Merge branch 'current' of github.com:vyos/vyos-1x into equuleus

* 'current' of github.com:vyos/vyos-1x: (30 commits)
  smoketest: dummy: fix indent
  smoketest: bridge: bond: enable ip subsystem tests
  smoketest: interfaces: dhcpv6pd final fix
  smoketest: ethernet: fix link-speed loop test
  Debian: add build-dependency on python3-jinja2
  smoketest: ethernet: verify() speed/duplex must both be auto or discrete
  smoketest: interfaces: report skipped tests
  smoketest: ethernet: bugfixes for dhcpc6 and unknown interfaces
  Debian: add python3-psutil build dependency
  smoketest: ethernet: check for error on non existing interface
  vyos.configverify: provide generic helper to check for interface existence
  smoketest: interfaces: fix dhcpv6 pd testcase when using multiple interfaces
  login: radius: T3192: migrate to get_config_dict()
  ssh: T2635: harden Jinja2 template and daemon startup
  ssh: T2635: change sshd_config path to /run/sshd
  login: radius: T3192: support IPv6 server(s) and source-address
  xml: include: provide generic include for disable node
  xml: radius: T3192: split individual nodes to discrete includes
  bgp: T2174: verify() existence of route-map and prefix-list
  smoketest: interfaces: test dhcpv6 pd sla-id auto increment
  ...

