19 files changed, 287 insertions, 51 deletions

diff --git a/src/conf_mode/flow_accounting_conf.py b/src/conf_mode/flow_accounting_conf.py
index 7e16235c1..f67f1710e 100755
--- a/src/conf_mode/flow_accounting_conf.py
+++ b/src/conf_mode/flow_accounting_conf.py
@@ -38,7 +38,7 @@ airbag.enable()
 
 uacctd_conf_path = '/run/pmacct/uacctd.conf'
 systemd_service = 'uacctd.service'
-systemd_override = f'/etc/systemd/system/{systemd_service}.d/override.conf'
+systemd_override = f'/run/systemd/system/{systemd_service}.d/override.conf'
 nftables_nflog_table = 'raw'
 nftables_nflog_chain = 'VYOS_CT_PREROUTING_HOOK'
 egress_nftables_nflog_table = 'inet mangle'
@@ -192,7 +192,7 @@ def verify(flow_config):
                     raise ConfigError("All sFlow servers must use the same IP protocol")
             else:
                 sflow_collector_ipver = ip_address(server).version
-	
+
         # check if vrf is defined for Sflow
         sflow_vrf = None
         if 'vrf' in flow_config:
diff --git a/src/conf_mode/high-availability.py b/src/conf_mode/high-availability.py
index 8a959dc79..4ed16d0d7 100755
--- a/src/conf_mode/high-availability.py
+++ b/src/conf_mode/high-availability.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -144,8 +144,10 @@ def verify(ha):
     # Virtual-server
     if 'virtual_server' in ha:
         for vs, vs_config in ha['virtual_server'].items():
-            if 'port' not in vs_config:
-                raise ConfigError(f'Port is required but not set for virtual-server "{vs}"')
+            if 'port' not in vs_config and 'fwmark' not in vs_config:
+                raise ConfigError(f'Port or fwmark is required but not set for virtual-server "{vs}"')
+            if 'port' in vs_config and 'fwmark' in vs_config:
+                raise ConfigError(f'Cannot set both port and fwmark for virtual-server "{vs}"')
             if 'real_server' not in vs_config:
                 raise ConfigError(f'Real-server ip is required but not set for virtual-server "{vs}"')
         # Real-server
diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py
index 7cd7ea42e..ce5e63928 100755
--- a/src/conf_mode/https.py
+++ b/src/conf_mode/https.py
@@ -37,7 +37,7 @@ from vyos import airbag
 airbag.enable()
 
 config_file = '/etc/nginx/sites-available/default'
-systemd_override = r'/etc/systemd/system/nginx.service.d/override.conf'
+systemd_override = r'/run/systemd/system/nginx.service.d/override.conf'
 cert_dir = '/etc/ssl/certs'
 key_dir = '/etc/ssl/private'
 certbot_dir = vyos.defaults.directories['certbot']
diff --git a/src/conf_mode/interfaces-input.py b/src/conf_mode/interfaces-input.py
new file mode 100755
index 000000000..ad248843d
--- /dev/null
+++ b/src/conf_mode/interfaces-input.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2023 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+from sys import exit
+
+from vyos.config import Config
+from vyos.configdict import get_interface_dict
+from vyos.configverify import verify_mirror_redirect
+from vyos.ifconfig import InputIf
+from vyos import ConfigError
+from vyos import airbag
+airbag.enable()
+
+def get_config(config=None):
+    """
+    Retrive CLI config as dictionary. Dictionary can never be empty, as at
+    least the interface name will be added or a deleted flag
+    """
+    if config:
+        conf = config
+    else:
+        conf = Config()
+    base = ['interfaces', 'input']
+    _, ifb = get_interface_dict(conf, base)
+
+    return ifb
+
+def verify(ifb):
+    if 'deleted' in ifb:
+        return None
+
+    verify_mirror_redirect(ifb)
+    return None
+
+def generate(ifb):
+    return None
+
+def apply(ifb):
+    d = InputIf(ifb['ifname'])
+
+    # Remove input interface
+    if 'deleted' in ifb:
+        d.remove()
+    else:
+        d.update(ifb)
+
+    return None
+
+if __name__ == '__main__':
+    try:
+        c = get_config()
+        verify(c)
+        generate(c)
+        apply(c)
+    except ConfigError as e:
+        print(e)
+        exit(1)
diff --git a/src/conf_mode/ntp.py b/src/conf_mode/ntp.py
index 0ecb4d736..92cb73aab 100755
--- a/src/conf_mode/ntp.py
+++ b/src/conf_mode/ntp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
+# Copyright (C) 2018-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -21,26 +21,29 @@ from vyos.configdict import is_node_changed
 from vyos.configverify import verify_vrf
 from vyos.configverify import verify_interface_exists
 from vyos.util import call
+from vyos.util import chmod_750
 from vyos.util import get_interface_config
 from vyos.template import render
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-config_file = r'/run/ntpd/ntpd.conf'
-systemd_override = r'/etc/systemd/system/ntp.service.d/override.conf'
+config_file = r'/run/chrony/chrony.conf'
+systemd_override = r'/run/systemd/system/chrony.service.d/override.conf'
+user_group = '_chrony'
 
