Merge branch 'vyos:equuleus' into equuleus

18 files changed, 299 insertions, 223 deletions

diff --git a/data/templates/accel-ppp/l2tp.config.tmpl b/data/templates/accel-ppp/l2tp.config.tmpl
index 070a966b7..a2a2382fa 100644
--- a/data/templates/accel-ppp/l2tp.config.tmpl
+++ b/data/templates/accel-ppp/l2tp.config.tmpl
@@ -57,6 +57,9 @@ bind={{ outside_addr }}
 {% if lns_shared_secret %}
 secret={{ lns_shared_secret }}
 {% endif %}
+{% if lns_host_name %}
+host-name={{ lns_host_name }}
+{% endif %}
 
 [client-ip-range]
 0.0.0.0/0
diff --git a/data/templates/accel-ppp/pptp.config.tmpl b/data/templates/accel-ppp/pptp.config.tmpl
index 5a6cfe749..3cfc4a906 100644
--- a/data/templates/accel-ppp/pptp.config.tmpl
+++ b/data/templates/accel-ppp/pptp.config.tmpl
@@ -2,12 +2,13 @@
 [modules]
 log_syslog
 pptp
-ippool
+shaper
 {% if auth_mode == 'local' %}
 chap-secrets
 {% elif auth_mode == 'radius' %}
 radius
 {% endif %}
+ippool
 {% for proto in auth_proto %}
 {{proto}}
 {% endfor %}
@@ -87,6 +88,10 @@ nas-ip-address={{ radius_nas_ip }}
 bind={{ radius_source_address }}
 {% endif %}
 {% endif %}
+{# Both chap-secrets and radius block required the gw-ip-address #}
+{% if gw_ip is defined and gw_ip is not none %}
+gw-ip-address={{ gw_ip }}
+{% endif %}
 
 [cli]
 tcp=127.0.0.1:2003
diff --git a/data/templates/accel-ppp/sstp.config.tmpl b/data/templates/accel-ppp/sstp.config.tmpl
index 7ca7b1c1e..7a40a96aa 100644
--- a/data/templates/accel-ppp/sstp.config.tmpl
+++ b/data/templates/accel-ppp/sstp.config.tmpl
@@ -29,7 +29,9 @@ disable
 verbose=1
 ifname=sstp%d
 accept=ssl
+{% if ssl.ca_cert_file is defined and ssl.ca_cert_file is not none %}
 ssl-ca-file={{ ssl.ca_cert_file }}
+{% endif %}
 ssl-pemfile={{ ssl.cert_file }}
 ssl-keyfile={{ ssl.key_file }}
 
@@ -50,9 +52,9 @@ verbose=1
 check-ip=1
 {# MTU #}
 mtu={{ mtu }}
-{% if client_ipv6_pool is defined %}
-ipv6=allow
-{% endif %}
+ipv6={{ 'allow' if ppp_options.ipv6 == "deny" and client_ipv6_pool is defined else ppp_options.ipv6 }}
+ipv4={{ ppp_options.ipv4 }}
+
 mppe={{ ppp_options.mppe }}
 lcp-echo-interval={{ ppp_options.lcp_echo_interval }}
 lcp-echo-timeout={{ ppp_options.lcp_echo_timeout }}
diff --git a/data/templates/conserver/dropbear@.service.tmpl b/data/templates/conserver/dropbear@.service.tmpl
index 4bb73f751..e355dab43 100644
--- a/data/templates/conserver/dropbear@.service.tmpl
+++ b/data/templates/conserver/dropbear@.service.tmpl
@@ -1,4 +1,4 @@
 [Service]
 ExecStart=
-ExecStart=/usr/sbin/dropbear -w -j -k -r /etc/dropbear/dropbear_rsa_host_key -c "/usr/bin/console {{ device }}" -P /run/conserver/dropbear.%I.pid -p %I
+ExecStart=/usr/sbin/dropbear -w -j -k -r /etc/dropbear/dropbear_rsa_host_key -b /etc/issue.net -c "/usr/bin/console {{ device }}" -P /run/conserver/dropbear.%I.pid -p %I
 PIDFile=/run/conserver/dropbear.%I.pid
diff --git a/data/templates/dhcp-client/ipv4.tmpl b/data/templates/dhcp-client/ipv4.tmpl
index c934b7cdb..fcc2846a5 100644
--- a/data/templates/dhcp-client/ipv4.tmpl
+++ b/data/templates/dhcp-client/ipv4.tmpl
@@ -2,7 +2,8 @@
 
 option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;
 timeout 60;
-retry 300;
+retry 60;
+initial-interval 2;
 
