b4bac0f7a0
* Remove unnecessary exception re-wraps * Preserve exception chains on re-raise We slap "from cause" to almost all possible cases here. In some cases it could conceivably be better to do "from None" if we really want to hide the cause. However those should be in the minority, and "from cause" should be an improvement over the corresponding raise without a "from" in all cases anyway. The only case where we raise from None here is in plex, where the exception for an original invalid SSL cert is not the root cause for failure to validate a newly fetched one. Follow local convention on exception variable names if there is a consistent one, otherwise `err` to match with majority of codebase. * Fix mistaken re-wrap in homematicip_cloud/hap.py Missed the difference between HmipConnectionError and HmipcConnectionError. * Do not hide original error on plex new cert validation error Original is not the cause for the new one, but showing old in the traceback is useful nevertheless.
47 lines
1.6 KiB
Python
47 lines
1.6 KiB
Python
"""Helper functions for the Cert Expiry platform."""
|
|
import socket
|
|
import ssl
|
|
|
|
from homeassistant.util import dt
|
|
|
|
from .const import TIMEOUT
|
|
from .errors import (
|
|
ConnectionRefused,
|
|
ConnectionTimeout,
|
|
ResolveFailed,
|
|
ValidationFailure,
|
|
)
|
|
|
|
|
|
def get_cert(host, port):
|
|
"""Get the certificate for the host and port combination."""
|
|
ctx = ssl.create_default_context()
|
|
address = (host, port)
|
|
with socket.create_connection(address, timeout=TIMEOUT) as sock:
|
|
with ctx.wrap_socket(sock, server_hostname=address[0]) as ssock:
|
|
# pylint disable: https://github.com/PyCQA/pylint/issues/3166
|
|
cert = ssock.getpeercert() # pylint: disable=no-member
|
|
return cert
|
|
|
|
|
|
async def get_cert_expiry_timestamp(hass, hostname, port):
|
|
"""Return the certificate's expiration timestamp."""
|
|
try:
|
|
cert = await hass.async_add_executor_job(get_cert, hostname, port)
|
|
except socket.gaierror as err:
|
|
raise ResolveFailed(f"Cannot resolve hostname: {hostname}") from err
|
|
except socket.timeout as err:
|
|
raise ConnectionTimeout(
|
|
f"Connection timeout with server: {hostname}:{port}"
|
|
) from err
|
|
except ConnectionRefusedError as err:
|
|
raise ConnectionRefused(
|
|
f"Connection refused by server: {hostname}:{port}"
|
|
) from err
|
|
except ssl.CertificateError as err:
|
|
raise ValidationFailure(err.verify_message) from err
|
|
except ssl.SSLError as err:
|
|
raise ValidationFailure(err.args[0]) from err
|
|
|
|
ts_seconds = ssl.cert_time_to_seconds(cert["notAfter"])
|
|
return dt.utc_from_timestamp(ts_seconds)
|