17 files changed, 619 insertions, 209 deletions
diff --git a/src/conf_mode/nat.py b/src/conf_mode/nat.py
index bd9b5162c..26822b755 100755
--- a/src/conf_mode/nat.py
+++ b/src/conf_mode/nat.py
@@ -69,6 +69,10 @@ def get_config(config=None):
     nat['firewall_group'] = conf.get_config_dict(['firewall', 'group'], key_mangling=('-', '_'), get_first_key=True,
                                     no_tag_node_value_mangle=True)
 
+    # Remove dynamic firewall groups if present:
+    if 'dynamic_group' in nat['firewall_group']:
+        del nat['firewall_group']['dynamic_group']
+
     return nat
 
 def verify_rule(config, err_msg, groups_dict):
diff --git a/src/conf_mode/policy_route.py b/src/conf_mode/policy_route.py
index adad012de..6d7a06714 100755
--- a/src/conf_mode/policy_route.py
+++ b/src/conf_mode/policy_route.py
@@ -53,6 +53,10 @@ def get_config(config=None):
     policy['firewall_group'] = conf.get_config_dict(['firewall', 'group'], key_mangling=('-', '_'), get_first_key=True,
                                     no_tag_node_value_mangle=True)
 
+    # Remove dynamic firewall groups if present:
+    if 'dynamic_group' in policy['firewall_group']:
+        del policy['firewall_group']['dynamic_group']
+
     return policy
 
 def verify_rule(policy, name, rule_conf, ipv6, rule_id):
diff --git a/src/conf_mode/protocols_bgp.py b/src/conf_mode/protocols_bgp.py
index f6f3370c3..d90dfe45b 100755
--- a/src/conf_mode/protocols_bgp.py
+++ b/src/conf_mode/protocols_bgp.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020-2023 VyOS maintainers and contributors
+# Copyright (C) 2020-2024 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -509,6 +509,14 @@ def verify(bgp):
                     if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
                         raise ConfigError(
                             'Command "import vrf" conflicts with "route-target vpn both" command!')
+                    if dict_search('route_target.vpn.export', afi_config):
+                        raise ConfigError(
+                            'Command "route-target vpn export" conflicts '\
+                            'with "route-target vpn both" command!')
+                    if dict_search('route_target.vpn.import', afi_config):
+                        raise ConfigError(
+                            'Command "route-target vpn import" conflicts '\
+                            'with "route-target vpn both" command!')
 
                 if dict_search('route_target.vpn.import', afi_config):
                     if verify_vrf_as_import(vrf_name, afi, bgp['dependent_vrfs']):
diff --git a/src/conf_mode/service_dns_dynamic.py b/src/conf_mode/service_dns_dynamic.py
index 845aaa1b5..a551a9891 100755
--- a/src/conf_mode/service_dns_dynamic.py
+++ b/src/conf_mode/service_dns_dynamic.py
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
+# Copyright (C) 2018-2024 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -87,31 +87,36 @@ def verify(dyndns):
             if field not in config:
                 raise ConfigError(f'"{field.replace("_", "-")}" {error_msg_req}')
 
-        # If dyndns address is an interface, ensure
-        # that the interface exists (or just warn if dynamic interface)
-        # and that web-options are not set
-        if config['address'] != 'web':
+        if not any(x in config['address'] for x in ['interface', 'web']):
+            raise ConfigError(f'Either "interface" or "web" {error_msg_req} '
+                              f'with protocol "{config["protocol"]}"')
+        if all(x in config['address'] for x in ['interface', 'web']):
+            raise ConfigError(f'Both "interface" and "web" at the same time {error_msg_uns} '
+                              f'with protocol "{config["protocol"]}"')
+
+        # If dyndns address is an interface, ensure that the interface exists
+        # and warn if a non-active dynamic interface is used
+        if 'interface' in config['address']:
             tmp = re.compile(dynamic_interface_pattern)
             # exclude check interface for dynamic interfaces
-            if tmp.match(config["address"]):
-                if not interface_exists(config["address"]):
-                    Warning(f'Interface "{config["address"]}" does not exist yet and cannot '
-                            f'be used for Dynamic DNS service "{service}" until it is up!')
+            if tmp.match(config['address']['interface']):
+                if not interface_exists(config['address']['interface']):
+                    Warning(f'Interface "{config["address"]["interface"]}" does not exist yet and '
+                            f'cannot be used for Dynamic DNS service "{service}" until it is up!')
             else:
-                verify_interface_exists(config['address'])
-            if 'web_options' in config:
-                raise ConfigError(f'"web-options" is applicable only when using HTTP(S) '
-                                  f'web request to obtain the IP address')
-
-        # Warn if using checkip.dyndns.org, as it does not support HTTPS
-        # See: https://github.com/ddclient/ddclient/issues/597
-        if 'web_options' in config:
-            if 'url' not in config['web_options']:
-                raise ConfigError(f'"url" in "web-options" {error_msg_req} '
+                verify_interface_exists(config['address']['interface'])
+
+        if 'web' in config['address']:
+            # If 'skip' is specified, 'url' is required as well
+            if 'skip' in config['address']['web'] and 'url' not in config['address']['web']:
+                raise ConfigError(f'"url" along with "skip" {error_msg_req} '
                                   f'with protocol "{config["protocol"]}"')
-            elif re.search("^(https?://)?checkip\.dyndns\.org", config['web_options']['url']):
-                Warning(f'"checkip.dyndns.org" does not support HTTPS requests for IP address '
-                        f'lookup. Please use a different IP address lookup service.')
+            if 'url' in config['address']['web']:
+                # Warn if using checkip.dyndns.org, as it does not support HTTPS
+                # See: https://github.com/ddclient/ddclient/issues/597
+                if re.search("^(https?://)?checkip\.dyndns\.org", config['address']['web']['url']):
+                    Warning(f'"checkip.dyndns.org" does not support HTTPS requests for IP address '
+                            f'lookup. Please use a different IP address lookup service.')
 