 interface "{{ ifname }}" {
     send host-name "{{ dhcp_options.host_name }}";
diff --git a/data/templates/dhcp-server/dhcpd.conf.tmpl b/data/templates/dhcp-server/dhcpd.conf.tmpl
index ff2e31998..233e2cc53 100644
--- a/data/templates/dhcp-server/dhcpd.conf.tmpl
+++ b/data/templates/dhcp-server/dhcpd.conf.tmpl
@@ -8,16 +8,12 @@
 on release {
     set ClientName = pick-first-value(host-decl-name, option fqdn.hostname, option host-name);
     set ClientIp = binary-to-ascii(10, 8, ".",leased-address);
-    set ClientMac = binary-to-ascii(16, 8, ":",substring(hardware, 1, 6));
-    set ClientDomain = pick-first-value(config-option domain-name, "..YYZ!");
-    execute("/usr/libexec/vyos/system/on-dhcp-event.sh", "release", ClientName, ClientIp, ClientMac, ClientDomain);
+    execute("/usr/libexec/vyos/system/on-dhcp-event.sh", "release", "", ClientIp, "", "");
 }
 on expiry {
     set ClientName = pick-first-value(host-decl-name, option fqdn.hostname, option host-name);
     set ClientIp = binary-to-ascii(10, 8, ".",leased-address);
-    set ClientMac = binary-to-ascii(16, 8, ":",substring(hardware, 1, 6));
-    set ClientDomain = pick-first-value(config-option domain-name, "..YYZ!");
-    execute("/usr/libexec/vyos/system/on-dhcp-event.sh", "release", ClientName, ClientIp, ClientMac, ClientDomain);
+    execute("/usr/libexec/vyos/system/on-dhcp-event.sh", "release", "", ClientIp, "", "");
 }
 {% endif %}
 
@@ -35,32 +31,24 @@ option wpad-url code 252 = text;
 {%   endfor %}
 
 {% endif %}
-{% if shared_network_name is defined and shared_network_name is not none %}
-{%   for network, network_config in shared_network_name.items() if network_config.disable is not defined %}
-{%     if network_config.subnet is defined and network_config.subnet is not none %}
-{%       for subnet, subnet_config in network_config.subnet.items() %}
-{%         if subnet_config.failover is defined and subnet_config.failover is defined and subnet_config.failover.name is defined and subnet_config.failover.name is not none %}
-# Failover configuration for {{ subnet }}
-failover peer "{{ subnet_config.failover.name }}" {
-{%           if subnet_config.failover.status == 'primary' %}
+{% if failover is defined and failover is not none %}
+# DHCP failover configuration
+failover peer "{{ failover.name }}" {
+{%   if failover.status == 'primary' %}
     primary;
     mclt 1800;
     split 128;
-{%           elif subnet_config.failover.status == 'secondary' %}
+{%   elif failover.status == 'secondary' %}
     secondary;
-{%           endif %}
-    address {{ subnet_config.failover.local_address }};
+{%   endif %}
+    address {{ failover.source_address }};
     port 520;
-    peer address {{ subnet_config.failover.peer_address }};
+    peer address {{ failover.remote }};
     peer port 520;
     max-response-delay 30;
     max-unacked-updates 10;
     load balance max seconds 3;
 }
-{%         endif %}
-{%       endfor %}
-{%     endif %}
-{%   endfor %}
 {% endif %}
 {% if listen_address is defined and listen_address is not none %}
 
