Merge branch 'vyos:current' into current

38 files changed, 976 insertions, 212 deletions

diff --git a/src/conf_mode/dns_forwarding.py b/src/conf_mode/dns_forwarding.py
index 06366362a..23a16df63 100755
--- a/src/conf_mode/dns_forwarding.py
+++ b/src/conf_mode/dns_forwarding.py
@@ -17,6 +17,7 @@
 import os
 
 from sys import exit
+from glob import glob
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
@@ -50,10 +51,12 @@ def get_config(config=None):
     if not conf.exists(base):
         return None
 
-    dns = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
+    dns = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True, no_tag_node_value_mangle=True)
     # We have gathered the dict representation of the CLI, but there are default
-    # options which we need to update into the dictionary retrived.
+    # options which we need to update into the dictionary retrieved.
     default_values = defaults(base)
+    # T2665 due to how defaults under tag nodes work, we must clear these out before we merge
+    del default_values['authoritative_domain']
     dns = dict_merge(default_values, dns)
 
     # some additions to the default dictionary
@@ -66,6 +69,183 @@ def get_config(config=None):
         if conf.exists(base_nameservers_dhcp):
             dns.update({'system_name_server_dhcp': conf.return_values(base_nameservers_dhcp)})
 
+    if 'authoritative_domain' in dns:
+        dns['authoritative_zones'] = []
+        dns['authoritative_zone_errors'] = []
+        for node in dns['authoritative_domain']:
+            zonedata = dns['authoritative_domain'][node]
+            if ('disable' in zonedata) or (not 'records' in zonedata):
+                continue
+            zone = {
+                'name': node,
+                'file': "{}/zone.{}.conf".format(pdns_rec_run_dir, node),
+                'records': [],
+            }
+
+            recorddata = zonedata['records']
+
+            for rtype in [ 'a', 'aaaa', 'cname', 'mx', 'ptr', 'txt', 'spf', 'srv', 'naptr' ]:
+                if rtype not in recorddata:
+                    continue
+                for subnode in recorddata[rtype]:
+                    if 'disable' in recorddata[rtype][subnode]:
+                        continue
+
+                    rdata = recorddata[rtype][subnode]
+
+                    if rtype in [ 'a', 'aaaa' ]:
+                        rdefaults = defaults(base + ['authoritative-domain', 'records', rtype]) # T2665
+                        rdata = dict_merge(rdefaults, rdata)
+
+                        if not 'address' in rdata:
+                            dns['authoritative_zone_errors'].append('{}.{}: at least one address is required'.format(subnode, node))
+                            continue
+
+                        for address in rdata['address']:
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': address
+                            })
+                    elif rtype in ['cname', 'ptr']:
+                        rdefaults = defaults(base + ['authoritative-domain', 'records', rtype]) # T2665
+                        rdata = dict_merge(rdefaults, rdata)
+
+                        if not 'target' in rdata:
+                            dns['authoritative_zone_errors'].append('{}.{}: target is required'.format(subnode, node))
+                            continue
+
+                        zone['records'].append({
+                            'name': subnode,
+                            'type': rtype.upper(),
+                            'ttl': rdata['ttl'],
+                            'value': '{}.'.format(rdata['target'])
+                        })
+                    elif rtype == 'mx':
+                        rdefaults = defaults(base + ['authoritative-domain', 'records', rtype]) # T2665
+                        del rdefaults['server']
+                        rdata = dict_merge(rdefaults, rdata)
+
+                        if not 'server' in rdata:
+                            dns['authoritative_zone_errors'].append('{}.{}: at least one server is required'.format(subnode, node))
+                            continue
+
+                        for servername in rdata['server']:
+                            serverdata = rdata['server'][servername]
+                            serverdefaults = defaults(base + ['authoritative-domain', 'records', rtype, 'server']) # T2665
+                            serverdata = dict_merge(serverdefaults, serverdata)
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': '{} {}.'.format(serverdata['priority'], servername)
+                            })
+                    elif rtype == 'txt':
+                        rdefaults = defaults(base + ['authoritative-domain', 'records', rtype]) # T2665
+                        rdata = dict_merge(rdefaults, rdata)
+
+                        if not 'value' in rdata:
+                            dns['authoritative_zone_errors'].append('{}.{}: at least one value is required'.format(subnode, node))
+                            continue
+
+                        for value in rdata['value']:
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': "\"{}\"".format(value.replace("\"", "\\\""))
+                            })
+                    elif rtype == 'spf':
+                        rdefaults = defaults(base + ['authoritative-domain', 'records', rtype]) # T2665
+                        rdata = dict_merge(rdefaults, rdata)
+
+                        if not 'value' in rdata:
+                            dns['authoritative_zone_errors'].append('{}.{}: value is required'.format(subnode, node))
+                            continue
+
+                        zone['records'].append({
+                            'name': subnode,
+                            'type': rtype.upper(),
+                            'ttl': rdata['ttl'],
+                            'value': '"{}"'.format(rdata['value'].replace("\"", "\\\""))
+                        })
+                    elif rtype == 'srv':
+                        rdefaults = defaults(base + ['authoritative-domain', 'records', rtype]) # T2665
+                        del rdefaults['entry']
+                        rdata = dict_merge(rdefaults, rdata)
+
+                        if not 'entry' in rdata:
+                            dns['authoritative_zone_errors'].append('{}.{}: at least one entry is required'.format(subnode, node))
+                            continue
+
+                        for entryno in rdata['entry']:
+                            entrydata = rdata['entry'][entryno]
+                            entrydefaults = defaults(base + ['authoritative-domain', 'records', rtype, 'entry']) # T2665
+                            entrydata = dict_merge(entrydefaults, entrydata)
+
+                            if not 'hostname' in entrydata:
+                                dns['authoritative_zone_errors'].append('{}.{}: hostname is required for entry {}'.format(subnode, node, entryno))
+                                continue
+
+                            if not 'port' in entrydata:
+                                dns['authoritative_zone_errors'].append('{}.{}: port is required for entry {}'.format(subnode, node, entryno))
+                                continue
+
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': '{} {} {} {}.'.format(entrydata['priority'], entrydata['weight'], entrydata['port'], entrydata['hostname'])
+                            })
+                    elif rtype == 'naptr':
+                        rdefaults = defaults(base + ['authoritative-domain', 'records', rtype]) # T2665
+                        del rdefaults['rule']
+                        rdata = dict_merge(rdefaults, rdata)
+
+
+                        if not 'rule' in rdata:
+                            dns['authoritative_zone_errors'].append('{}.{}: at least one rule is required'.format(subnode, node))
+                            continue
+
+                        for ruleno in rdata['rule']:
+                            ruledata = rdata['rule'][ruleno]
+                            ruledefaults = defaults(base + ['authoritative-domain', 'records', rtype, 'rule']) # T2665
+                            ruledata = dict_merge(ruledefaults, ruledata)
+                            flags = ""
+                            if 'lookup-srv' in ruledata:
+                                flags += "S"
+                            if 'lookup-a' in ruledata:
+                                flags += "A"
+                            if 'resolve-uri' in ruledata:
+                                flags += "U"
+                            if 'protocol-specific' in ruledata:
+                                flags += "P"
+
+                            if 'order' in ruledata:
+                                order = ruledata['order']
+                            else:
+                                order = ruleno
+
+                            if 'regexp' in ruledata:
+                                regexp= ruledata['regexp'].replace("\"", "\\\"")
+                            else:
+                                regexp = ''
+
+                            if ruledata['replacement']:
+                                replacement = '{}.'.format(ruledata['replacement'])
+                            else:
+                                replacement = ''
+
+                            zone['records'].append({
+                                'name': subnode,
+                                'type': rtype.upper(),
+                                'ttl': rdata['ttl'],
+                                'value': '{} {} "{}" "{}" "{}" {}'.format(order, ruledata['preference'], flags, ruledata['service'], regexp, replacement)
+                            })
+
+            dns['authoritative_zones'].append(zone)
+
     return dns
 
 def verify(dns):
@@ -86,6 +266,11 @@ def verify(dns):
             if 'server' not in dns['domain'][domain]:
                 raise ConfigError(f'No server configured for domain {domain}!')
 
