xml: T3488: when using regex one must use ^ and $ when checking string literals

(cherry picked from commit 85d0ae7b434a3ae9f3bd50ad7fee1fcd23b26a26)

25 files changed, 47 insertions, 47 deletions

diff --git a/interface-definitions/dhcp-server.xml.in b/interface-definitions/dhcp-server.xml.in
index 28b61e92d..015500043 100644
--- a/interface-definitions/dhcp-server.xml.in
+++ b/interface-definitions/dhcp-server.xml.in
@@ -198,7 +198,7 @@
                             <list>primary secondary</list>
                           </completionHelp>
                           <constraint>
-                            <regex>(primary|secondary)</regex>
+                            <regex>^(primary|secondary)$</regex>
                           </constraint>
                           <constraintErrorMessage>Invalid DHCP failover peer status</constraintErrorMessage>
                         </properties>
diff --git a/interface-definitions/flow-accounting-conf.xml.in b/interface-definitions/flow-accounting-conf.xml.in
index 830078abe..b3980d9e2 100644
--- a/interface-definitions/flow-accounting-conf.xml.in
+++ b/interface-definitions/flow-accounting-conf.xml.in
@@ -39,9 +39,6 @@
               <completionHelp>
                 <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list>
               </completionHelp>
-              <constraint>
-                <regex>auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all</regex>
-              </constraint>
               <valueHelp>
                 <format>auth</format>
                 <description>Authentication and authorization</description>
@@ -134,6 +131,9 @@
                 <format>all</format>
                 <description>Authentication and authorization</description>
               </valueHelp>
+              <constraint>
+                <regex>^(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)$</regex>
+              </constraint>
             </properties>
           </leafNode>
           <leafNode name="interface">
@@ -381,7 +381,7 @@
                   </valueHelp>
                   <constraint>
                     <validator name="ipv4-address"/>
-                    <regex>auto$</regex>
+                    <regex>^auto$</regex>
                   </constraint>
                 </properties>
               </leafNode>
diff --git a/interface-definitions/include/accel-ppp/auth-mode.xml.i b/interface-definitions/include/accel-ppp/auth-mode.xml.i
index c1a87cfe3..a7711b675 100644
--- a/interface-definitions/include/accel-ppp/auth-mode.xml.i
+++ b/interface-definitions/include/accel-ppp/auth-mode.xml.i
@@ -11,7 +11,7 @@
       <description>Use RADIUS server for user autentication</description>
     </valueHelp>
     <constraint>
-      <regex>(local|radius)</regex>
+      <regex>^(local|radius)$</regex>
     </constraint>
     <completionHelp>
       <list>local radius</list>
diff --git a/interface-definitions/include/accel-ppp/auth-protocols.xml.i b/interface-definitions/include/accel-ppp/auth-protocols.xml.i
index d43266152..480747f53 100644
--- a/interface-definitions/include/accel-ppp/auth-protocols.xml.i
+++ b/interface-definitions/include/accel-ppp/auth-protocols.xml.i
@@ -22,7 +22,7 @@
       <description>Authentication via MS-CHAPv2 (Microsoft Challenge Handshake Authentication Protocol, version 2)</description>
     </valueHelp>
     <constraint>
-      <regex>(pap|chap|mschap|mschap-v2)</regex>
+      <regex>^(pap|chap|mschap|mschap-v2)$</regex>
     </constraint>
     <multi/>
   </properties>
diff --git a/interface-definitions/include/interface/vif-s.xml.i b/interface-definitions/include/interface/vif-s.xml.i
index 9d1ddf579..dc0d91909 100644
--- a/interface-definitions/include/interface/vif-s.xml.i
+++ b/interface-definitions/include/interface/vif-s.xml.i
@@ -29,7 +29,7 @@
           <description>VLAN-tagged frame (IEEE 802.1q), ethertype 0x8100</description>
         </valueHelp>
         <constraint>
-          <regex>(802.1q|802.1ad)</regex>
+          <regex>^(802.1q|802.1ad)$</regex>
         </constraint>
         <constraintErrorMessage>Ethertype must be 802.1ad or 802.1q</constraintErrorMessage>
