diff options
Diffstat (limited to 'python')
| -rw-r--r-- | python/vyos/configverify.py | 38 |
1 files changed, 26 insertions, 12 deletions
diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py index c1c038a7a..17476f02d 100644 --- a/python/vyos/configverify.py +++ b/python/vyos/configverify.py @@ -424,24 +424,38 @@ def verify_vlan_config(config): verify_mtu_ipv6(c_vlan) -def verify_diffie_hellman_length(file, min_keysize): - """ Verify Diffie-Hellamn keypair length given via file. It must be greater - then or equal to min_keysize """ +def verify_diffie_hellman_length(file: str, min_keysize: int) -> bool: + """ Verify Diffie-Hellman keypair length given via file. It must be greater + than or equal to min_keysize. + + Raises TypeError if min_keysize is not an integer and ValueError if it is + not a positive integer - both indicate a logic error in the caller. An + unreadable or malformed file is user input, not a logic error, and simply + fails the check. """ import os import re from vyos.utils.process import cmdl - try: - keysize = str(min_keysize) - except: - return False + if isinstance(min_keysize, bool) or not isinstance(min_keysize, int): + raise TypeError( + f'min_keysize must be an integer, got {type(min_keysize).__name__}') + if min_keysize < 1: + raise ValueError( + f'min_keysize must be a positive integer, got {min_keysize}') if os.path.exists(file): - out = cmdl(['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text']) - prog = re.compile('\d+\s+bit') - if prog.search(out): - bits = prog.search(out)[0].split()[0] - if int(bits) >= int(min_keysize): + try: + out = cmdl( + ['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text']) + except OSError: + # Not a readable PEM encoded Diffie-Hellman parameter file + return False + + prog = re.compile(r'\d+\s+bit') + match = prog.search(out) + if match: + bits = match[0].split()[0] + if int(bits) >= min_keysize: return True return False |