@@ -78,6 +66,21 @@ shared-network {{ network | replace('_','-') }} {
 {%     if network_config.authoritative is defined %}
     authoritative;
 {%     endif %}
+{%     if network_config.name_server is defined and network_config.name_server is not none %}
+    option domain-name-servers {{ network_config.name_server | join(', ') }};
+{%     endif %}
+{%     if network_config.domain_name is defined and network_config.domain_name is not none %}
+    option domain-name "{{ network_config.domain_name }}";
+{%     endif %}
+{%     if network_config.domain_search is defined and network_config.domain_search is not none %}
+    option domain-search "{{ network_config.domain_search | join('", "') }}";
+{%     endif %}
+{%     if network_config.ntp_server is defined and network_config.ntp_server is not none %}
+    option ntp-servers {{ network_config.ntp_server | join(', ') }};
+{%     endif %}
+{%     if network_config.ping_check is defined %}
+    ping-check true;
+{%     endif %}
 {%     if network_config.shared_network_parameters is defined and network_config.shared_network_parameters is not none %}
     # The following {{ network_config.shared_network_parameters | length }} line(s)
     # were added as shared-network-parameters in the CLI and have not been validated
@@ -87,9 +90,15 @@ shared-network {{ network | replace('_','-') }} {
 {%     endif %}
 {%     if network_config.subnet is defined and network_config.subnet is not none %}
 {%       for subnet, subnet_config in network_config.subnet.items() %}
+{%         if subnet_config.description is defined and subnet_config.description is not none %}
+    # {{ subnet_config.description }}
+{%         endif %}
     subnet {{ subnet | address_from_cidr }} netmask {{ subnet | netmask_from_cidr }} {
-{%         if subnet_config.dns_server is defined and subnet_config.dns_server is not none %}
-        option domain-name-servers {{ subnet_config.dns_server | join(', ') }};
+{%         if subnet_config.name_server is defined and subnet_config.name_server is not none %}
+        option domain-name-servers {{ subnet_config.name_server | join(', ') }};
+{%         endif %}
+{%         if subnet_config.domain_name is defined and subnet_config.domain_name is not none %}
+        option domain-name "{{ subnet_config.domain_name }}";
 {%         endif %}
 {%         if subnet_config.domain_search is defined and subnet_config.domain_search is not none %}
         option domain-search "{{ subnet_config.domain_search | join('", "') }}";
@@ -114,9 +123,13 @@ shared-network {{ network | replace('_','-') }} {
 {%           if subnet_config.default_router and subnet_config.default_router is not none %}
 {%             set static_default_route = ', ' + '0.0.0.0/0' | isc_static_route(subnet_config.default_router) %}
 {%           endif %}
-{%           if subnet_config.static_route.router is defined and subnet_config.static_route.router is not none and subnet_config.static_route.destination_subnet is defined and subnet_config.static_route.destination_subnet is not none %}
-        option rfc3442-static-route {{ subnet_config.static_route.destination_subnet | isc_static_route(subnet_config.static_route.router) }}{{ static_default_route }};
-        option windows-static-route {{ subnet_config.static_route.destination_subnet | isc_static_route(subnet_config.static_route.router) }};
+{%           if subnet_config.static_route is defined and subnet_config.static_route is not none %}
+{%           set rfc3442_routes = [] %}
+{%           for route, route_options in subnet_config.static_route.items() %}
+{%             set rfc3442_routes = rfc3442_routes.append(route | isc_static_route(route_options.next_hop)) %}
+{%           endfor %}
+        option rfc3442-static-route {{ rfc3442_routes | join(', ') }}{{ static_default_route }};
+        option windows-static-route {{ rfc3442_routes | join(', ') }};
 {%           endif %}
 {%         endif %}
 {%         if subnet_config.ip_forwarding is defined %}
@@ -128,9 +141,6 @@ shared-network {{ network | replace('_','-') }} {
 {%         if subnet_config.server_identifier is defined and subnet_config.server_identifier is not none %}
         option dhcp-server-identifier {{ subnet_config.server_identifier }};
 {%         endif %}
-{%         if subnet_config.domain_name is defined and subnet_config.domain_name is not none %}
-        option domain-name "{{ subnet_config.domain_name }}";
-{%         endif %}
 {%         if subnet_config.subnet_parameters is defined and subnet_config.subnet_parameters is not none %}
         # The following {{ subnet_config.subnet_parameters | length }} line(s) were added as
         # subnet-parameters in the CLI and have not been validated!!!
@@ -161,6 +171,9 @@ shared-network {{ network | replace('_','-') }} {
         default-lease-time {{ subnet_config.lease }};
         max-lease-time {{ subnet_config.lease }};
 {%         endif %}
+{%         if network_config.ping_check is not defined and subnet_config.ping_check is defined %}
+        ping-check true;
+{%         endif %}
 {%         if subnet_config.static_mapping is defined and subnet_config.static_mapping is not none %}
 {%           for host, host_config in subnet_config.static_mapping.items() if host_config.disable is not defined %}
         host {{ host | replace('_','-') if host_decl_name is defined else network | replace('_','-') + '_' + host | replace('_','-') }} {
@@ -178,22 +191,22 @@ shared-network {{ network | replace('_','-') }} {
         }
 {%           endfor %}
 {%         endif %}
-{%         if subnet_config.failover is defined and subnet_config.failover.name is defined and subnet_config.failover.name is not none %}
+{%         if subnet_config.range is defined and subnet_config.range is not none %}
+{#           pool configuration can only be used if there follows a range option #}
         pool {
-            failover peer "{{ subnet_config.failover.name }}";
+{%         endif %}
+{%         if subnet_config.enable_failover is defined %}
+            failover peer "{{ failover.name }}";
             deny dynamic bootp clients;
+{%         endif %}
 {%           if subnet_config.range is defined and subnet_config.range is not none %}
 {%             for range, range_options in subnet_config.range.items() %}
             range {{ range_options.start }} {{ range_options.stop }};
 {%             endfor %}
 {%           endif %}
+{%         if subnet_config.range is defined and subnet_config.range is not none %}
+{#           pool configuration can only be used if there follows a range option #}
         }
-{%         else %}
-{%           if subnet_config.range is defined and subnet_config.range is not none %}
-{%             for range, range_options in subnet_config.range.items() %}
-        range {{ range_options.start }} {{ range_options.stop }};
-{%             endfor %}
-{%           endif %}
 {%         endif %}
     }
 {%       endfor %}
@@ -201,11 +214,15 @@ shared-network {{ network | replace('_','-') }} {
     on commit {
         set shared-networkname = "{{ network | replace('_','-') }}";
 {%     if hostfile_update is defined %}
-        set ClientName = pick-first-value(host-decl-name, option fqdn.hostname, option host-name);
         set ClientIp = binary-to-ascii(10, 8, ".", leased-address);
         set ClientMac = binary-to-ascii(16, 8, ":", substring(hardware, 1, 6));
-        set ClientDomain = pick-first-value(config-option domain-name, "..YYZ!");
-        execute("/usr/libexec/vyos/system/on-dhcp-event.sh", "commit", ClientName, ClientIp, ClientMac, ClientDomain);
+        set ClientName = pick-first-value(host-decl-name, option fqdn.hostname, option host-name, "empty_hostname");
+        if not (ClientName = "empty_hostname") {
+            set ClientDomain = pick-first-value(config-option domain-name, "..YYZ!");
+            execute("/usr/libexec/vyos/system/on-dhcp-event.sh", "commit", ClientName, ClientIp, ClientMac, ClientDomain);
+        } else {
+            log(concat("Hostname is not defined for client with IP: ", ClientIP, " MAC: ", ClientMac));
+        }
 {%     endif %}
     }
 }
diff --git a/data/templates/dns-forwarding/recursor.conf.tmpl b/data/templates/dns-forwarding/recursor.conf.tmpl
index 8799718b0..be0778993 100644
--- a/data/templates/dns-forwarding/recursor.conf.tmpl
+++ b/data/templates/dns-forwarding/recursor.conf.tmpl
@@ -10,8 +10,7 @@ threads=1
 allow-from={{ allow_from | join(',') }}
 log-common-errors=yes
 non-local-bind=yes
-query-local-address={{ source_address_v4 | join(',') }}
-query-local-address6={{ source_address_v6 | join(',') }}
+query-local-address={{ source_address | join(',') }}
 lua-config-file=recursor.conf.lua
 
