nat: T538: Move nat configs to /run directory

15 files changed, 188 insertions, 110 deletions

diff --git a/src/conf_mode/arp.py b/src/conf_mode/arp.py
index 1cd8f5451..7dc5206e0 100755
--- a/src/conf_mode/arp.py
+++ b/src/conf_mode/arp.py
@@ -61,7 +61,7 @@ def apply(arp):
                 continue
             for address, address_config in interface_config['address'].items():
                 mac = address_config['mac']
-                call(f'ip neigh add {address} lladdr {mac} dev {interface}')
+                call(f'ip neigh replace {address} lladdr {mac} dev {interface}')
 
 if __name__ == '__main__':
     try:
diff --git a/src/conf_mode/firewall.py b/src/conf_mode/firewall.py
index 07eca722f..f0ea1a1e5 100755
--- a/src/conf_mode/firewall.py
+++ b/src/conf_mode/firewall.py
@@ -206,9 +206,31 @@ def get_config(config=None):
     firewall = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True,
                                     no_tag_node_value_mangle=True)
 
+    # We have gathered the dict representation of the CLI, but there are
+    # default options which we need to update into the dictionary retrived.
+    # XXX: T2665: we currently have no nice way for defaults under tag
+    # nodes, thus we load the defaults "by hand"
     default_values = defaults(base)
+    for tmp in ['name', 'ipv6_name']:
+        if tmp in default_values:
+            del default_values[tmp]
+
     firewall = dict_merge(default_values, firewall)
 
+    # Merge in defaults for IPv4 ruleset
+    if 'name' in firewall:
+        default_values = defaults(base + ['name'])
+        for name in firewall['name']:
+            firewall['name'][name] = dict_merge(default_values,
+                                                firewall['name'][name])
+
+    # Merge in defaults for IPv6 ruleset
+    if 'ipv6_name' in firewall:
+        default_values = defaults(base + ['ipv6-name'])
+        for ipv6_name in firewall['ipv6_name']:
+            firewall['ipv6_name'][ipv6_name] = dict_merge(default_values,
+                                                          firewall['ipv6_name'][ipv6_name])
+
     firewall['policy_resync'] = bool('group' in firewall or node_changed(conf, base + ['group']))
     firewall['interfaces'] = get_firewall_interfaces(conf)
     firewall['zone_policy'] = get_firewall_zones(conf)
@@ -315,7 +337,7 @@ def verify_nested_group(group_name, group, groups, seen):
 
         if g in seen:
             raise ConfigError(f'Group "{group_name}" has a circular reference')
-            
+
         seen.append(g)
 
         if 'include' in groups[g]:
@@ -378,7 +400,7 @@ def cleanup_commands(firewall):
         if firewall['geoip_updated']:
             geoip_key = 'deleted_ipv6_name' if table == 'ip6 filter' else 'deleted_name'
             geoip_list = dict_search_args(firewall, 'geoip_updated', geoip_key) or []
- 
+
         json_str = cmd(f'nft -t -j list table {table}')
         obj = loads(json_str)
 
@@ -420,7 +442,7 @@ def cleanup_commands(firewall):
                 if set_name.startswith('GEOIP_CC_') and set_name in geoip_list:
                     commands_sets.append(f'delete set {table} {set_name}')
                     continue
-                
+
                 if set_name.startswith("RECENT_"):
                     commands_sets.append(f'delete set {table} {set_name}')
                     continue
@@ -520,7 +542,7 @@ def apply(firewall):
     if install_result == 1:
         raise ConfigError('Failed to apply firewall')
 
-    # set fireall group domain-group xxx
+    # set firewall group domain-group xxx
     if 'group' in firewall:
         if 'domain_group' in firewall['group']:
             # T970 Enable a resolver (systemd daemon) that checks
diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py
index 3057357fc..7cd7ea42e 100755
--- a/src/conf_mode/https.py
+++ b/src/conf_mode/https.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2021 VyOS maintainers and contributors
+# Copyright (C) 2019-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -29,6 +29,8 @@ from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
 from vyos.template import render
 from vyos.util import call
+from vyos.util import check_port_availability
+from vyos.util import is_listen_port_bind_service
 from vyos.util import write_file
 
 from vyos import airbag
@@ -107,6 +109,31 @@ def verify(https):
                 raise ConfigError("At least one 'virtual-host <id> server-name' "
                               "matching the 'certbot domain-name' is required.")
 
