Fix/confd hardening

board/common/rootfs/usr/libexec/infix/iw.py

@@ -585,13 +585,13 @@ def parse_phy_caps(phy_name):
 
 def parse_mesh_param(ifname):
     """
-    Parse 'iw dev <name> get mesh_param' output for mesh point mode
+    Parse 'iw dev <name> mesh_param dump' output for mesh point mode
     Returns: {param: value}, values as int where they are numeric
 
     Lines are 'mesh_fwding = 1' or 'mesh_retry_timeout = 100 milliseconds',
     the unit is dropped.
     """
-    output = run_iw('dev', ifname, 'get', 'mesh_param')
+    output = run_iw('dev', ifname, 'mesh_param', 'dump')
     if not output:
         return {}
 

doc/ChangeLog.md

@@ -106,6 +106,15 @@ All notable changes to the project are documented in this file.
 
 ### Fixes
 
+- Fix #1655: restrict the allowed characters in interface names
+- Constrain Wi-Fi mesh-id and NAS identifier, and validate access-point and mesh passphrases as strictly as station
+- Apply syslog configuration changes at runtime, not only after reboot
+- Restrict the allowed characters in keystore key and certificate names
+- Restrict the allowed characters in syslog property-filter value and pattern-match
+- Fix #1657: restrict the allowed characters in DHCP client option values,
+  which are written into the DHCP client service file
+- Restrict the allowed characters in DHCP server static-host match values
+- Restrict the allowed characters in a hardware component `name`
 - Fix #1619: Raspberry Pi kernel panic when configure Wi-Fi
 - WebUI: "Save" in the interface editor and "OK" in Add Interface
   did nothing for Wi-Fi and WireGuard interfaces. The inline "+ New"

doc/iface.md

@@ -9,9 +9,10 @@ sections for [Bridging](bridging.md), [Link Aggregation](lag.md),
 ## Interface Name
 
 The interface name is limited to 1-15 characters due to Linux kernel
-constraints.  Physical interfaces use their system-assigned names (e.g.,
-`eth0`, `eth1`), while user-created interfaces can be named freely within
-this limit.
+constraints, and may only contain letters, digits and the characters
+`_ . : + -`, not starting with `.` or `-`.  Physical interfaces use their
+system-assigned names (e.g., `eth0`, `eth1`), while user-created
+interfaces can be named freely within these limits.
 
 > [!TIP]
 > Naming conventions like `br0`, `lag0`, `vlan10`, or `eth0.20` allow

src/confd/src/core.c

@@ -874,6 +874,11 @@ int sr_plugin_init_cb(sr_session_ctx_t *session, void **priv)
 		ERROR("Failed to subscribe to ietf-system");
 		goto err;
 	}
+	rc = subscribe_model("ietf-syslog", &confd, 0);
+	if (rc) {
+		ERROR("Failed to subscribe to ietf-syslog");
+		goto err;
+	}
 	rc = subscribe_model("ieee802-dot1ab-lldp", &confd, 0);
 	if (rc) {
 		ERROR("Failed to subscribe to ieee802-dot1ab-lldp");

src/confd/src/dhcp-client.c

@@ -101,7 +101,7 @@ static void add(const char *ifname, struct lyd_node *cfg)
 	char *cid = NULL, *options = NULL;
 	int ena = 0;
 	const char *vendor_class;
-	char vendor[128] = { 0 };
+	char vendor[272] = { 0 };
 	char do_arp[20] = { 0 };
 	bool arping;
 	FILE *fp;

src/confd/src/if-wifi.c

@@ -18,27 +18,28 @@
 #define WPA_SUPPLICANT_CONF      "/etc/wpa_supplicant-%s.conf"
 
