Merge branch 'current' into T3350-sagitta

37 files changed, 1077 insertions, 604 deletions

diff --git a/src/completion/list_openvpn_users.py b/src/completion/list_openvpn_users.py
new file mode 100755
index 000000000..c472dbeab
--- /dev/null
+++ b/src/completion/list_openvpn_users.py
@@ -0,0 +1,48 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2019-2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+import sys
+import argparse
+
+from vyos.config import Config
+from vyos.util import dict_search
+
+def get_user_from_interface(interface):
+    config = Config()
+    base = ['interfaces', 'openvpn', interface]
+    openvpn = config.get_config_dict(base, effective=True, key_mangling=('-', '_'))
+    users = []
+
+    try:
+        for user in (dict_search('server.client', openvpn[interface]) or []):
+            users.append(user.split(',')[0])
+    except:
+        pass
+
+    return users
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument("-i", "--interface", type=str, help="List users per interface")
+    args = parser.parse_args()
+
+    users = []
+
+    users = get_user_from_interface(args.interface)
+
+    print(" ".join(users))
+
diff --git a/src/conf_mode/containers.py b/src/conf_mode/containers.py
index 1e0197a13..cc34f9d39 100755
--- a/src/conf_mode/containers.py
+++ b/src/conf_mode/containers.py
@@ -271,6 +271,14 @@ def apply(container):
             tmp = run(f'podman image exists {image}')
             if tmp != 0: print(os.system(f'podman pull {image}'))
 
+            # Add capability options. Should be in uppercase
+            cap_add = ''
+            if 'cap_add' in container_config:
+                for c in container_config['cap_add']:
+                    c = c.upper()
+                    c = c.replace('-', '_')
+                    cap_add += f' --cap-add={c}'
+
             # Check/set environment options "-e foo=bar"
             env_opt = ''
             if 'environment' in container_config:
@@ -299,7 +307,7 @@ def apply(container):
                     dvol = vol_config['destination']
                     volume += f' -v {svol}:{dvol}'
 
-            container_base_cmd = f'podman run --detach --interactive --tty --replace ' \
+            container_base_cmd = f'podman run --detach --interactive --tty --replace {cap_add} ' \
                                  f'--memory {memory}m --memory-swap 0 --restart {restart} ' \
                                  f'--name {name} {port} {volume} {env_opt}'
             if 'allow_host_networks' in container_config:
diff --git a/src/conf_mode/dhcp_server.py b/src/conf_mode/dhcp_server.py
index 28f2a4ca5..a8cef5ebf 100755
--- a/src/conf_mode/dhcp_server.py
+++ b/src/conf_mode/dhcp_server.py
@@ -151,9 +151,15 @@ def verify(dhcp):
     listen_ok = False
     subnets = []
     failover_ok = False
+    shared_networks =  len(dhcp['shared_network_name'])
+    disabled_shared_networks = 0
+
 
     # A shared-network requires a subnet definition
     for network, network_config in dhcp['shared_network_name'].items():
+        if 'disable' in network_config:
+            disabled_shared_networks += 1
+
         if 'subnet' not in network_config:
             raise ConfigError(f'No subnets defined for {network}. At least one\n' \
                               'lease subnet must be configured.')
@@ -226,7 +232,7 @@ def verify(dhcp):
             # There must be one subnet connected to a listen interface.
             # This only counts if the network itself is not disabled!
             if 'disable' not in network_config:
-                if is_subnet_connected(subnet, primary=True):
+                if is_subnet_connected(subnet, primary=False):
                     listen_ok = True
 
             # Subnets must be non overlapping
@@ -243,6 +249,10 @@ def verify(dhcp):
                     if net.overlaps(net2):
                         raise ConfigError('Conflicting subnet ranges: "{net}" overlaps "{net2}"!')
 
+    # Prevent 'disable' for shared-network if only one network is configured
+    if (shared_networks - disabled_shared_networks) < 1:
+        raise ConfigError(f'At least one shared network must be active!')
+
     if 'failover' in dhcp:
         if not failover_ok:
             raise ConfigError('DHCP failover must be enabled for at least one subnet!')
diff --git a/src/conf_mode/dhcpv6_server.py b/src/conf_mode/dhcpv6_server.py
index 175300bb0..e6a2e4486 100755
--- a/src/conf_mode/dhcpv6_server.py
+++ b/src/conf_mode/dhcpv6_server.py
@@ -128,7 +128,7 @@ def verify(dhcpv6):
 
             # Subnets must be unique
             if subnet in subnets:
-                raise ConfigError('DHCPv6 subnets must be unique! Subnet {0} defined multiple times!'.format(subnet['network']))
+                raise ConfigError(f'DHCPv6 subnets must be unique! Subnet {subnet} defined multiple times!')
             subnets.append(subnet)
 
         # DHCPv6 requires at least one configured address range or one static mapping
diff --git a/src/conf_mode/dynamic_dns.py b/src/conf_mode/dynamic_dns.py
index c979feca7..a31e5ed75 100755
--- a/src/conf_mode/dynamic_dns.py
+++ b/src/conf_mode/dynamic_dns.py
@@ -131,9 +131,7 @@ def generate(dyndns):
     if not dyndns:
         return None
 
-    render(config_file, 'dynamic-dns/ddclient.conf.tmpl', dyndns,
-           permission=0o600)
-
+    render(config_file, 'dynamic-dns/ddclient.conf.tmpl', dyndns)
     return None
 
 def apply(dyndns):
diff --git a/src/conf_mode/flow_accounting_conf.py b/src/conf_mode/flow_accounting_conf.py
index 9cae29481..0a4559ade 100755
--- a/src/conf_mode/flow_accounting_conf.py
+++ b/src/conf_mode/flow_accounting_conf.py
@@ -306,7 +306,7 @@ def verify(config):
                             source_ip_presented = True
                             break
             if not source_ip_presented:
-                raise ConfigError("Your \"netflow source-ip\" does not exist in the system")
+                print("Warning: your \"netflow source-ip\" does not exist in the system")
 
         # check if engine-id compatible with selected protocol version
         if config['netflow']['engine-id']:
diff --git a/src/conf_mode/host_name.py b/src/conf_mode/host_name.py
index a7135911d..87bad0dc6 100755
--- a/src/conf_mode/host_name.py
+++ b/src/conf_mode/host_name.py
@@ -79,7 +79,7 @@ def get_config(config=None):
     # system static-host-mapping
     for hn in conf.list_nodes(['system', 'static-host-mapping', 'host-name']):
         hosts['static_host_mapping'][hn] = {}
-        hosts['static_host_mapping'][hn]['address'] = conf.return_value(['system', 'static-host-mapping', 'host-name', hn, 'inet'])
+        hosts['static_host_mapping'][hn]['address'] = conf.return_values(['system', 'static-host-mapping', 'host-name', hn, 'inet'])
         hosts['static_host_mapping'][hn]['aliases'] = conf.return_values(['system', 'static-host-mapping', 'host-name', hn, 'alias'])
 
     return hosts
diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py
index be4380462..92dc4a410 100755
--- a/src/conf_mode/https.py
+++ b/src/conf_mode/https.py
@@ -28,6 +28,7 @@ from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
 from vyos.template import render
 from vyos.util import call
+from vyos.util import write_file
 
 from vyos import airbag
 airbag.enable()
@@ -139,15 +140,18 @@ def generate(https):
         cert_path = os.path.join(cert_dir, f'{cert_name}.pem')
         key_path = os.path.join(key_dir, f'{cert_name}.pem')
 
-        with open(cert_path, 'w') as f:
-            f.write(wrap_certificate(pki_cert['certificate']))
+        server_cert = str(wrap_certificate(pki_cert['certificate']))
+        if 'ca-certificate' in cert_dict:
+            ca_cert = cert_dict['ca-certificate']
+            print(ca_cert)
+            server_cert += '\n' + str(wrap_certificate(https['pki']['ca'][ca_cert]['certificate']))
 
-        with open(key_path, 'w') as f:
-            f.write(wrap_private_key(pki_cert['private']['key']))
+        write_file(cert_path, server_cert)
+        write_file(key_path, wrap_private_key(pki_cert['private']['key']))
 
         vyos_cert_data = {
-            "crt": cert_path,
-            "key": key_path
+            'crt': cert_path,
+            'key': key_path
         }
 
         for block in server_block_list:
diff --git a/src/conf_mode/interfaces-openvpn.py b/src/conf_mode/interfaces-openvpn.py
index 1b4fc95c9..0e915a9c8 100755
--- a/src/conf_mode/interfaces-openvpn.py
+++ b/src/conf_mode/interfaces-openvpn.py
@@ -16,6 +16,7 @@
 
 import os
 import re
+import tempfile
 
 from cryptography.hazmat.primitives.asymmetric import ec
 from glob import glob
@@ -26,6 +27,7 @@ from ipaddress import IPv6Address
 from ipaddress import IPv6Network
 from ipaddress import summarize_address_range
 from netifaces import interfaces
+from secrets import SystemRandom
 from shutil import rmtree
 
 from vyos.config import Config
@@ -48,6 +50,7 @@ from vyos.util import chown
 from vyos.util import dict_search
 from vyos.util import dict_search_args
 from vyos.util import makedir
+from vyos.util import read_file
 from vyos.util import write_file
 from vyos.validate import is_addr_assigned
 
@@ -60,6 +63,9 @@ group = 'openvpn'
 
 cfg_dir = '/run/openvpn'
 cfg_file = '/run/openvpn/{ifname}.conf'
+otp_path = '/config/auth/openvpn'
+otp_file = '/config/auth/openvpn/{ifname}-otp-secrets'
+secret_chars = list('ABCDEFGHIJKLMNOPQRSTUVWXYZ234567')
 service_file = '/run/systemd/system/openvpn@{ifname}.service.d/20-override.conf'
 
 def get_config(config=None):
@@ -76,12 +82,26 @@ def get_config(config=None):
     tmp_pki = conf.get_config_dict(['pki'], key_mangling=('-', '_'),
                                 get_first_key=True, no_tag_node_value_mangle=True)
 
+    # We have to get the dict using 'get_config_dict' instead of 'get_interface_dict'
+    # as 'get_interface_dict' merges the defaults in, so we can not check for defaults in there.
+    tmp_openvpn = conf.get_config_dict(base + [os.environ['VYOS_TAGNODE_VALUE']], key_mangling=('-', '_'),
+                                get_first_key=True, no_tag_node_value_mangle=True)
+
     openvpn = get_interface_dict(conf, base)
 
     if 'deleted' not in openvpn:
         openvpn['pki'] = tmp_pki
 
     openvpn['auth_user_pass_file'] = '/run/openvpn/{ifname}.pw'.format(**openvpn)
+
+    # We have to cleanup the config dict, as default values could enable features
+    # which are not explicitly enabled on the CLI. Example: server mfa totp
+    # originate comes with defaults, which will enable the
+    # totp plugin, even when not set via CLI so we
+    # need to check this first and drop those keys
+    if 'totp' not in tmp_openvpn['server']:
+        del openvpn['server']['mfa']['totp']
+        
     return openvpn
 
 def is_ec_private_key(pki, cert_name):
@@ -170,6 +190,10 @@ def verify_pki(openvpn):
 
 def verify(openvpn):
     if 'deleted' in openvpn:
+        # remove totp secrets file if totp is not configured
+        if os.path.isfile(otp_file.format(**openvpn)):
+            os.remove(otp_file.format(**openvpn))
+
         verify_bridge_delete(openvpn)
         return None
 
