15 files changed, 599 insertions, 173 deletions
diff --git a/src/conf_mode/vpn_ipsec.py b/src/conf_mode/vpn_ipsec.py
index 77a425f8b..cfefcfbe8 100755
--- a/src/conf_mode/vpn_ipsec.py
+++ b/src/conf_mode/vpn_ipsec.py
@@ -117,13 +117,26 @@ def get_config(config=None):
                     ipsec['ike_group'][group]['proposal'][proposal] = dict_merge(default_values,
                         ipsec['ike_group'][group]['proposal'][proposal])
 
-    if 'remote_access' in ipsec and 'connection' in ipsec['remote_access']:
+    # XXX: T2665: we can not safely rely on the defaults() when there are
+    # tagNodes in place, it is better to blend in the defaults manually.
+    if dict_search('remote_access.connection', ipsec):
         default_values = defaults(base + ['remote-access', 'connection'])
         for rw in ipsec['remote_access']['connection']:
             ipsec['remote_access']['connection'][rw] = dict_merge(default_values,
               ipsec['remote_access']['connection'][rw])
 
-    if 'remote_access' in ipsec and 'radius' in ipsec['remote_access'] and 'server' in ipsec['remote_access']['radius']:
+    # XXX: T2665: we can not safely rely on the defaults() when there are
+    # tagNodes in place, it is better to blend in the defaults manually.
+    if dict_search('remote_access.radius.server', ipsec):
+        # Fist handle the "base" stuff like RADIUS timeout
+        default_values = defaults(base + ['remote-access', 'radius'])
+        if 'server' in default_values:
+            del default_values['server']
+        ipsec['remote_access']['radius'] = dict_merge(default_values,
+                                                      ipsec['remote_access']['radius'])
+
+        # Take care about individual RADIUS servers implemented as tagNodes - this
+        # requires special treatment
         default_values = defaults(base + ['remote-access', 'radius', 'server'])
         for server in ipsec['remote_access']['radius']['server']:
             ipsec['remote_access']['radius']['server'][server] = dict_merge(default_values,
diff --git a/src/op_mode/bgp.py b/src/op_mode/bgp.py
new file mode 100755
index 000000000..23001a9d7
--- /dev/null
+++ b/src/op_mode/bgp.py
@@ -0,0 +1,120 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Purpose:
+#    Displays bgp neighbors information.
+#    Used by the "show bgp (vrf <tag>) ipv4|ipv6 neighbors" commands.
+
+import re
+import sys
+import typing
+
+import jmespath
+from jinja2 import Template
+from humps import decamelize
+
+from vyos.configquery import ConfigTreeQuery
+
+import vyos.opmode
+
+
+frr_command_template = Template("""
+{% if family %}
+    show bgp
+        {{ 'vrf ' ~ vrf if vrf else '' }}
+        {{ 'ipv6' if family == 'inet6' else 'ipv4'}}
+        {{ 'neighbor ' ~ peer if peer else 'summary' }}
+{% endif %}
+
+{% if raw %}
+    json
+{% endif %}
+""")
+
+
+def _verify(func):
+    """Decorator checks if BGP config exists
+    BGP configuration can be present under vrf <tag>
+    If we do npt get arg 'peer' then it can be 'bgp summary'
+    """
+    from functools import wraps
+
+    @wraps(func)
+    def _wrapper(*args, **kwargs):
+        config = ConfigTreeQuery()
+        afi = 'ipv6' if kwargs.get('family') == 'inet6' else 'ipv4'
+        global_vrfs = ['all', 'default']
+        peer = kwargs.get('peer')
+        vrf = kwargs.get('vrf')
+        unconf_message = f'BGP or neighbor is not configured'
+        # Add option to check the specific neighbor if we have arg 'peer'
+        peer_opt = f'neighbor {peer} address-family {afi}-unicast' if peer else ''
+        vrf_opt = ''
+        if vrf and vrf not in global_vrfs:
+            vrf_opt = f'vrf name {vrf}'
+        # Check if config does not exist
+        if not config.exists(f'{vrf_opt} protocols bgp {peer_opt}'):
+            raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
+        return func(*args, **kwargs)
+
+    return _wrapper
+
+
+@_verify
+def show_neighbors(raw: bool,
+                   family: str,
+                   peer: typing.Optional[str],
+                   vrf: typing.Optional[str]):
+    kwargs = dict(locals())
+    frr_command = frr_command_template.render(kwargs)
+    frr_command = re.sub(r'\s+', ' ', frr_command)
+
+    from vyos.util import cmd
+    output = cmd(f"vtysh -c '{frr_command}'")
+
+    if raw:
+        from json import loads
