stomp.py icon indicating copy to clipboard operation
stomp.py copied to clipboard

Error message from `cert_validator` function gets lost

Open andy-maier opened this issue 5 months ago • 1 comments

When using CA certificate validation, stomp currently handles any validation errors with this code in https://github.com/jasonrbriggs/stomp.py/blob/dev/stomp/transport.py#L779:

                    if need_ssl and ssl_params["cert_validator"]:
                        cert = self.socket.getpeercert()
                        (ok, errmsg) = ssl_params["cert_validator"](cert, host_and_port[0])
                        if not ok:
                            raise SSLError("Server certificate validation failed: %s", errmsg)

                    self.current_host_and_port = host_and_port
                    logging.info("established connection to host %s, port %s", host_and_port[0], host_and_port[1])
                    break

                except FileNotFoundError as err:
                    logging.error("Could not find file %s", err.filename)
                    self.socket = None
                    break

                except (OSError, AssertionError):
                    self.socket = None
                    connect_count += 1
                    logging.warning("could not connect to host %s, port %s", host_and_port[0], host_and_port[1],
                                    exc_info=logging.verbose)

Up to the point where it raises SSLError, everything is fine. It then catches that exception again as an OSError and issues a warning without including the exception message of the SSLError.

That way, the error message returned by the cert_validator function gets lost.

In addition, other SSL methods may raise SSLError in the code path of if need_ssl:, and they also get lost - for example the SSL error about self-signed certificates.

I suggest to include the exception message in the logged warning.

andy-maier avatar Jul 18 '25 09:07 andy-maier

Addressed by PR #449.

andy-maier avatar Jul 18 '25 11:07 andy-maier