         # RFC2136 uses 'key' instead of 'password'
         if config['protocol'] != 'nsupdate' and 'password' not in config:
diff --git a/src/conf_mode/vpn_l2tp.py b/src/conf_mode/vpn_l2tp.py
index b569ca140..36b3d2a30 100755
--- a/src/conf_mode/vpn_l2tp.py
+++ b/src/conf_mode/vpn_l2tp.py
@@ -51,11 +51,6 @@ def get_config(config=None):
         # Multiple named pools require ordered values T5099
         l2tp['ordered_named_pools'] = get_pools_in_order(
             dict_search('client_ip_pool', l2tp))
-    l2tp['ip6_column'] = []
-    if dict_search('client_ipv6_pool.prefix', l2tp):
-        l2tp['ip6_column'].append('ipv6')
-    if dict_search('client_ipv6_pool.delegate', l2tp):
-        l2tp['ip6_column'].append('ip6-db')
     l2tp['server_type'] = 'l2tp'
     return l2tp
 
diff --git a/src/conf_mode/vpn_pptp.py b/src/conf_mode/vpn_pptp.py
index 0629625bf..b1d5067d5 100755
--- a/src/conf_mode/vpn_pptp.py
+++ b/src/conf_mode/vpn_pptp.py
@@ -22,6 +22,7 @@ from vyos.config import Config
 from vyos.template import render
 from vyos.utils.process import call
 from vyos.utils.dict import dict_search
+from vyos.accel_ppp_util import verify_accel_ppp_base_service
 from vyos.accel_ppp_util import verify_accel_ppp_ip_pool
 from vyos.accel_ppp_util import get_pools_in_order
 from vyos import ConfigError
@@ -58,36 +59,10 @@ def get_config(config=None):
 def verify(pptp):
     if not pptp:
         return None
-    auth_mode = dict_search('authentication.mode', pptp)
-    if auth_mode == 'local':
-        if not dict_search('authentication.local_users', pptp):
-            raise ConfigError(
-                'PPTP local auth mode requires local users to be configured!')
-
-        for user in dict_search('authentication.local_users.username', pptp):
-            user_config = pptp['authentication']['local_users']['username'][
-                user]
-            if 'password' not in user_config:
-                raise ConfigError(f'Password required for local user "{user}"')
-
-    elif auth_mode == 'radius':
-        if not dict_search('authentication.radius.server', pptp):
-            raise ConfigError(
-                'RADIUS authentication requires at least one server')
-        for server in dict_search('authentication.radius.server', pptp):
-            radius_config = pptp['authentication']['radius']['server'][server]
-            if 'key' not in radius_config:
-                raise ConfigError(
-                    f'Missing RADIUS secret key for server "{server}"')
 
+    verify_accel_ppp_base_service(pptp)
     verify_accel_ppp_ip_pool(pptp)
 