+        data = loads(output)
+        # Get list of the peers
+        peers = jmespath.search('*.peers | [0]', data)
+        if peers:
+            # Create new dict, delete old key 'peers'
+            # add key 'peers' neighbors to the list
+            list_peers = []
+            new_dict = jmespath.search('* | [0]', data)
+            if 'peers' in new_dict:
+                new_dict.pop('peers')
+
+                for neighbor, neighbor_options in peers.items():
+                    neighbor_options['neighbor'] = neighbor
+                    list_peers.append(neighbor_options)
+                new_dict['peers'] = list_peers
+            return decamelize(new_dict)
+        data = jmespath.search('* | [0]', data)
+        return decamelize(data)
+
+    else:
+        return output
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/dhcp.py b/src/op_mode/dhcp.py
new file mode 100755
index 000000000..07e9b7d6c
--- /dev/null
+++ b/src/op_mode/dhcp.py
@@ -0,0 +1,278 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import sys
+from ipaddress import ip_address
+import typing
+
+from datetime import datetime
+from sys import exit
+from tabulate import tabulate
+from isc_dhcp_leases import IscDhcpLeases
+
+from vyos.base import Warning
+from vyos.configquery import ConfigTreeQuery
+
+from vyos.util import cmd
+from vyos.util import dict_search
+from vyos.util import is_systemd_service_running
+
+import vyos.opmode
+
+
+config = ConfigTreeQuery()
+pool_key = "shared-networkname"
+
+
+def _in_pool(lease, pool):
+    if pool_key in lease.sets:
+        if lease.sets[pool_key] == pool:
+            return True
+    return False
+
+
+def _utc_to_local(utc_dt):
+    return datetime.fromtimestamp((datetime.fromtimestamp(utc_dt) - datetime(1970, 1, 1)).total_seconds())
+
+
+def _format_hex_string(in_str):
+    out_str = ""
+    # if input is divisible by 2, add : every 2 chars
+    if len(in_str) > 0 and len(in_str) % 2 == 0:
+        out_str = ':'.join(a+b for a,b in zip(in_str[::2], in_str[1::2]))
+    else:
+        out_str = in_str
+
+    return out_str
+
+
+def _find_list_of_dict_index(lst, key='ip', value='') -> int:
+    """
+    Find the index entry of list of dict matching the dict value
+    Exampe:
+        % lst = [{'ip': '192.0.2.1'}, {'ip': '192.0.2.2'}]
+        % _find_list_of_dict_index(lst, key='ip', value='192.0.2.2')
+        % 1
+    """
+    idx = next((index for (index, d) in enumerate(lst) if d[key] == value), None)
+    return idx
+
+
+def _get_raw_server_leases(family, pool=None) -> list:
+    """
+    Get DHCP server leases
+    :return list
+    """
+    lease_file = '/config/dhcpdv6.leases' if family == 'inet6' else '/config/dhcpd.leases'
+    data = []
+    leases = IscDhcpLeases(lease_file).get()
+    if pool is not None:
+        if config.exists(f'service dhcp-server shared-network-name {pool}'):
+            leases = list(filter(lambda x: _in_pool(x, pool), leases))
+    for lease in leases:
+        data_lease = {}
+        data_lease['ip'] = lease.ip
+        data_lease['state'] = lease.binding_state
+        data_lease['pool'] = lease.sets.get('shared-networkname', '')
+        data_lease['end'] = lease.end.timestamp()
+
+        if family == 'inet':
+            data_lease['hardware'] = lease.ethernet
+            data_lease['start'] = lease.start.timestamp()
+            data_lease['hostname'] = lease.hostname
+
+        if family == 'inet6':
+            data_lease['last_communication'] = lease.last_communication.timestamp()
+            data_lease['iaid_duid'] = _format_hex_string(lease.host_identifier_string)
+            lease_types_long = {'na': 'non-temporary', 'ta': 'temporary', 'pd': 'prefix delegation'}
+            data_lease['type'] = lease_types_long[lease.type]
+
+        data_lease['remaining'] = lease.end - datetime.utcnow()
+
+        if data_lease['remaining'].days >= 0:
+            # substraction gives us a timedelta object which can't be formatted with strftime
+            # so we use str(), split gets rid of the microseconds
+            data_lease['remaining'] = str(data_lease["remaining"]).split('.')[0]
+        else:
+            data_lease['remaining'] = ''
+
+        # Do not add old leases
+        if data_lease['remaining'] != '':
+            data.append(data_lease)
+
+        # deduplicate
+        checked = []
+        for entry in data:
