Merge branch 'current' into current

14 files changed, 124 insertions, 96 deletions

diff --git a/data/op-mode-standardized.json b/data/op-mode-standardized.json
index 35587b63c..170f0d259 100644
--- a/data/op-mode-standardized.json
+++ b/data/op-mode-standardized.json
@@ -19,7 +19,6 @@
 "multicast.py",
 "nat.py",
 "neighbor.py",
-"nhrp.py",
 "openconnect.py",
 "openvpn.py",
 "otp.py",
diff --git a/data/templates/dhcp-server/10-override.conf.j2 b/data/templates/dhcp-server/10-override.conf.j2
deleted file mode 100644
index 6cf9e0a11..000000000
--- a/data/templates/dhcp-server/10-override.conf.j2
+++ /dev/null
@@ -1,2 +0,0 @@
-[Unit]
-ConditionFileNotEmpty=
diff --git a/data/templates/dns-dynamic/ddclient.conf.j2 b/data/templates/dns-dynamic/ddclient.conf.j2
index 23aad4cb8..b209c8c81 100644
--- a/data/templates/dns-dynamic/ddclient.conf.j2
+++ b/data/templates/dns-dynamic/ddclient.conf.j2
@@ -21,10 +21,7 @@ if{{ ipv }}={{ address }}, \
 {{ host }}
 {% endmacro %}
 ### Autogenerated by service_dns_dynamic.py ###
-daemon={{ interval }}
-syslog=yes
 ssl=yes
-cache={{ config_file | replace('.conf', '.cache') }}
 {# ddclient default (web=dyndns) doesn't support ssl and results in process lockup #}
 web=googledomains
 {# ddclient default (use=ip) results in confusing warning message in log #}
diff --git a/data/templates/dns-dynamic/override.conf.j2 b/data/templates/dns-dynamic/override.conf.j2
index c0edd8f05..aaed4ff35 100644
--- a/data/templates/dns-dynamic/override.conf.j2
+++ b/data/templates/dns-dynamic/override.conf.j2
@@ -1,4 +1,5 @@
 {% set vrf_command = 'ip vrf exec ' ~ vrf ~ ' ' if vrf is vyos_defined else '' %}
+{% set cache_file = config_file.replace('.conf', '.cache') %}
 [Unit]
 ConditionPathExists={{ config_file }}
 Wants=
@@ -7,5 +8,5 @@ After=vyos-router.service
 [Service]
 EnvironmentFile=
 ExecStart=
-ExecStart={{ vrf_command }}/usr/bin/ddclient --file {{ config_file }} --foreground
+ExecStart={{ vrf_command }}/usr/bin/ddclient --file {{ config_file }} --cache {{ cache_file }} --foreground --daemon {{ interval }}
 Restart=always
diff --git a/data/templates/frr/daemons.frr.tmpl b/data/templates/frr/daemons.frr.tmpl
index 3506528d2..835dc382b 100644
--- a/data/templates/frr/daemons.frr.tmpl
+++ b/data/templates/frr/daemons.frr.tmpl
@@ -30,7 +30,7 @@ isisd=yes
 pimd=no
 pim6d=yes
 ldpd=yes
-nhrpd=no
+nhrpd=yes
 eigrpd=no
 babeld=yes
 sharpd=no
diff --git a/data/templates/frr/nhrpd.frr.j2 b/data/templates/frr/nhrpd.frr.j2
new file mode 100644
index 000000000..2b2aba256
--- /dev/null
+++ b/data/templates/frr/nhrpd.frr.j2
@@ -0,0 +1,62 @@
+!