+    if ('authoritative_zone_errors' in dns) and dns['authoritative_zone_errors']:
+        for error in dns['authoritative_zone_errors']:
+            print(error)
+        raise ConfigError('Invalid authoritative records have been defined')
+
     if 'system' in dns:
         if not ('system_name_server' in dns or 'system_name_server_dhcp' in dns):
             print("Warning: No 'system name-server' or 'system " \
@@ -104,6 +289,15 @@ def generate(dns):
     render(pdns_rec_lua_conf_file, 'dns-forwarding/recursor.conf.lua.tmpl',
             dns, user=pdns_rec_user, group=pdns_rec_group)
 
+    for zone_filename in glob(f'{pdns_rec_run_dir}/zone.*.conf'):
+        os.unlink(zone_filename)
+
+    if 'authoritative_zones' in dns:
+        for zone in dns['authoritative_zones']:
+            render(zone['file'], 'dns-forwarding/recursor.zone.conf.tmpl',
+                    zone, user=pdns_rec_user, group=pdns_rec_group)
+
+
     # if vyos-hostsd didn't create its files yet, create them (empty)
     for file in [pdns_rec_hostsd_lua_conf_file, pdns_rec_hostsd_zones_file]:
         with open(file, 'a'):
@@ -119,6 +313,9 @@ def apply(dns):
 
         if os.path.isfile(pdns_rec_config_file):
             os.unlink(pdns_rec_config_file)
+
+        for zone_filename in glob(f'{pdns_rec_run_dir}/zone.*.conf'):
+            os.unlink(zone_filename)
     else:
         ### first apply vyos-hostsd config
         hc = hostsd_client()
@@ -153,6 +350,12 @@ def apply(dns):
         if 'domain' in dns:
             hc.add_forward_zones(dns['domain'])
 
+        # hostsd generates NTAs for the authoritative zones
+        # the list and keys() are required as get returns a dict, not list
+        hc.delete_authoritative_zones(list(hc.get_authoritative_zones()))
+        if 'authoritative_zones' in dns:
+            hc.add_authoritative_zones(list(map(lambda zone: zone['name'], dns['authoritative_zones'])))
+
         # call hostsd to generate forward-zones and its lua-config-file
         hc.apply()
 
diff --git a/src/conf_mode/flow_accounting_conf.py b/src/conf_mode/flow_accounting_conf.py
index 0a4559ade..daad00067 100755
--- a/src/conf_mode/flow_accounting_conf.py
+++ b/src/conf_mode/flow_accounting_conf.py
@@ -169,7 +169,8 @@ def get_config():
             'configured': vc.exists('system flow-accounting sflow'),
             'agent-address': vc.return_value('system flow-accounting sflow agent-address'),
             'sampling-rate': vc.return_value('system flow-accounting sflow sampling-rate'),
-            'servers': None
+            'servers': None,
+            'source-address': vc.return_value('system flow-accounting sflow source-address')
         },
         'netflow': {
             'configured': vc.exists('system flow-accounting netflow'),
diff --git a/src/conf_mode/http-api.py b/src/conf_mode/http-api.py
index 4bfcbeb47..ea0743cd5 100755
--- a/src/conf_mode/http-api.py
+++ b/src/conf_mode/http-api.py
@@ -31,7 +31,7 @@ from vyos.util import call
 from vyos import airbag
 airbag.enable()
 
-config_file = '/etc/vyos/http-api.conf'
+api_conf_file = '/etc/vyos/http-api.conf'
 
 vyos_conf_scripts_dir=vyos.defaults.directories['conf_mode']
 
@@ -55,15 +55,24 @@ def get_config(config=None):
         conf.set_level('service https api')
 
     if conf.exists('strict'):
-        http_api['strict'] = 'true'
+        http_api['strict'] = True
 
     if conf.exists('debug'):
-        http_api['debug'] = 'true'
+        http_api['debug'] = True
+
+    if conf.exists('socket'):
+        http_api['socket'] = True
 
     if conf.exists('port'):
         port = conf.return_value('port')
         http_api['port'] = port
 
+    if conf.exists('cors'):
+        http_api['cors'] = {}
+        if conf.exists('cors allow-origin'):
+            origins = conf.return_values('cors allow-origin')
+            http_api['cors']['origins'] = origins[:]
+
     if conf.exists('keys'):
         for name in conf.list_nodes('keys id'):
             if conf.exists('keys id {0} key'.format(name)):
@@ -88,7 +97,7 @@ def generate(http_api):
     if not os.path.exists('/etc/vyos'):
         os.mkdir('/etc/vyos')
 
-    with open(config_file, 'w') as f:
+    with open(api_conf_file, 'w') as f:
         json.dump(http_api, f, indent=2)
 
     return None
diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py
index 92dc4a410..053ee5d4a 100755
--- a/src/conf_mode/https.py
+++ b/src/conf_mode/https.py
@@ -23,6 +23,7 @@ import vyos.defaults
 import vyos.certbot_util
 
 from vyos.config import Config
+from vyos.configverify import verify_vrf
 from vyos import ConfigError
 from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
@@ -34,6 +35,7 @@ from vyos import airbag
 airbag.enable()
 
 config_file = '/etc/nginx/sites-available/default'
+systemd_override = r'/etc/systemd/system/nginx.service.d/override.conf'
 cert_dir = '/etc/ssl/certs'
 key_dir = '/etc/ssl/private'
 certbot_dir = vyos.defaults.directories['certbot']
@@ -103,6 +105,8 @@ def verify(https):
             if not domains_found:
                 raise ConfigError("At least one 'virtual-host <id> server-name' "
                               "matching the 'certbot domain-name' is required.")
+
+    verify_vrf(https)
     return None
 
 def generate(https):
@@ -143,7 +147,6 @@ def generate(https):
         server_cert = str(wrap_certificate(pki_cert['certificate']))
         if 'ca-certificate' in cert_dict:
             ca_cert = cert_dict['ca-certificate']
-            print(ca_cert)
             server_cert += '\n' + str(wrap_certificate(https['pki']['ca'][ca_cert]['certificate']))
 
         write_file(cert_path, server_cert)
@@ -188,6 +191,8 @@ def generate(https):
         vhosts = https.get('api-restrict', {}).get('virtual-host', [])
         if vhosts:
             api_data['vhost'] = vhosts[:]
+        if 'socket' in list(api_settings):
+            api_data['socket'] = True
 
     if api_data:
         vhost_list = api_data.get('vhost', [])
@@ -209,10 +214,12 @@ def generate(https):
     }
 
     render(config_file, 'https/nginx.default.tmpl', data)
-
+    render(systemd_override, 'https/override.conf.tmpl', https)
     return None
 
 def apply(https):
+    # Reload systemd manager configuration
+    call('systemctl daemon-reload')
     if https is not None:
         call('systemctl restart nginx.service')
     else:
diff --git a/src/conf_mode/interfaces-vxlan.py b/src/conf_mode/interfaces-vxlan.py
index 804f2d14f..6cd931049 100755
--- a/src/conf_mode/interfaces-vxlan.py
+++ b/src/conf_mode/interfaces-vxlan.py
@@ -44,6 +44,20 @@ def get_config(config=None):
     base = ['interfaces', 'vxlan']
     vxlan = get_interface_dict(conf, base)
 
+    # We need to verify that no other VXLAN tunnel is configured when external
+    # mode is in use - Linux Kernel limitation
+    conf.set_level(base)
+    vxlan['other_tunnels'] = conf.get_config_dict([], key_mangling=('-', '_'),
+                                                  get_first_key=True,
+                                                  no_tag_node_value_mangle=True)
+
+    # This if-clause is just to be sure - it will always evaluate to true
+    ifname = vxlan['ifname']
+    if ifname in vxlan['other_tunnels']:
+        del vxlan['other_tunnels'][ifname]
+    if len(vxlan['other_tunnels']) == 0:
+        del vxlan['other_tunnels']
+
     return vxlan
 
 def verify(vxlan):
@@ -63,8 +77,17 @@ def verify(vxlan):
     if not any(tmp in ['group', 'remote', 'source_address'] for tmp in vxlan):
         raise ConfigError('Group, remote or source-address must be configured')
 
-    if 'vni' not in vxlan:
-        raise ConfigError('Must configure VNI for VXLAN')
+    if 'vni' not in vxlan and 'external' not in vxlan:
+        raise ConfigError(
+            'Must either configure VXLAN "vni" or use "external" CLI option!')
+
+    if {'external', 'vni'} <= set(vxlan):
+        raise ConfigError('Can not specify both "external" and "VNI"!')
+
+    if {'external', 'other_tunnels'} <= set(vxlan):
+        other_tunnels = ', '.join(vxlan['other_tunnels'])
+        raise ConfigError(f'Only one VXLAN tunnel is supported when "external" '\
+                          f'CLI option is used. Additional tunnels: {other_tunnels}')
 
     if 'source_interface' in vxlan:
         # VXLAN adds at least an overhead of 50 byte - we need to check the
diff --git a/src/conf_mode/interfaces-wwan.py b/src/conf_mode/interfaces-wwan.py
index f013e5411..a4b033374 100755
--- a/src/conf_mode/interfaces-wwan.py
+++ b/src/conf_mode/interfaces-wwan.py
@@ -17,6 +17,7 @@
 import os
 
 from sys import exit
+from time import sleep
 
 from vyos.config import Config
 from vyos.configdict import get_interface_dict
@@ -28,10 +29,15 @@ from vyos.util import cmd
 from vyos.util import call
 from vyos.util import dict_search
 from vyos.util import DEVNULL
+from vyos.util import is_systemd_service_active
+from vyos.util import write_file
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
+service_name = 'ModemManager.service'
+cron_script = '/etc/cron.d/wwan'
+
 def get_config(config=None):
     """
     Retrive CLI config as dictionary. Dictionary can never be empty, as at least the
@@ -44,6 +50,20 @@ def get_config(config=None):
     base = ['interfaces', 'wwan']
     wwan = get_interface_dict(conf, base)
 