+    server_block_list = []
+
+    # organize by vhosts
+    vhost_dict = https.get('virtual-host', {})
+
+    if not vhost_dict:
+        # no specified virtual hosts (server blocks); use default
+        server_block_list.append(default_server_block)
+    else:
+        for vhost in list(vhost_dict):
+            server_block = deepcopy(default_server_block)
+            data = vhost_dict.get(vhost, {})
+            server_block['address'] = data.get('listen-address', '*')
+            server_block['port'] = data.get('listen-port', '443')
+            server_block_list.append(server_block)
+
+    for entry in server_block_list:
+        _address = entry.get('address')
+        _address = '0.0.0.0' if _address == '*' else _address
+        _port = entry.get('port')
+        proto = 'tcp'
+        if check_port_availability(_address, int(_port), proto) is not True and \
+                not is_listen_port_bind_service(int(_port), 'nginx'):
+            raise ConfigError(f'"{proto}" port "{_port}" is used by another service')
+
     verify_vrf(https)
     return None
 
diff --git a/src/conf_mode/interfaces-ethernet.py b/src/conf_mode/interfaces-ethernet.py
index 30e7a2af7..e02841831 100755
--- a/src/conf_mode/interfaces-ethernet.py
+++ b/src/conf_mode/interfaces-ethernet.py
@@ -153,11 +153,20 @@ def verify(ethernet):
     return None
 
 def generate(ethernet):
-    if 'eapol' in ethernet:
-        render(wpa_suppl_conf.format(**ethernet),
-               'ethernet/wpa_supplicant.conf.j2', ethernet)
+    # render real configuration file once
+    wpa_supplicant_conf = wpa_suppl_conf.format(**ethernet)
+
+    if 'deleted' in ethernet:
+        # delete configuration on interface removal
+        if os.path.isfile(wpa_supplicant_conf):
+            os.unlink(wpa_supplicant_conf)
+        return None
 
+    if 'eapol' in ethernet:
         ifname = ethernet['ifname']
+
+        render(wpa_supplicant_conf, 'ethernet/wpa_supplicant.conf.j2', ethernet)
+
         cert_file_path = os.path.join(cfg_dir, f'{ifname}_cert.pem')
         cert_key_path = os.path.join(cfg_dir, f'{ifname}_cert.key')
 
@@ -184,10 +193,6 @@ def generate(ethernet):
 
             write_file(ca_cert_file_path,
                        '\n'.join(encode_certificate(c) for c in ca_full_chain))
-    else:
-        # delete configuration on interface removal
-        if os.path.isfile(wpa_suppl_conf.format(**ethernet)):
-            os.unlink(wpa_suppl_conf.format(**ethernet))
 
     return None
 
@@ -203,9 +208,9 @@ def apply(ethernet):
     else:
         e.update(ethernet)
         if 'eapol' in ethernet:
-            eapol_action='restart'
+            eapol_action='reload-or-restart'
 
-    call(f'systemctl {eapol_action} wpa_supplicant-macsec@{ifname}')
+    call(f'systemctl {eapol_action} wpa_supplicant-wired@{ifname}')
 
 if __name__ == '__main__':
     try:
diff --git a/src/conf_mode/interfaces-macsec.py b/src/conf_mode/interfaces-macsec.py
index 870049a88..649ea8d50 100755
--- a/src/conf_mode/interfaces-macsec.py
+++ b/src/conf_mode/interfaces-macsec.py
@@ -67,7 +67,7 @@ def get_config(config=None):
         macsec.update({'shutdown_required': {}})
 
     if 'source_interface' in macsec:
-        tmp = is_source_interface(conf, macsec['source_interface'], 'macsec')
+        tmp = is_source_interface(conf, macsec['source_interface'], ['macsec', 'pseudo-ethernet'])
         if tmp and tmp != ifname: macsec.update({'is_source_interface' : tmp})
 
     return macsec
@@ -102,12 +102,6 @@ def verify(macsec):
             # gcm-aes-128 requires a 128bit long key - 64 characters (string) = 32byte = 256bit
             raise ConfigError('gcm-aes-128 requires a 256bit long key!')
 
