tunnel: T3364: rename encapsulation mode "gre-bridge" to "gretap"

The following list shows the mapping of VyOS tunnel encapsulation modes to the
corresponding Linux modes.

VyOS        Linux
gre         gre
gre-bridge  gretap
ipip        ipip
ipip6       ipip6
ip6ip6      ip6ip6
ip6gre      ip6gre
sit         sit

Besides gre-bridge this is pretty consistent. As bridge interfaces are also
called tap interfaces gre-bridge will be renamed to gretap to make the
post-processing much easier.

This means (in detail) that there are no more child classes of _Tunnel and
there will be now one geneirc TunnelIf class handling all sorts of encapsulation.

8 files changed, 263 insertions, 167 deletions

diff --git a/interface-definitions/interfaces-tunnel.xml.in b/interface-definitions/interfaces-tunnel.xml.in
index 7a97980a2..bb23ba933 100644
--- a/interface-definitions/interfaces-tunnel.xml.in
+++ b/interface-definitions/interfaces-tunnel.xml.in
@@ -79,15 +79,15 @@
             <properties>
               <help>Encapsulation of this tunnel interface</help>
               <completionHelp>
-                <list>gre gre-bridge ip6gre ip6ip6 ipip ipip6 sit</list>
+                <list>gre gretap ip6gre ip6ip6 ipip ipip6 sit</list>
               </completionHelp>
               <valueHelp>
                 <format>gre</format>
                 <description>Generic Routing Encapsulation</description>
               </valueHelp>
               <valueHelp>
-                <format>gre-bridge</format>
-                <description>Generic Routing Encapsulation bridge interface</description>
+                <format>gretap</format>
+                <description>Generic Routing Encapsulation (virtual L2 tunnel)</description>
               </valueHelp>
               <valueHelp>
                 <format>ip6gre</format>
@@ -110,9 +110,9 @@
                 <description>Simple Internet Transition encapsulation</description>
               </valueHelp>
               <constraint>
-                <regex>^(gre|gre-bridge|ip6gre|ip6ip6|ipip|ipip6|sit)$</regex>
+                <regex>^(gre|gretap|ip6gre|ip6ip6|ipip|ipip6|sit)$</regex>
               </constraint>
-              <constraintErrorMessage>Invalid encapsulation, must be one of: gre, gre-bridge, ipip, sit, ipip6, ip6ip6, ip6gre</constraintErrorMessage>
+              <constraintErrorMessage>Invalid encapsulation, must be one of: gre, gretap, ipip, sit, ipip6, ip6ip6, ip6gre</constraintErrorMessage>
             </properties>
           </leafNode>
           <leafNode name="multicast">
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index 7be78b94b..8286a735c 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -124,10 +124,11 @@ def verify_tunnel(config):
         if 'remote_ip' in config and not is_ipv4(config['remote_ip']):
             raise ConfigError(f'{error_ipv4} remote-ip')
 
-    if config['encapsulation'] in ['sit', 'gre-bridge']:
+    if config['encapsulation'] in ['sit', 'gretap']:
         if 'source_interface' in config:
-            raise ConfigError('Option source-interface can not be used with ' \
-                              'encapsulation "sit" or "gre-bridge"')
+            encapsulation = config['encapsulation']
+            raise ConfigError(f'Option source-interface can not be used with ' \
+                              f'encapsulation "{encapsulation}"!')
     elif config['encapsulation'] == 'gre':
         if 'local_ip' in config and is_ipv6(config['local_ip']):
             raise ConfigError('Can not use local IPv6 address is for mGRE tunnels')
diff --git a/python/vyos/ifconfig/__init__.py b/python/vyos/ifconfig/__init__.py
index 129524bda..9d797d7f1 100644
--- a/python/vyos/ifconfig/__init__.py
+++ b/python/vyos/ifconfig/__init__.py
@@ -30,14 +30,7 @@ from vyos.ifconfig.vxlan import VXLANIf
 from vyos.ifconfig.wireguard import WireGuardIf
 from vyos.ifconfig.vtun import VTunIf
 from vyos.ifconfig.vti import VTIIf
-from vyos.ifconfig.tunnel import GREIf
-from vyos.ifconfig.tunnel import GRETapIf
-from vyos.ifconfig.tunnel import IP6GREIf
-from vyos.ifconfig.tunnel import IPIPIf
-from vyos.ifconfig.tunnel import IPIP6If
-from vyos.ifconfig.tunnel import IP6IP6If
-from vyos.ifconfig.tunnel import SitIf
-from vyos.ifconfig.tunnel import Sit6RDIf
+from vyos.ifconfig.tunnel import TunnelIf
 from vyos.ifconfig.erspan import ERSpanIf
 from vyos.ifconfig.erspan import ER6SpanIf
 from vyos.ifconfig.wireless import WiFiIf
diff --git a/python/vyos/ifconfig/tunnel.py b/python/vyos/ifconfig/tunnel.py
index 271919b90..a74d50646 100644
--- a/python/vyos/ifconfig/tunnel.py
+++ b/python/vyos/ifconfig/tunnel.py
@@ -32,9 +32,9 @@ def enable_to_on(value):
     raise ValueError(f'expect enable or disable but got "{value}"')
 
