ifconfig: backport ifconfig framework from 1.4 to support new tunnel options

It is easier to backport the entire vyos.ifconfig library from 1.4 instead of
backporting single pieces which are required to add new feature to the tunnel
interface section.

In addition that both libraries are now back in sync it will become much easier
to backport any other new feature introduced in VyOS 1.4!

17 files changed, 343 insertions, 368 deletions

diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index ee0fd94f7..0fb3501e8 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -84,6 +84,50 @@ def verify_mtu_ipv6(config):
             if tmp and 'eui64' in tmp:
                 raise ConfigError(error_msg)
 
+def verify_tunnel(config):
+    """
+    This helper is used to verify the common part of the tunnel
+    """
+    from vyos.template import is_ipv4
+    from vyos.template import is_ipv6
+
+    if 'encapsulation' not in config:
+        raise ConfigError('Must configure the tunnel encapsulation for '\
+                          '{ifname}!'.format(**config))
+
+    if 'source_address' not in config and 'dhcp_interface' not in config:
+        raise ConfigError('source-address is mandatory for tunnel')
+
+    if 'remote' not in config and config['encapsulation'] != 'gre':
+        raise ConfigError('remote-ip address is mandatory for tunnel')
+
+    if {'source_address', 'dhcp_interface'} <= set(config):
+        raise ConfigError('Can not use both source-address and dhcp-interface')
+
+    if config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+        error_ipv6 = 'Encapsulation mode requires IPv6'
+        if 'source_address' in config and not is_ipv6(config['source_address']):
+            raise ConfigError(f'{error_ipv6} source-address')
+
+        if 'remote' in config and not is_ipv6(config['remote']):
+            raise ConfigError(f'{error_ipv6} remote-ip address')
+    else:
+        error_ipv4 = 'Encapsulation mode requires IPv4'
+        if 'source_address' in config and not is_ipv4(config['source_address']):
+            raise ConfigError(f'{error_ipv4} source-address')
+
+        if 'remote' in config and not is_ipv4(config['remote']):
+            raise ConfigError(f'{error_ipv4} remote address')
+
+    if config['encapsulation'] in ['sit', 'gretap']:
+        if 'source_interface' in config:
+            encapsulation = config['encapsulation']
+            raise ConfigError(f'Option source-interface can not be used with ' \
+                              f'encapsulation "{encapsulation}"!')
+    elif config['encapsulation'] == 'gre':
+        if 'source_address' in config and is_ipv6(config['source_address']):
+            raise ConfigError('Can not use local IPv6 address is for mGRE tunnels')
+
 def verify_vrf(config):
     """
     Common helper function used by interface implementations to perform
diff --git a/python/vyos/ifconfig/__init__.py b/python/vyos/ifconfig/__init__.py
index 1c77a9e55..cbde93c97 100644
--- a/python/vyos/ifconfig/__init__.py
+++ b/python/vyos/ifconfig/__init__.py
@@ -29,14 +29,7 @@ from vyos.ifconfig.macvlan import MACVLANIf
 from vyos.ifconfig.vxlan import VXLANIf
 from vyos.ifconfig.wireguard import WireGuardIf
 from vyos.ifconfig.vtun import VTunIf
-from vyos.ifconfig.tunnel import GREIf
-from vyos.ifconfig.tunnel import GRETapIf
-from vyos.ifconfig.tunnel import IP6GREIf
-from vyos.ifconfig.tunnel import IPIPIf
-from vyos.ifconfig.tunnel import IPIP6If
-from vyos.ifconfig.tunnel import IP6IP6If
-from vyos.ifconfig.tunnel import SitIf
-from vyos.ifconfig.tunnel import Sit6RDIf
+from vyos.ifconfig.tunnel import TunnelIf
 from vyos.ifconfig.wireless import WiFiIf
 from vyos.ifconfig.l2tpv3 import L2TPv3If
 from vyos.ifconfig.macsec import MACsecIf
diff --git a/python/vyos/ifconfig/bond.py b/python/vyos/ifconfig/bond.py
index 78ce27bba..27d0182e9 100644
--- a/python/vyos/ifconfig/bond.py
+++ b/python/vyos/ifconfig/bond.py
@@ -31,9 +31,7 @@ class BondIf(Interface):
     monitoring may be performed.
     """
 
-    default = {
-        'type': 'bond',
-    }
+    iftype = 'bond'
     definition = {
         **Interface.definition,
         ** {
diff --git a/python/vyos/ifconfig/bridge.py b/python/vyos/ifconfig/bridge.py
index 116ed22c0..65a4506c5 100644
--- a/python/vyos/ifconfig/bridge.py
+++ b/python/vyos/ifconfig/bridge.py
@@ -34,9 +34,7 @@ class BridgeIf(Interface):
     The Linux bridge code implements a subset of the ANSI/IEEE 802.1d standard.
     """
 
-    default = {
-        'type': 'bridge',
-    }
+    iftype = 'bridge'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/dummy.py b/python/vyos/ifconfig/dummy.py
index f2a4106e6..50a7a710b 100644
--- a/python/vyos/ifconfig/dummy.py
+++ b/python/vyos/ifconfig/dummy.py
@@ -23,9 +23,7 @@ class DummyIf(Interface):
     packets through without actually transmitting them.
     """
 
