12 files changed, 84 insertions, 148 deletions
diff --git a/src/conf_mode/service_ids_ddos-protection.py b/src/conf_mode/service_ids_ddos-protection.py
deleted file mode 100755
index 276a71fcb..000000000
--- a/src/conf_mode/service_ids_ddos-protection.py
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/env python3
-#
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
-#
-# This program is free software; you can redistribute it and/or modify
-# it under the terms of the GNU General Public License version 2 or later as
-# published by the Free Software Foundation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-import os
-
-from sys import exit
-
-from vyos.config import Config
-from vyos.template import render
-from vyos.utils.process import call
-from vyos import ConfigError
-from vyos import airbag
-airbag.enable()
-
-config_file = r'/run/fastnetmon/fastnetmon.conf'
-networks_list = r'/run/fastnetmon/networks_list'
-excluded_networks_list = r'/run/fastnetmon/excluded_networks_list'
-attack_dir = '/var/log/fastnetmon_attacks'
-
-def get_config(config=None):
-    if config:
-        conf = config
-    else:
-        conf = Config()
-    base = ['service', 'ids', 'ddos-protection']
-    if not conf.exists(base):
-        return None
-
-    fastnetmon = conf.get_config_dict(base, key_mangling=('-', '_'),
-                                      get_first_key=True,
-                                      with_recursive_defaults=True)
-
-    return fastnetmon
-
-def verify(fastnetmon):
-    if not fastnetmon:
-        return None
-
-    if 'mode' not in fastnetmon:
-        raise ConfigError('Specify operating mode!')
-
-    if fastnetmon.get('mode') == 'mirror' and 'listen_interface' not in fastnetmon:
-        raise ConfigError("Incorrect settings for 'mode mirror': must specify interface(s) for traffic mirroring")
-
-    if fastnetmon.get('mode') == 'sflow' and 'listen_address' not in fastnetmon.get('sflow', {}):
-        raise ConfigError("Incorrect settings for 'mode sflow': must specify sFlow 'listen-address'")
-
-    if 'alert_script' in fastnetmon:
-        if os.path.isfile(fastnetmon['alert_script']):
-            # Check script permissions
-            if not os.access(fastnetmon['alert_script'], os.X_OK):
-                raise ConfigError('Script "{alert_script}" is not executable!'.format(fastnetmon['alert_script']))
-        else:
-           raise ConfigError('File "{alert_script}" does not exists!'.format(fastnetmon))
-
-def generate(fastnetmon):
-    if not fastnetmon:
-        for file in [config_file, networks_list]:
-            if os.path.isfile(file):
-                os.unlink(file)
-
-        return None
-
-    # Create dir for log attack details
-    if not os.path.exists(attack_dir):
-        os.mkdir(attack_dir)
-
-    render(config_file, 'ids/fastnetmon.j2', fastnetmon)
-    render(networks_list, 'ids/fastnetmon_networks_list.j2', fastnetmon)
-    render(excluded_networks_list, 'ids/fastnetmon_excluded_networks_list.j2', fastnetmon)
-    return None
-
-def apply(fastnetmon):
-    systemd_service = 'fastnetmon.service'
-    if not fastnetmon:
-        # Stop fastnetmon service if removed
-        call(f'systemctl stop {systemd_service}')
-    else:
-        call(f'systemctl reload-or-restart {systemd_service}')
-
-    return None
-
-if __name__ == '__main__':
-    try:
-        c = get_config()
-        verify(c)
-        generate(c)
-        apply(c)
-    except ConfigError as e:
-        print(e)
-        exit(1)
diff --git a/src/conf_mode/system_login.py b/src/conf_mode/system_login.py
index 3fed6d273..4febb6494 100755
--- a/src/conf_mode/system_login.py
+++ b/src/conf_mode/system_login.py
@@ -15,7 +15,6 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
-import warnings
 
 from passlib.hosts import linux_context
 from psutil import users
@@ -30,12 +29,9 @@ from vyos.config import Config
 from vyos.configverify import verify_vrf
 from vyos.template import render
 from vyos.template import is_ipv4
-from vyos.utils.auth import (
-    DEFAULT_PASSWORD,
-    EPasswdStrength,
-    evaluate_strength,
-    get_current_user
-)
+from vyos.utils.auth import EPasswdStrength
+from vyos.utils.auth import evaluate_strength
+from vyos.utils.auth import get_current_user
 from vyos.utils.configfs import delete_cli_node
 from vyos.utils.configfs import add_cli_node
 from vyos.utils.dict import dict_search
diff --git a/src/etc/netplug/vyos-netplug-dhcp-client b/src/etc/netplug/vyos-netplug-dhcp-client
index 7fe6cda75..a230fe900 100755
--- a/src/etc/netplug/vyos-netplug-dhcp-client
+++ b/src/etc/netplug/vyos-netplug-dhcp-client
@@ -20,10 +20,10 @@ import sys
 from time import sleep
 
 from vyos.config import Config
-from vyos.configdict import get_interface_dict
-from vyos.ifconfig import Interface
 from vyos.ifconfig import Section
 from vyos.utils.boot import boot_configuration_complete
+from vyos.utils.process import cmd
+from vyos.utils.process import is_systemd_service_active
 from vyos.utils.commit import commit_in_progress
 from vyos import airbag
 