@@ -310,10 +334,10 @@ def verify(openvpn):
             if 'is_bridge_member' not in openvpn:
                 raise ConfigError('Must specify "server subnet" or add interface to bridge in server mode')
 
-
-        for client in (dict_search('client', openvpn) or []):
-            if len(client['ip']) > 1 or len(client['ipv6_ip']) > 1:
-                raise ConfigError(f'Server client "{client["name"]}": cannot specify more than 1 IPv4 and 1 IPv6 IP')
+        if hasattr(dict_search('server.client', openvpn), '__iter__'):
+            for client_k, client_v in dict_search('server.client', openvpn).items():
+                if (client_v.get('ip') and len(client_v['ip']) > 1) or (client_v.get('ipv6_ip') and len(client_v['ipv6_ip']) > 1):
+                    raise ConfigError(f'Server client "{client_k}": cannot specify more than 1 IPv4 and 1 IPv6 IP')
 
         if dict_search('server.client_ip_pool', openvpn):
             if not (dict_search('server.client_ip_pool.start', openvpn) and dict_search('server.client_ip_pool.stop', openvpn)):
@@ -361,6 +385,29 @@ def verify(openvpn):
                                 if IPv6Address(client['ipv6_ip'][0]) in v6PoolNet:
                                     print(f'Warning: Client "{client["name"]}" IP {client["ipv6_ip"][0]} is in server IP pool, it is not reserved for this client.')
 
+        # add mfa users to the file the mfa plugin uses
+        if dict_search('server.mfa.totp', openvpn):
+            user_data = ''
+            if not os.path.isfile(otp_file.format(**openvpn)):
+                write_file(otp_file.format(**openvpn), user_data,
+                           user=user, group=group, mode=0o644)
+
+            ovpn_users = read_file(otp_file.format(**openvpn))
+            for client in (dict_search('server.client', openvpn) or []):
+                exists = None
+                for ovpn_user in ovpn_users.split('\n'):
+                    if re.search('^' + client + ' ', ovpn_user):
+                        user_data += f'{ovpn_user}\n'
+                        exists = 'true'
+
+                if not exists:
+                    random = SystemRandom()
+                    totp_secret = ''.join(random.choice(secret_chars) for _ in range(16))
+                    user_data += f'{client} otp totp:sha1:base32:{totp_secret}::xxx *\n'
+
+            write_file(otp_file.format(**openvpn), user_data,
+                           user=user, group=group, mode=0o644)
+
     else:
         # checks for both client and site-to-site go here
         if dict_search('server.reject_unconfigured_clients', openvpn):
@@ -526,6 +573,7 @@ def generate_pki_files(openvpn):
 def generate(openvpn):
     interface = openvpn['ifname']
     directory = os.path.dirname(cfg_file.format(**openvpn))
+    plugin_dir = '/usr/lib/openvpn'
     # create base config directory on demand
     makedir(directory, user, group)
     # enforce proper permissions on /run/openvpn
diff --git a/src/conf_mode/interfaces-tunnel.py b/src/conf_mode/interfaces-tunnel.py
index ef385d2e7..30f57ec0c 100755
--- a/src/conf_mode/interfaces-tunnel.py
+++ b/src/conf_mode/interfaces-tunnel.py
@@ -98,7 +98,7 @@ def verify(tunnel):
 
     # If tunnel source address any and key not set
     if tunnel['encapsulation'] in ['gre'] and \
-       tunnel['source_address'] == '0.0.0.0' and \
+       dict_search('source_address', tunnel) == '0.0.0.0' and \
        dict_search('parameters.ip.key', tunnel) == None:
         raise ConfigError('Tunnel parameters ip key must be set!')
 
@@ -107,19 +107,22 @@ def verify(tunnel):
             # Check pairs tunnel source-address/encapsulation/key with exists tunnels.
             # Prevent the same key for 2 tunnels with same source-address/encap. T2920
             for tunnel_if in Section.interfaces('tunnel'):
+                # It makes no sense to run the test for re-used GRE keys on our
+                # own interface we are currently working on
+                if tunnel['ifname'] == tunnel_if:
+                    continue
                 tunnel_cfg = get_interface_config(tunnel_if)
-                exist_encap = tunnel_cfg['linkinfo']['info_kind']
-                exist_source_address = tunnel_cfg['address']
-                exist_key = tunnel_cfg['linkinfo']['info_data']['ikey']
-                new_source_address = tunnel['source_address']
+                # no match on encapsulation - bail out
+                if dict_search('linkinfo.info_kind', tunnel_cfg) != tunnel['encapsulation']:
+                    continue
+                new_source_address = dict_search('source_address', tunnel)
                 # Convert tunnel key to ip key, format "ip -j link show"
                 # 1 => 0.0.0.1, 999 => 0.0.3.231
-                orig_new_key = int(tunnel['parameters']['ip']['key'])
-                new_key = IPv4Address(orig_new_key)
+                orig_new_key = dict_search('parameters.ip.key', tunnel)
+                new_key = IPv4Address(int(orig_new_key))
                 new_key = str(new_key)
-                if tunnel['encapsulation'] == exist_encap and \
-                   new_source_address == exist_source_address and \
-                   new_key == exist_key:
+                if dict_search('address', tunnel_cfg) == new_source_address and \
+                   dict_search('linkinfo.info_data.ikey', tunnel_cfg) == new_key:
                     raise ConfigError(f'Key "{orig_new_key}" for source-address "{new_source_address}" ' \
                                       f'is already used for tunnel "{tunnel_if}"!')
 
diff --git a/src/conf_mode/interfaces-wireless.py b/src/conf_mode/interfaces-wireless.py
index 7b3de6e8a..af35b5f03 100755
--- a/src/conf_mode/interfaces-wireless.py
+++ b/src/conf_mode/interfaces-wireless.py
@@ -82,11 +82,12 @@ def get_config(config=None):
     tmp = conf.get_config_dict([], key_mangling=('-', '_'), get_first_key=True)
     if not (dict_search('security.wpa.passphrase', tmp) or
             dict_search('security.wpa.radius', tmp)):
-        del wifi['security']['wpa']
+        if 'deleted' not in wifi:
+            del wifi['security']['wpa']
 
     # defaults include RADIUS server specifics per TAG node which need to be
     # added to individual RADIUS servers instead - so we can simply delete them
-    if dict_search('security.wpa.radius.server.port', wifi):
+    if dict_search('security.wpa.radius.server.port', wifi) != None:
         del wifi['security']['wpa']['radius']['server']['port']
         if not len(wifi['security']['wpa']['radius']['server']):
             del wifi['security']['wpa']['radius']
diff --git a/src/conf_mode/service_mdns-repeater.py b/src/conf_mode/service_mdns-repeater.py
index c920920ed..d31a0c49e 100755
--- a/src/conf_mode/service_mdns-repeater.py
+++ b/src/conf_mode/service_mdns-repeater.py
@@ -28,7 +28,7 @@ from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-config_file = r'/etc/default/mdns-repeater'
+config_file = '/run/avahi-daemon/avahi-daemon.conf'
 vrrp_running_file = '/run/mdns_vrrp_active'
 
 def get_config(config=None):
@@ -92,12 +92,12 @@ def generate(mdns):
         if len(mdns['interface']) < 2:
             return None
 
-    render(config_file, 'mdns-repeater/mdns-repeater.tmpl', mdns)
+    render(config_file, 'mdns-repeater/avahi-daemon.tmpl', mdns)
     return None
 
 def apply(mdns):
     if not mdns or 'disable' in mdns:
-        call('systemctl stop mdns-repeater.service')
+        call('systemctl stop avahi-daemon.service')
         if os.path.exists(config_file):
             os.unlink(config_file)
 
@@ -106,16 +106,16 @@ def apply(mdns):
     else:
         if 'vrrp_disable' not in mdns and os.path.exists(vrrp_running_file):
             os.unlink(vrrp_running_file)
-        
+
         if mdns['vrrp_exists'] and 'vrrp_disable' in mdns:
             if not os.path.exists(vrrp_running_file):
                 os.mknod(vrrp_running_file) # vrrp script looks for this file to update mdns repeater
 
             if len(mdns['interface']) < 2:
-                call('systemctl stop mdns-repeater.service')
+                call('systemctl stop avahi-daemon.service')
                 return None
 
-        call('systemctl restart mdns-repeater.service')
+        call('systemctl restart avahi-daemon.service')
 
     return None
 
diff --git a/src/conf_mode/snmp.py b/src/conf_mode/snmp.py
index 23e45a5b7..2a420b193 100755
--- a/src/conf_mode/snmp.py
+++ b/src/conf_mode/snmp.py
@@ -52,6 +52,7 @@ default_config_data = {
     'communities': [],
     'smux_peers': [],
     'location' : '',
+    'protocol' : 'udp',
     'description' : '',
     'contact' : '',
     'route_table': 'False',
@@ -151,6 +152,9 @@ def get_config():
     if conf.exists('location'):
         snmp['location'] = conf.return_value('location')
 
+    if conf.exists('protocol'):
+        snmp['protocol'] = conf.return_value('protocol')
+
     if conf.exists('smux-peer'):
         snmp['smux_peers'] = conf.return_values('smux-peer')
 
@@ -404,13 +408,14 @@ def verify(snmp):
     for listen in snmp['listen_address']:
         addr = listen[0]
         port = listen[1]
+        protocol = snmp['protocol']
 
         if is_ipv4(addr):
             # example: udp:127.0.0.1:161
-            listen = 'udp:' + addr + ':' + port
+            listen = f'{protocol}:{addr}:{port}'
         elif snmp['ipv6_enabled']:
             # example: udp6:[::1]:161
-            listen = 'udp6:' + '[' + addr + ']' + ':' + port
+            listen = f'{protocol}6:[{addr}]:{port}'
 
         # We only wan't to configure addresses that exist on the system.
         # Hint the user if they don't exist
diff --git a/src/conf_mode/system_console.py b/src/conf_mode/system_console.py
index 33a546bd3..19b252513 100755
--- a/src/conf_mode/system_console.py
+++ b/src/conf_mode/system_console.py
@@ -18,9 +18,14 @@ import os
 import re
 
 from vyos.config import Config
-from vyos.util import call, read_file, write_file
+from vyos.configdict import dict_merge
+from vyos.util import call
+from vyos.util import read_file
+from vyos.util import write_file
 from vyos.template import render
-from vyos import ConfigError, airbag
+from vyos.xml import defaults
+from vyos import ConfigError
+from vyos import airbag
 airbag.enable()
 
 by_bus_dir = '/dev/serial/by-bus'
@@ -36,21 +41,27 @@ def get_config(config=None):
     console = conf.get_config_dict(base, get_first_key=True)
 