 def get_config(config=None):
     if config:
         conf = config
     else:
         conf = Config()
-    base = ['system', 'ntp']
+    base = ['service', 'ntp']
     if not conf.exists(base):
         return None
 
     ntp = conf.get_config_dict(base, key_mangling=('-', '_'), get_first_key=True)
     ntp['config_file'] = config_file
+    ntp['user'] = user_group
 
     tmp = is_node_changed(conf, base + ['vrf'])
     if tmp: ntp.update({'restart_required': {}})
@@ -52,7 +55,7 @@ def verify(ntp):
     if not ntp:
         return None
 
-    if 'allow_clients' in ntp and 'server' not in ntp:
+    if 'server' not in ntp:
         raise ConfigError('NTP server not configured')
 
     verify_vrf(ntp)
@@ -77,13 +80,17 @@ def generate(ntp):
     if not ntp:
         return None
 
-    render(config_file, 'ntp/ntpd.conf.j2', ntp)
-    render(systemd_override, 'ntp/override.conf.j2', ntp)
+    render(config_file, 'chrony/chrony.conf.j2', ntp, user=user_group, group=user_group)
+    render(systemd_override, 'chrony/override.conf.j2', ntp, user=user_group, group=user_group)
+
+    # Ensure proper permission for chrony command socket
+    config_dir = os.path.dirname(config_file)
+    chmod_750(config_dir)
 
     return None
 
 def apply(ntp):
-    systemd_service = 'ntp.service'
+    systemd_service = 'chrony.service'
     # Reload systemd manager configuration
     call('systemctl daemon-reload')
 
diff --git a/src/conf_mode/protocols_bgp.py b/src/conf_mode/protocols_bgp.py
index ff568d470..c410258ee 100755
--- a/src/conf_mode/protocols_bgp.py
+++ b/src/conf_mode/protocols_bgp.py
@@ -14,8 +14,6 @@
 # You should have received a copy of the GNU General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import os
-
 from sys import exit
 from sys import argv
 
@@ -57,13 +55,18 @@ def get_config(config=None):
     # instead of the VRF instance.
     if vrf: bgp.update({'vrf' : vrf})
 
