diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-09-26 16:58:39 +0000 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-09-26 17:09:05 +0000 |
| commit | d497c3b7a7504bb578874cc706dc75849ad84c2d (patch) | |
| tree | a107f73dd96864b314e3de866240461d72fd5c52 /src/validators/ipv4-range-exclude | |
| parent | 430dda1e170576239d3580c1b7a6381525a05cbc (diff) | |
| download | vyos-1x-fix/T8859-dh-keysize-validation.tar.gz vyos-1x-fix/T8859-dh-keysize-validation.zip | |
python: T8859: fail loudly on an invalid Diffie-Hellman keysize argumentfix/T8859-dh-keysize-validation
The Diffie-Hellman length check stringified the requested minimum keysize
into a variable it never used, then converted the original argument again
for the comparison. A non-numeric value therefore escaped as an uncaught
ValueError from the comparison rather than being reported where it was
passed in.
The argument is now typed and validated up front: a non-integer raises
TypeError, booleans included, and a non-positive integer raises
ValueError. Both indicate a logic error in the calling script and should
fail loudly instead of silently reporting an undersized key. The only
callers today are the unit tests, so the contract is free to change.
A file that exists but holds no readable parameters is user input rather
than a logic error, and now fails the check instead of propagating the
error from openssl.
The bit-count pattern becomes a raw string, and the tests pass integer
keysizes and cover the new paths.
Diffstat (limited to 'src/validators/ipv4-range-exclude')
0 files changed, 0 insertions, 0 deletions