 
-int wifi_validate_secret(sr_session_ctx_t *session, struct lyd_node *cif)
+/*
+ * Validate one wifi security block's referenced keystore secret.  The
+ * decoded passphrase is written verbatim into wpa_supplicant/hostapd
+ * config, so it must be 8-63 printable characters (no newline, which
+ * would inject an unrelated directive).  Applies to station, access
+ * point and mesh alike.
+ */
+static int validate_wifi_secret(sr_session_ctx_t *session, const char *ifname,
+				struct lyd_node *cif, struct lyd_node *security)
 {
-	struct lyd_node *wifi, *station, *security, *secret_node;
-	const char *ifname, *secret_name, *security_mode, *b64;
+	const char *secret_name, *security_mode, *b64;
+	struct lyd_node *secret_node;
 	unsigned char *decoded;
 	size_t len;
 
-	ifname = lydx_get_cattr(cif, "name");
-	wifi = lydx_get_child(cif, "wifi");
-	if (!wifi)
-		return SR_ERR_OK;
-
-	station = lydx_get_child(wifi, "station");
-	if (!station)
+	if (!security)
 		return SR_ERR_OK;
 
-	security = lydx_get_child(station, "security");
 	security_mode = lydx_get_cattr(security, "mode");
 	secret_name = lydx_get_cattr(security, "secret");
 
-	if (!secret_name || !strcmp(security_mode, "disabled"))
+	if (!secret_name || (security_mode && !strcmp(security_mode, "disabled")))
 		return SR_ERR_OK;
 
 	secret_node = lydx_get_xpathf(cif,
@@ -77,6 +78,35 @@ int wifi_validate_secret(sr_session_ctx_t *session, struct lyd_node *cif)
 	return SR_ERR_OK;
 }
 
+int wifi_validate_secret(sr_session_ctx_t *session, struct lyd_node *cif)
+{
+	static const char *const modes[] = {
+		"station", "access-point", "mesh-point"
+	};
+	const char *ifname;
+	struct lyd_node *wifi;
+
+	ifname = lydx_get_cattr(cif, "name");
+	wifi = lydx_get_child(cif, "wifi");
+	if (!wifi)
+		return SR_ERR_OK;
+
+	for (size_t i = 0; i < sizeof(modes) / sizeof(modes[0]); i++) {
+		struct lyd_node *node = lydx_get_child(wifi, modes[i]);
+		int rc;
+
+		if (!node)
+			continue;
+
+		rc = validate_wifi_secret(session, ifname, cif,
+					  lydx_get_child(node, "security"));
+		if (rc)
+			return rc;
+	}
+
+	return SR_ERR_OK;
+}
+
 wifi_mode_t wifi_get_mode(struct lyd_node *iface)
 {
 	struct lyd_node *ap, *mesh, *wifi;

src/confd/yang/confd.inc

@@ -24,20 +24,20 @@ MODULES=(
         # NOTE: ietf-tls-client must be version matched with ietf-tls-server, used by netopeer2!
 #	"ietf-tls-client@2023-12-28.yang"
 	"ietf-syslog@2024-03-21.yang -e file-action -e file-limit-size -e remote-action -e select-adv-compare -e select-match"
-	"infix-syslog@2026-09-15.yang"
+	"infix-syslog@2026-09-24.yang"
 	"iana-hardware@2018-03-13.yang"
 	"ietf-hardware@2018-03-13.yang -e hardware-state -e hardware-sensor"
-	"infix-hardware@2026-07-02.yang"
+	"infix-hardware@2026-09-24.yang"
 	"ieee802-dot1q-types@2022-10-29.yang"
 	"infix-ip@2026-04-28.yang"
 	"infix-if-type@2026-01-07.yang"
 	"infix-routing@2026-03-11.yang"
 	"ieee802-dot1ab-lldp@2022-03-15.yang"
 	"infix-lldp@2025-05-05.yang"
 	"infix-dhcp-common@2025-12-21.yang"
-	"infix-dhcp-client@2025-11-09.yang"
+	"infix-dhcp-client@2026-09-28.yang"
 	"infix-dhcpv6-client@2025-11-09.yang"
-	"infix-dhcp-server@2026-09-18.yang"
+	"infix-dhcp-server@2026-09-24.yang"
 	"infix-firewall@2026-07-02.yang"
 	"infix-firewall-services@2025-04-26.yang"
 	"infix-firewall-icmp-types@2025-04-26.yang"
@@ -48,12 +48,12 @@ MODULES=(
 	"ieee802-ethernet-phy-type@2025-09-10.yang"
 	"infix-ethernet-interface@2026-05-21.yang"
 	"infix-factory-default@2023-06-28.yang"
-	"infix-interfaces@2026-06-11.yang -e vlan-filtering"
+	"infix-interfaces@2026-09-28.yang -e vlan-filtering"
 	"ietf-crypto-types -e cleartext-symmetric-keys"
 	"infix-crypto-types@2026-02-14.yang"
 	"ietf-keystore -e symmetric-keys"
 	"infix-ntp@2026-06-11.yang"
-	"infix-keystore@2025-12-17.yang"
+	"infix-keystore@2026-09-24.yang"
 	"ieee1588-ptp-tt@2023-08-14.yang -e timestamp-correction"
 	"ieee802-dot1as-gptp@2025-12-10.yang"
 	"infix-ptp@2026-04-07.yang"

