19 files changed, 275 insertions, 48 deletions

diff --git a/Makefile b/Makefile
index 763f44952..14fefe208 100644
--- a/Makefile
+++ b/Makefile
@@ -7,7 +7,7 @@ LIBS := -lzmq
 CFLAGS :=
 BUILD_ARCH := $(shell dpkg-architecture -q DEB_BUILD_ARCH)
 J2LINT := $(shell command -v j2lint 2> /dev/null)
-PYLINT_FILES := $(shell git ls-files *.py src/migration-scripts)
+PYLINT_FILES := $(shell git ls-files *.py src/migration-scripts src/services)
 LIBVYOSCONFIG_BUILD_PATH := /tmp/libvyosconfig/_build/libvyosconfig.so
 LIBVYOSCONFIG_STATUS := $(shell git submodule status)
 
diff --git a/interface-definitions/include/dhcp/option-v4.xml.i b/interface-definitions/include/dhcp/option-v4.xml.i
index bd6fc6043..08fbcca4a 100644
--- a/interface-definitions/include/dhcp/option-v4.xml.i
+++ b/interface-definitions/include/dhcp/option-v4.xml.i
@@ -59,6 +59,18 @@
         <constraintErrorMessage>DHCP client prefix length must be 0 to 32</constraintErrorMessage>
       </properties>
     </leafNode>
+    <leafNode name="capwap-controller">
+      <properties>
+        <help>IP address of CAPWAP access controller (Option 138)</help>
+        <valueHelp>
+          <format>ipv4</format>
+          <description>CAPWAP AC controller</description>
+        </valueHelp>
+        <constraint>
+          <validator name="ipv4-address"/>
+        </constraint>
+      </properties>
+    </leafNode>
     <leafNode name="default-router">
       <properties>
         <help>IP address of default router</help>
diff --git a/interface-definitions/include/dhcp/option-v6.xml.i b/interface-definitions/include/dhcp/option-v6.xml.i
index e1897f52d..202843ddf 100644
--- a/interface-definitions/include/dhcp/option-v6.xml.i
+++ b/interface-definitions/include/dhcp/option-v6.xml.i
@@ -7,6 +7,18 @@
     #include <include/dhcp/captive-portal.xml.i>
     #include <include/dhcp/domain-search.xml.i>
     #include <include/name-server-ipv6.xml.i>
+    <leafNode name="capwap-controller">
+      <properties>
+        <help>IP address of CAPWAP access controller (Option 52)</help>
+        <valueHelp>
+          <format>ipv6</format>
+          <description>CAPWAP AC controller</description>
+        </valueHelp>
+        <constraint>
+          <validator name="ipv6-address"/>
+        </constraint>
+      </properties>
+    </leafNode>
     <leafNode name="nis-domain">
       <properties>
         <help>NIS domain name for client to use</help>
diff --git a/libvyosconfig b/libvyosconfig
-Subproject 58dbb42e827e3d326c6e0e9470334d4d5c7c396
+Subproject 1dedc69476d707718031c45b53b626da8badf86
diff --git a/python/vyos/component_version.py b/python/vyos/component_version.py
index 94215531d..81d986658 100644
--- a/python/vyos/component_version.py
+++ b/python/vyos/component_version.py
@@ -49,7 +49,9 @@ DEFAULT_CONFIG_PATH = os.path.join(directories['config'], 'config.boot')
 REGEX_WARN_VYOS = r'(// Warning: Do not remove the following line.)'
 REGEX_WARN_VYATTA = r'(/\* Warning: Do not remove the following line. \*/)'
 REGEX_COMPONENT_VERSION_VYOS = r'// vyos-config-version:\s+"([\w@:-]+)"\s*'
-REGEX_COMPONENT_VERSION_VYATTA = r'/\* === vyatta-config-version:\s+"([\w@:-]+)"\s+=== \*/'
+REGEX_COMPONENT_VERSION_VYATTA = (
+    r'/\* === vyatta-config-version:\s+"([\w@:-]+)"\s+=== \*/'
+)
 REGEX_RELEASE_VERSION_VYOS = r'// Release version:\s+(\S*)\s*'
 REGEX_RELEASE_VERSION_VYATTA = r'/\* Release version:\s+(\S*)\s*\*/'
 