-    default = {
-        'type': 'dummy',
-    }
+    iftype = 'dummy'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/ethernet.py b/python/vyos/ifconfig/ethernet.py
index aa7da35d5..df6b96fbf 100644
--- a/python/vyos/ifconfig/ethernet.py
+++ b/python/vyos/ifconfig/ethernet.py
@@ -27,9 +27,7 @@ class EthernetIf(Interface):
     Abstraction of a Linux Ethernet Interface
     """
 
-    default = {
-        'type': 'ethernet',
-    }
+    iftype = 'ethernet'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/geneve.py b/python/vyos/ifconfig/geneve.py
index 0a3711dab..35b7680a1 100644
--- a/python/vyos/ifconfig/geneve.py
+++ b/python/vyos/ifconfig/geneve.py
@@ -27,11 +27,7 @@ class GeneveIf(Interface):
     https://lwn.net/Articles/644938/
     """
 
-    default = {
-        'type': 'geneve',
-        'vni': 0,
-        'remote': '',
-    }
+    iftype = 'geneve'
     options = Interface.options + \
         ['vni', 'remote']
     definition = {
diff --git a/python/vyos/ifconfig/interface.py b/python/vyos/ifconfig/interface.py
index fb658bd61..9c02af68f 100644
--- a/python/vyos/ifconfig/interface.py
+++ b/python/vyos/ifconfig/interface.py
@@ -1,4 +1,4 @@
-# Copyright 2019-2020 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -61,7 +61,6 @@ class Interface(Control):
     options = ['debug', 'create']
     required = []
     default = {
-        'type': '',
         'debug': True,
         'create': True,
     }
@@ -115,6 +114,10 @@ class Interface(Control):
             'convert': lambda name: name if name else '',
             'shellcmd': 'ip link set dev {ifname} alias "{value}"',
         },
+        'bridge_port_isolation': {
+            'validate': lambda v: assert_list(v, ['on', 'off']),
+            'shellcmd': 'bridge link set dev {ifname} isolated {value}',
+        },
         'mac': {
             'validate': assert_mac,
             'shellcmd': 'ip link set dev {ifname} address {value}',
@@ -233,26 +236,21 @@ class Interface(Control):
         >>> from vyos.ifconfig import Interface
         >>> i = Interface('eth0')
         """
+        self.config = deepcopy(kargs)
+        self.config['ifname'] = self.ifname = ifname
 
-        self.config = deepcopy(self.default)
-        for k in self.options:
-            if k in kargs:
-                self.config[k] = kargs[k]
-
-        # make sure the ifname is the first argument and not from the dict
-        self.config['ifname'] = ifname
         self._admin_state_down_cnt = 0
 
         # we must have updated config before initialising the Interface
         super().__init__(**kargs)
-        self.ifname = ifname
 
         if not self.exists(ifname):
-            # Any instance of Interface, such as Interface('eth0')
-            # can be used safely to access the generic function in this class
-            # as 'type' is unset, the class can not be created
-            if not self.config['type']:
+            # Any instance of Interface, such as Interface('eth0') can be used
+            # safely to access the generic function in this class as 'type' is
+            # unset, the class can not be created
+            if not self.iftype:
                 raise Exception(f'interface "{ifname}" not found')
+            self.config['type'] = self.iftype
 
             # Should an Instance of a child class (EthernetIf, DummyIf, ..)
             # be required, then create should be set to False to not accidentally create it.
@@ -696,6 +694,20 @@ class Interface(Control):
         """
         self.set_interface('path_priority', priority)
 
+    def set_port_isolation(self, on_or_off):
+        """
+        Controls whether a given port will be isolated, which means it will be
+        able to communicate with non-isolated ports only. By default this flag
+        is off.
+
+        Use enable=1 to enable or enable=0 to disable
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth1').set_port_isolation('on')
+        """
+        self.set_interface('bridge_port_isolation', on_or_off)
+
     def set_proxy_arp(self, enable):
         """
         Set per interface proxy ARP configuration
@@ -736,6 +748,7 @@ class Interface(Control):
         """
         Retrieve assigned IPv4 addresses from given interface.
         This is done using the netifaces and ipaddress python modules.
+
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_addr_v4()
@@ -750,28 +763,18 @@ class Interface(Control):
                 ipv4.append(v4_addr['addr'] + prefix)
         return ipv4
 
-    def get_addr(self):
+    def get_addr_v6(self):
         """
-        Retrieve assigned IPv4 and IPv6 addresses from given interface.
+        Retrieve assigned IPv6 addresses from given interface.
         This is done using the netifaces and ipaddress python modules.
 