+    # We need to know the amount of other WWAN interfaces as ModemManager needs
+    # to be started or stopped.
+    conf.set_level(base)
+    wwan['other_interfaces'] = conf.get_config_dict([], key_mangling=('-', '_'),
+                                                    get_first_key=True,
+                                                    no_tag_node_value_mangle=True)
+
+    # This if-clause is just to be sure - it will always evaluate to true
+    ifname = wwan['ifname']
+    if ifname in wwan['other_interfaces']:
+        del wwan['other_interfaces'][ifname]
+    if len(wwan['other_interfaces']) == 0:
+        del wwan['other_interfaces']
+
     return wwan
 
 def verify(wwan):
@@ -61,9 +81,26 @@ def verify(wwan):
     return None
 
 def generate(wwan):
+    if 'deleted' in wwan:
+        return None
+
+    if not os.path.exists(cron_script):
+        write_file(cron_script, '*/5 * * * * root /usr/libexec/vyos/vyos-check-wwan.py')
     return None
 
 def apply(wwan):
+    if not is_systemd_service_active(service_name):
+        cmd(f'systemctl start {service_name}')
+
+        counter = 100
+        # Wait until a modem is detected and then we can continue
+        while counter > 0:
+            counter -= 1
+            tmp = cmd('mmcli -L')
+            if tmp != 'No modems were found':
+                break
+            sleep(0.250)
+
     # we only need the modem number. wwan0 -> 0, wwan1 -> 1
     modem = wwan['ifname'].lstrip('wwan')
     base_cmd = f'mmcli --modem {modem}'
@@ -73,6 +110,15 @@ def apply(wwan):
     w = WWANIf(wwan['ifname'])
     if 'deleted' in wwan or 'disable' in wwan:
         w.remove()
+
+        # There are no other WWAN interfaces - stop the daemon
+        if 'other_interfaces' not in wwan:
+            cmd(f'systemctl stop {service_name}')
+            # Clean CRON helper script which is used for to re-connect when
+            # RF signal is lost
+            if os.path.exists(cron_script):
+                os.unlink(cron_script)
+
         return None
 
     ip_type = 'ipv4'
@@ -93,6 +139,9 @@ def apply(wwan):
     call(command, stdout=DEVNULL)
     w.update(wwan)
 
+    if 'other_interfaces' not in wwan and 'deleted' in wwan:
+        cmd(f'systemctl start {service_name}')
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/netns.py b/src/conf_mode/netns.py
new file mode 100755
index 000000000..0924eb616
--- /dev/null
+++ b/src/conf_mode/netns.py
@@ -0,0 +1,118 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import os
+
+from sys import exit
+from tempfile import NamedTemporaryFile
+
+from vyos.config import Config
+from vyos.configdict import node_changed
+from vyos.ifconfig import Interface
+from vyos.util import call
+from vyos.util import dict_search
+from vyos.util import get_interface_config
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+
+def netns_interfaces(c, match):
+    """
+    get NETNS bound interfaces
+    """
+    matched = []
+    old_level = c.get_level()
+    c.set_level(['interfaces'])
+    section = c.get_config_dict([], get_first_key=True)
+    for type in section:
+        interfaces = section[type]
+        for name in interfaces:
+            interface = interfaces[name]
+            if 'netns' in interface:
+                v = interface.get('netns', '')
+                if v == match:
+                    matched.append(name)
+
+    c.set_level(old_level)
+    return matched
+
+def get_config(config=None):
+    if config:
+        conf = config
+    else:
+        conf = Config()
+
+    base = ['netns']
+    netns = conf.get_config_dict(base, get_first_key=True,
+                                       no_tag_node_value_mangle=True)
+
+    # determine which NETNS has been removed
+    for name in node_changed(conf, base + ['name']):
+        if 'netns_remove' not in netns:
+            netns.update({'netns_remove' : {}})
+
+        netns['netns_remove'][name] = {}
+        # get NETNS bound interfaces
+        interfaces = netns_interfaces(conf, name)
+        if interfaces: netns['netns_remove'][name]['interface'] = interfaces
+
+    return netns
+
+def verify(netns):
+    # ensure NETNS is not assigned to any interface
+    if 'netns_remove' in netns:
+        for name, config in netns['netns_remove'].items():
+            if 'interface' in config:
+                raise ConfigError(f'Can not remove NETNS "{name}", it still has '\
+                                  f'member interfaces!')
+
+    if 'name' in netns:
+        for name, config in netns['name'].items():
+            print(name)
+
+    return None
+
+
+def generate(netns):
+    if not netns:
+        return None
+
+    return None
+
+
+def apply(netns):
+
+    for tmp in (dict_search('netns_remove', netns) or []):
+        if os.path.isfile(f'/run/netns/{tmp}'):
+            call(f'ip netns del {tmp}')
+
+    if 'name' in netns:
+        for name, config in netns['name'].items():
+            if not os.path.isfile(f'/run/netns/{name}'):
+                call(f'ip netns add {name}')
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/protocols_bfd.py b/src/conf_mode/protocols_bfd.py
index 94825ba10..4ebc0989c 100755
--- a/src/conf_mode/protocols_bfd.py
+++ b/src/conf_mode/protocols_bfd.py
@@ -18,6 +18,7 @@ import os
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
+from vyos.configverify import verify_vrf
 from vyos.template import is_ipv6
 from vyos.template import render_to_string
 from vyos.validate import is_ipv6_link_local
@@ -33,7 +34,9 @@ def get_config(config=None):
     else:
         conf = Config()
     base = ['protocols', 'bfd']
-    bfd = conf.get_config_dict(base, get_first_key=True)
+    bfd = conf.get_config_dict(base, key_mangling=('-', '_'),
+                               get_first_key=True,
+                               no_tag_node_value_mangle=True)
     # Bail out early if configuration tree does not exist
     if not conf.exists(base):
         return bfd
@@ -76,11 +79,19 @@ def verify(bfd):
 
                 # multihop and echo-mode cannot be used together
                 if 'echo_mode' in peer_config:
-                    raise ConfigError('Multihop and echo-mode cannot be used together')
+                    raise ConfigError('BFD multihop and echo-mode cannot be used together')
 
                 # multihop doesn't accept interface names
                 if 'source' in peer_config and 'interface' in peer_config['source']:
-                    raise ConfigError('Multihop and source interface cannot be used together')
+                    raise ConfigError('BFD multihop and source interface cannot be used together')
+
+            if 'profile' in peer_config:
+                profile_name = peer_config['profile']
+                if 'profile' not in bfd or profile_name not in bfd['profile']:
+                    raise ConfigError(f'BFD profile "{profile_name}" does not exist!')
+
+            if 'vrf' in peer_config:
+                verify_vrf(peer_config)
 
     return None
 
diff --git a/src/conf_mode/protocols_bgp.py b/src/conf_mode/protocols_bgp.py
index b88f0c4ef..d8704727c 100755
--- a/src/conf_mode/protocols_bgp.py
+++ b/src/conf_mode/protocols_bgp.py
@@ -183,6 +183,28 @@ def verify(bgp):
                     raise ConfigError(f'Neighbor "{peer}" cannot have both ipv6-unicast and ipv6-labeled-unicast configured at the same time!')
 
                 afi_config = peer_config['address_family'][afi]
+
+                if 'conditionally_advertise' in afi_config:
+                    if 'advertise_map' not in afi_config['conditionally_advertise']:
+                        raise ConfigError('Must speficy advertise-map when conditionally-advertise is in use!')
+                    # Verify advertise-map (which is a route-map) exists
+                    verify_route_map(afi_config['conditionally_advertise']['advertise_map'], bgp)
+
+                    if ('exist_map' not in afi_config['conditionally_advertise'] and
+                        'non_exist_map' not in afi_config['conditionally_advertise']):
+                        raise ConfigError('Must either speficy exist-map or non-exist-map when ' \
+                                          'conditionally-advertise is in use!')
+
+                    if {'exist_map', 'non_exist_map'} <= set(afi_config['conditionally_advertise']):
+                        raise ConfigError('Can not specify both exist-map and non-exist-map for ' \
+                                          'conditionally-advertise!')
+
+                    if 'exist_map' in afi_config['conditionally_advertise']:
+                        verify_route_map(afi_config['conditionally_advertise']['exist_map'], bgp)
+
+                    if 'non_exist_map' in afi_config['conditionally_advertise']:
+                        verify_route_map(afi_config['conditionally_advertise']['non_exist_map'], bgp)
+
                 # Validate if configured Prefix list exists
                 if 'prefix_list' in afi_config:
                     for tmp in ['import', 'export']:
@@ -255,14 +277,6 @@ def verify(bgp):
                     tmp = dict_search(f'route_map.vpn.{export_import}', afi_config)
                     if tmp: verify_route_map(tmp, bgp)
 
-            if afi in ['l2vpn_evpn'] and 'vrf' not in bgp:
-                # Some L2VPN EVPN AFI options are only supported under VRF
-                if 'vni' in afi_config:
-                    for vni, vni_config in afi_config['vni'].items():
-                        if 'rd' in vni_config:
-                            raise ConfigError('VNI route-distinguisher is only supported under EVPN VRF')
-                        if 'route_target' in vni_config:
-                            raise ConfigError('VNI route-target is only supported under EVPN VRF')
 
     return None
 
diff --git a/src/conf_mode/protocols_mpls.py b/src/conf_mode/protocols_mpls.py
index 3b27608da..0b0c7d07b 100755
--- a/src/conf_mode/protocols_mpls.py
+++ b/src/conf_mode/protocols_mpls.py
@@ -66,36 +66,24 @@ def verify(mpls):
 
 def generate(mpls):
     # If there's no MPLS config generated, create dictionary key with no value.
-    if not mpls:
-        mpls['new_frr_config'] = ''
+    if not mpls or 'deleted' in mpls:
         return None
 