       </properties>
diff --git a/interface-definitions/interfaces-bonding.xml.in b/interface-definitions/interfaces-bonding.xml.in
index 30e8deb9c..37dfe1c12 100644
--- a/interface-definitions/interfaces-bonding.xml.in
+++ b/interface-definitions/interfaces-bonding.xml.in
@@ -75,7 +75,7 @@
                 <description>combine IP address and port to make hash</description>
               </valueHelp>
               <constraint>
-                <regex>(layer2\+3|layer3\+4|layer2)</regex>
+                <regex>^(layer2\+3|layer3\+4|layer2)$</regex>
               </constraint>
               <constraintErrorMessage>hash-policy must be layer2 layer2+3 or layer3+4</constraintErrorMessage>
             </properties>
@@ -132,7 +132,7 @@
                 <description>Distribute based on MAC address</description>
               </valueHelp>
               <constraint>
-                <regex>(802.3ad|active-backup|broadcast|round-robin|transmit-load-balance|adaptive-load-balance|xor-hash)</regex>
+                <regex>^(802.3ad|active-backup|broadcast|round-robin|transmit-load-balance|adaptive-load-balance|xor-hash)$</regex>
               </constraint>
               <constraintErrorMessage>mode must be 802.3ad, active-backup, broadcast, round-robin, transmit-load-balance, adaptive-load-balance, or xor</constraintErrorMessage>
             </properties>
diff --git a/interface-definitions/interfaces-ethernet.xml.in b/interface-definitions/interfaces-ethernet.xml.in
index bda44d64c..54be3a43b 100644
--- a/interface-definitions/interfaces-ethernet.xml.in
+++ b/interface-definitions/interfaces-ethernet.xml.in
@@ -47,7 +47,7 @@
                 <description>Full duplex</description>
               </valueHelp>
               <constraint>
-                <regex>(auto|half|full)</regex>
+                <regex>^(auto|half|full)$</regex>
               </constraint>
               <constraintErrorMessage>duplex must be auto, half or full</constraintErrorMessage>
             </properties>
@@ -154,7 +154,7 @@
                 <description>100 Gbit/sec</description>
               </valueHelp>
               <constraint>
-                <regex>(auto|10|100|1000|2500|5000|10000|25000|40000|50000|100000)</regex>
+                <regex>^(auto|10|100|1000|2500|5000|10000|25000|40000|50000|100000)$</regex>
               </constraint>
               <constraintErrorMessage>Speed must be auto, 10, 100, 1000, 2500, 5000, 10000, 25000, 40000, 50000 or 100000</constraintErrorMessage>
             </properties>
diff --git a/interface-definitions/interfaces-l2tpv3.xml.in b/interface-definitions/interfaces-l2tpv3.xml.in
index ba1e07740..dac99b909 100644
--- a/interface-definitions/interfaces-l2tpv3.xml.in
+++ b/interface-definitions/interfaces-l2tpv3.xml.in
@@ -47,7 +47,7 @@
                 <description>IP encapsulation</description>
               </valueHelp>
               <constraint>
-                <regex>(udp|ip)</regex>
+                <regex>^(udp|ip)$</regex>
               </constraint>
               <constraintErrorMessage>Encapsulation must be UDP or IP</constraintErrorMessage>
             </properties>
diff --git a/interface-definitions/interfaces-pppoe.xml.in b/interface-definitions/interfaces-pppoe.xml.in
index 87ed34a79..beb5ab4ed 100644
--- a/interface-definitions/interfaces-pppoe.xml.in
+++ b/interface-definitions/interfaces-pppoe.xml.in
@@ -50,7 +50,7 @@
                 <list>auto none force</list>
               </completionHelp>
               <constraint>
-                <regex>(auto|none|force)</regex>
+                <regex>^(auto|none|force)$</regex>
               </constraint>
               <constraintErrorMessage>PPPoE default-route option must be 'auto', 'none', or 'force'</constraintErrorMessage>
               <valueHelp>
diff --git a/interface-definitions/interfaces-pseudo-ethernet.xml.in b/interface-definitions/interfaces-pseudo-ethernet.xml.in
index 4a7fbe7fc..2fe3b5dfa 100644
--- a/interface-definitions/interfaces-pseudo-ethernet.xml.in
+++ b/interface-definitions/interfaces-pseudo-ethernet.xml.in
@@ -50,7 +50,7 @@