32 files changed, 362 insertions, 217 deletions

diff --git a/interface-definitions/bcast-relay.xml.in b/interface-definitions/bcast-relay.xml.in
index b691f79fa..1b354d885 100644
--- a/interface-definitions/bcast-relay.xml.in
+++ b/interface-definitions/bcast-relay.xml.in
@@ -9,12 +9,7 @@
           <priority>990</priority>
         </properties>
         <children>
-          <leafNode name="disable">
-            <properties>
-              <help>Globally disable broadcast relay service</help>
-              <valueless/>
-            </properties>
-          </leafNode>
+          #include <include/generic-disable-node.xml.i>
           <tagNode name="id">
             <properties>
               <help>Unique ID for each UDP port to forward</help>
@@ -27,12 +22,7 @@
               </constraint>
             </properties>
             <children>
-              <leafNode name="disable">
-                <properties>
-                  <help>Disable broadcast relay service instance</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <leafNode name="address">
                 <properties>
                   <help>Set source IP of forwarded packets, otherwise original senders address is used</help>
diff --git a/interface-definitions/dhcp-server.xml.in b/interface-definitions/dhcp-server.xml.in
index 2c1609d94..912e4eaf7 100644
--- a/interface-definitions/dhcp-server.xml.in
+++ b/interface-definitions/dhcp-server.xml.in
@@ -9,12 +9,7 @@
           <priority>911</priority>
         </properties>
         <children>
-          <leafNode name="disable">
-            <properties>
-              <help>Disable DHCP server</help>
-              <valueless/>
-            </properties>
-          </leafNode>
+          #include <include/generic-disable-node.xml.i>
           <leafNode name="dynamic-dns-update">
             <properties>
               <help>Dynamically update Domain Name System (RFC4702)</help>
@@ -63,12 +58,7 @@
                   <help>Shared-network-name description</help>
                 </properties>
               </leafNode>
-              <leafNode name="disable">
-                <properties>
-                  <help>Option to disable DHCP configuration for shared-network</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <leafNode name="shared-network-parameters">
                 <properties>
                   <help>Additional shared-network parameters for DHCP server.
@@ -330,12 +320,7 @@
                       <constraintErrorMessage>Invalid static mapping name. May only contain letters, numbers and .-_</constraintErrorMessage>
                     </properties>
                     <children>
-                      <leafNode name="disable">
-                        <properties>
-                          <help>Option to disable static mapping</help>
-                          <valueless/>
-                        </properties>
-                      </leafNode>
+                      #include <include/generic-disable-node.xml.i>
                       <leafNode name="ip-address">
                         <properties>
                           <help>Fixed IP address of static mapping</help>
diff --git a/interface-definitions/dhcpv6-server.xml.in b/interface-definitions/dhcpv6-server.xml.in
index 37bc7e03e..fb0e79c47 100644
--- a/interface-definitions/dhcpv6-server.xml.in
+++ b/interface-definitions/dhcpv6-server.xml.in
@@ -9,12 +9,7 @@
           <priority>900</priority>
         </properties>
         <children>
-          <leafNode name="disable">
-            <properties>
-              <help>Option to disable DHCPv6 server</help>
-              <valueless/>
-            </properties>
-          </leafNode>
+          #include <include/generic-disable-node.xml.i>
           <leafNode name="preference">
             <properties>
               <help>Preference of this DHCPv6 server compared with others</help>
@@ -37,12 +32,7 @@
               <constraintErrorMessage>Invalid DHCPv6 shared network name. May only contain letters, numbers and .-_</constraintErrorMessage>
             </properties>
             <children>
-              <leafNode name="disable">
-                <properties>
-                  <help>Option to disable DHCPv6 configuration for shared-network</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <node name="common-options">
                 <properties>
                   <help>Common options to distribute to all clients, including stateless clients</help>
@@ -324,12 +314,7 @@
                       <constraintErrorMessage>Invalid static mapping name. May only contain letters, numbers and .-_</constraintErrorMessage>
                     </properties>
                     <children>
-                      <leafNode name="disable">
-                        <properties>
-                          <help>Option to disable static mapping</help>
-                          <valueless/>
-                        </properties>
-                      </leafNode>
+                      #include <include/generic-disable-node.xml.i>
                       <leafNode name="identifier">
                         <properties>
                           <help>Client identifier (DUID) for this static mapping</help>
diff --git a/interface-definitions/firewall-options.xml.in b/interface-definitions/firewall-options.xml.in
index defd44f06..8d9225a9a 100644
--- a/interface-definitions/firewall-options.xml.in
+++ b/interface-definitions/firewall-options.xml.in
@@ -16,12 +16,7 @@
               </completionHelp>
             </properties>
             <children>
-              <leafNode name="disable">
-                <properties>
-                  <help>Disable this rule</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <leafNode name="adjust-mss">
                 <properties>
                   <help>Adjust MSS for IPv4 transit packets</help>
diff --git a/interface-definitions/igmp-proxy.xml.in b/interface-definitions/igmp-proxy.xml.in
index b9c52794f..d0f44eada 100644
--- a/interface-definitions/igmp-proxy.xml.in
+++ b/interface-definitions/igmp-proxy.xml.in
@@ -9,12 +9,7 @@
           <priority>740</priority>
         </properties>
         <children>
-          <leafNode name="disable">
-            <properties>
-              <help>Option to disable IGMP proxy</help>
-              <valueless/>
-            </properties>
-          </leafNode>
+          #include <include/generic-disable-node.xml.i>
           <leafNode name="disable-quickleave">
             <properties>
               <help>Option to disable "quickleave"</help>
diff --git a/interface-definitions/include/accel-auth-local-users.xml.i b/interface-definitions/include/accel-auth-local-users.xml.i
index 0d66b8135..35c7a2a06 100644
--- a/interface-definitions/include/accel-auth-local-users.xml.i
+++ b/interface-definitions/include/accel-auth-local-users.xml.i
@@ -9,12 +9,7 @@
         <help>User name for authentication</help>
       </properties>
       <children>
-        <leafNode name="disable">
-          <properties>
-            <help>Option to disable a PPPoE Server user</help>
-            <valueless/>
-          </properties>
-        </leafNode>
+        #include <include/generic-disable-node.xml.i>
         <leafNode name="password">
           <properties>
             <help>Password for authentication</help>
diff --git a/interface-definitions/include/generic-disable-node.xml.i b/interface-definitions/include/generic-disable-node.xml.i
new file mode 100644
index 000000000..520383afb
--- /dev/null
+++ b/interface-definitions/include/generic-disable-node.xml.i
@@ -0,0 +1,8 @@
+<!-- included start from generic-disable-node.xml.i -->
+<leafNode name="disable">
+  <properties>
+    <help>Temporary disable</help>
+    <valueless/>
+  </properties>
+</leafNode>
+<!-- included end -->
diff --git a/interface-definitions/include/interface-eapol.xml.i b/interface-definitions/include/interface-eapol.xml.i
index 94476f0f1..8b33b4acf 100644
--- a/interface-definitions/include/interface-eapol.xml.i
+++ b/interface-definitions/include/interface-eapol.xml.i
@@ -1,12 +1,12 @@
-<!-- included start from interface-eapol.xml.i -->