 @Interface.register
-class _Tunnel(Interface):
+class TunnelIf(Interface):
     """
-    _Tunnel: private base class for tunnels
+    Tunnel: private base class for tunnels
     https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/tunnel.c
     https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/ip6tunnel.c
     """
@@ -89,15 +89,30 @@ class _Tunnel(Interface):
         }
     }
 
+    def __init__(self, ifname, **kargs):
+        self.iftype = kargs['encapsulation']
+        super().__init__(ifname, **kargs)
+
+        # The gretap interface has the possibility to act as L2 bridge
+        if self.iftype == 'gretap':
+            # no multicast, ttl or tos for gretap
+            self.definition = {
+                **TunnelIf.definition,
+                **{
+                    'bridgeable': True,
+                },
+            }
+
+
     def _create(self):
         if self.config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
             mapping = { **self.mapping, **self.mapping_ipv6 }
         else:
             mapping = { **self.mapping, **self.mapping_ipv4 }
 
-        cmd = 'ip tunnel add {ifname} mode {type}'
-        if self.config['encapsulation'] == 'gre-bridge':
-            cmd = 'ip link add name {ifname} type {type}'
+        cmd = 'ip tunnel add {ifname} mode {encapsulation}'
+        if self.iftype == 'gretap':
+            cmd = 'ip link add name {ifname} type {encapsulation}'
         for vyos_key, iproute2_key in mapping.items():
             # dict_search will return an empty dict "{}" for valueless nodes like
             # "parameters.nolearning" - thus we need to test the nodes existence
@@ -112,14 +127,17 @@ class _Tunnel(Interface):
 
         self.set_admin_state('down')
 
-    def change_options(self):
+    def _change_options(self):
+        # gretap interfaces do not support changing any parameter
+        if self.iftype == 'gretap':
+            return
+
         if self.config['encapsulation'] in ['ipip6', 'ip6ip6', 'ip6gre']:
             mapping = { **self.mapping, **self.mapping_ipv6 }
         else:
             mapping = { **self.mapping, **self.mapping_ipv4 }
 
-        self.config['type'] = self.iftype
-        cmd = 'ip tunnel change {ifname} mode {type}'
+        cmd = 'ip tunnel change {ifname} mode {encapsulation}'
         for vyos_key, iproute2_key in mapping.items():
             # dict_search will return an empty dict "{}" for valueless nodes like
             # "parameters.nolearning" - thus we need to test the nodes existence
@@ -161,6 +179,8 @@ class _Tunnel(Interface):
         get_config_dict(). It's main intention is to consolidate the scattered
         interface setup code and provide a single point of entry when workin
         on any interface. """
+        # Adjust iproute2 tunnel parameters if necessary
+        self._change_options()
 
