summaryrefslogtreecommitdiff
path: root/src/migration-scripts/firewall
diff options
context:
space:
mode:
authorYuriy Andamasov <yuriy@vyos.io>2026-09-26 16:58:39 +0000
committerChristian Breunig <christian@breunig.cc>2026-09-26 17:09:05 +0000
commitd497c3b7a7504bb578874cc706dc75849ad84c2d (patch)
treea107f73dd96864b314e3de866240461d72fd5c52 /src/migration-scripts/firewall
parent430dda1e170576239d3580c1b7a6381525a05cbc (diff)
downloadvyos-1x-fix/T8859-dh-keysize-validation.tar.gz
vyos-1x-fix/T8859-dh-keysize-validation.zip
python: T8859: fail loudly on an invalid Diffie-Hellman keysize argumentfix/T8859-dh-keysize-validation
The Diffie-Hellman length check stringified the requested minimum keysize into a variable it never used, then converted the original argument again for the comparison. A non-numeric value therefore escaped as an uncaught ValueError from the comparison rather than being reported where it was passed in. The argument is now typed and validated up front: a non-integer raises TypeError, booleans included, and a non-positive integer raises ValueError. Both indicate a logic error in the calling script and should fail loudly instead of silently reporting an undersized key. The only callers today are the unit tests, so the contract is free to change. A file that exists but holds no readable parameters is user input rather than a logic error, and now fails the check instead of propagating the error from openssl. The bit-count pattern becomes a raw string, and the tests pass integer keysizes and cover the new paths.
Diffstat (limited to 'src/migration-scripts/firewall')
0 files changed, 0 insertions, 0 deletions