+    bgp['dependent_vrfs'] = conf.get_config_dict(['vrf', 'name'],
+                                                 key_mangling=('-', '_'),
+                                                 get_first_key=True,
+                                                 no_tag_node_value_mangle=True)
+
+    bgp['dependent_vrfs'].update({'default': {'protocols': {
+        'bgp': conf.get_config_dict(base_path, key_mangling=('-', '_'),
+                                    get_first_key=True,
+                                    no_tag_node_value_mangle=True)}}})
     if not conf.exists(base):
+        # If bgp instance is deleted then mark it
         bgp.update({'deleted' : ''})
-        if not vrf:
-            # We are running in the default VRF context, thus we can not delete
-            # our main BGP instance if there are dependent BGP VRF instances.
-            bgp['dependent_vrfs'] = conf.get_config_dict(['vrf', 'name'],
-                key_mangling=('-', '_'), get_first_key=True, no_tag_node_value_mangle=True)
         return bgp
 
     # We also need some additional information from the config, prefix-lists
@@ -74,9 +77,91 @@ def get_config(config=None):
     tmp = conf.get_config_dict(['policy'])
     # Merge policy dict into "regular" config dict
     bgp = dict_merge(tmp, bgp)
-
     return bgp
 
+
+def verify_vrf_as_import(search_vrf_name: str, afi_name: str, vrfs_config: dict) -> bool:
+    """
+    :param search_vrf_name: search vrf name in import list
+    :type search_vrf_name: str
+    :param afi_name: afi/safi name
+    :type afi_name: str
+    :param vrfs_config: configuration dependents vrfs
+    :type vrfs_config: dict
+    :return: if vrf in import list retrun true else false
+    :rtype: bool
+    """
+    for vrf_name, vrf_config in vrfs_config.items():
+        import_list = dict_search(
+            f'protocols.bgp.address_family.{afi_name}.import.vrf',
+            vrf_config)
+        if import_list:
+            if search_vrf_name in import_list:
+               return True
+    return False
+
+def verify_vrf_import_options(afi_config: dict) -> bool:
+    """
+    Search if afi contains one of options
+    :param afi_config: afi/safi
+    :type afi_config: dict
+    :return: if vrf contains rd and route-target options return true else false
+    :rtype: bool
+    """
+    options = [
+        f'rd.vpn.export',
+        f'route_target.vpn.import',
+        f'route_target.vpn.export',
+        f'route_target.vpn.both'
+    ]
+    for option in options:
+        if dict_search(option, afi_config):
+            return True
+    return False
+
+def verify_vrf_import(vrf_name: str, vrfs_config: dict, afi_name: str) -> bool:
+    """
+    Verify if vrf exists and contain options
+    :param vrf_name: name of VRF
+    :type vrf_name: str
+    :param vrfs_config: dependent vrfs config
+    :type vrfs_config: dict
+    :param afi_name: afi/safi name
+    :type afi_name: str
+    :return: if vrf contains rd and route-target options return true else false
+    :rtype: bool
+    """
+    if vrf_name != 'default':
+        verify_vrf({'vrf': vrf_name})
+    if dict_search(f'{vrf_name}.protocols.bgp.address_family.{afi_name}',
+                   vrfs_config):
+        afi_config = \
+        vrfs_config[vrf_name]['protocols']['bgp']['address_family'][
+            afi_name]
+        if verify_vrf_import_options(afi_config):
+            return True
+    return False
+
+def verify_vrflist_import(afi_name: str, afi_config: dict, vrfs_config: dict) -> bool:
+    """
+    Call function to verify
+    if scpecific vrf contains rd and route-target
+    options return true else false
+
+    :param afi_name: afi/safi name
+    :type afi_name: str
+    :param afi_config: afi/safi configuration
+    :type afi_config: dict
+    :param vrfs_config: dependent vrfs config
+    :type vrfs_config:dict
+    :return: if vrf contains rd and route-target options return true else false
+    :rtype: bool
+    """
+    for vrf_name in afi_config['import']['vrf']:
+        if verify_vrf_import(vrf_name, vrfs_config, afi_name):
+            return True
+    return False
+
 def verify_remote_as(peer_config, bgp_config):
     if 'remote_as' in peer_config:
         return peer_config['remote_as']
@@ -113,12 +198,22 @@ def verify_afi(peer_config, bgp_config):
     return False
 