+            addr = entry.get('ip')
+            if addr not in checked:
+                checked.append(addr)
+            else:
+                idx = _find_list_of_dict_index(data, key='ip', value=addr)
+                data.pop(idx)
+
+    return data
+
+
+def _get_formatted_server_leases(raw_data, family):
+    data_entries = []
+    if family == 'inet':
+        for lease in raw_data:
+            ipaddr = lease.get('ip')
+            hw_addr = lease.get('hardware')
+            state = lease.get('state')
+            start = lease.get('start')
+            start =  _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
+            end = lease.get('end')
+            end =  _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S')
+            remain = lease.get('remaining')
+            pool = lease.get('pool')
+            hostname = lease.get('hostname')
+            data_entries.append([ipaddr, hw_addr, state, start, end, remain, pool, hostname])
+
+        headers = ['IP Address', 'Hardware address', 'State', 'Lease start', 'Lease expiration', 'Remaining', 'Pool',
+                   'Hostname']
+
+    if family == 'inet6':
+        for lease in raw_data:
+            ipaddr = lease.get('ip')
+            state = lease.get('state')
+            start = lease.get('last_communication')
+            start =  _utc_to_local(start).strftime('%Y/%m/%d %H:%M:%S')
+            end = lease.get('end')
+            end =  _utc_to_local(end).strftime('%Y/%m/%d %H:%M:%S')
+            remain = lease.get('remaining')
+            lease_type = lease.get('type')
+            pool = lease.get('pool')
+            host_identifier = lease.get('iaid_duid')
+            data_entries.append([ipaddr, state, start, end, remain, lease_type, pool, host_identifier])
+
+        headers = ['IPv6 address', 'State', 'Last communication', 'Lease expiration', 'Remaining', 'Type', 'Pool',
+                   'IAID_DUID']
+
+    output = tabulate(data_entries, headers, numalign='left')
+    return output
+
+
+def _get_dhcp_pools(family='inet') -> list:
+    v = 'v6' if family == 'inet6' else ''
+    pools = config.list_nodes(f'service dhcp{v}-server shared-network-name')
+    return pools
+
+
+def _get_pool_size(pool, family='inet'):
+    v = 'v6' if family == 'inet6' else ''
+    base = f'service dhcp{v}-server shared-network-name {pool}'
+    size = 0
+    subnets = config.list_nodes(f'{base} subnet')
+    for subnet in subnets:
+        if family == 'inet6':
+            ranges = config.list_nodes(f'{base} subnet {subnet} address-range start')
+        else:
+            ranges = config.list_nodes(f'{base} subnet {subnet} range')
+        for range in ranges:
+            if family == 'inet6':
+                start = config.list_nodes(f'{base} subnet {subnet} address-range start')[0]
+                stop = config.value(f'{base} subnet {subnet} address-range start {start} stop')
+            else:
+                start = config.value(f'{base} subnet {subnet} range {range} start')
+                stop = config.value(f'{base} subnet {subnet} range {range} stop')
+            # Add +1 because both range boundaries are inclusive
+            size += int(ip_address(stop)) - int(ip_address(start)) + 1
+    return size
+
+
+def _get_raw_pool_statistics(family='inet', pool=None):
+    if pool is None:
+        pool = _get_dhcp_pools(family=family)
+    else:
+        pool = [pool]
+
+    v = 'v6' if family == 'inet6' else ''
+    stats = []
+    for p in pool:
+        subnet = config.list_nodes(f'service dhcp{v}-server shared-network-name {p} subnet')
+        size = _get_pool_size(family=family, pool=p)
+        leases = len(_get_raw_server_leases(family=family, pool=p))
+        use_percentage = round(leases / size * 100) if size != 0 else 0
+        pool_stats = {'pool': p, 'size': size, 'leases': leases,
+                      'available': (size - leases), 'use_percentage': use_percentage, 'subnet': subnet}
+        stats.append(pool_stats)
+    return stats
+
+
+def _get_formatted_pool_statistics(pool_data, family='inet'):
+    data_entries = []
+    for entry in pool_data:
+        pool = entry.get('pool')
+        size = entry.get('size')
+        leases = entry.get('leases')
+        available = entry.get('available')
+        use_percentage = entry.get('use_percentage')
+        use_percentage = f'{use_percentage}%'