src/confd/yang/confd/infix-dhcp-client.yang

@@ -16,6 +16,11 @@ module infix-dhcp-client {
   contact      "kernelkit@googlegroups.com";
   description  "This module implements a DHCPv4 client";
 
+  revision 2026-09-28 {
+    description "Constrain the character set and length of option values.";
+    reference   "internal";
+  }
+
   revision 2025-11-09 {
     description   "Fix namespace to use infix instead of ietf.";
     reference     "internal";
@@ -128,7 +133,12 @@ module infix-dhcp-client {
                            which the server can use for static host matching.
                            For the 'hostname' option the 'auto' keyword can be
                            used to send the hostname part from IETF system.";
-              type string;
+              reference "RFC 2132, sec. 2: the option length field is one
+                         octet, so a value is at most 255 bytes.";
+              type string {
+                length "1..255";
+                pattern '[a-zA-Z0-9 _.:/@=,+-]+';
+              }
               must "../id != 'hostname' or re-match(., '[a-zA-Z0-9\\-_]{1,64}')";
             }
           }

src/confd/yang/confd/infix-dhcp-server.yang

@@ -20,6 +20,12 @@ module infix-dhcp-server {
   contact      "kernelkit@googlegroups.com";
   description  "This module implements a DHCPv4 server";
 
+  revision 2026-09-24 {
+    description "Constrain the character set and length of static-host
+                 match hostname and client-id string.";
+    reference   "internal";
+  }
+
   revision 2026-09-18 {
     description "Add network boot parameters (BOOTP siaddr/file, option 66/67)
                  at global, subnet, and host scope.";
@@ -283,7 +289,13 @@ module infix-dhcp-server {
             case hostname {
               leaf hostname {
                 description "Match on client hostname, DHCP option 12.";
-                type string;
+                reference "RFC 2132, sec. 3.14: Host Name Option.  The
+                           option length field is one octet, so the value
+                           is at most 255 bytes.";
+                type string {
+                  length "1..255";
+                  pattern '[a-zA-Z0-9_.-]+';
+                }
               }
             }
 
@@ -298,7 +310,14 @@ module infix-dhcp-server {
                       description "String value for text-based client-id.
 
                                    Example: xyzzy";
-                      type string;
+                      reference "RFC 2132, sec. 9.14: Client-identifier
+                                 (option 61).  The option length field is
+                                 one octet, so the value is at most 255
+                                 bytes.";
+                      type string {
+                        length "1..255";
+                        pattern '[a-zA-Z0-9_.:+-]+';
+                      }
                     }
                   }
                   case hex {

src/confd/yang/confd/infix-hardware.yang

@@ -21,6 +21,11 @@ module infix-hardware {
   contact      "kernelkit@googlegroups.com";
   description  "Vital Product Data augmentation of ieee-hardware and deviations.";
 