-<node name="eapol">

-  <properties>

-     <help>Extensible Authentication Protocol over Local Area Network</help>

-  </properties>

-  <children>

-    #include <include/certificate.xml.i>

-    #include <include/certificate-ca.xml.i>

-    #include <include/certificate-key.xml.i>

-  </children>

-</node>

-<!-- included end -->

+<!-- included start from interface-eapol.xml.i -->
+<node name="eapol">
+  <properties>
+     <help>Extensible Authentication Protocol over Local Area Network</help>
+  </properties>
+  <children>
+    #include <include/certificate.xml.i>
+    #include <include/certificate-ca.xml.i>
+    #include <include/certificate-key.xml.i>
+  </children>
+</node>
+<!-- included end -->
diff --git a/interface-definitions/include/nat-rule.xml.i b/interface-definitions/include/nat-rule.xml.i
index e034ef4dd..7ef90f07e 100644
--- a/interface-definitions/include/nat-rule.xml.i
+++ b/interface-definitions/include/nat-rule.xml.i
@@ -26,12 +26,7 @@
         #include <include/nat-port.xml.i>
       </children>
     </node>
-    <leafNode name="disable">
-      <properties>
-        <help>Disable NAT rule</help>
-        <valueless/>
-      </properties>
-    </leafNode>
+    #include <include/generic-disable-node.xml.i>
     <leafNode name="exclude">
       <properties>
         <help>Exclude packets matching this rule from NAT</help>
diff --git a/interface-definitions/include/radius-server-ipv4-ipv6.xml.i b/interface-definitions/include/radius-server-ipv4-ipv6.xml.i
new file mode 100644
index 000000000..e4919d86a
--- /dev/null
+++ b/interface-definitions/include/radius-server-ipv4-ipv6.xml.i
@@ -0,0 +1,32 @@
+<!-- included start from radius-server-ipv4-ipv6.xml.i -->
+<node name="radius">
+  <properties>
+    <help>RADIUS based user authentication</help>
+  </properties>
+  <children>
+    <tagNode name="server">
+      <properties>
+        <help>RADIUS server configuration</help>
+        <valueHelp>
+          <format>ipv4</format>
+          <description>RADIUS server IPv4 address</description>
+        </valueHelp>
+        <valueHelp>
+          <format>ipv6</format>
+          <description>RADIUS server IPv6 address</description>
+        </valueHelp>
+        <constraint>
+          <validator name="ipv4-address"/>
+          <validator name="ipv6-address"/>
+        </constraint>
+      </properties>
+      <children>
+        #include <include/generic-disable-node.xml.i>
+        #include <include/radius-server-key.xml.in>
+        #include <include/radius-server-port.xml.in>
+      </children>
+    </tagNode>
+    #include <include/source-address-ipv4-ipv6.xml.i>
+  </children>
+</node>
+<!-- included end -->
diff --git a/interface-definitions/include/radius-server-ipv4.xml.i b/interface-definitions/include/radius-server-ipv4.xml.i
new file mode 100644
index 000000000..9c73c4c49
--- /dev/null
+++ b/interface-definitions/include/radius-server-ipv4.xml.i
@@ -0,0 +1,27 @@
+<!-- included start from radius-server-ipv4.xml.i -->
+<node name="radius">
+  <properties>
+    <help>RADIUS based user authentication</help>
+  </properties>
+  <children>
+    #include <include/source-address-ipv4.xml.i>
+    <tagNode name="server">
+      <properties>
+        <help>RADIUS server configuration</help>
+        <valueHelp>
+          <format>ipv4</format>
+          <description>RADIUS server IPv4 address</description>
+        </valueHelp>
+        <constraint>
+          <validator name="ipv4-address"/>
+        </constraint>
+      </properties>
+      <children>
+        #include <include/generic-disable-node.xml.i>
+        #include <include/radius-server-key.xml.in>
+        #include <include/radius-server-port.xml.in>
+      </children>
+    </tagNode>
+  </children>
+</node>
+<!-- included end -->
diff --git a/interface-definitions/include/radius-server-key.xml.in b/interface-definitions/include/radius-server-key.xml.in
new file mode 100644
index 000000000..32a01b402
--- /dev/null
+++ b/interface-definitions/include/radius-server-key.xml.in
@@ -0,0 +1,7 @@
+<!-- included start from radius-server-key.xml.i -->
+<leafNode name="key">
+  <properties>
+    <help>Shared secret key</help>
+  </properties>
+</leafNode>
+<!-- included end -->
diff --git a/interface-definitions/include/radius-server-port.xml.in b/interface-definitions/include/radius-server-port.xml.in
new file mode 100644
index 000000000..71b6bddb7
--- /dev/null
+++ b/interface-definitions/include/radius-server-port.xml.in
@@ -0,0 +1,15 @@
+<!-- included start from radius-server-port.xml.i -->
+<leafNode name="port">
+  <properties>
+    <help>Authentication port</help>
+    <valueHelp>
+      <format>u32:1-65535</format>
+      <description>Numeric IP port (default: 1812)</description>
+    </valueHelp>
+    <constraint>
+      <validator name="numeric" argument="--range 1-65535"/>
+    </constraint>
+  </properties>
+  <defaultValue>1812</defaultValue>
+</leafNode>
+<!-- included end -->
diff --git a/interface-definitions/include/radius-server.xml.i b/interface-definitions/include/radius-server.xml.i
deleted file mode 100644
index c1dadd2a2..000000000
--- a/interface-definitions/include/radius-server.xml.i
+++ /dev/null
@@ -1,48 +0,0 @@
-<!-- included start from radius-server.xml.i -->
-<node name="radius">
-  <properties>
-    <help>RADIUS based user authentication</help>
-  </properties>
-  <children>
-    #include <include/source-address-ipv4.xml.i>
-    <tagNode name="server">