 # cache-size
@@ -29,5 +28,14 @@ local-address={{ listen_address | join(',') }}
 # dnssec
 dnssec={{ dnssec }}
 
+{# dns: T3277: #}
+{% if no_serve_rfc1918 is defined %}
+# serve-rfc1918
+serve-rfc1918=no
+{% else %}
+# serve-rfc1918
+serve-rfc1918=yes
+{% endif %}
+
 forward-zones-file=recursor.forward-zones.conf
 
diff --git a/data/templates/frr/isisd.frr.tmpl b/data/templates/frr/isisd.frr.tmpl
index 8a813d9cb..6cfa076d0 100644
--- a/data/templates/frr/isisd.frr.tmpl
+++ b/data/templates/frr/isisd.frr.tmpl
@@ -1,5 +1,5 @@
 !
-router isis {{ process }}
+router isis VyOS {{ 'vrf ' + vrf if vrf is defined and vrf is not none }}
  net {{ net }}
 {% if dynamic_hostname is defined %}
  hostname dynamic
@@ -13,8 +13,15 @@ router isis {{ process }}
 {% if set_overload_bit is defined %}
  set-overload-bit
 {% endif %}
-{% if domain_password is defined and domain_password.plaintext_password is defined and domain_password.plaintext_password is not none %}
+{% if domain_password is defined and domain_password is not none %}
+{%   if domain_password.md5 is defined and domain_password.md5 is not none %}
+ domain-password md5 {{ domain_password.plaintext_password }}
+{%   elif domain_password.plaintext_password is defined and domain_password.plaintext_password is not none %}
  domain-password clear {{ domain_password.plaintext_password }}
+{%   endif %}
+{% endif %}
+{% if log_adjacency_changes is defined %}
+ log-adjacency-changes
 {% endif %}
 {% if lsp_gen_interval is defined and lsp_gen_interval is not none %}
  lsp-gen-interval {{ lsp_gen_interval }}
@@ -95,47 +102,61 @@ router isis {{ process }}
 {% if spf_delay_ietf is defined and spf_delay_ietf.init_delay is defined and spf_delay_ietf.init_delay is not none %}
  spf-delay-ietf init-delay {{ spf_delay_ietf.init_delay }}
 {% endif %}
-{% if area_password is defined and area_password.md5 is defined and area_password.md5 is not none %}
+{% if area_password is defined and area_password is not none %}
+{%   if area_password.md5 is defined and area_password.md5 is not none %}
  area-password md5 {{ area_password.md5 }}
-{% elif area_password is defined and area_password.plaintext_password is defined and area_password.plaintext_password is not none %}
+{%   elif area_password.plaintext_password is defined and area_password.plaintext_password is not none %}
  area-password clear {{ area_password.plaintext_password }}
+{%   endif %}
 {% endif %}
 {% if default_information is defined and default_information.originate is defined and default_information.originate is not none %}
-{%   for level in default_information.originate.ipv4 if default_information.originate.ipv4 is defined %}
- default-information originate ipv4 {{ level | replace('_', '-') }}
-{%   endfor %}
-{%   for level in default_information.originate.ipv6 if default_information.originate.ipv6 is defined %}
- default-information originate ipv6 {{ level | replace('_', '-') }} always
+{%   for afi, afi_config in default_information.originate.items() %}
+{%     for level, level_config in afi_config.items() %}
+ default-information originate {{ afi }} {{ level | replace('_', '-') }} {{ 'always' if level_config.always is defined }} {{ 'route-map ' ~ level_config.route_map if level_config.route_map is defined }} {{ 'metric ' ~ level_config.metric if level_config.metric is defined }}
+{%     endfor %}
 {%   endfor %}
 {% endif %}
-{% if redistribute is defined and redistribute.ipv4 is defined and redistribute.ipv4 is not none %}
-{%   for protocol in redistribute.ipv4 %}
-{%     for level, level_config in redistribute.ipv4[protocol].items() %}
-{%       if level_config.metric is defined and level_config.metric is not none %}
+{% if redistribute is defined %}
+{%   if redistribute.ipv4 is defined and redistribute.ipv4 is not none %}
+{%     for protocol, protocol_options in redistribute.ipv4.items() %}
+{%       for level, level_config in protocol_options.items() %}
+{%         if level_config.metric is defined and level_config.metric is not none %}
  redistribute ipv4 {{ protocol }} {{ level | replace('_', '-') }} metric {{ level_config.metric }}
-{%       elif level_config.route_map is defined and level_config.route_map is not none %}
+{%         elif level_config.route_map is defined and level_config.route_map is not none %}
  redistribute ipv4 {{ protocol }} {{ level | replace('_', '-') }} route-map {{ level_config.route_map }}
-{%       else %}
+{%         else %}
  redistribute ipv4 {{ protocol }} {{ level | replace('_', '-') }}
-{%       endif %}
+{%         endif %}
+{%       endfor %}
 {%     endfor %}
-{%   endfor %}
+{%   endif %}
+{%   if redistribute.ipv6 is defined and redistribute.ipv6 is not none %}
+{%     for protocol, protocol_options in redistribute.ipv6.items() %}
+{%       for level, level_config in protocol_options.items() %}
+{%         if level_config.metric is defined and level_config.metric is not none %}
+ redistribute ipv6 {{ protocol }} {{ level | replace('_', '-') }} metric {{ level_config.metric }}
+{%         elif level_config.route_map is defined and level_config.route_map is not none %}
+ redistribute ipv6 {{ protocol }} {{ level | replace('_', '-') }} route-map {{ level_config.route_map }}
+{%         else %}
+ redistribute ipv6 {{ protocol }} {{ level | replace('_', '-') }}
+{%         endif %}
+{%       endfor %}
+{%     endfor %}
+{%   endif %}
 {% endif %}
 {% if level is defined and level is not none %}
-{%   if level == 'level-1' %}
- is-type level-1
-{%   elif level == 'level-2'  %}
+{%   if level == 'level-2'  %}
  is-type level-2-only
-{%   elif level == 'level-1-2'  %}
- is-type level-1-2
+{%   else %}
+ is-type {{ level }}
 {%   endif %}
 {% endif %}
 !
 {% if interface is defined and interface is not none %}
 {%   for iface, iface_config in interface.items() %}
-interface {{ iface }}
- ip router isis {{ process }}
- ipv6 router isis {{ process }}
+interface {{ iface }} {{ 'vrf ' + vrf if vrf is defined and vrf is not none }}
+ ip router isis VyOS
+ ipv6 router isis VyOS
 {%     if iface_config.bfd is defined %}
  isis bfd
 {%     endif %}
@@ -174,3 +195,4 @@ interface {{ iface }}
 {%     endif %}
 {%   endfor %}
 {% endif %}
+!
\ No newline at end of file
diff --git a/data/templates/frr/route-map.frr.tmpl b/data/templates/frr/route-map.frr.tmpl
new file mode 100644
index 000000000..6b33cc126
--- /dev/null
+++ b/data/templates/frr/route-map.frr.tmpl
@@ -0,0 +1,5 @@
+!
+{% if route_map is defined and route_map is not none %}
+ip protocol {{ protocol }} route-map {{ route_map }}
+{% endif %}
+!
diff --git a/data/templates/https/nginx.default.tmpl b/data/templates/https/nginx.default.tmpl
index 4aaf0132f..d25e5193a 100644
--- a/data/templates/https/nginx.default.tmpl
+++ b/data/templates/https/nginx.default.tmpl
@@ -38,11 +38,14 @@ server {
         #
         include snippets/snakeoil.conf;
 {% endif %}
+        ssl_protocols TLSv1.2 TLSv1.3;
 
