Rewrite the pyOpenSSL implementation in terms of the cryptography one

src/service_identity/pyopenssl.py

@@ -9,20 +9,11 @@
 
 from typing import Sequence
 
-from pyasn1.codec.der.decoder import decode
-from pyasn1.type.char import IA5String
-from pyasn1.type.univ import ObjectIdentifier
-from pyasn1_modules.rfc2459 import GeneralNames
-
-from .exceptions import CertificateError
+from .cryptography import extract_patterns
 from .hazmat import (
     DNS_ID,
     CertificatePattern,
-    DNSPattern,
     IPAddress_ID,
-    IPAddressPattern,
-    SRVPattern,
-    URIPattern,
     verify_service_identity,
 )
 
@@ -62,7 +53,7 @@ def verify_hostname(connection: Connection, hostname: str) -> None:
     """
     verify_service_identity(
         cert_patterns=extract_patterns(
-            connection.get_peer_certificate()  # type:ignore[arg-type]
+            connection.get_peer_certificate().to_cryptography()  # type:ignore[union-attr]
         ),
         obligatory_ids=[DNS_ID(hostname)],
         optional_ids=[],
@@ -98,77 +89,21 @@ def verify_ip_address(connection: Connection, ip_address: str) -> None:
     """
     verify_service_identity(
         cert_patterns=extract_patterns(
-            connection.get_peer_certificate()  # type:ignore[arg-type]
+            connection.get_peer_certificate().to_cryptography()  # type:ignore[union-attr]
         ),
         obligatory_ids=[IPAddress_ID(ip_address)],
         optional_ids=[],
     )
 
 
-ID_ON_DNS_SRV = ObjectIdentifier("1.3.6.1.5.5.7.8.7")  # id_on_dnsSRV
-
-
-def extract_patterns(cert: X509) -> Sequence[CertificatePattern]:
-    """
-    Extract all valid ID patterns from a certificate for service verification.
-
-    Args:
-        cert: The certificate to be dissected.
-
-    Returns:
-        List of IDs.
-
-    .. versionchanged:: 23.1.0
-       ``commonName`` is not used as a fallback anymore.
-    """
-    ids: list[CertificatePattern] = []
-    for i in range(cert.get_extension_count()):
-        ext = cert.get_extension(i)
-        if ext.get_short_name() == b"subjectAltName":
-            names, _ = decode(ext.get_data(), asn1Spec=GeneralNames())
-            for n in names:
-                name_string = n.getName()
-                if name_string == "dNSName":
-                    ids.append(
-                        DNSPattern.from_bytes(n.getComponent().asOctets())
-                    )
-                elif name_string == "iPAddress":
-                    ids.append(
-                        IPAddressPattern.from_bytes(
-                            n.getComponent().asOctets()
-                        )
-                    )
-                elif name_string == "uniformResourceIdentifier":
-                    ids.append(
-                        URIPattern.from_bytes(n.getComponent().asOctets())
-                    )
-                elif name_string == "otherName":
-                    comp = n.getComponent()
-                    oid = comp.getComponentByPosition(0)
-                    if oid == ID_ON_DNS_SRV:
-                        srv, _ = decode(comp.getComponentByPosition(1))
-                        if isinstance(srv, IA5String):
-                            ids.append(SRVPattern.from_bytes(srv.asOctets()))
-                        else:  # pragma: no cover
-                            msg = "Unexpected certificate content."
-                            raise CertificateError(msg)
-                    else:  # pragma: no cover
-                        pass
-                else:  # pragma: no cover
-                    pass
-
-    return ids
-
-
 def extract_ids(cert: X509) -> Sequence[CertificatePattern]:
     """
     Deprecated and never public API.  Use :func:`extract_patterns` instead.
-
     .. deprecated:: 23.1.0
     """
     warnings.warn(
         category=DeprecationWarning,
         message="`extract_ids()` is deprecated, please use `extract_patterns()`.",
         stacklevel=2,
     )
-    return extract_patterns(cert)
+    return extract_patterns(cert.to_cryptography())