 def verify(bgp):
-    if not bgp or 'deleted' in bgp:
-        if 'dependent_vrfs' in bgp:
-            for vrf, vrf_options in bgp['dependent_vrfs'].items():
-                if dict_search('protocols.bgp', vrf_options) != None:
-                    raise ConfigError('Cannot delete default BGP instance, ' \
-                                      'dependent VRF instance(s) exist!')
+    if 'deleted' in bgp:
+        if 'vrf' in bgp:
+            # Cannot delete vrf if it exists in import vrf list in other vrfs
+            for tmp_afi in ['ipv4_unicast', 'ipv6_unicast']:
+                if verify_vrf_as_import(bgp['vrf'],tmp_afi,bgp['dependent_vrfs']):
+                    raise ConfigError(f'Cannot delete vrf {bgp["vrf"]} instance, ' \
+                                      'Please unconfigure import vrf commands!')
+        else:
+            # We are running in the default VRF context, thus we can not delete
+            # our main BGP instance if there are dependent BGP VRF instances.
+            if 'dependent_vrfs' in bgp:
+                for vrf, vrf_options in bgp['dependent_vrfs'].items():
+                    if vrf != 'default':
+                        if dict_search('protocols.bgp', vrf_options):
+                            raise ConfigError('Cannot delete default BGP instance, ' \
+                                              'dependent VRF instance(s) exist!')
         return None
 
     if 'system_as' not in bgp:
@@ -324,9 +419,43 @@ def verify(bgp):
                                          f'{afi} administrative distance {key}!')
 
             if afi in ['ipv4_unicast', 'ipv6_unicast']:
-                if 'import' in afi_config and 'vrf' in afi_config['import']:
-                    # Check if VRF exists
-                    verify_vrf(afi_config['import']['vrf'])
+
+                vrf_name = bgp['vrf'] if dict_search('vrf', bgp) else 'default'
+                # Verify if currant VRF contains rd and route-target options
+                # and does not exist in import list in other VRFs
+                if dict_search(f'rd.vpn.export', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf" conflicts with "rd vpn export" command!')
+
+                if dict_search('route_target.vpn.both', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf" conflicts with "route-target vpn both" command!')
+
+                if dict_search('route_target.vpn.import', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf conflicts" with "route-target vpn import" command!')
+
+                if dict_search('route_target.vpn.export', afi_config):
+                    if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Command "import vrf" conflicts with "route-target vpn export" command!')
+
+                # Verify if VRFs in import do not contain rd
+                # and route-target options
+                if dict_search('import.vrf', afi_config) is not None:
+                    # Verify if VRF with import does not contain rd
+                    # and route-target options
+                    if verify_vrf_import_options(afi_config):
+                        raise ConfigError(
+                            'Please unconfigure "import vrf" commands before using vpn commands in the same VRF!')
+                    # Verify if VRFs in import list do not contain rd
+                    # and route-target options
+                    if verify_vrflist_import(afi, afi_config, bgp['dependent_vrfs']):
+                        raise ConfigError(
+                            'Please unconfigure import vrf commands before using vpn commands in dependent VRFs!')
 
                     # FRR error: please unconfigure vpn to vrf commands before
                     # using import vrf commands
@@ -339,7 +468,6 @@ def verify(bgp):
                     tmp = dict_search(f'route_map.vpn.{export_import}', afi_config)
                     if tmp: verify_route_map(tmp, bgp)
 
