18 files changed, 279 insertions, 114 deletions

diff --git a/data/templates/accel-ppp/ipoe.config.j2 b/data/templates/accel-ppp/ipoe.config.j2
index 81f63c53b..34dfa529a 100644
--- a/data/templates/accel-ppp/ipoe.config.j2
+++ b/data/templates/accel-ppp/ipoe.config.j2
@@ -38,6 +38,9 @@ level={{ log.level }}
 
 [ipoe]
 verbose=1
+{% if lua_file is vyos_defined %}
+lua-file={{ lua_file }}
+{% endif %}
 {% if interface is vyos_defined %}
 {%     for iface, iface_config in interface.items() %}
 {%         set tmp = 'interface=' %}
@@ -55,7 +58,10 @@ verbose=1
 {%         set range = 'range=' ~ iface_config.client_subnet ~ ',' if iface_config.client_subnet is vyos_defined else '' %}
 {%         set relay = ',' ~ 'relay=' ~ iface_config.external_dhcp.dhcp_relay  if iface_config.external_dhcp.dhcp_relay is vyos_defined else '' %}
 {%         set giaddr = ',' ~ 'giaddr=' ~ iface_config.external_dhcp.giaddr if iface_config.external_dhcp.giaddr is vyos_defined else '' %}
-{{ tmp }},{{ shared }}mode={{ iface_config.mode | upper }},ifcfg=1,{{ range }}start=dhcpv4,ipv6=1{{ relay }}{{ giaddr }}
+{%         set username = ',' ~ 'username=lua:' ~ iface_config.lua_username if iface_config.lua_username is vyos_defined else '' %}
+{%         set start_map = {'dhcp': 'dhcpv4', 'unclassified-packet': 'up', 'auto': 'auto'} %}
+{%         set start = start_map[iface_config.start_session] %}
+{{ tmp }},{{ shared }}mode={{ iface_config.mode | upper }},ifcfg=1,{{ range }}start={{ start }},ipv6=1{{ relay }}{{ giaddr }}{{ username }}
 {%         if iface_config.vlan_mon is vyos_defined %}
 vlan-mon={{ iface }},{{ iface_config.vlan | join(',') }}
 {%         endif %}
diff --git a/data/templates/ipsec/swanctl.conf.j2 b/data/templates/ipsec/swanctl.conf.j2
index 698a9135e..64e7ea860 100644
--- a/data/templates/ipsec/swanctl.conf.j2
+++ b/data/templates/ipsec/swanctl.conf.j2
@@ -87,7 +87,11 @@ secrets {
         id-{{ gen_uuid }} = "{{ id }}"
 {%             endfor %}
 {%         endif %}
+{%         if psk_config.secret_type is vyos_defined('base64') %}
+        secret = 0s{{ psk_config.secret }}
+{%         elif psk_config.secret_type is vyos_defined('plaintext') %}
         secret = "{{ psk_config.secret }}"
+{%         endif %}
     }
 {%     endfor %}
 {% endif %}
diff --git a/interface-definitions/pki.xml.in b/interface-definitions/pki.xml.in
index b922771c1..c69886a4b 100644
--- a/interface-definitions/pki.xml.in
+++ b/interface-definitions/pki.xml.in
@@ -35,6 +35,12 @@
               <multi/>
             </properties>
           </leafNode>
+          <leafNode name="system-install">
+            <properties>
+              <help>Install into CA certificate store on router</help>
+              <valueless/>
+            </properties>
+          </leafNode>
           #include <include/pki/cli-revoke.xml.i>
         </children>
       </tagNode>
diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in
index 25bc43cc6..39cfb7889 100644
--- a/interface-definitions/service_ipoe-server.xml.in
+++ b/interface-definitions/service_ipoe-server.xml.in
@@ -131,6 +131,30 @@
                 </properties>
                 <defaultValue>shared</defaultValue>
               </leafNode>
+              <leafNode name="start-session">
+                <properties>
+                  <help>Start session options</help>
+                  <completionHelp>
+                    <list>auto dhcp unclassified-packet</list>
+                  </completionHelp>
+                  <valueHelp>
+                    <format>auto</format>
+                    <description>Start session with username as the interface name</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>dhcp</format>
+                    <description>Start session on DHCPv4 Discover</description>
+                  </valueHelp>
+                  <valueHelp>
+                    <format>unclassified-packet</format>
+                    <description>Start session on unclassified-packet</description>
+                  </valueHelp>
+                  <constraint>
+                    <regex>(auto|dhcp|unclassified-packet)</regex>
+                  </constraint>
+                </properties>
+                <defaultValue>dhcp</defaultValue>
+              </leafNode>
               <leafNode name="client-subnet">
                 <properties>
                   <help>Client address pool</help>
@@ -174,10 +198,34 @@
                   </leafNode>
                 </children>
               </node>
+              <leafNode name="lua-username">
+                <properties>
+                  <help>Username function</help>
+                  <valueHelp>
+                    <format>txt</format>
+                    <description>Name of the function in the Lua file to construct usernames with</description>
+                  </valueHelp>
+                  <constraint>
+                      #include <include/constraint/alpha-numeric-hyphen-underscore.xml.i>
+                  </constraint>
+                </properties>
+              </leafNode>
               #include <include/accel-ppp/vlan.xml.i>
               #include <include/accel-ppp/vlan-mon.xml.i>
             </children>
           </tagNode>
+          <leafNode name="lua-file">
+            <properties>
+              <help>Lua script file for constructing user names</help>
+              <valueHelp>
+                <format>filename</format>
+                <description>File with Lua script in /config/scripts directory</description>
+              </valueHelp>
+              <constraint>
+                <validator name="file-path" argument="--strict --parent-dir /config/scripts"/>
+              </constraint>
+            </properties>
+          </leafNode>
           #include <include/accel-ppp/client-ip-pool.xml.i>
           #include <include/accel-ppp/client-ipv6-pool.xml.i>
           #include <include/accel-ppp/default-pool.xml.i>
diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index d9d6fd93b..5540021e2 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -41,6 +41,18 @@
                       </valueHelp>
                     </properties>
                   </leafNode>
+                  <leafNode name="secret-type">
+                    <properties>
+                      <help>Secret type</help>
+                      <completionHelp>
+                        <list>base64 plaintext</list>
+                      </completionHelp>