-    mpls['new_frr_config'] = render_to_string('frr/ldpd.frr.tmpl', mpls)
+    mpls['frr_ldpd_config'] = render_to_string('frr/ldpd.frr.tmpl', mpls)
     return None
 
 def apply(mpls):
-    # Define dictionary that will load FRR config
-    frr_cfg = {}
+    ldpd_damon = 'ldpd'
+
     # Save original configuration prior to starting any commit actions
-    frr_cfg['original_config'] = frr.get_configuration(daemon='ldpd')
-    frr_cfg['modified_config'] = frr.replace_section(frr_cfg['original_config'], mpls['new_frr_config'], from_re='mpls.*')
-
-    # If FRR config is blank, rerun the blank commit three times due to frr-reload
-    # behavior/bug not properly clearing out on one commit.
-    if mpls['new_frr_config'] == '':
-        for x in range(3):
-            frr.reload_configuration(frr_cfg['modified_config'], daemon='ldpd')
-    elif not 'ldp' in mpls:
-        for x in range(3):
-            frr.reload_configuration(frr_cfg['modified_config'], daemon='ldpd')
-    else:
-        # FRR mark configuration will test for syntax errors and throws an
-        # exception if any syntax errors is detected
-        frr.mark_configuration(frr_cfg['modified_config'])
+    frr_cfg = frr.FRRConfig()
+
+    frr_cfg.load_configuration(ldpd_damon)
+    frr_cfg.modify_section(f'^mpls ldp', stop_pattern='^exit', remove_stop_mark=True)
 
-        # Commit resulting configuration to FRR, this will throw CommitError
-        # on failure
-        frr.reload_configuration(frr_cfg['modified_config'], daemon='ldpd')
+    if 'frr_ldpd_config' in mpls:
+        frr_cfg.add_before(frr.default_add_before, mpls['frr_ldpd_config'])
+    frr_cfg.commit_configuration(ldpd_damon)
 
     # Set number of entries in the platform label tables
     labels = '0'
@@ -122,7 +110,7 @@ def apply(mpls):
         system_interfaces = []
         # Populate system interfaces list with local MPLS capable interfaces
         for interface in glob('/proc/sys/net/mpls/conf/*'):
-            system_interfaces.append(os.path.basename(interface))   
+            system_interfaces.append(os.path.basename(interface))
         # This is where the comparison is done on if an interface needs to be enabled/disabled.
         for system_interface in system_interfaces:
             interface_state = read_file(f'/proc/sys/net/mpls/conf/{system_interface}/input')
@@ -138,7 +126,7 @@ def apply(mpls):
         system_interfaces = []
         # If MPLS interfaces are not configured, set MPLS processing disabled
         for interface in glob('/proc/sys/net/mpls/conf/*'):
-            system_interfaces.append(os.path.basename(interface)) 
+            system_interfaces.append(os.path.basename(interface))
         for system_interface in system_interfaces:
             system_interface = system_interface.replace('.', '/')
             call(f'sysctl -wq net.mpls.conf.{system_interface}.input=0')
diff --git a/src/conf_mode/service_pppoe-server.py b/src/conf_mode/service_pppoe-server.py
index 9fbd531da..1f31d132d 100755
--- a/src/conf_mode/service_pppoe-server.py
+++ b/src/conf_mode/service_pppoe-server.py
@@ -24,8 +24,11 @@ from vyos.configverify import verify_accel_ppp_base_service
 from vyos.template import render
 from vyos.util import call
 from vyos.util import dict_search
+from vyos.util import get_interface_config
 from vyos import ConfigError
 from vyos import airbag
+from vyos.range_regex import range_to_regex
+
 airbag.enable()
 
 pppoe_conf = r'/run/accel-pppd/pppoe.conf'
@@ -56,6 +59,11 @@ def verify(pppoe):
     if 'interface' not in pppoe:
         raise ConfigError('At least one listen interface must be defined!')
 
+    # Check is interface exists in the system
+    for iface in pppoe['interface']:
+        if not get_interface_config(iface):
+            raise ConfigError(f'Interface {iface} does not exist!')
+
     # local ippool and gateway settings config checks
     if not (dict_search('client_ip_pool.subnet', pppoe) or
            (dict_search('client_ip_pool.start', pppoe) and
@@ -73,6 +81,13 @@ def generate(pppoe):
     if not pppoe:
         return None
 
+    # Generate special regex for dynamic interfaces
+    for iface in pppoe['interface']:
+        if 'vlan_range' in pppoe['interface'][iface]:
+            pppoe['interface'][iface]['regex'] = []
+            for vlan_range in pppoe['interface'][iface]['vlan_range']:
+                pppoe['interface'][iface]['regex'].append(range_to_regex(vlan_range))
+
     render(pppoe_conf, 'accel-ppp/pppoe.config.tmpl', pppoe)
 
     if dict_search('authentication.mode', pppoe) == 'local':
diff --git a/src/conf_mode/system-login-banner.py b/src/conf_mode/system-login-banner.py
index 2220d7b66..9642b2aae 100755
--- a/src/conf_mode/system-login-banner.py
+++ b/src/conf_mode/system-login-banner.py
@@ -15,13 +15,16 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 from sys import exit
+
 from vyos.config import Config
+from vyos.util import write_file
 from vyos import ConfigError
-
 from vyos import airbag
 airbag.enable()
 
 motd="""
+Welcome to VyOS
+
 Check out project news at https://blog.vyos.io
 and feel free to report bugs at https://phabricator.vyos.net
 
@@ -38,7 +41,7 @@ POSTLOGIN_FILE = r'/etc/motd'
 
 default_config_data = {
     'issue': 'Welcome to VyOS - \\n \\l\n\n',
-    'issue_net': 'Welcome to VyOS\n',
+    'issue_net': '',
     'motd': motd
 }
 
@@ -92,14 +95,9 @@ def generate(banner):
     pass
 
 def apply(banner):
-    with open(PRELOGIN_FILE, 'w') as f:
-        f.write(banner['issue'])
-
-    with open(PRELOGIN_NET_FILE, 'w') as f:
-        f.write(banner['issue_net'])
-
-    with open(POSTLOGIN_FILE, 'w') as f:
-        f.write(banner['motd'])
+    write_file(PRELOGIN_FILE, banner['issue'])
+    write_file(PRELOGIN_NET_FILE, banner['issue_net'])
+    write_file(POSTLOGIN_FILE, banner['motd'])
 
     return None
 
diff --git a/src/helpers/vyos-boot-config-loader.py b/src/helpers/vyos-boot-config-loader.py
index c5bf22f10..b9cc87bfa 100755
--- a/src/helpers/vyos-boot-config-loader.py
+++ b/src/helpers/vyos-boot-config-loader.py
@@ -23,12 +23,12 @@ import grp
 import traceback
 from datetime import datetime
 
-from vyos.defaults import directories
+from vyos.defaults import directories, config_status
 from vyos.configsession import ConfigSession, ConfigSessionError
 from vyos.configtree import ConfigTree
 from vyos.util import cmd
 
-STATUS_FILE = '/tmp/vyos-config-status'
+STATUS_FILE = config_status
 TRACE_FILE = '/tmp/boot-config-trace'
 
 CFG_GROUP = 'vyattacfg'
diff --git a/src/helpers/vyos-check-wwan.py b/src/helpers/vyos-check-wwan.py
index c6e6c54b7..2ff9a574f 100755
--- a/src/helpers/vyos-check-wwan.py
+++ b/src/helpers/vyos-check-wwan.py
@@ -18,7 +18,6 @@ from vyos.configquery import VbashOpRun
 from vyos.configquery import ConfigTreeQuery
 
 from vyos.util import is_wwan_connected
-from vyos.util import call
 
 conf = ConfigTreeQuery()
 dict = conf.get_config_dict(['interfaces', 'wwan'], key_mangling=('-', '_'),
@@ -30,8 +29,7 @@ for interface, interface_config in dict.items():
             # do not restart this interface as it's disabled by the user
             continue
 
-        #op = VbashOpRun()
-        #op.run(['connect', 'interface', interface])
-        call(f'VYOS_TAGNODE_VALUE={interface} /usr/libexec/vyos/conf_mode/interfaces-wwan.py')
+        op = VbashOpRun()
+        op.run(['connect', 'interface', interface])
 
 exit(0)
diff --git a/src/helpers/vyos_net_name b/src/helpers/vyos_net_name
index e21d8c9ff..afeef8f2d 100755
--- a/src/helpers/vyos_net_name
+++ b/src/helpers/vyos_net_name
@@ -25,14 +25,13 @@ from sys import argv
 
 from vyos.configtree import ConfigTree
 from vyos.defaults import directories
-from vyos.util import cmd
+from vyos.util import cmd, boot_configuration_complete
 
 vyos_udev_dir = directories['vyos_udev_dir']
 vyos_log_dir = '/run/udev/log'
 vyos_log_file = os.path.join(vyos_log_dir, 'vyos-net-name')
 
 config_path = '/opt/vyatta/etc/config/config.boot'
-config_status = '/tmp/vyos-config-status'
 
 lock = threading.Lock()
 
@@ -43,13 +42,6 @@ except FileExistsError:
 
 logging.basicConfig(filename=vyos_log_file, level=logging.DEBUG)
 
-def boot_configuration_complete() -> bool:
-    """ Check if vyos-router has completed, hence hotplug event
-    """
-    if os.path.isfile(config_status):
-        return True
-    return False
-
 def is_available(intfs: dict, intf_name: str) -> bool:
     """ Check if interface name is already assigned
     """
diff --git a/src/op_mode/format_disk.py b/src/op_mode/format_disk.py
index df4486bce..b3ba44e87 100755
--- a/src/op_mode/format_disk.py
+++ b/src/op_mode/format_disk.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019 VyOS maintainers and contributors
+# Copyright (C) 2019-2021 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,11 +17,10 @@
 import argparse
 import os
 import re
-import sys
+
 from datetime import datetime
-from time import sleep
 
