Merge remote-tracking branch 'upstream/current' into current

15 files changed, 737 insertions, 253 deletions

diff --git a/python/vyos/ifconfig/__init__.py b/python/vyos/ifconfig/__init__.py
index a7cdeadd1..9cd8d44c1 100644
--- a/python/vyos/ifconfig/__init__.py
+++ b/python/vyos/ifconfig/__init__.py
@@ -13,12 +13,10 @@
 # You should have received a copy of the GNU Lesser General Public
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
-
 from vyos.ifconfig.section import Section
 from vyos.ifconfig.control import Control
 from vyos.ifconfig.interface import Interface
 from vyos.ifconfig.operational import Operational
-from vyos.ifconfig.dhcp import DHCP
 from vyos.ifconfig.vrrp import VRRP
 
 from vyos.ifconfig.bond import BondIf
diff --git a/python/vyos/ifconfig/bond.py b/python/vyos/ifconfig/bond.py
index 47dd4ff34..64407401b 100644
--- a/python/vyos/ifconfig/bond.py
+++ b/python/vyos/ifconfig/bond.py
@@ -18,10 +18,11 @@ import os
 from vyos.ifconfig.interface import Interface
 from vyos.ifconfig.vlan import VLAN
 
+from vyos.util import cmd
+from vyos.util import vyos_dict_search
 from vyos.validate import assert_list
 from vyos.validate import assert_positive
 
-
 @Interface.register
 @VLAN.enable
 class BondIf(Interface):
@@ -179,7 +180,13 @@ class BondIf(Interface):
         >>> BondIf('bond0').get_arp_ip_target()
         '192.0.2.1'
         """
-        return self.get_interface('bond_arp_ip_target')
+        # As this function might also be called from update() of a VLAN interface
+        # we must check if the bond_arp_ip_target retrieval worked or not - as this
+        # can not be set for a bond vif interface
+        try:
+            return self.get_interface('bond_arp_ip_target')
+        except FileNotFoundError:
+            return ''
 
     def set_arp_ip_target(self, target):
         """
@@ -209,11 +216,31 @@ class BondIf(Interface):
         >>> BondIf('bond0').add_port('eth0')
         >>> BondIf('bond0').add_port('eth1')
         """
-        # An interface can only be added to a bond if it is in 'down' state. If
-        # interface is in 'up' state, the following Kernel error will  be thrown:
-        # bond0: eth1 is up - this may be due to an out of date ifenslave.
-        Interface(interface).set_admin_state('down')
-        return self.set_interface('bond_add_port', f'+{interface}')
+
+        # From drivers/net/bonding/bond_main.c:
+        # ...
+        # bond_set_slave_link_state(new_slave,
+        #      BOND_LINK_UP,
+        #      BOND_SLAVE_NOTIFY_NOW);
+        # ...
+        #
+        # The kernel will ALWAYS place new bond members in "up" state regardless
+        # what the CLI will tell us!
+
+        # Physical interface must be in admin down state before they can be
+        # enslaved. If this is not the case an error will be shown:
+        # bond0: eth0 is up - this may be due to an out of date ifenslave
+        slave = Interface(interface)
+        slave_state = slave.get_admin_state()
+        if slave_state == 'up':
+            slave.set_admin_state('down')
+
+        ret = self.set_interface('bond_add_port', f'+{interface}')
+        # The kernel will ALWAYS place new bond members in "up" state regardless
+        # what the LI is configured for - thus we place the interface in its
+        # desired state
+        slave.set_admin_state(slave_state)
+        return ret
 
     def del_port(self, interface):
         """
@@ -277,3 +304,80 @@ class BondIf(Interface):
         >>> BondIf('bond0').set_mode('802.3ad')
         """
         return self.set_interface('bond_mode', mode)
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # use ref-counting function to place an interface into admin down state.
+        # set_admin_state_up() must be called the same amount of times else the
+        # interface won't come up. This can/should be used to prevent link flapping
+        # when changing interface parameters require the interface to be down.
+        # We will disable it once before reconfiguration and enable it afterwards.
+        if 'shutdown_required' in config:
+            self.set_admin_state('down')
+
+        # call base class first
+        super().update(config)
+
+        # ARP monitor targets need to be synchronized between sysfs and CLI.
+        # Unfortunately an address can't be send twice to sysfs as this will
+        # result in the following exception:  OSError: [Errno 22] Invalid argument.
+        #
+        # We remove ALL addresses prior to adding new ones, this will remove
+        # addresses manually added by the user too - but as we are limited to 16 adresses
+        # from the kernel side this looks valid to me. We won't run into an error
+        # when a user added manual adresses which would result in having more
+        # then 16 adresses in total.
+        arp_tgt_addr = list(map(str, self.get_arp_ip_target().split()))
+        for addr in arp_tgt_addr:
+            self.set_arp_ip_target('-' + addr)
+
+        # Add configured ARP target addresses
+        value = vyos_dict_search('arp_monitor.target', config)
+        if isinstance(value, str):
+            value = [value]
+        if value:
+            for addr in value:
+                self.set_arp_ip_target('+' + addr)
+
+        # Bonding transmit hash policy
+        value = config.get('hash_policy')
+        if value: self.set_hash_policy(value)
+
+        # Some interface options can only be changed if the interface is
+        # administratively down
+        if self.get_admin_state() == 'down':
+            # Delete bond member port(s)
+            for interface in self.get_slaves():
+                self.del_port(interface)
+
+            # Bonding policy/mode
+            value = config.get('mode')
+            if value: self.set_mode(value)
+
+            # Add (enslave) interfaces to bond
+            value = vyos_dict_search('member.interface', config)
+            if value:
+                for interface in value:
+                    # if we've come here we already verified the interface
+                    # does not have an addresses configured so just flush
+                    # any remaining ones
+                    Interface(interface).flush_addrs()
+                    self.add_port(interface)
+
+        # Primary device interface - must be set after 'mode'
+        value = config.get('primary')
+        if value: self.set_primary(value)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/bridge.py b/python/vyos/ifconfig/bridge.py
index 44b92c1db..4c76fe996 100644
--- a/python/vyos/ifconfig/bridge.py
+++ b/python/vyos/ifconfig/bridge.py
@@ -13,12 +13,12 @@
 # You should have received a copy of the GNU Lesser General Public
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
-
 from vyos.ifconfig.interface import Interface
-
+from vyos.ifconfig.stp import STP
 from vyos.validate import assert_boolean
 from vyos.validate import assert_positive
-
+from vyos.util import cmd
+from vyos.util import vyos_dict_search
 