@@ -62,16 +64,31 @@ CONFIG_FILE_VERSION = """\
 warn_filter_vyos = re.compile(REGEX_WARN_VYOS)
 warn_filter_vyatta = re.compile(REGEX_WARN_VYATTA)
 
-regex_filter = { 'vyos': dict(zip(['component', 'release'],
-                                  [re.compile(REGEX_COMPONENT_VERSION_VYOS),
-                                   re.compile(REGEX_RELEASE_VERSION_VYOS)])),
-                 'vyatta': dict(zip(['component', 'release'],
-                                    [re.compile(REGEX_COMPONENT_VERSION_VYATTA),
-                                     re.compile(REGEX_RELEASE_VERSION_VYATTA)])) }
+regex_filter = {
+    'vyos': dict(
+        zip(
+            ['component', 'release'],
+            [
+                re.compile(REGEX_COMPONENT_VERSION_VYOS),
+                re.compile(REGEX_RELEASE_VERSION_VYOS),
+            ],
+        )
+    ),
+    'vyatta': dict(
+        zip(
+            ['component', 'release'],
+            [
+                re.compile(REGEX_COMPONENT_VERSION_VYATTA),
+                re.compile(REGEX_RELEASE_VERSION_VYATTA),
+            ],
+        )
+    ),
+}
+
 
 @dataclass
 class VersionInfo:
-    component: Optional[dict[str,int]] = None
+    component: Optional[dict[str, int]] = None
     release: str = get_version()
     vintage: str = 'vyos'
     config_body: Optional[str] = None
@@ -84,8 +101,9 @@ class VersionInfo:
         return bool(self.config_body is None)
 
     def update_footer(self):
-        f = CONFIG_FILE_VERSION.format(component_to_string(self.component),
-                                       self.release)
+        f = CONFIG_FILE_VERSION.format(
+            component_to_string(self.component), self.release
+        )
         self.footer_lines = f.splitlines()
 
     def update_syntax(self):
@@ -121,13 +139,16 @@ class VersionInfo:
         except Exception as e:
             raise ValueError(e) from e
 
+
 def component_to_string(component: dict) -> str:
-    l = [f'{k}@{v}' for k, v in sorted(component.items(), key=lambda x: x[0])]
+    l = [f'{k}@{v}' for k, v in sorted(component.items(), key=lambda x: x[0])]  # noqa: E741
     return ':'.join(l)
 
+
 def component_from_string(string: str) -> dict:
     return {k: int(v) for k, v in re.findall(r'([\w,-]+)@(\d+)', string)}
 
+
 def version_info_from_file(config_file) -> VersionInfo:
     """Return config file component and release version info."""
     version_info = VersionInfo()
@@ -166,27 +187,27 @@ def version_info_from_file(config_file) -> VersionInfo:
 
     return version_info
 
+
 def version_info_from_system() -> VersionInfo:
     """Return system component and release version info."""
     d = component_version()
     sort_d = dict(sorted(d.items(), key=lambda x: x[0]))
-    version_info = VersionInfo(
-        component = sort_d,
-        release =  get_version(),
-        vintage = 'vyos'
-    )
+    version_info = VersionInfo(component=sort_d, release=get_version(), vintage='vyos')
 
     return version_info
 
+
 def version_info_copy(v: VersionInfo) -> VersionInfo:
     """Make a copy of dataclass."""
     return replace(v)
 
