diff options
| -rw-r--r-- | python/vyos/configverify.py | 25 | ||||
| -rw-r--r-- | src/tests/test_configverify.py | 18 |
2 files changed, 30 insertions, 13 deletions
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py index f4cceeeec..35119530d 100644 --- a/python/vyos/configverify.py +++ b/python/vyos/configverify.py @@ -424,24 +424,29 @@ def verify_vlan_config(config): verify_mtu_ipv6(c_vlan) -def verify_diffie_hellman_length(file, min_keysize): - """ Verify Diffie-Hellamn keypair length given via file. It must be greater - then or equal to min_keysize """ +def verify_diffie_hellman_length(file: str, min_keysize: int): + """ Verify Diffie-Hellman keypair length given via file. It must be greater + than or equal to min_keysize. + + Raises TypeError if min_keysize is not an integer and ValueError if it is + not a positive integer - both indicate a logic error in the caller. """ import os import re from vyos.utils.process import cmd - try: - min_keysize_int = int(min_keysize) - except (TypeError, ValueError): - return False + if isinstance(min_keysize, bool) or not isinstance(min_keysize, int): + raise TypeError( + f'min_keysize must be an integer, got {type(min_keysize).__name__}') + if min_keysize < 1: + raise ValueError( + f'min_keysize must be a positive integer, got {min_keysize}') if os.path.exists(file): - out = cmd(f'openssl dhparam -inform PEM -in {file} -text') - prog = re.compile('\d+\s+bit') + out = cmd(['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text']) + prog = re.compile(r'\d+\s+bit') if prog.search(out): bits = prog.search(out)[0].split()[0] - if int(bits) >= min_keysize_int: + if int(bits) >= min_keysize: return True return False diff --git a/src/tests/test_configverify.py b/src/tests/test_configverify.py index 8f80365d7..a3a94fa50 100644 --- a/src/tests/test_configverify.py +++ b/src/tests/test_configverify.py @@ -18,14 +18,26 @@ from vyos.utils.process import cmd dh_file = '/tmp/dh.pem' -class TestDictSearch(TestCase): +class TestVerifyDiffieHellmanLength(TestCase): def setUp(self): pass def test_dh_key_none(self): - self.assertFalse(verify_diffie_hellman_length('/tmp/non_existing_file', '1024')) + self.assertFalse(verify_diffie_hellman_length('/tmp/non_existing_file', 1024)) def test_dh_key_512(self): - key_len = '512' + key_len = 512 cmd(f'openssl dhparam -out {dh_file} {key_len}') self.assertTrue(verify_diffie_hellman_length(dh_file, key_len)) + + def test_dh_keysize_not_integer(self): + with self.assertRaises(TypeError): + verify_diffie_hellman_length(dh_file, '1024') + with self.assertRaises(TypeError): + verify_diffie_hellman_length(dh_file, True) + + def test_dh_keysize_not_positive(self): + with self.assertRaises(ValueError): + verify_diffie_hellman_length(dh_file, -512) + with self.assertRaises(ValueError): + verify_diffie_hellman_length(dh_file, 0) |