-from vyos.util import is_admin, ask_yes_no
+from vyos.util import ask_yes_no
 from vyos.util import call
 from vyos.util import cmd
 from vyos.util import DEVNULL
@@ -38,16 +37,17 @@ def list_disks():
 
 def is_busy(disk: str):
     """Check if given disk device is busy by re-reading it's partition table"""
-    return call(f'sudo blockdev --rereadpt /dev/{disk}', stderr=DEVNULL) != 0
+    return call(f'blockdev --rereadpt /dev/{disk}', stderr=DEVNULL) != 0
 
 
 def backup_partitions(disk: str):
     """Save sfdisk partitions output to a backup file"""
 
-    device_path = '/dev/' + disk
-    backup_ts = datetime.now().strftime('%Y-%m-%d-%H:%M')
-    backup_file = '/var/tmp/backup_{}.{}'.format(disk, backup_ts)
-    cmd(f'sudo /sbin/sfdisk -d {device_path} > {backup_file}')
+    device_path = f'/dev/{disk}'
+    backup_ts = datetime.now().strftime('%Y%m%d-%H%M')
+    backup_file = f'/var/tmp/backup_{disk}.{backup_ts}'
+    call(f'sfdisk -d {device_path} > {backup_file}')
+    print(f'Partition table backup saved to {backup_file}')
 
 
 def list_partitions(disk: str):
@@ -65,11 +65,11 @@ def list_partitions(disk: str):
 
 
 def delete_partition(disk: str, partition_idx: int):
-    cmd(f'sudo /sbin/parted /dev/{disk} rm {partition_idx}')
+    cmd(f'parted /dev/{disk} rm {partition_idx}')
 
 
 def format_disk_like(target: str, proto: str):
-    cmd(f'sudo /sbin/sfdisk -d /dev/{proto} | sudo /sbin/sfdisk --force /dev/{target}')
+    cmd(f'sfdisk -d /dev/{proto} | sfdisk --force /dev/{target}')
 
 
 if __name__ == '__main__':
@@ -79,10 +79,6 @@ if __name__ == '__main__':
     group.add_argument('-p', '--proto', type=str, required=True, help='Prototype device to use as reference')
     args = parser.parse_args()
 
-    if not is_admin():
-        print('Must be admin or root to format disk')
-        sys.exit(1)
-
     target_disk = args.target
     eligible_target_disks = list_disks()
 
@@ -90,54 +86,48 @@ if __name__ == '__main__':
     eligible_proto_disks = eligible_target_disks.copy()
     eligible_proto_disks.remove(target_disk)
 
-    fmt = {
-        'target_disk': target_disk,
-        'proto_disk': proto_disk,
-    }
-
     if proto_disk == target_disk:
         print('The two disk drives must be different.')
-        sys.exit(1)
+        exit(1)
 
-    if not os.path.exists('/dev/' + proto_disk):
-        print('Device /dev/{proto_disk} does not exist'.format_map(fmt))
-        sys.exit(1)
+    if not os.path.exists(f'/dev/{proto_disk}'):
+        print(f'Device /dev/{proto_disk} does not exist')
+        exit(1)
 
     if not os.path.exists('/dev/' + target_disk):
-        print('Device /dev/{target_disk} does not exist'.format_map(fmt))
-        sys.exit(1)
+        print(f'Device /dev/{target_disk} does not exist')
+        exit(1)
 
     if target_disk not in eligible_target_disks:
-        print('Device {target_disk} can not be formatted'.format_map(fmt))
-        sys.exit(1)
+        print(f'Device {target_disk} can not be formatted')
+        exit(1)
 
     if proto_disk not in eligible_proto_disks:
-        print('Device {proto_disk} can not be used as a prototype for {target_disk}'.format_map(fmt))
-        sys.exit(1)
+        print(f'Device {proto_disk} can not be used as a prototype for {target_disk}')
+        exit(1)
 
     if is_busy(target_disk):
-        print("Disk device {target_disk} is busy. Can't format it now".format_map(fmt))
-        sys.exit(1)
+        print(f'Disk device {target_disk} is busy, unable to format')
+        exit(1)
 
-    print('This will re-format disk {target_disk} so that it has the same disk\n'
-          'partion sizes and offsets as {proto_disk}. This will not copy\n'
-          'data from {proto_disk} to {target_disk}. But this will erase all\n'
-          'data on {target_disk}.\n'.format_map(fmt))
+    print(f'\nThis will re-format disk {target_disk} so that it has the same disk'
+          f'\npartion sizes and offsets as {proto_disk}. This will not copy'
+          f'\ndata from {proto_disk} to {target_disk}. But this will erase all'
+          f'\ndata on {target_disk}.\n')
 
-    if not ask_yes_no("Do you wish to proceed?"):
-        print('OK. Disk drive {target_disk} will not be re-formated'.format_map(fmt))
-        sys.exit(0)
+    if not ask_yes_no('Do you wish to proceed?'):
+        print(f'Disk drive {target_disk} will not be re-formated')
+        exit(0)
 
-    print('OK. Re-formating disk drive {target_disk}...'.format_map(fmt))
+    print(f'Re-formating disk drive {target_disk}...')
 
     print('Making backup copy of partitions...')
     backup_partitions(target_disk)
-    sleep(1)
 
     print('Deleting old partitions...')
     for p in list_partitions(target_disk):
         delete_partition(disk=target_disk, partition_idx=p)
 
-    print('Creating new partitions on {target_disk} based on {proto_disk}...'.format_map(fmt))
+    print(f'Creating new partitions on {target_disk} based on {proto_disk}...')
     format_disk_like(target=target_disk, proto=proto_disk)
-    print('Done.')
+    print('Done!')
diff --git a/src/op_mode/ppp-server-ctrl.py b/src/op_mode/ppp-server-ctrl.py
index 670cdf879..e93963fdd 100755
--- a/src/op_mode/ppp-server-ctrl.py
+++ b/src/op_mode/ppp-server-ctrl.py
@@ -60,7 +60,7 @@ def main():
         output, err = popen(cmd_dict['cmd_base'].format(cmd_dict['vpn_types'][args.proto]) + args.action + ses_pattern, stderr=DEVNULL, decode='utf-8')
         if not err:
             try:
-                print(output)
+                print(f' {output}')
             except:
                 sys.exit(0)
         else:
diff --git a/src/services/api/graphql/README.graphql b/src/services/api/graphql/README.graphql
index a3c30b005..1133d79ed 100644
--- a/src/services/api/graphql/README.graphql
+++ b/src/services/api/graphql/README.graphql
@@ -1,7 +1,12 @@
 
+The following examples are in the form as entered in the GraphQL
+'playground', which is found at:
+
+https://{{ host_address }}/graphql
+
 Example using GraphQL mutations to configure a DHCP server:
 
-This assumes that the http-api is running:
+All examples assume that the http-api is running:
 
 'set service https api'
 
@@ -58,8 +63,8 @@ N.B. fileName can be empty (fileName: "") or data can be empty (data: {}) to
 save to /config/config.boot; to save to an alternative path, specify
 fileName.
 
-Similarly, using the same 'endpoint' (meaning the form of the request and
-resolver; the actual enpoint for all GraphQL requests is
+Similarly, using an analogous 'endpoint' (meaning the form of the request
+and resolver; the actual enpoint for all GraphQL requests is
 https://hostname/graphql), one can load an arbitrary config file from a
 path.
 
@@ -75,7 +80,7 @@ mutation {
 
 Op-mode 'show' commands may be requested by path, e.g.:
 
-mutation {
+query {
   Show (data: {path: ["interfaces", "ethernet", "detail"]}) {
     success
     errors
@@ -88,16 +93,58 @@ mutation {
 N.B. to see the output the 'data' field 'result' must be present in the
 request.
 
-The GraphQL playground will be found at:
+Mutations to manipulate firewall address groups:
 
-https://{{ host_address }}/graphql
+mutation {
+  CreateFirewallAddressGroup (data: {name: "ADDR-GRP", address: "10.0.0.1"}) {
+    success
+    errors
+  }
+}
+
+mutation {
+  UpdateFirewallAddressGroupMembers (data: {name: "ADDR-GRP",
+                                            address: ["10.0.0.1-10.0.0.8", "192.168.0.1"]}) {
+    success
+    errors
+  }
+}
+
+mutation {
+  RemoveFirewallAddressGroupMembers (data: {name: "ADDR-GRP",
+                                            address: "192.168.0.1"}) {
+    success
+    errors
+  }
+}
+
+N.B. The schema for the above specify that 'address' be of the form 'list of
+strings' (SDL type [String!]! for UpdateFirewallAddressGroupMembers, where
+the ! indicates that the input is required; SDL type [String] in
+CreateFirewallAddressGroup, since a group may be created without any
+addresses). However, notice that a single string may be passed without being
+a member of a list, in which case the specification allows for 'input
+coercion':
+
+http://spec.graphql.org/October2021/#sec-Scalars.Input-Coercion
+
+Similarly, IPv6 versions of the above:
 
-An equivalent curl command to the first example above would be:
+CreateFirewallAddressIpv6Group
+UpdateFirewallAddressIpv6GroupMembers
+RemoveFirewallAddressIpv6GroupMembers
+
+
+Instead of using the GraphQL playground, an equivalent curl command to the
+first example above would be:
 
 curl -k 'https://192.168.100.168/graphql' -H 'Content-Type: application/json' --data-binary '{"query": "mutation {createInterfaceEthernet (data: {interface: \"eth1\", address: \"192.168.0.1/24\", description: \"BOB\"}) {success errors data {address}}}"}'
 
 Note that the 'mutation' term is prefaced by 'query' in the curl command.
 
