snowflake-connector-python 3.7.1__tar.gz → 3.8.0__tar.gz

{snowflake-connector-python-3.7.1 → snowflake-connector-python-3.8.0}/DESCRIPTION.md

@@ -8,6 +8,26 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 
 # Release Notes
 
+- v3.8.0(April 04,2024)
+
+  - Improved `externalbrowser` auth in containerized environments
+    - Instruct browser to not fetch `/favicon` on success page
+    - Simple retry strategy on empty socket.recv
+    - Add `SNOWFLAKE_AUTH_SOCKET_REUSE_PORT` flag (usage: `SNOWFLAKE_AUTH_SOCKET_REUSE_PORT=true`) to set the underlying socket's `SO_REUSEPORT` flag (described in the [socket man page](https://man7.org/linux/man-pages/man7/socket.7.html))
+      - Useful when the randomized port used in the localhost callback url is being followed before the container engine completes port forwarding to host
+      - Statically map a port between your host and container and allow that port to be reused in rapid succession with:
+         `SF_AUTH_SOCKET_PORT=3037 SNOWFLAKE_AUTH_SOCKET_REUSE_PORT=true poetry run python somescript.py`
+    - Add `SNOWFLAKE_AUTH_SOCKET_MSG_DONTWAIT` flag (usage: `SNOWFLAKE_AUTH_SOCKET_MSG_DONTWAIT=true`) to make a non-blocking socket.recv call and retry on Error
+      - Consider using this if running in a containerized environment and externalbrowser auth frequently hangs while waiting for callback
+      - NOTE: this has not been tested extensively, but has been shown to improve the experience when using WSL
+  - Added support for parsing structured type information in schema queries.
+  - Bumped platformdirs from >=2.6.0,<4.0.0 to >=2.6.0,<5.0.0
+  - Updated diagnostics to use system$allowlist instead of system$whitelist.
+  - Updated `write_pandas` to skip TABLE IF NOT EXISTS in truncate mode.
+  - Improved cleanup logic for connection to rely on interpreter shutdown instead of the `__del__` method.
+  - Updated the logging level from INFO to DEBUG when logging the executed query using `SnowflakeCursor.execute`.
+  - Fixed a bug that the truncated password in log is not masked.
+
 - v3.7.1(February 21, 2024)
 
   - Bumped pandas dependency from >=1.0.0,<2.2.0 to >=1.0.0,<3.0.0.
@@ -62,6 +82,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added the `socket_timeout` argument to `snowflake.connector.connect` specifying socket read and connect timeout.
   - Fixed `login_timeout` and `network_timeout` behaviour. Retries of login and network requests are now properly halted after these timeouts expire.
   - Fixed bug for issue https://github.com/urllib3/urllib3/issues/1878 in vendored `urllib`.
+  - Add User-Agent header for diagnostic report for tracking.
 
 - v3.3.1(October 16,2023)
 

{snowflake-connector-python-3.7.1 → snowflake-connector-python-3.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: snowflake-connector-python
-Version: 3.7.1
+Version: 3.8.0
 Summary: Snowflake Connector for Python
 Home-page: https://www.snowflake.com/
 Author: Snowflake, Inc
@@ -54,7 +54,7 @@ Requires-Dist: certifi>=2017.4.17
 Requires-Dist: typing_extensions<5,>=4.3
 Requires-Dist: filelock<4,>=3.5
 Requires-Dist: sortedcontainers>=2.4.0
-Requires-Dist: platformdirs<4.0.0,>=2.6.0
+Requires-Dist: platformdirs<5.0.0,>=2.6.0
 Requires-Dist: tomlkit
 Provides-Extra: development
 Requires-Dist: Cython; extra == "development"
@@ -85,6 +85,26 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 
 # Release Notes
 
