20 files changed, 167 insertions, 26 deletions
diff --git a/src/validators/as-number-list b/src/validators/as-number-list
index 432d44180..1df40cc3a 100755
--- a/src/validators/as-number-list
+++ b/src/validators/as-number-list
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2022 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/base64 b/src/validators/base64
index a54168ef7..97d7a0398 100755
--- a/src/validators/base64
+++ b/src/validators/base64
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2025 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/bgp-extended-community b/src/validators/bgp-extended-community
index d66665519..561d41bca 100755
--- a/src/validators/bgp-extended-community
+++ b/src/validators/bgp-extended-community
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright 2019-2023 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
diff --git a/src/validators/bgp-large-community b/src/validators/bgp-large-community
index 386398308..2b9ef7a8a 100755
--- a/src/validators/bgp-large-community
+++ b/src/validators/bgp-large-community
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright 2019-2022 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -48,6 +48,6 @@ if __name__ == '__main__':
         print("Invalid community format")
         exit(1)
 
-    # fail if none of validators catched the value
+    # fail if none of validators caught the value
     print("Invalid community format")
     exit(1)
 \ No newline at end of file
diff --git a/src/validators/bgp-large-community-list b/src/validators/bgp-large-community-list
index 9ba5b27eb..8e4326a9c 100755
--- a/src/validators/bgp-large-community-list
+++ b/src/validators/bgp-large-community-list
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -17,18 +17,27 @@
 import re
 import sys
 
-pattern = '(.*):(.*):(.*)'
-allowedChars = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '.', '+', '*', '?', '^', '$', '(', ')', '[', ']', '{', '}', '|', '\\', ':', '-' }
+allowedChars = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', '.', '+', '*', '?', '^', '$', '(', ')', '[', ']', '{', '}', '|', '\\', ':', '-', '_', ' ' }
 
 if __name__ == '__main__':
     if len(sys.argv) != 2:
         sys.exit(1)
 
-    value = sys.argv[1].split(':')
-    if not len(value) == 3:
+    value = sys.argv[1]
+
+    # Require at least one well-formed large-community tuple in the pattern. 
+    tmp = value.split(':')
+    if len(tmp) < 3:
+        sys.exit(1)
+
+    # Simple guard against invalid community & 1003.2 pattern chars
+    if not set(value).issubset(allowedChars):
         sys.exit(1)
 
-    if not (re.match(pattern, sys.argv[1]) and set(sys.argv[1]).issubset(allowedChars)):
+    # Don't feed FRR badly formed regex
+    try:
+        re.compile(value)
+    except re.error:
         sys.exit(1)
 
     sys.exit(0)
diff --git a/src/validators/bgp-rd-rt b/src/validators/bgp-rd-rt
index b2b69c9be..233f09696 100755
--- a/src/validators/bgp-rd-rt
+++ b/src/validators/bgp-rd-rt
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/bgp-regular-community b/src/validators/bgp-regular-community
index d43a71eae..6df3e8d5d 100755
--- a/src/validators/bgp-regular-community
+++ b/src/validators/bgp-regular-community
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 
-# Copyright 2019-2022 VyOS maintainers and contributors <maintainers@vyos.io>
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Lesser General Public
@@ -45,6 +45,6 @@ if __name__ == '__main__':
         print("Invalid community format")
         exit(1)
 
-    # fail if none of validators catched the value
+    # fail if none of validators caught the value
     print("Invalid community format")
     exit(1)
 \ No newline at end of file
diff --git a/src/validators/cpu b/src/validators/cpu
new file mode 100755
index 000000000..959a49248
--- /dev/null
+++ b/src/validators/cpu
@@ -0,0 +1,43 @@
+#!/usr/bin/python3
+
+import re
+import sys
+
+MAX_CPU = 511
+
+
+def validate_isolcpus(value):
+    pattern = re.compile(r'^(\d{1,3}(-\d{1,3})?)(,(\d{1,3}(-\d{1,3})?))*$')
+    if not pattern.fullmatch(value):
+        return False
+
+    flat_list = []
+    for part in value.split(','):
+        if '-' in part:
+            start, end = map(int, part.split('-'))
+            if start > end or start < 0 or end > MAX_CPU:
+                return False
+            flat_list.extend(range(start, end + 1))
+        else:
+            num = int(part)
+            if num < 0 or num > MAX_CPU:
+                return False
+            flat_list.append(num)
+
+    for i in range(1, len(flat_list)):
+        if flat_list[i] <= flat_list[i - 1]:
+            return False
+
+    return True
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        print("Usage: python3 cpu.py <cpu_list>")
+        sys.exit(1)
+
+    input_value = sys.argv[1]
+    if validate_isolcpus(input_value):
+        sys.exit(0)
+    else:
+        sys.exit(1)
diff --git a/src/validators/ddclient-protocol b/src/validators/ddclient-protocol
index ce5efbd52..0d28039d3 100755
--- a/src/validators/ddclient-protocol
+++ b/src/validators/ddclient-protocol
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/ether-type b/src/validators/ether-type
index 926db26d3..b3dc23b58 100644
--- a/src/validators/ether-type
+++ b/src/validators/ether-type
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/interface-address b/src/validators/interface-address
index 2a2583fc3..3ea18b91f 100755
--- a/src/validators/interface-address
+++ b/src/validators/interface-address
@@ -1,3 +1,10 @@
 #!/bin/sh
 
