Simplify delegation of rust for extension parsing (#6075)

Also now supports part openssl/part rust setups

4 files changed, 15 insertions, 32 deletions

diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
index 448bd6824..8ab05ffb1 100644
--- a/src/cryptography/hazmat/backends/openssl/backend.py
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
@@ -85,7 +85,11 @@ from cryptography.hazmat.backends.openssl.x509 import (
     _CertificateSigningRequest,
     _RevokedCertificate,
 )
-from cryptography.hazmat.bindings._rust import asn1, ocsp as rust_ocsp
+from cryptography.hazmat.bindings._rust import (
+    asn1,
+    ocsp as rust_ocsp,
+    x509 as rust_x509,
+)
 from cryptography.hazmat.bindings.openssl import binding
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import (
@@ -398,6 +402,7 @@ class Backend(BackendInterface):
             ext_count=self._lib.X509_get_ext_count,
             get_ext=self._lib.X509_get_ext,
             handlers=ext_handlers,
+            rust_callback=rust_x509.parse_x509_extension,
         )
         self._csr_extension_parser = _X509ExtensionParser(
             self,
diff --git a/src/cryptography/hazmat/backends/openssl/decode_asn1.py b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
index eb384263d..efa4dd14f 100644
--- a/src/cryptography/hazmat/backends/openssl/decode_asn1.py
+++ b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
@@ -8,7 +8,6 @@ import ipaddress
 import typing
 
 from cryptography import x509
-from cryptography.hazmat.bindings._rust import asn1
 from cryptography.x509.name import _ASN1_TYPE_TO_ENUM
 from cryptography.x509.oid import (
     CRLEntryExtensionOID,
@@ -178,7 +177,7 @@ def _decode_delta_crl_indicator(backend, ext):
 
 class _X509ExtensionParser(object):
     def __init__(
-        self, backend, ext_count, get_ext, handlers=None, rust_callback=None
+        self, backend, ext_count, get_ext, handlers={}, rust_callback=None
     ):
         assert handlers or rust_callback
         self.ext_count = ext_count
@@ -214,33 +213,11 @@ class _X509ExtensionParser(object):
                 )[:]
                 data = self._backend._lib.X509_EXTENSION_get_data(ext)
                 data_bytes = _asn1_string_to_bytes(self._backend, data)
-                ext = self.rust_callback(oid_der_bytes, data_bytes)
-                extensions.append(x509.Extension(oid, critical, ext))
-                seen_oids.add(oid)
-                continue
-
-            # These OIDs are only supported in OpenSSL 1.1.0+ but we want
-            # to support them in all versions of OpenSSL so we decode them
-            # ourselves.
-            if oid == ExtensionOID.TLS_FEATURE:
-                # The extension contents are a SEQUENCE OF INTEGERs.
-                data = self._backend._lib.X509_EXTENSION_get_data(ext)
-                data_bytes = _asn1_string_to_bytes(self._backend, data)
-                tls_feature = asn1.parse_tls_feature(data_bytes)
-
-                extensions.append(x509.Extension(oid, critical, tls_feature))
-                seen_oids.add(oid)
-                continue
-            elif oid == ExtensionOID.PRECERT_POISON:
-                data = self._backend._lib.X509_EXTENSION_get_data(ext)
-                data_bytes = _asn1_string_to_bytes(self._backend, data)
-                precert_poison = asn1.parse_precert_poison(data_bytes)
-
-                extensions.append(
-                    x509.Extension(oid, critical, precert_poison)
-                )
-                seen_oids.add(oid)
-                continue
+                ext_obj = self.rust_callback(oid_der_bytes, data_bytes)
+                if ext_obj is not None:
+                    extensions.append(x509.Extension(oid, critical, ext_obj))
+                    seen_oids.add(oid)
+                    continue
 
             try:
                 handler = self.handlers[oid]
diff --git a/src/cryptography/hazmat/bindings/_rust/asn1.pyi b/src/cryptography/hazmat/bindings/_rust/asn1.pyi
index bd73221ba..680927101 100644
--- a/src/cryptography/hazmat/bindings/_rust/asn1.pyi
+++ b/src/cryptography/hazmat/bindings/_rust/asn1.pyi
@@ -11,8 +11,6 @@ class TestCertificate:
 def decode_dss_signature(signature: bytes) -> typing.Tuple[int, int]: ...
 def encode_dss_signature(r: int, s: int) -> bytes: ...
 def encode_tls_feature(ext: TLSFeature) -> bytes: ...
-def parse_tls_feature(data: bytes) -> TLSFeature: ...
 def encode_precert_poison(ext: PrecertPoison) -> bytes: ...
-def parse_precert_poison(data: bytes) -> PrecertPoison: ...
 def parse_spki_for_data(data: bytes) -> bytes: ...
 def test_parse_certificate(data: bytes) -> TestCertificate: ...
diff --git a/src/cryptography/hazmat/bindings/_rust/x509.pyi b/src/cryptography/hazmat/bindings/_rust/x509.pyi
new file mode 100644
index 000000000..d1e26e0b1
--- /dev/null
+++ b/src/cryptography/hazmat/bindings/_rust/x509.pyi
@@ -0,0 +1,3 @@
+from cryptography.x509 import ExtensionType
+
+def parse_x509_extension(der_oid: bytes, ext_data: bytes) -> ExtensionType: ...