+- v3.8.0(April 04,2024)
+
+  - Improved `externalbrowser` auth in containerized environments
+    - Instruct browser to not fetch `/favicon` on success page
+    - Simple retry strategy on empty socket.recv
+    - Add `SNOWFLAKE_AUTH_SOCKET_REUSE_PORT` flag (usage: `SNOWFLAKE_AUTH_SOCKET_REUSE_PORT=true`) to set the underlying socket's `SO_REUSEPORT` flag (described in the [socket man page](https://man7.org/linux/man-pages/man7/socket.7.html))
+      - Useful when the randomized port used in the localhost callback url is being followed before the container engine completes port forwarding to host
+      - Statically map a port between your host and container and allow that port to be reused in rapid succession with:
+         `SF_AUTH_SOCKET_PORT=3037 SNOWFLAKE_AUTH_SOCKET_REUSE_PORT=true poetry run python somescript.py`
+    - Add `SNOWFLAKE_AUTH_SOCKET_MSG_DONTWAIT` flag (usage: `SNOWFLAKE_AUTH_SOCKET_MSG_DONTWAIT=true`) to make a non-blocking socket.recv call and retry on Error
+      - Consider using this if running in a containerized environment and externalbrowser auth frequently hangs while waiting for callback
+      - NOTE: this has not been tested extensively, but has been shown to improve the experience when using WSL
+  - Added support for parsing structured type information in schema queries.
+  - Bumped platformdirs from >=2.6.0,<4.0.0 to >=2.6.0,<5.0.0
+  - Updated diagnostics to use system$allowlist instead of system$whitelist.
+  - Updated `write_pandas` to skip TABLE IF NOT EXISTS in truncate mode.
+  - Improved cleanup logic for connection to rely on interpreter shutdown instead of the `__del__` method.
+  - Updated the logging level from INFO to DEBUG when logging the executed query using `SnowflakeCursor.execute`.
+  - Fixed a bug that the truncated password in log is not masked.
+
 - v3.7.1(February 21, 2024)
 
   - Bumped pandas dependency from >=1.0.0,<2.2.0 to >=1.0.0,<3.0.0.
@@ -139,6 +159,7 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
   - Added the `socket_timeout` argument to `snowflake.connector.connect` specifying socket read and connect timeout.
   - Fixed `login_timeout` and `network_timeout` behaviour. Retries of login and network requests are now properly halted after these timeouts expire.
   - Fixed bug for issue https://github.com/urllib3/urllib3/issues/1878 in vendored `urllib`.
+  - Add User-Agent header for diagnostic report for tracking.
 
 - v3.3.1(October 16,2023)
 

{snowflake-connector-python-3.7.1 → snowflake-connector-python-3.8.0}/setup.cfg

@@ -59,7 +59,7 @@ install_requires =
 	typing_extensions>=4.3,<5
 	filelock>=3.5,<4
 	sortedcontainers>=2.4.0
-	platformdirs>=2.6.0,<4.0.0
+	platformdirs>=2.6.0,<5.0.0
 	tomlkit
 include_package_data = True
 package_dir = 

{snowflake-connector-python-3.7.1 → snowflake-connector-python-3.8.0}/src/snowflake/connector/auth/webbrowser.py

@@ -10,13 +10,14 @@ import json
 import logging
 import os
 import secrets
+import select
 import socket
 import time
 import webbrowser
 from types import ModuleType
 from typing import TYPE_CHECKING, Any
 
-from ..compat import parse_qs, urlencode, urlparse, urlsplit
+from ..compat import IS_WINDOWS, parse_qs, urlencode, urlparse, urlsplit
 from ..constants import (
     HTTP_HEADER_ACCEPT,
     HTTP_HEADER_CONTENT_TYPE,
@@ -116,6 +117,15 @@ class AuthByWebBrowser(AuthByPlugin):
         logger.debug("authenticating by Web Browser")
 