                 <description>Promicious mode passthrough of underlying device</description>
               </valueHelp>
               <constraint>
-                <regex>(private|vepa|bridge|passthru)</regex>
+                <regex>^(private|vepa|bridge|passthru)$</regex>
               </constraint>
               <constraintErrorMessage>mode must be private, vepa, bridge or passthru</constraintErrorMessage>
             </properties>
diff --git a/interface-definitions/nat.xml.in b/interface-definitions/nat.xml.in
index d6bed5b27..6ed52fd29 100644
--- a/interface-definitions/nat.xml.in
+++ b/interface-definitions/nat.xml.in
@@ -163,7 +163,7 @@
                         <validator name="ipv4-prefix"/>
                         <validator name="ipv4-address"/>
                         <validator name="ipv4-range"/>
-                        <regex>(masquerade)</regex>
+                        <regex>^(masquerade)$</regex>
                       </constraint>
                     </properties>
                   </leafNode>
diff --git a/interface-definitions/protocols-isis.xml.in b/interface-definitions/protocols-isis.xml.in
index 5b26d6923..624c72a4c 100644
--- a/interface-definitions/protocols-isis.xml.in
+++ b/interface-definitions/protocols-isis.xml.in
@@ -153,7 +153,7 @@
                 <description>Act as an area router</description>
               </valueHelp>
               <constraint>
-                <regex>(level-1|level-1-2|level-2)</regex>
+                <regex>^(level-1|level-1-2|level-2)$</regex>
               </constraint>
             </properties>
           </leafNode>
@@ -224,7 +224,7 @@
                 <description>Use new style of TLVs to carry wider metric</description>
               </valueHelp>
               <constraint>
-                <regex>(narrow|transition|wide)</regex>
+                <regex>^(narrow|transition|wide)$</regex>
               </constraint>
             </properties>
           </leafNode>
@@ -662,7 +662,7 @@
                     <description>Level-2 only adjacencies are formed</description>
                   </valueHelp>
                   <constraint>
-                    <regex>(level-1|level-1-2|level-2-only)</regex>
+                    <regex>^(level-1|level-1-2|level-2-only)$</regex>
                   </constraint>
                 </properties>
               </leafNode>
diff --git a/interface-definitions/salt-minion.xml.in b/interface-definitions/salt-minion.xml.in
index c43374a0a..d3b022d12 100644
--- a/interface-definitions/salt-minion.xml.in
+++ b/interface-definitions/salt-minion.xml.in
@@ -15,7 +15,7 @@
                 <list>md5 sha1 sha224 sha256 sha384 sha512</list>
               </completionHelp>
               <constraint>
-                <regex>(md5|sha1|sha224|sha256|sha384|sha512)</regex>
+                <regex>^(md5|sha1|sha224|sha256|sha384|sha512)$</regex>
               </constraint>
             </properties>
           </leafNode>
diff --git a/interface-definitions/service-ids-ddos-protection.xml.in b/interface-definitions/service-ids-ddos-protection.xml.in
index 5e65d3106..ff4c1c24e 100644
--- a/interface-definitions/service-ids-ddos-protection.xml.in
+++ b/interface-definitions/service-ids-ddos-protection.xml.in
@@ -25,7 +25,7 @@
                     <list>in out</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(in|out)</regex>
+                    <regex>^(in|out)$</regex>
                   </constraint>
                   <multi/>
                 </properties>
diff --git a/interface-definitions/service_ipoe-server.xml.in b/interface-definitions/service_ipoe-server.xml.in
index d0a05aea6..7c575ba77 100644
--- a/interface-definitions/service_ipoe-server.xml.in
+++ b/interface-definitions/service_ipoe-server.xml.in
@@ -23,7 +23,7 @@
                     <list>L2 L3</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(L2|L3)</regex>
+                    <regex>^(L2|L3)$</regex>
                   </constraint>
                   <valueHelp>
                     <format>L2</format>
@@ -42,7 +42,7 @@
                     <list>shared vlan</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(shared|vlan)</regex>