+
 def version_info_prune_component(x: VersionInfo, y: VersionInfo) -> VersionInfo:
     """In place pruning of component keys of x not in y."""
     if x.component is None or y.component is None:
         return
-    x.component = { k: v for k,v in x.component.items() if k in y.component }
+    x.component = {k: v for k, v in x.component.items() if k in y.component}
+
 
 def add_system_version(config_str: str = None, out_file: str = None):
     """Wrap config string with system version and write to out_file.
@@ -202,3 +223,11 @@ def add_system_version(config_str: str = None, out_file: str = None):
         version_info.write(out_file)
     else:
         sys.stdout.write(version_info.write_string())
+
+
+def append_system_version(file: str):
+    """Append system version data to existing file"""
+    version_info = version_info_from_system()
+    version_info.update_footer()
+    with open(file, 'a') as f:
+        f.write(version_info.write_string())
diff --git a/python/vyos/configsession.py b/python/vyos/configsession.py
index 90b96b88c..a3be29881 100644
--- a/python/vyos/configsession.py
+++ b/python/vyos/configsession.py
@@ -21,6 +21,10 @@ import subprocess
 from vyos.defaults import directories
 from vyos.utils.process import is_systemd_service_running
 from vyos.utils.dict import dict_to_paths
+from vyos.utils.boot import boot_configuration_complete
+from vyos.vyconf_session import VyconfSession
+
+vyconf_backend = False
 
 CLI_SHELL_API = '/bin/cli-shell-api'
 SET = '/opt/vyatta/sbin/my_set'
@@ -165,6 +169,11 @@ class ConfigSession(object):
 
         self.__run_command([CLI_SHELL_API, 'setupSession'])
 
+        if vyconf_backend and boot_configuration_complete():
+            self._vyconf_session = VyconfSession(on_error=ConfigSessionError)
+        else:
+            self._vyconf_session = None
+
     def __del__(self):
         try:
             output = (
@@ -209,7 +218,10 @@ class ConfigSession(object):
             value = []
         else:
             value = [value]
-        self.__run_command([SET] + path + value)
+        if self._vyconf_session is None:
+            self.__run_command([SET] + path + value)
+        else:
+            self._vyconf_session.set(path + value)
 
     def set_section(self, path: list, d: dict):
         try:
@@ -223,7 +235,10 @@ class ConfigSession(object):
             value = []
         else:
             value = [value]
-        self.__run_command([DELETE] + path + value)
+        if self._vyconf_session is None:
+            self.__run_command([DELETE] + path + value)
+        else:
+            self._vyconf_session.delete(path + value)
 
     def load_section(self, path: list, d: dict):
         try:
@@ -261,20 +276,34 @@ class ConfigSession(object):
         self.__run_command([COMMENT] + path + value)
 
     def commit(self):
-        out = self.__run_command([COMMIT])
+        if self._vyconf_session is None:
+            out = self.__run_command([COMMIT])
+        else:
+            out, _ = self._vyconf_session.commit()
+
         return out
 
     def discard(self):
-        self.__run_command([DISCARD])
+        if self._vyconf_session is None:
+            self.__run_command([DISCARD])
+        else:
+            out, _ = self._vyconf_session.discard()
 
     def show_config(self, path, format='raw'):
-        config_data = self.__run_command(SHOW_CONFIG + path)
+        if self._vyconf_session is None:
+            config_data = self.__run_command(SHOW_CONFIG + path)
+        else:
+            config_data, _ = self._vyconf_session.show_config()
 
         if format == 'raw':
             return config_data
 
     def load_config(self, file_path):
-        out = self.__run_command(LOAD_CONFIG + [file_path])
+        if self._vyconf_session is None:
+            out = self.__run_command(LOAD_CONFIG + [file_path])
+        else:
+            out, _ = self._vyconf_session.load_config(file=file_path)
+
         return out
 
     def load_explicit(self, file_path):
@@ -287,11 +316,21 @@ class ConfigSession(object):
             raise ConfigSessionError(e) from e
 
     def migrate_and_load_config(self, file_path):
-        out = self.__run_command(MIGRATE_LOAD_CONFIG + [file_path])
+        if self._vyconf_session is None:
+            out = self.__run_command(MIGRATE_LOAD_CONFIG + [file_path])
+        else:
+            out, _ = self._vyconf_session.load_config(file=file_path, migrate=True)
+
         return out
 
