Defect
In python/vyos/configverify.py, verify_diffie_hellman_length(file, min_keysize):
def verify_diffie_hellman_length(file, min_keysize): """ Verify Diffie-Hellamn keypair length given via file. It must be greater then or equal to min_keysize """ import os import re from vyos.utils.process import cmd try: keysize = str(min_keysize) except: return False if os.path.exists(file): out = cmd(f'openssl dhparam -inform PEM -in {file} -text') prog = re.compile('\d+\s+bit') if prog.search(out): bits = prog.search(out)[0].split()[0] if int(bits) >= int(min_keysize): return True return False
Two issues:
- Only str(min_keysize) is wrapped in try/except. The later int(min_keysize) call (inside the if at line 444) can still raise ValueError for non-numeric inputs (e.g. 'abc'), surfacing as an unhandled exception instead of returning False as the function intends.
- The local keysize variable is never used. str(min_keysize) is computed and assigned but the result is discarded; the function only uses int(min_keysize) afterward.
Suggested fix
Validate / convert min_keysize once inside the try/except, then use that value for comparisons:
def verify_diffie_hellman_length(file, min_keysize): """ Verify Diffie-Hellman keypair length given via file. It must be greater than or equal to min_keysize """ import os import re from vyos.utils.process import cmd try: min_keysize_int = int(min_keysize) except (TypeError, ValueError): return False if os.path.exists(file): out = cmd(f'openssl dhparam -inform PEM -in {file} -text') prog = re.compile('\d+\s+bit') if prog.search(out): bits = prog.search(out)[0].split()[0] if int(bits) >= min_keysize_int: return True return False
Provenance
Found by Copilot during review of vyos/vyos-1x#5074 (comment). The configverify changes were dropped from #5074 per dmbaturin's scope narrowing; this defect is independent of his broader configverify redesign concerns (MTU helpers taking defaults as args) and can be fixed in isolation.