search

nabla-c0d3 / sslyze

Fast and powerful SSL/TLS scanning library.
GNU Affero General Public License v3.0
3.25k stars 446 forks source link

Support method extract_dns_subject_alternative_names #651

Closed msuliq closed 3 months ago

msuliq commented 3 months ago

Reintroduce extract_dns_subject_alternative_names Method for Compatibility with Legacy Systems

This PR reinstates the extract_dns_subject_alternative_names method, which was part of the library up to version 5.0.6 inclusive. The method was deprecated and subsequently removed in favor of parse_subject_alternative_name_extension, but with this PR it be added back, however it will be using the existing code of parse_subject_alternative_name_extension instead of the deprecated method contents in order to benefit from better handling of Subject Alternative Names (SAN) in X.509 certificates. Reintroducing this method, will allow to support legacy systems that still depend on the extract_dns_subject_alternative_names method and will ease upgrade of the sslyze and dependencies, e.g. cryptography for more enhanced and robust security.

Changes Introduced

Add new method extract_dns_subject_alternative_names that shares name with deprecated method and utilizes functionality of parse_subject_alternative_name_extension to ensure consistency and maintainability. Method extract_dns_subject_alternative_names calls parse_subject_alternative_name_extension and extracts only DNS names, ensuring it functions similarly to the original method but aligns with the new code design.

def extract_dns_subject_alternative_names(certificate: Certificate) -> List[str]:
    san_extension = parse_subject_alternative_name_extension(certificate)
    return san_extension.dns_names
nabla-c0d3 commented 3 months ago

Hello !

Thanks for your contribution.

However, I will not merge it because extract_dns_subject_alternative_names() was never part of SSLyze's public API (for example it is located in a file that starts with _ ie. "_certificate_utils.py" to indicate that).

Functions that are not part of the public API are not guaranteed to stay the same and keeping API-compatibility for all functions in SSLyze (including the private ones) would be too much work.