+{% if redirect is vyos_defined %}
+nhrp nflog-group {{ redirect }}
+{% endif %}
+{% if multicast is vyos_defined %}
+nhrp multicast-nflog-group {{ multicast }}
+{% endif %}
+{% if tunnel is vyos_defined %}
+{%     for iface, iface_config in tunnel.items() %}
+interface {{ iface }}
+{%         if iface_config.authentication is vyos_defined %}
+ ip nhrp authentication {{ iface_config.authentication }}
+{%         endif %}
+{%         if iface_config.holdtime is vyos_defined %}
+ ip nhrp holdtime {{ iface_config.holdtime }}
+{%         endif %}
+{%         if iface_config.map.tunnel_ip is vyos_defined %}
+{%             for tunip, tunip_config in iface_config.map.tunnel_ip.items() %}
+{%                 if tunip_config.nbma is vyos_defined %}
+ ip nhrp map {{ tunip }} {{ tunip_config.nbma }}
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%         if iface_config.mtu is vyos_defined %}
+ ip nhrp mtu {{ iface_config.mtu }}
+{%         endif %}
+{%         if iface_config.multicast is vyos_defined %}
+{%             for multicast_ip in iface_config.multicast %}
+ ip nhrp map multicast {{ multicast_ip }}
+{%             endfor %}
+{%         endif %}
+{%         if iface_config.nhs.tunnel_ip is vyos_defined %}
+{%             for tunip, tunip_config in iface_config.nhs.tunnel_ip.items() %}
+{%                 if tunip_config.nbma is vyos_defined %}
+{%                     for nbmaip in tunip_config.nbma %}
+ ip nhrp nhs {{ tunip }} nbma {{ nbmaip }}
+{%                     endfor %}
+{%                 endif %}
+{%             endfor %}
+{%         endif %}
+{%         if iface_config.network_id is vyos_defined %}
+ ip nhrp network-id {{ iface_config.network_id }}
+{%         endif %}
+{%         if iface_config.redirect is vyos_defined %}
+ ip nhrp redirect
+{%         endif %}
+{%         if iface_config.registration_no_unique is vyos_defined %}
+ ip nhrp registration no-unique
+{%         endif %}
+{%         if iface_config.shortcut is vyos_defined %}
+ ip nhrp shortcut
+{%         endif %}
+{%         if iface_config.security_profile is vyos_defined %}
+ tunnel protection vici profile dmvpn-{{ iface_config.security_profile }}-{{ iface }}-child
+{%         endif %}
+exit
+!
+{%     endfor %}
+{% endif %}
+!
+exit
+!
diff --git a/data/templates/frr/nhrpd_nftables.conf.j2 b/data/templates/frr/nhrpd_nftables.conf.j2
new file mode 100644
index 000000000..6ae35ef52
--- /dev/null
+++ b/data/templates/frr/nhrpd_nftables.conf.j2
@@ -0,0 +1,46 @@
+#!/usr/sbin/nft -f
+
+table ip vyos_nhrp_multicast
+table ip vyos_nhrp_redirect
+delete table ip vyos_nhrp_multicast
+delete table ip vyos_nhrp_redirect
+{% if multicast is vyos_defined %}
+table ip vyos_nhrp_multicast {
+    chain VYOS_NHRP_MULTICAST_OUTPUT {
+        type filter hook output priority filter+10; policy accept;
+{%     if tunnel is vyos_defined %}
+{%         for tun, tunnel_conf in tunnel.items() %}
+{%             if tunnel_conf.multicast is vyos_defined %}
+                oifname "{{ tun }}" ip daddr 224.0.0.0/24 counter log group {{ multicast }}
+                oifname "{{ tun }}" ip daddr 224.0.0.0/24 counter drop
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+    }
+    chain VYOS_NHRP_MULTICAST_FORWARD {
+        type filter hook forward priority filter+10; policy accept;
+{%     if tunnel is vyos_defined %}
+{%         for tun, tunnel_conf in tunnel.items() %}
+{%             if tunnel_conf.multicast is vyos_defined %}
+                oifname "{{ tun }}" ip daddr 224.0.0.0/4 counter log group {{ multicast }}
+                oifname "{{ tun }}" ip daddr 224.0.0.0/4 counter drop
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+    }
+}
+{% endif %}
+{% if redirect is vyos_defined %}
+table ip vyos_nhrp_redirect {
+    chain VYOS_NHRP_REDIRECT_FORWARD {
+        type filter hook forward priority filter+10; policy accept;
+{%     if tunnel is vyos_defined %}
+{%         for tun, tunnel_conf in tunnel.items() %}
+{%             if tunnel_conf.redirect is vyos_defined %}
