T6732: added same as vyos 1x

20 files changed, 902 insertions, 0 deletions

diff --git a/src/migration-scripts/system/10-to-11 b/src/migration-scripts/system/10-to-11
new file mode 100644
index 0000000..76d7f23
--- /dev/null
+++ b/src/migration-scripts/system/10-to-11
@@ -0,0 +1,32 @@
+# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Operator accounts have been deprecated due to a security issue. Those accounts
+# will be converted to regular admin accounts.
+
+from vyos.configtree import ConfigTree
+
+base_level = ['system', 'login', 'user']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base_level):
+        # Nothing to do, which shouldn't happen anyway
+        # only if you wipe the config and reboot.
+        return
+
+    for user in config.list_nodes(base_level):
+        if config.exists(base_level + [user, 'level']):
+            if config.return_value(base_level + [user, 'level']) == 'operator':
+                config.set(base_level + [user, 'level'], value="admin", replace=True)
diff --git a/src/migration-scripts/system/11-to-12 b/src/migration-scripts/system/11-to-12
new file mode 100644
index 0000000..71c359b
--- /dev/null
+++ b/src/migration-scripts/system/11-to-12
@@ -0,0 +1,69 @@
+# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Unclutter RADIUS configuration
+#
+# Move radius-server top level tag nodes to a regular node which allows us
+# to specify additional general features for the RADIUS client.
+
+from vyos.configtree import ConfigTree
+
+cfg_base = ['system', 'login']
+
+def migrate(config: ConfigTree) -> None:
+    if not (config.exists(cfg_base + ['radius-server']) or config.exists(cfg_base + ['radius-source-address'])):
+        # Nothing to do
+        return
+
+    #
+    # Migrate "system login radius-source-address" to "system login radius"
+    #
+    if config.exists(cfg_base + ['radius-source-address']):
+        address = config.return_value(cfg_base + ['radius-source-address'])
+        # delete old configuration node
+        config.delete(cfg_base + ['radius-source-address'])
+        # write new configuration node
+        config.set(cfg_base + ['radius', 'source-address'], value=address)
+
+    #
+    # Migrate "system login radius-server" tag node to new
+    # "system login radius server" tag node and also rename the "secret" node to "key"
+    #
+    if config.exists(cfg_base + ['radius-server']):
+        for server in config.list_nodes(cfg_base + ['radius-server']):
+            base_server = cfg_base + ['radius-server', server]
+            # "key" node is mandatory
+            key = config.return_value(base_server + ['secret'])
+            config.set(cfg_base + ['radius', 'server', server, 'key'], value=key)
+
+            # "port" is optional
+            if config.exists(base_server + ['port']):
+                port = config.return_value(base_server + ['port'])
+                config.set(cfg_base + ['radius', 'server', server, 'port'], value=port)
+
+            # "timeout is optional"
+            if config.exists(base_server + ['timeout']):
+                timeout = config.return_value(base_server + ['timeout'])
+                config.set(cfg_base + ['radius', 'server', server, 'timeout'], value=timeout)
+
+            # format as tag node
+            config.set_tag(cfg_base + ['radius', 'server'])
+
+            # delete old configuration node
+            config.delete(base_server)
+
+        # delete top level tag node
+        if config.exists(cfg_base + ['radius-server']):
+            config.delete(cfg_base + ['radius-server'])
diff --git a/src/migration-scripts/system/12-to-13 b/src/migration-scripts/system/12-to-13
new file mode 100644
index 0000000..014edba
--- /dev/null
+++ b/src/migration-scripts/system/12-to-13
@@ -0,0 +1,44 @@
+# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# converts 'set system syslog host <address>:<port>'
+# to 'set system syslog host <address> port <port>'
+
+import re
+
+from vyos.configtree import ConfigTree
+
+cbase = ['system', 'syslog', 'host']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(cbase):
+        return
+
+    for host in config.list_nodes(cbase):
+        if re.search(':[0-9]{1,5}$',host):
+            h = re.search('^[a-zA-Z\-0-9\.]+', host).group(0)
+            p = re.sub(':', '', re.search(':[0-9]+$', host).group(0))
+            config.set(cbase + [h])
+            config.set(cbase + [h, 'port'], value=p)
+            for fac in config.list_nodes(cbase + [host, 'facility']):
+                config.set(cbase + [h, 'facility', fac])
+                config.set_tag(cbase + [h, 'facility'])
+                if config.exists(cbase + [host, 'facility', fac, 'protocol']):
+                    proto = config.return_value(cbase + [host, 'facility', fac, 'protocol'])
+                    config.set(cbase + [h, 'facility', fac, 'protocol'], value=proto)
+                if config.exists(cbase + [host, 'facility', fac, 'level']):
+                    lvl = config.return_value(cbase + [host, 'facility', fac, 'level'])
+                    config.set(cbase + [h, 'facility', fac, 'level'], value=lvl)
+            config.delete(cbase + [host])
diff --git a/src/migration-scripts/system/13-to-14 b/src/migration-scripts/system/13-to-14
new file mode 100644
index 0000000..fbbecbc
--- /dev/null
+++ b/src/migration-scripts/system/13-to-14
@@ -0,0 +1,67 @@
+# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Fixup non existent time-zones. Some systems have time-zone set to: Los*
+# (Los_Angeles), Den* (Denver), New* (New_York) ... but those are no real IANA
+# assigned time zones. In the past they have been silently remapped.