-    if 'is_source_interface' in macsec:
-        tmp = macsec['is_source_interface']
-        src_ifname = macsec['source_interface']
-        raise ConfigError(f'Can not use source-interface "{src_ifname}", it already ' \
-                          f'belongs to interface "{tmp}"!')
-
     if 'source_interface' in macsec:
         # MACsec adds a 40 byte overhead (32 byte MACsec + 8 bytes VLAN 802.1ad
         # and 802.1q) - we need to check the underlaying MTU if our configured
diff --git a/src/conf_mode/interfaces-pseudo-ethernet.py b/src/conf_mode/interfaces-pseudo-ethernet.py
index f26a50a0e..20f2b1975 100755
--- a/src/conf_mode/interfaces-pseudo-ethernet.py
+++ b/src/conf_mode/interfaces-pseudo-ethernet.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2020 VyOS maintainers and contributors
+# Copyright (C) 2019-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -19,6 +19,7 @@ from sys import exit
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
 from vyos.configdict import is_node_changed
+from vyos.configdict import is_source_interface
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_address
 from vyos.configverify import verify_bridge_delete
@@ -51,6 +52,10 @@ def get_config(config=None):
     if 'source_interface' in peth:
         _, peth['parent'] = get_interface_dict(conf, ['interfaces', 'ethernet'],
                                                peth['source_interface'])
+        # test if source-interface is maybe already used by another interface
+        tmp = is_source_interface(conf, peth['source_interface'], ['macsec'])
+        if tmp and tmp != ifname: peth.update({'is_source_interface' : tmp})
+
     return peth
 
 def verify(peth):
diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py
index b76ea9f9e..e75418ba5 100755
--- a/src/conf_mode/nat.py
+++ b/src/conf_mode/nat.py
@@ -44,8 +44,8 @@ if LooseVersion(kernel_version()) > LooseVersion('5.1'):
 else:
     k_mod = ['nft_nat', 'nft_chain_nat_ipv4']
 
-nftables_nat_config = '/tmp/vyos-nat-rules.nft'
-nftables_static_nat_conf = '/tmp/vyos-static-nat-rules.nft'
+nftables_nat_config = '/run/nftables_nat.conf'
+nftables_static_nat_conf = '/run/nftables_static-nat-rules.nft'
 
 def get_handler(json, chain, target):
     """ Get nftable rule handler number of given chain/target combination.
@@ -199,8 +199,6 @@ def generate(nat):
     # dry-run newly generated configuration
     tmp = run(f'nft -c -f {nftables_nat_config}')
     if tmp > 0:
-        if os.path.exists(nftables_nat_config):
-            os.unlink(nftables_nat_config)
         raise ConfigError('Configuration file errors encountered!')
 
     tmp = run(f'nft -c -f {nftables_nat_config}')
@@ -210,8 +208,6 @@ def generate(nat):
 def apply(nat):
     cmd(f'nft -f {nftables_nat_config}')
     cmd(f'nft -f {nftables_static_nat_conf}')
-    if os.path.isfile(nftables_nat_config):
-        os.unlink(nftables_nat_config)
 
     return None
 
diff --git a/src/conf_mode/ntp.py b/src/conf_mode/ntp.py
index 5490a794d..0ecb4d736 100755
--- a/src/conf_mode/ntp.py
+++ b/src/conf_mode/ntp.py
@@ -17,6 +17,7 @@
 import os
 
 from vyos.config import Config
+from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_interface_exists
 from vyos.util import call
@@ -40,6 +41,10 @@ def get_config(config=None):
 
     ntp = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
     ntp['config_file'] = config_file
+
+    tmp = is_node_changed(conf, base + ['vrf'])
+    if tmp: ntp.update({'restart_required': {}})
+
     return ntp
 
 def verify(ntp):
@@ -78,19 +83,25 @@ def generate(ntp):
     return None
 
 def apply(ntp):
+    systemd_service = 'ntp.service'
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
+
     if not ntp:
         # NTP support is removed in the commit
-        call('systemctl stop ntp.service')
+        call(f'systemctl stop {systemd_service}')
         if os.path.exists(config_file):
             os.unlink(config_file)
         if os.path.isfile(systemd_override):
             os.unlink(systemd_override)
+        return
 