         # proxy settings for HTTP API, if enabled; 503, if not
-        location ~ /(retrieve|configure|config-file|image|generate|show) {
+        location ~ /(retrieve|configure|config-file|image|generate|show|docs|openapi.json|redoc|graphql) {
 {% if server.api %}
                 proxy_pass http://localhost:{{ server.api.port }};
+                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
                 proxy_read_timeout 600;
                 proxy_buffering off;
 {% else %}
diff --git a/data/templates/lcd/LCDd.conf.tmpl b/data/templates/lcd/LCDd.conf.tmpl
index 6cf6a440f..2c7ad920f 100644
--- a/data/templates/lcd/LCDd.conf.tmpl
+++ b/data/templates/lcd/LCDd.conf.tmpl
@@ -53,6 +53,8 @@ DriverPath=/usr/lib/x86_64-linux-gnu/lcdproc/
 Driver=CFontzPacket
 {%   elif model == 'sdec' %}
 Driver=sdeclcd
+{%   elif model == 'hd44780' %}
+Driver=hd44780
 {%   endif %}
 {% endif %}
 
@@ -128,5 +130,10 @@ USB=yes
 ## SDEC driver for Lanner, Watchguard, Sophos sppliances ##
 [sdeclcd]
 # No options
+{%   elif model == 'hd44780' %}
+[hd44780]
+ConnectionType=ezio
+Device={{ device }}
+Size=16x2
 {%   endif %}
 {% endif %}
diff --git a/data/templates/ntp/ntpd.conf.tmpl b/data/templates/ntp/ntpd.conf.tmpl
index 2b56b53c3..38e68f24f 100644
--- a/data/templates/ntp/ntpd.conf.tmpl
+++ b/data/templates/ntp/ntpd.conf.tmpl
@@ -6,6 +6,8 @@
 driftfile /var/lib/ntp/ntp.drift
 # By default, only allow ntpd to query time sources, ignore any incoming requests
 restrict default noquery nopeer notrap nomodify
+# Allow pool associations
+restrict source nomodify notrap noquery
 # Local users have unrestricted access, allowing reconfiguration via ntpdc
 restrict 127.0.0.1
 restrict -6 ::1
diff --git a/data/templates/openvpn/server.conf.tmpl b/data/templates/openvpn/server.conf.tmpl
index c5d665c0b..c2b0c2ef9 100644
--- a/data/templates/openvpn/server.conf.tmpl
+++ b/data/templates/openvpn/server.conf.tmpl
@@ -7,8 +7,6 @@
 #
 
 verb 3
-user {{ daemon_user }}
-group {{ daemon_group }}
 dev-type {{ device_type }}
 dev {{ ifname }}
 persist-key
@@ -74,6 +72,16 @@ topology {{ server.topology }}
 {%       for subnet in server.subnet %}
 {%         if subnet | is_ipv4 %}
 server {{ subnet | address_from_cidr }} {{ subnet | netmask_from_cidr }} nopool
+{# First ip address is used as gateway. It's allows to use metrics #}
+{%     if server.push_route is defined and server.push_route is not none %}
+{%       for route, route_config in server.push_route.items() %}
+{%         if route | is_ipv4 %}
+push "route {{ route | address_from_cidr }} {{ route | netmask_from_cidr }}{% if route_config.metric is defined %} {{ subnet | first_host_address }} {{ route_config.metric }}{% endif %}"
+{%         elif route | is_ipv6 %}
+push "route-ipv6 {{ route }}"
+{%         endif %}
+{%       endfor %}
+{%     endif %}
 {# OpenVPN assigns the first IP address to its local interface so the pool used #}
 {# in net30 topology - where each client receives a /30 must start from the second subnet #}
 {%           if server.topology is defined and server.topology == 'net30' %}
@@ -106,15 +114,6 @@ management /run/openvpn/openvpn-mgmt-intf unix
 ccd-exclusive
 {%     endif %}
 
