12 files changed, 48 insertions, 35 deletions
diff --git a/src/etc/commit/post-hooks.d/00vyos-sync b/src/etc/commit/post-hooks.d/00vyos-sync
new file mode 100755
index 000000000..8ec732df0
--- /dev/null
+++ b/src/etc/commit/post-hooks.d/00vyos-sync
@@ -0,0 +1,7 @@
+#!/bin/sh
+# When power is lost right after a commit modified files, the
+# system can be corrupted and e.g. login is no longer possible.
+# Always sync files to the backend storage after a commit.
+# https://vyos.dev/T4975
+sync
+
diff --git a/src/etc/dhcp/dhclient-enter-hooks.d/99-run-user-hooks b/src/etc/dhcp/dhclient-enter-hooks.d/99-run-user-hooks
new file mode 100644
index 000000000..b4b4d516d
--- /dev/null
+++ b/src/etc/dhcp/dhclient-enter-hooks.d/99-run-user-hooks
@@ -0,0 +1,5 @@
+#!/bin/bash
+DHCP_PRE_HOOKS="/config/scripts/dhcp-client/pre-hooks.d/"
+if [ -d "${DHCP_PRE_HOOKS}" ] ; then
+    run-parts "${DHCP_PRE_HOOKS}"
+fi
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/vyatta-dhclient-hook b/src/etc/dhcp/dhclient-exit-hooks.d/03-vyatta-dhclient-hook
index 49bb18372..49bb18372 100644
--- a/src/etc/dhcp/dhclient-exit-hooks.d/vyatta-dhclient-hook
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/03-vyatta-dhclient-hook
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/98-run-user-hooks b/src/etc/dhcp/dhclient-exit-hooks.d/98-run-user-hooks
new file mode 100755
index 000000000..442419d79
--- /dev/null
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/98-run-user-hooks
@@ -0,0 +1,5 @@
+#!/bin/bash
+DHCP_POST_HOOKS="/config/scripts/dhcp-client/post-hooks.d/"
+if [ -d "${DHCP_POST_HOOKS}" ] ; then
+    run-parts "${DHCP_POST_HOOKS}"
+fi
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/ipsec-dhclient-hook b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
index 61a89e62a..1f1926e17 100755
--- a/src/etc/dhcp/dhclient-exit-hooks.d/ipsec-dhclient-hook
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
@@ -23,7 +23,7 @@ DHCP_HOOK_IFLIST="/tmp/ipsec_dhcp_waiting"
 if [ -f $DHCP_HOOK_IFLIST ] && [ "$reason" == "BOUND" ]; then
     if grep -qw $interface $DHCP_HOOK_IFLIST; then
         sudo rm $DHCP_HOOK_IFLIST
-        sudo python3 /usr/libexec/vyos/conf_mode/vpn_ipsec.py
+        sudo /usr/libexec/vyos/conf_mode/vpn_ipsec.py
         exit 0
     fi
 fi
diff --git a/src/etc/modprobe.d/ifb.conf b/src/etc/modprobe.d/ifb.conf
new file mode 100644
index 000000000..2dcfb6af4
--- /dev/null
+++ b/src/etc/modprobe.d/ifb.conf
@@ -0,0 +1 @@
+options ifb numifbs=0
diff --git a/src/etc/opennhrp/opennhrp-script.py b/src/etc/opennhrp/opennhrp-script.py
index bf25a7331..688c7af2a 100755
--- a/src/etc/opennhrp/opennhrp-script.py
+++ b/src/etc/opennhrp/opennhrp-script.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,7 +17,7 @@
 import os
 import re
 import sys
-import vici
+import vyos.ipsec
 
 from json import loads
 from pathlib import Path
@@ -51,9 +51,8 @@ def vici_get_ipsec_uniqueid(conn: str, src_nbma: str,
         logger.info(
             f'Resolving IKE unique ids for: conn: {conn}, '
             f'src_nbma: {src_nbma}, dst_nbma: {dst_nbma}')
-        session: vici.Session = vici.Session()
         list_ikeid: list[str] = []
-        list_sa = session.list_sas({'ike': conn})
+        list_sa: list = vyos.ipsec.get_vici_sas_by_name(conn, None)
         for sa in list_sa:
             if sa[conn]['local-host'].decode('ascii') == src_nbma \
                     and sa[conn]['remote-host'].decode('ascii') == dst_nbma:
@@ -78,16 +77,7 @@ def vici_ike_terminate(list_ikeid: list[str]) -> bool:
         return False
 