 @Interface.register
 class BridgeIf(Interface):
@@ -187,3 +187,77 @@ class BridgeIf(Interface):
         >>> BridgeIf('br0').del_port('eth1')
         """
         return self.set_interface('del_port', interface)
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # Set ageing time
+        value = config.get('aging')
+        self.set_ageing_time(value)
+
+        # set bridge forward delay
+        value = config.get('forwarding_delay')
+        self.set_forward_delay(value)
+
+        # set hello time
+        value = config.get('hello_time')
+        self.set_hello_time(value)
+
+        # set max message age
+        value = config.get('max_age')
+        self.set_max_age(value)
+
+        # set bridge priority
+        value = config.get('priority')
+        self.set_priority(value)
+
+        # enable/disable spanning tree
+        value = '1' if 'stp' in config else '0'
+        self.set_stp(value)
+
+        # enable or disable IGMP querier
+        tmp = vyos_dict_search('igmp.querier', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_multicast_querier(value)
+
+        # remove interface from bridge
+        tmp = vyos_dict_search('member.interface_remove', config)
+        if tmp:
+            for member in tmp:
+                self.del_port(member)
+
+        STPBridgeIf = STP.enable(BridgeIf)
+        tmp = vyos_dict_search('member.interface', config)
+        if tmp:
+            for interface, interface_config in tmp.items():
+                # if we've come here we already verified the interface
+                # does not have an addresses configured so just flush
+                # any remaining ones
+                Interface(interface).flush_addrs()
+                # enslave interface port to bridge
+                self.add_port(interface)
+
+                tmp = STPBridgeIf(interface)
+                # set bridge port path cost
+                value = interface_config.get('cost')
+                tmp.set_path_cost(value)
+
+                # set bridge port path priority
+                value = interface_config.get('priority')
+                tmp.set_path_priority(value)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/dhcp.py b/python/vyos/ifconfig/dhcp.py
deleted file mode 100644
index a8b9a2a87..000000000
--- a/python/vyos/ifconfig/dhcp.py
+++ /dev/null
@@ -1,136 +0,0 @@
-# Copyright 2020 VyOS maintainers and contributors <maintainers@vyos.io>
-#
-# This library is free software; you can redistribute it and/or
-# modify it under the terms of the GNU Lesser General Public
-# License as published by the Free Software Foundation; either
-# version 2.1 of the License, or (at your option) any later version.
-#
-# This library is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-# Lesser General Public License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
-
-import os
-
-from vyos.dicts import FixedDict
-from vyos.ifconfig.control import Control
-from vyos.template import render
-
-class _DHCPv4 (Control):
-    def __init__(self, ifname):
-        super().__init__()
-        config_base = r'/var/lib/dhcp/dhclient_'
-        self.options = FixedDict(**{
-            'ifname': ifname,
-            'hostname': '',
-            'client_id': '',
-            'vendor_class_id': '',
-            'conf_file': config_base + f'{ifname}.conf',
-            'options_file': config_base + f'{ifname}.options',
-            'pid_file': config_base + f'{ifname}.pid',
-            'lease_file': config_base + f'{ifname}.leases',
-        })
-
-    # replace dhcpv4/v6 with systemd.networkd?
-    def set(self):
-        """
-        Configure interface as DHCP client. The dhclient binary is automatically
-        started in background!
-
-        Example:
-
-        >>> from vyos.ifconfig import Interface
-        >>> j = Interface('eth0')
-        >>> j.dhcp.v4.set()
-        """
-        if not self.options['hostname']:
-            # read configured system hostname.
-            # maybe change to vyos hostd client ???
-            with open('/etc/hostname', 'r') as f:
-                self.options['hostname'] = f.read().rstrip('\n')
-
-        render(self.options['options_file'], 'dhcp-client/daemon-options.tmpl', self.options)
-        render(self.options['conf_file'], 'dhcp-client/ipv4.tmpl', self.options)
-
-        return self._cmd('systemctl restart dhclient@{ifname}.service'.format(**self.options))
-
-    def delete(self):
-        """
-        De-configure interface as DHCP clinet. All auto generated files like
-        pid, config and lease will be removed.
-
-        Example:
-
-        >>> from vyos.ifconfig import Interface
-        >>> j = Interface('eth0')
-        >>> j.dhcp.v4.delete()
-        """
-        if not os.path.isfile(self.options['pid_file']):
-            self._debug_msg('No DHCP client PID found')
-            return None
-
-        self._cmd('systemctl stop dhclient@{ifname}.service'.format(**self.options))
-
-        # cleanup old config files
-        for name in ('conf_file', 'options_file', 'pid_file', 'lease_file'):
-            if os.path.isfile(self.options[name]):
-                os.remove(self.options[name])
-
-class _DHCPv6 (Control):
-    def __init__(self, ifname):
-        super().__init__()
-        self.options = FixedDict(**{
-            'ifname': ifname,
-            'dhcpv6_prm_only': False,
-            'dhcpv6_temporary': False,
-            'dhcpv6_pd_interfaces': [],
-            'dhcpv6_pd_length': ''
-        })
-        self._conf_file = f'/run/dhcp6c/dhcp6c.{ifname}.conf'
-
-    def set(self):
-        """
-        Configure interface as DHCPv6 client. The dhclient binary is automatically
-        started in background!
-
-        Example:
-
-        >>> from vyos.ifconfig import Interface
-        >>> j = Interface('eth0')
-        >>> j.dhcp.v6.set()
-        """
-
-        # better save then sorry .. should be checked in interface script
-        # but if you missed it we are safe!
-        if self.options['dhcpv6_prm_only'] and self.options['dhcpv6_temporary']:
-            raise Exception(
-                'DHCPv6 temporary and parameters-only options are mutually exclusive!')
-
-        render(self._conf_file, 'dhcp-client/ipv6.tmpl', self.options, trim_blocks=True)
-        return self._cmd('systemctl restart dhcp6c@{ifname}.service'.format(**self.options))
-
-    def delete(self):
-        """
-        De-configure interface as DHCPv6 clinet. All auto generated files like
-        pid, config and lease will be removed.
-
-        Example:
-
-        >>> from vyos.ifconfig import Interface
-        >>> j = Interface('eth0')
-        >>> j.dhcp.v6.delete()
-        """
-        self._cmd('systemctl stop dhcp6c@{ifname}.service'.format(**self.options))
-
-        # cleanup old config files
-        if os.path.isfile(self._conf_file):
-            os.remove(self._conf_file)
-
-
-class DHCP(object):
-    def __init__(self, ifname):
-        self.v4 = _DHCPv4(ifname)
-        self.v6 = _DHCPv6(ifname)
diff --git a/python/vyos/ifconfig/dummy.py b/python/vyos/ifconfig/dummy.py
index 404c490c7..43614cd1c 100644
--- a/python/vyos/ifconfig/dummy.py
+++ b/python/vyos/ifconfig/dummy.py
@@ -35,3 +35,22 @@ class DummyIf(Interface):
             'prefixes': ['dum', ],
         },
     }
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/ethernet.py b/python/vyos/ifconfig/ethernet.py
index 5b18926c9..17c1bd64d 100644
--- a/python/vyos/ifconfig/ethernet.py
+++ b/python/vyos/ifconfig/ethernet.py
@@ -20,7 +20,7 @@ from vyos.ifconfig.interface import Interface
 from vyos.ifconfig.vlan import VLAN
 from vyos.validate import assert_list
 from vyos.util import run
-
+from vyos.util import vyos_dict_search
 