-    if 'name_server' in pptp:
-        if len(pptp['name_server']) > 2:
-            raise ConfigError(
-                'Not more then two IPv4 DNS name-servers can be configured'
-            )
-
     if 'wins_server' in pptp and len(pptp['wins_server']) > 2:
         raise ConfigError(
             'Not more then two WINS name-servers can be configured')
@@ -105,6 +80,7 @@ def generate(pptp):
 
     return None
 
+
 def apply(pptp):
     if not pptp:
         call('systemctl stop accel-ppp@pptp.service')
diff --git a/src/conf_mode/vpn_sstp.py b/src/conf_mode/vpn_sstp.py
index a84513a0f..5c229fe62 100755
--- a/src/conf_mode/vpn_sstp.py
+++ b/src/conf_mode/vpn_sstp.py
@@ -20,7 +20,6 @@ from sys import exit
 
 from vyos.config import Config
 from vyos.configdict import get_accel_dict
-from vyos.configdict import dict_merge
 from vyos.pki import wrap_certificate
 from vyos.pki import wrap_private_key
 from vyos.template import render
diff --git a/src/migration-scripts/bgp/4-to-5 b/src/migration-scripts/bgp/4-to-5
new file mode 100755
index 000000000..c4eb9ec72
--- /dev/null
+++ b/src/migration-scripts/bgp/4-to-5
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Delete 'protocols bgp address-family ipv6-unicast route-target vpn
+# import/export', if 'protocols bgp address-family ipv6-unicast
+# route-target vpn both' exists
+
+from sys import argv
+from sys import exit
+
+from vyos.configtree import ConfigTree
+
+if len(argv) < 2:
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+bgp_base = ['protocols', 'bgp']
+# Delete 'import/export' in default vrf if 'both' exists
+if config.exists(bgp_base):
+    for address_family in ['ipv4-unicast', 'ipv6-unicast']:
+        rt_path = bgp_base + ['address-family', address_family, 'route-target',
+                              'vpn']
+        if config.exists(rt_path + ['both']):
+            if config.exists(rt_path + ['import']):
+                config.delete(rt_path + ['import'])
+            if config.exists(rt_path + ['export']):
+                config.delete(rt_path + ['export'])
+
+# Delete import/export in vrfs if both exists
+if config.exists(['vrf', 'name']):
+    for vrf in config.list_nodes(['vrf', 'name']):
+        vrf_base = ['vrf', 'name', vrf]
+        for address_family in ['ipv4-unicast', 'ipv6-unicast']:
+            rt_path = vrf_base + bgp_base + ['address-family', address_family,
+                                             'route-target', 'vpn']
+            if config.exists(rt_path + ['both']):
+                if config.exists(rt_path + ['import']):
+                    config.delete(rt_path + ['import'])
+                if config.exists(rt_path + ['export']):
+                    config.delete(rt_path + ['export'])
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print(f'Failed to save the modified config: {e}')
+    exit(1)
diff --git a/src/migration-scripts/dns-dynamic/3-to-4 b/src/migration-scripts/dns-dynamic/3-to-4
new file mode 100755
index 000000000..b888a3b6b
--- /dev/null
+++ b/src/migration-scripts/dns-dynamic/3-to-4
@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# T5966:
+# - migrate "service dns dynamic name <service> address <interface>"
+#        to "service dns dynamic name <service> address interface <interface>"
+#      when <interface> != 'web'
+# - migrate "service dns dynamic name <service> web-options ..."
+#        to "service dns dynamic name <service> address web ..."
+#      when <interface> == 'web'
+
+import sys
+from vyos.configtree import ConfigTree
+
+if len(sys.argv) < 2:
+    print("Must specify file name!")
+    sys.exit(1)
+
+file_name = sys.argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+
+base_path = ['service', 'dns', 'dynamic', 'name']
+
+if not config.exists(base_path):
+    # Nothing to do
+    sys.exit(0)
+
+for service in config.list_nodes(base_path):
+
+    service_path = base_path + [service]
+
+    if config.exists(service_path + ['address']):
+        address = config.return_value(service_path + ['address'])
+        # 'address' is not a leaf node anymore, delete it first
+        config.delete(service_path + ['address'])
+
+        # When address is an interface (not 'web'), move it to 'address interface'
+        if address != 'web':
+            config.set(service_path + ['address', 'interface'], address)
+
+        else: # address == 'web'
+            # Relocate optional 'web-options' directly under 'address web'
+            if config.exists(service_path + ['web-options']):
+                # config.copy does not recursively create a path, so initialize it
+                config.set(service_path + ['address'])
+                config.copy(service_path + ['web-options'],
+                            service_path + ['address', 'web'])
+                config.delete(service_path + ['web-options'])
+
+            # ensure that valueless 'address web' still exists even if there are no 'web-options'
+            if not config.exists(service_path + ['address', 'web']):
+                config.set(service_path + ['address', 'web'])
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    sys.exit(1)
diff --git a/src/migration-scripts/l2tp/7-to-8 b/src/migration-scripts/l2tp/7-to-8
new file mode 100755
index 000000000..4956e1155
--- /dev/null
+++ b/src/migration-scripts/l2tp/7-to-8
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Migrate from 'ccp-disable' to 'ppp-options.disable-ccp'
+# Migration ipv6 options
+
+import os
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+
+if len(argv) < 2:
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+base = ['vpn', 'l2tp', 'remote-access']
+if not config.exists(base):
+    exit(0)
+
+#CCP migration
+if config.exists(base + ['ccp-disable']):
+    config.delete(base + ['ccp-disable'])
+    config.set(base + ['ppp-options', 'disable-ccp'])
+
+#IPV6 options migrations
+if config.exists(base + ['ppp-options','ipv6-peer-intf-id']):
+    intf_peer_id = config.return_value(base + ['ppp-options','ipv6-peer-intf-id'])
+    if intf_peer_id == 'ipv4':
+        intf_peer_id = 'ipv4-addr'
+    config.set(base + ['ppp-options','ipv6-peer-interface-id'], value=intf_peer_id, replace=True)
+    config.delete(base + ['ppp-options','ipv6-peer-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-intf-id']):
+    intf_id = config.return_value(base + ['ppp-options','ipv6-intf-id'])
+    config.set(base + ['ppp-options','ipv6-interface-id'], value=intf_id, replace=True)
+    config.delete(base + ['ppp-options','ipv6-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-accept-peer-intf-id']):
+    config.set(base + ['ppp-options','ipv6-accept-peer-interface-id'])
+    config.delete(base + ['ppp-options','ipv6-accept-peer-intf-id'])
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    exit(1)
diff --git a/src/migration-scripts/policy/4-to-5 b/src/migration-scripts/policy/4-to-5
index f6f889c35..5b8fee17e 100755
--- a/src/migration-scripts/policy/4-to-5
+++ b/src/migration-scripts/policy/4-to-5
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright (C) 2022-2024 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -37,7 +37,53 @@ base4 = ['policy', 'route']
 base6 = ['policy', 'route6']
 config = ConfigTree(config_file)
 