     # bail out early if no serial console is configured
-    if 'device' not in console.keys():
+    if 'device' not in console:
         return console
 
     # convert CLI values to system values
-    for device in console['device'].keys():
-        # no speed setting has been configured - use default value
-        if not 'speed' in console['device'][device].keys():
-            tmp = { 'speed': '' }
-            if device.startswith('hvc'):
-                tmp['speed'] = 38400
-            else:
-                tmp['speed'] = 115200
+    default_values = defaults(base + ['device'])
+    for device, device_config in console['device'].items():
+        if 'speed' not in device_config and device.startswith('hvc'):
+            # XEN console has a different default console speed
+            console['device'][device]['speed'] = 38400
+        else:
+            # Merge in XML defaults - the proper way to do it
+            console['device'][device] = dict_merge(default_values,
+                                                   console['device'][device])
+
+    return console
 
-            console['device'][device].update(tmp)
+def verify(console):
+    if not console or 'device' not in console:
+        return None
 
+    for device in console['device']:
         if device.startswith('usb'):
             # It is much easiert to work with the native ttyUSBn name when using
             # getty, but that name may change across reboots - depending on the
@@ -58,13 +69,13 @@ def get_config(config=None):
             # to its dynamic device file - and create a new dict entry for it.
             by_bus_device = f'{by_bus_dir}/{device}'
             if os.path.isdir(by_bus_dir) and os.path.exists(by_bus_device):
-                tmp = os.path.basename(os.readlink(by_bus_device))
-                # updating the dict must come as last step in the loop!
-                console['device'][tmp] = console['device'].pop(device)
+                device = os.path.basename(os.readlink(by_bus_device))
 
-    return console
+        # If the device name still starts with usbXXX no matching tty was found
+        # and it can not be used as a serial interface
+        if device.startswith('usb'):
+            raise ConfigError(f'Device {device} does not support beeing used as tty')
 
-def verify(console):
     return None
 
 def generate(console):
@@ -76,20 +87,29 @@ def generate(console):
                 call(f'systemctl stop {basename}')
                 os.unlink(os.path.join(root, basename))
 
-    if not console:
+    if not console or 'device' not in console:
         return None
 
-    for device in console['device'].keys():
+    for device, device_config in console['device'].items():
+        if device.startswith('usb'):
+            # It is much easiert to work with the native ttyUSBn name when using
+            # getty, but that name may change across reboots - depending on the
+            # amount of connected devices. We will resolve the fixed device name
+            # to its dynamic device file - and create a new dict entry for it.
+            by_bus_device = f'{by_bus_dir}/{device}'
+            if os.path.isdir(by_bus_dir) and os.path.exists(by_bus_device):
+                device = os.path.basename(os.readlink(by_bus_device))
+
         config_file = base_dir + f'/serial-getty@{device}.service'
         getty_wants_symlink = base_dir + f'/getty.target.wants/serial-getty@{device}.service'
 
-        render(config_file, 'getty/serial-getty.service.tmpl', console['device'][device])
+        render(config_file, 'getty/serial-getty.service.tmpl', device_config)
         os.symlink(config_file, getty_wants_symlink)
 
     # GRUB
     # For existing serial line change speed (if necessary)
     # Only applys to ttyS0
-    if 'ttyS0' not in console['device'].keys():
+    if 'ttyS0' not in console['device']:
         return None
 
     speed = console['device']['ttyS0']['speed']
@@ -98,7 +118,6 @@ def generate(console):
         return None
 
     lines = read_file(grub_config).split('\n')
-
     p = re.compile(r'^(.* console=ttyS0),[0-9]+(.*)$')
     write = False
     newlines = []
@@ -122,9 +141,8 @@ def generate(console):
     return None
 
 def apply(console):
-    # reset screen blanking
+    # Reset screen blanking
     call('/usr/bin/setterm -blank 0 -powersave off -powerdown 0 -term linux </dev/tty1 >/dev/tty1 2>&1')
-
     # Reload systemd manager configuration
     call('systemctl daemon-reload')
 
@@ -136,11 +154,11 @@ def apply(console):
         call('/usr/bin/setterm -blank 15 -powersave powerdown -powerdown 60 -term linux </dev/tty1 >/dev/tty1 2>&1')
 
     # Start getty process on configured serial interfaces
-    for device in console['device'].keys():
+    for device in console['device']:
         # Only start console if it exists on the running system. If a user
         # detaches a USB serial console and reboots - it should not fail!
         if os.path.exists(f'/dev/{device}'):
-            call(f'systemctl start serial-getty@{device}.service')
+            call(f'systemctl restart serial-getty@{device}.service')
 
     return None
 
diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py
index 9c52f77ca..818e8fa0b 100755
--- a/src/conf_mode/vpn_l2tp.py
+++ b/src/conf_mode/vpn_l2tp.py
@@ -290,6 +290,8 @@ def get_config(config=None):
     # LNS secret
     if conf.exists(['lns', 'shared-secret']):
         l2tp['lns_shared_secret'] = conf.return_value(['lns', 'shared-secret'])
+    if conf.exists(['lns', 'host-name']):
+        l2tp['lns_host_name'] = conf.return_value(['lns', 'host-name'])
 
     if conf.exists(['ccp-disable']):
         l2tp['ccp_disable'] = True
diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py
index d1a71a5ad..68139dc47 100755
--- a/src/conf_mode/vpn_sstp.py
+++ b/src/conf_mode/vpn_sstp.py
@@ -58,7 +58,7 @@ def verify(sstp):
 
     verify_accel_ppp_base_service(sstp)
 
-    if not sstp['client_ip_pool']:
+    if 'client_ip_pool' not in sstp and 'client_ipv6_pool' not in sstp:
         raise ConfigError('Client IP subnet required')
 
     #
diff --git a/src/conf_mode/vrrp.py b/src/conf_mode/vrrp.py
index e8f1c1f99..c72efc61f 100755
--- a/src/conf_mode/vrrp.py
+++ b/src/conf_mode/vrrp.py
@@ -28,6 +28,7 @@ from vyos.template import render
 from vyos.template import is_ipv4
 from vyos.template import is_ipv6
 from vyos.util import call
+from vyos.util import is_systemd_service_running
 from vyos.xml import defaults
 from vyos import ConfigError
 from vyos import airbag
@@ -139,7 +140,12 @@ def apply(vrrp):
         call(f'systemctl stop {service_name}')
         return None
 
-    call(f'systemctl restart {service_name}')
+    # XXX: T3944 - reload keepalived configuration if service is already running
+    # to not cause any service disruption when applying changes.
+    if is_systemd_service_running(service_name):
+        call(f'systemctl reload {service_name}')
+    else:
+        call(f'systemctl restart {service_name}')
     return None
 
 if __name__ == '__main__':
diff --git a/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient b/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
index f737148dc..ae6bf9f16 100644
--- a/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
+++ b/src/etc/dhcp/dhclient-enter-hooks.d/02-vyos-stopdhclient
@@ -23,10 +23,12 @@ if [ -z ${CONTROLLED_STOP} ] ; then
         if ([ $dhclient -ne $current_dhclient ] && [ $dhclient -ne $master_dhclient ]); then
             # get path to PID-file of dhclient process
             local dhclient_pidfile=`ps --no-headers --format args --pid $dhclient | awk 'match(\$0, ".*-pf (/.*pid) .*", PF) { print PF[1] }'`
+            # get path to lease-file of dhclient process
+            local dhclient_leasefile=`ps --no-headers --format args --pid $dhclient | awk 'match(\$0, ".*-lf (/\\\S*leases) .*", LF) { print LF[1] }'`
             # stop dhclient with native command - this will run dhclient-script with correct reason unlike simple kill
-            logmsg info "Stopping dhclient with PID: ${dhclient}, PID file: $dhclient_pidfile"
+            logmsg info "Stopping dhclient with PID: ${dhclient}, PID file: ${dhclient_pidfile}, Leases file: ${dhclient_leasefile}"
             if [[ -e $dhclient_pidfile ]]; then
-                dhclient -e CONTROLLED_STOP=yes -x -pf $dhclient_pidfile
+                dhclient -e CONTROLLED_STOP=yes -x -pf $dhclient_pidfile -lf $dhclient_leasefile
             else
                 logmsg error "PID file $dhclient_pidfile does not exists, killing dhclient with SIGTERM signal"
                 kill -s 15 ${dhclient}
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
index 694d53b6b..fec792b64 100644
--- a/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/01-vyos-cleanup
@@ -15,10 +15,16 @@ if [[ $reason =~ (EXPIRE|FAIL|RELEASE|STOP) ]]; then
 
     if_metric="$IF_METRIC"
 
-    # try to delete default ip route 
+    # try to delete default ip route
     for router in $old_routers; do
-        logmsg info "Deleting default route: via $router dev ${interface} ${if_metric:+metric $if_metric}"
-        ip -4 route del default via $router dev ${interface} ${if_metric:+metric $if_metric}
+        # check if we are bound to a VRF
+        local vrf_name=$(basename /sys/class/net/${interface}/upper_* | sed -e 's/upper_//')
+        if [ "$vrf_name" != "*" ]; then
+            vrf="vrf $vrf_name"
+        fi
+
+        logmsg info "Deleting default route: via $router dev ${interface} ${if_metric:+metric $if_metric} ${vrf}"
+        ip -4 route del default via $router dev ${interface} ${if_metric:+metric $if_metric} ${vrf}
 
         if_metric=$((if_metric+1))
     done
diff --git a/src/etc/systemd/system/avahi-daemon.service.d/override.conf b/src/etc/systemd/system/avahi-daemon.service.d/override.conf
new file mode 100644
index 000000000..a9d2085f7
--- /dev/null
+++ b/src/etc/systemd/system/avahi-daemon.service.d/override.conf
@@ -0,0 +1,8 @@
+[Unit]
+After=
+After=vyos-router.service
+ConditionPathExists=/run/avahi-daemon/avahi-daemon.conf
+
+[Service]
+ExecStart=
+ExecStart=/usr/sbin/avahi-daemon --syslog --file /run/avahi-daemon/avahi-daemon.conf
\ No newline at end of file
diff --git a/src/etc/udev/rules.d/90-vyos-serial.rules b/src/etc/udev/rules.d/90-vyos-serial.rules
index 872fd4fea..30c1d3170 100644
--- a/src/etc/udev/rules.d/90-vyos-serial.rules
+++ b/src/etc/udev/rules.d/90-vyos-serial.rules
@@ -22,7 +22,7 @@ IMPORT{builtin}="path_id", IMPORT{builtin}="usb_id"
 #   (tr -d -) does the replacement
 # - Replace the first group after ":" to represent the bus relation (sed -e 0,/:/s//b/) indicated by "b"
 # - Replace the next group after ":" to represent the port relation (sed -e 0,/:/s//p/) indicated by "p"
-ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="",   PROGRAM="/bin/sh -c 'echo $env{ID_PATH:17} | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
-ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="?*", PROGRAM="/bin/sh -c 'echo $env{ID_PATH:17} | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
+ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="",   PROGRAM="/bin/sh -c 'echo $env{ID_PATH} | cut -d- -f3- | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
+ENV{ID_PATH}=="?*", ENV{.ID_PORT}=="?*", PROGRAM="/bin/sh -c 'echo $env{ID_PATH} | cut -d- -f3- | tr -d - | sed -e 0,/:/s//b/ | sed -e 0,/:/s//p/'", SYMLINK+="serial/by-bus/$result"
 