+                      <constraint>
+                        <regex>(base64|plaintext)</regex>
+                      </constraint>
+                    </properties>
+                    <defaultValue>plaintext</defaultValue>
+                  </leafNode>
                 </children>
               </tagNode>
             </children>
diff --git a/op-mode-definitions/show-bridge.xml.in b/op-mode-definitions/show-bridge.xml.in
index 5d8cc3847..1212ab1f9 100644
--- a/op-mode-definitions/show-bridge.xml.in
+++ b/op-mode-definitions/show-bridge.xml.in
@@ -66,7 +66,7 @@
             <properties>
               <help>Display bridge interface nexthop-group</help>
             </properties>
-            <command>${vyos_op_scripts_dir}/bridge.py show_detail --nexthop_group --interface=$3</command>
+            <command>${vyos_op_scripts_dir}/bridge.py show_detail --nexthop-group --interface=$3</command>
           </leafNode>
         </children>
       </tagNode>
diff --git a/op-mode-definitions/show-monitoring.xml.in b/op-mode-definitions/show-monitoring.xml.in
index 2651b3438..9fd60e45a 100644
--- a/op-mode-definitions/show-monitoring.xml.in
+++ b/op-mode-definitions/show-monitoring.xml.in
@@ -2,12 +2,68 @@
 <interfaceDefinition>
   <node name="show">
     <children>
-      <leafNode name="monitoring">
+      <node name="monitoring">
         <properties>
           <help>Show currently monitored services</help>
         </properties>
-        <command>vtysh -c "show debugging"</command>
-      </leafNode>
+        <children>
+          <node name="frr">
+            <properties>
+              <help>Show currently monitored FRR services</help>
+            </properties>
+            <command>vtysh -c "show debugging"</command>
+            <children>
+              <node name="zebra">
+                <properties>
+                  <help>Show Zebra routing information</help>
+                </properties>
+                <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command>
+                <children>
+                  <node name="client">
+                    <properties>
+                      <help>Client information</help>
+                    </properties>
+                    <children>
+                      <node name="summary">
+                        <properties>
+                          <help>Brief summary</help>
+                        </properties>
+                        <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command>
+                      </node>
+                    </children>
+                  </node>
+                  <node name="dplane">
+                    <properties>
+                      <help>Zebra dataplane information</help>
+                    </properties>
+                    <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command>
+                  </node>
+                  <node name="router">
+                    <properties>
+                      <help>Zebra router information</help>
+                    </properties>
+                    <children>
+                      <node name="table">
+                        <properties>
+                          <help>Zebra routing table information</help>
+                        </properties>
+                        <children>
+                          <node name="summary">
+                            <properties>
+                              <help>Summary information</help>
+                            </properties>
+                            <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh "show ${@:4}"</command>
+                          </node>
+                        </children>
+                      </node>
+                    </children>
+                  </node>
+                </children>
+              </node>
+            </children>
+          </node>
+        </children>
+      </node>
     </children>
   </node>
 </interfaceDefinition>
diff --git a/op-mode-definitions/show-zebra.xml.in b/op-mode-definitions/show-zebra.xml.in
deleted file mode 100644
index 69991a1d5..000000000
--- a/op-mode-definitions/show-zebra.xml.in
+++ /dev/null
@@ -1,54 +0,0 @@
-<?xml version="1.0"?>
-<interfaceDefinition>
-  <node name="show">
-    <children>
-      <node name="zebra">
-        <properties>
-          <help>Show Zebra routing information</help>
-        </properties>
-        <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
-        <children>
-          <node name="client">
-            <properties>
-              <help>Client information </help>
-            </properties>
-            <children>
-              <node name="summary">
-                <properties>
-                  <help>Brief Summary</help>
-                </properties>
-                <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
-              </node>
-            </children>
-          </node>
-          <node name="dplane">
-            <properties>
-              <help>Zebra dataplane information</help>
-            </properties>
-            <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
-          </node>
-          <node name="router">
-            <properties>
-              <help>Zebra Router Information</help>
-            </properties>
-            <children>
-              <node name="table">
-                <properties>
-                  <help>Table Information about this Zebra Router</help>
-                </properties>
-                <children>
-                  <node name="summary">
-                    <properties>
-                      <help>Summary Information</help>
-                    </properties>
-                    <command>${vyos_op_scripts_dir}/vtysh_wrapper.sh $@</command>
-                  </node>
-                </children>
-              </node>
-            </children>
-          </node>
-        </children>
-      </node>
-    </children>
-  </node>
-</interfaceDefinition>
diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py
index dec619d3e..425990967 100644
--- a/python/vyos/defaults.py
+++ b/python/vyos/defaults.py
@@ -36,7 +36,8 @@ directories = {
   'isc_dhclient_dir' : '/run/dhclient',
   'dhcp6_client_dir' : '/run/dhcp6c',
   'vyos_configdir' : '/opt/vyatta/config',
-  'completion_dir' : f'{base_dir}/completion'
+  'completion_dir' : f'{base_dir}/completion',
+  'ca_certificates' : '/usr/local/share/ca-certificates/vyos'
 }
 