+                    <regex>^(shared|vlan)$</regex>
                   </constraint>
                   <valueHelp>
                     <format>shared</format>
@@ -125,7 +125,7 @@
                     <list>local radius noauth</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(local|radius|noauth)</regex>
+                    <regex>^(local|radius|noauth)$</regex>
                   </constraint>
                   <valueHelp>
                     <format>local</format>
diff --git a/interface-definitions/service_pppoe-server.xml.in b/interface-definitions/service_pppoe-server.xml.in
index 1d3e8ba29..dc8af67af 100644
--- a/interface-definitions/service_pppoe-server.xml.in
+++ b/interface-definitions/service_pppoe-server.xml.in
@@ -38,7 +38,7 @@
                         <list>ifname ifname:mac</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(ifname|ifname:mac)</regex>
+                        <regex>^(ifname|ifname:mac)$</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid Called-Station-Id format</constraintErrorMessage>
                       <valueHelp>
@@ -168,7 +168,7 @@
                 <properties>
                   <help>IPv4 (IPCP) negotiation algorithm</help>
                   <constraint>
-                    <regex>(deny|allow|prefer|require)</regex>
+                    <regex>^(deny|allow|prefer|require)$</regex>
                   </constraint>
                   <constraintErrorMessage>invalid value</constraintErrorMessage>
                   <valueHelp>
@@ -196,7 +196,7 @@
                 <properties>
                   <help>IPv6 (IPCP6) negotiation algorithm</help>
                   <constraint>
-                    <regex>(deny|allow|prefer|require)</regex>
+                    <regex>^(deny|allow|prefer|require)$</regex>
                   </constraint>
                   <constraintErrorMessage>invalid value</constraintErrorMessage>
                   <valueHelp>
diff --git a/interface-definitions/service_router-advert.xml.in b/interface-definitions/service_router-advert.xml.in
index 94255aeb2..47ac4e25d 100644
--- a/interface-definitions/service_router-advert.xml.in
+++ b/interface-definitions/service_router-advert.xml.in
@@ -215,7 +215,7 @@
                       </valueHelp>
                       <constraint>
                         <validator name="numeric" argument="--range 0-4294967295"/>
-                        <regex>(infinity)</regex>
+                        <regex>^(infinity)$</regex>
                       </constraint>
                     </properties>
                     <defaultValue>2592000</defaultValue>
diff --git a/interface-definitions/system-console.xml.in b/interface-definitions/system-console.xml.in
index 71e63d0cb..88f7f82a9 100644
--- a/interface-definitions/system-console.xml.in
+++ b/interface-definitions/system-console.xml.in
@@ -71,7 +71,7 @@
                     <description>115200 bps</description>
                   </valueHelp>
                   <constraint>
-                    <regex>(1200|2400|4800|9600|19200|38400|57600|115200)</regex>
+                    <regex>^(1200|2400|4800|9600|19200|38400|57600|115200)$</regex>
                   </constraint>
                 </properties>
               </leafNode>
diff --git a/interface-definitions/system-ip.xml.in b/interface-definitions/system-ip.xml.in
index 0bd461042..86fbe5701 100644
--- a/interface-definitions/system-ip.xml.in
+++ b/interface-definitions/system-ip.xml.in
@@ -20,7 +20,7 @@
                     <list>1024 2048 4096 8192 16384 32768</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(1024|2048|4096|8192|16384|32768)</regex>
+                    <regex>^(1024|2048|4096|8192|16384|32768)$</regex>
                   </constraint>
                 </properties>
                 <defaultValue>8192</defaultValue>
diff --git a/interface-definitions/system-ipv6.xml.in b/interface-definitions/system-ipv6.xml.in
index 6ead747a1..5ee7adf54 100644
--- a/interface-definitions/system-ipv6.xml.in
+++ b/interface-definitions/system-ipv6.xml.in
@@ -45,7 +45,7 @@
                     <list>1024 2048 4096 8192 16384 32768</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(1024|2048|4096|8192|16384|32768)</regex>