-{%     if server.push_route is defined and server.push_route is not none %}
-{%       for route in server.push_route %}
-{%         if route | is_ipv4 %}
-push "route {{ route | address_from_cidr }} {{ route | netmask_from_cidr }}"
-{%         elif route | is_ipv6 %}
-push "route-ipv6 {{ route }}"
-{%         endif %}
-{%       endfor %}
-{%     endif %}
 {%     if server.name_server is defined and server.name_server is not none %}
 {%       for nameserver in server.name_server %}
 {%         if nameserver | is_ipv4 %}
@@ -258,16 +257,3 @@ auth {{ hash }}
 auth-user-pass {{ auth_user_pass_file }}
 auth-retry nointeract
 {% endif %}
-
-{% if openvpn_option is defined and openvpn_option is not none %}
-#
-# Custom options added by user (not validated)
-#
-{%   for option in openvpn_option %}
-{%     for argument in option.split('--') %}
-{%       if argument is defined and argument != '' %}
---{{ argument }}
-{%       endif %}
-{%     endfor %}
-{%   endfor %}
-{% endif %}
diff --git a/data/templates/openvpn/service-override.conf.tmpl b/data/templates/openvpn/service-override.conf.tmpl
new file mode 100644
index 000000000..069bdbd08
--- /dev/null
+++ b/data/templates/openvpn/service-override.conf.tmpl
@@ -0,0 +1,20 @@
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/openvpn --daemon openvpn-%i --config %i.conf --status %i.status 30 --writepid %i.pid
+{%- if openvpn_option is defined and openvpn_option is not none %}
+{%   for option in openvpn_option %}
+{#     Remove the '--' prefix from variable if it is presented #}
+{%     if option.startswith('--') %}
+{%       set option = option.split('--', maxsplit=1)[1] %}
+{%     endif %}
+{#     Workaround to pass '--push' options properly. Previously openvpn accepted this option without values in double-quotes #}
+{#     But now it stopped doing this, so we need to add them for compatibility #}
+{#     HOWEVER! This is a raw option and we do not promise that this or any other trick will work for all the cases. #}
+{#     Using 'openvpn-option' you take all responsibility for compatibility for yourself. #}
+{%     if option.startswith('push') and not (option.startswith('push "') and option.endswith('"')) %}
+{%       set option = 'push \"%s\"'|format(option.split('push ', maxsplit=1)[1]) %}
+{%     endif %}
+ --{{ option }}
+{%-   endfor %}
+{% endif %}
+
diff --git a/data/templates/pppoe/peer.tmpl b/data/templates/pppoe/peer.tmpl
index 0f78f9384..f416f9947 100644
--- a/data/templates/pppoe/peer.tmpl
+++ b/data/templates/pppoe/peer.tmpl
@@ -1,8 +1,5 @@
 ### Autogenerated by interfaces-pppoe.py ###
-
-{% if description %}
-# {{ description }}
-{% endif %}
+{{ '# ' ~ description if description is defined else '' }}
 
 # Require peer to provide the local IP address if it is not
 # specified explicitly in the config file.
@@ -37,8 +34,14 @@ noproxyarp
 # Unlimited connection attempts
 maxfail 0
 
-plugin rp-pppoe.so
-{{ source_interface }}
+plugin rp-pppoe.so {{ source_interface }}
+{% if access_concentrator is defined and access_concentrator is not none %}
+rp_pppoe_ac '{{ access_concentrator }}'
+{% endif %}
+{% if service_name is defined and service_name is not none %}
+rp_pppoe_service '{{ service_name }}'
+{% endif %}
+
 persist
 ifname {{ ifname }}
 ipparam {{ ifname }}
@@ -60,10 +63,6 @@ ipv6cp-use-ipaddr
 {%   endif %}
 {% endif %}
 
