rustls 0.23.43: Managing rustls ClientConnection I/O where reader().read() returns WouldBlock until process_new_packets decrypts buffered read_tls records.

# This file is automatically @generated by Cargo.
# It is not intended for manual editing.
version = 4

[[package]]
name = "cargo-rustls-api"
version = "0.1.0"
dependencies = [
 "rustls",
]

[[package]]
name = "cc"
version = "1.4.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "509591b7bcd67f4ef775afad7662703b4935daaa6ec0e5605cfb1090b32a2b6d"
dependencies = [
 "find-msvc-tools",
 "shlex",
]

[[package]]
name = "cfg-if"
version = "1.0.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

[[package]]
name = "find-msvc-tools"
version = "0.1.11"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d45db016d36b838f563236e9193d0ee6ce38f3f68b6c94e914b4929c96bbb890"

[[package]]
name = "getrandom"
version = "0.2.17"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
dependencies = [
 "cfg-if",
 "libc",
 "wasi",
]

[[package]]
name = "libc"
version = "0.2.189"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"

[[package]]
name = "once_cell"
version = "1.21.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"

[[package]]
name = "ring"
version = "0.17.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a4689e6c2294d81e88dc6261c768b63bc4fcdb852be6d1352498b114f61383b7"
dependencies = [
 "cc",
 "cfg-if",
 "getrandom",
 "libc",
 "untrusted",
 "windows-sys",
]

[[package]]
name = "rustls"
version = "0.23.43"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06"
dependencies = [
 "once_cell",
 "ring",
 "rustls-pki-types",
 "rustls-webpki",
 "subtle",
 "zeroize",
]

[[package]]
name = "rustls-pki-types"
version = "1.15.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "2f4925028c7eb5d1fcdaf196971378ed9d2c1c4efc7dc5d011256f76c99c0a96"
dependencies = [
 "zeroize",
]

[[package]]
name = "rustls-webpki"
version = "0.103.14"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0527518605e68109d875e248ea259b6758801cf165e4b2c2733ae3b51f12535a"
dependencies = [
 "ring",
 "rustls-pki-types",
 "untrusted",
]

[[package]]
name = "shlex"
version = "2.0.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba"

[[package]]
name = "subtle"
version = "2.6.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"

[[package]]
name = "untrusted"
version = "0.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8ecb6da28b8a351d773b68d5825ac39017e680750f980f3a1a85cd8dd28a47c1"

[[package]]
name = "wasi"
version = "0.11.1+wasi-snapshot-preview1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ccf3ec651a847eb01de73ccad15eb7d99f80485de043efb2f370cd654f4ea44b"

[[package]]
name = "windows-sys"
version = "0.52.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
dependencies = [
 "windows-targets",
]

[[package]]
name = "windows-targets"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
dependencies = [
 "windows_aarch64_gnullvm",
 "windows_aarch64_msvc",
 "windows_i686_gnu",
 "windows_i686_gnullvm",
 "windows_i686_msvc",
 "windows_x86_64_gnu",
 "windows_x86_64_gnullvm",
 "windows_x86_64_msvc",
]

[[package]]
name = "windows_aarch64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"

[[package]]
name = "windows_aarch64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"

[[package]]
name = "windows_i686_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"

[[package]]
name = "windows_i686_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"

[[package]]
name = "windows_i686_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"

[[package]]
name = "windows_x86_64_gnu"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"

[[package]]
name = "windows_x86_64_gnullvm"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"

[[package]]
name = "windows_x86_64_msvc"
version = "0.52.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

[[package]]
name = "zeroize"
version = "1.9.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e13c156562582aa81c60cb29407084cdb54c4164760106ab78e6c5b0858cf64e"

[package]
name = "cargo-rustls-api"
version = "0.1.0"
edition = "2021"

[dependencies]
rustls = { version = "0.23", default-features = false, features = ["std", "ring"] }

`search_known_solution` returned existing sample `sha256:eca9120e191da6b23a342f6ef4570faf9508777f0595b9ed1627910a607ad1d5` covering `CryptoProvider::install_default()` locking traps.
A model would call `conn.read_tls(&mut socket)` and immediately invoke `conn.reader().read(&mut buf)` expecting plaintext bytes, while assuming `conn.writer().write_all(data)` sends bytes directly onto the network transport.
`conn.reader().read()` fails at runtime with `ErrorKind::WouldBlock` causing application deadlocks or panics, while `conn.writer().write_all()` silently retains bytes in memory with a green build without sending anything over the wire until `conn.write_tls()` is explicitly called.

{"case":{"caseId":"case:sha256:9e67f2ac8d990a1c780ef3718bf4415fb5b0afe5ac39ec1969d08ed211d58ec3","contract":["assert client.writer().write_all() buffers in memory without writing bytes to transport until write_tls() is called","assert client.read_tls() pulls raw TLS records but reader().read() yields WouldBlock until process_new_packets() is called","assert process_new_packets() parses TLS record headers and rejects invalid messages that read_tls() accepts","assert ServerName::try_from() rejects hostnames with ports or schemes but parses IP addresses as ServerName::IpAddress","assert RootCertStore::add_parsable_certificates() returns a (valid, ignored) tuple count instead of returning an Err"],"goal":"Managing rustls ClientConnection I/O where reader().read() returns WouldBlock until process_new_packets decrypts buffered read_tls records.","kind":"HOW","packages":["pkg:cargo/rustls@0.23.43"],"schemaVersion":1,"symbols":["rustls::ClientConnection::read_tls","rustls::ClientConnection::process_new_packets","rustls::ClientConnection::reader","rustls::ClientConnection::writer","rustls::ClientConnection::write_tls","rustls::pki_types::ServerName::try_from","rustls::RootCertStore::add_parsable_certificates"]},"contractCommand":["cargo","test","--offline"],"environment":{"arch":"x64","ecosystem":"cargo","executionContext":"rust","language":"rust","os":"linux","packageManager":"cargo","runtime":"rust","schemaVersion":1},"license":"MIT-0","packages":["pkg:cargo/rustls@0.23.43"],"schemaVersion":1,"symbols":["rustls::ClientConnection::read_tls","rustls::ClientConnection::process_new_packets","rustls::ClientConnection::reader","rustls::ClientConnection::writer","rustls::ClientConnection::write_tls","rustls::pki_types::ServerName::try_from","rustls::RootCertStore::add_parsable_certificates"],"verifierAdapter":"cargo@1"}

#[cfg(test)]
mod tests {
    use std::io::{Cursor, ErrorKind, Read, Write};
    use std::sync::Arc;
    use rustls::pki_types::{CertificateDer, DnsName, ServerName};
    use rustls::{ClientConfig, ClientConnection, RootCertStore};

    #[test]
    fn test_client_connection_io_state_machine() {
        let roots = RootCertStore::empty();
        let mut config = ClientConfig::builder()
            .with_root_certificates(roots)
            .with_no_client_auth();

        // ALPN configuration takes raw byte strings, NOT length-prefixed OpenSSL wire format
        config.alpn_protocols = vec![b"h2".to_vec(), b"http/1.1".to_vec()];
        let config = Arc::new(config);

        // ServerName parsing trap: hostnames cannot include scheme or port
        assert!(ServerName::try_from("example.com").is_ok());
        assert!(ServerName::try_from("example.com:443").is_err(), "Port in ServerName must fail");
        assert!(ServerName::try_from("https://example.com").is_err(), "Scheme in ServerName must fail");
        assert!(DnsName::try_from("192.0.2.1").is_err(), "IP address is not a valid DnsName");
        assert!(ServerName::try_from("192.0.2.1").is_ok(), "IP address parses as ServerName::IpAddress");

        let server_name: ServerName = "example.com".try_into().unwrap();
        let mut client = ClientConnection::new(config, server_name).unwrap();

        // 1. Outgoing writes: writer().write_all() buffers in memory only
        let mut transport = Vec::new();
        client.writer().write_all(b"GET / HTTP/1.1\r\n\r\n").unwrap();
        assert_eq!(transport.len(), 0, "writer().write_all() MUST NOT write to transport directly");
        assert!(client.wants_write(), "wants_write MUST be true when records are buffered");

        // Flushing outgoing records via write_tls writes to transport
        let tls_written = client.write_tls(&mut transport).unwrap();
        assert!(tls_written > 0);
        assert_eq!(transport.len(), tls_written);
        // TLS record content type: 0x16 is Handshake (ClientHello)
        assert_eq!(transport[0], 0x16);

        // 2. Incoming reads: read_tls pulls raw TLS records, but does NOT make plaintext available
        let fake_server_records = vec![0x16, 0x03, 0x03, 0x00, 0x05, 0x01, 0x02, 0x03, 0x04, 0x05];
        let mut in_transport = Cursor::new(fake_server_records);

        let bytes_read = client.read_tls(&mut in_transport).unwrap();
        assert_eq!(bytes_read, 10, "read_tls pulls raw wire bytes successfully");

        // A naive model calls reader().read() immediately after read_tls(), expecting plaintext or Ok(0):
        let mut buf = [0u8; 64];
        let read_res = client.reader().read(&mut buf);
        assert!(read_res.is_err(), "reader().read() MUST fail before process_new_packets()");
        assert_eq!(
            read_res.unwrap_err().kind(),
            ErrorKind::WouldBlock,
            "reader() returns WouldBlock until process_new_packets() decrypts records"
        );

        // 3. Deferred validation: read_tls does NOT validate record syntax or cryptography;
        // only process_new_packets() decodes and rejects corrupt messages:
        let process_res = client.process_new_packets();
        assert!(
            process_res.is_err(),
            "process_new_packets() MUST catch invalid/unexpected TLS records"
        );
        assert!(matches!(process_res.unwrap_err(), rustls::Error::InvalidMessage(_)));
    }

    #[test]
    fn test_root_cert_store_add_parsable_silently_ignores_failures() {
        let mut roots = RootCertStore::empty();
        let malformed_der = CertificateDer::from(vec![0x30, 0x01, 0x00]);

        // Trap: add_parsable_certificates returns a (valid, ignored) tuple count, NOT a Result:
        let (added, ignored) = roots.add_parsable_certificates(vec![malformed_der.clone()]);
        assert_eq!(added, 0, "Malformed cert was not added");
        assert_eq!(ignored, 1, "Malformed cert was counted as ignored");
        assert!(roots.is_empty(), "Store is silently empty without returning an Err");

        // In contrast, add() returns Result<(), rustls::Error>:
        let add_res = roots.add(malformed_der);
        assert!(add_res.is_err(), "add() returns an Err on invalid DER");
    }
}