13 files changed, 113 insertions, 48 deletions
diff --git a/src/etc/commit/post-hooks.d/00vyos-sync b/src/etc/commit/post-hooks.d/00vyos-sync
new file mode 100755
index 000000000..8ec732df0
--- /dev/null
+++ b/src/etc/commit/post-hooks.d/00vyos-sync
@@ -0,0 +1,7 @@
+#!/bin/sh
+# When power is lost right after a commit modified files, the
+# system can be corrupted and e.g. login is no longer possible.
+# Always sync files to the backend storage after a commit.
+# https://vyos.dev/T4975
+sync
+
diff --git a/src/etc/dhcp/dhclient-enter-hooks.d/99-run-user-hooks b/src/etc/dhcp/dhclient-enter-hooks.d/99-run-user-hooks
new file mode 100644
index 000000000..b4b4d516d
--- /dev/null
+++ b/src/etc/dhcp/dhclient-enter-hooks.d/99-run-user-hooks
@@ -0,0 +1,5 @@
+#!/bin/bash
+DHCP_PRE_HOOKS="/config/scripts/dhcp-client/pre-hooks.d/"
+if [ -d "${DHCP_PRE_HOOKS}" ] ; then
+    run-parts "${DHCP_PRE_HOOKS}"
+fi
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/vyatta-dhclient-hook b/src/etc/dhcp/dhclient-exit-hooks.d/03-vyatta-dhclient-hook
index 49bb18372..49bb18372 100644
--- a/src/etc/dhcp/dhclient-exit-hooks.d/vyatta-dhclient-hook
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/03-vyatta-dhclient-hook
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/98-run-user-hooks b/src/etc/dhcp/dhclient-exit-hooks.d/98-run-user-hooks
new file mode 100755
index 000000000..442419d79
--- /dev/null
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/98-run-user-hooks
@@ -0,0 +1,5 @@
+#!/bin/bash
+DHCP_POST_HOOKS="/config/scripts/dhcp-client/post-hooks.d/"
+if [ -d "${DHCP_POST_HOOKS}" ] ; then
+    run-parts "${DHCP_POST_HOOKS}"
+fi
diff --git a/src/etc/dhcp/dhclient-exit-hooks.d/ipsec-dhclient-hook b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
index 1f1926e17..1f1926e17 100755
--- a/src/etc/dhcp/dhclient-exit-hooks.d/ipsec-dhclient-hook
+++ b/src/etc/dhcp/dhclient-exit-hooks.d/99-ipsec-dhclient-hook
diff --git a/src/etc/opennhrp/opennhrp-script.py b/src/etc/opennhrp/opennhrp-script.py
index bf25a7331..688c7af2a 100755
--- a/src/etc/opennhrp/opennhrp-script.py
+++ b/src/etc/opennhrp/opennhrp-script.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright (C) 2021-2023 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,7 +17,7 @@
 import os
 import re
 import sys
-import vici
+import vyos.ipsec
 
 from json import loads
 from pathlib import Path
@@ -51,9 +51,8 @@ def vici_get_ipsec_uniqueid(conn: str, src_nbma: str,
         logger.info(
             f'Resolving IKE unique ids for: conn: {conn}, '
             f'src_nbma: {src_nbma}, dst_nbma: {dst_nbma}')
-        session: vici.Session = vici.Session()
         list_ikeid: list[str] = []
-        list_sa = session.list_sas({'ike': conn})
+        list_sa: list = vyos.ipsec.get_vici_sas_by_name(conn, None)
         for sa in list_sa:
             if sa[conn]['local-host'].decode('ascii') == src_nbma \
                     and sa[conn]['remote-host'].decode('ascii') == dst_nbma:
@@ -78,16 +77,7 @@ def vici_ike_terminate(list_ikeid: list[str]) -> bool:
         return False
 