-    # Reload systemd manager configuration
-    call('systemctl daemon-reload')
-    if ntp:
-        call('systemctl restart ntp.service')
+    # we need to restart the service if e.g. the VRF name changed
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in ntp:
+        systemd_action = 'restart'
 
+    call(f'systemctl {systemd_action} {systemd_service}')
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/service_monitoring_telegraf.py b/src/conf_mode/service_monitoring_telegraf.py
index 62f5e1ddf..53df006a4 100755
--- a/src/conf_mode/service_monitoring_telegraf.py
+++ b/src/conf_mode/service_monitoring_telegraf.py
@@ -22,6 +22,8 @@ from shutil import rmtree
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
+from vyos.configdict import is_node_changed
+from vyos.configverify import verify_vrf
 from vyos.ifconfig import Section
 from vyos.template import render
 from vyos.util import call
@@ -32,39 +34,14 @@ from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-
-base_dir = '/run/telegraf'
 cache_dir = f'/etc/telegraf/.cache'
-config_telegraf = f'{base_dir}/vyos-telegraf.conf'
+config_telegraf = f'/run/telegraf/telegraf.conf'
 custom_scripts_dir = '/etc/telegraf/custom_scripts'
 syslog_telegraf = '/etc/rsyslog.d/50-telegraf.conf'
-systemd_telegraf_service = '/etc/systemd/system/vyos-telegraf.service'
-systemd_telegraf_override_dir = '/etc/systemd/system/vyos-telegraf.service.d'
-systemd_override = f'{systemd_telegraf_override_dir}/10-override.conf'
-
-
-def get_interfaces(type='', vlan=True):
-    """
-    Get interfaces
-    get_interfaces()
-    ['dum0', 'eth0', 'eth1', 'eth1.5', 'lo', 'tun0']
-
-    get_interfaces("dummy")
-    ['dum0']
-    """
-    interfaces = []
-    ifaces = Section.interfaces(type)
-    for iface in ifaces:
-        if vlan == False and '.' in iface:
-            continue
-        interfaces.append(iface)
-
-    return interfaces
+systemd_override = '/etc/systemd/system/telegraf.service.d/10-override.conf'
 
 def get_nft_filter_chains():
-    """
-    Get nft chains for table filter
-    """
+    """ Get nft chains for table filter """
     nft = cmd('nft --json list table ip filter')
     nft = json.loads(nft)
     chain_list = []
@@ -76,9 +53,7 @@ def get_nft_filter_chains():
 
     return chain_list
 
-
 def get_config(config=None):
-
     if config:
         conf = config
     else:
@@ -87,8 +62,12 @@ def get_config(config=None):
     if not conf.exists(base):
         return None
 
-    monitoring = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True,
-                                    no_tag_node_value_mangle=True)
+    monitoring = conf.get_config_dict(base, key_mangling=('-', '_'),
+                                      get_first_key=True,
+                                      no_tag_node_value_mangle=True)
+
+    tmp = is_node_changed(conf, base + ['vrf'])
+    if tmp: monitoring.update({'restart_required': {}})
 
     # We have gathered the dict representation of the CLI, but there are default
     # options which we need to update into the dictionary retrived.
@@ -96,7 +75,7 @@ def get_config(config=None):
     monitoring = dict_merge(default_values, monitoring)
 
     monitoring['custom_scripts_dir'] = custom_scripts_dir
-    monitoring['interfaces_ethernet'] = get_interfaces('ethernet', vlan=False)
+    monitoring['interfaces_ethernet'] = Section.interfaces('ethernet', vlan=False)
     monitoring['nft_chains'] = get_nft_filter_chains()
 
     # Redefine azure group-metrics 'single-table' and 'table-per-metric'
@@ -131,6 +110,8 @@ def verify(monitoring):
     if not monitoring:
         return None
 
+    verify_vrf(monitoring)
+
     # Verify influxdb
     if 'influxdb' in monitoring:
         if 'authentication' not in monitoring['influxdb'] or \
@@ -173,7 +154,7 @@ def verify(monitoring):
 def generate(monitoring):
     if not monitoring:
         # Delete config and systemd files
-        config_files = [config_telegraf, systemd_telegraf_service, systemd_override, syslog_telegraf]
+        config_files = [config_telegraf, systemd_override, syslog_telegraf]
         for file in config_files:
             if os.path.isfile(file):
                 os.unlink(file)
@@ -190,33 +171,34 @@ def generate(monitoring):
 
     chown(cache_dir, 'telegraf', 'telegraf')
 