         # call base class first
         super().update(config)
@@ -174,99 +194,3 @@ class _Tunnel(Interface):
         # reconfiguration.
         state = 'down' if 'disable' in config else 'up'
         self.set_admin_state(state)
-
-class GREIf(_Tunnel):
-    """
-    GRE: Generic Routing Encapsulation
-
-    For more information please refer to:
-    RFC1701, RFC1702, RFC2784
-    https://tools.ietf.org/html/rfc2784
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_gre.c
-    """
-    iftype = 'gre'
-
-# GreTap also called GRE Bridge
-class GRETapIf(_Tunnel):
-    """
-    GRETapIF: GreIF using TAP instead of TUN
-    https://en.wikipedia.org/wiki/TUN/TAP
-    """
-    iftype = 'gretap'
-    # no multicast, ttl or tos for gretap
-    definition = {
-        **_Tunnel.definition,
-        **{
-            'bridgeable': True,
-        },
-    }
-
-    def change_options(self):
-        pass
-
-class IP6GREIf(_Tunnel):
-    """
-    IP6Gre: IPv6 Support for Generic Routing Encapsulation (GRE)
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc7676
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_gre6.c
-    """
-    iftype = 'ip6gre'
-
-class IPIPIf(_Tunnel):
-    """
-    IPIP: IP Encapsulation within IP
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc2003
-    """
-    iftype = 'ipip'
-
-class IPIP6If(_Tunnel):
-    """
-    IPIP6: IPv4 over IPv6 tunnel
-
-    For more information please refer to:
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_ip6tnl.c
-    """
-    iftype = 'ipip6'
-
-class IP6IP6If(IPIP6If):
-    """
-    IP6IP6: IPv6 over IPv6 tunnel
-
-    For more information please refer to:
-    https://tools.ietf.org/html/rfc2473
-    """
-    iftype = 'ip6ip6'
-
-class SitIf(_Tunnel):
-    """
-    Sit: Simple Internet Transition
-
-    For more information please refer to:
-    https://git.kernel.org/pub/scm/network/iproute2/iproute2.git/tree/ip/link_iptnl.c
-    """
-    iftype = 'sit'
-
-class Sit6RDIf(SitIf):
-    """
-    Sit6RDIf: Simple Internet Transition with 6RD
-
-    https://en.wikipedia.org/wiki/IPv6_rapid_deployment
-    """
-    # TODO: check if key can really be used with 6RD
-    iftype = '6rd'
-
-    def _create(self):
-        # do not call _Tunnel.create, building fully here
-
-        create = 'ip tunnel add {ifname} mode {type} remote {remote}'
-        self._cmd(create.format(**self.config))
-        self.set_interface('state','down')
-
-        set6rd = 'ip tunnel 6rd dev {ifname} 6rd-prefix {6rd-prefix}'
-        if '6rd-relay-prefix' in self.config:
-            set6rd += ' 6rd-relay-prefix {6rd-relay-prefix}'
-        self._cmd(set6rd.format(**self.config))
diff --git a/smoketest/configs/tunnel-broker b/smoketest/configs/tunnel-broker
new file mode 100644
index 000000000..54e63abda
--- /dev/null
+++ b/smoketest/configs/tunnel-broker
@@ -0,0 +1,103 @@
+interfaces {
+    dummy dum0 {
+        address 192.0.2.0/32
+    }
+    dummy dum1 {
+        address 192.0.2.1/32
+    }
+    dummy dum2 {
+        address 192.0.2.2/32
+    }
+    dummy dum3 {
+        address 192.0.2.3/32
+    }
+    dummy dum4 {
+        address 192.0.2.4/32
+    }
+    ethernet eth0 {
+        duplex auto
+        smp-affinity auto
+        speed auto
+        address 172.18.202.10/24
+    }
+    tunnel tun100 {
+        address 172.16.0.1/30
+        encapsulation gre-bridge
+        local-ip 192.0.2.0
+        remote-ip 192.0.2.100
+    }
+    tunnel tun200 {
+        address 172.16.0.5/30
+        encapsulation gre
+        local-ip 192.0.2.1
+        remote-ip 192.0.2.101
+    }
+    tunnel tun300 {
+        address 172.16.0.9/30
+        encapsulation ipip
+        local-ip 192.0.2.2
+        remote-ip 192.0.2.102
+    }
+    tunnel tun400 {
+        address 172.16.0.13/30
+        encapsulation gre-bridge
+        local-ip 192.0.2.3
+        remote-ip 192.0.2.103
+    }
+    tunnel tun500 {
+        address 172.16.0.17/30
+        encapsulation gre
+        local-ip 192.0.2.4
+        remote-ip 192.0.2.104
+    }
+}
+protocols {
+    static {
+        route 0.0.0.0/0 {
+            next-hop 172.18.202.1 {
+                distance 10
+            }
+        }
+    }
+}
+system {
+    config-management {
+        commit-revisions 100
+    }
+    console {
+        device ttyS0 {
+            speed 115200
+        }
+    }
+    host-name vyos
+    login {
+        user vyos {
+            authentication {
+                encrypted-password $6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0
+                plaintext-password ""
+            }
+        }
+    }
+    ntp {
+        server 0.pool.ntp.org {
+        }
+        server 1.pool.ntp.org {
+        }
+        server 2.pool.ntp.org {
+        }
+    }
+    syslog {
+        global {
+            facility all {
+                level info
+            }
+            facility protocols {
+                level debug
+            }
+        }
+    }
+}
+
+/* Warning: Do not remove the following line. */
+/* === vyatta-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack-sync@1:conntrack@1:dhcp-relay@2:dhcp-server@5:dns-forwarding@1:firewall@5:ipsec@5:l2tp@1:mdns@1:nat@4:ntp@1:pptp@1:qos@1:quagga@6:snmp@1:ssh@1:system@10:vrrp@2:wanloadbalance@3:webgui@1:webproxy@1:webproxy@2:zone-policy@1" === */
+/* Release version: 1.2.6-S1 */
diff --git a/smoketest/scripts/cli/test_interfaces_tunnel.py b/smoketest/scripts/cli/test_interfaces_tunnel.py
index a9250e3e5..0bbc807db 100755
--- a/smoketest/scripts/cli/test_interfaces_tunnel.py
+++ b/smoketest/scripts/cli/test_interfaces_tunnel.py
@@ -20,6 +20,7 @@ import json
 from vyos.configsession import ConfigSession
 from vyos.configsession import ConfigSessionError
 from vyos.util import cmd
+from vyos.template import inc_ip
 
