_F_LINKDOWN,
+    'unresolved': RTNH_F_UNRESOLVED,
+    'rt_offload': RTM_F_OFFLOAD,
+    'rt_trap': RTM_F_TRAP,
+    'rt_offload_failed': RTM_F_OFFLOAD_FAILED,
+}
+
+RT_TABLE_TO_NAME = {
+    RT_TABLE_COMPAT: 'compat',
+    RT_TABLE_DEFAULT: 'default',
+    RT_TABLE_MAIN: 'main',
+    RT_TABLE_LOCAL: 'local',
+}