         Example:
         >>> from vyos.ifconfig import Interface
-        >>> Interface('eth0').get_addrs()
-        ['172.16.33.30/24', 'fe80::20c:29ff:fe11:a174/64']
+        >>> Interface('eth0').get_addr_v6()
+        ['fe80::20c:29ff:fe11:a174/64']
         """
-
-        ipv4 = []
         ipv6 = []
-
-        if AF_INET in ifaddresses(self.config['ifname']).keys():
-            for v4_addr in ifaddresses(self.config['ifname'])[AF_INET]:
-                # we need to manually assemble a list of IPv4 address/prefix
-                prefix = '/' + \
-                    str(IPv4Network('0.0.0.0/' + v4_addr['netmask']).prefixlen)
-                ipv4.append(v4_addr['addr'] + prefix)
-
-        if AF_INET6 in ifaddresses(self.config['ifname']).keys():
+        if AF_INET6 in ifaddresses(self.config['ifname']):
             for v6_addr in ifaddresses(self.config['ifname'])[AF_INET6]:
                 # Note that currently expanded netmasks are not supported. That means
                 # 2001:db00::0/24 is a valid argument while 2001:db00::0/ffff:ff00:: not.
@@ -784,8 +787,18 @@ class Interface(Control):
                 # addresses
                 v6_addr['addr'] = v6_addr['addr'].split('%')[0]
                 ipv6.append(v6_addr['addr'] + prefix)
+        return ipv6
 
-        return ipv4 + ipv6
+    def get_addr(self):
+        """
+        Retrieve assigned IPv4 and IPv6 addresses from given interface.
+
+        Example:
+        >>> from vyos.ifconfig import Interface
+        >>> Interface('eth0').get_addr()
+        ['172.16.33.30/24', 'fe80::20c:29ff:fe11:a174/64']
+        """
+        return self.get_addr_v4() + self.get_addr_v6()
 
     def add_addr(self, addr):
         """
@@ -919,49 +932,42 @@ class Interface(Control):
             if 'priority' in bridge_config:
                 self.set_path_cost(bridge_config['priority'])
 
-            vlan_filter = 0
-            vlan_add = set()
-
-            del_ifname_vlan_ids = get_vlan_ids(ifname)
             bridge_vlan_filter = Section.klass(bridge)(bridge, create=True).get_vlan_filter()
 
-            if bridge_vlan_filter:
-                if 1 in del_ifname_vlan_ids:
-                    del_ifname_vlan_ids.remove(1)
-                vlan_filter = 1
-
-            for vlan in del_ifname_vlan_ids:
-                cmd = f'bridge vlan del dev {ifname} vid {vlan}'
-                self._cmd(cmd)
-
-            if 'native_vlan' in bridge_config:
-                vlan_filter = 1
-                cmd = f'bridge vlan del dev {self.ifname} vid 1'
-                self._cmd(cmd)
-                vlan_id = bridge_config['native_vlan']
-                cmd = f'bridge vlan add dev {self.ifname} vid {vlan_id} pvid untagged master'
-                self._cmd(cmd)
-                vlan_add.add(vlan_id)
-
-            if 'allowed_vlan' in bridge_config:
-                vlan_filter = 1
-                if 'native_vlan' not in bridge_config:
-                    cmd = f'bridge vlan del dev {self.ifname} vid 1'
-                    self._cmd(cmd)
-                for vlan in bridge_config['allowed_vlan']:
-                    cmd = f'bridge vlan add dev {self.ifname} vid {vlan} master'
+            if int(bridge_vlan_filter):
+                cur_vlan_ids = get_vlan_ids(ifname)
+                add_vlan = []
+                native_vlan_id = None
+                allowed_vlan_ids= []
+
+                if 'native_vlan' in bridge_config:
+                    vlan_id = bridge_config['native_vlan']
+                    add_vlan.append(vlan_id)
+                    native_vlan_id = vlan_id
+
+                if 'allowed_vlan' in bridge_config:
+                    for vlan in bridge_config['allowed_vlan']:
+                        vlan_range = vlan.split('-')
+                        if len(vlan_range) == 2:
+                            for vlan_add in range(int(vlan_range[0]),int(vlan_range[1]) + 1):
+                                add_vlan.append(str(vlan_add))
+                                allowed_vlan_ids.append(str(vlan_add))
+                        else:
+                            add_vlan.append(vlan)
+                            allowed_vlan_ids.append(vlan)
+
+                # Remove redundant VLANs from the system
+                for vlan in list_diff(cur_vlan_ids, add_vlan):
+                    cmd = f'bridge vlan del dev {ifname} vid {vlan} master'
                     self._cmd(cmd)
-                    vlan_add.add(vlan)
 
-            if vlan_filter:
-                # Setting VLAN ID for the bridge
-                for vlan in vlan_add:
-                    cmd = f'bridge vlan add dev {bridge} vid {vlan} self'
+                for vlan in allowed_vlan_ids:
+                    cmd = f'bridge vlan add dev {ifname} vid {vlan} master'
+                    self._cmd(cmd)
+                # Setting native VLAN to system
+                if native_vlan_id:
+                    cmd = f'bridge vlan add dev {ifname} vid {native_vlan_id} pvid untagged master'
                     self._cmd(cmd)
-
-                # enable/disable Vlan Filter
-                # When the VLAN aware option is not detected, the setting of `bridge` should not be overwritten
-                Section.klass(bridge)(bridge, create=True).set_vlan_filter(vlan_filter)
 
     def set_dhcp(self, enable):
         """
@@ -1042,9 +1048,11 @@ class Interface(Control):
             source_if = next(iter(self._config['is_mirror_intf']))
             config = self._config['is_mirror_intf'][source_if].get('mirror', None)
 
+        # Please do not clear the 'set $? = 0 '. It's meant to force a return of 0
         # Remove existing mirroring rules
-        delete_tc_cmd  = f'tc qdisc del dev {source_if} handle ffff: ingress; '
-        delete_tc_cmd += f'tc qdisc del dev {source_if} handle 1: root prio'
+        delete_tc_cmd  = f'tc qdisc del dev {source_if} handle ffff: ingress 2> /dev/null;'
+        delete_tc_cmd += f'tc qdisc del dev {source_if} handle 1: root prio 2> /dev/null;'
+        delete_tc_cmd += 'set $?=0'
         self._popen(delete_tc_cmd)
 
