python: T8859: raise TypeError/ValueError on invalid min_keysizefix/T8859-dh-keysize-validation

Per dmbaturin's review on
https://github.com/vyos/vyos-1x/pull/5194: the only callers of
verify_diffie_hellman_length() are its own unit tests, so the contract
can change freely. An invalid min_keysize indicates a logic error in
the calling script and should fail loudly instead of silently
returning False:

- signature is now verify_diffie_hellman_length(file: str, min_keysize: int)
- non-integer min_keysize raises TypeError (bool explicitly rejected)
- non-positive min_keysize raises ValueError
- regex pattern converted to a raw string (invalid escape sequence)
- openssl invoked with list arguments instead of an interpolated
  command string, so the file path never hits a shell (CodeRabbit)

Tests updated to pass integer keysizes and extended to cover both
exception paths.

🤖 Generated by [robots](https://vyos.io)

2 files changed, 30 insertions, 13 deletions

diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index f4cceeeec..35119530d 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -424,24 +424,29 @@ def verify_vlan_config(config):
             verify_mtu_ipv6(c_vlan)
 
 
-def verify_diffie_hellman_length(file, min_keysize):
-    """ Verify Diffie-Hellamn keypair length given via file. It must be greater
-    then or equal to min_keysize """
+def verify_diffie_hellman_length(file: str, min_keysize: int):
+    """ Verify Diffie-Hellman keypair length given via file. It must be greater
+    than or equal to min_keysize.
+
+    Raises TypeError if min_keysize is not an integer and ValueError if it is
+    not a positive integer - both indicate a logic error in the caller. """
     import os
     import re
     from vyos.utils.process import cmd
 
-    try:
-        min_keysize_int = int(min_keysize)
-    except (TypeError, ValueError):
-        return False
+    if isinstance(min_keysize, bool) or not isinstance(min_keysize, int):
+        raise TypeError(
+            f'min_keysize must be an integer, got {type(min_keysize).__name__}')
+    if min_keysize < 1:
+        raise ValueError(
+            f'min_keysize must be a positive integer, got {min_keysize}')
 
     if os.path.exists(file):
-        out = cmd(f'openssl dhparam -inform PEM -in {file} -text')
-        prog = re.compile('\d+\s+bit')
+        out = cmd(['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text'])
+        prog = re.compile(r'\d+\s+bit')
         if prog.search(out):
             bits = prog.search(out)[0].split()[0]
-            if int(bits) >= min_keysize_int:
+            if int(bits) >= min_keysize:
                 return True
 
     return False
diff --git a/src/tests/test_configverify.py b/src/tests/test_configverify.py
index 8f80365d7..a3a94fa50 100644
--- a/src/tests/test_configverify.py
+++ b/src/tests/test_configverify.py
@@ -18,14 +18,26 @@ from vyos.utils.process import cmd
 
 dh_file = '/tmp/dh.pem'
 
-class TestDictSearch(TestCase):
+class TestVerifyDiffieHellmanLength(TestCase):
     def setUp(self):
         pass
 
     def test_dh_key_none(self):
-        self.assertFalse(verify_diffie_hellman_length('/tmp/non_existing_file', '1024'))
+        self.assertFalse(verify_diffie_hellman_length('/tmp/non_existing_file', 1024))
 
     def test_dh_key_512(self):
-        key_len = '512'
+        key_len = 512
         cmd(f'openssl dhparam -out {dh_file} {key_len}')
         self.assertTrue(verify_diffie_hellman_length(dh_file, key_len))
+
+    def test_dh_keysize_not_integer(self):
+        with self.assertRaises(TypeError):
+            verify_diffie_hellman_length(dh_file, '1024')
+        with self.assertRaises(TypeError):
+            verify_diffie_hellman_length(dh_file, True)
+
+    def test_dh_keysize_not_positive(self):
+        with self.assertRaises(ValueError):
+            verify_diffie_hellman_length(dh_file, -512)
+        with self.assertRaises(ValueError):
+            verify_diffie_hellman_length(dh_file, 0)