 from base_interfaces_test import BasicInterfaceTest
 
@@ -90,7 +91,7 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
 
         interface = f'tun1000'
         local_if_addr = f'10.10.200.1/24'
-        for encapsulation in ['ipip', 'sit', 'gre', 'gre-bridge']:
+        for encapsulation in ['ipip', 'sit', 'gre', 'gretap']:
             self.session.set(self._base_path + [interface, 'address', local_if_addr])
             self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
             self.session.set(self._base_path + [interface, 'local-ip', self.local_v6])
@@ -107,8 +108,8 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
             self.session.set(self._base_path + [interface, 'remote-ip', remote_ip4])
             self.session.set(self._base_path + [interface, 'source-interface', source_if])
 
-            # Source interface can not be used with sit and gre-bridge
-            if encapsulation in ['sit', 'gre-bridge']:
+            # Source interface can not be used with sit and gretap
+            if encapsulation in ['sit', 'gretap']:
                 with self.assertRaises(ConfigSessionError):
                     self.session.commit()
                 self.session.delete(self._base_path + [interface, 'source-interface'])
@@ -117,17 +118,14 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
             self.session.commit()
 
             conf = tunnel_conf(interface)
-            self.assertEqual(interface, conf['ifname'])
-            self.assertEqual(mtu, conf['mtu'])
-
-            if encapsulation not in ['sit', 'gre-bridge']:
+            if encapsulation not in ['sit', 'gretap']:
                 self.assertEqual(source_if, conf['link'])
-                self.assertEqual(encapsulation, conf['link_type'])
-            elif encapsulation in ['gre-bridge']:
-                self.assertEqual('ether', conf['link_type'])
 