 LABEL="serial_end"
diff --git a/src/helpers/strip-private.py b/src/helpers/strip-private.py
index c74a379aa..e4e1fe11d 100755
--- a/src/helpers/strip-private.py
+++ b/src/helpers/strip-private.py
@@ -106,6 +106,7 @@ if __name__ == "__main__":
     stripping_rules = [
         # Strip passwords
         (True, re.compile(r'password \S+'), 'password xxxxxx'),
+        (True, re.compile(r'cisco-authentication \S+'), 'cisco-authentication xxxxxx'),
         # Strip public key information
         (True, re.compile(r'public-keys \S+'), 'public-keys xxxx@xxx.xxx'),
         (True, re.compile(r'type \'ssh-(rsa|dss)\''), 'type ssh-xxx'),
diff --git a/src/migration-scripts/bgp/1-to-2 b/src/migration-scripts/bgp/1-to-2
new file mode 100755
index 000000000..4c6d5ceb8
--- /dev/null
+++ b/src/migration-scripts/bgp/1-to-2
@@ -0,0 +1,77 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# T3741: no-ipv4-unicast is now enabled by default
+
+from sys import argv
+from sys import exit
+
+from vyos.configtree import ConfigTree
+from vyos.template import is_ipv4
+
+if (len(argv) < 1):
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+base = ['protocols', 'bgp']
+config = ConfigTree(config_file)
+
+if not config.exists(base):
+    # Nothing to do
+    exit(0)
+
+# This is now a default option - simply delete it.
+# As it was configured explicitly - we can also bail out early as we need to
+# do nothing!
+if config.exists(base + ['parameters', 'default', 'no-ipv4-unicast']):
+    config.delete(base + ['parameters', 'default', 'no-ipv4-unicast'])
+
+    # Check if the "default" node is now empty, if so - remove it
+    if len(config.list_nodes(base + ['parameters', 'default'])) == 0:
+        config.delete(base + ['parameters', 'default'])
+
+    # Check if the "default" node is now empty, if so - remove it
+    if len(config.list_nodes(base + ['parameters'])) == 0:
+        config.delete(base + ['parameters'])
+
+    exit(0)
+
+# As we now install a new default option into BGP we need to migrate all
+# existing BGP neighbors and restore the old behavior
+if config.exists(base + ['neighbor']):
+    for neighbor in config.list_nodes(base + ['neighbor']):
+        peer_group = base + ['neighbor', neighbor, 'peer-group']
+        if config.exists(peer_group):
+            peer_group_name = config.return_value(peer_group)
+            # peer group enables old behavior for neighbor - bail out
+            if config.exists(base + ['peer-group', peer_group_name, 'address-family', 'ipv4-unicast']):
+                continue
+
+        afi_ipv4 = base + ['neighbor', neighbor, 'address-family', 'ipv4-unicast']
+        if not config.exists(afi_ipv4):
+            config.set(afi_ipv4)
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print(f'Failed to save the modified config: {e}')
+    exit(1)
diff --git a/src/migration-scripts/interfaces/21-to-22 b/src/migration-scripts/interfaces/21-to-22
index 06e07572f..098102102 100755
--- a/src/migration-scripts/interfaces/21-to-22
+++ b/src/migration-scripts/interfaces/21-to-22
@@ -15,131 +15,32 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from sys import argv
-from sys import exit
 from vyos.configtree import ConfigTree
 
-def migrate_ospf(config, path, interface):
-    path = path + ['ospf']
-    if config.exists(path):
-        new_base = ['protocols', 'ospf', 'interface']
-        config.set(new_base)
-        config.set_tag(new_base)
-        config.copy(path, new_base + [interface])
-        config.delete(path)
+if (len(argv) < 1):
+    print("Must specify file name!")
+    exit(1)
 
-        # if "ip ospf" was the only setting, we can clean out the empty
-        # ip node afterwards
-        if len(config.list_nodes(path[:-1])) == 0:
-            config.delete(path[:-1])
+file_name = argv[1]
+with open(file_name, 'r') as f:
+    config_file = f.read()
 
-def migrate_ospfv3(config, path, interface):
-    path = path + ['ospfv3']
-    if config.exists(path):
-        new_base = ['protocols', 'ospfv3', 'interface']
-        config.set(new_base)
-        config.set_tag(new_base)
-        config.copy(path, new_base + [interface])
-        config.delete(path)
+config = ConfigTree(config_file)
+base = ['interfaces', 'tunnel']
 
-        # if "ipv6 ospfv3" was the only setting, we can clean out the empty
-        # ip node afterwards
-        if len(config.list_nodes(path[:-1])) == 0:
-            config.delete(path[:-1])
+if not config.exists(base):
+    exit(0)
 
-def migrate_rip(config, path, interface):
-    path = path + ['rip']
+for interface in config.list_nodes(base):
+    path = base + [interface, 'dhcp-interface']
     if config.exists(path):
-        new_base = ['protocols', 'rip', 'interface']
-        config.set(new_base)
-        config.set_tag(new_base)
-        config.copy(path, new_base + [interface])
+        tmp = config.return_value(path)
         config.delete(path)
-
-        # if "ip rip" was the only setting, we can clean out the empty
-        # ip node afterwards
-        if len(config.list_nodes(path[:-1])) == 0:
-            config.delete(path[:-1])
-
-def migrate_ripng(config, path, interface):
-    path = path + ['ripng']
-    if config.exists(path):
-        new_base = ['protocols', 'ripng', 'interface']
-        config.set(new_base)
-        config.set_tag(new_base)
-        config.copy(path, new_base + [interface])
-        config.delete(path)
-
-        # if "ipv6 ripng" was the only setting, we can clean out the empty
-        # ip node afterwards
-        if len(config.list_nodes(path[:-1])) == 0:
-            config.delete(path[:-1])
-
-if __name__ == '__main__':
-    if (len(argv) < 1):
-        print("Must specify file name!")
-        exit(1)
-
-    file_name = argv[1]
-    with open(file_name, 'r') as f:
-        config_file = f.read()
-
-    config = ConfigTree(config_file)
-
-    #
-    # Migrate "interface ethernet eth0 ip ospf" to "protocols ospf interface eth0"
-    #
-    for type in config.list_nodes(['interfaces']):
-        for interface in config.list_nodes(['interfaces', type]):
-            ip_base = ['interfaces', type, interface, 'ip']
-            ipv6_base = ['interfaces', type, interface, 'ipv6']
-            migrate_rip(config, ip_base, interface)
-            migrate_ripng(config, ipv6_base, interface)
-            migrate_ospf(config, ip_base, interface)
-            migrate_ospfv3(config, ipv6_base, interface)
-
-            vif_path = ['interfaces', type, interface, 'vif']
-            if config.exists(vif_path):
-                for vif in config.list_nodes(vif_path):
-                    vif_ip_base = vif_path + [vif, 'ip']
-                    vif_ipv6_base = vif_path + [vif, 'ipv6']
-                    ifname = f'{interface}.{vif}'
-
-                    migrate_rip(config, vif_ip_base, ifname)
-                    migrate_ripng(config, vif_ipv6_base, ifname)
-                    migrate_ospf(config, vif_ip_base, ifname)
-                    migrate_ospfv3(config, vif_ipv6_base, ifname)
-
-
-            vif_s_path = ['interfaces', type, interface, 'vif-s']
-            if config.exists(vif_s_path):
-                for vif_s in config.list_nodes(vif_s_path):
-                    vif_s_ip_base = vif_s_path + [vif_s, 'ip']
-                    vif_s_ipv6_base = vif_s_path + [vif_s, 'ipv6']
-
-                    # vif-c interfaces MUST be migrated before their parent vif-s
-                    # interface as the migrate_*() functions delete the path!
-                    vif_c_path = ['interfaces', type, interface, 'vif-s', vif_s, 'vif-c']
-                    if config.exists(vif_c_path):
-                        for vif_c in config.list_nodes(vif_c_path):
-                            vif_c_ip_base = vif_c_path + [vif_c, 'ip']
-                            vif_c_ipv6_base = vif_c_path + [vif_c, 'ipv6']
-                            ifname = f'{interface}.{vif_s}.{vif_c}'
-
-                            migrate_rip(config, vif_c_ip_base, ifname)
-                            migrate_ripng(config, vif_c_ipv6_base, ifname)
-                            migrate_ospf(config, vif_c_ip_base, ifname)
-                            migrate_ospfv3(config, vif_c_ipv6_base, ifname)
-
-
-                    ifname = f'{interface}.{vif_s}'
-                    migrate_rip(config, vif_s_ip_base, ifname)
-                    migrate_ripng(config, vif_s_ipv6_base, ifname)
-                    migrate_ospf(config, vif_s_ip_base, ifname)
-                    migrate_ospfv3(config, vif_s_ipv6_base, ifname)
-
-    try:
-        with open(file_name, 'w') as f:
-            f.write(config.to_string())
-    except OSError as e:
-        print("Failed to save the modified config: {}".format(e))
-        exit(1)
+        config.set(base + [interface, 'source-interface'], value=tmp)
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    exit(1)
diff --git a/src/migration-scripts/interfaces/22-to-23 b/src/migration-scripts/interfaces/22-to-23
index d1ec2ad3e..06e07572f 100755
--- a/src/migration-scripts/interfaces/22-to-23
+++ b/src/migration-scripts/interfaces/22-to-23
@@ -14,47 +14,132 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-# A VTI interface also requires an IPSec configuration - VyOS 1.2 supported
-# having a VTI interface in the CLI but no IPSec configuration - drop VTI
-# configuration if this is the case for VyOS 1.4
-
-import sys
+from sys import argv
+from sys import exit
 from vyos.configtree import ConfigTree
 
+def migrate_ospf(config, path, interface):
+    path = path + ['ospf']
+    if config.exists(path):
+        new_base = ['protocols', 'ospf', 'interface']
+        config.set(new_base)
+        config.set_tag(new_base)
+        config.copy(path, new_base + [interface])
+        config.delete(path)
+
+        # if "ip ospf" was the only setting, we can clean out the empty
+        # ip node afterwards
+        if len(config.list_nodes(path[:-1])) == 0:
+            config.delete(path[:-1])
+
+def migrate_ospfv3(config, path, interface):
+    path = path + ['ospfv3']
+    if config.exists(path):
+        new_base = ['protocols', 'ospfv3', 'interface']
+        config.set(new_base)
+        config.set_tag(new_base)
+        config.copy(path, new_base + [interface])
+        config.delete(path)
+
+        # if "ipv6 ospfv3" was the only setting, we can clean out the empty
+        # ip node afterwards
+        if len(config.list_nodes(path[:-1])) == 0:
+            config.delete(path[:-1])
+
+def migrate_rip(config, path, interface):
+    path = path + ['rip']
+    if config.exists(path):
+        new_base = ['protocols', 'rip', 'interface']
+        config.set(new_base)
+        config.set_tag(new_base)
+        config.copy(path, new_base + [interface])
+        config.delete(path)
+
+        # if "ip rip" was the only setting, we can clean out the empty
+        # ip node afterwards
+        if len(config.list_nodes(path[:-1])) == 0:
+            config.delete(path[:-1])
+
+def migrate_ripng(config, path, interface):
+    path = path + ['ripng']
+    if config.exists(path):
+        new_base = ['protocols', 'ripng', 'interface']
+        config.set(new_base)
+        config.set_tag(new_base)
+        config.copy(path, new_base + [interface])
+        config.delete(path)
+
+        # if "ipv6 ripng" was the only setting, we can clean out the empty
+        # ip node afterwards
+        if len(config.list_nodes(path[:-1])) == 0:
+            config.delete(path[:-1])
+
 if __name__ == '__main__':
-    if (len(sys.argv) < 1):
+    if (len(argv) < 1):
         print("Must specify file name!")
-        sys.exit(1)
-
-    file_name = sys.argv[1]
+        exit(1)
 