+        data_entries.append([pool, size, leases, available, use_percentage])
+
+    headers = ['Pool', 'Size','Leases', 'Available', 'Usage']
+    output = tabulate(data_entries, headers, numalign='left')
+    return output
+
+
+def _verify(func):
+    """Decorator checks if DHCP(v6) config exists"""
+    from functools import wraps
+
+    @wraps(func)
+    def _wrapper(*args, **kwargs):
+        config = ConfigTreeQuery()
+        family = kwargs.get('family')
+        v = 'v6' if family == 'inet6' else ''
+        unconf_message = f'DHCP{v} server is not configured'
+        # Check if config does not exist
+        if not config.exists(f'service dhcp{v}-server'):
+            raise vyos.opmode.UnconfiguredSubsystem(unconf_message)
+        return func(*args, **kwargs)
+    return _wrapper
+
+
+@_verify
+def show_pool_statistics(raw: bool, family: str, pool: typing.Optional[str]):
+    pool_data = _get_raw_pool_statistics(family=family, pool=pool)
+    if raw:
+        return pool_data
+    else:
+        return _get_formatted_pool_statistics(pool_data, family=family)
+
+
+@_verify
+def show_server_leases(raw: bool, family: str):
+    # if dhcp server is down, inactive leases may still be shown as active, so warn the user.
+    if not is_systemd_service_running('isc-dhcp-server.service'):
+        Warning('DHCP server is configured but not started. Data may be stale.')
+
+    leases = _get_raw_server_leases(family)
+    if raw:
+        return leases
+    else:
+        return _get_formatted_server_leases(leases, family)
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/log.py b/src/op_mode/log.py
new file mode 100755
index 000000000..b0abd6191
--- /dev/null
+++ b/src/op_mode/log.py
@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+#
+# Copyright (C) 2022 VyOS maintainers and contributors
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import json
+import re
+import sys
+import typing
+
+from jinja2 import Template
+
+from vyos.util import rc_cmd
+
+import vyos.opmode
+
+journalctl_command_template = Template("""
+--no-hostname
+--quiet
+
+{% if boot %}
+  --boot
+{% endif %}
+
+{% if count %}
+  --lines={{ count }}
+{% endif %}
+
+{% if reverse %}
+  --reverse
+{% endif %}
+
+{% if since %}
+  --since={{ since }}
+{% endif %}
+
+{% if unit %}
+  --unit={{ unit }}
+{% endif %}
+
+{% if utc %}
+  --utc
+{% endif %}
+
+{% if raw %}
+{# By default show 100 only lines for raw option if count does not set #}
+{# Protection from parsing the full log by default #}
+{%    if not boot %}
+  --lines={{ '' ~ count if count else '100' }}
+{%    endif %}
+  --no-pager
+  --output=json
+{% endif %}
+""")
+
+
+def show(raw: bool,
+         boot: typing.Optional[bool],
+         count: typing.Optional[int],
+         facility: typing.Optional[str],
+         reverse: typing.Optional[bool],
+         utc: typing.Optional[bool],
+         unit: typing.Optional[str]):
+    kwargs = dict(locals())
+
+    journalctl_options = journalctl_command_template.render(kwargs)
+    journalctl_options = re.sub(r'\s+', ' ', journalctl_options)
+    rc, output = rc_cmd(f'journalctl {journalctl_options}')
+    if raw:
+        # Each 'journalctl --output json' line is a separate JSON object
+        # So we should return list of dict
+        return [json.loads(line) for line in output.split('\n')]
+    return output
+
+
+if __name__ == '__main__':
+    try:
+        res = vyos.opmode.run(sys.modules[__name__])
+        if res:
+            print(res)
+    except (ValueError, vyos.opmode.Error) as e:
+        print(e)
+        sys.exit(1)
diff --git a/src/op_mode/ping.py b/src/op_mode/ping.py
index 60bbc0c78..5e5b95a0a 100755
--- a/src/op_mode/ping.py
+++ b/src/op_mode/ping.py
@@ -18,6 +18,32 @@ import os
 import sys
 import socket
 import ipaddress
+import json
+from vyos.util import cmd, rc_cmd
+from vyos.ifconfig import Section
+
+
+def interface_list() -> list:
+    """
+    Get list of interfaces in system
+    :rtype: list
+    """
+    return Section.interfaces()
+
+
+def vrf_list() -> list:
+    """
+    Get list of VRFs in system
+    :rtype: list
+    """
+    result = cmd(f'sudo ip --json --brief link show type vrf')
+    data = json.loads(result)
+    vrflist: list = []
+    for o in data:
+        if 'ifname' in o:
+            vrflist.append(o['ifname'])
+    return vrflist
+
 