-
     return None
 
 def generate(bgp):
diff --git a/src/conf_mode/protocols_failover.py b/src/conf_mode/protocols_failover.py
index 048ba7a89..85e984afe 100755
--- a/src/conf_mode/protocols_failover.py
+++ b/src/conf_mode/protocols_failover.py
@@ -31,7 +31,7 @@ airbag.enable()
 
 service_name = 'vyos-failover'
 service_conf = Path(f'/run/{service_name}.conf')
-systemd_service = '/etc/systemd/system/vyos-failover.service'
+systemd_service = '/run/systemd/system/vyos-failover.service'
 rt_proto_failover = '/etc/iproute2/rt_protos.d/failover.conf'
 
 
diff --git a/src/conf_mode/protocols_ospfv3.py b/src/conf_mode/protocols_ospfv3.py
index ee4eaf59d..ed0a8fba2 100755
--- a/src/conf_mode/protocols_ospfv3.py
+++ b/src/conf_mode/protocols_ospfv3.py
@@ -117,6 +117,10 @@ def verify(ospfv3):
             if 'area_type' in area_config:
                 if len(area_config['area_type']) > 1:
                     raise ConfigError(f'Can only configure one area-type for OSPFv3 area "{area}"!')
+            if 'range' in area_config:
+                for range, range_config in area_config['range'].items():
+                    if {'not_advertise', 'advertise'} <= range_config.keys():
+                        raise ConfigError(f'"not-advertise" and "advertise" for "range {range}" cannot be both configured at the same time!')
 
     if 'interface' in ospfv3:
         for interface, interface_config in ospfv3['interface'].items():
diff --git a/src/conf_mode/protocols_static.py b/src/conf_mode/protocols_static.py
index 58e202928..3e5ebb805 100755
--- a/src/conf_mode/protocols_static.py
+++ b/src/conf_mode/protocols_static.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -25,12 +25,15 @@ from vyos.configdict import get_dhcp_interfaces
 from vyos.configdict import get_pppoe_interfaces
 from vyos.configverify import verify_common_route_maps
 from vyos.configverify import verify_vrf
+from vyos.template import render
 from vyos.template import render_to_string
 from vyos import ConfigError
 from vyos import frr
 from vyos import airbag
 airbag.enable()
 
+config_file = '/etc/iproute2/rt_tables.d/vyos-static.conf'
+
 def get_config(config=None):
     if config:
         conf = config
@@ -94,6 +97,9 @@ def verify(static):
 def generate(static):
     if not static:
         return None
+
+    # Put routing table names in /etc/iproute2/rt_tables
+    render(config_file, 'iproute2/static.conf.j2', static)
     static['new_frr_config'] = render_to_string('frr/staticd.frr.j2', static)
     return None
 
diff --git a/src/conf_mode/qos.py b/src/conf_mode/qos.py
index 2eb03237c..0418e8d82 100755
--- a/src/conf_mode/qos.py
+++ b/src/conf_mode/qos.py
@@ -187,6 +187,9 @@ def verify(qos):
                                 if queue_lim < max_tr:
                                     raise ConfigError(f'Policy "{policy}" uses queue-limit "{queue_lim}" < max-threshold "{max_tr}"!')
 
+                if 'default' in policy_config:
+                    if 'bandwidth' not in policy_config['default'] and policy_type not in ['priority_queue', 'round_robin']:
+                        raise ConfigError('Bandwidth not defined for default traffic!')
 
     # we should check interface ingress/egress configuration after verifying that
     # the policy name is used only once - this makes the logic easier!
diff --git a/src/conf_mode/service_console-server.py b/src/conf_mode/service_console-server.py
index ee4fe42ab..60eff6543 100755
--- a/src/conf_mode/service_console-server.py
+++ b/src/conf_mode/service_console-server.py
@@ -27,7 +27,7 @@ from vyos.xml import defaults
 from vyos import ConfigError
 
 config_file = '/run/conserver/conserver.cf'
-dropbear_systemd_file = '/etc/systemd/system/dropbear@{port}.service.d/override.conf'
+dropbear_systemd_file = '/run/systemd/system/dropbear@{port}.service.d/override.conf'
 