         socket_connection = self._socket(socket.AF_INET, socket.SOCK_STREAM)
+
+        if os.getenv("SNOWFLAKE_AUTH_SOCKET_REUSE_PORT", "False").lower() == "true":
+            if IS_WINDOWS:
+                logger.warning(
+                    "Configuration SNOWFLAKE_AUTH_SOCKET_REUSE_PORT is not available in Windows. Ignoring."
+                )
+            else:
+                socket_connection.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEPORT, 1)
+
         try:
             try:
                 socket_connection.bind(
@@ -205,14 +215,68 @@ class AuthByWebBrowser(AuthByPlugin):
     def _receive_saml_token(self, conn: SnowflakeConnection, socket_connection) -> None:
         """Receives SAML token from web browser."""
         while True:
-            socket_client, _ = socket_connection.accept()
             try:
-                # Receive the data in small chunks and retransmit it
-                data = socket_client.recv(BUF_SIZE).decode("utf-8").split("\r\n")
+                attempts = 0
+                raw_data = bytearray()
+                socket_client = None
+                max_attempts = 15
+
+                msg_dont_wait = (
+                    os.getenv("SNOWFLAKE_AUTH_SOCKET_MSG_DONTWAIT", "false").lower()
+                    == "true"
+                )
+                if IS_WINDOWS:
+                    if msg_dont_wait:
+                        logger.warning(
+                            "Configuration SNOWFLAKE_AUTH_SOCKET_MSG_DONTWAIT is not available in Windows. Ignoring."
+                        )
+                    msg_dont_wait = False
+
+                # when running in a containerized environment, socket_client.recv ocassionally returns an empty byte array
+                #   an immediate successive call to socket_client.recv gets the actual data
+                while len(raw_data) == 0 and attempts < max_attempts:
+                    attempts += 1
+                    read_sockets, _write_sockets, _exception_sockets = select.select(
+                        [socket_connection], [], []
+                    )
+
+                    if read_sockets[0] is not None:
+                        # Receive the data in small chunks and retransmit it
+                        socket_client, _ = socket_connection.accept()
+
+                        try:
+                            if msg_dont_wait:
+                                # WSL containerized environment sometimes causes socket_client.recv to hang indefinetly
+                                #   To avoid this, passing the socket.MSG_DONTWAIT flag which raises BlockingIOError if
+                                #   operation would block
+                                logger.debug(
+                                    "Calling socket_client.recv with MSG_DONTWAIT flag due to SNOWFLAKE_AUTH_SOCKET_MSG_DONTWAIT env var"
+                                )
+                                raw_data = socket_client.recv(
+                                    BUF_SIZE, socket.MSG_DONTWAIT
+                                )
+                            else:
+                                raw_data = socket_client.recv(BUF_SIZE)
+
+                        except BlockingIOError:
+                            logger.debug(
+                                "BlockingIOError raised from socket.recv while attempting to retrieve callback token request"
+                            )
+                            if attempts < max_attempts:
+                                sleep_time = 0.25
+                                logger.debug(
+                                    f"Waiting {sleep_time} seconds before trying again"
+                                )
+                                time.sleep(sleep_time)
+                            else:
+                                logger.debug("Exceeded retry count")
+
+                data = raw_data.decode("utf-8").split("\r\n")
 
                 if not self._process_options(data, socket_client):
                     self._process_receive_saml_token(conn, data, socket_client)
                     break
+
             finally:
                 socket_client.shutdown(socket.SHUT_RDWR)
                 socket_client.close()
@@ -282,6 +346,7 @@ class AuthByWebBrowser(AuthByPlugin):
         else:
             msg = f"""
 <!DOCTYPE html><html><head><meta charset="UTF-8"/>
+<link rel="icon" href="data:,">
 <title>SAML Response for Snowflake</title></head>
 <body>
 Your identity was confirmed and propagated to Snowflake {self._application}.

{snowflake-connector-python-3.7.1 → snowflake-connector-python-3.8.0}/src/snowflake/connector/connection.py

@@ -5,6 +5,7 @@
 
 from __future__ import annotations
 
+import atexit
 import logging
 import os
 import pathlib
@@ -16,6 +17,7 @@ import warnings
 import weakref
 from concurrent.futures import as_completed
 from concurrent.futures.thread import ThreadPoolExecutor
+from contextlib import suppress
 from difflib import get_close_matches
 from functools import partial
 from io import StringIO
@@ -124,8 +126,10 @@ def DefaultConverterClass() -> type:
 
 def _get_private_bytes_from_file(
     private_key_file: str | bytes | os.PathLike[str] | os.PathLike[bytes],
-    private_key_file_pwd: bytes | None = None,
+    private_key_file_pwd: bytes | str | None = None,
 ) -> bytes:
+    if private_key_file_pwd is not None and isinstance(private_key_file_pwd, str):
+        private_key_file_pwd = private_key_file_pwd.encode("utf-8")
     with open(private_key_file, "rb") as key:
         private_key = serialization.load_pem_private_key(
             key.read(),
@@ -178,7 +182,7 @@ DEFAULT_CONFIGURATION: dict[str, tuple[Any, type | tuple[type, ...]]] = {
     "passcode": (None, (type(None), str)),  # Snowflake MFA
     "private_key": (None, (type(None), str, RSAPrivateKey)),
     "private_key_file": (None, (type(None), str)),
-    "private_key_file_pwd": (None, (type(None), str)),
+    "private_key_file_pwd": (None, (type(None), str, bytes)),
     "token": (None, (type(None), str)),  # OAuth or JWT Token
     "authenticator": (DEFAULT_AUTHENTICATOR, (type(None), str)),
     "mfa_callback": (None, (type(None), Callable)),
@@ -235,7 +239,11 @@ DEFAULT_CONFIGURATION: dict[str, tuple[Any, type | tuple[type, ...]]] = {
     "connection_diag_whitelist_path": (
         None,
         (type(None), str),
-    ),  # Path to connection diag whitelist json
+    ),  # Path to connection diag whitelist json - Deprecated remove in future
+    "connection_diag_allowlist_path": (
+        None,
+        (type(None), str),
+    ),  # Path to connection diag allowlist json
     "log_imported_packages_in_telemetry": (
         True,
         bool,
@@ -343,7 +351,8 @@ class SnowflakeConnection:
         enable_stage_s3_privatelink_for_us_east_1: when true, clients use regional s3 url to upload files.
         enable_connection_diag: when true, clients will generate a connectivity diagnostic report.
         connection_diag_log_path: path to location to create diag report with enable_connection_diag.
-        connection_diag_whitelist_path: path to a whitelist.json file to test with enable_connection_diag.
+        connection_diag_whitelist_path: path to a whitelist.json file to test with enable_connection_diag - deprecated remove in future
+        connection_diag_allowlist_path: path to a allowlist.json file to test with enable_connection_diag.
         json_result_force_utf8_decoding: When true, json result will be decoded in utf-8,
           when false, the encoding of the content is auto-detected. Default value is false.
           This parameter is only effective when the result format is JSON.
@@ -432,12 +441,8 @@ class SnowflakeConnection:
 
         # get the imported modules from sys.modules
         self._log_telemetry_imported_packages()
-
-    def __del__(self) -> None:  # pragma: no cover
-        try:
-            self.close(retry=False)
-        except Exception:
-            pass
+        # check SNOW-1218851 for long term improvement plan to refactor ocsp code
+        atexit.register(self._close_at_exit)
 
     @property
     def insecure_mode(self) -> bool:
@@ -655,8 +660,23 @@ class SnowflakeConnection:
 
     @property
     def connection_diag_whitelist_path(self):
+        """
+        Old version of ``connection_diag_allowlist_path``.
+        This used to be the original name, but snowflake backend
+        deprecated whitelist for allowlist. This name will be
+        deprecated in the future.
+        """
+        warnings.warn(
+            "connection_diag_whitelist_path has been deprecated, use connection_diag_allowlist_path instead",
+            DeprecationWarning,
+            stacklevel=2,
+        )
         return self._connection_diag_whitelist_path
 
+    @property
+    def connection_diag_allowlist_path(self):
+        return self._connection_diag_allowlist_path
+
     @arrow_number_to_decimal.setter
     def arrow_number_to_decimal_setter(self, value: bool) -> None:
         self._arrow_number_to_decimal = value
@@ -689,7 +709,9 @@ class SnowflakeConnection:
                 account=self.account,
                 host=self.host,
                 connection_diag_log_path=self.connection_diag_log_path,
-                connection_diag_whitelist_path=self.connection_diag_whitelist_path,
+                connection_diag_allowlist_path=self.connection_diag_allowlist_path
+                if self.connection_diag_allowlist_path is not None
+                else self.connection_diag_whitelist_path,
                 proxy_host=self.proxy_host,
                 proxy_port=self.proxy_port,
                 proxy_user=self.proxy_user,
@@ -720,6 +742,8 @@ class SnowflakeConnection:
 
     def close(self, retry: bool = True) -> None:
         """Closes the connection."""
+        # unregister to dereference connection object as it's already closed after the execution
+        atexit.unregister(self._close_at_exit)
         try:
             if not self.rest:
                 logger.debug("Rest object has been destroyed, cannot close session")
@@ -1747,6 +1771,10 @@ class SnowflakeConnection:
             )  # Prevent KeyError when multiple threads try to remove the same query id
             self._done_async_sfqids[sf_qid] = None
 
+    def _close_at_exit(self):
+        with suppress(Exception):
+            self.close(retry=False)
+
     def get_query_status(self, sf_qid: str) -> QueryStatus:
         """Retrieves the status of query with sf_qid.
 

{snowflake-connector-python-3.7.1 → snowflake-connector-python-3.8.0}/src/snowflake/connector/connection_diagnostic.py

@@ -18,6 +18,7 @@ from pathlib import Path
 from typing import Any, AnyStr
 from urllib.request import getproxies
 
+import certifi
 import OpenSSL
 
 from .compat import IS_WINDOWS, urlparse
@@ -30,8 +31,8 @@ if IS_WINDOWS:
     import winreg
 
 
-def _decode_dict(d):
-    result = {}
+def _decode_dict(d: dict[str, dict[str, Any]]):
+    result: dict[str, dict[str, Any]] = {}
     for key, value in d.items():
         if isinstance(key, bytes):
             key = key.decode()
@@ -43,6 +44,18 @@ def _decode_dict(d):
     return result
 
 
+def _is_list_of_json_objects(allowlist: List[Dict[str, Any]]):
+    if isinstance(allowlist, list) and all(
+        isinstance(item, dict) for item in allowlist
+    ):
+        try:
+            json.dumps(allowlist)
+            return True
+        except TypeError:
+            return False
+    return False
+
+
 class ConnectionDiagnostic:
     """Implementation of a connection test utility for Snowflake connector
 
@@ -54,7 +67,7 @@ class ConnectionDiagnostic:
         account: str,
         host: str,
         connection_diag_log_path: str | None = None,
-        connection_diag_whitelist_path: str | None = None,
+        connection_diag_allowlist_path: str | None = None,
         proxy_host: str | None = None,
         proxy_port: str | None = None,
         proxy_user: str | None = None,
@@ -117,9 +130,9 @@ class ConnectionDiagnostic:
             if connection_diag_log_path is not None
             else None
         )
-        self.full_connection_diag_whitelist_path: Path | None = (
-            Path(connection_diag_whitelist_path)
-            if connection_diag_whitelist_path is not None
+        self.full_connection_diag_allowlist_path: Path | None = (
+            Path(connection_diag_allowlist_path)
+            if connection_diag_allowlist_path is not None
             else None
         )
         self.tmpdir: str = tempfile.gettempdir()
@@ -142,35 +155,35 @@ class ConnectionDiagnostic:
         )
         logger.info(f"Reporting to file {self.report_file}")
 
-        if self.full_connection_diag_whitelist_path is not None:
-            if not self.full_connection_diag_whitelist_path.is_absolute():
+        if self.full_connection_diag_allowlist_path is not None:
+            if not self.full_connection_diag_allowlist_path.is_absolute():
                 logger.warning(
-                    f"Path '{self.full_connection_diag_whitelist_path}' for connection test whitelist is not absolute."
+                    f"Path '{self.full_connection_diag_allowlist_path}' for connection test allowlist is not absolute."
                 )
                 logger.warning(
-                    "Will connect to Snowflake for whitelist json instead.  If you did not provide a valid "
+                    "Will connect to Snowflake for allowlist json instead.  If you did not provide a valid "
                     "password, please make sure to update and run again."
                 )
-                self.full_connection_diag_whitelist_path = None
-            elif not self.full_connection_diag_whitelist_path.exists():
+                self.full_connection_diag_allowlist_path = None
+            elif not self.full_connection_diag_allowlist_path.exists():
                 logger.warning(
-                    f"File '{self.full_connection_diag_whitelist_path}' for connection test whitelist does not exist."
+                    f"File '{self.full_connection_diag_allowlist_path}' for connection test allowlist does not exist."
                 )
                 logger.warning(
-                    "Will connect to Snowflake for whitelist json instead.  If you did not provide a valid "
+                    "Will connect to Snowflake for allowlist json instead.  If you did not provide a valid "
                     "password, please make sure to update and run again."
                 )
-                self.full_connection_diag_whitelist_path = None
+                self.full_connection_diag_allowlist_path = None
 