+
+def delete_orphaned_interface_policy(config, iftype, ifname, vif=None, vifs=None, vifc=None):
+    """Delete unexpected policy on interfaces in cases when
+       policy does not exist but inreface has a policy configuration
+       Example T5941:
+         set interfaces bonding bond0 vif 995 policy
+    """
+    if_path = ['interfaces', iftype, ifname]
+
+    if vif:
+        if_path += ['vif', vif]
+    elif vifs:
+        if_path += ['vif-s', vifs]
+        if vifc:
+            if_path += ['vif-c', vifc]
+
+    if not config.exists(if_path + ['policy']):
+        return
+
+    config.delete(if_path + ['policy'])
+
+
 if not config.exists(base4) and not config.exists(base6):
+    # Delete orphaned nodes on interfaces T5941
+    for iftype in config.list_nodes(['interfaces']):
+        for ifname in config.list_nodes(['interfaces', iftype]):
+            delete_orphaned_interface_policy(config, iftype, ifname)
+
+            if config.exists(['interfaces', iftype, ifname, 'vif']):
+                for vif in config.list_nodes(['interfaces', iftype, ifname, 'vif']):
+                    delete_orphaned_interface_policy(config, iftype, ifname, vif=vif)
+
+            if config.exists(['interfaces', iftype, ifname, 'vif-s']):
+                for vifs in config.list_nodes(['interfaces', iftype, ifname, 'vif-s']):
+                    delete_orphaned_interface_policy(config, iftype, ifname, vifs=vifs)
+
+                    if config.exists(['interfaces', iftype, ifname, 'vif-s', vifs, 'vif-c']):
+                        for vifc in config.list_nodes(['interfaces', iftype, ifname, 'vif-s', vifs, 'vif-c']):
+                            delete_orphaned_interface_policy(config, iftype, ifname, vifs=vifs, vifc=vifc)
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        exit(1)
+
     # Nothing to do
     exit(0)
 
