13 files changed, 781 insertions, 0 deletions
diff --git a/src/migration-scripts/dhcp-relay/1-to-2 b/src/migration-scripts/dhcp-relay/1-to-2
new file mode 100755
index 000000000..b72da1028
--- /dev/null
+++ b/src/migration-scripts/dhcp-relay/1-to-2
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+
+# Delete "set service dhcp-relay relay-options port" option
+# Delete "set service dhcpv6-relay listen-port" option
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+if not (config.exists(['service', 'dhcp-relay', 'relay-options', 'port']) or config.exists(['service', 'dhcpv6-relay', 'listen-port'])):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Delete abandoned node
+    config.delete(['service', 'dhcp-relay', 'relay-options', 'port'])
+    # Delete abandoned node
+    config.delete(['service', 'dhcpv6-relay', 'listen-port'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/dhcp-server/4-to-5 b/src/migration-scripts/dhcp-server/4-to-5
new file mode 100755
index 000000000..baccd5a2b
--- /dev/null
+++ b/src/migration-scripts/dhcp-server/4-to-5
@@ -0,0 +1,123 @@
+#!/usr/bin/env python3
+
+# Removes boolean operator from:
+#   - "set service dhcp-server shared-network-name <xyz> subnet 172.31.0.0/24 ip-forwarding enable (true|false)"
+#   - "set service dhcp-server shared-network-name <xyz> authoritative (true|false)"
+#   - "set service dhcp-server disabled (true|false)"
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+if not config.exists(['service', 'dhcp-server']):
+    # Nothing to do
+    sys.exit(0)
+else:
+    base = ['service', 'dhcp-server']
+    # Make node "set service dhcp-server dynamic-dns-update enable (true|false)" valueless
+    if config.exists(base + ['dynamic-dns-update']):
+        bool_val = config.return_value(base + ['dynamic-dns-update', 'enable'])
+
+        # Delete the node with the old syntax
+        config.delete(base + ['dynamic-dns-update'])
+        if str(bool_val) == 'true':
+            # Enable dynamic-dns-update with new syntax
+            config.set(base + ['dynamic-dns-update'], value=None)
+
+    # Make node "set service dhcp-server disabled (true|false)" valueless
+    if config.exists(base + ['disabled']):
+        bool_val = config.return_value(base + ['disabled'])
+
+        # Delete the node with the old syntax
+        config.delete(base + ['disabled'])
+        if str(bool_val) == 'true':
+            # Now disable DHCP server with the new syntax
+            config.set(base + ['disable'], value=None)
+
+    # Make node "set service dhcp-server hostfile-update (enable|disable) valueless
+    if config.exists(base + ['hostfile-update']):
+        bool_val = config.return_value(base + ['hostfile-update'])
+
+        # Delete the node with the old syntax incl. all subnodes
+        config.delete(base + ['hostfile-update'])
+        if str(bool_val) == 'enable':
+            # Enable hostfile update with new syntax
+            config.set(base + ['hostfile-update'], value=None)
+
+    # Run this for every instance if 'shared-network-name'
+    for network in config.list_nodes(base + ['shared-network-name']):
+        base_network = base + ['shared-network-name', network]
+        # format as tag node to avoid loading problems
+        config.set_tag(base + ['shared-network-name'])
+
+        # Run this for every specified 'subnet'
+        for subnet in config.list_nodes(base_network + ['subnet']):
+            base_subnet = base_network + ['subnet', subnet]
+            # format as tag node to avoid loading problems
+            config.set_tag(base_network + ['subnet'])
+
+            # Make node "set service dhcp-server shared-network-name <xyz> subnet 172.31.0.0/24 ip-forwarding enable" valueless
+            if config.exists(base_subnet + ['ip-forwarding', 'enable']):
+                bool_val = config.return_value(base_subnet + ['ip-forwarding', 'enable'])
+                # Delete the node with the old syntax
+                config.delete(base_subnet + ['ip-forwarding'])
+                if str(bool_val) == 'true':
+                    # Recreate node with new syntax
+                    config.set(base_subnet + ['ip-forwarding'], value=None)
+
+            # Rename node "set service dhcp-server shared-network-name <xyz> subnet 172.31.0.0/24 start <172.16.0.4> stop <172.16.0.9>
+            if config.exists(base_subnet + ['start']):
+                # This is the new "range" id for DHCP lease ranges
+                r_id = 0
+                for range in config.list_nodes(base_subnet + ['start']):
+                    range_start = range
+                    range_stop = config.return_value(base_subnet + ['start', range_start, 'stop'])
+
+                    # Delete the node with the old syntax
+                    config.delete(base_subnet + ['start', range_start])
+
+                    # Create the node for the new syntax
+                    # Note: range is a tag node, counter is its child, not a value
+                    config.set(base_subnet + ['range', r_id])
+                    config.set(base_subnet + ['range', r_id, 'start'], value=range_start)
+                    config.set(base_subnet + ['range', r_id, 'stop'], value=range_stop)
+
+                    # format as tag node to avoid loading problems
+                    config.set_tag(base_subnet + ['range'])
+
+                    # increment range id for possible next range definition
+                    r_id += 1
+
+                # Delete the node with the old syntax
+                config.delete(['service', 'dhcp-server', 'shared-network-name', network, 'subnet', subnet, 'start'])
+
+
+        # Make node "set service dhcp-server shared-network-name <xyz> authoritative" valueless
+        if config.exists(['service', 'dhcp-server', 'shared-network-name', network, 'authoritative']):
+            authoritative = config.return_value(['service', 'dhcp-server', 'shared-network-name', network, 'authoritative'])
+
+            # Delete the node with the old syntax
+            config.delete(['service', 'dhcp-server', 'shared-network-name', network, 'authoritative'])
+
+            # Recreate node with new syntax - if required
+            if authoritative == "enable":
+                config.set(['service', 'dhcp-server', 'shared-network-name', network, 'authoritative'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+
+    sys.exit(1)
diff --git a/src/migration-scripts/ipsec/4-to-5 b/src/migration-scripts/ipsec/4-to-5
new file mode 100755
index 000000000..b64aa8462
--- /dev/null
+++ b/src/migration-scripts/ipsec/4-to-5
@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+
+# log-modes have changed, keyword  all to any
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+ctree = ConfigTree(config_file)
+
+if not ctree.exists(['vpn', 'ipsec', 'logging','log-modes']):
+    # Nothing to do
+    sys.exit(0)
+else:
+  lmodes = ctree.return_values(['vpn', 'ipsec', 'logging','log-modes'])
+  for mode in lmodes:
+    if mode == 'all':
+      ctree.set(['vpn', 'ipsec', 'logging','log-modes'], value='any', replace=True)
+
+  try:
+    open(file_name,'w').write(ctree.to_string())
+  except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    sys.exit(1)
diff --git a/src/migration-scripts/l2tp/0-to-1 b/src/migration-scripts/l2tp/0-to-1
new file mode 100755
index 000000000..f6c716df1
--- /dev/null
+++ b/src/migration-scripts/l2tp/0-to-1
@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+
+# Unclutter L2TP VPN configuiration - move radius-server top level tag
+# nodes to a regular node which now also configures the radius source address
+# used when querying a radius server
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+cfg_base = ['vpn', 'l2tp', 'remote-access', 'authentication']
+if not config.exists(cfg_base):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Migrate "vpn l2tp authentication radius-source-address" to new
+    # "vpn l2tp authentication radius source-address"
+    if config.exists(cfg_base + ['radius-source-address']):
+        address = config.return_value(cfg_base + ['radius-source-address'])
+        # delete old configuration node
+        config.delete(cfg_base + ['radius-source-address'])
+        # write new configuration node
+        config.set(cfg_base + ['radius', 'source-address'], value=address)
+
+    # Migrate "vpn l2tp authentication radius-server" tag node to new
+    # "vpn l2tp authentication radius server" tag node
+    for server in config.list_nodes(cfg_base + ['radius-server']):
+        base_server = cfg_base + ['radius-server', server]
+        key = config.return_value(base_server + ['key'])
+
+        # delete old configuration node
+        config.delete(base_server)
+        # write new configuration node
+        config.set(cfg_base + ['radius', 'server', server, 'key'], value=key)
+
+        # format as tag node
+        config.set_tag(cfg_base + ['radius', 'server'])
+
+    # delete top level tag node
+    if config.exists(cfg_base + ['radius-server']):
+        config.delete(cfg_base + ['radius-server'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/ntp/0-to-1 b/src/migration-scripts/ntp/0-to-1
new file mode 100755
index 000000000..9c66f3109
--- /dev/null
+++ b/src/migration-scripts/ntp/0-to-1
@@ -0,0 +1,36 @@
+#!/usr/bin/env python3
+
+# Delete "set system ntp server <n> dynamic" option
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+if not config.exists(['system', 'ntp']):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Delete abandoned leaf node if found inside tag node for
+    # "set system ntp server <n> dynamic"
+    base = ['system', 'ntp', 'server']
+    for server in config.list_nodes(base):
+        if config.exists(base + [server, 'dynamic']):
+            config.delete(base + [server, 'dynamic'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/pppoe-server/0-to-1 b/src/migration-scripts/pppoe-server/0-to-1
new file mode 100755
index 000000000..bb24211b6
--- /dev/null
+++ b/src/migration-scripts/pppoe-server/0-to-1
@@ -0,0 +1,37 @@
+#!/usr/bin/env python3
+
+# Convert "service pppoe-server authentication radius-server  node key"
+# to:
+# "service pppoe-server authentication radius-server node secret"  
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+ctree = ConfigTree(config_file)
+
+
+if not ctree.exists(['service', 'pppoe-server', 'authentication','radius-server']):
+    # Nothing to do
+    sys.exit(0)
+else:
+  nodes = ctree.list_nodes(['service', 'pppoe-server', 'authentication','radius-server'])
+  for node in nodes:
+    if ctree.exists(['service', 'pppoe-server', 'authentication', 'radius-server', node, 'key']):
+      val = ctree.return_value(['service', 'pppoe-server', 'authentication', 'radius-server', node, 'key'])
+      ctree.set(['service', 'pppoe-server', 'authentication', 'radius-server', node, 'secret'], value=val, replace=False)
+      ctree.delete(['service', 'pppoe-server', 'authentication', 'radius-server', node, 'key'])
+  try:
+    open(file_name,'w').write(ctree.to_string())
+  except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    sys.exit(1)
diff --git a/src/migration-scripts/pptp/0-to-1 b/src/migration-scripts/pptp/0-to-1
new file mode 100755
index 000000000..d0c7a83b5
--- /dev/null
+++ b/src/migration-scripts/pptp/0-to-1
@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+
+# Unclutter PPTP VPN configuiration - move radius-server top level tag
+# nodes to a regular node which now also configures the radius source address
+# used when querying a radius server
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+cfg_base = ['vpn', 'pptp', 'remote-access', 'authentication']
+if not config.exists(cfg_base):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Migrate "vpn pptp authentication radius-source-address" to new
+    # "vpn pptp authentication radius source-address"
+    if config.exists(cfg_base + ['radius-source-address']):
+        address = config.return_value(cfg_base + ['radius-source-address'])
+        # delete old configuration node
+        config.delete(cfg_base + ['radius-source-address'])
+        # write new configuration node
+        config.set(cfg_base + ['radius', 'source-address'], value=address)
+
+    # Migrate "vpn pptp authentication radius-server" tag node to new
+    # "vpn pptp authentication radius server" tag node
+    for server in config.list_nodes(cfg_base + ['radius-server']):
+        base_server = cfg_base + ['radius-server', server]
+        key = config.return_value(base_server + ['key'])
+
+        # delete old configuration node
+        config.delete(base_server)
+        # write new configuration node
+        config.set(cfg_base + ['radius', 'server', server, 'key'], value=key)
+
+        # format as tag node
+        config.set_tag(cfg_base + ['radius', 'server'])
+
+    # delete top level tag node
+    if config.exists(cfg_base + ['radius-server']):
+        config.delete(cfg_base + ['radius-server'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/quagga/2-to-3 b/src/migration-scripts/quagga/2-to-3
new file mode 100755
index 000000000..4c1cd86a3
--- /dev/null
+++ b/src/migration-scripts/quagga/2-to-3
@@ -0,0 +1,203 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2018 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+def migrate_neighbor(config, neighbor_path, neighbor):
+    if config.exists(neighbor_path):
+        neighbors = config.list_nodes(neighbor_path)
+        for neighbor in neighbors:
+            # Move the valueless options: as-override, next-hop-self, route-reflector-client, route-server-client,
+            # remove-private-as
+            for valueless_option in ['as-override', 'nexthop-self', 'route-reflector-client', 'route-server-client',
+                                     'remove-private-as']:
+                if config.exists(neighbor_path + [neighbor, valueless_option]):
+                    config.set(neighbor_path + [neighbor] + af_path + [valueless_option])
+                    config.delete(neighbor_path + [neighbor, valueless_option])
+
+            # Move filter options: distribute-list, filter-list, prefix-list, and route-map
+            # They share the same syntax inside so we can group them
+            for filter_type in ['distribute-list', 'filter-list', 'prefix-list', 'route-map']:
+                if config.exists(neighbor_path + [neighbor, filter_type]):
+                    for filter_dir in ['import', 'export']:
+                        if config.exists(neighbor_path + [neighbor, filter_type, filter_dir]):
+                            filter_name = config.return_value(neighbor_path + [neighbor, filter_type, filter_dir])
+                            config.set(neighbor_path + [neighbor] + af_path + [filter_type, filter_dir], value=filter_name)
+                    config.delete(neighbor_path + [neighbor, filter_type])
+
+            # Move simple leaf node options: maximum-prefix, unsuppress-map, weight
+            for leaf_option in ['maximum-prefix', 'unsuppress-map', 'weight']:
+                if config.exists(neighbor_path + [neighbor, leaf_option]):
+                    if config.exists(neighbor_path + [neighbor, leaf_option]):
+                        leaf_opt_value = config.return_value(neighbor_path + [neighbor, leaf_option])
+                        config.set(neighbor_path + [neighbor] + af_path + [leaf_option], value=leaf_opt_value)
+                        config.delete(neighbor_path + [neighbor, leaf_option])
+
+            # The rest is special cases, for better or worse
+
+            # Move allowas-in
+            if config.exists(neighbor_path + [neighbor, 'allowas-in']):
+                if config.exists(neighbor_path + [neighbor, 'allowas-in', 'number']):
+                    allowas_in = config.return_value(neighbor_path + [neighbor, 'allowas-in', 'number'])
+                    config.set(neighbor_path + [neighbor] + af_path + ['allowas-in', 'number'], value=allowas_in)
+                config.delete(neighbor_path + [neighbor, 'allowas-in'])
+
+            # Move attribute-unchanged options
+            if config.exists(neighbor_path + [neighbor, 'attribute-unchanged']):
+                for attr in ['as-path', 'med', 'next-hop']:
+                    if config.exists(neighbor_path + [neighbor, 'attribute-unchanged', attr]):
+                        config.set(neighbor_path + [neighbor] + af_path + ['attribute-unchanged', attr])
+                        config.delete(neighbor_path + [neighbor, 'attribute-unchanged', attr])
+                config.delete(neighbor_path + [neighbor, 'attribute-unchanged'])
+
+            # Move capability options
+            if config.exists(neighbor_path + [neighbor, 'capability']):
+                # "capability dynamic" is a peer-global option, we only migrate ORF
+                if config.exists(neighbor_path + [neighbor, 'capability', 'orf']):
+                    if config.exists(neighbor_path + [neighbor, 'capability', 'orf', 'prefix-list']):
+                        for orf in ['send', 'receive']:
+                            if config.exists(neighbor_path + [neighbor, 'capability', 'orf', 'prefix-list', orf]):
+                                config.set(neighbor_path + [neighbor] + af_path + ['capability', 'orf', 'prefix-list', orf])
+                                config.delete(neighbor_path + [neighbor, 'capability', 'orf', 'prefix-list', orf])
+                        config.delete(neighbor_path + [neighbor, 'capability', 'orf', 'prefix-list'])
+                    config.delete(neighbor_path + [neighbor, 'capability', 'orf'])
+
+            # Move default-originate
+            if config.exists(neighbor_path + [neighbor, 'default-originate']):
+                if config.exists(neighbor_path + [neighbor, 'default-originate', 'route-map']):
+                    route_map = config.return_value(neighbor_path + [neighbor, 'default-originate', 'route-map'])
+                    config.set(neighbor_path + [neighbor] + af_path + ['default-originate', 'route-map'], value=route_map)
+                else:
+                    # Empty default-originate node is meaningful so we re-create it
+                    config.set(neighbor_path + [neighbor] + af_path + ['default-originate'])
+                config.delete(neighbor_path + [neighbor, 'default-originate'])
+
+            # Move soft-reconfiguration
+            if config.exists(neighbor_path + [neighbor, 'soft-reconfiguration']):
+                if config.exists(neighbor_path + [neighbor, 'soft-reconfiguration', 'inbound']):
+                    config.set(neighbor_path + [neighbor] + af_path + ['soft-reconfiguration', 'inbound'])
+                # Empty soft-reconfiguration is meaningless, so we just remove it
+                config.delete(neighbor_path + [neighbor, 'soft-reconfiguration'])
+
+            # Move disable-send-community
+            if config.exists(neighbor_path + [neighbor, 'disable-send-community']):
+                for comm_type in ['standard', 'extended']:
+                    if config.exists(neighbor_path + [neighbor, 'disable-send-community', comm_type]):
+                        config.set(neighbor_path + [neighbor] + af_path + ['disable-send-community', comm_type])
+                        config.delete(neighbor_path + [neighbor, 'disable-send-community', comm_type])
+                config.delete(neighbor_path + [neighbor, 'disable-send-community'])
+
+
+if not config.exists(['protocols', 'bgp']):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Just to avoid writing it so many times
+    af_path = ['address-family', 'ipv4-unicast']
+
+    # Check if BGP is actually configured and obtain the ASN
+    asn_list = config.list_nodes(['protocols', 'bgp'])
+    if asn_list:
+        # There's always just one BGP node, if any
+        asn = asn_list[0]
+        bgp_path = ['protocols', 'bgp', asn]
+    else:
+        # There's actually no BGP, just its empty shell
+        sys.exit(0)
+
+    ## Move global IPv4-specific BGP options to "address-family ipv4-unicast"
+
+    # Move networks
+    network_path = ['protocols', 'bgp', asn, 'network']
+    if config.exists(network_path):
+        config.set(bgp_path + af_path + ['network'])
+        config.set_tag(bgp_path + af_path + ['network'])
+
+        networks = config.list_nodes(network_path)
+        for network in networks:
+            config.set(bgp_path + af_path + ['network', network])
+            if config.exists(network_path + [network, 'route-map']):
+                route_map = config.return_value(network_path + [network, 'route-map'])
+                config.set(bgp_path + af_path + ['network', network, 'route-map'], value=route_map)
+        config.delete(network_path)
+
+    # Move aggregate-address statements
+    aggregate_path = ['protocols', 'bgp', asn, 'aggregate-address']
+    if config.exists(aggregate_path):
+        config.set(bgp_path + af_path + ['aggregate-address'])
+        config.set_tag(bgp_path + af_path + ['aggregate-address'])
+
+        aggregates = config.list_nodes(aggregate_path)
+        for aggregate in aggregates:
+            config.set(bgp_path + af_path + ['aggregate-address', aggregate])
+            if config.exists(aggregate_path + [aggregate, 'as-set']):
+                config.set(bgp_path + af_path + ['aggregate-address', aggregate, 'as-set'])
+            if config.exists(aggregate_path + [aggregate, 'summary-only']):
+                config.set(bgp_path + af_path + ['aggregate-address', aggregate, 'summary-only'])
+        config.delete(aggregate_path)
+
+    ## Migrate neighbor options
+    neighbor_path = ['protocols', 'bgp', asn, 'neighbor']
+    if config.exists(neighbor_path):
+        neighbors = config.list_nodes(neighbor_path)
+        for neighbor in neighbors:
+            migrate_neighbor(config, neighbor_path, neighbor)
+
+    peer_group_path = ['protocols', 'bgp', asn, 'peer-group']
+    if config.exists(peer_group_path):
+        peer_groups = config.list_nodes(peer_group_path)
+        for peer_group in peer_groups:
+            migrate_neighbor(config, peer_group_path, peer_group)
+
+    ## Migrate redistribute statements
+    redistribute_path = ['protocols', 'bgp', asn, 'redistribute']
+    if config.exists(redistribute_path):
+        config.set(bgp_path + af_path + ['redistribute'])
+
+        redistributes = config.list_nodes(redistribute_path)
+        for redistribute in redistributes:
+            config.set(bgp_path + af_path + ['redistribute', redistribute])
+            if config.exists(redistribute_path + [redistribute, 'metric']):
+                redist_metric = config.return_value(redistribute_path + [redistribute, 'metric'])
+                config.set(bgp_path + af_path + ['redistribute', redistribute, 'metric'], value=redist_metric)
+            if config.exists(redistribute_path + [redistribute, 'route-map']):
+                redist_route_map = config.return_value(redistribute_path + [redistribute, 'route-map'])
+                config.set(bgp_path + af_path + ['redistribute', redistribute, 'route-map'], value=redist_route_map)
+
+        config.delete(redistribute_path)
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/ssh/0-to-1 b/src/migration-scripts/ssh/0-to-1
new file mode 100755
index 000000000..91b832276
--- /dev/null
+++ b/src/migration-scripts/ssh/0-to-1
@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+
+# Delete "service ssh allow-root" option
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+if not config.exists(['service', 'ssh', 'allow-root']):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Delete node with abandoned command
+    config.delete(['service', 'ssh', 'allow-root'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/system/10-to-11 b/src/migration-scripts/system/10-to-11
new file mode 100755
index 000000000..e6467243c
--- /dev/null
+++ b/src/migration-scripts/system/10-to-11
@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+
+# Unclutter RADIUS configuiration for 'system login radius-server'
+# Move radius-server top level tag nodes to a regular node which allows us
+# to specify additional general features for the RADIUS client
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+cfg_base = ['system', 'login']
+if not config.exists(cfg_base + ['radius-server']):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Migrate "system login radius-server" tag node to new
+    # "system login radius server" tag node and also rename the "secret" node to "key"
+    for server in config.list_nodes(cfg_base + ['radius-server']):
+        base_server = cfg_base + ['radius-server', server]
+        # "key" node is mandatory
+        key = config.return_value(base_server + ['secret'])
+        config.set(cfg_base + ['radius', 'server', server, 'key'], value=key)
+
+        # "port" is optional
+        if config.exists(base_server + ['port']):
+            port = config.return_value(base_server + ['port'])
+            config.set(cfg_base + ['radius', 'server', server, 'port'], value=port)
+
+        # "timeout is optional"
+        if config.exists(base_server + ['timeout']):
+            timeout = config.return_value(base_server + ['timeout'])
+            config.set(cfg_base + ['radius', 'server', server, 'timeout'], value=timeout)
+
+        # format as tag node
+        config.set_tag(cfg_base + ['radius', 'server'])
+
+        # delete old configuration node
+        config.delete(base_server)
+
+    # delete top level tag node
+    if config.exists(cfg_base + ['radius-server']):
+        config.delete(cfg_base + ['radius-server'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/system/8-to-9 b/src/migration-scripts/system/8-to-9
new file mode 100755
index 000000000..db3fefdea
--- /dev/null
+++ b/src/migration-scripts/system/8-to-9
@@ -0,0 +1,32 @@
+#!/usr/bin/env python3
+
+# Deletes "system package" option as it is deprecated
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+if not config.exists(['system', 'package']):
+    # Nothing to do
+    sys.exit(0)
+else:
+    # Delete the node with the old syntax
+    config.delete(['system', 'package'])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/system/9-to-10 b/src/migration-scripts/system/9-to-10
new file mode 100755
index 000000000..c4343ec55
--- /dev/null
+++ b/src/migration-scripts/system/9-to-10
@@ -0,0 +1,34 @@
+#!/usr/bin/env python3
+
+# converts opertator accts. to admin level accts.
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if (len(sys.argv) < 1):
+  print("Must specify file name!")
+  sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+  config_file = f.read()
+
+config = ConfigTree(config_file)
+
+if not config.exists(['system', 'login', 'user']):
+  # Nothing to do, which shouldn't happen anyway
+  # only if you wipe the config and reboot.
+    sys.exit(0)
+else:
+  for usr in config.list_nodes(['system', 'login', 'user']):
+    if config.return_value(['system', 'login', 'user', usr, 'level']) == 'operator':
+      config.set(['system', 'login', 'user', usr, 'level'], value="admin", replace=True)
+
+  try:
+    open(file_name,'w').write(config.to_string())
+  except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    sys.exit(1)
+
diff --git a/src/migration-scripts/webproxy/1-to-2 b/src/migration-scripts/webproxy/1-to-2
new file mode 100755
index 000000000..070ff356d
--- /dev/null
+++ b/src/migration-scripts/webproxy/1-to-2
@@ -0,0 +1,39 @@
+#!/usr/bin/env python3
+
+# migrate old style `webproxy proxy-bypass 1.2.3.4/24`
+# to new style `webproxy whitelist destination-address 1.2.3.4/24`
+
+import sys
+
+from vyos.configtree import ConfigTree
+
+if len(sys.argv) < 1:
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+cfg_webproxy_base = ['service', 'webproxy']
+if not config.exists(cfg_webproxy_base + ['proxy-bypass']):
+    # Nothing to do
+    sys.exit(0)
+else:
+    bypass_addresses = config.return_values(cfg_webproxy_base + ['proxy-bypass'])
+    # delete old configuration node
+    config.delete(cfg_webproxy_base + ['proxy-bypass'])
+    for bypass_address in bypass_addresses:
+        # add data to new configuration node
+        config.set(cfg_webproxy_base + ['whitelist', 'destination-address'], value=bypass_address, replace=False)
+
+    # save updated configuration
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)