+            self.assertEqual(interface, conf['ifname'])
+            self.assertEqual(mtu, conf['mtu'])
+            self.assertEqual(encapsulation, conf['linkinfo']['info_kind'])
             self.assertEqual(self.local_v4, conf['linkinfo']['info_data']['local'])
-            self.assertEqual(remote_ip4,     conf['linkinfo']['info_data']['remote'])
+            self.assertEqual(remote_ip4,    conf['linkinfo']['info_data']['remote'])
             self.assertTrue(conf['linkinfo']['info_data']['pmtudisc'])
 
             # cleanup this instance
@@ -167,14 +165,15 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
             self.assertEqual(mtu, conf['mtu'])
             self.assertEqual(source_if, conf['link'])
 
-            # remap encapsulation protocol(s)
-            if encapsulation in ['ipip6', 'ip6ip6']:
-                encapsulation = 'tunnel6'
-            elif encapsulation in ['ip6gre']:
-                encapsulation = 'gre6'
+            # Not applicable for ip6gre
+            if 'proto' in conf['linkinfo']['info_data']:
+                self.assertEqual(encapsulation, conf['linkinfo']['info_data']['proto'])
 
-            self.assertEqual(encapsulation, conf['link_type'])
+            # remap encapsulation protocol(s) only for ipip6, ip6ip6
+            if encapsulation in ['ipip6', 'ip6ip6']:
+                encapsulation = 'ip6tnl'
 
+            self.assertEqual(encapsulation, conf['linkinfo']['info_kind'])
             self.assertEqual(self.local_v6, conf['linkinfo']['info_data']['local'])
             self.assertEqual(remote_ip6,    conf['linkinfo']['info_data']['remote'])
 
@@ -222,11 +221,41 @@ class TunnelInterfaceTest(BasicInterfaceTest.BaseTest):
         conf = tunnel_conf(interface)
         self.assertEqual(mtu,           conf['mtu'])
         self.assertEqual(interface,     conf['ifname'])
-        self.assertEqual(encapsulation, conf['link_type'])
+        self.assertEqual(encapsulation, conf['linkinfo']['info_kind'])
         self.assertEqual(self.local_v4, conf['linkinfo']['info_data']['local'])
         self.assertEqual(remote_ip4,    conf['linkinfo']['info_data']['remote'])
         self.assertEqual(0,             conf['linkinfo']['info_data']['ttl'])
         self.assertFalse(               conf['linkinfo']['info_data']['pmtudisc'])
 
+    def test_gretap_parameters_change(self):
+        interface = f'tun1040'
+        gre_key = '10'
+        encapsulation = 'gretap'
+        tos = '20'
+
+        self.session.set(self._base_path + [interface, 'encapsulation', encapsulation])
+        self.session.set(self._base_path + [interface, 'local-ip', self.local_v4])
+        self.session.set(self._base_path + [interface, 'remote-ip', remote_ip4])
+
+        # Check if commit is ok
+        self.session.commit()
+
+        conf = tunnel_conf(interface)
+        self.assertEqual(mtu,           conf['mtu'])
+        self.assertEqual(interface,     conf['ifname'])
+        self.assertEqual(encapsulation, conf['linkinfo']['info_kind'])
+        self.assertEqual(self.local_v4, conf['linkinfo']['info_data']['local'])
+        self.assertEqual(remote_ip4,    conf['linkinfo']['info_data']['remote'])
+        self.assertEqual(0,             conf['linkinfo']['info_data']['ttl'])
+
+        # Change remote-ip (inc host by 2
+        new_remote = inc_ip(remote_ip4, 2)
+        self.session.set(self._base_path + [interface, 'remote-ip', new_remote])
+        # Check if commit is ok
+        self.session.commit()
+
+        conf = tunnel_conf(interface)
+        self.assertEqual(new_remote,    conf['linkinfo']['info_data']['remote'])
+
 if __name__ == '__main__':
     unittest.main(verbosity=2)
diff --git a/src/conf_mode/interfaces-tunnel.py b/src/conf_mode/interfaces-tunnel.py
index ae28f5101..2d2f29f94 100755
--- a/src/conf_mode/interfaces-tunnel.py
+++ b/src/conf_mode/interfaces-tunnel.py
@@ -31,21 +31,25 @@ from vyos.configverify import verify_mtu_ipv6
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_tunnel
 from vyos.ifconfig import Interface
-from vyos.ifconfig import GREIf
-from vyos.ifconfig import GRETapIf
-from vyos.ifconfig import IPIPIf
-from vyos.ifconfig import IP6GREIf
-from vyos.ifconfig import IPIP6If
-from vyos.ifconfig import IP6IP6If
-from vyos.ifconfig import SitIf
-from vyos.ifconfig import Sit6RDIf
+from vyos.ifconfig import TunnelIf
 from vyos.template import is_ipv4
 from vyos.template import is_ipv6
+from vyos.util import cmd
 from vyos.util import dict_search
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
+def get_tunnel_encapsulation(interface):
+    """ Returns the used encapsulation protocol for given interface.
+        If interface does not exist, None is returned.
+    """
+    if not os.path.exists(f'/sys/class/net/{interface}'):
+        return None
+    from json import loads
+    tmp = loads(cmd(f'ip -d -j link show {interface}'))[0]
+    return tmp['linkinfo']['info_kind']
+
 def get_config(config=None):
     """
     Retrive CLI config as dictionary. Dictionary can never be empty, as at least
@@ -79,8 +83,8 @@ def verify(tunnel):
         return None
 