+                    <regex>^(1024|2048|4096|8192|16384|32768)$</regex>
                   </constraint>
                 </properties>
               </leafNode>
diff --git a/interface-definitions/system-syslog.xml.in b/interface-definitions/system-syslog.xml.in
index c58922a3d..f3dcae2f3 100644
--- a/interface-definitions/system-syslog.xml.in
+++ b/interface-definitions/system-syslog.xml.in
@@ -28,7 +28,7 @@
                     <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex>
+                    <regex>^(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)$</regex>
                   </constraint>
                   <constraintErrorMessage>Invalid facility type</constraintErrorMessage>
                   <valueHelp>
@@ -132,7 +132,7 @@
                         <list>emerg alert crit err warning notice info debug all</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(emerg|alert|crit|err|warning|notice|info|debug|all)</regex>
+                        <regex>^(emerg|alert|crit|err|warning|notice|info|debug|all)$</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid loglevel</constraintErrorMessage>
                       <valueHelp>
@@ -215,7 +215,7 @@
                     <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex>
+                    <regex>^(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)$</regex>
                   </constraint>
                   <constraintErrorMessage>Invalid facility type</constraintErrorMessage>
                   <valueHelp>
@@ -327,7 +327,7 @@
                         <list>udp tcp</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(udp|tcp)</regex>
+                        <regex>^(udp|tcp)$</regex>
                       </constraint>
                       <constraintErrorMessage>invalid protocol name</constraintErrorMessage>
                     </properties>
@@ -339,7 +339,7 @@
                         <list>emerg alert crit err warning notice info debug all</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(emerg|alert|crit|err|warning|notice|info|debug|all)</regex>
+                        <regex>^(emerg|alert|crit|err|warning|notice|info|debug|all)$</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid loglevel</constraintErrorMessage>
                       <valueHelp>
@@ -434,7 +434,7 @@
                     <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex>
+                    <regex>^(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)$</regex>
                   </constraint>
                   <constraintErrorMessage>Invalid facility type</constraintErrorMessage>
                   <valueHelp>
@@ -538,7 +538,7 @@
                         <list>emerg alert crit err warning notice info debug all</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(emerg|alert|crit|err|warning|notice|info|debug|all)</regex>
+                        <regex>^(emerg|alert|crit|err|warning|notice|info|debug|all)$</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid loglevel</constraintErrorMessage>
                       <valueHelp>
@@ -645,7 +645,7 @@
                     <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex>
+                    <regex>^(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)$</regex>
                   </constraint>
                   <constraintErrorMessage>Invalid facility type</constraintErrorMessage>
                   <valueHelp>
@@ -749,7 +749,7 @@
                         <list>emerg alert crit err warning notice info debug all</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(emerg|alert|crit|err|warning|notice|info|debug|all)</regex>
+                        <regex>^(emerg|alert|crit|err|warning|notice|info|debug|all)$</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid loglevel</constraintErrorMessage>
                       <valueHelp>
@@ -806,7 +806,7 @@
                     <list>auth authpriv cron daemon kern lpr mail mark news protocols security syslog user uucp local0 local1 local2 local3 local4 local5 local6 local7 all</list>
                   </completionHelp>