-    # Create systemd override dir
-    if not os.path.exists(systemd_telegraf_override_dir):
-        os.mkdir(systemd_telegraf_override_dir)
-
     # Create custome scripts dir
     if not os.path.exists(custom_scripts_dir):
         os.mkdir(custom_scripts_dir)
 
     # Render telegraf configuration and systemd override
-    render(config_telegraf, 'monitoring/telegraf.j2', monitoring)
-    render(systemd_telegraf_service, 'monitoring/systemd_vyos_telegraf_service.j2', monitoring)
-    render(systemd_override, 'monitoring/override.conf.j2', monitoring, permission=0o640)
-    render(syslog_telegraf, 'monitoring/syslog_telegraf.j2', monitoring)
-
-    chown(base_dir, 'telegraf', 'telegraf')
+    render(config_telegraf, 'telegraf/telegraf.j2', monitoring, user='telegraf', group='telegraf')
+    render(systemd_override, 'telegraf/override.conf.j2', monitoring)
+    render(syslog_telegraf, 'telegraf/syslog_telegraf.j2', monitoring)
 
     return None
 
 def apply(monitoring):
     # Reload systemd manager configuration
+    systemd_service = 'telegraf.service'
     call('systemctl daemon-reload')
-    if monitoring:
-        call('systemctl restart vyos-telegraf.service')
-    else:
-        call('systemctl stop vyos-telegraf.service')
+    if not monitoring:
+        call(f'systemctl stop {systemd_service}')
+        return
+
+    # we need to restart the service if e.g. the VRF name changed
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in monitoring:
+        systemd_action = 'restart'
+
+    call(f'systemctl {systemd_action} {systemd_service}')
+
     # Telegraf include custom rsyslog config changes
-    call('systemctl restart rsyslog')
+    call('systemctl reload-or-restart rsyslog')
 
 if __name__ == '__main__':
     try:
diff --git a/src/conf_mode/service_upnp.py b/src/conf_mode/service_upnp.py
index 36f3e18a7..c798fd515 100755
--- a/src/conf_mode/service_upnp.py
+++ b/src/conf_mode/service_upnp.py
@@ -24,8 +24,6 @@ from ipaddress import IPv6Network
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
-from vyos.configdict import get_interface_dict
-from vyos.configverify import verify_vrf
 from vyos.util import call
 from vyos.template import render
 from vyos.template import is_ipv4
@@ -113,19 +111,28 @@ def verify(upnpd):
     listen_dev = []
     system_addrs_cidr = get_all_interface_addr(True, [], [netifaces.AF_INET, netifaces.AF_INET6])
     system_addrs = get_all_interface_addr(False, [], [netifaces.AF_INET, netifaces.AF_INET6])
+    if 'listen' not in upnpd:
+        raise ConfigError(f'Listen address or interface is required!')
     for listen_if_or_addr in upnpd['listen']:
         if listen_if_or_addr not in netifaces.interfaces():
             listen_dev.append(listen_if_or_addr)
-        if (listen_if_or_addr not in system_addrs) and (listen_if_or_addr not in system_addrs_cidr) and (listen_if_or_addr not in netifaces.interfaces()):
+        if (listen_if_or_addr not in system_addrs) and (listen_if_or_addr not in system_addrs_cidr) and \
+                (listen_if_or_addr not in netifaces.interfaces()):
             if is_ipv4(listen_if_or_addr) and IPv4Network(listen_if_or_addr).is_multicast:
-                raise ConfigError(f'The address "{listen_if_or_addr}" is an address that is not allowed to listen on. It is not an interface address nor a multicast address!')
+                raise ConfigError(f'The address "{listen_if_or_addr}" is an address that is not allowed'
+                                  f'to listen on. It is not an interface address nor a multicast address!')
             if is_ipv6(listen_if_or_addr) and IPv6Network(listen_if_or_addr).is_multicast:
-                raise ConfigError(f'The address "{listen_if_or_addr}" is an address that is not allowed to listen on. It is not an interface address nor a multicast address!')
+                raise ConfigError(f'The address "{listen_if_or_addr}" is an address that is not allowed'
+                                  f'to listen on. It is not an interface address nor a multicast address!')
 