-{% if service_name is defined %}
-rp_pppoe_service "{{ service_name }}"
-{% endif %}
-
 {% if connect_on_demand is defined %}
 demand
 # See T2249. PPP default route options should only be set when in on-demand
diff --git a/data/templates/syslog/rsyslog.conf.tmpl b/data/templates/syslog/rsyslog.conf.tmpl
index 10fbb9d3c..e25ef48d4 100644
--- a/data/templates/syslog/rsyslog.conf.tmpl
+++ b/data/templates/syslog/rsyslog.conf.tmpl
@@ -2,47 +2,47 @@
 ## file based logging
 {% if files['global']['marker'] %}
 $ModLoad immark
-{% if files['global']['marker-interval'] %}
+{%   if files['global']['marker-interval'] %}
 $MarkMessagePeriod  {{files['global']['marker-interval']}}
-{% endif %}
+{%   endif %}
 {% endif %}
 {% if files['global']['preserver_fqdn'] %}
 $PreserveFQDN on
 {% endif %}
-{% for file in files %}
-$outchannel {{file}},{{files[file]['log-file']}},{{files[file]['max-size']}},{{files[file]['action-on-max-size']}}
-{{files[file]['selectors']}} :omfile:${{file}}
+{% for file, file_options in files.items() %}
+$outchannel {{ file }},{{ file_options['log-file'] }},{{ file_options['max-size'] }},{{ file_options['action-on-max-size'] }}
+{{ file_options['selectors'] }} :omfile:${{ file }}
 {% endfor %}
-{% if console %}
+{% if console is defined and console is not none %}
 ## console logging
-{% for con in console %}
-{{console[con]['selectors']}} /dev/console
-{% endfor %}
+{%   for con, con_options in console.items() %}
+{{ con_options['selectors'] }} /dev/console
+{%   endfor %}
 {% endif %}
-{% if hosts %}
+{% if hosts is defined and hosts is not none %}
 ## remote logging
-{% for host in hosts %}
-{%   if hosts[host]['proto'] == 'tcp' %}
-{%     if hosts[host]['port'] %}
-{%       if hosts[host]['oct_count'] %}
-{{hosts[host]['selectors']}} @@(o){{host}}:{{hosts[host]['port']}};RSYSLOG_SyslogProtocol23Format
+{%   for host, host_options in hosts.items() %}
+{%     if host_options.proto == 'tcp' %}
+{%       if host_options.port is defined %}
+{%         if host_options.oct_count is defined %}
+{{ host_options.selectors }} @@(o){{ host }}:{{ host_options.port }};RSYSLOG_SyslogProtocol23Format
+{%         else %}
+{{ host_options.selectors }} @@{{ host }}:{{ host_options.port }}
+{%         endif %}
 {%       else %}
-{{hosts[host]['selectors']}} @@{{host}}:{{hosts[host]['port']}}
+{{ host_options.selectors }} @@{{ host }}
 {%       endif %}
 {%     else %}
-{{hosts[host]['selectors']}} @@{{host}}
-{%     endif %}
-{%   else %}
-{%     if hosts[host]['port'] %}
-{{hosts[host]['selectors']}} @{{host}}:{{hosts[host]['port']}}
-{%     else %}
-{{hosts[host]['selectors']}} @{{host}}
+{%       if host_options['port'] %}
+{{ host_options.selectors }} @{{ host | bracketize_ipv6 }}:{{ host_options.port }}
+{%       else %}
+{{ host_options.selectors }} @{{ host | bracketize_ipv6 }}
+{%       endif %}
 {%     endif %}
-{%   endif %}
-{% endfor %}
+{%   endfor %}
 {% endif %}
-{% if user %}
-{% for u in user %}
-{{user[u]['selectors']}} :omusrmsg:{{u}}
-{% endfor %}
+{% if user is defined and user is not none %}
+{%   for username, user_options in user.items() %}
+{{ user_options.selectors }} :omusrmsg:{{ username }}
+{%   endfor %}
 {% endif %}
diff --git a/data/templates/vrrp/daemon.tmpl b/data/templates/vrrp/daemon.tmpl
deleted file mode 100644
index c9dbea72d..000000000
--- a/data/templates/vrrp/daemon.tmpl
+++ /dev/null
@@ -1,5 +0,0 @@
-# Autogenerated by VyOS
-# Options to pass to keepalived
-
-# DAEMON_ARGS are appended to the keepalived command-line
-DAEMON_ARGS="--snmp"
diff --git a/data/templates/vrrp/keepalived.conf.tmpl b/data/templates/vrrp/keepalived.conf.tmpl
index d51522e45..7b8f7cb09 100644
--- a/data/templates/vrrp/keepalived.conf.tmpl
+++ b/data/templates/vrrp/keepalived.conf.tmpl
@@ -5,101 +5,102 @@
 global_defs {
     dynamic_interfaces
     script_user root
-    notify_fifo /run/keepalived_notify_fifo
+    # Don't run scripts configured to be run as root if any part of the path
+    # is writable by a non-root user.
+    enable_script_security
+    notify_fifo /run/keepalived/keepalived_notify_fifo
     notify_fifo_script /usr/libexec/vyos/system/keepalived-fifo.py
 }
 