+#
+# Time to clean it up!
+#
+# Migrate all configured timezones to real IANA assigned timezones!
+
+import re
+
+from vyos.configtree import ConfigTree
+from vyos.utils.process import cmd
+
+
+tz_base = ['system', 'time-zone']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(tz_base):
+        # Nothing to do
+        return
+
+    tz = config.return_value(tz_base)
+
+    # retrieve all valid timezones
+    try:
+        tz_datas = cmd('timedatectl list-timezones')
+    except OSError:
+        tz_datas = ''
+    tz_data = tz_datas.split('\n')
+
+    if re.match(r'[Ll][Oo][Ss].+', tz):
+        tz = 'America/Los_Angeles'
+    elif re.match(r'[Dd][Ee][Nn].+', tz):
+        tz = 'America/Denver'
+    elif re.match(r'[Hh][Oo][Nn][Oo].+', tz):
+        tz = 'Pacific/Honolulu'
+    elif re.match(r'[Nn][Ee][Ww].+', tz):
+        tz = 'America/New_York'
+    elif re.match(r'[Cc][Hh][Ii][Cc]*.+', tz):
+        tz = 'America/Chicago'
+    elif re.match(r'[Aa][Nn][Cc].+', tz):
+        tz = 'America/Anchorage'
+    elif re.match(r'[Pp][Hh][Oo].+', tz):
+        tz = 'America/Phoenix'
+    elif re.match(r'GMT(.+)?', tz):
+        tz = 'Etc/' + tz
+    elif tz not in tz_data:
+        # assign default UTC timezone
+        tz = 'UTC'
+
+    # replace timezone data is required
+    config.set(tz_base, value=tz)
diff --git a/src/migration-scripts/system/14-to-15 b/src/migration-scripts/system/14-to-15
new file mode 100644
index 0000000..2818094
--- /dev/null
+++ b/src/migration-scripts/system/14-to-15
@@ -0,0 +1,37 @@
+# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Delete 'system ipv6 blacklist' option as the IPv6 module can no longer be
+# blacklisted as it is required by e.g. WireGuard and thus will always be
+# loaded.
+
+import os
+
+ipv6_blacklist_file = '/etc/modprobe.d/vyatta_blacklist_ipv6.conf'
+
+from vyos.configtree import ConfigTree
+
+ip_base = ['system', 'ipv6']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(ip_base):
+        # Nothing to do
+        return
+
+    # delete 'system ipv6 blacklist' node
+    if config.exists(ip_base + ['blacklist']):
+        config.delete(ip_base + ['blacklist'])
+        if os.path.isfile(ipv6_blacklist_file):
+            os.unlink(ipv6_blacklist_file)
diff --git a/src/migration-scripts/system/15-to-16 b/src/migration-scripts/system/15-to-16
new file mode 100644
index 0000000..7db0429
--- /dev/null
+++ b/src/migration-scripts/system/15-to-16
@@ -0,0 +1,32 @@
+# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Make 'system options reboot-on-panic' valueless
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'options']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    if config.exists(base + ['reboot-on-panic']):
+        reboot = config.return_value(base + ['reboot-on-panic'])
+        config.delete(base + ['reboot-on-panic'])
+        # create new valueless node if action was true
+        if reboot == "true":
+            config.set(base + ['reboot-on-panic'])
diff --git a/src/migration-scripts/system/16-to-17 b/src/migration-scripts/system/16-to-17
new file mode 100644
index 0000000..9fb86af
--- /dev/null
+++ b/src/migration-scripts/system/16-to-17
@@ -0,0 +1,36 @@
+# Copyright 2020-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# * remove "system login user <user> group" node, Why should be add a user to a
+#   3rd party group when the system is fully managed by CLI?