     system_listening_dev_addrs_cidr = get_all_interface_addr(True, listen_dev, [netifaces.AF_INET6])
     system_listening_dev_addrs = get_all_interface_addr(False, listen_dev, [netifaces.AF_INET6])
     for listen_if_or_addr in upnpd['listen']:
-        if listen_if_or_addr not in netifaces.interfaces() and (listen_if_or_addr not in system_listening_dev_addrs_cidr) and (listen_if_or_addr not in system_listening_dev_addrs) and is_ipv6(listen_if_or_addr) and (not IPv6Network(listen_if_or_addr).is_multicast):
+        if listen_if_or_addr not in netifaces.interfaces() and \
+                (listen_if_or_addr not in system_listening_dev_addrs_cidr) and \
+                (listen_if_or_addr not in system_listening_dev_addrs) and \
+                is_ipv6(listen_if_or_addr) and \
+                (not IPv6Network(listen_if_or_addr).is_multicast):
             raise ConfigError(f'{listen_if_or_addr} must listen on the interface of the network card')
 
 def generate(upnpd):
diff --git a/src/conf_mode/ssh.py b/src/conf_mode/ssh.py
index 28669694b..2bbd7142a 100755
--- a/src/conf_mode/ssh.py
+++ b/src/conf_mode/ssh.py
@@ -22,6 +22,7 @@ from syslog import LOG_INFO
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
+from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
 from vyos.util import call
 from vyos.template import render
@@ -50,6 +51,10 @@ def get_config(config=None):
         return None
 
     ssh = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+
+    tmp = is_node_changed(conf, base + ['vrf'])
+    if tmp: ssh.update({'restart_required': {}})
+
     # We have gathered the dict representation of the CLI, but there are default
     # options which we need to update into the dictionary retrived.
     default_values = defaults(base)
@@ -104,17 +109,25 @@ def generate(ssh):
     return None
 
 def apply(ssh):
+    systemd_service_ssh = 'ssh.service'
+    systemd_service_sshguard = 'sshguard.service'
     if not ssh:
         # SSH access is removed in the commit
-        call('systemctl stop ssh.service')
-        call('systemctl stop sshguard.service')
+        call(f'systemctl stop {systemd_service_ssh}')
+        call(f'systemctl stop {systemd_service_sshguard}')
         return None
+
     if 'dynamic_protection' not in ssh:
-        call('systemctl stop sshguard.service')
+        call(f'systemctl stop {systemd_service_sshguard}')
     else:
-        call('systemctl restart sshguard.service')
+        call(f'systemctl reload-or-restart {systemd_service_sshguard}')
+
+    # we need to restart the service if e.g. the VRF name changed
+    systemd_action = 'reload-or-restart'
+    if 'restart_required' in ssh:
+        systemd_action = 'restart'
 
-    call('systemctl restart ssh.service')
+    call(f'systemctl {systemd_action} {systemd_service_ssh}')
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/system_console.py b/src/conf_mode/system_console.py
index 86985d765..e922edc4e 100755
--- a/src/conf_mode/system_console.py
+++ b/src/conf_mode/system_console.py
@@ -16,6 +16,7 @@
 
 import os
 import re
+from pathlib import Path
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
@@ -68,18 +69,15 @@ def verify(console):
             # amount of connected devices. We will resolve the fixed device name
             # to its dynamic device file - and create a new dict entry for it.
             by_bus_device = f'{by_bus_dir}/{device}'
-            if os.path.isdir(by_bus_dir) and os.path.exists(by_bus_device):
-                device = os.path.basename(os.readlink(by_bus_device))
-
-        # If the device name still starts with usbXXX no matching tty was found
-        # and it can not be used as a serial interface
-        if device.startswith('usb'):
-            raise ConfigError(f'Device {device} does not support beeing used as tty')
+            # If the device name still starts with usbXXX no matching tty was found
+            # and it can not be used as a serial interface
+            if not os.path.isdir(by_bus_dir) or not os.path.exists(by_bus_device):
+                raise ConfigError(f'Device {device} does not support beeing used as tty')
 
     return None
 
 def generate(console):
-    base_dir = '/etc/systemd/system'
+    base_dir = '/run/systemd/system'
     # Remove all serial-getty configuration files in advance
     for root, dirs, files in os.walk(base_dir):
         for basename in files:
@@ -90,7 +88,8 @@ def generate(console):
     if not console or 'device' not in console:
         return None
 