@@ -38,21 +38,34 @@ if not boot_configuration_complete():
     sys.exit(1)
 
 interface = sys.argv[1]
-# helper scripts should only work on physical interfaces not on individual
-# sub-interfaces. Moving e.g. a VLAN interface in/out a VRF will also trigger
-# this script which should be prohibited - bail out early
-if '.' in interface:
-    sys.exit(0)
 
 while commit_in_progress():
-    sleep(1)
+    sleep(0.250)
 
 in_out = sys.argv[2]
 config = Config()
 
 interface_path = ['interfaces'] + Section.get_config_path(interface).split()
-_, interface_config = get_interface_dict(
-    config, interface_path[:-1], ifname=interface, with_pki=True
-)
-if 'deleted' not in interface_config:
-    Interface(interface).update(interface_config)
+
+systemdV4_service = f'dhclient@{interface}.service'
+systemdV6_service = f'dhcp6c@{interface}.service'
+if in_out == 'out':
+    # Interface moved state to down
+    if is_systemd_service_active(systemdV4_service):
+        cmd(f'systemctl stop {systemdV4_service}')
+    if is_systemd_service_active(systemdV6_service):
+        cmd(f'systemctl stop {systemdV6_service}')
+elif in_out == 'in':
+    if config.exists_effective(interface_path + ['address']):
+        tmp = config.return_effective_values(interface_path + ['address'])
+        # Always (re-)start the DHCP(v6) client service. If the DHCP(v6) client
+        # is already running - which could happen if the interface is re-
+        # configured in operational down state, it will have a backoff
+        # time increasing while not receiving a DHCP(v6) reply.
+        #
+        # To make the interface instantly available, and as for a DHCP(v6) lease
+        # we will re-start the service and thus cancel the backoff time.
+        if 'dhcp' in tmp:
+            cmd(f'systemctl restart {systemdV4_service}')
+        if 'dhcpv6' in tmp:
+            cmd(f'systemctl restart {systemdV6_service}')
diff --git a/src/etc/systemd/system/fastnetmon.service.d/override.conf b/src/etc/systemd/system/fastnetmon.service.d/override.conf
deleted file mode 100644
index 841666070..000000000
--- a/src/etc/systemd/system/fastnetmon.service.d/override.conf
+++ /dev/null
@@ -1,12 +0,0 @@
-[Unit]
-RequiresMountsFor=/run
-ConditionPathExists=/run/fastnetmon/fastnetmon.conf
-After=
-After=vyos-router.service
-
-[Service]
-Type=simple
-WorkingDirectory=/run/fastnetmon
-PIDFile=/run/fastnetmon.pid
-ExecStart=
-ExecStart=/usr/sbin/fastnetmon --configuration_file /run/fastnetmon/fastnetmon.conf
diff --git a/src/init/vyos-router b/src/init/vyos-router
index ab3cc42cb..081adf214 100755
--- a/src/init/vyos-router
+++ b/src/init/vyos-router
@@ -417,6 +417,7 @@ gen_duid ()
 
 start ()
 {
+    echo -e "Initializing VyOS router\033[0m"
     # reset and clean config files
     security_reset || log_failure_msg "security reset failed"
 
@@ -517,7 +518,6 @@ start ()
 
     cleanup_post_commit_hooks
 
-    log_daemon_msg "Starting VyOS router"
     disabled migrate || migrate_bootfile
 
     restore_if_missing_preconfig_script
@@ -557,6 +557,9 @@ start ()
     if [[ ! -z "$tmp" ]]; then
         vtysh -c "rpki start"
     fi
+
+    # Start netplug daemon
+    systemctl start netplug.service
 }
 
 stop()
@@ -574,8 +577,8 @@ stop()
     umount ${vyatta_configdir}
     log_action_end_msg $?
 