+    file_name = argv[1]
     with open(file_name, 'r') as f:
         config_file = f.read()
 
     config = ConfigTree(config_file)
-    base = ['interfaces', 'vti']
-    if not config.exists(base):
-        # Nothing to do
-        sys.exit(0)
-
-    ipsec_base = ['vpn', 'ipsec', 'site-to-site', 'peer']
-    for interface in config.list_nodes(base):
-        found = False
-        if config.exists(ipsec_base):
-            for peer in config.list_nodes(ipsec_base):
-                if config.exists(ipsec_base + [peer, 'vti', 'bind']):
-                    tmp = config.return_value(ipsec_base + [peer, 'vti', 'bind'])
-                    if tmp == interface:
-                        # Interface was found and we no longer need to search
-                        # for it in our IPSec peers
-                        found = True
-                        break
-        if not found:
-            config.delete(base + [interface])
+
+    #
+    # Migrate "interface ethernet eth0 ip ospf" to "protocols ospf interface eth0"
+    #
+    for type in config.list_nodes(['interfaces']):
+        for interface in config.list_nodes(['interfaces', type]):
+            ip_base = ['interfaces', type, interface, 'ip']
+            ipv6_base = ['interfaces', type, interface, 'ipv6']
+            migrate_rip(config, ip_base, interface)
+            migrate_ripng(config, ipv6_base, interface)
+            migrate_ospf(config, ip_base, interface)
+            migrate_ospfv3(config, ipv6_base, interface)
+
+            vif_path = ['interfaces', type, interface, 'vif']
+            if config.exists(vif_path):
+                for vif in config.list_nodes(vif_path):
+                    vif_ip_base = vif_path + [vif, 'ip']
+                    vif_ipv6_base = vif_path + [vif, 'ipv6']
+                    ifname = f'{interface}.{vif}'
+
+                    migrate_rip(config, vif_ip_base, ifname)
+                    migrate_ripng(config, vif_ipv6_base, ifname)
+                    migrate_ospf(config, vif_ip_base, ifname)
+                    migrate_ospfv3(config, vif_ipv6_base, ifname)
+
+
+            vif_s_path = ['interfaces', type, interface, 'vif-s']
+            if config.exists(vif_s_path):
+                for vif_s in config.list_nodes(vif_s_path):
+                    vif_s_ip_base = vif_s_path + [vif_s, 'ip']
+                    vif_s_ipv6_base = vif_s_path + [vif_s, 'ipv6']
+
+                    # vif-c interfaces MUST be migrated before their parent vif-s
+                    # interface as the migrate_*() functions delete the path!
+                    vif_c_path = ['interfaces', type, interface, 'vif-s', vif_s, 'vif-c']
+                    if config.exists(vif_c_path):
+                        for vif_c in config.list_nodes(vif_c_path):
+                            vif_c_ip_base = vif_c_path + [vif_c, 'ip']
+                            vif_c_ipv6_base = vif_c_path + [vif_c, 'ipv6']
+                            ifname = f'{interface}.{vif_s}.{vif_c}'
+
+                            migrate_rip(config, vif_c_ip_base, ifname)
+                            migrate_ripng(config, vif_c_ipv6_base, ifname)
+                            migrate_ospf(config, vif_c_ip_base, ifname)
+                            migrate_ospfv3(config, vif_c_ipv6_base, ifname)
+
+
+                    ifname = f'{interface}.{vif_s}'
+                    migrate_rip(config, vif_s_ip_base, ifname)
+                    migrate_ripng(config, vif_s_ipv6_base, ifname)
+                    migrate_ospf(config, vif_s_ip_base, ifname)
+                    migrate_ospfv3(config, vif_s_ipv6_base, ifname)
 
     try:
         with open(file_name, 'w') as f:
             f.write(config.to_string())
     except OSError as e:
         print("Failed to save the modified config: {}".format(e))
-        sys.exit(1)
+        exit(1)
diff --git a/src/migration-scripts/interfaces/23-to-24 b/src/migration-scripts/interfaces/23-to-24
index 93ce9215f..d1ec2ad3e 100755
--- a/src/migration-scripts/interfaces/23-to-24
+++ b/src/migration-scripts/interfaces/23-to-24
@@ -14,356 +14,47 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-# Migrate Wireguard to store keys in CLI
-# Migrate EAPoL to PKI configuration
+# A VTI interface also requires an IPSec configuration - VyOS 1.2 supported
+# having a VTI interface in the CLI but no IPSec configuration - drop VTI
+# configuration if this is the case for VyOS 1.4
 
-import os
 import sys
 from vyos.configtree import ConfigTree
-from vyos.pki import load_certificate
-from vyos.pki import load_crl
-from vyos.pki import load_dh_parameters
-from vyos.pki import load_private_key
-from vyos.pki import encode_certificate
-from vyos.pki import encode_dh_parameters
-from vyos.pki import encode_private_key
-from vyos.util import run
 
-def wrapped_pem_to_config_value(pem):
-    out = []
-    for line in pem.strip().split("\n"):
-        if not line or line.startswith("-----") or line[0] == '#':
-            continue
-        out.append(line)
-    return "".join(out)
+if __name__ == '__main__':
+    if (len(sys.argv) < 1):
+        print("Must specify file name!")
+        sys.exit(1)
 
-def read_file_for_pki(config_auth_path):
-    full_path = os.path.join(AUTH_DIR, config_auth_path)
-    output = None
+    file_name = sys.argv[1]
 
-    if os.path.isfile(full_path):
-        if not os.access(full_path, os.R_OK):
-            run(f'sudo chmod 644 {full_path}')
+    with open(file_name, 'r') as f:
+        config_file = f.read()
 
-        with open(full_path, 'r') as f:
-            output = f.read()
+    config = ConfigTree(config_file)
+    base = ['interfaces', 'vti']
+    if not config.exists(base):
+        # Nothing to do
+        sys.exit(0)
 
-    return output
-
-if (len(sys.argv) < 1):
-    print("Must specify file name!")
-    sys.exit(1)
-
-file_name = sys.argv[1]
-
-with open(file_name, 'r') as f:
-    config_file = f.read()
-
-config = ConfigTree(config_file)
-
-AUTH_DIR = '/config/auth'
-pki_base = ['pki']
-
-# OpenVPN
-base = ['interfaces', 'openvpn']
-
-if config.exists(base):
-    for interface in config.list_nodes(base):
-        x509_base = base + [interface, 'tls']
-        pki_name = f'openvpn_{interface}'
-
-        if config.exists(base + [interface, 'shared-secret-key-file']):
-            if not config.exists(pki_base + ['openvpn', 'shared-secret']):
-                config.set(pki_base + ['openvpn', 'shared-secret'])
-                config.set_tag(pki_base + ['openvpn', 'shared-secret'])
-
-            key_file = config.return_value(base + [interface, 'shared-secret-key-file'])
-            key = read_file_for_pki(key_file)
-            key_pki_name = f'{pki_name}_shared'
-
-            if key:
-                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
-                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
-                config.set(base + [interface, 'shared-secret-key'], value=key_pki_name)
-            else:
-                print(f'Failed to migrate shared-secret-key on openvpn interface {interface}')
-
-            config.delete(base + [interface, 'shared-secret-key-file'])
-
-        if not config.exists(base + [interface, 'tls']):
-            continue
-
-        if config.exists(base + [interface, 'tls', 'auth-file']):
-            if not config.exists(pki_base + ['openvpn', 'shared-secret']):
-                config.set(pki_base + ['openvpn', 'shared-secret'])
-                config.set_tag(pki_base + ['openvpn', 'shared-secret'])
-
-            key_file = config.return_value(base + [interface, 'tls', 'auth-file'])
-            key = read_file_for_pki(key_file)
-            key_pki_name = f'{pki_name}_auth'
-
-            if key:
-                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
-                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
-                config.set(base + [interface, 'tls', 'auth-key'], value=key_pki_name)
-            else:
-                print(f'Failed to migrate auth-key on openvpn interface {interface}')
-
-            config.delete(base + [interface, 'tls', 'auth-file'])
-
-        if config.exists(base + [interface, 'tls', 'crypt-file']):
-            if not config.exists(pki_base + ['openvpn', 'shared-secret']):
-                config.set(pki_base + ['openvpn', 'shared-secret'])
-                config.set_tag(pki_base + ['openvpn', 'shared-secret'])
-
-            key_file = config.return_value(base + [interface, 'tls', 'crypt-file'])
-            key = read_file_for_pki(key_file)
-            key_pki_name = f'{pki_name}_crypt'
-
-            if key:
-                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
-                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
-                config.set(base + [interface, 'tls', 'crypt-key'], value=key_pki_name)
-            else:
-                print(f'Failed to migrate crypt-key on openvpn interface {interface}')
-
-            config.delete(base + [interface, 'tls', 'crypt-file'])
-
-        if config.exists(x509_base + ['ca-cert-file']):
-            if not config.exists(pki_base + ['ca']):
-                config.set(pki_base + ['ca'])
-                config.set_tag(pki_base + ['ca'])
-
-            cert_file = config.return_value(x509_base + ['ca-cert-file'])
-            cert_path = os.path.join(AUTH_DIR, cert_file)
-            cert = None
-
-            if os.path.isfile(cert_path):
-                if not os.access(cert_path, os.R_OK):
-                    run(f'sudo chmod 644 {cert_path}')
-
-                with open(cert_path, 'r') as f:
-                    cert_data = f.read()
-                    cert = load_certificate(cert_data, wrap_tags=False)
-
-            if cert:
-                cert_pem = encode_certificate(cert)
-                config.set(pki_base + ['ca', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
-                config.set(x509_base + ['ca-certificate'], value=pki_name)
-            else:
-                print(f'Failed to migrate CA certificate on openvpn interface {interface}')
-
-            config.delete(x509_base + ['ca-cert-file'])
-
-        if config.exists(x509_base + ['crl-file']):
-            if not config.exists(pki_base + ['ca']):
-                config.set(pki_base + ['ca'])
-                config.set_tag(pki_base + ['ca'])
-
-            crl_file = config.return_value(x509_base + ['crl-file'])
-            crl_path = os.path.join(AUTH_DIR, crl_file)
-            crl = None
-
-            if os.path.isfile(crl_path):
-                if not os.access(crl_path, os.R_OK):
-                    run(f'sudo chmod 644 {crl_path}')
-
-                with open(crl_path, 'r') as f:
-                    crl_data = f.read()
-                    crl = load_crl(crl_data, wrap_tags=False)
-
-            if crl:
-                crl_pem = encode_certificate(crl)
-                config.set(pki_base + ['ca', pki_name, 'crl'], value=wrapped_pem_to_config_value(crl_pem))
-            else:
-                print(f'Failed to migrate CRL on openvpn interface {interface}')
-
-            config.delete(x509_base + ['crl-file'])
-
-        if config.exists(x509_base + ['cert-file']):
-            if not config.exists(pki_base + ['certificate']):
-                config.set(pki_base + ['certificate'])
-                config.set_tag(pki_base + ['certificate'])
-
-            cert_file = config.return_value(x509_base + ['cert-file'])
-            cert_path = os.path.join(AUTH_DIR, cert_file)
-            cert = None
-
-            if os.path.isfile(cert_path):
-                if not os.access(cert_path, os.R_OK):
-                    run(f'sudo chmod 644 {cert_path}')
-
-                with open(cert_path, 'r') as f:
-                    cert_data = f.read()
-                    cert = load_certificate(cert_data, wrap_tags=False)
-
-            if cert:
-                cert_pem = encode_certificate(cert)
-                config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
-                config.set(x509_base + ['certificate'], value=pki_name)
-            else:
-                print(f'Failed to migrate certificate on openvpn interface {interface}')
-
-            config.delete(x509_base + ['cert-file'])
-
-        if config.exists(x509_base + ['key-file']):
-            key_file = config.return_value(x509_base + ['key-file'])
-            key_path = os.path.join(AUTH_DIR, key_file)
-            key = None
-
-            if os.path.isfile(key_path):
-                if not os.access(key_path, os.R_OK):
-                    run(f'sudo chmod 644 {key_path}')
-
-                with open(key_path, 'r') as f:
-                    key_data = f.read()
-                    key = load_private_key(key_data, passphrase=None, wrap_tags=False)
-
-            if key:
-                key_pem = encode_private_key(key, passphrase=None)
-                config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem))
-            else:
-                print(f'Failed to migrate private key on openvpn interface {interface}')
-                
-            config.delete(x509_base + ['key-file'])
-
-        if config.exists(x509_base + ['dh-file']):
-            if not config.exists(pki_base + ['dh']):
-                config.set(pki_base + ['dh'])
-                config.set_tag(pki_base + ['dh'])
-
-            dh_file = config.return_value(x509_base + ['dh-file'])
-            dh_path = os.path.join(AUTH_DIR, dh_file)
-            dh = None
-
-            if os.path.isfile(dh_path):
-                if not os.access(dh_path, os.R_OK):
-                    run(f'sudo chmod 644 {dh_path}')
-
-                with open(dh_path, 'r') as f:
-                    dh_data = f.read()
-                    dh = load_dh_parameters(dh_data, wrap_tags=False)
-
-            if dh:
-                dh_pem = encode_dh_parameters(dh)
-                config.set(pki_base + ['dh', pki_name, 'parameters'], value=wrapped_pem_to_config_value(dh_pem))
-                config.set(x509_base + ['dh-params'], value=pki_name)
-            else:
-                print(f'Failed to migrate DH parameters on openvpn interface {interface}')
-
-            config.delete(x509_base + ['dh-file'])
-
-# Wireguard
-base = ['interfaces', 'wireguard']
-
-if config.exists(base):
-    for interface in config.list_nodes(base):
-        private_key_path = base + [interface, 'private-key']
-        
-        key_file = 'default'
-        if config.exists(private_key_path):
-            key_file = config.return_value(private_key_path)
-
-        full_key_path = f'/config/auth/wireguard/{key_file}/private.key'
-
-        if not os.path.exists(full_key_path):
-            print(f'Could not find wireguard private key for migration on interface "{interface}"')
-            continue
-
-        with open(full_key_path, 'r') as f:
-            key_data = f.read().strip()
-            config.set(private_key_path, value=key_data)
-
-        for peer in config.list_nodes(base + [interface, 'peer']):
-            config.rename(base + [interface, 'peer', peer, 'pubkey'], 'public-key')
-
-# Ethernet EAPoL
-base = ['interfaces', 'ethernet']
-
-if config.exists(base):
+    ipsec_base = ['vpn', 'ipsec', 'site-to-site', 'peer']
     for interface in config.list_nodes(base):
-        if not config.exists(base + [interface, 'eapol']):
-            continue
-
-        x509_base = base + [interface, 'eapol']
-        pki_name = f'eapol_{interface}'
-
-        if config.exists(x509_base + ['ca-cert-file']):
-            if not config.exists(pki_base + ['ca']):
-                config.set(pki_base + ['ca'])
-                config.set_tag(pki_base + ['ca'])
-
-            cert_file = config.return_value(x509_base + ['ca-cert-file'])
-            cert_path = os.path.join(AUTH_DIR, cert_file)
-            cert = None
-
-            if os.path.isfile(cert_path):
-                if not os.access(cert_path, os.R_OK):
-                    run(f'sudo chmod 644 {cert_path}')
-
-                with open(cert_path, 'r') as f:
-                    cert_data = f.read()
-                    cert = load_certificate(cert_data, wrap_tags=False)
-
-            if cert:
-                cert_pem = encode_certificate(cert)
-                config.set(pki_base + ['ca', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
-                config.set(x509_base + ['ca-certificate'], value=pki_name)
-            else:
-                print(f'Failed to migrate CA certificate on eapol config for interface {interface}')
-
-            config.delete(x509_base + ['ca-cert-file'])
-
-        if config.exists(x509_base + ['cert-file']):
-            if not config.exists(pki_base + ['certificate']):
-                config.set(pki_base + ['certificate'])
-                config.set_tag(pki_base + ['certificate'])
-
-            cert_file = config.return_value(x509_base + ['cert-file'])
-            cert_path = os.path.join(AUTH_DIR, cert_file)
-            cert = None
-
-            if os.path.isfile(cert_path):
-                if not os.access(cert_path, os.R_OK):
-                    run(f'sudo chmod 644 {cert_path}')
-
-                with open(cert_path, 'r') as f:
-                    cert_data = f.read()
-                    cert = load_certificate(cert_data, wrap_tags=False)
-
-            if cert:
-                cert_pem = encode_certificate(cert)
-                config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
-                config.set(x509_base + ['certificate'], value=pki_name)
-            else:
-                print(f'Failed to migrate certificate on eapol config for interface {interface}')
-
-            config.delete(x509_base + ['cert-file'])
-
-        if config.exists(x509_base + ['key-file']):
-            key_file = config.return_value(x509_base + ['key-file'])
-            key_path = os.path.join(AUTH_DIR, key_file)
-            key = None
-
-            if os.path.isfile(key_path):
-                if not os.access(key_path, os.R_OK):
-                    run(f'sudo chmod 644 {key_path}')
-
-                with open(key_path, 'r') as f:
-                    key_data = f.read()
-                    key = load_private_key(key_data, passphrase=None, wrap_tags=False)
-
-            if key:
-                key_pem = encode_private_key(key, passphrase=None)
-                config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem))
-            else:
-                print(f'Failed to migrate private key on eapol config for interface {interface}')
-                
-            config.delete(x509_base + ['key-file'])
-
-try:
-    with open(file_name, 'w') as f:
-        f.write(config.to_string())
-except OSError as e:
-    print("Failed to save the modified config: {}".format(e))
-    sys.exit(1)
+        found = False
+        if config.exists(ipsec_base):
+            for peer in config.list_nodes(ipsec_base):
+                if config.exists(ipsec_base + [peer, 'vti', 'bind']):
+                    tmp = config.return_value(ipsec_base + [peer, 'vti', 'bind'])
+                    if tmp == interface:
+                        # Interface was found and we no longer need to search
+                        # for it in our IPSec peers
+                        found = True
+                        break
+        if not found:
+            config.delete(base + [interface])
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        sys.exit(1)
diff --git a/src/migration-scripts/interfaces/24-to-25 b/src/migration-scripts/interfaces/24-to-25
new file mode 100755
index 000000000..93ce9215f
--- /dev/null
+++ b/src/migration-scripts/interfaces/24-to-25
@@ -0,0 +1,369 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Migrate Wireguard to store keys in CLI
+# Migrate EAPoL to PKI configuration
+
+import os
+import sys
+from vyos.configtree import ConfigTree
+from vyos.pki import load_certificate
+from vyos.pki import load_crl
+from vyos.pki import load_dh_parameters
+from vyos.pki import load_private_key
+from vyos.pki import encode_certificate
+from vyos.pki import encode_dh_parameters
+from vyos.pki import encode_private_key
+from vyos.util import run
+
+def wrapped_pem_to_config_value(pem):
+    out = []
+    for line in pem.strip().split("\n"):
+        if not line or line.startswith("-----") or line[0] == '#':
+            continue
+        out.append(line)
+    return "".join(out)
+
+def read_file_for_pki(config_auth_path):
+    full_path = os.path.join(AUTH_DIR, config_auth_path)
+    output = None
+
+    if os.path.isfile(full_path):
+        if not os.access(full_path, os.R_OK):
+            run(f'sudo chmod 644 {full_path}')
+
+        with open(full_path, 'r') as f:
+            output = f.read()
+
+    return output
+
+if (len(sys.argv) < 1):
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+AUTH_DIR = '/config/auth'
+pki_base = ['pki']
+
+# OpenVPN
+base = ['interfaces', 'openvpn']
+
+if config.exists(base):
+    for interface in config.list_nodes(base):
+        x509_base = base + [interface, 'tls']
+        pki_name = f'openvpn_{interface}'
+
+        if config.exists(base + [interface, 'shared-secret-key-file']):
+            if not config.exists(pki_base + ['openvpn', 'shared-secret']):
+                config.set(pki_base + ['openvpn', 'shared-secret'])
+                config.set_tag(pki_base + ['openvpn', 'shared-secret'])
+
+            key_file = config.return_value(base + [interface, 'shared-secret-key-file'])
+            key = read_file_for_pki(key_file)
+            key_pki_name = f'{pki_name}_shared'
+
+            if key:
+                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
+                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
+                config.set(base + [interface, 'shared-secret-key'], value=key_pki_name)
+            else:
+                print(f'Failed to migrate shared-secret-key on openvpn interface {interface}')
+
+            config.delete(base + [interface, 'shared-secret-key-file'])
+
+        if not config.exists(base + [interface, 'tls']):
+            continue
+
+        if config.exists(base + [interface, 'tls', 'auth-file']):
+            if not config.exists(pki_base + ['openvpn', 'shared-secret']):
+                config.set(pki_base + ['openvpn', 'shared-secret'])
+                config.set_tag(pki_base + ['openvpn', 'shared-secret'])
+
+            key_file = config.return_value(base + [interface, 'tls', 'auth-file'])
+            key = read_file_for_pki(key_file)
+            key_pki_name = f'{pki_name}_auth'
+
+            if key:
+                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
+                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
+                config.set(base + [interface, 'tls', 'auth-key'], value=key_pki_name)
+            else:
+                print(f'Failed to migrate auth-key on openvpn interface {interface}')
+
+            config.delete(base + [interface, 'tls', 'auth-file'])
+
+        if config.exists(base + [interface, 'tls', 'crypt-file']):
+            if not config.exists(pki_base + ['openvpn', 'shared-secret']):
+                config.set(pki_base + ['openvpn', 'shared-secret'])
+                config.set_tag(pki_base + ['openvpn', 'shared-secret'])
+
+            key_file = config.return_value(base + [interface, 'tls', 'crypt-file'])
+            key = read_file_for_pki(key_file)
+            key_pki_name = f'{pki_name}_crypt'
+
+            if key:
+                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'key'], value=wrapped_pem_to_config_value(key))
+                config.set(pki_base + ['openvpn', 'shared-secret', key_pki_name, 'version'], value='1')
+                config.set(base + [interface, 'tls', 'crypt-key'], value=key_pki_name)
+            else:
+                print(f'Failed to migrate crypt-key on openvpn interface {interface}')
+
+            config.delete(base + [interface, 'tls', 'crypt-file'])
+
+        if config.exists(x509_base + ['ca-cert-file']):
+            if not config.exists(pki_base + ['ca']):
+                config.set(pki_base + ['ca'])
+                config.set_tag(pki_base + ['ca'])
+
+            cert_file = config.return_value(x509_base + ['ca-cert-file'])
+            cert_path = os.path.join(AUTH_DIR, cert_file)
+            cert = None
+
+            if os.path.isfile(cert_path):
+                if not os.access(cert_path, os.R_OK):
+                    run(f'sudo chmod 644 {cert_path}')
+
+                with open(cert_path, 'r') as f:
+                    cert_data = f.read()
+                    cert = load_certificate(cert_data, wrap_tags=False)
+
+            if cert:
+                cert_pem = encode_certificate(cert)
+                config.set(pki_base + ['ca', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
+                config.set(x509_base + ['ca-certificate'], value=pki_name)
+            else:
+                print(f'Failed to migrate CA certificate on openvpn interface {interface}')
+
+            config.delete(x509_base + ['ca-cert-file'])
+
+        if config.exists(x509_base + ['crl-file']):
+            if not config.exists(pki_base + ['ca']):
+                config.set(pki_base + ['ca'])
+                config.set_tag(pki_base + ['ca'])
+
+            crl_file = config.return_value(x509_base + ['crl-file'])
+            crl_path = os.path.join(AUTH_DIR, crl_file)
+            crl = None
+
+            if os.path.isfile(crl_path):
+                if not os.access(crl_path, os.R_OK):
+                    run(f'sudo chmod 644 {crl_path}')
+
+                with open(crl_path, 'r') as f:
+                    crl_data = f.read()
+                    crl = load_crl(crl_data, wrap_tags=False)
+
+            if crl:
+                crl_pem = encode_certificate(crl)
+                config.set(pki_base + ['ca', pki_name, 'crl'], value=wrapped_pem_to_config_value(crl_pem))
+            else:
+                print(f'Failed to migrate CRL on openvpn interface {interface}')
+
+            config.delete(x509_base + ['crl-file'])
+
+        if config.exists(x509_base + ['cert-file']):
+            if not config.exists(pki_base + ['certificate']):
+                config.set(pki_base + ['certificate'])
+                config.set_tag(pki_base + ['certificate'])
+
+            cert_file = config.return_value(x509_base + ['cert-file'])
+            cert_path = os.path.join(AUTH_DIR, cert_file)
+            cert = None
+
+            if os.path.isfile(cert_path):
+                if not os.access(cert_path, os.R_OK):
+                    run(f'sudo chmod 644 {cert_path}')
+
+                with open(cert_path, 'r') as f:
+                    cert_data = f.read()
+                    cert = load_certificate(cert_data, wrap_tags=False)
+
+            if cert:
+                cert_pem = encode_certificate(cert)
+                config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
+                config.set(x509_base + ['certificate'], value=pki_name)
+            else:
+                print(f'Failed to migrate certificate on openvpn interface {interface}')
+
+            config.delete(x509_base + ['cert-file'])
+
+        if config.exists(x509_base + ['key-file']):
+            key_file = config.return_value(x509_base + ['key-file'])
+            key_path = os.path.join(AUTH_DIR, key_file)
+            key = None
+
+            if os.path.isfile(key_path):
+                if not os.access(key_path, os.R_OK):
+                    run(f'sudo chmod 644 {key_path}')
+
+                with open(key_path, 'r') as f:
+                    key_data = f.read()
+                    key = load_private_key(key_data, passphrase=None, wrap_tags=False)
+
+            if key:
+                key_pem = encode_private_key(key, passphrase=None)
+                config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem))
+            else:
+                print(f'Failed to migrate private key on openvpn interface {interface}')
+                
+            config.delete(x509_base + ['key-file'])
+
+        if config.exists(x509_base + ['dh-file']):
+            if not config.exists(pki_base + ['dh']):
+                config.set(pki_base + ['dh'])
+                config.set_tag(pki_base + ['dh'])
+
+            dh_file = config.return_value(x509_base + ['dh-file'])
+            dh_path = os.path.join(AUTH_DIR, dh_file)
+            dh = None
+
+            if os.path.isfile(dh_path):
+                if not os.access(dh_path, os.R_OK):
+                    run(f'sudo chmod 644 {dh_path}')
+
+                with open(dh_path, 'r') as f:
+                    dh_data = f.read()
+                    dh = load_dh_parameters(dh_data, wrap_tags=False)
+
+            if dh:
+                dh_pem = encode_dh_parameters(dh)
+                config.set(pki_base + ['dh', pki_name, 'parameters'], value=wrapped_pem_to_config_value(dh_pem))
+                config.set(x509_base + ['dh-params'], value=pki_name)
+            else:
+                print(f'Failed to migrate DH parameters on openvpn interface {interface}')
+
+            config.delete(x509_base + ['dh-file'])
+
+# Wireguard
+base = ['interfaces', 'wireguard']
+
+if config.exists(base):
+    for interface in config.list_nodes(base):
+        private_key_path = base + [interface, 'private-key']
+        
+        key_file = 'default'
+        if config.exists(private_key_path):
+            key_file = config.return_value(private_key_path)
+
+        full_key_path = f'/config/auth/wireguard/{key_file}/private.key'
+
+        if not os.path.exists(full_key_path):
+            print(f'Could not find wireguard private key for migration on interface "{interface}"')
+            continue
+
+        with open(full_key_path, 'r') as f:
+            key_data = f.read().strip()
+            config.set(private_key_path, value=key_data)
+
+        for peer in config.list_nodes(base + [interface, 'peer']):
+            config.rename(base + [interface, 'peer', peer, 'pubkey'], 'public-key')
+
+# Ethernet EAPoL
+base = ['interfaces', 'ethernet']
+
+if config.exists(base):
+    for interface in config.list_nodes(base):
+        if not config.exists(base + [interface, 'eapol']):
+            continue
+
+        x509_base = base + [interface, 'eapol']
+        pki_name = f'eapol_{interface}'
+
+        if config.exists(x509_base + ['ca-cert-file']):
+            if not config.exists(pki_base + ['ca']):
+                config.set(pki_base + ['ca'])
+                config.set_tag(pki_base + ['ca'])
+
+            cert_file = config.return_value(x509_base + ['ca-cert-file'])
+            cert_path = os.path.join(AUTH_DIR, cert_file)
+            cert = None
+
+            if os.path.isfile(cert_path):
+                if not os.access(cert_path, os.R_OK):
+                    run(f'sudo chmod 644 {cert_path}')
+
+                with open(cert_path, 'r') as f:
+                    cert_data = f.read()
+                    cert = load_certificate(cert_data, wrap_tags=False)
+
+            if cert:
+                cert_pem = encode_certificate(cert)
+                config.set(pki_base + ['ca', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
+                config.set(x509_base + ['ca-certificate'], value=pki_name)
+            else:
+                print(f'Failed to migrate CA certificate on eapol config for interface {interface}')
+
+            config.delete(x509_base + ['ca-cert-file'])
+
+        if config.exists(x509_base + ['cert-file']):
+            if not config.exists(pki_base + ['certificate']):
+                config.set(pki_base + ['certificate'])
+                config.set_tag(pki_base + ['certificate'])
+
+            cert_file = config.return_value(x509_base + ['cert-file'])
+            cert_path = os.path.join(AUTH_DIR, cert_file)
+            cert = None
+
+            if os.path.isfile(cert_path):
+                if not os.access(cert_path, os.R_OK):
+                    run(f'sudo chmod 644 {cert_path}')
+
+                with open(cert_path, 'r') as f:
+                    cert_data = f.read()
+                    cert = load_certificate(cert_data, wrap_tags=False)
+
+            if cert:
+                cert_pem = encode_certificate(cert)
+                config.set(pki_base + ['certificate', pki_name, 'certificate'], value=wrapped_pem_to_config_value(cert_pem))
+                config.set(x509_base + ['certificate'], value=pki_name)
+            else:
+                print(f'Failed to migrate certificate on eapol config for interface {interface}')
+
+            config.delete(x509_base + ['cert-file'])
+
+        if config.exists(x509_base + ['key-file']):
+            key_file = config.return_value(x509_base + ['key-file'])
+            key_path = os.path.join(AUTH_DIR, key_file)
+            key = None
+
+            if os.path.isfile(key_path):
+                if not os.access(key_path, os.R_OK):
+                    run(f'sudo chmod 644 {key_path}')
+
+                with open(key_path, 'r') as f:
+                    key_data = f.read()
+                    key = load_private_key(key_data, passphrase=None, wrap_tags=False)
+
+            if key:
+                key_pem = encode_private_key(key, passphrase=None)
+                config.set(pki_base + ['certificate', pki_name, 'private', 'key'], value=wrapped_pem_to_config_value(key_pem))
+            else:
+                print(f'Failed to migrate private key on eapol config for interface {interface}')
+                
+            config.delete(x509_base + ['key-file'])
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    sys.exit(1)
diff --git a/src/op_mode/generate_ipsec_debug_archive.sh b/src/op_mode/generate_ipsec_debug_archive.sh
new file mode 100755
index 000000000..53d0a6eaa
--- /dev/null
+++ b/src/op_mode/generate_ipsec_debug_archive.sh
@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+
+# Collecting IPSec Debug Information
+
+DATE=`date +%d-%m-%Y`
+
+a_CMD=(
+       "sudo ipsec status"
+       "sudo swanctl -L"
+       "sudo swanctl -l"
+       "sudo swanctl -P"
+       "sudo ip x sa show"
+       "sudo ip x policy show"
+       "sudo ip tunnel show"
+       "sudo ip address"
+       "sudo ip rule show"
+       "sudo ip route"
+       "sudo ip route show table 220"
+      )
+
+
+echo "DEBUG: ${DATE} on host \"$(hostname)\"" > /tmp/ipsec-status-${DATE}.txt
+date >> /tmp/ipsec-status-${DATE}.txt
+
+# Execute all DEBUG commands and save it to file
+for cmd in "${a_CMD[@]}"; do
+    echo -e "\n### ${cmd} ###" >> /tmp/ipsec-status-${DATE}.txt
+    ${cmd} >> /tmp/ipsec-status-${DATE}.txt 2>/dev/null
+done
+
+# Collect charon logs, build .tgz archive
+sudo journalctl /usr/lib/ipsec/charon > /tmp/journalctl-charon-${DATE}.txt && \
+sudo tar -zcvf /tmp/ipsec-debug-${DATE}.tgz /tmp/journalctl-charon-${DATE}.txt /tmp/ipsec-status-${DATE}.txt >& /dev/null
+sudo rm -f /tmp/journalctl-charon-${DATE}.txt /tmp/ipsec-status-${DATE}.txt
+
+echo "Debug file is generated and located in /tmp/ipsec-debug-${DATE}.tgz"
diff --git a/src/op_mode/show_ipsec_sa.py b/src/op_mode/show_ipsec_sa.py
index c964caaeb..e72f0f965 100755
--- a/src/op_mode/show_ipsec_sa.py
+++ b/src/op_mode/show_ipsec_sa.py
@@ -46,7 +46,6 @@ def format_output(conns, sas):
 