+# * remove "system login user <user> level" node
+#   This is the only privilege level left and also the default, what is the
+#   sense in keeping this orphaned node?
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'login', 'user']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    for user in config.list_nodes(base):
+        if config.exists(base + [user, 'group']):
+            config.delete(base + [user, 'group'])
+
+        if config.exists(base + [user, 'level']):
+            config.delete(base + [user, 'level'])
diff --git a/src/migration-scripts/system/17-to-18 b/src/migration-scripts/system/17-to-18
new file mode 100644
index 0000000..323ef4e
--- /dev/null
+++ b/src/migration-scripts/system/17-to-18
@@ -0,0 +1,59 @@
+# Copyright 2020-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# remove "system console netconsole"
+# remove "system console device <device> modem"
+
+import os
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'console']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    # remove "system console netconsole" (T2561)
+    if config.exists(base + ['netconsole']):
+        config.delete(base + ['netconsole'])
+
+    if config.exists(base + ['device']):
+        for device in config.list_nodes(base + ['device']):
+            dev_path = base + ['device', device]
+            # remove "system console device <device> modem" (T2570)
+            if config.exists(dev_path + ['modem']):
+                config.delete(dev_path + ['modem'])
+
+            # Only continue on USB based serial consoles
+            if not 'ttyUSB' in device:
+                continue
+
+            # A serial console has been configured but it does no longer
+            # exist on the system - cleanup
+            if not os.path.exists(f'/dev/{device}'):
+                config.delete(dev_path)
+                continue
+
+            # migrate from ttyUSB device to new device in /dev/serial/by-bus
+            for root, dirs, files in os.walk('/dev/serial/by-bus'):
+                for usb_device in files:
+                    device_file = os.path.realpath(os.path.join(root, usb_device))
+                    # migrate to new USB device names (T2529)
+                    if os.path.basename(device_file) == device:
+                        config.copy(dev_path, base + ['device', usb_device])
+                        # Delete old USB node from config
+                        config.delete(dev_path)
diff --git a/src/migration-scripts/system/18-to-19 b/src/migration-scripts/system/18-to-19
new file mode 100644
index 0000000..5d9788d
--- /dev/null
+++ b/src/migration-scripts/system/18-to-19
@@ -0,0 +1,81 @@
+# Copyright 2020-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# migrate disable-dhcp-nameservers (boolean) to name-servers-dhcp <interface>
+# if disable-dhcp-nameservers is set, just remove it
+# else retrieve all interface names that have configured dhcp(v6) address and
+# add them to the new name-servers-dhcp node
+
+from vyos.ifconfig import Interface
+from vyos.configtree import ConfigTree
+
+base = ['system']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    if config.exists(base + ['disable-dhcp-nameservers']):
+        config.delete(base + ['disable-dhcp-nameservers'])
+    else:
+        dhcp_interfaces = []
+
+        # go through all interfaces searching for 'address dhcp(v6)?'
+        for sect in Interface.sections():
+            sect_base = ['interfaces', sect]
+
+            if not config.exists(sect_base):
+                continue
+
+            for intf in config.list_nodes(sect_base):
+                intf_base = sect_base + [intf]
+
+                # try without vlans
+                if config.exists(intf_base + ['address']):
+                    for addr in config.return_values(intf_base + ['address']):
+                        if addr in ['dhcp', 'dhcpv6']:
+                            dhcp_interfaces.append(intf)
+
+                # try vif
+                if config.exists(intf_base + ['vif']):
+                    for vif in config.list_nodes(intf_base + ['vif']):
+                        vif_base = intf_base + ['vif', vif]
+                        if config.exists(vif_base + ['address']):
+                            for addr in config.return_values(vif_base + ['address']):
+                                if addr in ['dhcp', 'dhcpv6']:
+                                    dhcp_interfaces.append(f'{intf}.{vif}')
+
+                # try vif-s
+                if config.exists(intf_base + ['vif-s']):
+                    for vif_s in config.list_nodes(intf_base + ['vif-s']):
+                        vif_s_base = intf_base + ['vif-s', vif_s]
+                        if config.exists(vif_s_base + ['address']):
+                            for addr in config.return_values(vif_s_base + ['address']):
+                                if addr in ['dhcp', 'dhcpv6']:
+                                    dhcp_interfaces.append(f'{intf}.{vif_s}')
+
+                    # try vif-c
+                    if config.exists(intf_base + ['vif-c']):
+                        for vif_c in config.list_nodes(vif_s_base + ['vif-c']):
+                            vif_c_base = vif_s_base + ['vif-c', vif_c]
+                            if config.exists(vif_c_base + ['address']):
+                                for addr in config.return_values(vif_c_base + ['address']):