     if 'encapsulation' not in tunnel:
-        raise ConfigError('Must configure the tunnel encapsulation for '\
-                          '{ifname}!'.format(**tunnel))
+        error = 'Must configure encapsulation for "{ifname}"!'
+        raise ConfigError(error.format(**tunnel))
 
     verify_mtu_ipv6(tunnel)
     verify_address(tunnel)
@@ -103,29 +107,20 @@ def generate(tunnel):
     return None
 
 def apply(tunnel):
-    if 'deleted' in tunnel or 'encapsulation_changed' in tunnel:
-        if tunnel['ifname'] in interfaces():
-            tmp = Interface(tunnel['ifname'])
+    interface = tunnel['ifname']
+    # If a gretap tunnel is already existing we can not "simply" change local or
+    # remote addresses. This returns "Operation not supported" by the Kernel.
+    # There is no other solution to destroy and recreate the tunnel.
+    encap = get_tunnel_encapsulation(interface)
+
+    if 'deleted' in tunnel or 'encapsulation_changed' in tunnel or encap == 'gretap':
+        if interface in interfaces():
+            tmp = Interface(interface)
             tmp.remove()
         if 'deleted' in tunnel:
             return None
 
-    dispatch = {
-        'gre': GREIf,
-        'gre-bridge': GRETapIf,
-        'ipip': IPIPIf,
-        'ipip6': IPIP6If,
-        'ip6ip6': IP6IP6If,
-        'ip6gre': IP6GREIf,
-        'sit': SitIf,
-    }
-
-    # We need to re-map the tunnel encapsulation proto to a valid interface class
-    encap = tunnel['encapsulation']
-    klass = dispatch[encap]
-
-    tun = klass(**tunnel)
-    tun.change_options()
+    tun = TunnelIf(**tunnel)
     tun.update(tunnel)
 
     return None
diff --git a/src/migration-scripts/interfaces/19-to-20 b/src/migration-scripts/interfaces/19-to-20
new file mode 100755
index 000000000..be42cdd61
--- /dev/null
+++ b/src/migration-scripts/interfaces/19-to-20
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+if __name__ == '__main__':
+    if (len(argv) < 1):
+        print("Must specify file name!")
+        exit(1)
+
+    file_name = argv[1]
+    with open(file_name, 'r') as f:
+        config_file = f.read()
+
+    config = ConfigTree(config_file)
+    base = ['interfaces', 'tunnel']
+
+    if not config.exists(base):
+        # Nothing to do
+        exit(0)
+
+    #
+    # Migrate "interface tunnel <tunX> encapsulation gre-bridge" to gretap
+    for interface in config.list_nodes(base):
+        path = base + [interface, 'encapsulation']
+        if config.exists(path):
+            tmp = config.return_value(path)
+            if tmp == 'gre-bridge':
+                config.set(path, value='gretap')
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        exit(1)