Beispiel
Resolve server certificates dynamically via ResolvesServerCertUsingSni validating strict DNS hostname mapping, certificate SAN enforcement, case-insensitivity, and fallback rejection
sha256:61ae3657305e22aefe406fd7c8abd3f00926b2f45287d1ebf2898bfbb4cf8964
PUBLISHED
L3_CONTRACT_PASS
MIT-0
Ausführungsbelege
Deklarierte Umgebung und signierte Prüfläufe werden getrennt dargestellt.
BeleggrundlageSignierter Vertrag bestanden
Verifizierungsbelege1
VerifizierungsstufeL3_CONTRACT_PASS
Deklarierte Umgebung
- Ausführungskontext
- rust
- Betriebssystem
- linux
- Architektur
- x64
- Runtime
- rust
- Sprache
- rust
- Paketmanager
- cargo
Umgebungen der Verifizierungsläufe
- Ausführungskontext
- rust 1
- Betriebssystem
- linux alpine · musl
- Architektur
- x64
- Runtime
- rust 1
- Sprache
- rust
- Paketmanager
- cargo
- Ausführung
- container · docker
CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · cargo@1 · 2026-08-17
Fall
- Ziel
- Resolve server certificates dynamically via ResolvesServerCertUsingSni validating strict DNS hostname mapping, certificate SAN enforcement, case-insensitivity, and fallback rejection HOW
- Pakete
-
rustls 0.23.43
- Umgebung
- rust
- Erstellt
- 2026-08-17T19:13:32Z
Häufige Annahme
ResolvesServerCertUsingSni accepts wildcard domain patterns or IP literals as registration keys and serves any mapped certificate without validating its Subject Alternative Names against the domain key
So hat der Autor des Samples festgehalten, was eine Entwicklerin oder ein Modell hier erwarten würde. Der Vertrag darunter ist das, was tatsächlich lief.
Contract
- rustls ResolvesServerCertUsingSni::add strictly rejects wildcard patterns and IP literals as registration keys and validates that the certified key's SAN matches the registered DNS domain
- ResolvesServerCertUsingSni::add returns Bad DNS name when registering wildcard pattern *.example.com or IP literal 192.0.2.1
- ResolvesServerCertUsingSni::add returns InvalidCertificate when certificate SAN api.example.com does not match domain key unrelated.example.org
- ResolvesServerCertUsingSni::add accepts wildcard certificate *.example.com for single-level sub.example.com but rejects apex example.com and deep.sub.example.com
- ServerConnection resolves exact matching certificate and case-insensitively resolves API.EXAMPLE.COM during in-memory TLS 1.3 handshake
- ServerConnection fails handshake with General("no server certificate chain resolved") when client sends unrecognized SNI or connects via IP literal without fallback resolver
Dateien
- Cargo.lock
- Cargo.toml
- NOTES.md
- csx.json
- src/lib.rs
Quellartefakt herunterladen (tar.gz)
Ursprungs-Seeder
csx-seed
Verifizierungsbelege
- rust 1 · linux alpine/x64 · docker · CONTAINER_RUN · compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS · cargo@1 · 2026-08-17 · ed25519:d91480838ac982c9