+    systemctl stop netplug.service
     systemctl stop vyconfd.service
-
     systemctl stop frr.service
 
     unmount_encrypted_config
diff --git a/src/migration-scripts/ids/1-to-2 b/src/migration-scripts/ids/1-to-2
new file mode 100644
index 000000000..4c0333c88
--- /dev/null
+++ b/src/migration-scripts/ids/1-to-2
@@ -0,0 +1,30 @@
+# Copyright 2025 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# T: Migrate threshold and add new threshold types
+
+from vyos.configtree import ConfigTree
+
+# The old 'service ids' path was only used for FastNetMon
+# Suricata is in 'service suricata',
+# so this isn't an overreach
+base = ['service', 'ids']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+    else:
+        config.delete(base)
diff --git a/src/op_mode/image_installer.py b/src/op_mode/image_installer.py
index 9c17d0229..179913f15 100755
--- a/src/op_mode/image_installer.py
+++ b/src/op_mode/image_installer.py
@@ -74,6 +74,7 @@ MSG_INPUT_CONFIG_FOUND: str = 'An active configuration was found. Would you like
 MSG_INPUT_CONFIG_CHOICE: str = 'The following config files are available for boot:'
 MSG_INPUT_CONFIG_CHOOSE: str = 'Which file would you like as boot config?'
 MSG_INPUT_IMAGE_NAME: str = 'What would you like to name this image?'
+MSG_INPUT_IMAGE_NAME_TAKEN: str = 'There is already an installed image by that name; please choose again'
 MSG_INPUT_IMAGE_DEFAULT: str = 'Would you like to set the new image as the default one for boot?'
 MSG_INPUT_PASSWORD: str = 'Please enter a password for the "vyos" user:'
 MSG_INPUT_PASSWORD_CONFIRM: str = 'Please confirm password for the "vyos" user:'
@@ -984,8 +985,12 @@ def add_image(image_path: str, vrf: str = None, username: str = '',
                 f'Adding image would downgrade image tools to v.{cfg_ver}; disallowed')
 
         if not no_prompt:
+            versions = grub.version_list()
             while True:
                 image_name: str = ask_input(MSG_INPUT_IMAGE_NAME, version_name)
+                if image_name in versions:
+                    print(MSG_INPUT_IMAGE_NAME_TAKEN)
+                    continue
                 if image.validate_name(image_name):
                     break
                 print(MSG_WARN_IMAGE_NAME_WRONG)
diff --git a/src/services/vyos-conntrack-logger b/src/services/vyos-conntrack-logger
index 9c31b465f..ec0e1f717 100755
--- a/src/services/vyos-conntrack-logger
+++ b/src/services/vyos-conntrack-logger
@@ -15,10 +15,8 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import argparse
-import grp
 import logging
 import multiprocessing
-import os
 import queue
 import signal
 import socket
diff --git a/src/services/vyos-domain-resolver b/src/services/vyos-domain-resolver
index aba5ba9db..4419fc4a7 100755
--- a/src/services/vyos-domain-resolver
+++ b/src/services/vyos-domain-resolver
@@ -92,12 +92,14 @@ def resolve(domains, ipv6=False):
     for domain in domains:
         resolved = fqdn_resolve(domain, ipv6=ipv6)
 
+        cache_key = f'{domain}_ipv6' if ipv6 else domain
+
         if resolved and cache:
-            domain_state[domain] = resolved
+            domain_state[cache_key] = resolved
         elif not resolved:
-            if domain not in domain_state:
+            if cache_key not in domain_state:
                 continue
-            resolved = domain_state[domain]
+            resolved = domain_state[cache_key]
 
         ip_list = ip_list | resolved
     return ip_list
diff --git a/src/services/vyos-hostsd b/src/services/vyos-hostsd
index 1ba90471e..44f03586c 100755
--- a/src/services/vyos-hostsd
+++ b/src/services/vyos-hostsd
@@ -233,10 +233,7 @@
 # }
 
 import os
-import sys
-import time
 import json
-import signal
 import traceback
 import re
 import logging
@@ -245,7 +242,6 @@ import zmq
 from voluptuous import Schema, MultipleInvalid, Required, Any
 from collections import OrderedDict
 from vyos.utils.file import makedir
-from vyos.utils.permission import chown
 from vyos.utils.permission import chmod_755
 from vyos.utils.process import popen
 from vyos.utils.process import process_named_running
diff --git a/src/systemd/netplug.service b/src/systemd/netplug.service
new file mode 100644
index 000000000..928c553e8
--- /dev/null
+++ b/src/systemd/netplug.service
@@ -0,0 +1,9 @@
+[Unit]
+Description=Network cable hotplug management daemon
+Documentation=man:netplugd(8)
+After=vyos-router.service
+
+[Service]
+Type=forking
+PIDFile=/run/netplugd.pid
+ExecStart=/sbin/netplugd -c /etc/netplug/netplugd.conf -p /run/netplugd.pid
diff --git a/src/systemd/vyos.target b/src/systemd/vyos.target
index 47c91c1cc..c5d04891d 100644
--- a/src/systemd/vyos.target
+++ b/src/systemd/vyos.target
@@ -1,3 +1,3 @@
 [Unit]
 Description=VyOS target
-After=multi-user.target
+After=multi-user.target vyos-grub-update.service