     def save_config(self, file_path):
-        out = self.__run_command(SAVE_CONFIG + [file_path])
+        if self._vyconf_session is None:
+            out = self.__run_command(SAVE_CONFIG + [file_path])
+        else:
+            out, _ = self._vyconf_session.save_config(
+                file=file_path, append_version=True
+            )
+
         return out
 
     def install_image(self, url):
diff --git a/python/vyos/kea.py b/python/vyos/kea.py
index 9fc5dde3d..de397d8f9 100644
--- a/python/vyos/kea.py
+++ b/python/vyos/kea.py
@@ -44,6 +44,7 @@ kea4_options = {
     'wpad_url': 'wpad-url',
     'ipv6_only_preferred': 'v6-only-preferred',
     'captive_portal': 'v4-captive-portal',
+    'capwap_controller': 'capwap-ac-v4',
 }
 
 kea6_options = {
@@ -56,6 +57,7 @@ kea6_options = {
     'nisplus_server': 'nisp-servers',
     'sntp_server': 'sntp-servers',
     'captive_portal': 'v6-captive-portal',
+    'capwap_controller': 'capwap-ac-v6',
 }
 
 kea_ctrl_socket = '/run/kea/dhcp{inet}-ctrl-socket'
diff --git a/python/vyos/proto/vyconf_client.py b/python/vyos/proto/vyconf_client.py
index f34549309..b385f0951 100644
--- a/python/vyos/proto/vyconf_client.py
+++ b/python/vyos/proto/vyconf_client.py
@@ -52,7 +52,9 @@ def request_to_msg(req: vyconf_proto.RequestEnvelope) -> vyconf_pb2.RequestEnvel
 def msg_to_response(msg: vyconf_pb2.Response) -> vyconf_proto.Response:
     # pylint: disable=no-member
 
-    d = MessageToDict(msg, preserving_proto_field_name=True)
+    d = MessageToDict(
+        msg, preserving_proto_field_name=True, use_integers_for_enums=True
+    )
 