-      <properties>
-        <help>RADIUS server configuration</help>
-        <valueHelp>
-          <format>ipv4</format>
-          <description>RADIUS server IPv4 address</description>
-        </valueHelp>
-        <constraint>
-          <validator name="ipv4-address"/>
-        </constraint>
-      </properties>
-      <children>
-        <leafNode name="disable">
-          <properties>
-            <help>Temporary disable this server</help>
-            <valueless/>
-          </properties>
-        </leafNode>
-        <leafNode name="key">
-          <properties>
-            <help>Shared secret key</help>
-          </properties>
-        </leafNode>
-        <leafNode name="port">
-          <properties>
-            <help>Authentication port</help>
-            <valueHelp>
-              <format>u32:1-65535</format>
-              <description>Numeric IP port (default: 1812)</description>
-            </valueHelp>
-            <constraint>
-              <validator name="numeric" argument="--range 1-65535"/>
-            </constraint>
-          </properties>
-          <defaultValue>1812</defaultValue>
-        </leafNode>
-      </children>
-    </tagNode>
-  </children>
-</node>
-<!-- included end -->
diff --git a/interface-definitions/include/source-address-ipv4-ipv6.xml.i b/interface-definitions/include/source-address-ipv4-ipv6.xml.i
index 004e04f7b..4da4698c2 100644
--- a/interface-definitions/include/source-address-ipv4-ipv6.xml.i
+++ b/interface-definitions/include/source-address-ipv4-ipv6.xml.i
@@ -17,6 +17,7 @@
       <validator name="ipv4-address"/>
       <validator name="ipv6-address"/>
     </constraint>
+    <multi/>
   </properties>
 </leafNode>
 <!-- included end -->
diff --git a/interface-definitions/interfaces-openvpn.xml.in b/interface-definitions/interfaces-openvpn.xml.in
index 34040bf72..527f7fd54 100644
--- a/interface-definitions/interfaces-openvpn.xml.in
+++ b/interface-definitions/interfaces-openvpn.xml.in
@@ -418,12 +418,7 @@
                   </valueHelp>
                 </properties>
                 <children>
-                  <leafNode name="disable">
-                    <properties>
-                      <help>Option to disable client connection</help>
-                      <valueless/>
-                    </properties>
-                  </leafNode>
+                  #include <include/generic-disable-node.xml.i>
                   <leafNode name="ip">
                     <properties>
                       <help>IP address of the client</help>
@@ -482,12 +477,7 @@
                   <help>Pool of client IPv4 addresses</help>
                 </properties>
                 <children>
-                  <leafNode name="disable">
-                    <properties>
-                      <help>Disable client IP pool</help>
-                      <valueless/>
-                    </properties>
-                  </leafNode>
+                  #include <include/generic-disable-node.xml.i>
                   <leafNode name="start">
                     <properties>
                       <help>First IP address in the pool</help>
@@ -546,12 +536,7 @@
                       </constraint>
                     </properties>
                   </leafNode>
-                  <leafNode name="disable">
-                    <properties>
-                      <help>Disable client IPv6 pool</help>
-                      <valueless/>
-                    </properties>
-                  </leafNode>
+                  #include <include/generic-disable-node.xml.i>
                 </children>
               </node>
               <leafNode name="domain-name">
diff --git a/interface-definitions/interfaces-wireguard.xml.in b/interface-definitions/interfaces-wireguard.xml.in
index 92c9f510c..acf5082d6 100644
--- a/interface-definitions/interfaces-wireguard.xml.in
+++ b/interface-definitions/interfaces-wireguard.xml.in
@@ -55,12 +55,7 @@
               <constraintErrorMessage>peer alias too long (limit 100 characters)</constraintErrorMessage>
             </properties>
             <children>
-              <leafNode name="disable">
-                <properties>
-                  <help>disables peer</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <leafNode name="pubkey">
                 <properties>
                   <help>base64 encoded public key</help>
diff --git a/interface-definitions/interfaces-wireless.xml.in b/interface-definitions/interfaces-wireless.xml.in
index 86f529278..f39e5618f 100644
--- a/interface-definitions/interfaces-wireless.xml.in
+++ b/interface-definitions/interfaces-wireless.xml.in
@@ -722,7 +722,7 @@
                       <constraintErrorMessage>Invalid WPA pass phrase, must be 8 to 63 printable characters!</constraintErrorMessage>
                     </properties>
                   </leafNode>
-                  #include <include/radius-server.xml.i>
+                  #include <include/radius-server-ipv4.xml.i>
                   <node name="radius">
                     <children>
                       <tagNode name="server">
diff --git a/interface-definitions/lldp.xml.in b/interface-definitions/lldp.xml.in
index 950b267ef..9fdffcea1 100644
--- a/interface-definitions/lldp.xml.in
+++ b/interface-definitions/lldp.xml.in
@@ -25,12 +25,7 @@
               </completionHelp>
             </properties>
             <children>
-              <leafNode name="disable">