 def get_config(config=None):
     if config:
diff --git a/src/conf_mode/service_monitoring_telegraf.py b/src/conf_mode/service_monitoring_telegraf.py
index aafece47a..363408679 100755
--- a/src/conf_mode/service_monitoring_telegraf.py
+++ b/src/conf_mode/service_monitoring_telegraf.py
@@ -38,7 +38,7 @@ cache_dir = f'/etc/telegraf/.cache'
 config_telegraf = f'/run/telegraf/telegraf.conf'
 custom_scripts_dir = '/etc/telegraf/custom_scripts'
 syslog_telegraf = '/etc/rsyslog.d/50-telegraf.conf'
-systemd_override = '/etc/systemd/system/telegraf.service.d/10-override.conf'
+systemd_override = '/run/systemd/system/telegraf.service.d/10-override.conf'
 
 def get_nft_filter_chains():
     """ Get nft chains for table filter """
diff --git a/src/conf_mode/service_sla.py b/src/conf_mode/service_sla.py
index e7c3ca59c..b1e22f37b 100755
--- a/src/conf_mode/service_sla.py
+++ b/src/conf_mode/service_sla.py
@@ -27,15 +27,13 @@ from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
-
 owamp_config_dir = '/etc/owamp-server'
 owamp_config_file = f'{owamp_config_dir}/owamp-server.conf'
-systemd_override_owamp = r'/etc/systemd/system/owamp-server.d/20-override.conf'
+systemd_override_owamp = r'/run/systemd/system/owamp-server.d/20-override.conf'
 
 twamp_config_dir = '/etc/twamp-server'
 twamp_config_file = f'{twamp_config_dir}/twamp-server.conf'
-systemd_override_twamp = r'/etc/systemd/system/twamp-server.d/20-override.conf'
-
+systemd_override_twamp = r'/run/systemd/system/twamp-server.d/20-override.conf'
 
 def get_config(config=None):
     if config:
diff --git a/src/conf_mode/service_webproxy.py b/src/conf_mode/service_webproxy.py
index 41a1deaa3..658e496a6 100755
--- a/src/conf_mode/service_webproxy.py
+++ b/src/conf_mode/service_webproxy.py
@@ -246,7 +246,7 @@ def apply(proxy):
 
     if os.path.exists(squidguard_db_dir):
         chmod_755(squidguard_db_dir)
-    call('systemctl restart squid.service')
+    call('systemctl reload-or-restart squid.service')
     return None
 
 
diff --git a/src/conf_mode/snmp.py b/src/conf_mode/snmp.py
index 5cd24db32..914ec245c 100755
--- a/src/conf_mode/snmp.py
+++ b/src/conf_mode/snmp.py
@@ -40,7 +40,7 @@ config_file_client  = r'/etc/snmp/snmp.conf'
 config_file_daemon  = r'/etc/snmp/snmpd.conf'
 config_file_access  = r'/usr/share/snmp/snmpd.conf'
 config_file_user    = r'/var/lib/snmp/snmpd.conf'
-systemd_override    = r'/etc/systemd/system/snmpd.service.d/override.conf'
+systemd_override    = r'/run/systemd/system/snmpd.service.d/override.conf'
 systemd_service     = 'snmpd.service'
 
 def get_config(config=None):
diff --git a/src/conf_mode/ssh.py b/src/conf_mode/ssh.py
index 8746cc701..8de0617af 100755
--- a/src/conf_mode/ssh.py
+++ b/src/conf_mode/ssh.py
@@ -32,7 +32,7 @@ from vyos import airbag
 airbag.enable()
 
 config_file = r'/run/sshd/sshd_config'
-systemd_override = r'/etc/systemd/system/ssh.service.d/override.conf'
+systemd_override = r'/run/systemd/system/ssh.service.d/override.conf'
 
 sshguard_config_file = '/etc/sshguard/sshguard.conf'
 sshguard_whitelist = '/etc/sshguard/whitelist'
diff --git a/src/conf_mode/system-option.py b/src/conf_mode/system-option.py
index 36dbf155b..e6c7a0ed2 100755
--- a/src/conf_mode/system-option.py
+++ b/src/conf_mode/system-option.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2020 VyOS maintainers and contributors
+# Copyright (C) 2019-2022 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -22,17 +22,19 @@ from time import sleep
 