diff --git a/src/migration-scripts/pppoe-server/8-to-9 b/src/migration-scripts/pppoe-server/8-to-9
new file mode 100755
index 000000000..ad75c28a1
--- /dev/null
+++ b/src/migration-scripts/pppoe-server/8-to-9
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Change from 'ccp' to 'disable-ccp' in ppp-option section
+# Migration ipv6 options
+
+import os
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+
+if len(argv) < 2:
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+base = ['service', 'pppoe-server']
+if not config.exists(base):
+    exit(0)
+
+#CCP migration
+if config.exists(base + ['ppp-options', 'ccp']):
+    config.delete(base + ['ppp-options', 'ccp'])
+else:
+    config.set(base + ['ppp-options', 'disable-ccp'])
+
+#IPV6 options migrations
+if config.exists(base + ['ppp-options','ipv6-peer-intf-id']):
+    intf_peer_id = config.return_value(base + ['ppp-options','ipv6-peer-intf-id'])
+    if intf_peer_id == 'ipv4':
+        intf_peer_id = 'ipv4-addr'
+    config.set(base + ['ppp-options','ipv6-peer-interface-id'], value=intf_peer_id, replace=True)
+    config.delete(base + ['ppp-options','ipv6-peer-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-intf-id']):
+    intf_id = config.return_value(base + ['ppp-options','ipv6-intf-id'])
+    config.set(base + ['ppp-options','ipv6-interface-id'], value=intf_id, replace=True)
+    config.delete(base + ['ppp-options','ipv6-intf-id'])
+
+if config.exists(base + ['ppp-options','ipv6-accept-peer-intf-id']):
+    config.set(base + ['ppp-options','ipv6-accept-peer-interface-id'])
+    config.delete(base + ['ppp-options','ipv6-accept-peer-intf-id'])
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    exit(1)
diff --git a/src/migration-scripts/pptp/3-to-4 b/src/migration-scripts/pptp/3-to-4
new file mode 100755
index 000000000..0a8dad2f4
--- /dev/null
+++ b/src/migration-scripts/pptp/3-to-4
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2024 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# - Move 'mppe' from 'authentication' node to 'ppp-options'
+
+import os
+
+from sys import argv
+from sys import exit
+from vyos.configtree import ConfigTree
+
+
+if len(argv) < 2:
+    print("Must specify file name!")
+    exit(1)
+
+file_name = argv[1]
+
+with open(file_name, 'r') as f:
+    config_file = f.read()
+
+config = ConfigTree(config_file)
+base = ['vpn', 'pptp', 'remote-access']
+
+if not config.exists(base):
+    exit(0)
+
+if config.exists(base + ['authentication','mppe']):
+    mppe = config.return_value(base + ['authentication','mppe'])
+    config.set(base + ['ppp-options', 'mppe'], value=mppe, replace=True)
+    config.delete(base + ['authentication','mppe'])
+
+try:
+    with open(file_name, 'w') as f:
+        f.write(config.to_string())
+except OSError as e:
+    print("Failed to save the modified config: {}".format(e))
+    exit(1)
diff --git a/src/migration-scripts/qos/1-to-2 b/src/migration-scripts/qos/1-to-2
index cca32d06e..666811e5a 100755
--- a/src/migration-scripts/qos/1-to-2
+++ b/src/migration-scripts/qos/1-to-2
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright (C) 2022-2024 VyOS maintainers and contributors
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -40,7 +40,53 @@ with open(file_name, 'r') as f:
 base = ['traffic-policy']
 config = ConfigTree(config_file)
 
+
+def delete_orphaned_interface_policy(config, iftype, ifname, vif=None, vifs=None, vifc=None):
+    """Delete unexpected traffic-policy on interfaces in cases when
+       policy does not exist but inreface has a policy configuration
+       Example T5941:
+         set interfaces bonding bond0 vif 995 traffic-policy
+    """
+    if_path = ['interfaces', iftype, ifname]
+
+    if vif:
+        if_path += ['vif', vif]
+    elif vifs:
+        if_path += ['vif-s', vifs]
+        if vifc:
+            if_path += ['vif-c', vifc]
+
+    if not config.exists(if_path + ['traffic-policy']):
+        return
+
+    config.delete(if_path + ['traffic-policy'])
+
+
 if not config.exists(base):
+    # Delete orphaned nodes on interfaces T5941
+    for iftype in config.list_nodes(['interfaces']):
+        for ifname in config.list_nodes(['interfaces', iftype]):
+            delete_orphaned_interface_policy(config, iftype, ifname)
+
+            if config.exists(['interfaces', iftype, ifname, 'vif']):
+                for vif in config.list_nodes(['interfaces', iftype, ifname, 'vif']):
+                    delete_orphaned_interface_policy(config, iftype, ifname, vif=vif)
+
+            if config.exists(['interfaces', iftype, ifname, 'vif-s']):
+                for vifs in config.list_nodes(['interfaces', iftype, ifname, 'vif-s']):
+                    delete_orphaned_interface_policy(config, iftype, ifname, vifs=vifs)
+
+                    if config.exists(['interfaces', iftype, ifname, 'vif-s', vifs, 'vif-c']):
+                        for vifc in config.list_nodes(['interfaces', iftype, ifname, 'vif-s', vifs, 'vif-c']):
+                            delete_orphaned_interface_policy(config, iftype, ifname, vifs=vifs, vifc=vifc)
+
+    try:
+        with open(file_name, 'w') as f:
+            f.write(config.to_string())
+    except OSError as e:
+        print("Failed to save the modified config: {}".format(e))
+        exit(1)
+
     # Nothing to do
     exit(0)
 