         # Bail out early if nothing needs to be configured
@@ -1068,7 +1076,6 @@ class Interface(Control):
             mirror_cmd += f'tc filter add dev {source_if} parent {parent} protocol all prio 10 u32 match u32 0 0 flowid 1:1 action mirred egress mirror dev {mirror_if}'
             self._popen(mirror_cmd)
 
-
     def update(self, config):
         """ General helper function which works on a dictionary retrived by
         get_config_dict(). It's main intention is to consolidate the scattered
@@ -1306,29 +1313,62 @@ class Interface(Control):
 
         # create/update 802.1q VLAN interfaces
         for vif_id, vif_config in config.get('vif', {}).items():
+
+            vif_ifname = f'{ifname}.{vif_id}'
+            vif_config['ifname'] = vif_ifname
+
             tmp = deepcopy(VLANIf.get_config())
             tmp['source_interface'] = ifname
             tmp['vlan_id'] = vif_id
 
-            vif_ifname = f'{ifname}.{vif_id}'
-            vif_config['ifname'] = vif_ifname
+            # We need to ensure that the string format is consistent, and we need to exclude redundant spaces.
+            sep = ' '
+            if 'egress_qos' in vif_config:
+                # Unwrap strings into arrays
+                egress_qos_array = vif_config['egress_qos'].split()
+                # The split array is spliced according to the fixed format
+                tmp['egress_qos'] = sep.join(egress_qos_array)
+
+            if 'ingress_qos' in vif_config:
+                # Unwrap strings into arrays
+                ingress_qos_array = vif_config['ingress_qos'].split()
+                # The split array is spliced according to the fixed format
+                tmp['ingress_qos'] = sep.join(ingress_qos_array)
+
+            # Since setting the QoS control parameters in the later stage will
+            # not completely delete the old settings,
+            # we still need to delete the VLAN encapsulation interface in order to
+            # ensure that the changed settings are effective.
+            cur_cfg = get_interface_config(vif_ifname)
+            qos_str = ''
+            tmp2 = dict_search('linkinfo.info_data.ingress_qos', cur_cfg)
+            if 'ingress_qos' in tmp and tmp2:
+                for item in tmp2:
+                    from_key = item['from']
+                    to_key = item['to']
+                    qos_str += f'{from_key}:{to_key} '
+                if qos_str != tmp['ingress_qos']:
+                    if self.exists(vif_ifname):
+                        VLANIf(vif_ifname).remove()
+
+            qos_str = ''
+            tmp2 = dict_search('linkinfo.info_data.egress_qos', cur_cfg)
+            if 'egress_qos' in tmp and tmp2:
+                for item in tmp2:
+                    from_key = item['from']
+                    to_key = item['to']
+                    qos_str += f'{from_key}:{to_key} '
+                if qos_str != tmp['egress_qos']:
+                    if self.exists(vif_ifname):
+                        VLANIf(vif_ifname).remove()
+
             vlan = VLANIf(vif_ifname, **tmp)
             vlan.update(vif_config)
 
 
 class VLANIf(Interface):
     """ Specific class which abstracts 802.1q and 802.1ad (Q-in-Q) VLAN interfaces """
-    default = {
-        'type': 'vlan',
-        'source_interface': '',
-        'vlan_id': '',
-        'protocol': '',
-        'ingress_qos': '',
-        'egress_qos': '',
-    }
-
-    options = Interface.options + \
-        ['source_interface', 'vlan_id', 'protocol', 'ingress_qos', 'egress_qos']
+    iftype = 'vlan'
 
     def _create(self):
         # bail out early if interface already exists
@@ -1336,11 +1376,11 @@ class VLANIf(Interface):
             return
 
         cmd = 'ip link add link {source_interface} name {ifname} type vlan id {vlan_id}'
-        if self.config['protocol']:
+        if 'protocol' in self.config:
             cmd += ' protocol {protocol}'
-        if self.config['ingress_qos']:
+        if 'ingress_qos' in self.config:
             cmd += ' ingress-qos-map {ingress_qos}'
-        if self.config['egress_qos']:
+        if 'egress_qos' in self.config:
             cmd += ' egress-qos-map {egress_qos}'
 
         self._cmd(cmd.format(**self.config))
diff --git a/python/vyos/ifconfig/l2tpv3.py b/python/vyos/ifconfig/l2tpv3.py
index 76d6e6311..7ff0fdd0e 100644
--- a/python/vyos/ifconfig/l2tpv3.py
+++ b/python/vyos/ifconfig/l2tpv3.py
@@ -1,4 +1,4 @@
-# Copyright 2019 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -24,19 +24,7 @@ class L2TPv3If(Interface):
     either hot standby or load balancing services. Additionally, link integrity
     monitoring may be performed.
     """
-
-    default = {
-        'type': 'l2tp',
-        'peer_tunnel_id': '',
-        'local_port': 0,
-        'remote_port': 0,
-        'encapsulation': 'udp',
-        'local_address': '',
-        'remote_address': '',
-        'session_id': '',
-        'tunnel_id': '',
-        'peer_session_id': ''
-    }
+    iftype = 'l2tp'
     definition = {
         **Interface.definition,
         **{
@@ -45,20 +33,16 @@ class L2TPv3If(Interface):
             'bridgeable': True,
         }
     }
-    options = Interface.options + \
-        ['tunnel_id', 'peer_tunnel_id', 'local_port', 'remote_port',
-         'encapsulation', 'local_address', 'remote_address', 'session_id',
-         'peer_session_id']
 