 config_status = '/tmp/vyos-config-status'
diff --git a/python/vyos/utils/convert.py b/python/vyos/utils/convert.py
index dd4266f57..2f587405d 100644
--- a/python/vyos/utils/convert.py
+++ b/python/vyos/utils/convert.py
@@ -235,3 +235,29 @@ def convert_data(data) -> dict | list | tuple | str | int | float | bool | None:
     # which cannot be converted to JSON
     # for example: complex | range | memoryview
     return
+
+
+def encode_to_base64(input_string):
+    """
+    Encodes a given string to its base64 representation.
+
+    Args:
+        input_string (str): The string to be encoded.
+
+    Returns:
+        str: The base64-encoded version of the input string.
+
+    Example:
+        input_string = "Hello, World!"
+        encoded_string = encode_to_base64(input_string)
+        print(encoded_string)  # Output: SGVsbG8sIFdvcmxkIQ==
+    """
+    import base64
+    # Convert the string to bytes
+    byte_string = input_string.encode('utf-8')
+
+    # Encode the byte string to base64
+    encoded_string = base64.b64encode(byte_string)
+
+    # Decode the base64 bytes back to a string
+    return encoded_string.decode('utf-8')
diff --git a/smoketest/scripts/cli/test_vpn_ipsec.py b/smoketest/scripts/cli/test_vpn_ipsec.py
index de18d0427..f2bea58d1 100755
--- a/smoketest/scripts/cli/test_vpn_ipsec.py
+++ b/smoketest/scripts/cli/test_vpn_ipsec.py
@@ -21,6 +21,7 @@ from base_vyostest_shim import VyOSUnitTestSHIM
 