 @Interface.register
 @VLAN.enable
@@ -252,3 +252,58 @@ class EthernetIf(Interface):
         >>> i.set_udp_offload('on')
         """
         return self.set_interface('ufo', state)
+
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # disable ethernet flow control (pause frames)
+        value = 'off' if 'disable_flow_control' in config.keys() else 'on'
+        self.set_flow_control(value)
+
+        # GRO (generic receive offload)
+        tmp = vyos_dict_search('offload_options.generic_receive', config)
+        value = tmp if (tmp != None) else 'off'
+        self.set_gro(value)
+
+        # GSO (generic segmentation offload)
+        tmp = vyos_dict_search('offload_options.generic_segmentation', config)
+        value = tmp if (tmp != None) else 'off'
+        self.set_gso(value)
+
+        # scatter-gather option
+        tmp = vyos_dict_search('offload_options.scatter_gather', config)
+        value = tmp if (tmp != None) else 'off'
+        self.set_sg(value)
+
+        # TSO (TCP segmentation offloading)
+        tmp = vyos_dict_search('offload_options.udp_fragmentation', config)
+        value = tmp if (tmp != None) else 'off'
+        self.set_tso(value)
+
+        # UDP fragmentation offloading
+        tmp = vyos_dict_search('offload_options.udp_fragmentation', config)
+        value = tmp if (tmp != None) else 'off'
+        self.set_ufo(value)
+
+        # Set physical interface speed and duplex
+        if {'speed', 'duplex'} <= set(config):
+            speed = config.get('speed')
+            duplex = config.get('duplex')
+            self.set_speed_duplex(speed, duplex)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/geneve.py b/python/vyos/ifconfig/geneve.py
index 145dc268c..dd0658668 100644
--- a/python/vyos/ifconfig/geneve.py
+++ b/python/vyos/ifconfig/geneve.py
@@ -64,3 +64,22 @@ class GeneveIf(Interface):
         >> dict = GeneveIf().get_config()
         """
         return deepcopy(cls.default)
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
index 8d7b247fc..ef2336c17 100644
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -16,7 +16,10 @@
 import os
 import re
 import json
+import jmespath
+
 from copy import deepcopy
+from glob import glob
 
 from ipaddress import IPv4Network
 from ipaddress import IPv6Address
@@ -28,7 +31,10 @@ from netifaces import AF_INET6
 
 from vyos import ConfigError
 from vyos.configdict import list_diff
+from vyos.configdict import dict_merge
+from vyos.template import render
 from vyos.util import mac2eui64
+from vyos.util import vyos_dict_search
 from vyos.validate import is_ipv4
 from vyos.validate import is_ipv6
 from vyos.validate import is_intf_addr_assigned
@@ -40,11 +46,17 @@ from vyos.validate import assert_positive
 from vyos.validate import assert_range
 
 from vyos.ifconfig.control import Control
-from vyos.ifconfig.dhcp import DHCP
 from vyos.ifconfig.vrrp import VRRP
 from vyos.ifconfig.operational import Operational
 from vyos.ifconfig import Section
 