 options = {
     'audible': {
@@ -63,6 +89,7 @@ options = {
     'interface': {
         'ping': '{command} -I {value}',
         'type': '<interface>',
+        'helpfunction': interface_list,
         'help': 'Source interface'
     },
     'interval': {
@@ -128,6 +155,7 @@ options = {
         'ping': 'sudo ip vrf exec {value} {command}',
         'type': '<vrf>',
         'help': 'Use specified VRF table',
+        'helpfunction': vrf_list,
         'dflt': 'default',
     },
     'verbose': {
@@ -142,20 +170,33 @@ ping = {
 }
 
 
-class List (list):
-    def first (self):
+class List(list):
+    def first(self):
         return self.pop(0) if self else ''
 
     def last(self):
         return self.pop() if self else ''
 
-    def prepend(self,value):
-        self.insert(0,value)
+    def prepend(self, value):
+        self.insert(0, value)
+
+
+def completion_failure(option: str) -> None:
+    """
+    Shows failure message after TAB when option is wrong
+    :param option: failure option
+    :type str:
+    """
+    sys.stderr.write('\n\n Invalid option: {}\n\n'.format(option))
+    sys.stdout.write('<nocomps>')
+    sys.exit(1)
 
 
 def expension_failure(option, completions):
     reason = 'Ambiguous' if completions else 'Invalid'
-    sys.stderr.write('\n\n  {} command: {} [{}]\n\n'.format(reason,' '.join(sys.argv), option))
+    sys.stderr.write(
+        '\n\n  {} command: {} [{}]\n\n'.format(reason, ' '.join(sys.argv),
+                                               option))
     if completions:
         sys.stderr.write('  Possible completions:\n   ')
         sys.stderr.write('\n   '.join(completions))
@@ -196,28 +237,44 @@ if __name__ == '__main__':
     if host == '--get-options':
         args.first()  # pop ping
         args.first()  # pop IP
+        usedoptionslist = []
         while args:
-            option = args.first()
-
-            matched = complete(option)
+            option = args.first()  # pop option
+            matched = complete(option)  # get option parameters
+            usedoptionslist.append(option)  # list of used options
+            # Select options
             if not args:
+                # remove from Possible completions used options
+                for o in usedoptionslist:
+                    if o in matched:
+                        matched.remove(o)
                 sys.stdout.write(' '.join(matched))
                 sys.exit(0)
 
-            if len(matched) > 1 :
+            if len(matched) > 1:
                 sys.stdout.write(' '.join(matched))
                 sys.exit(0)
+            # If option doesn't have value
+            if matched:
+                if options[matched[0]]['type'] == 'noarg':
+                    continue
+            else:
+                # Unexpected option
+                completion_failure(option)
 