     def _create(self):
         # create tunnel interface
         cmd = 'ip l2tp add tunnel tunnel_id {tunnel_id}'
         cmd += ' peer_tunnel_id {peer_tunnel_id}'
-        cmd += ' udp_sport {local_port}'
-        cmd += ' udp_dport {remote_port}'
+        cmd += ' udp_sport {source_port}'
+        cmd += ' udp_dport {destination_port}'
         cmd += ' encap {encapsulation}'
-        cmd += ' local {local_address}'
-        cmd += ' remote {remote_address}'
+        cmd += ' local {source_address}'
+        cmd += ' remote {remote}'
         self._cmd(cmd.format(**self.config))
 
         # setup session
@@ -82,15 +66,15 @@ class L2TPv3If(Interface):
         >>> i.remove()
         """
 
-        if self.exists(self.config['ifname']):
+        if self.exists(self.ifname):
             # interface is always A/D down. It needs to be enabled explicitly
             self.set_admin_state('down')
 
-            if self.config['tunnel_id'] and self.config['session_id']:
+            if {'tunnel_id', 'session_id'} <= set(self.config):
                 cmd = 'ip l2tp del session tunnel_id {tunnel_id}'
                 cmd += ' session_id {session_id}'
                 self._cmd(cmd.format(**self.config))
 
-            if self.config['tunnel_id']:
+            if 'tunnel_id' in self.config:
                 cmd = 'ip l2tp del tunnel tunnel_id {tunnel_id}'
                 self._cmd(cmd.format(**self.config))
diff --git a/python/vyos/ifconfig/loopback.py b/python/vyos/ifconfig/loopback.py
index e911ecbd9..768d1eaf0 100644
--- a/python/vyos/ifconfig/loopback.py
+++ b/python/vyos/ifconfig/loopback.py
@@ -22,9 +22,7 @@ class LoopbackIf(Interface):
     uses to communicate with itself.
     """
     _persistent_addresses = ['127.0.0.1/8', '::1/128']
-    default = {
-        'type': 'loopback',
-    }
+    iftype = 'loopback'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/macsec.py b/python/vyos/ifconfig/macsec.py
index a229eaed5..b805f7bf7 100644
--- a/python/vyos/ifconfig/macsec.py
+++ b/python/vyos/ifconfig/macsec.py
@@ -28,11 +28,7 @@ class MACsecIf(Interface):
     those solutions are used for their own specific use cases.
     """
 
-    default = {
-        'type': 'macsec',
-        'security_cipher': '',
-        'source_interface': ''
-    }
+    iftype = 'macsec'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/macvlan.py b/python/vyos/ifconfig/macvlan.py
index 894215539..8dca7c14e 100644
--- a/python/vyos/ifconfig/macvlan.py
+++ b/python/vyos/ifconfig/macvlan.py
@@ -21,12 +21,7 @@ class MACVLANIf(Interface):
     Abstraction of a Linux MACvlan interface
     """
 
-    default = {
-        'type': 'macvlan',
-        'address': '',
-        'source_interface': '',
-        'mode': '',
-    }
+    iftype = 'macvlan'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/tunnel.py b/python/vyos/ifconfig/tunnel.py
index 6f9d7abbf..e40756cc7 100644
--- a/python/vyos/ifconfig/tunnel.py
+++ b/python/vyos/ifconfig/tunnel.py
@@ -1,4 +1,4 @@
-# Copyright 2019-2020 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -16,13 +16,12 @@
 # https://developers.redhat.com/blog/2019/05/17/an-introduction-to-linux-virtual-interfaces-tunnels/
 # https://community.hetzner.com/tutorials/linux-setup-gre-tunnel
 
-from copy import deepcopy
-
 from netaddr import EUI
 from netaddr import mac_unix_expanded
 from random import getrandbits
 
 from vyos.ifconfig.interface import Interface
+from vyos.util import dict_search
 from vyos.validate import assert_list
 
 def enable_to_on(value):
@@ -32,11 +31,10 @@ def enable_to_on(value):
         return 'off'
     raise ValueError(f'expect enable or disable but got "{value}"')
 
-
 @Interface.register
-class _Tunnel(Interface):
+class TunnelIf(Interface):
     """
-    _Tunnel: private base class for tunnels
+    Tunnel: private base class for tunnels
     https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/tunnel.c
     https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/ip6tunnel.c
     """
@@ -49,54 +47,127 @@ class _Tunnel(Interface):
         },
     }
 