+Curl equivalents may be read from within the GraphQL playground at the 'copy
+curl' button.
+
 What's here:
 
 services
diff --git a/src/services/api/graphql/bindings.py b/src/services/api/graphql/bindings.py
index 1fbe13d0c..84d719fda 100644
--- a/src/services/api/graphql/bindings.py
+++ b/src/services/api/graphql/bindings.py
@@ -1,4 +1,20 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
 import vyos.defaults
+from . graphql.queries import query
 from . graphql.mutations import mutation
 from . graphql.directives import directives_dict
 from ariadne import make_executable_schema, load_schema_from_path, snake_case_fallback_resolvers
@@ -8,6 +24,6 @@ def generate_schema():
 
     type_defs = load_schema_from_path(api_schema_dir)
 
-    schema = make_executable_schema(type_defs, mutation, snake_case_fallback_resolvers, directives=directives_dict)
+    schema = make_executable_schema(type_defs, query, mutation, snake_case_fallback_resolvers, directives=directives_dict)
 
     return schema
diff --git a/src/services/api/graphql/graphql/directives.py b/src/services/api/graphql/graphql/directives.py
index 10bc522db..0a9298f55 100644
--- a/src/services/api/graphql/graphql/directives.py
+++ b/src/services/api/graphql/graphql/directives.py
@@ -1,4 +1,20 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
 from ariadne import SchemaDirectiveVisitor, ObjectType
+from . queries import *
 from . mutations import *
 
 def non(arg):
diff --git a/src/services/api/graphql/graphql/mutations.py b/src/services/api/graphql/graphql/mutations.py
index 8e5aab56d..0c3eb702a 100644
--- a/src/services/api/graphql/graphql/mutations.py
+++ b/src/services/api/graphql/graphql/mutations.py
@@ -1,3 +1,17 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from importlib import import_module
 from typing import Any, Dict
@@ -10,7 +24,7 @@ from api.graphql.recipes.session import Session
 
 mutation = ObjectType("Mutation")
 
-def make_resolver(mutation_name, class_name, session_func):
+def make_mutation_resolver(mutation_name, class_name, session_func):
     """Dynamically generate a resolver for the mutation named in the
     schema by 'mutation_name'.
 
@@ -66,34 +80,20 @@ def make_resolver(mutation_name, class_name, session_func):
 
     return func_impl
 
-def make_configure_resolver(mutation_name):
-    class_name = mutation_name
-    return make_resolver(mutation_name, class_name, 'configure')
+def make_prefix_resolver(mutation_name, prefix=[]):
+    for pre in prefix:
+        Pre = pre.capitalize()
+        if Pre in mutation_name:
+            class_name = mutation_name.replace(Pre, '', 1)
+            return make_mutation_resolver(mutation_name, class_name, pre)
+    raise Exception
 
-def make_show_config_resolver(mutation_name):
+def make_configure_resolver(mutation_name):
     class_name = mutation_name
-    return make_resolver(mutation_name, class_name, 'show_config')
+    return make_mutation_resolver(mutation_name, class_name, 'configure')
 
 def make_config_file_resolver(mutation_name):
-    if 'Save' in mutation_name:
-        class_name = mutation_name.replace('Save', '', 1)
-        return make_resolver(mutation_name, class_name, 'save')
-    elif 'Load' in mutation_name:
-        class_name = mutation_name.replace('Load', '', 1)
-        return make_resolver(mutation_name, class_name, 'load')
-    else:
-        raise Exception
-
-def make_show_resolver(mutation_name):
-    class_name = mutation_name
-    return make_resolver(mutation_name, class_name, 'show')
+    return make_prefix_resolver(mutation_name, prefix=['save', 'load'])
 
 def make_image_resolver(mutation_name):
-    if 'Add' in mutation_name:
-        class_name = mutation_name.replace('Add', '', 1)
-        return make_resolver(mutation_name, class_name, 'add')
-    elif 'Delete' in mutation_name:
-        class_name = mutation_name.replace('Delete', '', 1)
-        return make_resolver(mutation_name, class_name, 'delete')
-    else:
-        raise Exception
+    return make_prefix_resolver(mutation_name, prefix=['add', 'delete'])
diff --git a/src/services/api/graphql/graphql/queries.py b/src/services/api/graphql/graphql/queries.py
new file mode 100644
index 000000000..e1868091e
--- /dev/null
+++ b/src/services/api/graphql/graphql/queries.py
@@ -0,0 +1,89 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+from importlib import import_module
+from typing import Any, Dict
+from ariadne import ObjectType, convert_kwargs_to_snake_case, convert_camel_case_to_snake
+from graphql import GraphQLResolveInfo
+from makefun import with_signature
+
+from .. import state
+from api.graphql.recipes.session import Session
+
+query = ObjectType("Query")
+
+def make_query_resolver(query_name, class_name, session_func):
+    """Dynamically generate a resolver for the query named in the
+    schema by 'query_name'.
+
+    Dynamic generation is provided using the package 'makefun' (via the
+    decorator 'with_signature'), which provides signature-preserving
+    function wrappers; it provides several improvements over, say,
+    functools.wraps.
+
+    :raise Exception:
+        raising ConfigErrors, or internal errors
+    """
+
+    func_base_name = convert_camel_case_to_snake(class_name)
+    resolver_name = f'resolve_{func_base_name}'
+    func_sig = '(obj: Any, info: GraphQLResolveInfo, data: Dict)'
+
+    @query.field(query_name)
+    @convert_kwargs_to_snake_case
+    @with_signature(func_sig, func_name=resolver_name)
+    async def func_impl(*args, **kwargs):
+        try:
+            if 'data' not in kwargs:
+                return {
+                    "success": False,
+                    "errors": ['missing data']
+                }
+
+            data = kwargs['data']
+            session = state.settings['app'].state.vyos_session
+
+            # one may override the session functions with a local subclass
+            try:
+                mod = import_module(f'api.graphql.recipes.{func_base_name}')
+                klass = getattr(mod, class_name)
+            except ImportError:
+                # otherwise, dynamically generate subclass to invoke subclass
+                # name based templates
+                klass = type(class_name, (Session,), {})
+            k = klass(session, data)
+            method = getattr(k, session_func)
+            result = method()
+            data['result'] = result
+
+            return {
+                "success": True,
+                "data": data
+            }
+        except Exception as error:
+            return {
+                "success": False,
+                "errors": [str(error)]
+            }
+
+    return func_impl
+
+def make_show_config_resolver(query_name):
+    class_name = query_name
+    return make_query_resolver(query_name, class_name, 'show_config')
+
+def make_show_resolver(query_name):
+    class_name = query_name
+    return make_query_resolver(query_name, class_name, 'show')
diff --git a/src/services/api/graphql/graphql/schema/firewall_group.graphql b/src/services/api/graphql/graphql/schema/firewall_group.graphql
index efe7de632..d89904b9e 100644
--- a/src/services/api/graphql/graphql/schema/firewall_group.graphql
+++ b/src/services/api/graphql/graphql/schema/firewall_group.graphql
@@ -45,3 +45,51 @@ type RemoveFirewallAddressGroupMembersResult {
     success: Boolean!
     errors: [String]
 }
+
+input CreateFirewallAddressIpv6GroupInput {
+    name: String!
+    address: [String]
+}
+
+type CreateFirewallAddressIpv6Group {
+    name: String!
+    address: [String]
+}
+
+type CreateFirewallAddressIpv6GroupResult {
+    data: CreateFirewallAddressIpv6Group
+    success: Boolean!
+    errors: [String]
+}
+
+input UpdateFirewallAddressIpv6GroupMembersInput {
+    name: String!
+    address: [String!]!
+}
+
+type UpdateFirewallAddressIpv6GroupMembers {
+    name: String!
+    address: [String!]!
+}
+
+type UpdateFirewallAddressIpv6GroupMembersResult {
+    data: UpdateFirewallAddressIpv6GroupMembers
+    success: Boolean!
+    errors: [String]
+}
+
+input RemoveFirewallAddressIpv6GroupMembersInput {
+    name: String!
+    address: [String!]!
+}
+
+type RemoveFirewallAddressIpv6GroupMembers {
+    name: String!
+    address: [String!]!
+}
+
+type RemoveFirewallAddressIpv6GroupMembersResult {
+    data: RemoveFirewallAddressIpv6GroupMembers
+    success: Boolean!
+    errors: [String]
+}
diff --git a/src/services/api/graphql/graphql/schema/schema.graphql b/src/services/api/graphql/graphql/schema/schema.graphql
index c6899bee6..952e46f34 100644
--- a/src/services/api/graphql/graphql/schema/schema.graphql
+++ b/src/services/api/graphql/graphql/schema/schema.graphql
@@ -3,26 +3,28 @@ schema {
     mutation: Mutation
 }
 
-type Query {
-    _dummy: String
-}
-
 directive @configure on FIELD_DEFINITION
 directive @configfile on FIELD_DEFINITION
 directive @show on FIELD_DEFINITION
 directive @showconfig on FIELD_DEFINITION
 directive @image on FIELD_DEFINITION
 