                   <constraint>
-                    <regex>(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)</regex>
+                    <regex>^(auth|authpriv|cron|daemon|kern|lpr|mail|mark|news|protocols|security|syslog|user|uucp|local0|local1|local2|local3|local4|local5|local6|local7|all)$</regex>
                   </constraint>
                   <constraintErrorMessage>Invalid facility type</constraintErrorMessage>
                   <valueHelp>
@@ -910,7 +910,7 @@
                         <list>emerg alert crit err warning notice info debug all</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(emerg|alert|crit|err|warning|notice|info|debug|all)</regex>
+                        <regex>^(emerg|alert|crit|err|warning|notice|info|debug|all)$</regex>
                       </constraint>
                       <constraintErrorMessage>Invalid loglevel</constraintErrorMessage>
                       <valueHelp>
diff --git a/interface-definitions/vpn_l2tp.xml.in b/interface-definitions/vpn_l2tp.xml.in
index 2d8a8503d..5bdebcb05 100644
--- a/interface-definitions/vpn_l2tp.xml.in
+++ b/interface-definitions/vpn_l2tp.xml.in
@@ -63,7 +63,7 @@
                             <description>Use X.509 certificate for IPsec authentication</description>
                           </valueHelp>
                           <constraint>
-                            <regex>(pre-shared-secret|x509)</regex>
+                            <regex>^(pre-shared-secret|x509)$</regex>
                           </constraint>
                           <completionHelp>
                             <list>pre-shared-secret x509</list>
@@ -201,7 +201,7 @@
                         <description>Require the peer to authenticate itself using MS-CHAPv2 [Microsoft Challenge Handshake Authentication Protocol, Version 2].</description>
                       </valueHelp>
                       <constraint>
-                        <regex>(pap|chap|mschap|mschap-v2)</regex>
+                        <regex>^(pap|chap|mschap|mschap-v2)$</regex>
                       </constraint>
                       <completionHelp>
                         <list>pap chap mschap mschap-v2</list>
diff --git a/interface-definitions/vpn_openconnect.xml.in b/interface-definitions/vpn_openconnect.xml.in
index f64aa7f23..1a9d39a12 100644
--- a/interface-definitions/vpn_openconnect.xml.in
+++ b/interface-definitions/vpn_openconnect.xml.in
@@ -25,7 +25,7 @@
                     <description>Use RADIUS server for user autentication</description>
                   </valueHelp>
                   <constraint>
-                    <regex>(local|radius)</regex>
+                    <regex>^(local|radius)$</regex>
                   </constraint>
                   <completionHelp>
                     <list>local radius</list>
diff --git a/interface-definitions/vpn_pptp.xml.in b/interface-definitions/vpn_pptp.xml.in
index 7cf584a18..91c8cd76f 100644
--- a/interface-definitions/vpn_pptp.xml.in
+++ b/interface-definitions/vpn_pptp.xml.in
@@ -86,7 +86,7 @@
                         <description>ask client for mppe, if it rejects drop connection</description>
                       </valueHelp>
                       <constraint>
-                        <regex>(deny|prefer|require)</regex>
+                        <regex>^(deny|prefer|require)$</regex>
                       </constraint>
                       <completionHelp>
                         <list>deny prefer require</list>
diff --git a/interface-definitions/vrrp.xml.in b/interface-definitions/vrrp.xml.in
index 1bb57d165..54cd44275 100644
--- a/interface-definitions/vrrp.xml.in
+++ b/interface-definitions/vrrp.xml.in
@@ -61,7 +61,7 @@
                         <list>plaintext-password ah</list>
                       </completionHelp>
                       <constraint>
-                        <regex>(plaintext-password|ah)</regex>
+                        <regex>^(plaintext-password|ah)$</regex>
                       </constraint>
                       <constraintErrorMessage>Authentication type must be plaintext-password or ah</constraintErrorMessage>
                     </properties>