     try:
-        session = vici.Session()
-        for ikeid in list_ikeid:
-            logger.info(f'Terminating IKE SA with id {ikeid}')
-            session_generator = session.terminate(
-                {'ike-id': ikeid, 'timeout': '-1'})
-            # a dummy `for` loop is required because of requirements
-            # from vici. Without a full iteration on the output, the
-            # command to vici may not be executed completely
-            for _ in session_generator:
-                pass
+        vyos.ipsec.terminate_vici_ikeid_list(list_ikeid)
         return True
     except Exception as err:
         logger.error(f'Failed to terminate SA for IKE ids {list_ikeid}: {err}')
@@ -180,19 +170,7 @@ def vici_initiate(conn: str, child_sa: str, src_addr: str,
         f'Trying to initiate connection. Name: {conn}, child sa: {child_sa}, '
         f'src_addr: {src_addr}, dst_addr: {dest_addr}')
     try:
-        session = vici.Session()
-        session_generator = session.initiate({
-            'ike': conn,
-            'child': child_sa,
-            'timeout': '-1',
-            'my-host': src_addr,
-            'other-host': dest_addr
-        })
-        # a dummy `for` loop is required because of requirements
-        # from vici. Without a full iteration on the output, the
-        # command to vici may not be executed completely
-        for _ in session_generator:
-            pass
+        vyos.ipsec.vici_initiate(conn, child_sa, src_addr, dest_addr)
         return True
     except Exception as err:
         logger.error(f'Unable to initiate connection {err}')
@@ -218,8 +196,11 @@ def vici_terminate(conn: str, src_addr: str, dest_addr: str) -> None:
             f'No active sessions found for IKE profile {conn}, '
             f'local NBMA {src_addr}, remote NBMA {dest_addr}')
     else:
-        vici_ike_terminate(ikeid_list)
-
+        try:
+            vyos.ipsec.terminate_vici_ikeid_list(ikeid_list)
+        except Exception as err:
+            logger.error(
+                f'Failed to terminate SA for IKE ids {ikeid_list}: {err}')
 
 def iface_up(interface: str) -> None:
     """Proceed tunnel interface UP event
diff --git a/src/etc/rsyslog.conf b/src/etc/rsyslog.conf
new file mode 100644
index 000000000..c28e9b537
--- /dev/null
+++ b/src/etc/rsyslog.conf
@@ -0,0 +1,67 @@
+#################
+#### MODULES ####
+#################
+
+$ModLoad imuxsock # provides support for local system logging
+$ModLoad imklog   # provides kernel logging support (previously done by rklogd)
+#$ModLoad immark  # provides --MARK-- message capability
+
+$OmitLocalLogging off
+$SystemLogSocketName /run/systemd/journal/syslog
+
+$KLogPath /proc/kmsg
+
+###########################
+#### GLOBAL DIRECTIVES ####
+###########################
+
+# The lines below cause all listed daemons/processes to be logged into
+# /var/log/auth.log, then drops the message so it does not also go to the
+# regular syslog so that messages are not duplicated
+
+$outchannel auth_log,/var/log/auth.log
+if  $programname == 'CRON' or
+    $programname == 'sudo' or
+    $programname == 'su'
+    then :omfile:$auth_log
+
+if $programname == 'CRON' or
+    $programname == 'sudo' or
+    $programname == 'su'
+    then stop
+
+# Use traditional timestamp format.
+# To enable high precision timestamps, comment out the following line.
+# A modern-style logfile format similar to TraditionalFileFormat, buth with high-precision timestamps and timezone information
+#$ActionFileDefaultTemplate RSYSLOG_FileFormat
+# The "old style" default log file format with low-precision timestamps
+$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
+
+# Filter duplicated messages
+$RepeatedMsgReduction on
+
+#
+# Set the default permissions for all log files.
+#
+$FileOwner root
+$FileGroup adm
+$FileCreateMode 0640
+$DirCreateMode 0755
+$Umask 0022
+
+#
+# Stop excessive logging of sudo
+#
+:msg, contains, " pam_unix(sudo:session): session opened for user root(uid=0) by" ~
+:msg, contains, "pam_unix(sudo:session): session closed for user root" ~
+
+#
+# Include all config files in /etc/rsyslog.d/
+#
+$IncludeConfig /etc/rsyslog.d/*.conf
+
+###############
+#### RULES ####
+###############
+# Emergencies are sent to everybody logged in.
+*.emerg                         :omusrmsg:*
+\ No newline at end of file
diff --git a/src/etc/rsyslog.d/01-auth.conf b/src/etc/rsyslog.d/01-auth.conf
deleted file mode 100644
index cc64099d6..000000000
--- a/src/etc/rsyslog.d/01-auth.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-# The lines below cause all listed daemons/processes to be logged into
-# /var/log/auth.log, then drops the message so it does not also go to the
-# regular syslog so that messages are not duplicated
-
-$outchannel auth_log,/var/log/auth.log
-if  $programname == 'CRON' or
-    $programname == 'sudo' or
-    $programname == 'su'
-    then :omfile:$auth_log
-
-if $programname == 'CRON' or
-    $programname == 'sudo' or
-    $programname == 'su'
-    then stop
diff --git a/src/etc/sysctl.d/30-vyos-router.conf b/src/etc/sysctl.d/30-vyos-router.conf
index 411429510..f5d84be4b 100644
--- a/src/etc/sysctl.d/30-vyos-router.conf
+++ b/src/etc/sysctl.d/30-vyos-router.conf
@@ -19,7 +19,7 @@ kernel.core_pattern=/var/core/core-%e-%p-%t
 #  arp_filter defaults to 1 so set all to 0 so vrrp interfaces can override it.
 net.ipv4.conf.all.arp_filter=0
 