+type Query {
+    Show(data: ShowInput) : ShowResult @show
+    ShowConfig(data: ShowConfigInput) : ShowConfigResult @showconfig
+}
+
 type Mutation {
     CreateDhcpServer(data: DhcpServerConfigInput) : CreateDhcpServerResult @configure
     CreateInterfaceEthernet(data: InterfaceEthernetConfigInput) : CreateInterfaceEthernetResult @configure
     CreateFirewallAddressGroup(data: CreateFirewallAddressGroupInput) : CreateFirewallAddressGroupResult @configure
     UpdateFirewallAddressGroupMembers(data: UpdateFirewallAddressGroupMembersInput) : UpdateFirewallAddressGroupMembersResult @configure
     RemoveFirewallAddressGroupMembers(data: RemoveFirewallAddressGroupMembersInput) : RemoveFirewallAddressGroupMembersResult @configure
+    CreateFirewallAddressIpv6Group(data: CreateFirewallAddressIpv6GroupInput) : CreateFirewallAddressIpv6GroupResult @configure
+    UpdateFirewallAddressIpv6GroupMembers(data: UpdateFirewallAddressIpv6GroupMembersInput) : UpdateFirewallAddressIpv6GroupMembersResult @configure
+    RemoveFirewallAddressIpv6GroupMembers(data: RemoveFirewallAddressIpv6GroupMembersInput) : RemoveFirewallAddressIpv6GroupMembersResult @configure
     SaveConfigFile(data: SaveConfigFileInput) : SaveConfigFileResult @configfile
     LoadConfigFile(data: LoadConfigFileInput) : LoadConfigFileResult @configfile
-    Show(data: ShowInput) : ShowResult @show
-    ShowConfig(data: ShowConfigInput) : ShowConfigResult @showconfig
     AddSystemImage(data: AddSystemImageInput) : AddSystemImageResult @image
     DeleteSystemImage(data: DeleteSystemImageInput) : DeleteSystemImageResult @image
 }
diff --git a/src/services/api/graphql/recipes/remove_firewall_address_group_members.py b/src/services/api/graphql/recipes/remove_firewall_address_group_members.py
index cde30c27a..b91932e14 100644
--- a/src/services/api/graphql/recipes/remove_firewall_address_group_members.py
+++ b/src/services/api/graphql/recipes/remove_firewall_address_group_members.py
@@ -1,3 +1,17 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
 
 from . session import Session
 
diff --git a/src/services/api/graphql/recipes/session.py b/src/services/api/graphql/recipes/session.py
index 5ece78ee6..1f844ff70 100644
--- a/src/services/api/graphql/recipes/session.py
+++ b/src/services/api/graphql/recipes/session.py
@@ -1,3 +1,18 @@
+# Copyright 2021 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
 import json
 
 from ariadne import convert_camel_case_to_snake
diff --git a/src/services/api/graphql/recipes/templates/create_firewall_address_ipv_6_group.tmpl b/src/services/api/graphql/recipes/templates/create_firewall_address_ipv_6_group.tmpl
new file mode 100644
index 000000000..e9b660722
--- /dev/null
+++ b/src/services/api/graphql/recipes/templates/create_firewall_address_ipv_6_group.tmpl
@@ -0,0 +1,4 @@
+set firewall group ipv6-address-group {{ name }}
+{% for add in address %}
+set firewall group ipv6-address-group {{ name }} address {{ add }}
+{% endfor %}
diff --git a/src/services/api/graphql/recipes/templates/remove_firewall_address_ipv_6_group_members.tmpl b/src/services/api/graphql/recipes/templates/remove_firewall_address_ipv_6_group_members.tmpl
new file mode 100644
index 000000000..0efa0b226
--- /dev/null
+++ b/src/services/api/graphql/recipes/templates/remove_firewall_address_ipv_6_group_members.tmpl
@@ -0,0 +1,3 @@
+{% for add in address %}
+delete firewall group ipv6-address-group {{ name }} address {{ add }}
+{% endfor %}
diff --git a/src/services/api/graphql/recipes/templates/update_firewall_address_ipv_6_group_members.tmpl b/src/services/api/graphql/recipes/templates/update_firewall_address_ipv_6_group_members.tmpl
new file mode 100644
index 000000000..f98a5517c
--- /dev/null
+++ b/src/services/api/graphql/recipes/templates/update_firewall_address_ipv_6_group_members.tmpl
@@ -0,0 +1,3 @@
+{% for add in address %}
+set firewall group ipv6-address-group {{ name }} address {{ add }}
+{% endfor %}
diff --git a/src/services/vyos-configd b/src/services/vyos-configd
index 670b6e66a..48c9135e2 100755
--- a/src/services/vyos-configd
+++ b/src/services/vyos-configd
@@ -28,6 +28,7 @@ import zmq
 from contextlib import contextmanager
 
 from vyos.defaults import directories
+from vyos.util import boot_configuration_complete
 from vyos.configsource import ConfigSourceString, ConfigSourceError
 from vyos.config import Config
 from vyos import ConfigError
@@ -186,7 +187,7 @@ def initialization(socket):
         session_out = None
 
     # if not a 'live' session, for example on boot, write to file
-    if not session_out or not os.path.isfile('/tmp/vyos-config-status'):
+    if not session_out or not boot_configuration_complete():
         session_out = script_stdout_log
         session_mode = 'a'
 
diff --git a/src/services/vyos-hostsd b/src/services/vyos-hostsd
index f4b1d0fc2..df9f18d2d 100755
--- a/src/services/vyos-hostsd
+++ b/src/services/vyos-hostsd
@@ -139,6 +139,27 @@
 # }
 #
 #
+### authoritative_zones
+## Additional zones hosted authoritatively by pdns-recursor.
+## We add NTAs for these zones but do not do much else here.
+#
+# { 'type': 'authoritative_zones',
+#   'op': 'add',
+#   'data': ['<str zone>', ...]
+# }
+#
+# { 'type': 'authoritative_zones',
+#   'op': 'delete',
+#   'data': ['<str zone>', ...]
+# }
+#
+# { 'type': 'authoritative_zones',
+#   'op': 'get',
+# }
+# response:
+# { 'data': ['<str zone>', ...] }
+#
+#
 ### search_domains
 #
 # { 'type': 'search_domains',
@@ -255,6 +276,7 @@ STATE = {
     "name_server_tags_recursor": [],
     "name_server_tags_system": [],
     "forward_zones": {},
+    "authoritative_zones": [],
     "hosts": {},
     "host_name": "vyos",
     "domain_name": "",
@@ -267,7 +289,8 @@ base_schema = Schema({
     Required('op'): Any('add', 'delete', 'set', 'get', 'apply'),
     'type': Any('name_servers',
         'name_server_tags_recursor', 'name_server_tags_system',
-        'forward_zones', 'search_domains', 'hosts', 'host_name'),
+        'forward_zones', 'authoritative_zones', 'search_domains',
+        'hosts', 'host_name'),
     'data': Any(list, dict),
     'tag': str,
     'tag_regex': str
@@ -347,6 +370,11 @@ msg_schema_map = {
         'delete': data_list_schema,
         'get': op_type_schema
         },
+    'authoritative_zones': {
+        'add': data_list_schema,
+        'delete': data_list_schema,
+        'get': op_type_schema
+        },
     'search_domains': {
         'add': data_dict_list_schema,
         'delete': data_list_schema,
@@ -522,7 +550,7 @@ def handle_message(msg):
         data = get_option(msg, 'data')
         if _type in ['name_servers', 'forward_zones', 'search_domains', 'hosts']:
             delete_items_from_dict(STATE[_type], data)
-        elif _type in ['name_server_tags_recursor', 'name_server_tags_system']:
+        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'authoritative_zones']:
             delete_items_from_list(STATE[_type], data)
         else:
             raise ValueError(f'Operation "{op}" unknown data type "{_type}"')
@@ -534,7 +562,7 @@ def handle_message(msg):
         elif _type in ['forward_zones', 'hosts']:
             add_items_to_dict(STATE[_type], data)
             # maybe we need to rec_control clear-nta each domain that was removed here?
-        elif _type in ['name_server_tags_recursor', 'name_server_tags_system']:
+        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'authoritative_zones']:
             add_items_to_list(STATE[_type], data)
         else:
             raise ValueError(f'Operation "{op}" unknown data type "{_type}"')
@@ -550,7 +578,7 @@ def handle_message(msg):
         if _type in ['name_servers', 'search_domains', 'hosts']:
             tag_regex = get_option(msg, 'tag_regex')
             result = get_items_from_dict_regex(STATE[_type], tag_regex)
-        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'forward_zones']:
+        elif _type in ['name_server_tags_recursor', 'name_server_tags_system', 'forward_zones', 'authoritative_zones']:
             result = STATE[_type]
         else:
             raise ValueError(f'Operation "{op}" unknown data type "{_type}"')
diff --git a/src/services/vyos-http-api-server b/src/services/vyos-http-api-server
index aa7ac6708..06871f1d6 100755
--- a/src/services/vyos-http-api-server
+++ b/src/services/vyos-http-api-server
@@ -32,6 +32,7 @@ from fastapi.responses import HTMLResponse
 from fastapi.exceptions import RequestValidationError
 from fastapi.routing import APIRoute
 from pydantic import BaseModel, StrictStr, validator
+from starlette.middleware.cors import CORSMiddleware
 from starlette.datastructures import FormData
 from starlette.formparsers import FormParser, MultiPartParser
 from multipart.multipart import parse_options_header
@@ -610,13 +611,19 @@ def show_op(data: ShowModel):
 # GraphQL integration
 ###
 
-from api.graphql.bindings import generate_schema
+def graphql_init(fast_api_app):
+    from api.graphql.bindings import generate_schema
 
-api.graphql.state.init()
+    api.graphql.state.init()
+    api.graphql.state.settings['app'] = app
 
-schema = generate_schema()
+    schema = generate_schema()
 