-            if options[matched[0]]['type'] == 'noarg':
-                continue
-
-            value = args.first()
+            value = args.first()  # pop option's value
             if not args:
                 matched = complete(option)
-                sys.stdout.write(options[matched[0]]['type'])
+                helplines = options[matched[0]]['type']
+                # Run helpfunction to get list of possible values
+                if 'helpfunction' in options[matched[0]]:
+                    result = options[matched[0]]['helpfunction']()
+                    if result:
+                        helplines = '\n' + ' '.join(result)
+                sys.stdout.write(helplines)
                 sys.exit(0)
 
-    for name,option in options.items():
+    for name, option in options.items():
         if 'dflt' in option and name not in args:
             args.append(name)
             args.append(option['dflt'])
@@ -234,8 +291,7 @@ if __name__ == '__main__':
     except ValueError:
         sys.exit(f'ping: Unknown host: {host}')
 
-    command = convert(ping[version],args)
+    command = convert(ping[version], args)
 
     # print(f'{command} {host}')
     os.system(f'{command} {host}')
-
diff --git a/src/services/api/graphql/libs/op_mode.py b/src/services/api/graphql/libs/op_mode.py
index da2bcdb5b..97a26520e 100644
--- a/src/services/api/graphql/libs/op_mode.py
+++ b/src/services/api/graphql/libs/op_mode.py
@@ -17,8 +17,11 @@ import os
 import re
 import typing
 import importlib.util
+from typing import Union
+from humps import decamelize
 
 from vyos.defaults import directories
+from vyos.opmode import _normalize_field_names
 
 def load_as_module(name: str, path: str):
     spec = importlib.util.spec_from_file_location(name, path)
@@ -98,3 +101,6 @@ def map_type_name(type_name: type, optional: bool = False) -> str:
 
     # scalar 'Generic' is defined in schema.graphql
     return 'Generic'
+
+def normalize_output(result: Union[dict, list]) -> Union[dict, list]:
+    return _normalize_field_names(decamelize(result))
diff --git a/src/services/api/graphql/session/session.py b/src/services/api/graphql/session/session.py
index c2c1db1df..0b77b1433 100644
--- a/src/services/api/graphql/session/session.py
+++ b/src/services/api/graphql/session/session.py
@@ -25,6 +25,7 @@ from vyos.template import render
 from vyos.opmode import Error as OpModeError
 
 from api.graphql.libs.op_mode import load_op_mode_as_module, split_compound_op_mode_name
+from api.graphql.libs.op_mode import normalize_output
 
 op_mode_include_file = os.path.join(directories['data'], 'op-mode-standardized.json')
 
@@ -149,6 +150,8 @@ class Session:
         except OpModeError as e:
             raise e
 
+        res = normalize_output(res)
+
         return res
 
     def gen_op_mutation(self):
diff --git a/src/system/keepalived-fifo.py b/src/system/keepalived-fifo.py
index a0fccd1d0..864ee8419 100755
--- a/src/system/keepalived-fifo.py
+++ b/src/system/keepalived-fifo.py
@@ -67,13 +67,13 @@ class KeepalivedFifo:
         # For VRRP configuration to be read, the commit must be finished
         count = 1
         while commit_in_progress():
-            if ( count <= 40 ):
-                logger.debug(f'commit in progress try: {count}')
+            if ( count <= 20 ):
+                logger.debug(f'Attempt to load keepalived configuration aborted due to a commit in progress (attempt {count}/20)')
             else:
-                logger.error(f'commit still in progress after {count} continuing anyway')
+                logger.error(f'Forced keepalived configuration loading despite a commit in progress ({count} wait time expired, not waiting further)')
                 break
             count += 1
-            time.sleep(0.5)
+            time.sleep(1)
 