+                                    if addr in ['dhcp', 'dhcpv6']:
+                                        dhcp_interfaces.append(f'{intf}.{vif_s}.{vif_c}')
+
+        # set new config nodes
+        for intf in dhcp_interfaces:
+            config.set(base + ['name-servers-dhcp'], value=intf, replace=False)
diff --git a/src/migration-scripts/system/19-to-20 b/src/migration-scripts/system/19-to-20
new file mode 100644
index 0000000..cb84e11
--- /dev/null
+++ b/src/migration-scripts/system/19-to-20
@@ -0,0 +1,44 @@
+# Copyright 2020-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# T3048: remove smp-affinity node from ethernet and use tuned instead
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'options']
+base_new = ['system', 'option']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    if config.exists(base_new):
+        for node in config.list_nodes(base):
+            config.copy(base + [node], base_new + [node])
+    else:
+        config.copy(base, base_new)
+
+    config.delete(base)
+
+    # Rename "system option beep-if-fully-booted" -> "system option startup-beep"
+    base_beep = base_new + ['beep-if-fully-booted']
+    if config.exists(base_beep):
+        config.rename(base_beep, 'startup-beep')
+
+    # Rename "system option ctrl-alt-del-action" -> "system option ctrl-alt-delete"
+    base_ctrl_alt_del = base_new + ['ctrl-alt-del-action']
+    if config.exists(base_ctrl_alt_del):
+        config.rename(base_ctrl_alt_del, 'ctrl-alt-delete')
diff --git a/src/migration-scripts/system/20-to-21 b/src/migration-scripts/system/20-to-21
new file mode 100644
index 0000000..71c283d
--- /dev/null
+++ b/src/migration-scripts/system/20-to-21
@@ -0,0 +1,30 @@
+# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# T3795: merge "system name-servers-dhcp" into "system name-server"
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'name-servers-dhcp']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    for interface in config.return_values(base):
+        config.set(['system', 'name-server'], value=interface, replace=False)
+
+    config.delete(base)
diff --git a/src/migration-scripts/system/21-to-22 b/src/migration-scripts/system/21-to-22
new file mode 100644
index 0000000..0e68a68
--- /dev/null
+++ b/src/migration-scripts/system/21-to-22
@@ -0,0 +1,38 @@
+# Copyright 2021-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'sysctl']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    for all_custom in ['all', 'custom']:
+        if config.exists(base + [all_custom]):
+            for key in config.list_nodes(base + [all_custom]):
+                tmp = config.return_value(base + [all_custom, key, 'value'])
+                config.set(base + ['parameter', key, 'value'], value=tmp)
+                config.set_tag(base + ['parameter'])
+            config.delete(base + [all_custom])
+
+    for ipv4_param in ['net.ipv4.igmp_max_memberships', 'net.ipv4.ipfrag_time']:
+        if config.exists(base + [ipv4_param]):
+            tmp = config.return_value(base + [ipv4_param])
+            config.set(base + ['parameter', ipv4_param, 'value'], value=tmp)
+            config.set_tag(base + ['parameter'])
+            config.delete(base + [ipv4_param])
diff --git a/src/migration-scripts/system/22-to-23 b/src/migration-scripts/system/22-to-23
new file mode 100644
index 0000000..e49094e
--- /dev/null
+++ b/src/migration-scripts/system/22-to-23
@@ -0,0 +1,31 @@
+# Copyright 2022-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'ipv6']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    # T4346: drop support to disbale IPv6 address family within the OS Kernel
+    if config.exists(base + ['disable']):
+        config.delete(base + ['disable'])
+        # IPv6 address family disable was the only CLI option set - we can cleanup
+        # the entire tree
+        if len(config.list_nodes(base)) == 0:
+            config.delete(base)
diff --git a/src/migration-scripts/system/23-to-24 b/src/migration-scripts/system/23-to-24
new file mode 100644
index 0000000..feb62bc
--- /dev/null
+++ b/src/migration-scripts/system/23-to-24
@@ -0,0 +1,71 @@
+# Copyright 2022-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+from ipaddress import ip_interface
+from ipaddress import ip_address
+
+from vyos.configtree import ConfigTree
+from vyos.template import is_ipv4
+
+base = ['protocols', 'static', 'arp']
+tmp_base = ['protocols', 'static', 'arp-tmp']
+
+def fixup_cli(config, path, interface, host):
+    if config.exists(path + ['address']):
+        for address in config.return_values(path + ['address']):
+            tmp = ip_interface(address)
+            # ARP is only available for IPv4 ;-)
+            if not is_ipv4(tmp):
+                continue
+            if ip_address(host) in tmp.network.hosts():
+                mac = config.return_value(tmp_base + [host, 'hwaddr'])
+                iface_path = ['protocols', 'static', 'arp', 'interface']
+                config.set(iface_path + [interface, 'address', host, 'mac'], value=mac)
+                config.set_tag(iface_path)
+                config.set_tag(iface_path + [interface, 'address'])
+                continue
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        # Nothing to do
+        return
+
+    # We need a temporary copy of the config tree as the original one needs to be
+    # deleted first due to a change iun thge tagNode structure.