+                iifname "{{ tun }}" oifname "{{ tun }}" meter loglimit-0 size 65535 { ip daddr & 255.255.255.0 . ip saddr & 255.255.255.0 timeout 1m limit rate 4/minute burst 1 packets } counter log group {{ redirect }}
+{%             endif %}
+{%         endfor %}
+{%     endif %}
+    }
+}
+{% endif %}
diff --git a/data/templates/ipsec/swanctl/profile.j2 b/data/templates/ipsec/swanctl/profile.j2
index 8519a84f8..6a04b038a 100644
--- a/data/templates/ipsec/swanctl/profile.j2
+++ b/data/templates/ipsec/swanctl/profile.j2
@@ -22,16 +22,16 @@
         }
 {%         endif %}
         children {
-            dmvpn {
+            dmvpn-{{ name }}-{{ interface }}-child {
                 esp_proposals = {{ esp | get_esp_ike_cipher(ike) | join(',') }}
                 rekey_time = {{ esp.lifetime }}s
                 rand_time = 540s
                 local_ts = dynamic[gre]
                 remote_ts = dynamic[gre]
                 mode = {{ esp.mode }}
-{%         if ike.dead_peer_detection.action is vyos_defined %}
-                dpd_action = {{ ike.dead_peer_detection.action }}
-{%         endif %}
+                dpd_action = clear
+                close_action = none
+                start_action = none
 {%         if esp.compression is vyos_defined('enable') %}
                 ipcomp = yes
 {%         endif %}
diff --git a/data/templates/login/pam_radius_auth.conf.j2 b/data/templates/login/pam_radius_auth.conf.j2
index 75437ca71..f9b8d5e87 100644
--- a/data/templates/login/pam_radius_auth.conf.j2
+++ b/data/templates/login/pam_radius_auth.conf.j2
@@ -9,7 +9,7 @@
 {%             if address | is_ipv4 %}
 {%                 set source_address.ipv4 = address %}
 {%             elif address | is_ipv6 %}
-{%                 set source_address.ipv6 = "[" + address + "]" %}
+{%                 set source_address.ipv6 = address %}
 {%             endif %}
 {%         endfor %}
 {%     endif %}
@@ -21,7 +21,7 @@
 {%             if server | is_ipv4 %}
 {{ server }}:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv4 if source_address.ipv4 is vyos_defined }}
 {%             else %}
-[{{ server }}]:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv6 if source_address.ipv6 is vyos_defined }}
+{{ server | bracketize_ipv6 }}:{{ options.port }} {{ "%-25s" | format(options.key) }} {{ "%-10s" | format(options.timeout) }} {{ source_address.ipv6 if source_address.ipv6 is vyos_defined }}
 {%             endif %}
 {%         endfor %}
 {%     endif %}
diff --git a/data/templates/nhrp/nftables.conf.j2 b/data/templates/nhrp/nftables.conf.j2
deleted file mode 100644
index a0d1f6d4c..000000000
--- a/data/templates/nhrp/nftables.conf.j2
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/sbin/nft -f
-
-{% if first_install is not vyos_defined %}
-delete table ip vyos_nhrp_filter
-{% endif %}
-table ip vyos_nhrp_filter {
-    chain VYOS_NHRP_OUTPUT {
-        type filter hook output priority 10; policy accept;
-{% if tunnel is vyos_defined %}
-{%     for tun, tunnel_conf in tunnel.items() %}
-{%         if if_tunnel[tun].source_address is vyos_defined %}
-        ip protocol gre ip saddr {{ if_tunnel[tun].source_address }} ip daddr 224.0.0.0/4 counter drop comment "VYOS_NHRP_{{ tun }}"
-{%         endif %}
-{%     endfor %}
-{% endif %}
-    }
-}
diff --git a/data/templates/nhrp/opennhrp.conf.j2 b/data/templates/nhrp/opennhrp.conf.j2
deleted file mode 100644
index c040a8f14..000000000
--- a/data/templates/nhrp/opennhrp.conf.j2
+++ /dev/null
@@ -1,42 +0,0 @@
-{# j2lint: disable=jinja-variable-format #}
-# Created by VyOS - manual changes will be overwritten
-
-{% if tunnel is vyos_defined %}
-{%     for name, tunnel_conf in tunnel.items() %}
-{%         set type = 'spoke' if tunnel_conf.map is vyos_defined or tunnel_conf.dynamic_map is vyos_defined else 'hub' %}
-{%         set profile_name = profile_map[name] if profile_map is vyos_defined and name in profile_map else '' %}
-interface {{ name }} #{{ type }} {{ profile_name }}
-{%         if tunnel_conf.map is vyos_defined %}
-{%             for map, map_conf in tunnel_conf.map.items() %}
