diff options
| -rw-r--r-- | python/vyos/configverify.py | 38 | ||||
| -rw-r--r-- | src/tests/test_configverify.py | 29 |
2 files changed, 51 insertions, 16 deletions
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py index c1c038a7a..17476f02d 100644 --- a/python/vyos/configverify.py +++ b/python/vyos/configverify.py @@ -424,24 +424,38 @@ def verify_vlan_config(config): verify_mtu_ipv6(c_vlan) -def verify_diffie_hellman_length(file, min_keysize): - """ Verify Diffie-Hellamn keypair length given via file. It must be greater - then or equal to min_keysize """ +def verify_diffie_hellman_length(file: str, min_keysize: int) -> bool: + """ Verify Diffie-Hellman keypair length given via file. It must be greater + than or equal to min_keysize. + + Raises TypeError if min_keysize is not an integer and ValueError if it is + not a positive integer - both indicate a logic error in the caller. An + unreadable or malformed file is user input, not a logic error, and simply + fails the check. """ import os import re from vyos.utils.process import cmdl - try: - keysize = str(min_keysize) - except: - return False + if isinstance(min_keysize, bool) or not isinstance(min_keysize, int): + raise TypeError( + f'min_keysize must be an integer, got {type(min_keysize).__name__}') + if min_keysize < 1: + raise ValueError( + f'min_keysize must be a positive integer, got {min_keysize}') if os.path.exists(file): - out = cmdl(['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text']) - prog = re.compile('\d+\s+bit') - if prog.search(out): - bits = prog.search(out)[0].split()[0] - if int(bits) >= int(min_keysize): + try: + out = cmdl( + ['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text']) + except OSError: + # Not a readable PEM encoded Diffie-Hellman parameter file + return False + + prog = re.compile(r'\d+\s+bit') + match = prog.search(out) + if match: + bits = match[0].split()[0] + if int(bits) >= min_keysize: return True return False diff --git a/src/tests/test_configverify.py b/src/tests/test_configverify.py index 72ed8c084..a8476d849 100644 --- a/src/tests/test_configverify.py +++ b/src/tests/test_configverify.py @@ -12,20 +12,41 @@ # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. +import os + from unittest import TestCase from vyos.configverify import verify_diffie_hellman_length from vyos.utils.process import cmdl dh_file = '/tmp/dh.pem' +dh_file_invalid = '/tmp/dh_invalid.pem' -class TestDictSearch(TestCase): +class TestVerifyDiffieHellmanLength(TestCase): def setUp(self): pass def test_dh_key_none(self): - self.assertFalse(verify_diffie_hellman_length('/tmp/non_existing_file', '1024')) + self.assertFalse(verify_diffie_hellman_length('/tmp/non_existing_file', 1024)) def test_dh_key_512(self): - key_len = '512' - cmdl(['openssl', 'dhparam', '-out', dh_file, key_len]) + key_len = 512 + cmdl(['openssl', 'dhparam', '-out', dh_file, str(key_len)]) self.assertTrue(verify_diffie_hellman_length(dh_file, key_len)) + + def test_dh_key_malformed(self): + with open(dh_file_invalid, 'w') as f: + f.write('this is not a PEM encoded file') + self.assertFalse(verify_diffie_hellman_length(dh_file_invalid, 512)) + os.unlink(dh_file_invalid) + + def test_dh_keysize_not_integer(self): + with self.assertRaises(TypeError): + verify_diffie_hellman_length(dh_file, '1024') + with self.assertRaises(TypeError): + verify_diffie_hellman_length(dh_file, True) + + def test_dh_keysize_not_positive(self): + with self.assertRaises(ValueError): + verify_diffie_hellman_length(dh_file, -512) + with self.assertRaises(ValueError): + verify_diffie_hellman_length(dh_file, 0) |