4 files changed, 32 insertions, 4 deletions
diff --git a/src/conf_mode/dynamic_dns.py b/src/conf_mode/dynamic_dns.py
index 06a2f7e15..426e3d693 100755
--- a/src/conf_mode/dynamic_dns.py
+++ b/src/conf_mode/dynamic_dns.py
@@ -108,7 +108,8 @@ def verify(dyndns):
                     raise ConfigError(f'"host-name" {error_msg}')
 
                 if 'login' not in config:
-                    raise ConfigError(f'"login" (username) {error_msg}')
+                    if service != 'cloudflare' and ('protocol' not in config or config['protocol'] != 'cloudflare'):
+                        raise ConfigError(f'"login" (username) {error_msg}, unless using CloudFlare')
 
                 if 'password' not in config:
                     raise ConfigError(f'"password" {error_msg}')
diff --git a/src/conf_mode/high-availability.py b/src/conf_mode/high-availability.py
index 7a63f5b4b..e18b426b1 100755
--- a/src/conf_mode/high-availability.py
+++ b/src/conf_mode/high-availability.py
@@ -21,6 +21,7 @@ from ipaddress import ip_interface
 from ipaddress import IPv4Interface
 from ipaddress import IPv6Interface
 
+from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import dict_merge
 from vyos.ifconfig.vrrp import VRRP
@@ -107,11 +108,16 @@ def verify(ha):
                     raise ConfigError(f'Authentication requires both type and passwortd to be set in VRRP group "{group}"')
 
             if 'health_check' in group_config:
+                health_check_types = ["script", "ping"]
                 from vyos.utils.dict import check_mutually_exclusive_options
                 try:
-                    check_mutually_exclusive_options(group_config["health_check"], ["script", "ping"], required=True)
+                    check_mutually_exclusive_options(group_config["health_check"], health_check_types, required=True)
                 except ValueError as e:
-                    raise ConfigError(f'Health check config is incorrect in VRRP group "{group}": {e}')
+                    Warning(f'Health check configuration for VRRP group "{group}" will remain unused ' \
+                            f'until it has one of the following options: {health_check_types}')
+                    # XXX: health check has default options so we need to remove it
+                    # to avoid generating useless config statements in keepalived.conf
+                    del group_config["health_check"]
 
             # Keepalived doesn't allow mixing IPv4 and IPv6 in one group, so we mirror that restriction
             # We also need to make sure VRID is not used twice on the same interface with the
diff --git a/src/conf_mode/interfaces-ethernet.py b/src/conf_mode/interfaces-ethernet.py
index b49c945cd..31cfab368 100755
--- a/src/conf_mode/interfaces-ethernet.py
+++ b/src/conf_mode/interfaces-ethernet.py
@@ -22,6 +22,7 @@ from sys import exit
 from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
+from vyos.configdict import is_node_changed
 from vyos.configverify import verify_address
 from vyos.configverify import verify_dhcpv6
 from vyos.configverify import verify_eapol
@@ -66,11 +67,17 @@ def get_config(config=None):
                                get_first_key=True, no_tag_node_value_mangle=True)
 
     base = ['interfaces', 'ethernet']
-    _, ethernet = get_interface_dict(conf, base)
+    ifname, ethernet = get_interface_dict(conf, base)
 
     if 'deleted' not in ethernet:
        if pki: ethernet['pki'] = pki
 
+    tmp = is_node_changed(conf, base + [ifname, 'speed'])
+    if tmp: ethernet.update({'speed_duplex_changed': {}})
+
+    tmp = is_node_changed(conf, base + [ifname, 'duplex'])
+    if tmp: ethernet.update({'speed_duplex_changed': {}})
+
     return ethernet
 
 def verify(ethernet):
diff --git a/src/conf_mode/vpn_openconnect.py b/src/conf_mode/vpn_openconnect.py
index 68da70d7d..83021a3e6 100755
--- a/src/conf_mode/vpn_openconnect.py
+++ b/src/conf_mode/vpn_openconnect.py
@@ -17,6 +17,7 @@
 import os
 from sys import exit
 
+from vyos.base import Warning
 from vyos.config import Config
 from vyos.configdict import dict_merge
 from vyos.pki import wrap_certificate
@@ -173,6 +174,19 @@ def verify(ocserv):
                                 users_wo_pswd.append(user)
                         if users_wo_pswd:
                             raise ConfigError(f'password required for users:\n{users_wo_pswd}')
+
+            # Validate that if identity-based-config is configured all child config nodes are set
+            if 'identity_based_config' in ocserv["authentication"]:
+                if 'disabled' not in ocserv["authentication"]["identity_based_config"]:
+                    Warning("Identity based configuration files is a 3rd party addition. Use at your own risk, this might break the ocserv daemon!")
+                    if 'mode' not in ocserv["authentication"]["identity_based_config"]:
+                        raise ConfigError('OpenConnect radius identity-based-config enabled but mode not selected')
+                    elif 'group' in ocserv["authentication"]["identity_based_config"]["mode"] and "radius" not in ocserv["authentication"]["mode"]:
+                        raise ConfigError('OpenConnect config-per-group must be used with radius authentication')
+                    if 'directory' not in ocserv["authentication"]["identity_based_config"]:
+                        raise ConfigError('OpenConnect identity-based-config enabled but directory not set')
+                    if 'default_config' not in ocserv["authentication"]["identity_based_config"]:
+                        raise ConfigError('OpenConnect identity-based-config enabled but default-config not set')
         else:
             raise ConfigError('openconnect authentication mode required')
     else: