Catch SSL errors

Properly catch SSL errors. When a connection could not be
established, the ddns client will try again. If an invalid
certificate is presented future updates are held back for
the usual time.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

diff --git a/src/ddns/errors.py b/src/ddns/errors.py
index 26bc18ec46d508c02bbd6836d3cce18495e79bd5..58a5ba9beb0e0342d51d21dc7e140c3cbc591483 100644 (file)
--- a/src/ddns/errors.py
+++ b/src/ddns/errors.py
@@ -64,6 +64,13 @@ class DDNSBlockedError(DDNSError):
        reason = N_("The server denies any updates from this client")
 
 
        reason = N_("The server denies any updates from this client")
 
 

+class DDNSCertificateError(DDNSError):
+       """
+               Thrown when a server presented an invalid certificate.
+       """
+       reason = N_("Invalid certificate")
+
+

 class DDNSConfigurationError(DDNSError):
        """
                Thrown when invalid or insufficient
 class DDNSConfigurationError(DDNSError):
        """
                Thrown when invalid or insufficient


@@ -139,6 +146,14 @@ class DDNSResolveError(DDNSNetworkError):
        reason = N_("Could not resolve DNS entry")
 
 
        reason = N_("Could not resolve DNS entry")
 
 

+class DDNSSSLError(DDNSNetworkError):
+       """
+               Raised when a SSL connection could not be
+               negotiated.
+       """
+       reason = N_("SSL negotiation error")
+
+

 class DDNSServiceUnavailableError(DDNSNetworkError):
        """
                Equivalent to HTTP error code 503.
 class DDNSServiceUnavailableError(DDNSNetworkError):
        """
                Equivalent to HTTP error code 503.

diff --git a/src/ddns/system.py b/src/ddns/system.py
index 6a21af85395af68ac149b545d7f8009e5a3cd713..0d90ce66ee38e6d604420449aa2cfabdecb7ffc8 100644 (file)
--- a/src/ddns/system.py
+++ b/src/ddns/system.py
@@ -21,6 +21,7 @@
 
 import base64
 import re
 
 import base64
 import re

+import ssl

 import socket
 import urllib
 import urllib2
 import socket
 import urllib
 import urllib2


@@ -199,6 +200,16 @@ class DDNSSystem(object):
 
                except urllib2.URLError, e:
                        if e.reason:
 
                except urllib2.URLError, e:
                        if e.reason:

+                               # Handle SSL errors
+                               if isinstance(e.reason, ssl.SSLError):
+                                       e = e.reason
+
+                                       if e.reason == "CERTIFICATE_VERIFY_FAILED":
+                                               raise DDNSCertificateError
+
+                                       # Raise all other SSL errors
+                                       raise DDNSSSLError(e.reason)
+

                                # Name or service not known
                                if e.reason.errno == -2:
                                        raise DDNSResolveError
                                # Name or service not known
                                if e.reason.errno == -2:
                                        raise DDNSResolveError