 from vyos.configsession import ConfigSessionError
 from vyos.ifconfig import Interface
+from vyos.utils.convert import encode_to_base64
 from vyos.utils.process import process_named_running
 from vyos.utils.file import read_file
 
@@ -495,6 +496,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         local_id = 'vyos-r1'
         remote_id = 'vyos-r2'
         peer_base_path = base_path + ['site-to-site', 'peer', connection_name]
+        secret_base64 = encode_to_base64(secret)
 
         self.cli_set(tunnel_path + ['tun1', 'encapsulation', 'gre'])
         self.cli_set(tunnel_path + ['tun1', 'source-address', local_address])
@@ -509,7 +511,8 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
         self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', remote_id])
         self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', local_address])
         self.cli_set(base_path + ['authentication', 'psk', connection_name, 'id', peer_ip])
-        self.cli_set(base_path + ['authentication', 'psk', connection_name, 'secret', secret])
+        self.cli_set(base_path + ['authentication', 'psk', connection_name, 'secret', secret_base64])
+        self.cli_set(base_path + ['authentication', 'psk', connection_name, 'secret-type', 'base64'])
 
         self.cli_set(peer_base_path + ['authentication', 'local-id', local_id])
         self.cli_set(peer_base_path + ['authentication', 'mode', 'pre-shared-secret'])
@@ -546,7 +549,7 @@ class TestVPNIPsec(VyOSUnitTestSHIM.TestCase):
             f'id-{regex_uuid4} = "{remote_id}"',
             f'id-{regex_uuid4} = "{peer_ip}"',
             f'id-{regex_uuid4} = "{local_address}"',
-            f'secret = "{secret}"',
+            f'secret = 0s{secret_base64}',
         ]
 
         for line in swanctl_secrets_lines:
diff --git a/src/conf_mode/pki.py b/src/conf_mode/pki.py
index 45e0129a3..acea2c9be 100755
--- a/src/conf_mode/pki.py
+++ b/src/conf_mode/pki.py
@@ -50,6 +50,7 @@ from vyos import airbag
 airbag.enable()
 
 vyos_certbot_dir = directories['certbot']
+vyos_ca_certificates_dir = directories['ca_certificates']
 
 # keys to recursively search for under specified path
 sync_search = [
@@ -149,35 +150,15 @@ def get_config(config=None):
     if len(argv) > 1 and argv[1] == 'certbot_renew':
         pki['certbot_renew'] = {}
 
-    tmp = node_changed(conf, base + ['ca'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
-    if tmp:
-        if 'changed' not in pki: pki.update({'changed':{}})
-        pki['changed'].update({'ca' : tmp})
-
-    tmp = node_changed(conf, base + ['certificate'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
-    if tmp:
-        if 'changed' not in pki: pki.update({'changed':{}})
-        pki['changed'].update({'certificate' : tmp})
+    changed_keys = ['ca', 'certificate', 'dh', 'key-pair', 'openssh', 'openvpn']
 