-                <properties>
-                  <help>Disable lldp on this interface</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <node name="location">
                 <properties>
                   <help>LLDP-MED location data [REQUIRED]</help>
diff --git a/interface-definitions/nat.xml.in b/interface-definitions/nat.xml.in
index 00aaddb17..d6bed5b27 100644
--- a/interface-definitions/nat.xml.in
+++ b/interface-definitions/nat.xml.in
@@ -79,12 +79,7 @@
                   <help>Rule description</help>
                 </properties>
               </leafNode>
-              <leafNode name="disable">
-                <properties>
-                  <help>Disable NAT rule</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               #include <include/nat-interface.xml.i>
               <node name="source">
                 <properties>
diff --git a/interface-definitions/protocols-isis.xml.in b/interface-definitions/protocols-isis.xml.in
index 2ceb05180..2340079a6 100644
--- a/interface-definitions/protocols-isis.xml.in
+++ b/interface-definitions/protocols-isis.xml.in
@@ -1,4 +1,4 @@
-<?xml version="1.0"?>
+<?xml version="1.0" encoding="utf-8"?>
 <!-- Protocol IS-IS configuration -->
 <interfaceDefinition>
   <node name="protocols">
@@ -246,6 +246,225 @@
               <valueless/>
             </properties>
           </leafNode>
+          <node name="traffic-engineering">
+            <properties>
+              <help>Show IS-IS neighbor adjacencies</help>
+            </properties>
+            <children>
+              <leafNode name="enable">
+                <properties>
+                  <help>Enable MPLS traffic engineering extensions</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
+<!--              
+              <node name="inter-as">
+                <properties>
+                  <help>MPLS traffic engineering inter-AS support</help>
+                </properties>
+                <children>
+                  <leafNode name="level-1">
+                    <properties>
+                      <help>Area native mode self originate inter-AS LSP with L1 only flooding scope</help>
+                      <valueless/>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="level-1-2">
+                    <properties>
+                      <help>Area native mode self originate inter-AS LSP with L1 and L2 flooding scope</help>
+                      <valueless/>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="level-2">
+                    <properties>
+                      <help>Area native mode self originate inter-AS LSP with L2 only flooding scope</help>
+                      <valueless/>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+              <leafNode name="inter-as">
+                <properties>
+                  <help>MPLS traffic engineering inter-AS support</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
+-->
+              <leafNode name="address">
+                <properties>
+                  <help>MPLS traffic engineering router ID</help>
+                  <valueHelp>
+                    <format>ipv4</format>
+                    <description>IPv4 address</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="ipv4-address"/>
+                  </constraint>
+                </properties>
+              </leafNode>
+            </children>
+          </node>
+          <node name="segment-routing">
+            <properties>
+              <help>Segment-Routing (SPRING) settings</help>
+            </properties>
+            <children>
+              <leafNode name="enable">
+                <properties>
+                  <help>Enable segment-routing functionality</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
+              <node name="global-block">
+                <properties>
+                  <help>Global block label range</help>
+                </properties>
+                <children>
+                  <leafNode name="low-label-value">
+                    <properties>
+                      <help>The lower bound of the global block</help>
+                      <valueHelp>
+                        <format>u32:16-1048575</format>
+                        <description>MPLS label value</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="--range 16-1048575"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="high-label-value">
+                    <properties>
+                      <help>The upper bound of the global block</help>
+                      <valueHelp>
+                        <format>u32:16-1048575</format>
+                        <description>MPLS label value</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="--range 16-1048575"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+<!--
+              <node name="local-block">
+                <properties>
+                  <help>Local Block label range</help>
+                </properties>
+                <children>
+                  <leafNode name="low-label-value">
+                    <properties>
+                      <help>The lower bound of the local block</help>
+                      <valueHelp>
+                        <format>u32:16-1048575</format>
+                        <description>MPLS label value</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="  range 16-1048575"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                  <leafNode name="high-label-value">
