From d497c3b7a7504bb578874cc706dc75849ad84c2d Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Sat, 26 Sep 2026 16:58:39 +0000
Subject: python: T8859: fail loudly on an invalid Diffie-Hellman keysize
 argument

The Diffie-Hellman length check stringified the requested minimum keysize
into a variable it never used, then converted the original argument again
for the comparison. A non-numeric value therefore escaped as an uncaught
ValueError from the comparison rather than being reported where it was
passed in.

The argument is now typed and validated up front: a non-integer raises
TypeError, booleans included, and a non-positive integer raises
ValueError. Both indicate a logic error in the calling script and should
fail loudly instead of silently reporting an undersized key. The only
callers today are the unit tests, so the contract is free to change.

A file that exists but holds no readable parameters is user input rather
than a logic error, and now fails the check instead of propagating the
error from openssl.

The bit-count pattern becomes a raw string, and the tests pass integer
keysizes and cover the new paths.
---
 python/vyos/configverify.py | 38 ++++++++++++++++++++++++++------------
 1 file changed, 26 insertions(+), 12 deletions(-)

(limited to 'python')

diff --git a/python/vyos/configverify.py b/python/vyos/configverify.py
index c1c038a7a..17476f02d 100644
--- a/python/vyos/configverify.py
+++ b/python/vyos/configverify.py
@@ -424,24 +424,38 @@ def verify_vlan_config(config):
             verify_mtu_ipv6(c_vlan)
 
 
-def verify_diffie_hellman_length(file, min_keysize):
-    """ Verify Diffie-Hellamn keypair length given via file. It must be greater
-    then or equal to min_keysize """
+def verify_diffie_hellman_length(file: str, min_keysize: int) -> bool:
+    """ Verify Diffie-Hellman keypair length given via file. It must be greater
+    than or equal to min_keysize.
+
+    Raises TypeError if min_keysize is not an integer and ValueError if it is
+    not a positive integer - both indicate a logic error in the caller. An
+    unreadable or malformed file is user input, not a logic error, and simply
+    fails the check. """
     import os
     import re
     from vyos.utils.process import cmdl
 
-    try:
-        keysize = str(min_keysize)
-    except:
-        return False
+    if isinstance(min_keysize, bool) or not isinstance(min_keysize, int):
+        raise TypeError(
+            f'min_keysize must be an integer, got {type(min_keysize).__name__}')
+    if min_keysize < 1:
+        raise ValueError(
+            f'min_keysize must be a positive integer, got {min_keysize}')
 
     if os.path.exists(file):
-        out = cmdl(['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text'])
-        prog = re.compile('\d+\s+bit')
-        if prog.search(out):
-            bits = prog.search(out)[0].split()[0]
-            if int(bits) >= int(min_keysize):
+        try:
+            out = cmdl(
+                ['openssl', 'dhparam', '-inform', 'PEM', '-in', file, '-text'])
+        except OSError:
+            # Not a readable PEM encoded Diffie-Hellman parameter file
+            return False
+
+        prog = re.compile(r'\d+\s+bit')
+        match = prog.search(out)
+        if match:
+            bits = match[0].split()[0]
+            if int(bits) >= min_keysize:
                 return True
 
     return False
-- 
cgit v1.2.3