-ipaddrcheck --is-any-host "$1"
+ipaddrcheck --allow-loopback --is-valid-intf-address "$1"
+
+if [ $? -gt 0 ]; then
+    echo "Error: $1 is not a valid network interface address"
+    exit 1
+fi
+
+exit 0
diff --git a/src/validators/ip-protocol b/src/validators/ip-protocol
index c4c882502..b7467a7a0 100755
--- a/src/validators/ip-protocol
+++ b/src/validators/ip-protocol
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/ipv6-eui64-prefix b/src/validators/ipv6-eui64-prefix
index d7f262633..73ef9b29e 100755
--- a/src/validators/ipv6-eui64-prefix
+++ b/src/validators/ipv6-eui64-prefix
@@ -2,6 +2,8 @@
 
 # Validator used to check if given IPv6 prefix is of size /64 required by EUI64
 
+import ipaddress
+
 from sys import argv
 from sys import exit
 
@@ -10,7 +12,14 @@ if __name__ == '__main__':
         exit(1)
 
     prefix = argv[1]
-    if prefix.split('/')[1] == '64':
-        exit(0)
+
+    try:
+        network = ipaddress.ip_network(prefix)
+        if network.prefixlen == 64:
+            exit(0)
+    except ValueError:
+        print(
+            'EUI64 prefix must be a valid IPv6 prefix in CIDR notation (e.g., 2001:db8::/64)'
+        )
 
     exit(1)
diff --git a/src/validators/psk-secret b/src/validators/psk-secret
index c91aa95a8..69d8b75c4 100644
--- a/src/validators/psk-secret
+++ b/src/validators/psk-secret
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2024 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/script b/src/validators/script
index eb176d23b..c3d39b347 100755
--- a/src/validators/script
+++ b/src/validators/script
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2018-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or
 # modify it under the terms of the GNU General Public License
diff --git a/src/validators/sysctl b/src/validators/sysctl
index 9b5bba3e1..cc21186f5 100755
--- a/src/validators/sysctl
+++ b/src/validators/sysctl
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2021 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/timezone b/src/validators/timezone
index e55af8d2a..dd3e0654d 100755
--- a/src/validators/timezone
+++ b/src/validators/timezone
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2019-2023 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
diff --git a/src/validators/vrf-name b/src/validators/vrf-name
index 29167c635..b56ebd036 100755
--- a/src/validators/vrf-name
+++ b/src/validators/vrf-name
@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 #
-# Copyright (C) 2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as
@@ -24,15 +24,22 @@ if __name__ == '__main__':
     vrf = argv[1]
     length = len(vrf)
 
+    # must not exceed Linux Kernel IFNAMSIZ definition
     if length not in range(1, 16):
         exit(1)
 
+    # allow only alpha numerical characters, - and _
+    pattern = r'^[A-Za-z0-9_-]+$'
+    if not re.match(pattern, vrf):
+        exit(1)
+
     # Treat loopback interface "lo" explicitly. Adding "lo" explicitly to the
     # following regex pattern would deny any VRF name starting with lo - thuse
     # local-vrf would be illegal - and that we do not want.
     if vrf == "lo":
         exit(1)
 
+    # VRF name must not conflict with local interface type prefix
     pattern = r'^(?!(bond|br|dum|eth|lan|eno|ens|enp|enx|gnv|ipoe|l2tp|l2tpeth|\
        vtun|ppp|pppoe|peth|tun|vti|vxlan|wg|wlan|wwan|\d)\d*(\.\d+)?(v.+)?).*$'
     if not re.match(pattern, vrf):
diff --git a/src/validators/watchdog-module b/src/validators/watchdog-module
new file mode 100644
index 000000000..0ae68b46d
--- /dev/null
+++ b/src/validators/watchdog-module
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+#
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License version 2 or later as
+# published by the Free Software Foundation.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import re
+import sys
+
+from vyos.utils.kernel import load_module
+from vyos.utils.process import rc_cmd
+
+
+
+def main() -> int:
+    if len(sys.argv) < 2:
+        # No value to validate
+        return 1
+
+    module = sys.argv[1].strip()
+    if not module:
+        return 1
+
+    # Keep the module name format strict.
+    if not re.fullmatch(r"[a-zA-Z0-9_\-]+", module):
+        return 1
+
+    # Ensure the module exists and is loadable (dry-run).
+    # This does not load the module.
+    try:
+        rc = load_module(module, quiet=True, dry_run=True)
+    except OSError:
+        return 1
+
+    if rc != 0:
+        return 1
+
+    # Validate that the module looks like a watchdog driver.
+    # Use modinfo filename location as the heuristic.
+    rc, out = rc_cmd(["modinfo", "-F", "filename", module])
+    if rc != 0:
+        return 1
+    filename = (out or "").strip().lower()
+
+    # Accept modules located under drivers/watchdog, plus explicit exception for
+    # ipmi_watchdog which lives in drivers/char/ipmi.
+    is_watchdog_driver = (
+        ("/watchdog/" in filename)
+        or filename.endswith("/ipmi_watchdog.ko")
+    )
+
+    return 0 if is_watchdog_driver else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/src/validators/wireless-phy b/src/validators/wireless-phy
index 513a902de..3d0abbb54 100755
--- a/src/validators/wireless-phy
+++ b/src/validators/wireless-phy
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (C) 2018-2020 VyOS maintainers and contributors
+# Copyright VyOS maintainers and contributors <maintainers@vyos.io>
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License version 2 or later as