-# https://phabricator.vyos.net/T300
+# https://vyos.dev/T300
 net.ipv4.conf.all.arp_ignore=0
 
 net.ipv4.conf.all.arp_announce=2
@@ -98,9 +98,6 @@ net.ipv6.route.skip_notify_on_dev_down=1
 # Default value of 20 seems to interfere with larger OSPF and VRRP setups
 net.ipv4.igmp_max_memberships = 512
 
-# Enable conntrack helper by default
-net.netfilter.nf_conntrack_helper=1
-
 # Increase default garbage collection thresholds
 net.ipv4.neigh.default.gc_thresh1 = 1024
 net.ipv4.neigh.default.gc_thresh2 = 4096
diff --git a/src/etc/systemd/system/ddclient.service.d/override.conf b/src/etc/systemd/system/ddclient.service.d/override.conf
index d9c9963b0..09d929d39 100644
--- a/src/etc/systemd/system/ddclient.service.d/override.conf
+++ b/src/etc/systemd/system/ddclient.service.d/override.conf
@@ -8,4 +8,4 @@ WorkingDirectory=/run/ddclient
 PIDFile=
 PIDFile=/run/ddclient/ddclient.pid
 ExecStart=
-ExecStart=/usr/sbin/ddclient -cache /run/ddclient/ddclient.cache -pid /run/ddclient/ddclient.pid -file /run/ddclient/ddclient.conf
+ExecStart=/usr/bin/ddclient -cache /run/ddclient/ddclient.cache -pid /run/ddclient/ddclient.pid -file /run/ddclient/ddclient.conf
diff --git a/src/etc/systemd/system/frr.service.d/override.conf b/src/etc/systemd/system/frr.service.d/override.conf
index 69eb1a86a..2e4b6e295 100644
--- a/src/etc/systemd/system/frr.service.d/override.conf
+++ b/src/etc/systemd/system/frr.service.d/override.conf
@@ -3,6 +3,7 @@ Before=
 Before=vyos-router.service
 
 [Service]
+LimitNOFILE=4096
 ExecStartPre=/bin/bash -c 'mkdir -p /run/frr/config; \
              echo "log syslog" > /run/frr/config/frr.conf; \
              echo "log facility local7" >> /run/frr/config/frr.conf; \
diff --git a/src/etc/systemd/system/hostapd@.service.d/override.conf b/src/etc/systemd/system/hostapd@.service.d/override.conf
index bb8e81d7a..926c07f94 100644
--- a/src/etc/systemd/system/hostapd@.service.d/override.conf
+++ b/src/etc/systemd/system/hostapd@.service.d/override.conf
@@ -1,6 +1,8 @@
 [Unit]
 After=
 After=vyos-router.service
+ConditionFileNotEmpty=
+ConditionFileNotEmpty=/run/hostapd/%i.conf
 
 [Service]
 WorkingDirectory=/run/hostapd
diff --git a/src/etc/systemd/system/keepalived.service.d/override.conf b/src/etc/systemd/system/keepalived.service.d/override.conf
new file mode 100644
index 000000000..d91a824b9
--- /dev/null
+++ b/src/etc/systemd/system/keepalived.service.d/override.conf
@@ -0,0 +1,14 @@
+[Unit]
+After=vyos-router.service
+# Only start if there is our configuration file - remove Debian default
+# config file from the condition list
+ConditionFileNotEmpty=
+ConditionFileNotEmpty=/run/keepalived/keepalived.conf
+
+[Service]
+KillMode=process
+Type=simple
+# Read configuration variable file if it is present
+ExecStart=
+ExecStart=/usr/sbin/keepalived --use-file /run/keepalived/keepalived.conf --pid /run/keepalived/keepalived.pid --dont-fork --snmp
+PIDFile=/run/keepalived/keepalived.pid