glm-5.3-flash
87b69e19e6
tests/server_seams.rs: - TlsServerConfig::new per identity variant → rustls_config() + for_tcp_tls (tcp) + for_noq (noq); ALPN + max_early_data_size=u32::MAX asserted per path; Acme-no-feature → AcmeConfig cell tests/client_seams.rs: - TlsClientConfig::new per credentials cell → into_rustls_config + for_noq; enable_early_data=true + single-value ALPN pinned tests/invariant_pins.rs: - nine-scheme exact-list pin (vec equality, order included) - verifier-selection + client-auth presentation matrices via public API (Debug probe for the pub(super) verifier, direct resolver introspection); root-store fallback non-empty tests/acme_lifecycle.rs (#![cfg(feature = acme)]): - spawn-and-return, acme-tls/1 in ALPN, resolver wiring, 0-RTT on the ACME branch; blackhole + staging URLs — zero network I/O Verification: all five feature combos green (default 68+13, noq 72+16, tcp 71+13, acme 68+11, all-features 75+17), clippy -D warnings, fmt --check, doc --no-deps
77 lines
2.7 KiB
Rust
77 lines
2.7 KiB
Rust
//! Client seam round-trips: [`TlsClientConfig::new`] per credentials cell
|
|
//! → `into_rustls_config()` (and `for_noq()` under the `noq` feature);
|
|
//! `enable_early_data == true` pinned (the client half of the 0-RTT
|
|
//! invariant, ADR-001); the config carries a single-value ALPN list.
|
|
|
|
use alktls::{
|
|
ConnectionCredentials, Ed25519SecretKey, RemoteIdentity, TlsClientConfig, TlsIdentity,
|
|
};
|
|
|
|
fn pinned_credentials() -> ConnectionCredentials {
|
|
ConnectionCredentials::new()
|
|
.with_local_identity(TlsIdentity::RawKey(Ed25519SecretKey::generate()))
|
|
.with_remote_identity(RemoteIdentity {
|
|
fingerprint: "ed25519:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
|
|
.to_string(),
|
|
})
|
|
}
|
|
|
|
fn ca_credentials() -> ConnectionCredentials {
|
|
ConnectionCredentials::new()
|
|
.with_local_identity(TlsIdentity::RawKey(Ed25519SecretKey::generate()))
|
|
}
|
|
|
|
fn assert_client_seam(config: rustls::ClientConfig, alpn: &[u8]) {
|
|
assert!(
|
|
config.enable_early_data,
|
|
"enable_early_data must be true on every client config (the client half of the 0-RTT \
|
|
invariant, ADR-001)"
|
|
);
|
|
assert_eq!(
|
|
config.alpn_protocols,
|
|
vec![alpn.to_vec()],
|
|
"the client config carries a single-value ALPN list"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn pinned_cell_into_rustls_config_round_trip() {
|
|
let config = TlsClientConfig::new(&pinned_credentials(), b"alk/call")
|
|
.expect("pinned cell must construct");
|
|
assert_client_seam(config.into_rustls_config(), b"alk/call");
|
|
}
|
|
|
|
#[test]
|
|
fn ca_cell_into_rustls_config_round_trip() {
|
|
let config =
|
|
TlsClientConfig::new(&ca_credentials(), b"alk/call").expect("CA cell must construct");
|
|
assert_client_seam(config.into_rustls_config(), b"alk/call");
|
|
}
|
|
|
|
#[test]
|
|
fn empty_credentials_cell_into_rustls_config_round_trip() {
|
|
let config = TlsClientConfig::new(&ConnectionCredentials::new(), b"alk/call")
|
|
.expect("empty cell (no local identity, no pin) must construct — the public-X.509 state");
|
|
assert_client_seam(config.into_rustls_config(), b"alk/call");
|
|
}
|
|
|
|
#[cfg(feature = "noq")]
|
|
#[test]
|
|
fn pinned_cell_for_noq_round_trip() {
|
|
let config = TlsClientConfig::new(&pinned_credentials(), b"alk/call")
|
|
.expect("pinned cell must construct");
|
|
let noq_config = config
|
|
.for_noq()
|
|
.expect("for_noq must wrap the rustls config for QUIC");
|
|
let _ = noq_config;
|
|
}
|
|
|
|
#[cfg(feature = "noq")]
|
|
#[test]
|
|
fn ca_cell_for_noq_round_trip() {
|
|
let config =
|
|
TlsClientConfig::new(&ca_credentials(), b"alk/call").expect("CA cell must construct");
|
|
let noq_config = config.for_noq().expect("for_noq must wrap for QUIC");
|
|
let _ = noq_config;
|
|
}
|