diff --git a/src/op_mode/dns.py b/src/op_mode/dns.py
index 309bef3b9..16c462f23 100755
--- a/src/op_mode/dns.py
+++ b/src/op_mode/dns.py
@@ -15,14 +15,33 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-import typing
+import os
 import sys
+import time
+import typing
 import vyos.opmode
 
 from tabulate import tabulate
 from vyos.configquery import ConfigTreeQuery
 from vyos.utils.process import cmd, rc_cmd
+from vyos.template import is_ipv4, is_ipv6
+
+_dynamic_cache_file = r'/run/ddclient/ddclient.cache'
+
+_dynamic_status_columns = {
+    'host':        'Hostname',
+    'ipv4':        'IPv4 address',
+    'status-ipv4': 'IPv4 status',
+    'ipv6':        'IPv6 address',
+    'status-ipv6': 'IPv6 status',
+    'mtime':       'Last update',
+}
 
+_forwarding_statistics_columns = {
+    'cache-entries':     'Cache entries',
+    'max-cache-entries': 'Max cache entries',
+    'cache-size':        'Cache size',
+}
 
 def _forwarding_data_to_dict(data, sep="\t") -> dict:
     """
@@ -50,37 +69,106 @@ def _forwarding_data_to_dict(data, sep="\t") -> dict:
             dictionary[key] = value
     return dictionary
 
+def _get_dynamic_host_records_raw() -> dict:
+
+    data = []
+
+    if os.path.isfile(_dynamic_cache_file): # A ddclient status file might not always exist
+        with open(_dynamic_cache_file, 'r') as f:
+            for line in f:
+                if line.startswith('#'):
+                    continue
+
+                props = {}
+                # ddclient cache rows have properties in 'key=value' format separated by comma
+                # we pick up the ones we are interested in
+                for kvraw in line.split(' ')[0].split(','):
+                    k, v = kvraw.split('=')
+                    if k in list(_dynamic_status_columns.keys()) + ['ip', 'status']:  # ip and status are legacy keys
+                        props[k] = v
+
+                # Extract IPv4 and IPv6 address and status from legacy keys
+                # Dual-stack isn't supported in legacy format, 'ip' and 'status' are for one of IPv4 or IPv6
+                if 'ip' in props:
+                    if is_ipv4(props['ip']):
+                        props['ipv4'] = props['ip']
+                        props['status-ipv4'] = props['status']
+                    elif is_ipv6(props['ip']):
+                        props['ipv6'] = props['ip']
+                        props['status-ipv6'] = props['status']
+                    del props['ip']
+
+                # Convert mtime to human readable format
+                if 'mtime' in props:
+                    props['mtime'] = time.strftime(
+                        "%Y-%m-%d %H:%M:%S", time.localtime(int(props['mtime'], base=10)))
+
+                data.append(props)
+
+    return data
+
+def _get_dynamic_host_records_formatted(data):
+    data_entries = []
+    for entry in data:
+        data_entries.append([entry.get(key) for key in _dynamic_status_columns.keys()])
+    header = _dynamic_status_columns.values()
+    output = tabulate(data_entries, header, numalign='left')
+    return output
 
 def _get_forwarding_statistics_raw() -> dict:
     command = cmd('rec_control get-all')
     data = _forwarding_data_to_dict(command)
-    data['cache-size'] = "{0:.2f}".format( int(
+    data['cache-size'] = "{0:.2f} kbytes".format( int(
         cmd('rec_control get cache-bytes')) / 1024 )
     return data
 
-
 def _get_forwarding_statistics_formatted(data):
-    cache_entries = data.get('cache-entries')
-    max_cache_entries = data.get('max-cache-entries')
-    cache_size = data.get('cache-size')
-    data_entries = [[cache_entries, max_cache_entries, f'{cache_size} kbytes']]
-    headers = ["Cache entries", "Max cache entries" , "Cache size"]
-    output = tabulate(data_entries, headers, numalign="left")
+    data_entries = []
+    data_entries.append([data.get(key) for key in _forwarding_statistics_columns.keys()])
+    header = _forwarding_statistics_columns.values()
+    output = tabulate(data_entries, header, numalign='left')
     return output
 
-def _verify_forwarding(func):
-    """Decorator checks if DNS Forwarding config exists"""
+def _verify(target):
+    """Decorator checks if config for DNS related service exists"""
     from functools import wraps
 