-    tmp = node_changed(conf, base + ['dh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
-    if tmp:
-        if 'changed' not in pki: pki.update({'changed':{}})
-        pki['changed'].update({'dh' : tmp})
+    for key in changed_keys:
+        tmp = node_changed(conf, base + [key], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
 
-    tmp = node_changed(conf, base + ['key-pair'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
-    if tmp:
-        if 'changed' not in pki: pki.update({'changed':{}})
-        pki['changed'].update({'key_pair' : tmp})
-
-    tmp = node_changed(conf, base + ['openssh'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
-    if tmp:
-        if 'changed' not in pki: pki.update({'changed':{}})
-        pki['changed'].update({'openssh' : tmp})
+        if 'changed' not in pki:
+            pki.update({'changed':{}})
 
-    tmp = node_changed(conf, base + ['openvpn', 'shared-secret'], recursive=True, expand_nodes=Diff.DELETE | Diff.ADD)
-    if tmp:
-        if 'changed' not in pki: pki.update({'changed':{}})
-        pki['changed'].update({'openvpn' : tmp})
+        pki['changed'].update({key.replace('-', '_') : tmp})
 
     # We only merge on the defaults of there is a configuration at all
     if conf.exists(base):
@@ -417,10 +398,33 @@ def verify(pki):
 
     return None
 
+def cleanup_system_ca():
+    if not os.path.exists(vyos_ca_certificates_dir):
+        os.mkdir(vyos_ca_certificates_dir)
+    else:
+        for filename in os.listdir(vyos_ca_certificates_dir):
+            full_path = os.path.join(vyos_ca_certificates_dir, filename)
+            if os.path.isfile(full_path):
+                os.unlink(full_path)
+
 def generate(pki):
     if not pki:
+        cleanup_system_ca()
         return None
 
+    # Create or cleanup CA install directory
+    if 'changed' in pki and 'ca' in pki['changed']:
+        cleanup_system_ca()
+
+        if 'ca' in pki:
+            for ca, ca_conf in pki['ca'].items():
+                if 'system_install' in ca_conf:
+                    ca_obj = load_certificate(ca_conf['certificate'])
+                    ca_path = os.path.join(vyos_ca_certificates_dir, f'{ca}.crt')
+
+                    with open(ca_path, 'w') as f:
+                        f.write(encode_certificate(ca_obj))
+
     # Certbot renewal only needs to re-trigger the services to load up the
     # new PEM file
     if 'certbot_renew' in pki:
@@ -487,6 +491,7 @@ def apply(pki):
     systemd_certbot_name = 'certbot.timer'
     if not pki:
         call(f'systemctl stop {systemd_certbot_name}')
+        call('update-ca-certificates')
         return None
 
     has_certbot = False
@@ -504,6 +509,10 @@ def apply(pki):
     if 'changed' in pki:
         call_dependents()
 
+        # Rebuild ca-certificates bundle
+        if 'ca' in pki['changed']:
+            call('update-ca-certificates')
+
     return None
 
 if __name__ == '__main__':
diff --git a/src/conf_mode/protocols_static_multicast.py b/src/conf_mode/protocols_static_multicast.py
index d323ceb4f..c8894fd41 100755
--- a/src/conf_mode/protocols_static_multicast.py
+++ b/src/conf_mode/protocols_static_multicast.py
@@ -86,10 +86,10 @@ def verify(mroute):
     if mroute is None:
         return None
 
-    for route in mroute['mroute']:
-        route = route.split('/')
+    for mcast_route in mroute['mroute']:
+        route = mcast_route.split('/')
         if IPv4Address(route[0]) < IPv4Address('224.0.0.0'):
-            raise ConfigError(route + " not a multicast network")
+            raise ConfigError(f'{mcast_route} not a multicast network')
 
 
 def generate(mroute):
diff --git a/src/conf_mode/service_ipoe-server.py b/src/conf_mode/service_ipoe-server.py
index c7e3ef033..a14d4b5b6 100755
--- a/src/conf_mode/service_ipoe-server.py
+++ b/src/conf_mode/service_ipoe-server.py
@@ -31,6 +31,7 @@ from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
 from vyos.accel_ppp_util import verify_accel_ppp_authentication
 from vyos import ConfigError
 from vyos import airbag
+
 airbag.enable()
 