     response = vyconf_proto.Response(**d)
     return response
diff --git a/python/vyos/vyconf_session.py b/python/vyos/vyconf_session.py
new file mode 100644
index 000000000..506095625
--- /dev/null
+++ b/python/vyos/vyconf_session.py
@@ -0,0 +1,123 @@
+# Copyright 2025 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+#
+#
+
+import tempfile
+import shutil
+from functools import wraps
+from typing import Type
+
+from vyos.proto import vyconf_client
+from vyos.migrate import ConfigMigrate
+from vyos.migrate import ConfigMigrateError
+from vyos.component_version import append_system_version
+
+
+def output(o):
+    out = ''
+    for res in (o.output, o.error, o.warning):
+        if res is not None:
+            out = out + res
+    return out
+
+
+class VyconfSession:
+    def __init__(self, token: str = None, on_error: Type[Exception] = None):
+        if token is None:
+            out = vyconf_client.send_request('setup_session')
+            self.__token = out.output
+        else:
+            self.__token = token
+
+        self.on_error = on_error
+
+    @staticmethod
+    def raise_exception(f):
+        @wraps(f)
+        def wrapped(self, *args, **kwargs):
+            if self.on_error is None:
+                return f(self, *args, **kwargs)
+            o, e = f(self, *args, **kwargs)
+            if e:
+                raise self.on_error(o)
+            return o, e
+
+        return wrapped
+
+    @raise_exception
+    def set(self, path: list[str]) -> tuple[str, int]:
+        out = vyconf_client.send_request('set', token=self.__token, path=path)
+        return output(out), out.status
+
+    @raise_exception
+    def delete(self, path: list[str]) -> tuple[str, int]:
+        out = vyconf_client.send_request('delete', token=self.__token, path=path)
+        return output(out), out.status
+
+    @raise_exception
+    def commit(self) -> tuple[str, int]:
+        out = vyconf_client.send_request('commit', token=self.__token)
+        return output(out), out.status
+
+    @raise_exception
+    def discard(self) -> tuple[str, int]:
+        out = vyconf_client.send_request('discard', token=self.__token)
+        return output(out), out.status
+
+    def session_changed(self) -> bool:
+        out = vyconf_client.send_request('session_changed', token=self.__token)
+        return not bool(out.status)
+
+    @raise_exception
+    def load_config(self, file: str, migrate: bool = False) -> tuple[str, int]:
+        # pylint: disable=consider-using-with
+        if migrate:
+            tmp = tempfile.NamedTemporaryFile()
+            shutil.copy2(file, tmp.name)
+            config_migrate = ConfigMigrate(tmp.name)
+            try:
+                config_migrate.run()
+            except ConfigMigrateError as e:
+                tmp.close()
+                return repr(e), 1
+            file = tmp.name
+        else:
+            tmp = ''
+
+        out = vyconf_client.send_request('load', token=self.__token, location=file)
+        if tmp:
+            tmp.close()
+
+        return output(out), out.status
+
+    @raise_exception
+    def save_config(self, file: str, append_version: bool = False) -> tuple[str, int]:
+        out = vyconf_client.send_request('save', token=self.__token, location=file)
+        if append_version:
+            append_system_version(file)
+        return output(out), out.status
+
+    @raise_exception
+    def show_config(self, path: list[str] = None) -> tuple[str, int]:
+        if path is None:
+            path = []
+        out = vyconf_client.send_request('show_config', token=self.__token, path=path)
+        return output(out), out.status
+
+    def __del__(self):
+        out = vyconf_client.send_request('teardown', token=self.__token)
+        if out.status:
+            print(f'Could not tear down session {self.__token}: {output(out)}')
diff --git a/smoketest/scripts/cli/test_interfaces_vxlan.py b/smoketest/scripts/cli/test_interfaces_vxlan.py
index 05900a4ba..694c24e4d 100755
--- a/smoketest/scripts/cli/test_interfaces_vxlan.py
+++ b/smoketest/scripts/cli/test_interfaces_vxlan.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2023 VyOS maintainers and contributors
+# Copyright (C) 2020-2025 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -25,7 +25,6 @@ from vyos.utils.network import interface_exists
 from vyos.utils.network import get_vxlan_vlan_tunnels
 from vyos.utils.network import get_vxlan_vni_filter
 from vyos.template import is_ipv6
-from vyos import ConfigError
 from base_interfaces_test import BasicInterfaceTest
 
 def convert_to_list(ranges_to_convert):
diff --git a/smoketest/scripts/cli/test_service_dhcp-server.py b/smoketest/scripts/cli/test_service_dhcp-server.py
index 7c2ebff89..7bb850b22 100755
--- a/smoketest/scripts/cli/test_service_dhcp-server.py
+++ b/smoketest/scripts/cli/test_service_dhcp-server.py
@@ -197,6 +197,7 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
         wpad = 'http://wpad.vyos.io/foo/bar'
         server_identifier = bootfile_server
         ipv6_only_preferred = '300'
+        capwap_access_controller = '192.168.2.125'
 
         pool = base_path + ['shared-network-name', shared_net_name, 'subnet', subnet]
         self.cli_set(pool + ['subnet-id', '1'])
@@ -216,6 +217,9 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
         self.cli_set(pool + ['option', 'bootfile-server', bootfile_server])
         self.cli_set(pool + ['option', 'wpad-url', wpad])
         self.cli_set(pool + ['option', 'server-identifier', server_identifier])
+        self.cli_set(
+            pool + ['option', 'capwap-controller', capwap_access_controller]
+        )
 
         self.cli_set(
             pool + ['option', 'static-route', '10.0.0.0/24', 'next-hop', '192.0.2.1']
@@ -301,6 +305,11 @@ class TestServiceDHCPServer(VyOSUnitTestSHIM.TestCase):
         self.verify_config_object(
             obj,
             ['Dhcp4', 'shared-networks', 0, 'subnet4', 0, 'option-data'],
+            {'name': 'capwap-ac-v4', 'data': capwap_access_controller},
+        )
+        self.verify_config_object(
+            obj,
+            ['Dhcp4', 'shared-networks', 0, 'subnet4', 0, 'option-data'],
             {'name': 'tftp-server-name', 'data': tftp_server},
         )
         self.verify_config_object(
diff --git a/smoketest/scripts/cli/test_service_dhcpv6-server.py b/smoketest/scripts/cli/test_service_dhcpv6-server.py
index 6ecf6c1cf..6535ca72d 100755
--- a/smoketest/scripts/cli/test_service_dhcpv6-server.py
+++ b/smoketest/scripts/cli/test_service_dhcpv6-server.py
@@ -108,6 +108,7 @@ class TestServiceDHCPv6Server(VyOSUnitTestSHIM.TestCase):
         self.cli_set(pool + ['lease-time', 'default', lease_time])
         self.cli_set(pool + ['lease-time', 'maximum', max_lease_time])
         self.cli_set(pool + ['lease-time', 'minimum', min_lease_time])
+        self.cli_set(pool + ['option', 'capwap-controller', dns_1])
         self.cli_set(pool + ['option', 'name-server', dns_1])
         self.cli_set(pool + ['option', 'name-server', dns_2])
         self.cli_set(pool + ['option', 'name-server', dns_2])
@@ -157,6 +158,10 @@ class TestServiceDHCPv6Server(VyOSUnitTestSHIM.TestCase):
         self.verify_config_object(
                 obj,
                 ['Dhcp6', 'shared-networks', 0, 'subnet6', 0, 'option-data'],
+                {'name': 'capwap-ac-v6', 'data': dns_1})
+        self.verify_config_object(
+                obj,
+                ['Dhcp6', 'shared-networks', 0, 'subnet6', 0, 'option-data'],
                 {'name': 'dns-servers', 'data': f'{dns_1}, {dns_2}'})
         self.verify_config_object(
                 obj,
diff --git a/smoketest/scripts/cli/test_system_login.py b/smoketest/scripts/cli/test_system_login.py
index ed72f378e..71dec68d8 100755
--- a/smoketest/scripts/cli/test_system_login.py
+++ b/smoketest/scripts/cli/test_system_login.py
@@ -25,9 +25,7 @@ import shutil
 
 from base_vyostest_shim import VyOSUnitTestSHIM
 
-from contextlib import redirect_stdout
 from gzip import GzipFile
-from io import StringIO, TextIOWrapper
 from subprocess import Popen
 from subprocess import PIPE
 from pwd import getpwall
diff --git a/src/conf_mode/system_login.py b/src/conf_mode/system_login.py
index 3fed6d273..4febb6494 100755
--- a/src/conf_mode/system_login.py
+++ b/src/conf_mode/system_login.py
@@ -15,7 +15,6 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
-import warnings
 
 from passlib.hosts import linux_context
 from psutil import users
@@ -30,12 +29,9 @@ from vyos.config import Config
 from vyos.configverify import verify_vrf
 from vyos.template import render
 from vyos.template import is_ipv4
-from vyos.utils.auth import (
-    DEFAULT_PASSWORD,
-    EPasswdStrength,
-    evaluate_strength,
-    get_current_user
-)
+from vyos.utils.auth import EPasswdStrength
+from vyos.utils.auth import evaluate_strength
+from vyos.utils.auth import get_current_user
 from vyos.utils.configfs import delete_cli_node
 from vyos.utils.configfs import add_cli_node
 from vyos.utils.dict import dict_search
diff --git a/src/init/vyos-router b/src/init/vyos-router
index 96957be7c..081adf214 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -417,6 +417,7 @@ gen_duid ()
 
 start ()
 {
+    echo -e "Initializing VyOS router\033[0m"
     # reset and clean config files
     security_reset || log_failure_msg "security reset failed"
 
