Merge branch 'vyos:current' into current

15 files changed, 353 insertions, 55 deletions

diff --git a/src/services/api/graphql/README.graphql b/src/services/api/graphql/README.graphql
index a3c30b005..1133d79ed 100644
--- a/src/services/api/graphql/README.graphql
+++ b/src/services/api/graphql/README.graphql
@@ -1,7 +1,12 @@
 
+The following examples are in the form as entered in the GraphQL
+'playground', which is found at:
+
+https://{{ host_address }}/graphql
+
 Example using GraphQL mutations to configure a DHCP server:
 
-This assumes that the http-api is running:
+All examples assume that the http-api is running:
 
 'set service https api'
 
@@ -58,8 +63,8 @@ N.B. fileName can be empty (fileName: "") or data can be empty (data: {}) to
 save to /config/config.boot; to save to an alternative path, specify
 fileName.
 
-Similarly, using the same 'endpoint' (meaning the form of the request and
-resolver; the actual enpoint for all GraphQL requests is
+Similarly, using an analogous 'endpoint' (meaning the form of the request
+and resolver; the actual enpoint for all GraphQL requests is
 https://hostname/graphql), one can load an arbitrary config file from a
 path.
 
@@ -75,7 +80,7 @@ mutation {
 
 Op-mode 'show' commands may be requested by path, e.g.:
 
-mutation {
+query {
   Show (data: {path: ["interfaces", "ethernet", "detail"]}) {
     success
     errors
@@ -88,16 +93,58 @@ mutation {
 N.B. to see the output the 'data' field 'result' must be present in the
 request.
 
-The GraphQL playground will be found at:
+Mutations to manipulate firewall address groups:
 
-https://{{ host_address }}/graphql
+mutation {
+  CreateFirewallAddressGroup (data: {name: "ADDR-GRP", address: "10.0.0.1"}) {
+    success
+    errors
+  }
+}
+
+mutation {
+  UpdateFirewallAddressGroupMembers (data: {name: "ADDR-GRP",
+                                            address: ["10.0.0.1-10.0.0.8", "192.168.0.1"]}) {
+    success
+    errors
+  }
+}
+
+mutation {
+  RemoveFirewallAddressGroupMembers (data: {name: "ADDR-GRP",
+                                            address: "192.168.0.1"}) {
+    success
+    errors
+  }
+}
+
+N.B. The schema for the above specify that 'address' be of the form 'list of
+strings' (SDL type [String!]! for UpdateFirewallAddressGroupMembers, where
+the ! indicates that the input is required; SDL type [String] in
+CreateFirewallAddressGroup, since a group may be created without any
+addresses). However, notice that a single string may be passed without being
+a member of a list, in which case the specification allows for 'input
+coercion':
+
+http://spec.graphql.org/October2021/#sec-Scalars.Input-Coercion
+
+Similarly, IPv6 versions of the above:
 
-An equivalent curl command to the first example above would be:
+CreateFirewallAddressIpv6Group
+UpdateFirewallAddressIpv6GroupMembers
+RemoveFirewallAddressIpv6GroupMembers
+
+
+Instead of using the GraphQL playground, an equivalent curl command to the
+first example above would be:
 
 curl -k 'https://192.168.100.168/graphql' -H 'Content-Type: application/json' --data-binary '{"query": "mutation {createInterfaceEthernet (data: {interface: \"eth1\", address: \"192.168.0.1/24\", description: \"BOB\"}) {success errors data {address}}}"}'
 
 Note that the 'mutation' term is prefaced by 'query' in the curl command.
 