+    # This table represents a mapping from VyOS internal config dict to
+    # arguments used by iproute2. For more information please refer to:
+    # - https://man7.org/linux/man-pages/man8/ip-link.8.html
+    # - https://man7.org/linux/man-pages/man8/ip-tunnel.8.html
+    mapping = {
+        'source_address'                  : 'local',
+        'source_interface'                : 'dev',
+        'remote'                          : 'remote',
+        'parameters.ip.key'               : 'key',
+        'parameters.ip.tos'               : 'tos',
+        'parameters.ip.ttl'               : 'ttl',
+    }
+    mapping_ipv4 = {
+        'parameters.ip.key'               : 'key',
+        'parameters.ip.no_pmtu_discovery' : 'nopmtudisc',
+        'parameters.ip.ignore_df'         : 'ignore-df',
+        'parameters.ip.tos'               : 'tos',
+        'parameters.ip.ttl'               : 'ttl',
+        'parameters.erspan.direction'     : 'erspan_dir',
+        'parameters.erspan.hw_id'         : 'erspan_hwid',
+        'parameters.erspan.index'         : 'erspan',
+        'parameters.erspan.version'       : 'erspan_ver',
+    }
+    mapping_ipv6 = {
+        'parameters.ipv6.encaplimit'      : 'encaplimit',
+        'parameters.ipv6.flowlabel'       : 'flowlabel',
+        'parameters.ipv6.hoplimit'        : 'hoplimit',
+        'parameters.ipv6.tclass'          : 'tclass',
+    }
+
     # TODO: This is surely used for more than tunnels
     # TODO: could be refactored elsewhere
-    _command_set = {**Interface._command_set, **{
-        'multicast': {
-            'validate': lambda v: assert_list(v, ['enable', 'disable']),
-            'convert': enable_to_on,
-            'shellcmd': 'ip link set dev {ifname} multicast {value}',
-        },
-        'allmulticast': {
-            'validate': lambda v: assert_list(v, ['enable', 'disable']),
-            'convert': enable_to_on,
-            'shellcmd': 'ip link set dev {ifname} allmulticast {value}',
-        },
-    }}
-
-    _create_cmd = 'ip tunnel add {ifname} mode {type}'
+    _command_set = {
+        **Interface._command_set,
+        **{
+            'multicast': {
+                'validate': lambda v: assert_list(v, ['enable', 'disable']),
+                'convert': enable_to_on,
+                'shellcmd': 'ip link set dev {ifname} multicast {value}',
+            },
+            'allmulticast': {
+                'validate': lambda v: assert_list(v, ['enable', 'disable']),
+                'convert': enable_to_on,
+                'shellcmd': 'ip link set dev {ifname} allmulticast {value}',
+            },
+        }
+    }
 
-    def __init__(self, ifname, **config):
-        self.config = deepcopy(config) if config else {}
-        super().__init__(ifname, **config)
+    def __init__(self, ifname, **kargs):
+        # T3357: we do not have the 'encapsulation' in kargs when calling this
+        # class from op-mode like "show interfaces tunnel"
+        if 'encapsulation' in kargs:
+            self.iftype = kargs['encapsulation']
+            # The gretap interface has the possibility to act as L2 bridge
+            if self.iftype in ['gretap', 'ip6gretap']:
+                # no multicast, ttl or tos for gretap
+                self.definition = {
+                    **TunnelIf.definition,
+                    **{
+                        'bridgeable': True,
+                    },
+                }
+
+        super().__init__(ifname, **kargs)
 
     def _create(self):
-        # add " option-name option-name-value ..." for all options set
-        options = " ".join(["{} {}".format(k, self.config[k])
-                            for k in self.options if k in self.config and self.config[k]])
-        self._cmd('{} {}'.format(self._create_cmd.format(**self.config), options))
-        self.set_admin_state('down')
+        if self.config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+            mapping = { **self.mapping, **self.mapping_ipv6 }
+        else:
+            mapping = { **self.mapping, **self.mapping_ipv4 }
+
+        cmd = 'ip tunnel add {ifname} mode {encapsulation}'
+        if self.iftype in ['gretap', 'ip6gretap', 'erspan', 'ip6erspan']:
+            cmd = 'ip link add name {ifname} type {encapsulation}'
+            # ERSPAN requires the serialisation of packets
+            if self.iftype in ['erspan', 'ip6erspan']:
+                cmd += ' seq'
+
+        for vyos_key, iproute2_key in mapping.items():
+            # dict_search will return an empty dict "{}" for valueless nodes like
+            # "parameters.nolearning" - thus we need to test the nodes existence
+            # by using isinstance()
+            tmp = dict_search(vyos_key, self.config)
+            if isinstance(tmp, dict):
+                cmd += f' {iproute2_key}'
+            elif tmp != None:
+                cmd += f' {iproute2_key} {tmp}'
+
+        self._cmd(cmd.format(**self.config))
 
-    def change_options(self):
-        change = 'ip tunnel change {ifname} mode {type}'
-
-        # add " option-name option-name-value ..." for all options set
-        options = " ".join(["{} {}".format(k, self.config[k])
-                            for k in self.options if k in self.config and self.config[k]])
-        self._cmd('{} {}'.format(change.format(**self.config), options))
+        self.set_admin_state('down')
 