 from vyos.config import Config
 from vyos.configdict import dict_merge
+from vyos.configverify import verify_source_interface
 from vyos.template import render
 from vyos.util import cmd
 from vyos.util import is_systemd_service_running
 from vyos.validate import is_addr_assigned
+from vyos.validate import is_intf_addr_assigned
 from vyos.xml import defaults
 from vyos import ConfigError
 from vyos import airbag
 airbag.enable()
 
 curlrc_config = r'/etc/curlrc'
-ssh_config = r'/etc/ssh/ssh_config'
+ssh_config = r'/etc/ssh/ssh_config.d/91-vyos-ssh-client-options.conf'
 systemd_action_file = '/lib/systemd/system/ctrl-alt-del.target'
 
 def get_config(config=None):
@@ -68,8 +70,17 @@ def verify(options):
     if 'ssh_client' in options:
         config = options['ssh_client']
         if 'source_address' in config:
+            address = config['source_address']
             if not is_addr_assigned(config['source_address']):
-                raise ConfigError('No interface with give address specified!')
+                raise ConfigError('No interface with address "{address}" configured!')
+
+        if 'source_interface' in config:
+            verify_source_interface(config)
+            if 'source_address' in config:
+                address = config['source_address']
+                interface = config['source_interface']
+                if not is_intf_addr_assigned(interface, address):
+                    raise ConfigError(f'Address "{address}" not assigned on interface "{interface}"!')
 
     return None
 
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 04e2f2939..3af2af4d9 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -95,6 +95,7 @@ def get_config(config=None):
     del default_values['esp_group']
     del default_values['ike_group']
     del default_values['remote_access']
+    del default_values['site_to_site']
     ipsec = dict_merge(default_values, ipsec)
 
     if 'esp_group' in ipsec:
@@ -143,6 +144,14 @@ def get_config(config=None):
             ipsec['remote_access']['radius']['server'][server] = dict_merge(default_values,
                 ipsec['remote_access']['radius']['server'][server])
 
+    # XXX: T2665: we can not safely rely on the defaults() when there are
+    # tagNodes in place, it is better to blend in the defaults manually.
+    if dict_search('site_to_site.peer', ipsec):
+        default_values = defaults(base + ['site-to-site', 'peer'])
+        for peer in ipsec['site_to_site']['peer']:
+            ipsec['site_to_site']['peer'][peer] = dict_merge(default_values,
+              ipsec['site_to_site']['peer'][peer])
+
     ipsec['dhcp_no_address'] = {}
     ipsec['install_routes'] = 'no' if conf.exists(base + ["options", "disable-route-autoinstall"]) else default_install_routes
     ipsec['interface_change'] = leaf_node_changed(conf, base + ['interface'])
@@ -622,7 +631,7 @@ def wait_for_vici_socket(timeout=5, sleep_interval=0.1):
         sleep(sleep_interval)
 
 def apply(ipsec):
-    systemd_service = 'strongswan.service'
+    systemd_service = 'strongswan-starter.service'
     if not ipsec:
         call(f'systemctl stop {systemd_service}')
     else:
diff --git a/src/conf_mode/vrf.py b/src/conf_mode/vrf.py
index 1b4156895..c17cca3bd 100755
--- a/src/conf_mode/vrf.py
+++ b/src/conf_mode/vrf.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2022 VyOS maintainers and contributors
+# Copyright (C) 2020-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -140,11 +140,9 @@ def verify(vrf):
 
 
 def generate(vrf):
-    render(config_file, 'vrf/vrf.conf.j2', vrf)
+    render(config_file, 'iproute2/vrf.conf.j2', vrf)
     # Render nftables zones config
-
     render(nft_vrf_config, 'firewall/nftables-vrf-zones.j2', vrf)
-
     return None