+Curl equivalents may be read from within the GraphQL playground at the 'copy
+curl' button.
+
 What's here:
 
 services
diff --git a/src/services/api/graphql/bindings.py b/src/services/api/graphql/bindings.py
index 1fbe13d0c..84d719fda 100644
--- a/src/services/api/graphql/bindings.py
+++ b/src/services/api/graphql/bindings.py
@@ -1,4 +1,20 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
 import vyos.defaults
+from . graphql.queries import query
 from . graphql.mutations import mutation
 from . graphql.directives import directives_dict
 from ariadne import make_executable_schema, load_schema_from_path, snake_case_fallback_resolvers
@@ -8,6 +24,6 @@ def generate_schema():
 
     type_defs = load_schema_from_path(api_schema_dir)
 
-    schema = make_executable_schema(type_defs, mutation, snake_case_fallback_resolvers, directives=directives_dict)
+    schema = make_executable_schema(type_defs, query, mutation, snake_case_fallback_resolvers, directives=directives_dict)
 
     return schema
diff --git a/src/services/api/graphql/graphql/directives.py b/src/services/api/graphql/graphql/directives.py
index 10bc522db..0a9298f55 100644
--- a/src/services/api/graphql/graphql/directives.py
+++ b/src/services/api/graphql/graphql/directives.py
@@ -1,4 +1,20 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
 from ariadne import SchemaDirectiveVisitor, ObjectType
+from . queries import *
 from . mutations import *
 
 def non(arg):
diff --git a/src/services/api/graphql/graphql/mutations.py b/src/services/api/graphql/graphql/mutations.py
index 8e5aab56d..0c3eb702a 100644
--- a/src/services/api/graphql/graphql/mutations.py
+++ b/src/services/api/graphql/graphql/mutations.py
@@ -1,3 +1,17 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from importlib import import_module
 from typing import Any, Dict
@@ -10,7 +24,7 @@ from api.graphql.recipes.session import Session
 
 mutation = ObjectType("Mutation")
 
-def make_resolver(mutation_name, class_name, session_func):
+def make_mutation_resolver(mutation_name, class_name, session_func):
     """Dynamically generate a resolver for the mutation named in the
     schema by 'mutation_name'.
 
@@ -66,34 +80,20 @@ def make_resolver(mutation_name, class_name, session_func):
 
     return func_impl
 
-def make_configure_resolver(mutation_name):
-    class_name = mutation_name
-    return make_resolver(mutation_name, class_name, 'configure')
+def make_prefix_resolver(mutation_name, prefix=[]):
+    for pre in prefix:
+        Pre = pre.capitalize()
+        if Pre in mutation_name:
+            class_name = mutation_name.replace(Pre, '', 1)
+            return make_mutation_resolver(mutation_name, class_name, pre)
+    raise Exception
 
-def make_show_config_resolver(mutation_name):
+def make_configure_resolver(mutation_name):
     class_name = mutation_name
-    return make_resolver(mutation_name, class_name, 'show_config')
+    return make_mutation_resolver(mutation_name, class_name, 'configure')
 
 def make_config_file_resolver(mutation_name):
-    if 'Save' in mutation_name:
-        class_name = mutation_name.replace('Save', '', 1)
-        return make_resolver(mutation_name, class_name, 'save')
-    elif 'Load' in mutation_name:
-        class_name = mutation_name.replace('Load', '', 1)
-        return make_resolver(mutation_name, class_name, 'load')
-    else:
-        raise Exception
-
-def make_show_resolver(mutation_name):
-    class_name = mutation_name
-    return make_resolver(mutation_name, class_name, 'show')
+    return make_prefix_resolver(mutation_name, prefix=['save', 'load'])
 