+                    <properties>
+                      <help>The upper bound of the local block</help>
+                      <valueHelp>
+                        <format>u32:16-1048575</format>
+                        <description>MPLS label value</description>
+                      </valueHelp>
+                      <constraint>
+                        <validator name="numeric" argument="  range 16-1048575"/>
+                      </constraint>
+                    </properties>
+                  </leafNode>
+                </children>
+              </node>
+-->
+              <leafNode name="maximum-label-depth">
+                <properties>
+                  <help>Maximum MPLS labels allowed for this router</help>
+                  <valueHelp>
+                    <format>u32:1-16</format>
+                      <description>MPLS label depth</description>
+                  </valueHelp>
+                  <constraint>
+                    <validator name="numeric" argument="--range 1-16"/>
+                  </constraint>
+                </properties>
+              </leafNode>
+              <tagNode name="prefix">
+                <properties>
+                  <help>Static IPv4/IPv6 prefix segment/label mapping</help>
+                  <completionHelp>
+                    <list>&lt;x.x.x.x/x&gt; &lt;h:h:h:h:h:h:h:h/h&gt;</list>
+                  </completionHelp>
+                </properties>
+                <children>
+                  <node name="absolute">
+                    <properties>
+                      <help>Specify the absolute value of prefix segment/label ID</help>
+                    </properties>
+                    <children>
+                      <leafNode name="value">
+                        <properties>
+                          <help>Specify the absolute value of prefix segment/label ID</help>
+                          <valueHelp>
+                            <format>u32:16-1048575</format>
+                              <description>The absolute segment/label ID value</description>
+                          </valueHelp>
+                          <constraint>
+                            <validator name="numeric" argument="--range 16-1048575"/>
+                          </constraint>
+                        </properties>
+                      </leafNode>
+                      <leafNode name="explicit-null">
+                        <properties>
+                          <help>Request upstream neighbor to replace segment/label with explicit null label</help>
+                          <valueless/>
+                        </properties>
+                      </leafNode>
+                      <leafNode name="no-php-flag">
+                        <properties>
+                          <help>Do not request penultimate hop popping for segment/label</help>
+                          <valueless/>
+                        </properties>
+                      </leafNode>
+                    </children>
+                  </node>
+                  <node name="index">
+                    <properties>
+                      <help>Specify the index value of prefix segment/label ID</help>
+                    </properties>
+                    <children>
+                      <leafNode name="value">
+                        <properties>
+                          <help>Specify the index value of prefix segment/label ID</help>
+                          <valueHelp>
+                            <format>u32:0-65535</format>
+                              <description>The index segment/label ID value</description>
+                          </valueHelp>
+                          <constraint>
+                            <validator name="numeric" argument="--range 0-65535"/>
+                          </constraint>
+                        </properties>
+                      </leafNode>
+                      <leafNode name="explicit-null">
+                        <properties>
+                          <help>Request upstream neighbor to replace segment/label with explicit null label</help>
+                          <valueless/>
+                        </properties>
+                      </leafNode>
+                      <leafNode name="no-php-flag">
+                        <properties>
+                          <help>Do not request penultimate hop popping for segment/label</help>
+                          <valueless/>
+                        </properties>
+                      </leafNode>
+                    </children>
+                  </node>
+                </children>
+              </tagNode>
+            </children>
+          </node>
           <node name="redistribute">
             <properties>
               <help>Redistribute information from another routing protocol</help>
diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in
index ee09d01d6..07241fcc2 100644
--- a/interface-definitions/service_ipoe-server.xml.in
+++ b/interface-definitions/service_ipoe-server.xml.in
@@ -197,7 +197,7 @@
                   </tagNode>
                 </children>
               </tagNode>
-              #include <include/radius-server.xml.i>
+              #include <include/radius-server-ipv4.xml.i>
               #include <include/accel-radius-additions.xml.i>
             </children>
           </node>
diff --git a/interface-definitions/service_mdns-repeater.xml.in b/interface-definitions/service_mdns-repeater.xml.in