-    @classmethod
-    def get_config(cls):
-        return dict(zip(cls.options, ['']*len(cls.options)))
+    def _change_options(self):
+        # gretap interfaces do not support changing any parameter
+        if self.iftype in ['gretap', 'ip6gretap', 'erspan', 'ip6erspan']:
+            return
+
+        if self.config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
+            mapping = { **self.mapping, **self.mapping_ipv6 }
+        else:
+            mapping = { **self.mapping, **self.mapping_ipv4 }
+
+        cmd = 'ip tunnel change {ifname} mode {encapsulation}'
+        for vyos_key, iproute2_key in mapping.items():
+            # dict_search will return an empty dict "{}" for valueless nodes like
+            # "parameters.nolearning" - thus we need to test the nodes existence
+            # by using isinstance()
+            tmp = dict_search(vyos_key, self.config)
+            if isinstance(tmp, dict):
+                cmd += f' {iproute2_key}'
+            elif tmp != None:
+                cmd += f' {iproute2_key} {tmp}'
+
+        self._cmd(cmd.format(**self.config))
 
     def get_mac(self):
         """
         Get current interface MAC (Media Access Contrl) address used.
-
         NOTE: Tunnel interfaces have no "MAC" address by default. The content
               of the 'address' file in /sys/class/net/device contains the
               local-ip thus we generate a random MAC address instead
-
         Example:
         >>> from vyos.ifconfig import Interface
         >>> Interface('eth0').get_mac()
@@ -113,113 +184,13 @@ class _Tunnel(Interface):
         mac.dialect = mac_unix_expanded
         return str(mac)
 
-class GREIf(_Tunnel):
-    """
-    GRE: Generic Routing Encapsulation
-
-    For more information please refer to:
-    RFC1701, RFC1702, RFC2784
-    https://tools.ietf.org/html/rfc2784
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_gre.c
-    """
-
-    default = {'type': 'gre'}
-    options = ['local', 'remote', 'dev', 'ttl', 'tos', 'key']
-
-# GreTap also called GRE Bridge
-class GRETapIf(_Tunnel):
-    """
-    GRETapIF: GreIF using TAP instead of TUN
-
-    https://en.wikipedia.org/wiki/TUN/TAP
-    """
-
-    # no multicast, ttl or tos for gretap
-    default = {'type': 'gretap'}
-    options = ['local', 'remote', 'ttl', 'tos', 'key']
-
-    _create_cmd = 'ip link add name {ifname} type {type}'
-
-    def change_options(self):
-        pass
-
-class IP6GREIf(_Tunnel):
-    """
-    IP6Gre: IPv6 Support for Generic Routing Encapsulation (GRE)
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc7676
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_gre6.c
-    """
-
-    default = {'type': 'ip6gre'}
-    options = ['local', 'remote', 'dev', 'encaplimit',
-               'hoplimit', 'tclass', 'flowlabel']
-
-class IPIPIf(_Tunnel):
-    """
-    IPIP: IP Encapsulation within IP
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc2003
-    """
-
-    # IPIP does not allow to pass multicast, unlike GRE
-    # but the interface itself can be set with multicast
-
-    default = {'type': 'ipip'}
-    options = ['local', 'remote', 'dev', 'ttl', 'tos', 'key']
-
-class IPIP6If(_Tunnel):
-    """
-    IPIP6: IPv4 over IPv6 tunnel
-
-    For more information please refer to:
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_ip6tnl.c
-    """
-
-    default = {'type': 'ipip6'}
-    options = ['local', 'remote', 'dev', 'encaplimit',
-               'hoplimit', 'tclass', 'flowlabel']
-
-class IP6IP6If(IPIP6If):
-    """
-    IP6IP6: IPv6 over IPv6 tunnel
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc2473
-    """
-    default = {'type': 'ip6ip6'}
-
-
-class SitIf(_Tunnel):
-    """
-    Sit: Simple Internet Transition
-
-    For more information please refer to:
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_iptnl.c
-    """
-
-    default = {'type': 'sit'}
-    options = ['local', 'remote', 'dev', 'ttl', 'tos', 'key']
-
-class Sit6RDIf(SitIf):
-    """
-    Sit6RDIf: Simple Internet Transition with 6RD
-
-    https://en.wikipedia.org/wiki/IPv6_rapid_deployment
-    """
-    # TODO: check if key can really be used with 6RD
-    options = ['remote', 'ttl', 'tos', 'key', '6rd-prefix', '6rd-relay-prefix']
-
-    def _create(self):
-        # do not call _Tunnel.create, building fully here
-
-        create = 'ip tunnel add {ifname} mode {type} remote {remote}'
-        self._cmd(create.format(**self.config))
-        self.set_interface('state','down')
+    def update(self, config):
+        """ General helper function which works on a dictionary retrived by
+        get_config_dict(). It's main intention is to consolidate the scattered
+        interface setup code and provide a single point of entry when workin
+        on any interface. """
+        # Adjust iproute2 tunnel parameters if necessary
+        self._change_options()
 
-        set6rd = 'ip tunnel 6rd dev {ifname} 6rd-prefix {6rd-prefix}'
-        if '6rd-relay-prefix' in self.config:
-            set6rd += ' 6rd-relay-prefix {6rd-relay-prefix}'
-        self._cmd(set6rd.format(**self.config))
+        # call base class first
+        super().update(config)
diff --git a/python/vyos/ifconfig/vtun.py b/python/vyos/ifconfig/vtun.py
index 2c6e126d5..ab32ef656 100644
--- a/python/vyos/ifconfig/vtun.py
+++ b/python/vyos/ifconfig/vtun.py
@@ -17,10 +17,7 @@ from vyos.ifconfig.interface import Interface
 