 def make_image_resolver(mutation_name):
-    if 'Add' in mutation_name:
-        class_name = mutation_name.replace('Add', '', 1)
-        return make_resolver(mutation_name, class_name, 'add')
-    elif 'Delete' in mutation_name:
-        class_name = mutation_name.replace('Delete', '', 1)
-        return make_resolver(mutation_name, class_name, 'delete')
-    else:
-        raise Exception
+    return make_prefix_resolver(mutation_name, prefix=['add', 'delete'])
diff --git a/src/services/api/graphql/graphql/queries.py b/src/services/api/graphql/graphql/queries.py
new file mode 100644
index 000000000..e1868091e
--- /dev/null
+++ b/src/services/api/graphql/graphql/queries.py
@@ -0,0 +1,89 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+from importlib import import_module
+from typing import Any, Dict
+from ariadne import ObjectType, convert_kwargs_to_snake_case, convert_camel_case_to_snake
+from graphql import GraphQLResolveInfo
+from makefun import with_signature
+
+from .. import state
+from api.graphql.recipes.session import Session
+
+query = ObjectType("Query")
+
+def make_query_resolver(query_name, class_name, session_func):
+    """Dynamically generate a resolver for the query named in the
+    schema by 'query_name'.
+
+    Dynamic generation is provided using the package 'makefun' (via the
+    decorator 'with_signature'), which provides signature-preserving
+    function wrappers; it provides several improvements over, say,
+    functools.wraps.
+
+    :raise Exception:
+        raising ConfigErrors, or internal errors
+    """
+
+    func_base_name = convert_camel_case_to_snake(class_name)
+    resolver_name = f'resolve_{func_base_name}'
+    func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Dict)'
+
+    @query.field(query_name)
+    @convert_kwargs_to_snake_case
+    @with_signature(func_sig, func_name=resolver_name)
+    async def func_impl(*args, **kwargs):
+        try:
+            if 'data' not in kwargs:
+                return {
+                    "success": False,
+                    "errors": ['missing data']
+                }
+
+            data = kwargs['data']
+            session = state.settings['app'].state.vyos_session
+
+            # one may override the session functions with a local subclass
+            try:
+                mod = import_module(f'api.graphql.recipes.{func_base_name}')
+                klass = getattr(mod, class_name)
+            except ImportError:
+                # otherwise, dynamically generate subclass to invoke subclass
+                # name based templates
+                klass = type(class_name, (Session,), {})
+            k = klass(session, data)
+            method = getattr(k, session_func)
+            result = method()
+            data['result'] = result
+
+            return {
+                "success": True,
+                "data": data
+            }
+        except Exception as error:
+            return {
+                "success": False,
+                "errors": [str(error)]
+            }
+
+    return func_impl
+
+def make_show_config_resolver(query_name):
+    class_name = query_name
+    return make_query_resolver(query_name, class_name, 'show_config')
+
+def make_show_resolver(query_name):
+    class_name = query_name
+    return make_query_resolver(query_name, class_name, 'show')
diff --git a/src/services/api/graphql/graphql/schema/firewall_group.graphql b/src/services/api/graphql/graphql/schema/firewall_group.graphql
index efe7de632..d89904b9e 100644
--- a/src/services/api/graphql/graphql/schema/firewall_group.graphql
+++ b/src/services/api/graphql/graphql/schema/firewall_group.graphql
@@ -45,3 +45,51 @@ type RemoveFirewallAddressGroupMembersResult {
     success: Boolean!
     errors: [String]
 }
+
+input CreateFirewallAddressIpv6GroupInput {
+    name: String!
+    address: [String]
+}
+
+type CreateFirewallAddressIpv6Group {
+    name: String!
+    address: [String]
+}
+
+type CreateFirewallAddressIpv6GroupResult {
+    data: CreateFirewallAddressIpv6Group
+    success: Boolean!
+    errors: [String]
+}
+
+input UpdateFirewallAddressIpv6GroupMembersInput {
+    name: String!
+    address: [String!]!
+}
+
+type UpdateFirewallAddressIpv6GroupMembers {
+    name: String!
+    address: [String!]!
+}
+
+type UpdateFirewallAddressIpv6GroupMembersResult {
+    data: UpdateFirewallAddressIpv6GroupMembers
+    success: Boolean!
+    errors: [String]
+}
+
+input RemoveFirewallAddressIpv6GroupMembersInput {
+    name: String!
+    address: [String!]!
+}
+
+type RemoveFirewallAddressIpv6GroupMembers {
+    name: String!
+    address: [String!]!
+}
+
+type RemoveFirewallAddressIpv6GroupMembersResult {
+    data: RemoveFirewallAddressIpv6GroupMembers
+    success: Boolean!
+    errors: [String]
+}
diff --git a/src/services/api/graphql/graphql/schema/schema.graphql b/src/services/api/graphql/graphql/schema/schema.graphql
index c6899bee6..952e46f34 100644
--- a/src/services/api/graphql/graphql/schema/schema.graphql
+++ b/src/services/api/graphql/graphql/schema/schema.graphql
@@ -3,26 +3,28 @@ schema {
     mutation: Mutation
 }
 