 
@@ -52,7 +53,9 @@ def get_config(config=None):
 
     if dict_search('client_ip_pool', ipoe):
         # Multiple named pools require ordered values T5099
-        ipoe['ordered_named_pools'] = get_pools_in_order(dict_search('client_ip_pool', ipoe))
+        ipoe['ordered_named_pools'] = get_pools_in_order(
+            dict_search('client_ip_pool', ipoe)
+        )
 
     ipoe['server_type'] = 'ipoe'
     return ipoe
@@ -68,11 +71,23 @@ def verify(ipoe):
     for interface, iface_config in ipoe['interface'].items():
         verify_interface_exists(ipoe, interface, warning_only=True)
         if 'client_subnet' in iface_config and 'vlan' in iface_config:
-            raise ConfigError('Option "client-subnet" and "vlan" are mutually exclusive, '
-                              'use "client-ip-pool" instead!')
-        if 'vlan_mon' in iface_config and not 'vlan' in iface_config:
+            raise ConfigError(
+                'Options "client-subnet" and "vlan" are mutually exclusive, '
+                'use "client-ip-pool" instead!'
+            )
+        if 'vlan_mon' in iface_config and 'vlan' not in iface_config:
             raise ConfigError('Option "vlan-mon" requires "vlan" to be set!')
 
+        if 'lua_username' in iface_config:
+            if 'lua_file' not in ipoe:
+                raise ConfigError(
+                    'Option "lua-username" requires "lua-file" to be set!'
+                )
+            if dict_search('authentication.mode', ipoe) != 'radius':
+                raise ConfigError(
+                    'Can configure username with Lua script only for RADIUS authentication'
+                )
+
     verify_accel_ppp_authentication(ipoe, local_users=False)
     verify_accel_ppp_ip_pool(ipoe)
     verify_accel_ppp_name_servers(ipoe)
@@ -88,14 +103,15 @@ def generate(ipoe):
     render(ipoe_conf, 'accel-ppp/ipoe.config.j2', ipoe)
 
     if dict_search('authentication.mode', ipoe) == 'local':
-        render(ipoe_chap_secrets, 'accel-ppp/chap-secrets.ipoe.j2',
-               ipoe, permission=0o640)
+        render(
+            ipoe_chap_secrets, 'accel-ppp/chap-secrets.ipoe.j2', ipoe, permission=0o640
+        )
     return None
 
 
 def apply(ipoe):
     systemd_service = 'accel-ppp@ipoe.service'
-    if ipoe == None:
+    if ipoe is None:
         call(f'systemctl stop {systemd_service}')
         for file in [ipoe_conf, ipoe_chap_secrets]:
             if os.path.exists(file):
@@ -103,7 +119,10 @@ def apply(ipoe):
 
         return None
 
-    call(f'systemctl reload-or-restart {systemd_service}')
+    # Accel-pppd does not do soft-reload correctly.
+    # Most of the changes require restarting the service
+    call(f'systemctl restart {systemd_service}')
+
 
 if __name__ == '__main__':
     try:
diff --git a/src/conf_mode/system_config-management.py b/src/conf_mode/system_config-management.py
index 8de4e5342..a3ce66512 100755
--- a/src/conf_mode/system_config-management.py
+++ b/src/conf_mode/system_config-management.py
@@ -39,6 +39,9 @@ def get_config(config=None):
 
 
 def verify(mgmt):
+    if mgmt is None:
+        return
+
     d = mgmt.config_dict
     confirm = d.get('commit_confirm', {})
     if confirm.get('action', '') == 'reload' and 'commit_revisions' not in d:
diff --git a/src/etc/sudoers.d/vyos b/src/etc/sudoers.d/vyos
index 67d7babc4..198b9b9aa 100644
--- a/src/etc/sudoers.d/vyos
+++ b/src/etc/sudoers.d/vyos
@@ -1,7 +1,8 @@
 #
 # VyOS modifications to sudo configuration
 #
-Defaults syslog_goodpri=info
+Defaults !syslog
+Defaults !pam_session
 Defaults env_keep+=VYATTA_*
 