index e21b1b27c..33ef9a434 100644
--- a/interface-definitions/service_mdns-repeater.xml.in
+++ b/interface-definitions/service_mdns-repeater.xml.in
@@ -13,12 +13,7 @@
               <priority>990</priority>
             </properties>
             <children>
-              <leafNode name="disable">
-                <properties>
-                  <help>Disable mDNS repeater service</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <leafNode name="interface">
                 <properties>
                   <help>Interface to repeat mDNS advertisements [REQUIRED]</help>
diff --git a/interface-definitions/service_pppoe-server.xml.in b/interface-definitions/service_pppoe-server.xml.in
index 6d11f41a0..5c0a66527 100644
--- a/interface-definitions/service_pppoe-server.xml.in
+++ b/interface-definitions/service_pppoe-server.xml.in
@@ -26,7 +26,7 @@
               #include <include/accel-auth-local-users.xml.i>
               #include <include/accel-auth-mode.xml.i>
               #include <include/accel-auth-protocols.xml.i>
-              #include <include/radius-server.xml.i>
+              #include <include/radius-server-ipv4.xml.i>
               #include <include/accel-radius-additions.xml.i>
               <node name="radius">
                 <children>
diff --git a/interface-definitions/service_webproxy.xml.in b/interface-definitions/service_webproxy.xml.in
index 4cd8138ec..7cb0f7ece 100644
--- a/interface-definitions/service_webproxy.xml.in
+++ b/interface-definitions/service_webproxy.xml.in
@@ -394,12 +394,7 @@
               <help>URL filtering settings</help>
             </properties>
             <children>
-              <leafNode name="disable">
-                <properties>
-                  <help>Disable URL filtering</help>
-                  <valueless/>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <node name="squidguard">
                 <properties>
                   <help>URL filtering via squidGuard redirector</help>
diff --git a/interface-definitions/system-login.xml.in b/interface-definitions/system-login.xml.in
index 812a50c8a..34e14d8e7 100644
--- a/interface-definitions/system-login.xml.in
+++ b/interface-definitions/system-login.xml.in
@@ -34,6 +34,7 @@
                       </constraint>
                       <constraintErrorMessage>Invalid encrypted password for $VAR(../../@).</constraintErrorMessage>
                     </properties>
+                    <defaultValue>!</defaultValue>
                   </leafNode>
                   <leafNode name="plaintext-password">
                     <properties>
@@ -44,7 +45,7 @@
                     <properties>
                       <help>Remote access public keys</help>
                       <valueHelp>
-                        <format>&gt;identifier&lt;</format>
+                        <format>txt</format>
                         <description>Key identifier used by ssh-keygen (usually of form user@host)</description>
                       </valueHelp>
                     </properties>
@@ -61,7 +62,7 @@
                       </leafNode>
                       <leafNode name="type">
                         <properties>
-                          <help></help>
+                          <help>Public key type</help>
                           <completionHelp>
                             <list>ssh-dss ssh-rsa ecdsa-sha2-nistp256 ecdsa-sha2-nistp384 ecdsa-sha2-nistp521 ssh-ed25519</list>
                           </completionHelp>
@@ -86,7 +87,7 @@
                             <description/>
                           </valueHelp>
                           <constraint>
-                            <regex>(ssh-dss|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|ssh-ed25519)</regex>
+                            <regex>^(ssh-dss|ssh-rsa|ecdsa-sha2-nistp256|ecdsa-sha2-nistp384|ecdsa-sha2-nistp521|ssh-ed25519)$</regex>
                           </constraint>
                         </properties>
                       </leafNode>
@@ -110,7 +111,7 @@
               </leafNode>
             </children>
           </tagNode>
-          #include <include/radius-server.xml.i>
+          #include <include/radius-server-ipv4-ipv6.xml.i>
           <node name="radius">
             <children>
               <tagNode name="server">
@@ -119,7 +120,7 @@
                     <properties>
                       <help>Session timeout</help>
                       <valueHelp>
-                        <format>1-30</format>
+                        <format>u32:1-30</format>
                         <description>Session timeout in seconds (default: 2)</description>
                       </valueHelp>
                       <constraint>
@@ -127,18 +128,20 @@
                       </constraint>
                       <constraintErrorMessage>Timeout must be between 1 and 30 seconds</constraintErrorMessage>
                     </properties>
+                    <defaultValue>2</defaultValue>
                   </leafNode>
                   <leafNode name="priority">
                     <properties>
                       <help>Server priority</help>
                       <valueHelp>
-                        <format>1-255</format>
+                        <format>u32:1-255</format>
                         <description>Server priority (default: 255)</description>
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 1-255"/>