 @Interface.register
 class VTunIf(Interface):
-    default = {
-        'type': 'vtun',
-        'device_type': 'tun',
-    }
+    iftype = 'vtun'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/vxlan.py b/python/vyos/ifconfig/vxlan.py
index 2cff21f02..d73fb47b8 100644
--- a/python/vyos/ifconfig/vxlan.py
+++ b/python/vyos/ifconfig/vxlan.py
@@ -1,4 +1,4 @@
-# Copyright 2019 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright 2019-2021 VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -14,7 +14,8 @@
 # License along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from vyos import ConfigError
-from vyos.ifconfig.interface import Interface
+from vyos.ifconfig import Interface
+from vyos.util import dict_search
 
 @Interface.register
 class VXLANIf(Interface):
@@ -38,17 +39,7 @@ class VXLANIf(Interface):
     https://www.kernel.org/doc/Documentation/networking/vxlan.txt
     """
 
-    default = {
-        'type': 'vxlan',
-        'group': '',
-        'port': 8472,   # The Linux implementation of VXLAN pre-dates
-                        # the IANA's selection of a standard destination port
-        'remote': '',
-        'source_address': '',
-        'source_interface': '',
-        'vni': 0,
-        'ttl': '16',
-    }
+    iftype = 'vxlan'
     definition = {
         **Interface.definition,
         **{
@@ -57,43 +48,34 @@ class VXLANIf(Interface):
             'bridgeable': True,
         }
     }
-    options = Interface.options + ['group', 'remote', 'source_interface',
-                                   'port', 'vni', 'source_address', 'ttl']
-
-    mapping = {
-        'ifname': 'add',
-        'vni':    'id',
-        'port':   'dstport',
-        'source_address': 'local',
-        'source_interface': 'dev',
-        'ttl': 'ttl',
-    }
 
     def _create(self):
-        cmdline = ['ifname', 'type', 'vni', 'port', 'ttl']
-
-        if self.config['source_address']:
-            cmdline.append('source_address')
-
-        if self.config['remote']:
-            cmdline.append('remote')
-
-        if self.config['group'] or self.config['source_interface']:
-            if self.config['group']:
-                cmdline.append('group')
-            if self.config['source_interface']:
-                cmdline.append('source_interface')
-            else:
-                ifname = self.config['ifname']
-                raise ConfigError(
-                    f'VXLAN "{ifname}" is missing mandatory underlay multicast'
-                     'group or source interface for a multicast network.')
+        # This table represents a mapping from VyOS internal config dict to
+        # arguments used by iproute2. For more information please refer to:
+        # - https://man7.org/linux/man-pages/man8/ip-link.8.html
+        mapping = {
+            'source_address'             : 'local',
+            'source_interface'           : 'dev',
+            'remote'                     : 'remote',
+            'group'                      : 'group',
+            'parameters.ip.dont_fragment': 'df set',
+            'parameters.ip.tos'          : 'tos',
+            'parameters.ip.ttl'          : 'ttl',
+            'parameters.ipv6.flowlabel'  : 'flowlabel',
+            'parameters.nolearning'      : 'nolearning',
+        }
 
-        cmd = 'ip link'
-        for key in cmdline:
-            value = self.config.get(key, '')
-            if not value:
-                continue
-            cmd += ' {} {}'.format(self.mapping.get(key, key), value)
+        cmd = 'ip link add {ifname} type {type} id {vni} dstport {port}'
+        for vyos_key, iproute2_key in mapping.items():
+            # dict_search will return an empty dict "{}" for valueless nodes like
+            # "parameters.nolearning" - thus we need to test the nodes existence
+            # by using isinstance()
+            tmp = dict_search(vyos_key, self.config)
+            if isinstance(tmp, dict):
+                cmd += f' {iproute2_key}'
+            elif tmp != None:
+                cmd += f' {iproute2_key} {tmp}'
 
-        self._cmd(cmd)
+        self._cmd(cmd.format(**self.config))
+        # interface is always A/D down. It needs to be enabled explicitly
+        self.set_admin_state('down')
diff --git a/python/vyos/ifconfig/wireguard.py b/python/vyos/ifconfig/wireguard.py
index 33f59b57e..2d2243b84 100644
--- a/python/vyos/ifconfig/wireguard.py
+++ b/python/vyos/ifconfig/wireguard.py
@@ -149,17 +149,7 @@ class WireGuardOperational(Operational):
 class WireGuardIf(Interface):
     OperationalClass = WireGuardOperational
 
-    default = {
-        'type': 'wireguard',
-        'port': 0,
-        'private_key': None,
-        'pubkey': None,
-        'psk': '',
-        'allowed_ips': [],
-        'fwmark': 0x00,
-        'endpoint': None,
-        'keepalive': 0
-    }
+    iftype = 'wireguard'
     definition = {
         **Interface.definition,
         **{
diff --git a/python/vyos/ifconfig/wireless.py b/python/vyos/ifconfig/wireless.py
index 0efe38d59..d897715db 100644
--- a/python/vyos/ifconfig/wireless.py
+++ b/python/vyos/ifconfig/wireless.py
@@ -21,10 +21,7 @@ class WiFiIf(Interface):
     Handle WIFI/WLAN interfaces.
     """
 
-    default = {
-        'type': 'wifi',
-        'phy': 'phy0'
-    }
+    iftype = 'wifi'
     definition = {
         **Interface.definition,
         **{