-type Query {
-    _dummy: String
-}
-
 directive @configure on FIELD_DEFINITION
 directive @configfile on FIELD_DEFINITION
 directive @show on FIELD_DEFINITION
 directive @showconfig on FIELD_DEFINITION
 directive @image on FIELD_DEFINITION
 
+type Query {
+    Show(data: ShowInput) : ShowResult @show
+    ShowConfig(data: ShowConfigInput) : ShowConfigResult @showconfig
+}
+
 type Mutation {
     CreateDhcpServer(data: DhcpServerConfigInput) : CreateDhcpServerResult @configure
     CreateInterfaceEthernet(data: InterfaceEthernetConfigInput) : CreateInterfaceEthernetResult @configure
     CreateFirewallAddressGroup(data: CreateFirewallAddressGroupInput) : CreateFirewallAddressGroupResult @configure
     UpdateFirewallAddressGroupMembers(data: UpdateFirewallAddressGroupMembersInput) : UpdateFirewallAddressGroupMembersResult @configure
     RemoveFirewallAddressGroupMembers(data: RemoveFirewallAddressGroupMembersInput) : RemoveFirewallAddressGroupMembersResult @configure
+    CreateFirewallAddressIpv6Group(data: CreateFirewallAddressIpv6GroupInput) : CreateFirewallAddressIpv6GroupResult @configure
+    UpdateFirewallAddressIpv6GroupMembers(data: UpdateFirewallAddressIpv6GroupMembersInput) : UpdateFirewallAddressIpv6GroupMembersResult @configure
+    RemoveFirewallAddressIpv6GroupMembers(data: RemoveFirewallAddressIpv6GroupMembersInput) : RemoveFirewallAddressIpv6GroupMembersResult @configure
     SaveConfigFile(data: SaveConfigFileInput) : SaveConfigFileResult @configfile
     LoadConfigFile(data: LoadConfigFileInput) : LoadConfigFileResult @configfile
-    Show(data: ShowInput) : ShowResult @show
-    ShowConfig(data: ShowConfigInput) : ShowConfigResult @showconfig
     AddSystemImage(data: AddSystemImageInput) : AddSystemImageResult @image
     DeleteSystemImage(data: DeleteSystemImageInput) : DeleteSystemImageResult @image
 }
diff --git a/src/services/api/graphql/recipes/remove_firewall_address_group_members.py b/src/services/api/graphql/recipes/remove_firewall_address_group_members.py
index cde30c27a..b91932e14 100644
--- a/src/services/api/graphql/recipes/remove_firewall_address_group_members.py
+++ b/src/services/api/graphql/recipes/remove_firewall_address_group_members.py
@@ -1,3 +1,17 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from . session import Session
 
diff --git a/src/services/api/graphql/recipes/session.py b/src/services/api/graphql/recipes/session.py
index 5ece78ee6..1f844ff70 100644
--- a/src/services/api/graphql/recipes/session.py
+++ b/src/services/api/graphql/recipes/session.py
@@ -1,3 +1,18 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
 import json
 