+    config.copy(base, tmp_base)
+    config.delete(base)
+
+    for host in config.list_nodes(tmp_base):
+        for type in config.list_nodes(['interfaces']):
+            for interface in config.list_nodes(['interfaces', type]):
+                if_base = ['interfaces', type, interface]
+                fixup_cli(config, if_base, interface, host)
+
+                if config.exists(if_base + ['vif']):
+                    for vif in config.list_nodes(if_base + ['vif']):
+                        vif_base = ['interfaces', type, interface, 'vif', vif]
+                        fixup_cli(config, vif_base, f'{interface}.{vif}', host)
+
+                if config.exists(if_base + ['vif-s']):
+                    for vif_s in config.list_nodes(if_base + ['vif-s']):
+                        vif_s_base = ['interfaces', type, interface, 'vif-s', vif_s]
+                        fixup_cli(config, vif_s_base, f'{interface}.{vif_s}', host)
+
+                        if config.exists(if_base + ['vif-s', vif_s, 'vif-c']):
+                            for vif_c in config.list_nodes(if_base + ['vif-s', vif_s, 'vif-c']):
+                                vif_c_base = ['interfaces', type, interface, 'vif-s', vif_s, 'vif-c', vif_c]
+                                fixup_cli(config, vif_c_base, f'{interface}.{vif_s}.{vif_c}', host)
+
+    config.delete(tmp_base)
diff --git a/src/migration-scripts/system/24-to-25 b/src/migration-scripts/system/24-to-25
new file mode 100644
index 0000000..bdb8990
--- /dev/null
+++ b/src/migration-scripts/system/24-to-25
@@ -0,0 +1,35 @@
+# Copyright 2022-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Migrate system syslog global archive to system logs logrotate messages
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'syslog', 'global', 'archive']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        return
+
+    if config.exists(base + ['file']):
+        tmp = config.return_value(base + ['file'])
+        config.set(['system', 'logs', 'logrotate', 'messages', 'rotate'], value=tmp)
+
+    if config.exists(base + ['size']):
+        tmp = config.return_value(base + ['size'])
+        tmp = max(round(int(tmp) / 1024), 1) # kb -> mb
+        config.set(['system', 'logs', 'logrotate', 'messages', 'max-size'], value=tmp)
+
+    config.delete(base)
diff --git a/src/migration-scripts/system/25-to-26 b/src/migration-scripts/system/25-to-26
new file mode 100644
index 0000000..8832f48
--- /dev/null
+++ b/src/migration-scripts/system/25-to-26
@@ -0,0 +1,65 @@
+# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# syslog: migrate deprecated CLI options
+#         - protocols -> local7
+#         - security -> auth
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'syslog']
+
+def rename_facilities(config, base_tree, facility, facility_new) -> None:
+    if config.exists(base + [base_tree, 'facility', facility]):
+        # do not overwrite already existing replacement facility
+        if not config.exists(base + [base_tree, 'facility', facility_new]):
+            config.rename(base + [base_tree, 'facility', facility], facility_new)
+        else:
+            # delete old duplicate facility config
+            config.delete(base + [base_tree, 'facility', facility])
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        return
+
+    #
+    # Rename protocols and securityy facility to common ones
+    #
+    replace = {
+        'protocols' : 'local7',
+        'security' : 'auth'
+    }
+    for facility, facility_new in replace.items():
+        rename_facilities(config, 'console', facility, facility_new)
+        rename_facilities(config, 'global', facility, facility_new)
+
+        if config.exists(base + ['host']):
+            for host in config.list_nodes(base + ['host']):
+                rename_facilities(config, f'host {host}', facility, facility_new)
+
+    #
+    # It makes no sense to configure udp/tcp transport per individual facility
+    #
+    if config.exists(base + ['host']):
+        for host in config.list_nodes(base + ['host']):
+            protocol = None
+            for facility in config.list_nodes(base + ['host', host, 'facility']):