-    @wraps(func)
-    def _wrapper(*args, **kwargs):
-        config = ConfigTreeQuery()
-        if not config.exists('service dns forwarding'):
-            raise vyos.opmode.UnconfiguredSubsystem('DNS Forwarding is not configured')
-        return func(*args, **kwargs)
-    return _wrapper
+    if target not in ['dynamic', 'forwarding']:
+        raise ValueError('Invalid target')
+
+    def _verify_target(func):
+        @wraps(func)
+        def _wrapper(*args, **kwargs):
+            config = ConfigTreeQuery()
+            if not config.exists(f'service dns {target}'):
+                _prefix = f'Dynamic DNS' if target == 'dynamic' else 'DNS Forwarding'
+                raise vyos.opmode.UnconfiguredSubsystem(f'{_prefix} is not configured')
+            return func(*args, **kwargs)
+        return _wrapper
+    return _verify_target
+
+@_verify('dynamic')
+def show_dynamic_status(raw: bool):
+    host_data = _get_dynamic_host_records_raw()
+    if raw:
+        return host_data
+    else:
+        return _get_dynamic_host_records_formatted(host_data)
 
-@_verify_forwarding
+@_verify('dynamic')
+def reset_dynamic():
+    """
+    Reset Dynamic DNS cache
+    """
+    if os.path.exists(_dynamic_cache_file):
+        os.remove(_dynamic_cache_file)
+    rc, output = rc_cmd('systemctl restart ddclient.service')
+    if rc != 0:
+        print(output)
+        return None
+    print(f'Dynamic DNS state reset!')
+
+@_verify('forwarding')
 def show_forwarding_statistics(raw: bool):
     dns_data = _get_forwarding_statistics_raw()
     if raw:
@@ -88,7 +176,7 @@ def show_forwarding_statistics(raw: bool):
     else:
         return _get_forwarding_statistics_formatted(dns_data)
 
-@_verify_forwarding
+@_verify('forwarding')
 def reset_forwarding(all: bool, domain: typing.Optional[str]):
     """
     Reset DNS Forwarding cache
diff --git a/src/op_mode/dns_dynamic.py b/src/op_mode/dns_dynamic.py
deleted file mode 100755
index 12aa5494a..000000000
--- a/src/op_mode/dns_dynamic.py
+++ /dev/null
@@ -1,113 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import os
-import argparse
-import sys
-import time
-from tabulate import tabulate
-
-from vyos.config import Config
-from vyos.template import is_ipv4, is_ipv6
-from vyos.utils.process import call
-
-cache_file = r'/run/ddclient/ddclient.cache'
-
-columns = {
-    'host':        'Hostname',
-    'ipv4':        'IPv4 address',
-    'status-ipv4': 'IPv4 status',
-    'ipv6':        'IPv6 address',
-    'status-ipv6': 'IPv6 status',
-    'mtime':       'Last update',
-}
-
-
-def _get_formatted_host_records(host_data):
-    data_entries = []
-    for entry in host_data:
-        data_entries.append([entry.get(key) for key in columns.keys()])
-
-    header = columns.values()
-    output = tabulate(data_entries, header, numalign='left')
-    return output
-
-
-def show_status():
-    # A ddclient status file might not always exist
-    if not os.path.exists(cache_file):
-        sys.exit(0)
-
-    data = []
-
-    with open(cache_file, 'r') as f:
-        for line in f:
-            if line.startswith('#'):
-                continue
-
-            props = {}
-            # ddclient cache rows have properties in 'key=value' format separated by comma
-            # we pick up the ones we are interested in
-            for kvraw in line.split(' ')[0].split(','):
-                k, v = kvraw.split('=')
-                if k in list(columns.keys()) + ['ip', 'status']:  # ip and status are legacy keys
-                    props[k] = v
-
-            # Extract IPv4 and IPv6 address and status from legacy keys
-            # Dual-stack isn't supported in legacy format, 'ip' and 'status' are for one of IPv4 or IPv6
-            if 'ip' in props:
-                if is_ipv4(props['ip']):
-                    props['ipv4'] = props['ip']
-                    props['status-ipv4'] = props['status']
-                elif is_ipv6(props['ip']):
-                    props['ipv6'] = props['ip']
-                    props['status-ipv6'] = props['status']
-                del props['ip']
-
-            # Convert mtime to human readable format
-            if 'mtime' in props:
-                props['mtime'] = time.strftime(
-                    "%Y-%m-%d %H:%M:%S", time.localtime(int(props['mtime'], base=10)))
-
-            data.append(props)
-
-    print(_get_formatted_host_records(data))
-
-
-def update_ddns():
-    call('systemctl stop ddclient.service')
-    if os.path.exists(cache_file):
-        os.remove(cache_file)
-    call('systemctl start ddclient.service')
-
-
-if __name__ == '__main__':
-    parser = argparse.ArgumentParser()
-    group = parser.add_mutually_exclusive_group()
-    group.add_argument("--status", help="Show DDNS status", action="store_true")
-    group.add_argument("--update", help="Update DDNS on a given interface", action="store_true")
-    args = parser.parse_args()
-
-    # Do nothing if service is not configured
-    c = Config()
-    if not c.exists_effective('service dns dynamic'):
-        print("Dynamic DNS not configured")
-        sys.exit(1)
-
-    if args.status:
-        show_status()
-    elif args.update:
-        update_ddns()
diff --git a/src/op_mode/firewall.py b/src/op_mode/firewall.py
index 36bb013fe..4dcffc412 100755
--- a/src/op_mode/firewall.py
+++ b/src/op_mode/firewall.py
@@ -327,6 +327,8 @@ def show_firewall_group(name=None):
                             dest_group = dict_search_args(rule_conf, 'destination', 'group', group_type)
                             in_interface = dict_search_args(rule_conf, 'inbound_interface', 'group')
                             out_interface = dict_search_args(rule_conf, 'outbound_interface', 'group')
+                            dyn_group_source = dict_search_args(rule_conf, 'add_address_to_group', 'source_address', group_type)
+                            dyn_group_dst = dict_search_args(rule_conf, 'add_address_to_group', 'destination_address', group_type)
                             if source_group:
                                 if source_group[0] == "!":
                                     source_group = source_group[1:]
@@ -348,6 +350,14 @@ def show_firewall_group(name=None):
                                 if group_name == out_interface:
                                     out.append(f'{item}-{name_type}-{priority}-{rule_id}')
 