 from ariadne import convert_camel_case_to_snake
diff --git a/src/services/api/graphql/recipes/templates/create_firewall_address_ipv_6_group.tmpl b/src/services/api/graphql/recipes/templates/create_firewall_address_ipv_6_group.tmpl
new file mode 100644
index 000000000..e9b660722
--- /dev/null
+++ b/src/services/api/graphql/recipes/templates/create_firewall_address_ipv_6_group.tmpl
@@ -0,0 +1,4 @@
+set firewall group ipv6-address-group {{ name }}
+{% for add in address %}
+set firewall group ipv6-address-group {{ name }} address {{ add }}
+{% endfor %}
diff --git a/src/services/api/graphql/recipes/templates/remove_firewall_address_ipv_6_group_members.tmpl b/src/services/api/graphql/recipes/templates/remove_firewall_address_ipv_6_group_members.tmpl
new file mode 100644
index 000000000..0efa0b226
--- /dev/null
+++ b/src/services/api/graphql/recipes/templates/remove_firewall_address_ipv_6_group_members.tmpl
@@ -0,0 +1,3 @@
+{% for add in address %}
+delete firewall group ipv6-address-group {{ name }} address {{ add }}
+{% endfor %}
diff --git a/src/services/api/graphql/recipes/templates/update_firewall_address_ipv_6_group_members.tmpl b/src/services/api/graphql/recipes/templates/update_firewall_address_ipv_6_group_members.tmpl
new file mode 100644
index 000000000..f98a5517c
--- /dev/null
+++ b/src/services/api/graphql/recipes/templates/update_firewall_address_ipv_6_group_members.tmpl
@@ -0,0 +1,3 @@
+{% for add in address %}
+set firewall group ipv6-address-group {{ name }} address {{ add }}
+{% endfor %}
diff --git a/src/services/vyos-configd b/src/services/vyos-configd
index 670b6e66a..48c9135e2 100755
--- a/src/services/vyos-configd
+++ b/src/services/vyos-configd
@@ -28,6 +28,7 @@ import zmq
 from contextlib import contextmanager
 
 from vyos.defaults import directories
+from vyos.util import boot_configuration_complete
 from vyos.configsource import ConfigSourceString, ConfigSourceError
 from vyos.config import Config
 from vyos import ConfigError
@@ -186,7 +187,7 @@ def initialization(socket):
         session_out = None
 
     # if not a 'live' session, for example on boot, write to file
-    if not session_out or not os.path.isfile('/tmp/vyos-config-status'):
+    if not session_out or not boot_configuration_complete():
         session_out = script_stdout_log
         session_mode = 'a'
 