 #
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 8825cc16a..f8cc87507 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -471,6 +471,12 @@ start ()
         touch /tmp/vyos.smoketest.debug
     fi
 
+    # Cleanup PKI CAs
+    if [ -d /usr/local/share/ca-certificates/vyos ]; then
+        rm -f /usr/local/share/ca-certificates/vyos/*.crt
+        update-ca-certificates >/dev/null 2>&1
+    fi
+
     log_action_begin_msg "Mounting VyOS Config"
     # ensure the vyatta_configdir supports a large number of inodes since
     # the config hierarchy is often inode-bound (instead of size).
diff --git a/src/op_mode/bridge.py b/src/op_mode/bridge.py
index e80b1c21d..c4293a77c 100755
--- a/src/op_mode/bridge.py
+++ b/src/op_mode/bridge.py
@@ -23,10 +23,11 @@ from tabulate import tabulate
 
 from vyos.utils.process import cmd
 from vyos.utils.process import rc_cmd
-from vyos.utils.process	import call
+from vyos.utils.process import call
 
 import vyos.opmode
 
+
 def _get_json_data():
     """
     Get bridge data format JSON
@@ -43,7 +44,7 @@ def _get_raw_data_summary():
     return data_dict
 
 
-def _get_raw_data_vlan(tunnel:bool=False):
+def _get_raw_data_vlan(tunnel: bool = False):
     """
     :returns dict
     """
@@ -54,14 +55,18 @@ def _get_raw_data_vlan(tunnel:bool=False):
     data_dict = json.loads(json_data)
     return data_dict
 
+
 def _get_raw_data_vni() -> dict:
     """
     :returns dict
     """
-    json_data = cmd(f'bridge --json vni show')
+    code, json_data = rc_cmd(f'bridge --json vni show')
+    if code != 0:
+        raise vyos.opmode.UnconfiguredObject('VNI is not configured')
     data_dict = json.loads(json_data)
     return data_dict
 
+
 def _get_raw_data_fdb(bridge):
     """Get MAC-address for the bridge brX
     :returns list
@@ -70,7 +75,9 @@ def _get_raw_data_fdb(bridge):
     # From iproute2 fdb.c, fdb_show() will only exit(-1) in case of
     # non-existent bridge device; raise error.
     if code == 255:
-        raise vyos.opmode.UnconfiguredObject(f"bridge {bridge} does not exist in the system")
+        raise vyos.opmode.UnconfiguredObject(
+            f'bridge {bridge} does not exist in the system'
+        )
     data_dict = json.loads(json_data)
     return data_dict
 
@@ -116,8 +123,8 @@ def _get_formatted_output_summary(data):
             flags = ','.join(option.get('flags')).lower()
             prio = option.get('priority')
             member_entries.append([interface, state, mtu, flags, prio])
-        member_headers = ["Member", "State", "MTU", "Flags", "Prio"]
-        output_members = tabulate(member_entries, member_headers, numalign="left")
+        member_headers = ['Member', 'State', 'MTU', 'Flags', 'Prio']
+        output_members = tabulate(member_entries, member_headers, numalign='left')
         output_bridge = f"""Bridge interface {bridge}:
 {output_members}
 
@@ -138,13 +145,14 @@ def _get_formatted_output_vlan(data):
                 vlan_end = vlan_entry.get('vlanEnd')
                 vlan = f'{vlan}-{vlan_end}'
             flags_raw = vlan_entry.get('flags')
-            flags = ', '.join(flags_raw if isinstance(flags_raw,list) else "").lower()
+            flags = ', '.join(flags_raw if isinstance(flags_raw, list) else '').lower()
             data_entries.append([interface, vlan, flags])
 