+                            if dyn_group_source:
+                                if group_name == dyn_group_source:
+                                    out.append(f'{item}-{name_type}-{priority}-{rule_id}')
+                            if dyn_group_dst:
+                                if group_name == dyn_group_dst:
+                                    out.append(f'{item}-{name_type}-{priority}-{rule_id}')
+
+
             # Look references in route | route6
             for name_type in ['route', 'route6']:
                 if name_type not in policy:
@@ -423,26 +433,37 @@ def show_firewall_group(name=None):
     rows = []
 
     for group_type, group_type_conf in firewall['group'].items():
-        for group_name, group_conf in group_type_conf.items():
-            if name and name != group_name:
-                continue
+        ##
+        if group_type != 'dynamic_group':
 
-            references = find_references(group_type, group_name)
-            row = [group_name, group_type, '\n'.join(references) or 'N/D']
-            if 'address' in group_conf:
-                row.append("\n".join(sorted(group_conf['address'])))
-            elif 'network' in group_conf:
-                row.append("\n".join(sorted(group_conf['network'], key=ipaddress.ip_network)))
-            elif 'mac_address' in group_conf:
-                row.append("\n".join(sorted(group_conf['mac_address'])))
-            elif 'port' in group_conf:
-                row.append("\n".join(sorted(group_conf['port'])))
-            elif 'interface' in group_conf:
-                row.append("\n".join(sorted(group_conf['interface'])))
-            else:
-                row.append('N/D')
-            rows.append(row)
+            for group_name, group_conf in group_type_conf.items():
+                if name and name != group_name:
+                    continue
 
+                references = find_references(group_type, group_name)
+                row = [group_name, group_type, '\n'.join(references) or 'N/D']
+                if 'address' in group_conf:
+                    row.append("\n".join(sorted(group_conf['address'])))
+                elif 'network' in group_conf:
+                    row.append("\n".join(sorted(group_conf['network'], key=ipaddress.ip_network)))
+                elif 'mac_address' in group_conf:
+                    row.append("\n".join(sorted(group_conf['mac_address'])))
+                elif 'port' in group_conf:
+                    row.append("\n".join(sorted(group_conf['port'])))
+                elif 'interface' in group_conf:
+                    row.append("\n".join(sorted(group_conf['interface'])))
+                else:
+                    row.append('N/D')
+                rows.append(row)
+
+        else:
+            for dynamic_type in ['address_group', 'ipv6_address_group']:
+                if dynamic_type in firewall['group']['dynamic_group']:
+                    for dynamic_name, dynamic_conf in firewall['group']['dynamic_group'][dynamic_type].items():
+                        references = find_references(dynamic_type, dynamic_name)
+                        row = [dynamic_name, dynamic_type + '(dynamic)', '\n'.join(references) or 'N/D']
+                        row.append('N/D')
+                        rows.append(row)
 
     if rows:
         print('Firewall Groups\n')