                       </constraint>
                     </properties>
+                    <defaultValue>255</defaultValue>
                   </leafNode>
                 </children>
               </tagNode>
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index daf98a833..426d7e71c 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -1045,12 +1045,7 @@
                           </constraint>
                         </properties>
                       </leafNode>
-                      <leafNode name="disable">
-                        <properties>
-                          <help>Option to disable vpn tunnel</help>
-                          <valueless/>
-                        </properties>
-                      </leafNode>
+                      #include <include/generic-disable-node.xml.i>
                       <leafNode name="esp-group">
                         <properties>
                           <help>ESP group name</help>
diff --git a/interface-definitions/vpn_l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in
index 42da75a64..998a8c371 100644
--- a/interface-definitions/vpn_l2tp.xml.in
+++ b/interface-definitions/vpn_l2tp.xml.in
@@ -212,7 +212,7 @@
                   #include <include/accel-ppp-mppe.xml.i>
                   #include <include/accel-auth-mode.xml.i>
                   #include <include/accel-auth-local-users.xml.i>
-                  #include <include/radius-server.xml.i>
+                  #include <include/radius-server-ipv4.xml.i>
                   <node name="radius">
                     <children>
                       <tagNode name="server">
diff --git a/interface-definitions/vpn_openconnect.xml.in b/interface-definitions/vpn_openconnect.xml.in
index ccf537e04..054e027fc 100644
--- a/interface-definitions/vpn_openconnect.xml.in
+++ b/interface-definitions/vpn_openconnect.xml.in
@@ -42,12 +42,7 @@
                       <help>User name for authentication</help>
                     </properties>
                     <children>
-                      <leafNode name="disable">
-                        <properties>
-                          <help>Option to disable a SSL VPN Server user</help>
-                          <valueless />
-                        </properties>
-                      </leafNode>
+                      #include <include/generic-disable-node.xml.i>
                       <leafNode name="password">
                         <properties>
                           <help>Password for authentication</help>
@@ -57,7 +52,7 @@
                   </tagNode>
                 </children>
               </node>
-              #include <include/radius-server.xml.i>
+              #include <include/radius-server-ipv4.xml.i>
               <node name="radius">
                 <children>
                   <leafNode name="timeout">
diff --git a/interface-definitions/vpn_pptp.xml.in b/interface-definitions/vpn_pptp.xml.in
index b17138e33..72eda8752 100644
--- a/interface-definitions/vpn_pptp.xml.in
+++ b/interface-definitions/vpn_pptp.xml.in
@@ -104,11 +104,7 @@
                           <help>User name for authentication</help>
                         </properties>
                         <children>
-                          <leafNode name="disable">
-                            <properties>
-                              <help>Option to disable a PPTP Server user</help>
-                            </properties>
-                          </leafNode>
+                          #include <include/generic-disable-node.xml.i>
                           <leafNode name="password">
                             <properties>
                               <help>Password for authentication</help>
@@ -123,7 +119,7 @@
                       </tagNode>
                     </children>
                   </node>
-                  #include <include/radius-server.xml.i>
+                  #include <include/radius-server-ipv4.xml.i>
                   #include <include/accel-radius-additions.xml.i>
                 </children>
               </node>
diff --git a/interface-definitions/vpn_sstp.xml.in b/interface-definitions/vpn_sstp.xml.in
index 134858608..ebcb77db2 100644
--- a/interface-definitions/vpn_sstp.xml.in
+++ b/interface-definitions/vpn_sstp.xml.in
@@ -16,7 +16,7 @@
               #include <include/accel-auth-local-users.xml.i>
               #include <include/accel-auth-mode.xml.i>
               #include <include/accel-auth-protocols.xml.i>
-              #include <include/radius-server.xml.i>
+              #include <include/radius-server-ipv4.xml.i>
               #include <include/accel-radius-additions.xml.i>
               <node name="radius">
                 <children>
diff --git a/interface-definitions/vrrp.xml.in b/interface-definitions/vrrp.xml.in
index c6a32930f..caa9f4a33 100644
--- a/interface-definitions/vrrp.xml.in
+++ b/interface-definitions/vrrp.xml.in
@@ -73,12 +73,7 @@
                   <help>Group description</help>
                 </properties>
               </leafNode>
-              <leafNode name="disable">
-                <properties>
-                  <valueless/>
-                  <help>Disable VRRP group</help>
-                </properties>
-              </leafNode>
+              #include <include/generic-disable-node.xml.i>
               <node name="health-check">
                 <properties>
                   <help>Health check script</help>