     try:
-        session = vici.Session()
-        for ikeid in list_ikeid:
-            logger.info(f'Terminating IKE SA with id {ikeid}')
-            session_generator = session.terminate(
-                {'ike-id': ikeid, 'timeout': '-1'})
-            # a dummy `for` loop is required because of requirements
-            # from vici. Without a full iteration on the output, the
-            # command to vici may not be executed completely
-            for _ in session_generator:
-                pass
+        vyos.ipsec.terminate_vici_ikeid_list(list_ikeid)
         return True
     except Exception as err:
         logger.error(f'Failed to terminate SA for IKE ids {list_ikeid}: {err}')
@@ -180,19 +170,7 @@ def vici_initiate(conn: str, child_sa: str, src_addr: str,
         f'Trying to initiate connection. Name: {conn}, child sa: {child_sa}, '
         f'src_addr: {src_addr}, dst_addr: {dest_addr}')
     try:
-        session = vici.Session()
-        session_generator = session.initiate({
-            'ike': conn,
-            'child': child_sa,
-            'timeout': '-1',
-            'my-host': src_addr,
-            'other-host': dest_addr
-        })
-        # a dummy `for` loop is required because of requirements
-        # from vici. Without a full iteration on the output, the
-        # command to vici may not be executed completely
-        for _ in session_generator:
-            pass
+        vyos.ipsec.vici_initiate(conn, child_sa, src_addr, dest_addr)
         return True
     except Exception as err:
         logger.error(f'Unable to initiate connection {err}')
@@ -218,8 +196,11 @@ def vici_terminate(conn: str, src_addr: str, dest_addr: str) -> None:
             f'No active sessions found for IKE profile {conn}, '
             f'local NBMA {src_addr}, remote NBMA {dest_addr}')
     else:
-        vici_ike_terminate(ikeid_list)
-
+        try:
+            vyos.ipsec.terminate_vici_ikeid_list(ikeid_list)
+        except Exception as err:
+            logger.error(
+                f'Failed to terminate SA for IKE ids {ikeid_list}: {err}')
 
 def iface_up(interface: str) -> None:
     """Proceed tunnel interface UP event
diff --git a/src/etc/sysctl.d/30-vyos-router.conf b/src/etc/sysctl.d/30-vyos-router.conf
index 411429510..f5d84be4b 100644
--- a/src/etc/sysctl.d/30-vyos-router.conf
+++ b/src/etc/sysctl.d/30-vyos-router.conf
@@ -19,7 +19,7 @@ kernel.core_pattern=/var/core/core-%e-%p-%t
 #  arp_filter defaults to 1 so set all to 0 so vrrp interfaces can override it.
 net.ipv4.conf.all.arp_filter=0
 
-# https://phabricator.vyos.net/T300
+# https://vyos.dev/T300
 net.ipv4.conf.all.arp_ignore=0
 
 net.ipv4.conf.all.arp_announce=2
@@ -98,9 +98,6 @@ net.ipv6.route.skip_notify_on_dev_down=1
 # Default value of 20 seems to interfere with larger OSPF and VRRP setups
 net.ipv4.igmp_max_memberships = 512
 
-# Enable conntrack helper by default
-net.netfilter.nf_conntrack_helper=1
-
 # Increase default garbage collection thresholds
 net.ipv4.neigh.default.gc_thresh1 = 1024
 net.ipv4.neigh.default.gc_thresh2 = 4096
diff --git a/src/etc/systemd/system/ddclient.service.d/override.conf b/src/etc/systemd/system/ddclient.service.d/override.conf
index d9c9963b0..09d929d39 100644
--- a/src/etc/systemd/system/ddclient.service.d/override.conf
+++ b/src/etc/systemd/system/ddclient.service.d/override.conf
@@ -8,4 +8,4 @@ WorkingDirectory=/run/ddclient
 PIDFile=
 PIDFile=/run/ddclient/ddclient.pid
 ExecStart=
-ExecStart=/usr/sbin/ddclient -cache /run/ddclient/ddclient.cache -pid /run/ddclient/ddclient.pid -file /run/ddclient/ddclient.conf
+ExecStart=/usr/bin/ddclient -cache /run/ddclient/ddclient.cache -pid /run/ddclient/ddclient.pid -file /run/ddclient/ddclient.conf
diff --git a/src/etc/systemd/system/frr.service.d/override.conf b/src/etc/systemd/system/frr.service.d/override.conf
index 69eb1a86a..2e4b6e295 100644
--- a/src/etc/systemd/system/frr.service.d/override.conf
+++ b/src/etc/systemd/system/frr.service.d/override.conf
@@ -3,6 +3,7 @@ Before=
 Before=vyos-router.service
 
 [Service]
+LimitNOFILE=4096
 ExecStartPre=/bin/bash -c 'mkdir -p /run/frr/config; \
              echo "log syslog" > /run/frr/config/frr.conf; \
              echo "log facility local7" >> /run/frr/config/frr.conf; \
diff --git a/src/etc/systemd/system/hostapd@.service.d/override.conf b/src/etc/systemd/system/hostapd@.service.d/override.conf
index bb8e81d7a..926c07f94 100644
--- a/src/etc/systemd/system/hostapd@.service.d/override.conf
+++ b/src/etc/systemd/system/hostapd@.service.d/override.conf
@@ -1,6 +1,8 @@
 [Unit]
 After=
 After=vyos-router.service
+ConditionFileNotEmpty=
+ConditionFileNotEmpty=/run/hostapd/%i.conf
 
 [Service]
 WorkingDirectory=/run/hostapd
diff --git a/src/etc/systemd/system/keepalived.service.d/override.conf b/src/etc/systemd/system/keepalived.service.d/override.conf
new file mode 100644
index 000000000..d91a824b9
--- /dev/null
+++ b/src/etc/systemd/system/keepalived.service.d/override.conf
@@ -0,0 +1,14 @@
+[Unit]
+After=vyos-router.service
+# Only start if there is our configuration file - remove Debian default
+# config file from the condition list
+ConditionFileNotEmpty=
+ConditionFileNotEmpty=/run/keepalived/keepalived.conf
+
+[Service]
+KillMode=process
+Type=simple
+# Read configuration variable file if it is present
+ExecStart=
+ExecStart=/usr/sbin/keepalived --use-file /run/keepalived/keepalived.conf --pid /run/keepalived/keepalived.pid --dont-fork --snmp
+PIDFile=/run/keepalived/keepalived.pid