+                tmp_path = base + ['host', host, 'facility', facility, 'protocol']
+                if config.exists(tmp_path):
+                    # We can only change the first one
+                    if protocol == None:
+                        protocol = config.return_value(tmp_path)
+                        config.set(base + ['host', host, 'protocol'], value=protocol)
+                    config.delete(tmp_path)
diff --git a/src/migration-scripts/system/26-to-27 b/src/migration-scripts/system/26-to-27
new file mode 100644
index 0000000..499e16e
--- /dev/null
+++ b/src/migration-scripts/system/26-to-27
@@ -0,0 +1,30 @@
+# Copyright 2023-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# T5877: migrate 'system domain-search domain' to 'system domain-search'
+
+from vyos.configtree import ConfigTree
+
+base = ['system', 'domain-search']
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(base):
+        return
+
+    if config.exists(base + ['domain']):
+        entries = config.return_values(base + ['domain'])
+        config.delete(base + ['domain'])
+        for entry in entries:
+            config.set(base, value=entry, replace=False)
diff --git a/src/migration-scripts/system/6-to-7 b/src/migration-scripts/system/6-to-7
new file mode 100644
index 0000000..e91ccc4
--- /dev/null
+++ b/src/migration-scripts/system/6-to-7
@@ -0,0 +1,36 @@
+# Copyright 2019-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Change smp_affinity to smp-affinity
+
+from vyos.configtree import ConfigTree
+
+def migrate(config: ConfigTree) -> None:
+    intf_types = config.list_nodes(["interfaces"])
+
+    for intf_type in intf_types:
+        intf_type_path = ["interfaces", intf_type]
+        intfs = config.list_nodes(intf_type_path)
+
+        for intf in intfs:
+            intf_path = intf_type_path + [intf]
+            if not config.exists(intf_path + ["smp_affinity"]):
+                # Nothing to do.
+                continue
+            else:
+                # Rename the node.
+                old_smp_affinity_path = intf_path + ["smp_affinity"]
+                config.rename(old_smp_affinity_path, "smp-affinity")
+                update_required = True
diff --git a/src/migration-scripts/system/7-to-8 b/src/migration-scripts/system/7-to-8
new file mode 100644
index 0000000..64dd4dc
--- /dev/null
+++ b/src/migration-scripts/system/7-to-8
@@ -0,0 +1,39 @@
+# Copyright 2018-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Converts "system gateway-address" option to "protocols static route 0.0.0.0/0 next-hop $gw"
+
+from vyos.configtree import ConfigTree
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(['system', 'gateway-address']):
+        # Nothing to do
+        return
+
+    # Save the address
+    gw = config.return_value(['system', 'gateway-address'])
+
+    # Create the node for the new syntax
+    # Note: next-hop is a tag node, gateway address is its child, not a value
+    config.set(['protocols', 'static', 'route', '0.0.0.0/0', 'next-hop', gw])
+
+    # Delete the node with the old syntax
+    config.delete(['system', 'gateway-address'])
+
+    # Now, the interesting part. Both route and next-hop are supposed to be tag nodes,
+    # which you can verify with "cli-shell-api isTag $configPath".
+    # They must be formatted as such to load correctly.
+    config.set_tag(['protocols', 'static', 'route'])
+    config.set_tag(['protocols', 'static', 'route', '0.0.0.0/0', 'next-hop'])
diff --git a/src/migration-scripts/system/8-to-9 b/src/migration-scripts/system/8-to-9
new file mode 100644
index 0000000..ea5f7af
--- /dev/null
+++ b/src/migration-scripts/system/8-to-9
@@ -0,0 +1,26 @@
+# Copyright 2018-2024 VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public License
+# along with this library.  If not, see <http://www.gnu.org/licenses/>.
+
+# Deletes "system package" option as it is deprecated
+
+from vyos.configtree import ConfigTree
+
+def migrate(config: ConfigTree) -> None:
+    if not config.exists(['system', 'package']):
+        # Nothing to do
+        return
+
+    # Delete the node with the old syntax
+    config.delete(['system', 'package'])