-{%                 set cisco = ' cisco' if map_conf.cisco is vyos_defined else '' %}
-{%                 set register = ' register' if map_conf.register is vyos_defined else '' %}
-    map {{ map }} {{ map_conf.nbma_address }}{{ register }}{{ cisco }}
-{%             endfor %}
-{%         endif %}
-{%         if tunnel_conf.dynamic_map is vyos_defined %}
-{%             for map, map_conf in tunnel_conf.dynamic_map.items() %}
-    dynamic-map {{ map }} {{ map_conf.nbma_domain_name }}
-{%             endfor %}
-{%         endif %}
-{%         if tunnel_conf.cisco_authentication is vyos_defined %}
-    cisco-authentication {{ tunnel_conf.cisco_authentication }}
-{%         endif %}
-{%         if tunnel_conf.holding_time is vyos_defined %}
-    holding-time {{ tunnel_conf.holding_time }}
-{%         endif %}
-{%         if tunnel_conf.multicast is vyos_defined %}
-    multicast {{ tunnel_conf.multicast }}
-{%         endif %}
-{%         for key in ['non_caching', 'redirect', 'shortcut', 'shortcut_destination'] %}
-{%             if key in tunnel_conf %}
-    {{ key | replace("_", "-") }}
-{%             endif %}
-{%         endfor %}
-{%         if tunnel_conf.shortcut_target is vyos_defined %}
-{%             for target, shortcut_conf in tunnel_conf.shortcut_target.items() %}
-    shortcut-target {{ target }}{{ ' holding-time ' + shortcut_conf.holding_time if shortcut_conf.holding_time is vyos_defined }}
-{%             endfor %}
-{%         endif %}
-
-{%     endfor %}
-{% endif %}
diff --git a/data/templates/pmacct/uacctd.conf.j2 b/data/templates/pmacct/uacctd.conf.j2
index aae0a0619..d2de80df4 100644
--- a/data/templates/pmacct/uacctd.conf.j2
+++ b/data/templates/pmacct/uacctd.conf.j2
@@ -25,12 +25,6 @@ imt_mem_pools_number: 169
 {%         set _ = plugin.append('nfprobe['~ nf_server_key ~ ']') %}
 {%     endfor %}
 {% endif %}
-{% if sflow.server is vyos_defined %}
-{%     for server in sflow.server %}
-{%         set sf_server_key = 'sf_' ~ server | dot_colon_to_dash %}
-{%         set _ = plugin.append('sfprobe[' ~ sf_server_key ~ ']') %}
-{%     endfor %}
-{% endif %}
 {% if disable_imt is not defined %}
 {%     set _ = plugin.append('memory') %}
 {% endif %}
@@ -61,20 +55,3 @@ nfprobe_timeouts[{{ nf_server_key }}]: expint={{ netflow.timeout.expiry_interval
 
 {%     endfor %}
 {% endif %}
-
-{% if sflow.server is vyos_defined %}
-# sFlow servers
-{%     for server, server_config in sflow.server.items() %}
-{#         # prevent pmacct syntax error when using IPv6 flow collectors #}
-{%         set sf_server_key = 'sf_' ~ server | dot_colon_to_dash %}
-sfprobe_receiver[{{ sf_server_key }}]: {{ server | bracketize_ipv6 }}:{{ server_config.port }}
-sfprobe_agentip[{{ sf_server_key }}]: {{ sflow.agent_address }}
-{%         if sflow.sampling_rate is vyos_defined %}
-sampling_rate[{{ sf_server_key }}]: {{ sflow.sampling_rate }}
-{%         endif %}
-{%         if sflow.source_address is vyos_defined %}
-sfprobe_source_ip[{{ sf_server_key }}]: {{ sflow.source_address | bracketize_ipv6 }}
-{%         endif %}
-
-{%     endfor %}
-{% endif %}
diff --git a/data/templates/sflow/hsflowd.conf.j2 b/data/templates/sflow/hsflowd.conf.j2
index 5000956bd..6a1ba2956 100644
--- a/data/templates/sflow/hsflowd.conf.j2
+++ b/data/templates/sflow/hsflowd.conf.j2
@@ -25,6 +25,9 @@ sflow {
   pcap { dev={{ iface }} }
 {%     endfor %}
 {% endif %}
+{% if enable_egress is vyos_defined %}
+  psample { group=1 egress=on }
+{% endif %}
 {% if drop_monitor_limit is vyos_defined %}
   dropmon { limit={{ drop_monitor_limit }} start=on sw=on hw=off }
 {% endif %}
diff --git a/data/templates/telegraf/syslog_telegraf.j2 b/data/templates/telegraf/syslog_telegraf.j2
index cdcbd92a4..4fe6382ab 100644
--- a/data/templates/telegraf/syslog_telegraf.j2
+++ b/data/templates/telegraf/syslog_telegraf.j2
@@ -2,4 +2,8 @@
 
 $ModLoad omuxsock
 $OMUxSockSocket /run/telegraf/telegraf_syslog.sock
+{% if telegraf.loki is vyos_defined or telegraf.splunk is vyos_defined %}
+*.info;*.notice :omuxsock:
+{% else %}
 *.notice :omuxsock:
+{% endif %}