+  revision 2026-09-24 {
+    description "Constrain the character set of hardware component names.";
+    reference "internal";
+  }
+
   revision 2026-07-02 {
     description "Widen wifi max-interfaces ap/station to uint16, virtual
                  radios (mac80211_hwsim) report combinations up to 2048.";
@@ -163,6 +168,16 @@ module infix-hardware {
     description "GPS/GNSS receiver for time synchronization";
   }
 
+  deviation "/iehw:hardware/iehw:component/iehw:name" {
+    deviate replace {
+      type string {
+        pattern '[a-zA-Z0-9_][a-zA-Z0-9_.:+@-]*';
+      }
+    }
+    description "Component names are plain identifiers, including
+                 device-tree unit addresses such as 'sfp@9'.";
+  }
+
   deviation "/iehw:hardware/iehw:component/iehw:state/iehw:admin-state" {
     deviate add {
       must ". = 'locked' or . = 'unlocked'" {

src/confd/yang/confd/infix-if-wifi.yang

@@ -48,6 +48,12 @@ submodule infix-if-wifi {
      - Security: WPA2/WPA3 with keystore integration
      - Operational state: Connection status, RSSI, client lists";
 
+  revision 2026-09-24 {
+    description
+      "Constrain the character set of mesh-id and nas-identifier.";
+    reference "internal";
+  }
+
   revision 2026-07-01 {
     description
       "Add station 'bssid' operational leaf: the BSSID the station is
@@ -527,6 +533,7 @@ submodule infix-if-wifi {
                     }
                     type string {
                       length "1..253";
+                      pattern '[a-zA-Z0-9_.:+-]+';
                     }
                   }
                   default auto;
@@ -697,6 +704,9 @@ submodule infix-if-wifi {
             leaf mesh-id {
               type string {
                 length "1..32";
+                pattern '[^\x00-\x1f\x22\x5c\x7f]*' {
+                  error-message "Mesh ID must not contain control characters, double quotes, or backslashes.";
+                }
               }
               mandatory true;
               description

src/confd/yang/confd/infix-interfaces.yang

@@ -41,6 +41,11 @@ module infix-interfaces {
   contact      "kernelkit@googlegroups.com";
   description  "Linux bridge and lag extensions for ietf-interfaces.";
 
+  revision 2026-09-28 {
+    description "Constrain the character set of interface names.";
+    reference "internal";
+  }
+
   revision 2026-06-11 {
     description "Fix WireGuard key-format must expressions, see
                  infix-if-wireguard@2026-06-11.";
@@ -227,8 +232,11 @@ module infix-interfaces {
     deviate replace {
       type string {
         length "1..15";
+        pattern '[a-zA-Z0-9_][a-zA-Z0-9_.:+-]*';
       }
     }
+    description "Interface names are plain identifiers, at most 15
+                 characters (Linux IFNAMSIZ).";
   }
 
   deviation "/if:interfaces/if:interface/if:description" {

src/confd/yang/confd/infix-keystore.yang

@@ -9,6 +9,12 @@ module infix-keystore {
     prefix infix-ct;
   }
 
+  revision 2026-09-24 {
+    description "Constrain the character set of asymmetric-key and
+                 certificate names.";
+    reference "internal";
+  }
+
   revision 2025-12-17 {
     description "Add WireGuard support, see infix-crypto-types.yang";
   }
@@ -21,4 +27,22 @@ module infix-keystore {
   revision 2025-02-04 {
     description "Initial";
   }
+
+  deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:name" {
+    deviate replace {
+      type string {
+        pattern '[a-zA-Z0-9_][a-zA-Z0-9_.:+@-]*';
+      }
+    }
+    description "Key names are plain identifiers.";
+  }
+
+  deviation "/ks:keystore/ks:asymmetric-keys/ks:asymmetric-key/ks:certificates/ks:certificate/ks:name" {
+    deviate replace {
+      type string {
+        pattern '[a-zA-Z0-9_][a-zA-Z0-9_.:+@-]*';
+      }
+    }
+    description "Certificate names are plain identifiers.";
+  }
 }