diff --git a/src/services/vyos-hostsd b/src/services/vyos-hostsd
index f4b1d0fc2..df9f18d2d 100755
--- a/src/services/vyos-hostsd
+++ b/src/services/vyos-hostsd
@@ -139,6 +139,27 @@
 # }
 #
 #
+### authoritative_zones
+## Additional zones hosted authoritatively by pdns-recursor.
+## We add NTAs for these zones but do not do much else here.
+#
+# { 'type': 'authoritative_zones',
+#   'op': 'add',
+#   'data': ['<str zone>', ...]
+# }
+#
+# { 'type': 'authoritative_zones',
+#   'op': 'delete',
+#   'data': ['<str zone>', ...]
+# }
+#
+# { 'type': 'authoritative_zones',
+#   'op': 'get',
+# }
+# response:
+# { 'data': ['<str zone>', ...] }
+#
+#
 ### search_domains
 #
 # { 'type': 'search_domains',
@@ -255,6 +276,7 @@ STATE = {
     "name_server_tags_recursor": [],
     "name_server_tags_system": [],
     "forward_zones": {},
+    "authoritative_zones": [],
     "hosts": {},
     "host_name": "vyos",
     "domain_name": "",
@@ -267,7 +289,8 @@ base_schema = Schema({
     Required('op'): Any('add', 'delete', 'set', 'get', 'apply'),
     'type': Any('name_servers',
         'name_server_tags_recursor', 'name_server_tags_system',
-        'forward_zones', 'search_domains', 'hosts', 'host_name'),
+        'forward_zones', 'authoritative_zones', 'search_domains',
+        'hosts', 'host_name'),
     'data': Any(list, dict),
     'tag': str,
     'tag_regex': str
@@ -347,6 +370,11 @@ msg_schema_map = {
         'delete': data_list_schema,
         'get': op_type_schema
         },
+    'authoritative_zones': {
+        'add': data_list_schema,
+        'delete': data_list_schema,
+        'get': op_type_schema
+        },
     'search_domains': {
         'add': data_dict_list_schema,
         'delete': data_list_schema,
@@ -522,7 +550,7 @@ def handle_message(msg):
         data = get_option(msg, 'data')
         if _type in ['name_servers', 'forward_zones', 'search_domains', 'hosts']:
             delete_items_from_dict(STATE[_type], data)
-        elif _type in ['name_server_tags_recursor', 'name_server_tags_system']:
+        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'authoritative_zones']:
             delete_items_from_list(STATE[_type], data)
         else:
             raise ValueError(f'Operation "{op}" unknown data type "{_type}"')
@@ -534,7 +562,7 @@ def handle_message(msg):
         elif _type in ['forward_zones', 'hosts']:
             add_items_to_dict(STATE[_type], data)
             # maybe we need to rec_control clear-nta each domain that was removed here?
-        elif _type in ['name_server_tags_recursor', 'name_server_tags_system']:
+        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'authoritative_zones']:
             add_items_to_list(STATE[_type], data)
         else:
             raise ValueError(f'Operation "{op}" unknown data type "{_type}"')
@@ -550,7 +578,7 @@ def handle_message(msg):
         if _type in ['name_servers', 'search_domains', 'hosts']:
             tag_regex = get_option(msg, 'tag_regex')
             result = get_items_from_dict_regex(STATE[_type], tag_regex)
-        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'forward_zones']:
+        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'forward_zones', 'authoritative_zones']:
             result = STATE[_type]
         else:
             raise ValueError(f'Operation "{op}" unknown data type "{_type}"')
diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index aa7ac6708..06871f1d6 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -32,6 +32,7 @@ from fastapi.responses import HTMLResponse
 from fastapi.exceptions import RequestValidationError
 from fastapi.routing import APIRoute
 from pydantic import BaseModel, StrictStr, validator
+from starlette.middleware.cors import CORSMiddleware
 from starlette.datastructures import FormData
 from starlette.formparsers import FormParser, MultiPartParser
 from multipart.multipart import parse_options_header
@@ -610,13 +611,19 @@ def show_op(data: ShowModel):
 # GraphQL integration
 ###
 
-from api.graphql.bindings import generate_schema
+def graphql_init(fast_api_app):
+    from api.graphql.bindings import generate_schema
 
-api.graphql.state.init()
+    api.graphql.state.init()
+    api.graphql.state.settings['app'] = app
 
-schema = generate_schema()
+    schema = generate_schema()
 
-app.add_route('/graphql', GraphQL(schema, debug=True))
+    if app.state.vyos_origins:
+        origins = app.state.vyos_origins
+        app.add_route('/graphql', CORSMiddleware(GraphQL(schema, debug=True), allow_origins=origins, allow_methods=("GET", "POST", "OPTIONS")))
+    else:
+        app.add_route('/graphql', GraphQL(schema, debug=True))
 
 ###
 
@@ -640,15 +647,20 @@ if __name__ == '__main__':
     app.state.vyos_session = config_session
     app.state.vyos_keys = server_config['api_keys']
 
-    app.state.vyos_debug = bool(server_config['debug'] == 'true')
-    app.state.vyos_strict = bool(server_config['strict'] == 'true')
+    app.state.vyos_debug = server_config['debug']
+    app.state.vyos_strict = server_config['strict']
+    app.state.vyos_origins = server_config.get('cors', {}).get('origins', [])
 
-    api.graphql.state.settings['app'] = app
+    graphql_init(app)
 
     try:
-        uvicorn.run(app, host=server_config["listen_address"],
-                         port=int(server_config["port"]),
-                         proxy_headers=True)
+        if not server_config['socket']:
+            uvicorn.run(app, host=server_config["listen_address"],
+                             port=int(server_config["port"]),
+                             proxy_headers=True)
+        else:
+            uvicorn.run(app, uds="/run/api.sock",
+                             proxy_headers=True)
     except OSError as err:
         logger.critical(f"OSError {err}")
         sys.exit(1)