+def get_ethertype(ethertype_val):
+    if ethertype_val == '0x88A8':
+        return '802.1ad'
+    elif ethertype_val == '0x8100':
+        return '802.1q'
+    else:
+        raise ConfigError('invalid ethertype "{}"'.format(ethertype_val))
 
 class Interface(Control):
     # This is the class which will be used to create
@@ -72,8 +84,12 @@ class Interface(Control):
     _command_get = {
         'admin_state': {
             'shellcmd': 'ip -json link show dev {ifname}',
-            'format': lambda j: 'up' if 'UP' in json.loads(j)[0]['flags'] else 'down',
-        }
+            'format': lambda j: 'up' if 'UP' in jmespath.search('[*].flags | [0]', json.loads(j)) else 'down',
+        },
+        'vlan_protocol': {
+            'shellcmd': 'ip -json -details link show dev {ifname}',
+            'format': lambda j: jmespath.search('[*].linkinfo.info_data.protocol | [0]', json.loads(j)),
+        },
     }
 
     _command_set = {
@@ -197,11 +213,11 @@ class Interface(Control):
 
         # make sure the ifname is the first argument and not from the dict
         self.config['ifname'] = ifname
+        self._admin_state_down_cnt = 0
 
         # we must have updated config before initialising the Interface
         super().__init__(**kargs)
         self.ifname = ifname
-        self.dhcp = DHCP(ifname)
 
         if not self.exists(ifname):
             # Any instance of Interface, such as Interface('eth0')
@@ -322,11 +338,11 @@ class Interface(Control):
             self.set_admin_state('down')
 
         self.set_interface('mac', mac)
-        
+
         # Turn an interface to the 'up' state if it was changed to 'down' by this fucntion
         if prev_state == 'up':
             self.set_admin_state('up')
-    
+
     def set_vrf(self, vrf=''):
         """
         Add/Remove interface from given VRF instance.
@@ -543,6 +559,17 @@ class Interface(Control):
         """
         self.set_interface('alias', ifalias)
 
+    def get_vlan_protocol(self):
+        """
+        Retrieve VLAN protocol in use, this can be 802.1Q, 802.1ad or None
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth0.10').get_vlan_protocol()
+        '802.1Q'
+        """
+        return self.get_interface('vlan_protocol')
+
     def get_admin_state(self):
         """
         Get interface administrative state. Function will return 'up' or 'down'
@@ -564,7 +591,24 @@ class Interface(Control):
         >>> Interface('eth0').get_admin_state()
         'down'
         """
-        return self.set_interface('admin_state', state)
+        # A VLAN interface can only be placed in admin up state when
+        # the lower interface is up, too
+        if self.get_vlan_protocol():
+            lower_interface = glob(f'/sys/class/net/{self.ifname}/lower*/flags')[0]
+            with open(lower_interface, 'r') as f:
+                flags = f.read()
+            # If parent is not up - bail out as we can not bring up the VLAN.
+            # Flags are defined in kernel source include/uapi/linux/if.h
+            if not int(flags, 16) & 1:
+                return None
+
+        if state == 'up':
+            self._admin_state_down_cnt -= 1
+            if self._admin_state_down_cnt < 1:
+                return self.set_interface('admin_state', state)
+        else:
+            self._admin_state_down_cnt += 1
+            return self.set_interface('admin_state', state)
 
     def set_proxy_arp(self, enable):
         """
@@ -679,9 +723,9 @@ class Interface(Control):
 
         # add to interface
         if addr == 'dhcp':
-            self.dhcp.v4.set()
+            self.set_dhcp(True)
         elif addr == 'dhcpv6':
-            self.dhcp.v6.set()
+            self.set_dhcpv6(True)
         elif not is_intf_addr_assigned(self.ifname, addr):
             self._cmd(f'ip addr add "{addr}" '
                     f'{"brd + " if addr_is_v4 else ""}dev "{self.ifname}"')
@@ -720,9 +764,9 @@ class Interface(Control):
 
         # remove from interface
         if addr == 'dhcp':
-            self.dhcp.v4.delete()
+            self.set_dhcp(False)
         elif addr == 'dhcpv6':
-            self.dhcp.v6.delete()
+            self.set_dhcpv6(False)
         elif is_intf_addr_assigned(self.ifname, addr):
             self._cmd(f'ip addr del "{addr}" dev "{self.ifname}"')
         else:
@@ -741,8 +785,8 @@ class Interface(Control):
         Will raise an exception on error.
         """
         # stop DHCP(v6) if running
-        self.dhcp.v4.delete()
-        self.dhcp.v6.delete()
+        self.set_dhcp(False)
+        self.set_dhcpv6(False)
 
         # flush all addresses
         self._cmd(f'ip addr flush dev "{self.ifname}"')
@@ -766,23 +810,103 @@ class Interface(Control):
 
         return True
 
+    def set_dhcp(self, enable):
+        """
+        Enable/Disable DHCP client on a given interface.
+        """
+        if enable not in [True, False]:
+            raise ValueError()
+
+        ifname = self.ifname
+        config_base = r'/var/lib/dhcp/dhclient'
+        config_file = f'{config_base}_{ifname}.conf'
+        options_file = f'{config_base}_{ifname}.options'
+        pid_file = f'{config_base}_{ifname}.pid'
+        lease_file = f'{config_base}_{ifname}.leases'
+
+        if enable and 'disable' not in self._config:
+            if vyos_dict_search('dhcp_options.host_name', self._config) == None:
+                # read configured system hostname.
+                # maybe change to vyos hostd client ???
+                hostname = 'vyos'
+                with open('/etc/hostname', 'r') as f:
+                    hostname = f.read().rstrip('\n')
+                    tmp = {'dhcp_options' : { 'host_name' : hostname}}
+                    self._config = dict_merge(tmp, self._config)
+
+            render(options_file, 'dhcp-client/daemon-options.tmpl',
+                   self._config, trim_blocks=True)
+            render(config_file, 'dhcp-client/ipv4.tmpl',
+                   self._config, trim_blocks=True)
+
+            # 'up' check is mandatory b/c even if the interface is A/D, as soon as
+            # the DHCP client is started the interface will be placed in u/u state.
+            # This is not what we intended to do when disabling an interface.
+            return self._cmd(f'systemctl restart dhclient@{ifname}.service')
+        else:
+            self._cmd(f'systemctl stop dhclient@{ifname}.service')
+
+            # cleanup old config files
+            for file in [config_file, options_file, pid_file, lease_file]:
+                if os.path.isfile(file):
+                    os.remove(file)
+
+
+    def set_dhcpv6(self, enable):
+        """
+        Enable/Disable DHCPv6 client on a given interface.
+        """
+        if enable not in [True, False]:
+            raise ValueError()
+
+        ifname = self.ifname
+        config_file = f'/run/dhcp6c/dhcp6c.{ifname}.conf'
+
+        if enable and 'disable' not in self._config:
+            render(config_file, 'dhcp-client/ipv6.tmpl',
+                   self._config, trim_blocks=True)
+
+            # We must ignore any return codes. This is required to enable DHCPv6-PD
+            # for interfaces which are yet not up and running.
+            return self._popen(f'systemctl restart dhcp6c@{ifname}.service')
+        else:
+            self._popen(f'systemctl stop dhcp6c@{ifname}.service')
+
+            if os.path.isfile(config_file):
+                os.remove(config_file)
+
+
     def update(self, config):
         """ General helper function which works on a dictionary retrived by
         get_config_dict(). It's main intention is to consolidate the scattered
         interface setup code and provide a single point of entry when workin
         on any interface. """
 
+        # Cache the configuration - it will be reused inside e.g. DHCP handler
+        # XXX: maybe pass the option via __init__ in the future and rename this
+        # method to apply()?
+        self._config = config
+
         # Update interface description
-        self.set_alias(config.get('description', None))
+        self.set_alias(config.get('description', ''))
+
+        # Ignore link state changes
+        value = '2' if 'disable_link_detect' in config else '1'
+        self.set_link_detect(value)
 
         # Configure assigned interface IP addresses. No longer
         # configured addresses will be removed first
         new_addr = config.get('address', [])
 
-        # XXX workaround for T2636, convert IP address string to a list
-        # with one element
-        if isinstance(new_addr, str):
-            new_addr = [new_addr]
+        # always ensure DHCP client is stopped (when not configured explicitly)
+        if 'dhcp' not in new_addr:
+            self.del_addr('dhcp')
+
+        # always ensure DHCPv6 client is stopped (when not configured as client
+        # for IPv6 address or prefix delegation
+        dhcpv6pd = vyos_dict_search('dhcpv6_options.pd', config)
+        if 'dhcpv6' not in new_addr or dhcpv6pd == None:
+            self.del_addr('dhcpv6')
 
         # determine IP addresses which are assigned to the interface and build a
         # list of addresses which are no longer in the dict so they can be removed
@@ -793,13 +917,144 @@ class Interface(Control):
         for addr in new_addr:
             self.add_addr(addr)
 
+        # start DHCPv6 client when only PD was configured
+        if dhcpv6pd != None:
+            self.set_dhcpv6(True)
+
         # There are some items in the configuration which can only be applied
         # if this instance is not bound to a bridge. This should be checked
         # by the caller but better save then sorry!
-        if not config.get('is_bridge_member', False):
-            # Bind interface instance into VRF
+        if not any(k in ['is_bond_member', 'is_bridge_member'] for k in config):
+            # Bind interface to given VRF or unbind it if vrf node is not set.
+            # unbinding will call 'ip link set dev eth0 nomaster' which will
+            # also drop the interface out of a bridge or bond - thus this is
+            # checked before
             self.set_vrf(config.get('vrf', ''))
 
-        # Interface administrative state
-        state = 'down' if 'disable' in config.keys() else 'up'
-        self.set_admin_state(state)
+        # Configure ARP cache timeout in milliseconds - has default value
+        tmp = vyos_dict_search('ip.arp_cache_timeout', config)
+        value = tmp if (tmp != None) else '30'
+        self.set_arp_cache_tmo(value)
+
+        # Configure ARP filter configuration
+        tmp = vyos_dict_search('ip.disable_arp_filter', config)
+        value = '0' if (tmp != None) else '1'
+        self.set_arp_filter(value)
+
+        # Configure ARP accept
+        tmp = vyos_dict_search('ip.enable_arp_accept', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_arp_accept(value)
+
+        # Configure ARP announce
+        tmp = vyos_dict_search('ip.enable_arp_announce', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_arp_announce(value)
+
+        # Configure ARP ignore
+        tmp = vyos_dict_search('ip.enable_arp_ignore', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_arp_ignore(value)
+
+        # Enable proxy-arp on this interface
+        tmp = vyos_dict_search('ip.enable_proxy_arp', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_proxy_arp(value)
+
+        # Enable private VLAN proxy ARP on this interface
+        tmp = vyos_dict_search('ip.proxy_arp_pvlan', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_proxy_arp_pvlan(value)
+
+        # IPv6 forwarding
+        tmp = vyos_dict_search('ipv6.disable_forwarding', config)
+        value = '0' if (tmp != None) else '1'
+        self.set_ipv6_forwarding(value)
+
+        # IPv6 router advertisements
+        tmp = vyos_dict_search('ipv6.address.autoconf', config)
+        value = '2' if (tmp != None) else '1'
+        if 'dhcpv6' in new_addr:
+            value = '2'
+        self.set_ipv6_accept_ra(value)
+
+        # IPv6 address autoconfiguration
+        tmp = vyos_dict_search('ipv6.address.autoconf', config)
+        value = '1' if (tmp != None) else '0'
+        self.set_ipv6_autoconf(value)
+
+        # IPv6 Duplicate Address Detection (DAD) tries
+        tmp = vyos_dict_search('ipv6.dup_addr_detect_transmits', config)
+        value = tmp if (tmp != None) else '1'
+        self.set_ipv6_dad_messages(value)
+
+        # MTU - Maximum Transfer Unit
+        if 'mtu' in config:
+            self.set_mtu(config.get('mtu'))
+
+        # Delete old IPv6 EUI64 addresses before changing MAC
+        tmp = vyos_dict_search('ipv6.address.eui64_old', config)
+        if tmp:
+            for addr in tmp:
+                self.del_ipv6_eui64_address(addr)
+
+        # Change interface MAC address - re-set to real hardware address (hw-id)
+        # if custom mac is removed. Skip if bond member.
+        if 'is_bond_member' not in config:
+            mac = config.get('hw_id')
+            if 'mac' in config:
+                mac = config.get('mac')
+            if mac:
+                self.set_mac(mac)
+
+        # Manage IPv6 link-local addresses
+        tmp = vyos_dict_search('ipv6.address.no_default_link_local', config)
+        # we must check explicitly for None type as if the key is set we will
+        # get an empty dict (<class 'dict'>)
+        if tmp is not None:
+            self.del_ipv6_eui64_address('fe80::/64')
+        else:
+            self.add_ipv6_eui64_address('fe80::/64')
+
+        # Add IPv6 EUI-based addresses
+        tmp = vyos_dict_search('ipv6.address.eui64', config)
+        if tmp:
+            for addr in tmp:
+                self.add_ipv6_eui64_address(addr)
+
+        # re-add ourselves to any bridge we might have fallen out of
+        if 'is_bridge_member' in config:
+            bridge = config.get('is_bridge_member')
+            self.add_to_bridge(bridge)
+
+        # remove no longer required 802.1ad (Q-in-Q VLANs)
+        for vif_s_id in config.get('vif_s_remove', {}):
+            self.del_vlan(vif_s_id)
+
+        # create/update 802.1ad (Q-in-Q VLANs)
+        ifname = config['ifname']
+        for vif_s_id, vif_s in config.get('vif_s', {}).items():
+            tmp=get_ethertype(vif_s.get('ethertype', '0x88A8'))
+            s_vlan = self.add_vlan(vif_s_id, ethertype=tmp)
+            vif_s['ifname'] = f'{ifname}.{vif_s_id}'
+            s_vlan.update(vif_s)
+
+            # remove no longer required client VLAN (vif-c)
+            for vif_c_id in vif_s.get('vif_c_remove', {}):
+                s_vlan.del_vlan(vif_c_id)
+
+            # create/update client VLAN (vif-c) interface
+            for vif_c_id, vif_c in vif_s.get('vif_c', {}).items():
+                c_vlan = s_vlan.add_vlan(vif_c_id)
+                vif_c['ifname'] = f'{ifname}.{vif_s_id}.{vif_c_id}'
+                c_vlan.update(vif_c)
+
+        # remove no longer required 802.1q VLAN interfaces
+        for vif_id in config.get('vif_remove', {}):
+            self.del_vlan(vif_id)
+
+        # create/update 802.1q VLAN interfaces
+        for vif_id, vif in config.get('vif', {}).items():
+            vlan = self.add_vlan(vif_id)
+            vif['ifname'] = f'{ifname}.{vif_id}'
+            vlan.update(vif)
diff --git a/python/vyos/ifconfig/loopback.py b/python/vyos/ifconfig/loopback.py
index 7ebd13b54..c70e1773f 100644
--- a/python/vyos/ifconfig/loopback.py
+++ b/python/vyos/ifconfig/loopback.py
@@ -64,16 +64,21 @@ class LoopbackIf(Interface):
         on any interface. """
 
         addr = config.get('address', [])
-        # XXX workaround for T2636, convert IP address string to a list
-        # with one element
-        if isinstance(addr, str):
-            addr = [addr]
-
         # We must ensure that the loopback addresses are never deleted from the system
         addr += self._persistent_addresses
 
         # Update IP address entry in our dictionary
         config.update({'address' : addr})
 
-        # now call the regular function from within our base class
+        # call base class
         super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/macsec.py b/python/vyos/ifconfig/macsec.py
index ea8c9807e..6f570d162 100644
--- a/python/vyos/ifconfig/macsec.py
+++ b/python/vyos/ifconfig/macsec.py
@@ -71,3 +71,22 @@ class MACsecIf(Interface):
             'source_interface': '',
         }
         return config
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/macvlan.py b/python/vyos/ifconfig/macvlan.py
index b5481f4a7..b068ce873 100644
--- a/python/vyos/ifconfig/macvlan.py
+++ b/python/vyos/ifconfig/macvlan.py
@@ -68,3 +68,22 @@ class MACVLANIf(Interface):
         >> dict = MACVLANIf().get_config()
         """
         return deepcopy(cls.default)
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/vrrp.py b/python/vyos/ifconfig/vrrp.py
index 5e6387881..01a7cc7ab 100644
--- a/python/vyos/ifconfig/vrrp.py
+++ b/python/vyos/ifconfig/vrrp.py
@@ -96,7 +96,7 @@ class VRRP(object):
             pid = util.read_file(cls.location['pid'])
             os.kill(int(pid), cls._signal[what])
 
-            # shoud look for file size change ?
+            # should look for file size change?
             sleep(0.2)
             return util.read_file(fname)
         except FileNotFoundError:
@@ -126,8 +126,8 @@ class VRRP(object):
         return disabled
 
     @classmethod
-    def format (cls, data):
-        headers = ["Name", "Interface", "VRID", "State", "Last Transition"]
+    def format(cls, data):
+        headers = ["Name", "Interface", "VRID", "State", "Priority", "Last Transition"]
         groups = []
 
         data = json.loads(data)
@@ -138,11 +138,12 @@ class VRRP(object):
             intf = data['ifp_ifname']
             vrid = data['vrid']
             state = cls.decode_state(data["state"])
+            priority = data['effective_priority']
 
             since = int(time() - float(data['last_transition']))
             last = util.seconds_to_human(since)
 
-            groups.append([name, intf, vrid, state, last])
+            groups.append([name, intf, vrid, state, priority, last])
 
         # add to the active list disabled instances
         groups.extend(cls.disabled())
diff --git a/python/vyos/ifconfig/vxlan.py b/python/vyos/ifconfig/vxlan.py
index 973b4ef05..18a500336 100644
--- a/python/vyos/ifconfig/vxlan.py
+++ b/python/vyos/ifconfig/vxlan.py
@@ -47,8 +47,8 @@ class VXLANIf(Interface):
         'port': 8472,   # The Linux implementation of VXLAN pre-dates
                         # the IANA's selection of a standard destination port
         'remote': '',
-        'src_address': '',
-        'src_interface': '',
+        'source_address': '',
+        'source_interface': '',
         'vni': 0
     }
     definition = {
@@ -60,29 +60,29 @@ class VXLANIf(Interface):
         }
     }
     options = Interface.options + \
-        ['group', 'remote', 'src_interface', 'port', 'vni', 'src_address']
+        ['group', 'remote', 'source_interface', 'port', 'vni', 'source_address']
 
     mapping = {
         'ifname': 'add',
         'vni':    'id',
         'port':   'dstport',
-        'src_address': 'local',
-        'src_interface': 'dev',
+        'source_address': 'local',
+        'source_interface': 'dev',
     }
 
     def _create(self):
         cmdline = ['ifname', 'type', 'vni', 'port']
 
-        if self.config['src_address']:
-            cmdline.append('src_address')
+        if self.config['source_address']:
+            cmdline.append('source_address')
 
         if self.config['remote']:
             cmdline.append('remote')
 
-        if self.config['group'] or self.config['src_interface']:
-            if self.config['group'] and self.config['src_interface']:
+        if self.config['group'] or self.config['source_interface']:
+            if self.config['group'] and self.config['source_interface']:
                 cmdline.append('group')
-                cmdline.append('src_interface')
+                cmdline.append('source_interface')
             else:
                 ifname = self.config['ifname']
                 raise ConfigError(
@@ -109,3 +109,22 @@ class VXLANIf(Interface):
         >> dict = VXLANIf().get_config()
         """
         return deepcopy(cls.default)
+
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
diff --git a/python/vyos/ifconfig/wireguard.py b/python/vyos/ifconfig/wireguard.py
index 62ca57ca2..fad4ef282 100644
--- a/python/vyos/ifconfig/wireguard.py
+++ b/python/vyos/ifconfig/wireguard.py
@@ -24,7 +24,7 @@ from hurry.filesize import alternative
 from vyos.config import Config
 from vyos.ifconfig import Interface
 from vyos.ifconfig import Operational
-
+from vyos.validate import is_ipv6
 
 class WireGuardOperational(Operational):
     def _dump(self):
@@ -169,65 +169,79 @@ class WireGuardIf(Interface):
         ['port', 'private_key', 'pubkey', 'psk',
          'allowed_ips', 'fwmark', 'endpoint', 'keepalive']
 