-app.add_route('/graphql', GraphQL(schema, debug=True))
+    if app.state.vyos_origins:
+        origins = app.state.vyos_origins
+        app.add_route('/graphql', CORSMiddleware(GraphQL(schema, debug=True), allow_origins=origins, allow_methods=("GET", "POST", "OPTIONS")))
+    else:
+        app.add_route('/graphql', GraphQL(schema, debug=True))
 
 ###
 
@@ -640,15 +647,20 @@ if __name__ == '__main__':
     app.state.vyos_session = config_session
     app.state.vyos_keys = server_config['api_keys']
 
-    app.state.vyos_debug = bool(server_config['debug'] == 'true')
-    app.state.vyos_strict = bool(server_config['strict'] == 'true')
+    app.state.vyos_debug = server_config['debug']
+    app.state.vyos_strict = server_config['strict']
+    app.state.vyos_origins = server_config.get('cors', {}).get('origins', [])
 
-    api.graphql.state.settings['app'] = app
+    graphql_init(app)
 
     try:
-        uvicorn.run(app, host=server_config["listen_address"],
-                         port=int(server_config["port"]),
-                         proxy_headers=True)
+        if not server_config['socket']:
+            uvicorn.run(app, host=server_config["listen_address"],
+                             port=int(server_config["port"]),
+                             proxy_headers=True)
+        else:
+            uvicorn.run(app, uds="/run/api.sock",
+                             proxy_headers=True)
     except OSError as err:
         logger.critical(f"OSError {err}")
         sys.exit(1)
diff --git a/src/system/keepalived-fifo.py b/src/system/keepalived-fifo.py
index 1fba0d75b..b1fe7e43f 100755
--- a/src/system/keepalived-fifo.py
+++ b/src/system/keepalived-fifo.py
@@ -29,6 +29,7 @@ from logging.handlers import SysLogHandler
 from vyos.ifconfig.vrrp import VRRP
 from vyos.configquery import ConfigTreeQuery
 from vyos.util import cmd
+from vyos.util import dict_search
 
 # configure logging
 logger = logging.getLogger(__name__)
@@ -69,22 +70,10 @@ class KeepalivedFifo:
                 raise ValueError()
 
             # Read VRRP configuration directly from CLI
-            vrrp_config_dict = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                                    get_first_key=True)
-            self.vrrp_config = {'vrrp_groups': {}, 'sync_groups': {}}
-            for key in ['group', 'sync_group']:
-                if key not in vrrp_config_dict:
-                    continue
-                for group, group_config in vrrp_config_dict[key].items():
-                    if 'transition_script' not in group_config:
-                        continue
-                    self.vrrp_config['vrrp_groups'][group] = {
-                        'STOP': group_config['transition_script'].get('stop'),
-                        'FAULT': group_config['transition_script'].get('fault'),
-                        'BACKUP': group_config['transition_script'].get('backup'),
-                        'MASTER': group_config['transition_script'].get('master'),
-                    }
-            logger.info(f'Loaded configuration: {self.vrrp_config}')
+            self.vrrp_config_dict = conf.get_config_dict(base,
+                                     key_mangling=('-', '_'), get_first_key=True)
+
+            logger.debug(f'Loaded configuration: {self.vrrp_config_dict}')
         except Exception as err:
             logger.error(f'Unable to load configuration: {err}')
 
@@ -129,20 +118,17 @@ class KeepalivedFifo:
                             if os.path.exists(mdns_running_file):
                                 cmd(mdns_update_command)
 
-                            if n_name in self.vrrp_config['vrrp_groups'] and n_state in self.vrrp_config['vrrp_groups'][n_name]:
-                                n_script = self.vrrp_config['vrrp_groups'][n_name].get(n_state)
-                                if n_script:
-                                    self._run_command(n_script)
+                            tmp = dict_search(f'group.{n_name}.transition_script.{n_state.lower()}', self.vrrp_config_dict)
+                            if tmp != None:
+                                self._run_command(tmp)
                         # check and run commands for VRRP sync groups
-                        # currently, this is not available in VyOS CLI
-                        if n_type == 'GROUP':
+                        elif n_type == 'GROUP':
                             if os.path.exists(mdns_running_file):
                                 cmd(mdns_update_command)
 
-                            if n_name in self.vrrp_config['sync_groups'] and n_state in self.vrrp_config['sync_groups'][n_name]:
-                                n_script = self.vrrp_config['sync_groups'][n_name].get(n_state)
-                                if n_script:
-                                    self._run_command(n_script)
+                            tmp = dict_search(f'sync_group.{n_name}.transition_script.{n_state.lower()}', self.vrrp_config_dict)
+                            if tmp != None:
+                                self._run_command(tmp)
                     # mark task in queue as done
                     self.message_queue.task_done()
             except Exception as err:
diff --git a/src/validators/bgp-route-target b/src/validators/bgp-rd-rt
index e7e4d403f..b2b69c9be 100755
--- a/src/validators/bgp-route-target
+++ b/src/validators/bgp-rd-rt
@@ -19,29 +19,37 @@ from vyos.template import is_ipv4
 
 parser = ArgumentParser()
 group = parser.add_mutually_exclusive_group()
-group.add_argument('--single', action='store', help='Validate and allow only one route-target')
-group.add_argument('--multi', action='store', help='Validate multiple, whitespace separated route-targets')
+group.add_argument('--route-distinguisher', action='store', help='Validate BGP route distinguisher')
+group.add_argument('--route-target', action='store', help='Validate one BGP route-target')
+group.add_argument('--route-target-multi', action='store', help='Validate multiple, whitespace separated BGP route-targets')
 args = parser.parse_args()
 
-def is_valid_rt(rt):
-    # every route target needs to have a colon and must consists of two parts
+def is_valid(rt):
+    """ Verify BGP RD/RT - both can be verified using the same logic """
+    # every RD/RT (route distinguisher/route target) needs to have a colon and
+    # must consists of two parts
     value = rt.split(':')
     if len(value) != 2:
         return False
-    # A route target must either be only numbers, or the first part must be an
-    # IPv4 address
+
+    # An RD/RT must either be only numbers, or the first part must be an IPv4
+    # address
     if (is_ipv4(value[0]) or value[0].isdigit()) and value[1].isdigit():
         return True
     return False
 
 if __name__ == '__main__':
-    if args.single:
-        if not is_valid_rt(args.single):
+    if args.route_distinguisher:
+        if not is_valid(args.route_distinguisher):
+            exit(1)
+
+    elif args.route_target:
+        if not is_valid(args.route_target):
             exit(1)
 
-    elif args.multi:
-        for rt in args.multi.split(' '):
-            if not is_valid_rt(rt):
+    elif args.route_target_multi:
+        for rt in args.route_target_multi.split(' '):
+            if not is_valid(rt):
                 exit(1)
 
     else:
diff --git a/src/validators/ipv4-multicast b/src/validators/ipv4-multicast
index e5cbc9532..5465c728d 100755
--- a/src/validators/ipv4-multicast
+++ b/src/validators/ipv4-multicast
@@ -1,3 +1,3 @@
 #!/bin/sh
 
-ipaddrcheck --is-ipv4-multicast $1
+ipaddrcheck --is-ipv4-multicast $1 && ipaddrcheck --is-ipv4-single $1
diff --git a/src/validators/ipv6-multicast b/src/validators/ipv6-multicast
index 66cd90c9c..5afc437e5 100755
--- a/src/validators/ipv6-multicast
+++ b/src/validators/ipv6-multicast
@@ -1,3 +1,3 @@
 #!/bin/sh
 
-ipaddrcheck --is-ipv6-multicast $1
+ipaddrcheck --is-ipv6-multicast $1 && ipaddrcheck --is-ipv6-single $1
diff --git a/src/validators/range b/src/validators/range
new file mode 100755
index 000000000..d4c25f3c4
--- /dev/null
+++ b/src/validators/range
@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2021 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+import sys
+import argparse
+
+class MalformedRange(Exception):
+    pass
+
+def validate_range(value, min=None, max=None):
+    try:
+        lower, upper = re.match(r'^(\d+)-(\d+)$', value).groups()
+
+        lower, upper = int(lower), int(upper)
+
+        if int(lower) > int(upper):
+            raise MalformedRange("the lower bound exceeds the upper bound".format(value))
+
+        if min is not None:
+            if lower < min:
+                raise MalformedRange("the lower bound must not be less than {}".format(min))
+
+        if max is not None:
+            if upper > max:
+                raise MalformedRange("the upper bound must not be greater than {}".format(max))
+
+    except (AttributeError, ValueError):
+        raise MalformedRange("range syntax error")
+
+parser = argparse.ArgumentParser(description='Range validator.')
+parser.add_argument('--min', type=int, action='store')
+parser.add_argument('--max', type=int, action='store')
+parser.add_argument('value', action='store')
+
+if __name__ == '__main__':
+    args = parser.parse_args()
+
+    try:
+        validate_range(args.value, min=args.min, max=args.max)
+    except MalformedRange as e:
+        print("Incorrect range '{}': {}".format(args.value, e))
+        sys.exit(1)
diff --git a/src/validators/script b/src/validators/script
index 1d8a27e5c..4ffdeb2a0 100755
--- a/src/validators/script
+++ b/src/validators/script
@@ -36,7 +36,7 @@ if __name__ == '__main__':
 
     # File outside the config dir is just a warning
     if not vyos.util.file_is_persistent(script):
-        sys.exit(
-            f'Warning: file {path} is outside the / config directory\n'
+        sys.exit(0)(
+            f'Warning: file {script} is outside the "/config" directory\n'
             'It will not be automatically migrated to a new image on system update'
         )