@@ -517,7 +518,6 @@ start ()
 
     cleanup_post_commit_hooks
 
-    log_daemon_msg "Starting VyOS router"
     disabled migrate || migrate_bootfile
 
     restore_if_missing_preconfig_script
diff --git a/src/op_mode/image_installer.py b/src/op_mode/image_installer.py
index 9c17d0229..179913f15 100755
--- a/src/op_mode/image_installer.py
+++ b/src/op_mode/image_installer.py
@@ -74,6 +74,7 @@ MSG_INPUT_CONFIG_FOUND: str = 'An active configuration was found. Would you like
 MSG_INPUT_CONFIG_CHOICE: str = 'The following config files are available for boot:'
 MSG_INPUT_CONFIG_CHOOSE: str = 'Which file would you like as boot config?'
 MSG_INPUT_IMAGE_NAME: str = 'What would you like to name this image?'
+MSG_INPUT_IMAGE_NAME_TAKEN: str = 'There is already an installed image by that name; please choose again'
 MSG_INPUT_IMAGE_DEFAULT: str = 'Would you like to set the new image as the default one for boot?'
 MSG_INPUT_PASSWORD: str = 'Please enter a password for the "vyos" user:'
 MSG_INPUT_PASSWORD_CONFIRM: str = 'Please confirm password for the "vyos" user:'
@@ -984,8 +985,12 @@ def add_image(image_path: str, vrf: str = None, username: str = '',
                 f'Adding image would downgrade image tools to v.{cfg_ver}; disallowed')
 
         if not no_prompt:
+            versions = grub.version_list()
             while True:
                 image_name: str = ask_input(MSG_INPUT_IMAGE_NAME, version_name)
+                if image_name in versions:
+                    print(MSG_INPUT_IMAGE_NAME_TAKEN)
+                    continue
                 if image.validate_name(image_name):
                     break
                 print(MSG_WARN_IMAGE_NAME_WRONG)
diff --git a/src/services/vyos-conntrack-logger b/src/services/vyos-conntrack-logger
index 9c31b465f..ec0e1f717 100755
--- a/src/services/vyos-conntrack-logger
+++ b/src/services/vyos-conntrack-logger
@@ -15,10 +15,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import argparse
-import grp
 import logging
 import multiprocessing
-import os
 import queue
 import signal
 import socket
diff --git a/src/services/vyos-domain-resolver b/src/services/vyos-domain-resolver
index aba5ba9db..4419fc4a7 100755
--- a/src/services/vyos-domain-resolver
+++ b/src/services/vyos-domain-resolver
@@ -92,12 +92,14 @@ def resolve(domains, ipv6=False):
     for domain in domains:
         resolved = fqdn_resolve(domain, ipv6=ipv6)
 
+        cache_key = f'{domain}_ipv6' if ipv6 else domain
+
         if resolved and cache:
-            domain_state[domain] = resolved
+            domain_state[cache_key] = resolved
         elif not resolved:
-            if domain not in domain_state:
+            if cache_key not in domain_state:
                 continue
-            resolved = domain_state[domain]
+            resolved = domain_state[cache_key]
 
         ip_list = ip_list | resolved
     return ip_list
diff --git a/src/services/vyos-hostsd b/src/services/vyos-hostsd
index 1ba90471e..44f03586c 100755
--- a/src/services/vyos-hostsd
+++ b/src/services/vyos-hostsd
@@ -233,10 +233,7 @@
 # }
 
 import os
-import sys
-import time
 import json
-import signal
 import traceback
 import re
 import logging
@@ -245,7 +242,6 @@ import zmq
 from voluptuous import Schema, MultipleInvalid, Required, Any
 from collections import OrderedDict
 from vyos.utils.file import makedir
-from vyos.utils.permission import chown
 from vyos.utils.permission import chmod_755
 from vyos.utils.process import popen
 from vyos.utils.process import process_named_running