-    """
-    Wireguard interface class, contains a comnfig dictionary since
-    wireguard VPN is being comnfigured via the wg command rather than
-    writing the config into a file. Otherwise if a pre-shared key is used
-    (symetric enryption key), it would we exposed within multiple files.
-    Currently it's only within the config.boot if the config was saved.
-
-    Example:
-    >>> from vyos.ifconfig import WireGuardIf as wg_if
-    >>> wg_intfc = wg_if("wg01")
-    >>> print (wg_intfc.wg_config)
-    {'private_key': None, 'keepalive': 0, 'endpoint': None, 'port': 0,
-    'allowed_ips': [], 'pubkey': None, 'fwmark': 0, 'psk': '/dev/null'}
-    >>> wg_intfc.wg_config['keepalive'] = 100
-    >>> print (wg_intfc.wg_config)
-    {'private_key': None, 'keepalive': 100, 'endpoint': None, 'port': 0,
-    'allowed_ips': [], 'pubkey': None, 'fwmark': 0, 'psk': '/dev/null'}
-    """
-
-    def update(self):
-        if not self.config['private_key']:
-            raise ValueError("private key required")
-        else:
-            # fmask permission check?
-            pass
-
-        cmd  = 'wg set {ifname}'.format(**self.config)
-        cmd += ' listen-port {port}'.format(**self.config)
-        cmd += ' fwmark "{fwmark}" '.format(**self.config)
-        cmd += ' private-key {private_key}'.format(**self.config)
-        cmd += ' peer {pubkey}'.format(**self.config)
-        cmd += ' persistent-keepalive {keepalive}'.format(**self.config)
-        # allowed-ips must be properly quoted else the interface can't be properly
-        # created as the wg utility will tread multiple IP addresses as command
-        # parameters
-        cmd += ' allowed-ips "{}"'.format(','.join(self.config['allowed-ips']))
-
-        if self.config['endpoint']:
-            cmd += ' endpoint "{endpoint}"'.format(**self.config)
-
-        psk_file = ''
-        if self.config['psk']:
-            psk_file = '/tmp/{ifname}.psk'.format(**self.config)
-            with open(psk_file, 'w') as f:
-                f.write(self.config['psk'])
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # remove no longer associated peers first
+        if 'peer_remove' in config:
+            for tmp in config['peer_remove']:
+                peer = config['peer_remove'][tmp]
+                peer['ifname'] = config['ifname']
+
+                cmd = 'wg set {ifname} peer {pubkey} remove'
+                self._cmd(cmd.format(**peer))
+
+        # Wireguard base command is identical for every peer
+        base_cmd  = 'wg set {ifname} private-key {private_key}'
+        if 'port' in config:
+            base_cmd += ' listen-port {port}'
+        if 'fwmark' in config:
+            base_cmd += ' fwmark {fwmark}'
+
+        base_cmd = base_cmd.format(**config)
+
+        for tmp in config['peer']:
+            peer = config['peer'][tmp]
+
+            # start of with a fresh 'wg' command
+            cmd = base_cmd + ' peer {pubkey}'
+
+            # If no PSK is given remove it by using /dev/null - passing keys via
+            # the shell (usually bash) is considered insecure, thus we use a file
+            no_psk_file = '/dev/null'
+            psk_file = no_psk_file
+            if 'preshared_key' in peer:
+                psk_file = '/tmp/tmp.wireguard.psk'
+                with open(psk_file, 'w') as f:
+                    f.write(peer['preshared_key'])
             cmd += f' preshared-key {psk_file}'
 
-        self._cmd(cmd)
-
-        # PSK key file is not required to be stored persistently as its backed by CLI
-        if os.path.exists(psk_file):
-            os.remove(psk_file)
-
-    def remove_peer(self, peerkey):
-        """
-        Remove a peer of an interface, peers are identified by their public key.
-        Giving it a readable name is a vyos feature, to remove a peer the pubkey
-        and the interface is needed, to remove the entry.
-        """
-        cmd = "wg set {0} peer {1} remove".format(
-            self.config['ifname'], str(peerkey))
-        return self._cmd(cmd)
+            # Persistent keepalive is optional
+            if 'persistent_keepalive'in peer:
+                cmd += ' persistent-keepalive {persistent_keepalive}'
+
+            # Multiple allowed-ip ranges can be defined - ensure we are always
+            # dealing with a list
+            if isinstance(peer['allowed_ips'], str):
+                peer['allowed_ips'] = [peer['allowed_ips']]
+            cmd += ' allowed-ips ' + ','.join(peer['allowed_ips'])
+
+            # Endpoint configuration is optional
+            if {'address', 'port'} <= set(peer):
+                if is_ipv6(config['address']):
+                    cmd += ' endpoint [{address}]:{port}'
+                else:
+                    cmd += ' endpoint {address}:{port}'
+
+            self._cmd(cmd.format(**peer))
+
+            # PSK key file is not required to be stored persistently as its backed by CLI
+            if psk_file != no_psk_file and os.path.exists(psk_file):
+                os.remove(psk_file)
+
+        # call base class
+        super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
+
diff --git a/python/vyos/ifconfig/wireless.py b/python/vyos/ifconfig/wireless.py
index 3122ac0a3..a50346ffa 100644
--- a/python/vyos/ifconfig/wireless.py
+++ b/python/vyos/ifconfig/wireless.py
@@ -71,6 +71,25 @@ class WiFiIf(Interface):
         return config
 
 
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+
+        # call base class first
+        super().update(config)
+
+        # Enable/Disable of an interface must always be done at the end of the
+        # derived class to make use of the ref-counting set_admin_state()
+        # function. We will only enable the interface if 'up' was called as
+        # often as 'down'. This is required by some interface implementations
+        # as certain parameters can only be changed when the interface is
+        # in admin-down state. This ensures the link does not flap during
+        # reconfiguration.
+        state = 'down' if 'disable' in config else 'up'
+        self.set_admin_state(state)
+
 
 @Interface.register
 class WiFiModemIf(WiFiIf):