-    headers = ["Interface", "VLAN", "Flags"]
+    headers = ['Interface', 'VLAN', 'Flags']
     output = tabulate(data_entries, headers)
     return output
 
+
 def _get_formatted_output_vlan_tunnel(data):
     data_entries = []
     for entry in data:
@@ -166,10 +174,11 @@ def _get_formatted_output_vlan_tunnel(data):
                 #                 200    200
                 data_entries.append(['', vlan, vni])
 
-    headers = ["Interface", "VLAN", "VNI"]
+    headers = ['Interface', 'VLAN', 'VNI']
     output = tabulate(data_entries, headers)
     return output
 
+
 def _get_formatted_output_vni(data):
     data_entries = []
     for entry in data:
@@ -182,10 +191,11 @@ def _get_formatted_output_vni(data):
                 vlan = f'{vlan}-{vlan_end}'
             data_entries.append([interface, vlan])
 
-    headers = ["Interface", "VNI"]
+    headers = ['Interface', 'VNI']
     output = tabulate(data_entries, headers)
     return output
 
+
 def _get_formatted_output_fdb(data):
     data_entries = []
     for entry in data:
@@ -195,8 +205,8 @@ def _get_formatted_output_fdb(data):
         flags = ','.join(entry['flags'])
         data_entries.append([interface, mac, state, flags])
 
-    headers = ["Interface", "Mac address", "State", "Flags"]
-    output = tabulate(data_entries, headers, numalign="left")
+    headers = ['Interface', 'Mac address', 'State', 'Flags']
+    output = tabulate(data_entries, headers, numalign='left')
     return output
 
 
@@ -209,28 +219,33 @@ def _get_formatted_output_mdb(data):
             state = mdb_entry.get('state')
             flags = ','.join(mdb_entry.get('flags'))
             data_entries.append([interface, group, state, flags])
-    headers = ["Interface", "Group", "State", "Flags"]
+    headers = ['Interface', 'Group', 'State', 'Flags']
     output = tabulate(data_entries, headers)
     return output
 
+
 def _get_bridge_detail(iface):
     """Get interface detail statistics"""
     return call(f'vtysh -c "show interface {iface}"')
 
+
 def _get_bridge_detail_nexthop_group(iface):
     """Get interface detail nexthop_group statistics"""
     return call(f'vtysh -c "show interface {iface} nexthop-group"')
 
+
 def _get_bridge_detail_nexthop_group_raw(iface):
     out = cmd(f'vtysh -c "show interface {iface} nexthop-group"')
     return out
 
+
 def _get_bridge_detail_raw(iface):
     """Get interface detail json statistics"""
-    data =  cmd(f'vtysh -c "show interface {iface} json"')
+    data = cmd(f'vtysh -c "show interface {iface} json"')
     data_dict = json.loads(data)
     return data_dict
 
+
 def show(raw: bool):
     bridge_data = _get_raw_data_summary()
     if raw:
@@ -249,6 +264,7 @@ def show_vlan(raw: bool, tunnel: typing.Optional[bool]):
         else:
             return _get_formatted_output_vlan(bridge_vlan)
 
+
 def show_vni(raw: bool):
     bridge_vni = _get_raw_data_vni()
     if raw:
@@ -256,6 +272,7 @@ def show_vni(raw: bool):
     else:
         return _get_formatted_output_vni(bridge_vni)
 
+
 def show_fdb(raw: bool, interface: str):
     fdb_data = _get_raw_data_fdb(interface)
     if raw:
@@ -271,6 +288,7 @@ def show_mdb(raw: bool, interface: str):
     else:
         return _get_formatted_output_mdb(mdb_data)
 
+
 def show_detail(raw: bool, nexthop_group: typing.Optional[bool], interface: str):
     if raw:
         if nexthop_group:
@@ -283,6 +301,7 @@ def show_detail(raw: bool, nexthop_group: typing.Optional[bool], interface: str)
         else:
             return _get_bridge_detail(interface)
 
+
 if __name__ == '__main__':
     try:
         res = vyos.opmode.run(sys.modules[__name__])