         if parent_sa["state"] == b"ESTABLISHED" and installed_sas:
             state = "up"
-            uptime = vyos.util.seconds_to_human(parent_sa["established"].decode())
 
         remote_host = parent_sa["remote-host"].decode()
         remote_id = parent_sa["remote-id"].decode()
@@ -75,6 +74,8 @@ def format_output(conns, sas):
             # Remove B from <1K values
             pkts_str = re.sub(r'B', r'', pkts_str)
 
+            uptime = vyos.util.seconds_to_human(isa['install-time'].decode())
+
             enc = isa["encr-alg"].decode()
             if "encr-keysize" in isa:
                 key_size = isa["encr-keysize"].decode()
diff --git a/src/op_mode/show_openvpn_mfa.py b/src/op_mode/show_openvpn_mfa.py
new file mode 100755
index 000000000..1ab54600c
--- /dev/null
+++ b/src/op_mode/show_openvpn_mfa.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+
+# Copyright 2017, 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+import socket
+import urllib.parse
+import argparse
+
+from vyos.util import popen
+
+otp_file = '/config/auth/openvpn/{interface}-otp-secrets'
+
+def get_mfa_secret(interface, client):
+    try:
+        with open(otp_file.format(interface=interface), "r") as f:
+            users = f.readlines()
+            for user in users:
+                if re.search('^' + client + ' ', user):
+                    return user.split(':')[3]
+    except:
+        pass
+
+def get_mfa_uri(client, secret):
+    hostname = socket.gethostname()
+    fqdn = socket.getfqdn()
+    uri = 'otpauth://totp/{hostname}:{client}@{fqdn}?secret={secret}'
+
+    return urllib.parse.quote(uri.format(hostname=hostname, client=client, fqdn=fqdn, secret=secret), safe='/:@?=')
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(add_help=False, description='Show two-factor authentication information')
+    parser.add_argument('--intf', action="store", type=str, default='', help='only show the specified interface')
+    parser.add_argument('--user', action="store", type=str, default='', help='only show the specified users')
+    parser.add_argument('--action', action="store", type=str, default='show', help='action to perform')
+
+    args = parser.parse_args()
+    secret = get_mfa_secret(args.intf, args.user)
+
+    if args.action == "secret" and secret:
+        print(secret)
+
+    if args.action == "uri" and secret:
+        uri = get_mfa_uri(args.user, secret)
+        print(uri)
+
+    if args.action == "qrcode" and secret:
+        uri = get_mfa_uri(args.user, secret)
+        qrcode,err = popen('qrencode -t ansiutf8', input=uri)
+        print(qrcode)
+
diff --git a/src/op_mode/show_ram.py b/src/op_mode/show_ram.py
new file mode 100755
index 000000000..5818ec132
--- /dev/null
+++ b/src/op_mode/show_ram.py
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+def get_system_memory():
+    from re import search as re_search
+
+    def find_value(keyword, mem_data):
+        regex = keyword + ':\s+(\d+)'
+        res = re_search(regex, mem_data).group(1)
+        return int(res)
+
+    with open("/proc/meminfo", "r") as f:
+        mem_data = f.read()
+
+    total     = find_value('MemTotal', mem_data)
+    available = find_value('MemAvailable', mem_data)
+    buffers   = find_value('Buffers', mem_data)
+    cached    = find_value('Cached', mem_data)
+
+    used = total - available
+
+    res = {
+      "total":   total,
+      "free":    available,
+      "used":    used,
+      "buffers": buffers,
+      "cached":  cached
+    }
+
+    return res
+
+def get_system_memory_human():
+    from vyos.util import bytes_to_human
+
+    mem = get_system_memory()
+
+    for key in mem:
+        # The Linux kernel exposes memory values in kilobytes,
+        # so we need to normalize them
+        mem[key] = bytes_to_human(mem[key], initial_exponent=10)
+
+    return mem
+
+if __name__ == '__main__':
+    mem = get_system_memory_human()
+
+    print("Total: {}".format(mem["total"]))
+    print("Free:  {}".format(mem["free"]))
+    print("Used:  {}".format(mem["used"]))
+
diff --git a/src/op_mode/show_ram.sh b/src/op_mode/show_ram.sh
deleted file mode 100755
index b013e16f8..000000000
--- a/src/op_mode/show_ram.sh
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/bin/bash
-#
-# Module: vyos-show-ram.sh
-# Displays memory usage information in minimalistic format
-#
-# Copyright (C) 2019 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-MB_DIVISOR=1024
-
-TOTAL=$(cat /proc/meminfo | grep -E "^MemTotal:" | awk -F ' ' '{print $2}')
-FREE=$(cat /proc/meminfo | grep -E "^MemFree:" | awk -F ' ' '{print $2}')
-BUFFERS=$(cat /proc/meminfo | grep -E "^Buffers:" | awk -F ' ' '{print $2}')
-CACHED=$(cat /proc/meminfo | grep -E "^Cached:" | awk -F ' ' '{print $2}')
-
-DISPLAY_FREE=$(( ($FREE + $BUFFERS + $CACHED) / $MB_DIVISOR ))
-DISPLAY_TOTAL=$(( $TOTAL / $MB_DIVISOR ))
-DISPLAY_USED=$(( $DISPLAY_TOTAL - $DISPLAY_FREE ))
-
-echo "Total: $DISPLAY_TOTAL"
-echo "Free:  $DISPLAY_FREE"
-echo "Used:  $DISPLAY_USED"
diff --git a/src/op_mode/show_uptime.py b/src/op_mode/show_uptime.py
new file mode 100755
index 000000000..c3dea52e6
--- /dev/null
+++ b/src/op_mode/show_uptime.py
@@ -0,0 +1,50 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+def get_uptime_seconds():
+  from re import search
+  from vyos.util import read_file
+
+  data = read_file("/proc/uptime")
+  seconds = search("([0-9\.]+)\s", data).group(1)
+
+  return int(float(seconds))
+
+def get_load_averages():
+    from re import search
+    from vyos.util import cmd
+
+    data = cmd("uptime")
+    matches = search(r"load average:\s*(?P<one>[0-9\.]+)\s*,\s*(?P<five>[0-9\.]+)\s*,\s*(?P<fifteen>[0-9\.]+)\s*", data)
+
+    res = {}
+    res[1]  = float(matches["one"])
+    res[5]  = float(matches["five"])
+    res[15] = float(matches["fifteen"])
+
+    return res
+
+if __name__ == '__main__':
+    from vyos.util import seconds_to_human
+
+    print("Uptime: {}\n".format(seconds_to_human(get_uptime_seconds())))
+
+    avgs = get_load_averages()
+
+    print("Load averages:")
+    print("1  minute:   {:.02f}%".format(avgs[1]*100))
+    print("5  minutes:  {:.02f}%".format(avgs[5]*100))
+    print("15 minutes:  {:.02f}%".format(avgs[15]*100))
diff --git a/src/op_mode/vpn_ipsec.py b/src/op_mode/vpn_ipsec.py
index 06e227ccf..40854fa8f 100755
--- a/src/op_mode/vpn_ipsec.py
+++ b/src/op_mode/vpn_ipsec.py
@@ -48,7 +48,7 @@ def reset_peer(peer, tunnel):
     result = True
     for conn in conns:
         try:
-            call(f'sudo /usr/sbin/ipsec down {conn}', timeout = 10)
+            call(f'sudo /usr/sbin/ipsec down {conn}{{*}}', timeout = 10)
             call(f'sudo /usr/sbin/ipsec up {conn}', timeout = 10)
         except TimeoutExpired as e:
             print(f'Timed out while resetting {conn}')
diff --git a/src/services/vyos-hostsd b/src/services/vyos-hostsd
index 4c4bb036e..f4b1d0fc2 100755
--- a/src/services/vyos-hostsd
+++ b/src/services/vyos-hostsd
@@ -317,7 +317,7 @@ hosts_add_schema = op_type_schema.extend({
     'data': {
         str: {
             str: {
-            'address': str,
+            'address': [str],
             'aliases': [str]
                 }
             }
diff --git a/src/systemd/dhcp6c@.service b/src/systemd/dhcp6c@.service
index fdd6d7d88..9a97ee261 100644
--- a/src/systemd/dhcp6c@.service
+++ b/src/systemd/dhcp6c@.service
@@ -9,7 +9,7 @@ StartLimitIntervalSec=0
 WorkingDirectory=/run/dhcp6c
 Type=forking
 PIDFile=/run/dhcp6c/dhcp6c.%i.pid
-ExecStart=/usr/sbin/dhcp6c -k /run/dhcp6c/dhcp6c.%i.sock -c /run/dhcp6c/dhcp6c.%i.conf -p /run/dhcp6c/dhcp6c.%i.pid %i
+ExecStart=/usr/sbin/dhcp6c -D -k /run/dhcp6c/dhcp6c.%i.sock -c /run/dhcp6c/dhcp6c.%i.conf -p /run/dhcp6c/dhcp6c.%i.pid %i
 Restart=on-failure
 RestartSec=20
 
diff --git a/src/validators/bgp-large-community-list b/src/validators/bgp-large-community-list
index c07268e81..80112dfdc 100755
--- a/src/validators/bgp-large-community-list
+++ b/src/validators/bgp-large-community-list
@@ -30,7 +30,7 @@ if __name__ == '__main__':
         sys.exit(1)
 
     if not (re.match(pattern, sys.argv[1]) and
-           (is_ipv4(value[0]) or value[0].isdigit()) and value[1].isdigit()):
+           (is_ipv4(value[0]) or value[0].isdigit()) and (value[1].isdigit() or value[1] == '*')):
         sys.exit(1)
 
     sys.exit(0)