-        self.whitelist_sql: str = "select /* snowflake-connector-python:connection_diagnostics */ system$whitelist();"
+        self.allowlist_sql: str = "select /* snowflake-connector-python:connection_diagnostics */ system$allowlist();"
 
         if self.__is_privatelink():
             self.ocsp_urls.append(f"ocsp.{self.host}")
-            self.whitelist_sql = "select system$whitelist_privatelink();"
+            self.allowlist_sql = "select system$allowlist_privatelink();"
         else:
             self.ocsp_urls.append("ocsp.snowflakecomputing.com")
 
-        self.whitelist_retrieval_success: bool = False
+        self.allowlist_retrieval_success: bool = False
         self.cursor: SnowflakeCursor | None = None
 
     def __parse_proxy(self, proxy_url: str) -> tuple[str, str, str, str]:
@@ -212,8 +225,20 @@ class ConnectionDiagnostic:
                     conn.recv(4096).decode("utf-8")
 
                 context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+                context.load_verify_locations(certifi.where())
                 sock = context.wrap_socket(conn, server_hostname=host)
                 certificate = ssl.DER_cert_to_PEM_cert(sock.getpeercert(True))
+                http_request = f"""GET / {host}:{port} HTTP/1.1\r\n
+                                   Host: {host}\r\n
+                                   User-Agent: snowflake-connector-python-diagnostic
+                                   \r\n\r\n"""
+                try:
+                    sock.send(str.encode(http_request))
+                except Exception as e:
+                    self.__append_message(
+                        host_type,
+                        f"{host}:{port}: URL Check: Failed: Unknown Exception: {e}",
+                    )
                 conn.close()
                 return certificate
             else:
@@ -260,37 +285,52 @@ class ConnectionDiagnostic:
         return "SUCCESS"
 
     def run_post_test(self) -> None:
-        results: list[str] = []
-        if self.full_connection_diag_whitelist_path is None:
+        results: list[str] = None
+        if self.full_connection_diag_allowlist_path is None:
             if self.cursor is not None:
                 try:
                     results = self.cursor.execute(
-                        self.whitelist_sql, _is_internal=True
+                        self.allowlist_sql, _is_internal=True
                     ).fetchall()[0][0]
                     results = json.loads(str(results))
-                    self.whitelist_retrieval_success = True
+                    self.allowlist_retrieval_success = True
                 except Exception as e:
-                    logger.warning(f"Unable to do whitelist checks: exception: {e}")
+                    logger.warning(f"Unable to do allowlist checks: exception: {e}")
         else:
-            results_file = open(self.full_connection_diag_whitelist_path)
-            results = json.load(results_file)
-            self.whitelist_retrieval_success = True
-
-        for result in results:
-            host_type = result["type"]
-            host = result["host"]
-            host_port = result["port"]
-
-            if host_type in ("OCSP_RESPONDER"):
-                if host not in self.ocsp_urls:
-                    self.__test_socket_get_cert(
-                        host, port=host_port, host_type=host_type
-                    )
-            elif host_type in ("STAGE", "OUT_OF_BAND_TELEMETRY"):
-                try:
-                    self.__https_host_report(host, port=host_port, host_type=host_type)
-                except Exception:
-                    pass
+            results_file = open(self.full_connection_diag_allowlist_path)
+            try:
+                results = json.load(results_file)
+                self.allowlist_retrieval_success = True
+            except Exception as e:
+                self.__append_message(
+                    "INITIAL",
+                    f"Allowlist was not valid json: '{e}'.  Please run 'select system$allowlist();' and validate the file {self.full_connection_diag_allowlist_path} is correct.",
+                )
+                pass
+
+        if _is_list_of_json_objects(results):
+            for result in results:
+                host_type = result["type"]
+                host = result["host"]
+                host_port = result["port"]
+
+                if host_type in ("OCSP_RESPONDER"):
+                    if host not in self.ocsp_urls:
+                        self.__test_socket_get_cert(
+                            host, port=host_port, host_type=host_type
+                        )
+                elif host_type in ("STAGE", "OUT_OF_BAND_TELEMETRY"):
+                    try:
+                        self.__https_host_report(
+                            host, port=host_port, host_type=host_type
+                        )
+                    except Exception:
+                        pass
+        else:
+            self.__append_message(
+                "INITIAL",
+                "Allowlist is not a valid list of json objects. Please run 'select system$allowlist();' and provide as a json file using the connection_diag_allowlist_path option.",
+            )
 
     def __is_privatelink(self) -> bool:
         return "privatelink" in self.host
@@ -490,23 +530,25 @@ class ConnectionDiagnostic:
         )
 
         check_pattern = f"(^{'|^'.join(cert_authorities)})"
-        issuer = self.__get_issuer_string(self.cert_info[self.host]["issuer"])
-        if not re.search(check_pattern, issuer):
-            self.__append_message(
-                host_type,
-                f"There is likely a proxy because the issuer for {self.host} is "
-                f"not correct. Got {issuer} and expected one of {cert_authorities}",
-            )
+        if self.host in self.cert_info.keys():
+            issuer = self.__get_issuer_string(self.cert_info[self.host]["issuer"])
+            if not re.search(check_pattern, issuer):
+                self.__append_message(
+                    host_type,
+                    f"There is likely a proxy because the issuer for {self.host} is "
+                    f"not correct. Got {issuer} and expected one of {cert_authorities}",
+                )
 
         test_host = "www.google.com"
         self.__https_host_report(test_host, port=443, host_type="IGNORE")
-        issuer = self.__get_issuer_string(self.cert_info[test_host]["issuer"])
-        if not re.search(check_pattern, issuer):
-            self.__append_message(
-                host_type,
-                f"There is likely a proxy because the issuer for {test_host} is "
-                f"not correct. Got {issuer} and expected one of {cert_authorities}",
-            )
+        if test_host in self.cert_info.keys():
+            issuer = self.__get_issuer_string(self.cert_info[test_host]["issuer"])
+            if not re.search(check_pattern, issuer):
+                self.__append_message(
+                    host_type,
+                    f"There is likely a proxy because the issuer for {test_host} is "
+                    f"not correct. Got {issuer} and expected one of {cert_authorities}",
+                )
 
         # Get Windows proxy info from Registry just in case:
         if IS_WINDOWS:
@@ -584,19 +626,19 @@ class ConnectionDiagnostic:
             f"{snowflake_url_joined_results}\n"
         )
 
-        if self.whitelist_retrieval_success:
+        if self.allowlist_retrieval_success:
             snowflake_stage_joined_results = "\n".join(self.test_results["STAGE"])
             message = (
                 f"{message}\n"
                 "=========Snowflake Stage information===================================\n"
-                "We retrieved stage info from the whitelist\n"
+                "We retrieved stage info from the allowlist\n"
                 f"{snowflake_stage_joined_results}\n"
             )
         else:
             message = (
                 f"{message}\n"
                 "=========Snowflake Stage information - Unavailable=====================\n"
-                "We could not connect to Snowflake to get whitelist, so we do not have stage\n"
+                "We could not connect to Snowflake to get allowlist, so we do not have stage\n"
                 f"diagnostic info\n"
             )
 
@@ -605,21 +647,21 @@ class ConnectionDiagnostic:
             "=========Snowflake OCSP information===================================="
         )
         snowflake_ocsp_joined_results = "\n".join(self.test_results["OCSP_RESPONDER"])
-        if self.whitelist_retrieval_success:
+        if self.allowlist_retrieval_success:
             message = (
                 f"{message}\n"
-                "We were able to retrieve system whitelist.\n"
-                "These OCSP hosts came from the certificate and the whitelist."
+                "We were able to retrieve system allowlist.\n"
+                "These OCSP hosts came from the certificate and the allowlist."
             )
         else:
             message = (
                 f"{message}\n"
-                "We were unable to retrieve system whitelist.\n"
+                "We were unable to retrieve system allowlist.\n"
                 "These OCSP hosts only came from the certificate."
             )
         message = f"{message}\n" f"{snowflake_ocsp_joined_results}\n"
 
-        if self.whitelist_retrieval_success:
+        if self.allowlist_retrieval_success:
             snowflake_telemetry_joined_results = "\n".join(
                 self.test_results["OUT_OF_BAND_TELEMETRY"]
             )