-{% for group in groups %}
-
-{% if group.health_check_script %}
-vrrp_script healthcheck_{{ group.name }} {
-    script "{{ group.health_check_script }}"
-    interval {{ group.health_check_interval }}
-    fall {{ group.health_check_count }}
+{% if group is defined and group is not none %}
+{%   for name, group_config in group.items() if group_config.disable is not defined %}
+{%     if group_config.health_check is defined and group_config.health_check.script is defined and group_config.health_check.script is not none %}
+vrrp_script healthcheck_{{ name }} {
+    script "{{ group_config.health_check.script }}"
+    interval {{ group_config.health_check.interval }}
+    fall {{ group_config.health_check.failure_count }}
     rise 1
-
 }
-{% endif %}
-
-vrrp_instance {{ group.name }} {
-    {% if group.description %}
-    # {{ group.description }}
-    {% endif %}
-
+{%     endif %}
+vrrp_instance {{ name }} {
+{%     if group_config.description is defined and group_config.description is not none %}
+    # {{ group_config.description }}
+{%     endif %}
     state BACKUP
-    interface {{ group.interface }}
-    virtual_router_id {{ group.vrid }}
-    priority {{ group.priority }}
-    advert_int {{ group.advertise_interval }}
-
-    {% if group.preempt %}
-    preempt_delay {{ group.preempt_delay }}
-    {% else %}
+    interface {{ group_config.interface }}
+    virtual_router_id {{ group_config.vrid }}
+    priority {{ group_config.priority }}
+    advert_int {{ group_config.advertise_interval }}
+{%     if group_config.no_preempt is not defined and group_config.preempt_delay is defined and group_config.preempt_delay is not none %}
+    preempt_delay {{ group_config.preempt_delay }}
+{%     elif group_config.no_preempt is defined %}
     nopreempt
-    {% endif %}
-
-    {% if group.peer_address %}
-    unicast_peer { {{ group.peer_address }} }
-    {% endif %}
-
-    {% if group.hello_source %}
-      {% if group.peer_address %}
-      unicast_src_ip {{ group.hello_source }}
-      {% else %}
-      mcast_src_ip {{ group.hello_source }}
-      {% endif %}
-    {% endif %}
-
-    {% if group.use_vmac and group.peer_address %}
-      use_vmac {{group.interface}}v{{group.vrid}}
-      vmac_xmit_base
-    {% elif group.use_vmac %}
-      use_vmac {{group.interface}}v{{group.vrid}}
-    {% endif %}
-
-    {% if group.auth_password %}
-      authentication {
-        auth_pass "{{ group.auth_password }}"
-        auth_type {{ group.auth_type }}
-      }
-    {% endif %}
-
+{%     endif %}
+{%     if group_config.peer_address is defined and group_config.peer_address is not none %}
+    unicast_peer { {{ group_config.peer_address }} }
+{%     endif %}
+{%     if group_config.hello_source_address is defined and group_config.hello_source_address is not none %}
+{%       if group_config.peer_address is defined and group_config.peer_address is not none %}
+    unicast_src_ip {{ group_config.hello_source_address }}
+{%       else %}
+    mcast_src_ip {{ group_config.hello_source_address }}
+{%       endif %}
+{%     endif %}
+{%     if group_config.rfc3768_compatibility is defined and group_config.peer_address is defined %}
+    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
+    vmac_xmit_base
+{%     elif group_config.rfc3768_compatibility is defined %}
+    use_vmac {{ group_config.interface }}v{{ group_config.vrid }}
+{%     endif %}
+{%     if group_config.authentication is defined and group_config.authentication is not none %}
+    authentication {
+        auth_pass "{{ group_config.authentication.password }}"
+{%       if group_config.authentication.type == 'plaintext-password' %}
+        auth_type PASS
+{%       else %}
+        auth_type {{ group_config.authentication.type | upper }}
+{%       endif %}
+    }
+{%     endif %}
+{%     if group_config.virtual_address is defined and group_config.virtual_address is not none %}
     virtual_ipaddress {
-    {% for addr in group.virtual_addresses %}
+{%       for addr in group_config.virtual_address %}
         {{ addr }}
-    {% endfor %}
+{%       endfor %}
     }
-
-    {% if group.virtual_addresses_excluded %}
+{%     endif %}
+{%     if group_config.virtual_address_excluded is defined and group_config.virtual_address_excluded is not none %}
     virtual_ipaddress_excluded {
-    {% for addr in group.virtual_addresses_excluded %}
+{%       for addr in group_config.virtual_address_excluded %}
         {{ addr }}
-    {% endfor %}
+{%       endfor %}
     }
-    {% endif %}
-
-    {% if group.health_check_script %}
+{%     endif %}
+{%     if group_config.health_check is defined and group_config.health_check.script is defined and group_config.health_check.script is not none %}
     track_script {
-        healthcheck_{{ group.name }}
+        healthcheck_{{ name }}
     }
-    {% endif %}
+{%     endif %}
 }
+{%   endfor %}
+{% endif %}
 
-{% endfor %}
-
-{% for sync_group in sync_groups %}
-vrrp_sync_group {{ sync_group.name }} {
-       group {
-            {% for member in sync_group.members %}
-                {{ member }}
-            {% endfor %}
-        }
-
-        {% if sync_group.conntrack_sync %}
-            notify_master "/opt/vyatta/sbin/vyatta-vrrp-conntracksync.sh master {{ sync_group.name }}"
-            notify_backup "/opt/vyatta/sbin/vyatta-vrrp-conntracksync.sh backup {{ sync_group.name }}"
-            notify_fault "/opt/vyatta/sbin/vyatta-vrrp-conntracksync.sh fault {{ sync_group.name }}"
-        {% endif %}
+{% if sync_group is defined and sync_group is not none %}
+{%   for name, group_config in sync_group.items() if group_config.disable is not defined %}
+vrrp_sync_group {{ name }} {
+    group {
+{%     if group_config.member is defined and group_config.member is not none %}
+{%       for member in group_config.member %}
+        {{ member }}
+{%       endfor %}
+{%     endif %}
+    }
+{%     if conntrack_sync_group is defined and conntrack_sync_group == name %}
+{%     set vyos_helper = "/usr/libexec/vyos/vyos-vrrp-conntracksync.sh" %}
+    notify_master "{{ vyos_helper }} master {{ name }}"
+    notify_backup "{{ vyos_helper }} backup {{ name }}"
+    notify_fault "{{ vyos_helper }} fault {{ name }}"
+{%     endif %}
 }
-
-{% endfor %}
+{%   endfor %}
+{% endif %}