         try:
             base = ['high-availability', 'vrrp']
diff --git a/src/validators/allowed-vlan b/src/validators/allowed-vlan
deleted file mode 100755
index 11389390b..000000000
--- a/src/validators/allowed-vlan
+++ /dev/null
@@ -1,19 +0,0 @@
-#! /usr/bin/python3
-
-import sys
-import re
-
-if __name__ == '__main__':
-    if len(sys.argv)>1:
-        allowed_vlan = sys.argv[1]
-        if re.search('[0-9]{1,4}-[0-9]{1,4}', allowed_vlan):
-            for tmp in allowed_vlan.split('-'):
-                if int(tmp) not in range(1, 4095):
-                    sys.exit(1)
-        else:
-            if int(allowed_vlan) not in range(1, 4095):
-                sys.exit(1)
-    else:
-        sys.exit(2)
-    
-    sys.exit(0)
diff --git a/src/validators/dotted-decimal b/src/validators/dotted-decimal
deleted file mode 100755
index 652110346..000000000
--- a/src/validators/dotted-decimal
+++ /dev/null
@@ -1,33 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2020 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import re
-import sys
-
-area = sys.argv[1]
-
-res = re.match(r'^(\d+)\.(\d+)\.(\d+)\.(\d+)$', area)
-if not res:
-    print("\'{0}\' is not a valid dotted decimal value".format(area))
-    sys.exit(1)
-else:
-    components = res.groups()
-    for n in range(0, 4):
-        if (int(components[n]) > 255):
-            print("Invalid component of a dotted decimal value: {0} exceeds 255".format(components[n]))
-            sys.exit(1)
-
-sys.exit(0)
diff --git a/src/validators/fqdn b/src/validators/fqdn
index a4027e4ca..a65d2d5d4 100755
--- a/src/validators/fqdn
+++ b/src/validators/fqdn
@@ -1,27 +1,2 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2020-2021 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import re
-import sys
-
-pattern = '[A-Za-z0-9][-.A-Za-z0-9]*'
-
-if __name__ == '__main__':
-    if len(sys.argv) != 2:
-        sys.exit(1)
-    if not re.match(pattern, sys.argv[1]):
-        sys.exit(1)
-    sys.exit(0)
+#!/usr/bin/env sh
+${vyos_libexec_dir}/validate-value --regex "[A-Za-z0-9][-.A-Za-z0-9]*" --value "$1"
diff --git a/src/validators/mac-address b/src/validators/mac-address
index 7d020f387..bb859a603 100755
--- a/src/validators/mac-address
+++ b/src/validators/mac-address
@@ -1,27 +1,2 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2018-2020 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import re
-import sys
-
-pattern = "^([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$"
-
-if __name__ == '__main__':
-    if len(sys.argv) != 2:
-        sys.exit(1)
-    if not re.match(pattern, sys.argv[1]):
-        sys.exit(1)
-    sys.exit(0)
+#!/usr/bin/env sh
+${vyos_libexec_dir}/validate-value --regex "([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})" --value "$1"
diff --git a/src/validators/mac-address-exclude b/src/validators/mac-address-exclude
new file mode 100755
index 000000000..c44913023
--- /dev/null
+++ b/src/validators/mac-address-exclude
@@ -0,0 +1,2 @@
+#!/usr/bin/env sh
+${vyos_libexec_dir}/validate-value --regex "!([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})" --value "$1"
diff --git a/src/validators/mac-address-firewall b/src/validators/mac-address-firewall
deleted file mode 100755
index 70551f86d..000000000
--- a/src/validators/mac-address-firewall
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2018-2022 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import re
-import sys
-
-pattern = "^!?([0-9A-Fa-f]{2}:){5}([0-9A-Fa-f]{2})$"
-
-if __name__ == '__main__':
-    if len(sys.argv) != 2:
-        sys.exit(1)
-    if not re.match(pattern, sys.argv[1]):
-        sys.exit(1)
-    sys.exit(0)
diff --git a/src/validators/tcp-flag b/src/validators/tcp-flag
deleted file mode 100755
index 1496b904a..000000000
--- a/src/validators/tcp-flag
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/python3
-
-import sys
-import re
-
-if __name__ == '__main__':
-    if len(sys.argv)>1:
-        flag = sys.argv[1]
-        if flag and flag[0] == '!':
-            flag = flag[1:]
-        if flag not in ['syn', 'ack', 'rst', 'fin', 'urg', 'psh', 'ecn', 'cwr']:
-            print(f'Error: {flag} is not a valid TCP flag')
-            sys.exit(1)
-    else:
-        sys.exit(2)
-
-    sys.exit(0)