-    for device, device_config in console['device'].items():
+    # replace keys in the config for ttyUSB items to use them in `apply()` later
+    for device in console['device'].copy():
         if device.startswith('usb'):
             # It is much easiert to work with the native ttyUSBn name when using
             # getty, but that name may change across reboots - depending on the
@@ -98,9 +97,17 @@ def generate(console):
             # to its dynamic device file - and create a new dict entry for it.
             by_bus_device = f'{by_bus_dir}/{device}'
             if os.path.isdir(by_bus_dir) and os.path.exists(by_bus_device):
-                device = os.path.basename(os.readlink(by_bus_device))
+                device_updated = os.path.basename(os.readlink(by_bus_device))
+
+                # replace keys in the config to use them in `apply()` later
+                console['device'][device_updated] = console['device'][device]
+                del console['device'][device]
+            else:
+                raise ConfigError(f'Device {device} does not support beeing used as tty')
 
+    for device, device_config in console['device'].items():
         config_file = base_dir + f'/serial-getty@{device}.service'
+        Path(f'{base_dir}/getty.target.wants').mkdir(exist_ok=True)
         getty_wants_symlink = base_dir + f'/getty.target.wants/serial-getty@{device}.service'
 
         render(config_file, 'getty/serial-getty.service.j2', device_config)
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index bad9cfbd8..5ca32d23e 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -595,13 +595,11 @@ def wait_for_vici_socket(timeout=5, sleep_interval=0.1):
         sleep(sleep_interval)
 
 def apply(ipsec):
+    systemd_service = 'strongswan-starter.service'
     if not ipsec:
-        call('sudo ipsec stop')
+        call(f'systemctl stop {systemd_service}')
     else:
-        call('sudo ipsec restart')
-        call('sudo ipsec rereadall')
-        call('sudo ipsec reload')
-
+        call(f'systemctl reload-or-restart {systemd_service}')
         if wait_for_vici_socket():
             call('sudo swanctl -q')
 
diff --git a/src/conf_mode/vpn_openconnect.py b/src/conf_mode/vpn_openconnect.py
index a3e774678..240546817 100755
--- a/src/conf_mode/vpn_openconnect.py
+++ b/src/conf_mode/vpn_openconnect.py
@@ -25,6 +25,7 @@ from vyos.template import render
 from vyos.util import call
 from vyos.util import check_port_availability
 from vyos.util import is_systemd_service_running
+from vyos.util import is_listen_port_bind_service
 from vyos.util import dict_search
 from vyos.xml import defaults
 from vyos import ConfigError
@@ -77,8 +78,10 @@ def verify(ocserv):
     if ocserv is None:
         return None
     # Check if listen-ports not binded other services
+    # It can be only listen by 'ocserv-main'
     for proto, port in ocserv.get('listen_ports').items():
-        if check_port_availability('0.0.0.0', int(port), proto) is not True:
+        if check_port_availability('0.0.0.0', int(port), proto) is not True and \
+                not is_listen_port_bind_service(int(port), 'ocserv-main'):
             raise ConfigError(f'"{proto}" port "{port}" is used by another service')
     # Check authentication
     if "authentication" in ocserv:
diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py
index 23e5162ba..2949ab290 100755
--- a/src/conf_mode/vpn_sstp.py
+++ b/src/conf_mode/vpn_sstp.py
@@ -26,7 +26,9 @@ from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
 from vyos.template import render
 from vyos.util import call
+from vyos.util import check_port_availability
 from vyos.util import dict_search
+from vyos.util import is_listen_port_bind_service
 from vyos.util import write_file
 from vyos import ConfigError
 from vyos import airbag
@@ -62,6 +64,12 @@ def verify(sstp):
     if not sstp:
         return None
 
+    port = sstp.get('port')
+    proto = 'tcp'
+    if check_port_availability('0.0.0.0', int(port), proto) is not True and \
+            not is_listen_port_bind_service(int(port), 'accel-pppd'):
+        raise ConfigError(f'"{proto}" port "{port}" is used by another service')
+
     verify_accel_ppp_base_service(sstp)
 
     if 'client_ip_pool' not in sstp and 'client_ipv6_pool' not in sstp: