9 files changed, 53 insertions, 43 deletions
diff --git a/templates/interfaces/bridge/node.tag/address/node.def b/templates/interfaces/bridge/node.tag/address/node.def
index 410c072b..23b1262f 100644
--- a/templates/interfaces/bridge/node.tag/address/node.def
+++ b/templates/interfaces/bridge/node.tag/address/node.def
@@ -4,6 +4,7 @@ help: Configure an IP address for this interface
 syntax:expression: exec "/opt/vyatta/sbin/vyatta-interfaces.pl --valid-addr $VAR(@) --dev $VAR(../@)"; "Invalid IP address/prefix [$VAR(@)] for interface $VAR(../@)"
 update:expression: "sudo /opt/vyatta/sbin/vyatta-interfaces.pl --eth-addr-update $VAR(@) --dev $VAR(../@)"; "Error setting address $VAR(@) on interface $VAR(../@)"
 delete:expression: "sudo /opt/vyatta/sbin/vyatta-interfaces.pl --eth-addr-delete $VAR(@) --dev $VAR(../@)"; "Error deleting address $VAR(@) on interface $VAR(../@)"
+allowed: echo "dhcp <>"
 comp_help:Possible completions:
   <IP address>/<prefix length>\tSet the IP address and prefix length
   dhcp\t\t\t\tSet the IP address and prefix length via DHCP
diff --git a/templates/interfaces/tunnel/node.def b/templates/interfaces/tunnel/node.def
index 73c8e572..9ebb581c 100644
--- a/templates/interfaces/tunnel/node.def
+++ b/templates/interfaces/tunnel/node.def
@@ -2,10 +2,23 @@ tag:
 type: txt
 help: Configure a tunnel interface
 syntax:expression: $VAR(@) in "tun0", "tun1", "tun2", "tun3", "tun4", "tun5", "tun6", "tun7", "tun8", "tun9" ; "Must be (tun0 - tun9)"
-commit:expression: $VAR(./local-ip/) != "" ; "Must configure the tunnel local-ip"
-commit:expression: $VAR(./remote-ip/) != "" ; "Must configure the tunnel remote-ip"
-commit:expression: $VAR(./encapsulation/) != "" ; "Must configure the tunnel encapsulation"
-create:expression: "sudo ip tunnel add $VAR(@) local $VAR(./local-ip/@) remote $VAR(./remote-ip/@) mode $VAR(./encapsulation/@)"
-create:expression: "sudo ip link set $VAR(@) up"
-delete:expression: "sudo ip tunnel del $VAR(@)"
+
+commit:expression: $VAR(./local-ip/) != "" ;                    \
+                   "Must configure the tunnel local-ip for $VAR(@)"
+commit:expression: $VAR(./remote-ip/) != "" ;                   \
+                   "Must configure the tunnel remote-ip for $VAR(@)"
+commit:expression: $VAR(./encapsulation/) != "" ;               \
+                   "Must configure the tunnel encapsulation for $VAR(@)"
+
+create:expression: "\
+       if [ -n \"$VAR(./key/@)\" ]; then                        \
+          KEY=\"key $VAR(./key/@)\";                            \
+       fi;                                                      \
+       sudo ip tunnel add $VAR(@)                               \
+            local $VAR(./local-ip/@) remote $VAR(./remote-ip/@) \
+            mode $VAR(./encapsulation/@) $KEY;                  \
+       sudo ip link set $VAR(@) up;" ; "Error creating $VAR(@)"
+
+delete:expression: "sudo ip tunnel del $VAR(@)" ; "Error deleting $VAR(@)"
+
 comp_help: "Enter tunnel interface name (tun0 - tun9)"
diff --git a/templates/interfaces/tunnel/node.tag/address/node.def b/templates/interfaces/tunnel/node.tag/address/node.def
index fe58ae05..4d91c9ba 100644
--- a/templates/interfaces/tunnel/node.tag/address/node.def
+++ b/templates/interfaces/tunnel/node.tag/address/node.def
@@ -1,8 +1,12 @@
 multi:
 type: txt
 help: Configure an IP address for this interface
+
 syntax:expression: exec "/opt/vyatta/sbin/vyatta-interfaces.pl --valid-addr $VAR(@) --dev $VAR(../@)"; "Invalid IP address/prefix [$VAR(@)] for interface $VAR(../@)"
+
 update:expression: "sudo /opt/vyatta/sbin/vyatta-interfaces.pl --eth-addr-update $VAR(@) --dev $VAR(../@)"; "Error setting address $VAR(@) on interface $VAR(../@)"
+
 delete:expression: "sudo /opt/vyatta/sbin/vyatta-interfaces.pl --eth-addr-delete $VAR(@) --dev $VAR(../@)"; "Error deleting address $VAR(@) on interface $VAR(../@)"
+
 comp_help:Possible completions:
-  <IP address>/<prefix length>\tSet the IP address and prefix length
+  <IP address>/<prefix length>      Set the IP address and prefix length
diff --git a/templates/interfaces/tunnel/node.tag/disable/node.def b/templates/interfaces/tunnel/node.tag/disable/node.def
index 9c795c61..cd3c019a 100644
--- a/templates/interfaces/tunnel/node.tag/disable/node.def
+++ b/templates/interfaces/tunnel/node.tag/disable/node.def
@@ -1,3 +1,6 @@
 help: Disable interface
-update:expression: "sudo ip link set $VAR(../@) down"; "Error disabling dev $VAR(../@)"
-delete:expression: "sudo ip link set $VAR(../@) up"; "Error enabling dev $VAR(../@)"
+update:expression: "sudo ip link set $VAR(../@) down"; \
+                   "Error disabling dev $VAR(../@)"
+
+delete:expression: "sudo ip link set $VAR(../@) up"; \
+                   "Error enabling dev $VAR(../@)"
diff --git a/templates/interfaces/tunnel/node.tag/encapsulation/node.def b/templates/interfaces/tunnel/node.tag/encapsulation/node.def
index 98745b2d..02d579a9 100644
--- a/templates/interfaces/tunnel/node.tag/encapsulation/node.def
+++ b/templates/interfaces/tunnel/node.tag/encapsulation/node.def
@@ -1,7 +1,12 @@
 type: txt
 help: Set the encapsulation of this tunnel interface
+
 syntax:expression: $VAR(@) in "ipip", "gre", "sit"; "Must be (ipip, gre, sit)"
-update:expression: "sudo ip tunnel change $VAR(../@) mode $VAR(@)"
+
+create:expression: "true"
+update:expression: "false" ; \
+               "Encapsulation can only be set at tunnel creation for $VAR(../@)"
+
 comp_help: "possible completions:
  gre                 Set Generic Routing Encapsulation
  ipip                Set IP in IP encapsulation
diff --git a/templates/interfaces/tunnel/node.tag/key/node.def b/templates/interfaces/tunnel/node.tag/key/node.def
index 1c524984..ae244529 100644
--- a/templates/interfaces/tunnel/node.tag/key/node.def
+++ b/templates/interfaces/tunnel/node.tag/key/node.def
@@ -1,6 +1,14 @@
 type: u32
 help: Set the tunnel key
-syntax:expression: $VAR(@) >= 0 && $VAR(@) <= 999999; "Must be between 0-999999"
-update:expression: "sudo ip tunnel change $VAR(../@) key $VAR(@)"
+syntax:expression: $VAR(@) >= 0 && $VAR(@) <= 999999; \
+                   "Must be between 0-999999 for $VAR(../@)"
+
+commit:expression: $VAR(../encapsulation/@) in "gre" ; \
+                   "Key only valid for GRE for $VAR(../@)"
+
+create:expression: "true"
+update:expression: "false" ; \
+                   "Key can only be set at tunnel creation for $VAR(../@)"
+
 comp_help: possible completions
  <0-999999>         Set a tunnel key
diff --git a/templates/system/login/node.def b/templates/system/login/node.def
index ca2da1b3..d98c03c6 100644
--- a/templates/system/login/node.def
+++ b/templates/system/login/node.def
@@ -1,3 +1,3 @@
 help: Configure user access
 delete:expression: "echo User root cannot be deleted 1>&2 && exit 1"
-
+end: /opt/vyatta/sbin/vyatta_update_login.pl
diff --git a/templates/system/login/radius-server/node.def b/templates/system/login/radius-server/node.def
index 6d87890c..85ca4cc5 100644
--- a/templates/system/login/radius-server/node.def
+++ b/templates/system/login/radius-server/node.def
@@ -1,10 +1,6 @@
 tag:
 type: ipv4
 help: Radius server authentication configuration
-# need mandatory secret. also need port & timeout (default values?)
-update:expression: "sudo sh -c \"touch /etc/raddb/server && \
-sed -i '/$VAR(@)/d' /etc/raddb/server && \
-echo \\\"$VAR(@):$VAR(port/@)\t$VAR(secret/@)\t$VAR(timeout/@)\\\" \
->> /etc/raddb/server\" "
-delete:expression: "sudo sh -c \"touch /etc/raddb/server && \
-sed -i '/$VAR(@)/d' /etc/raddb/server\" "
+commit:expression: $VAR(port) != "" && $VAR(secret) != ""
+                   && $VAR(timeout) != ""
+                     ; "Port, secret, and timeout must be specified for Radius"
diff --git a/templates/system/login/user/node.def b/templates/system/login/user/node.def
index 0c1a393d..205a4b7a 100644
--- a/templates/system/login/user/node.def
+++ b/templates/system/login/user/node.def
@@ -4,26 +4,6 @@ help: User account information
 commit:expression: $VAR(authentication/encrypted-password) != ""
                    || ($VAR(authentication/plaintext-password) != ""
                        && $VAR(authentication/plaintext-password/@) != "")
-                   ; "user password must be specified"
-syntax:expression: pattern $VAR(@) "^[a-zA-Z_][a-zA-Z0-9_-]*\\$?$" ; "invalid user name $VAR(@)"
-# line continuation and $() expansion are done by cli, not sh.
-# need mandatory encrypted password.
-end:expression: "if [ -d /tmp/vyatta-delete-system-login-user-$VAR(@).$PPID ]; \
-then rm -rf /tmp/vyatta-delete-system-login-user-$VAR(@).$PPID && exit 0; \
-fi && \
-sudo /opt/vyatta/sbin/vyatta_update_login_user.pl \
-  '$VAR(@)' '$VAR(full-name/@)' '$VAR(authentication/encrypted-password/@)' \
-  '$VAR(level/@)'"
-delete:expression: "if [ x$VAR(@) == x ]; then exit 1; fi && \
-if [ x$VAR(@) == xroot ]; then \
-  echo Cannot delete user \"root\" 1>&2 && exit 2; \
-fi && \
-if mkdir /tmp/vyatta-delete-system-login-user-$VAR(@).$PPID >& /dev/null; \
-then \
-  if ! sudo /opt/vyatta/sbin/vyatta_update_login_user.pl -d '$VAR(@)'; then \
-    rm -rf /tmp/vyatta-delete-system-login-user-$VAR(@).$PPID; \
-    exit 1; \
-  fi; \
-else \
-  exit 1; \
-fi"
+                     ; "user password must be specified"
+syntax:expression: pattern $VAR(@) "^[a-zA-Z_][a-zA-Z0-9_-]*\\$?$"
+                     ; "invalid user name $VAR(@)"