0.34.6_repo_cleanup

src/tls/server_config.rs

@@ -1,7 +1,3 @@
-/// Extract the DNS SubjectAltName set from the leaf certificate. This parser is
-/// deliberately narrow: it walks only the DER structures required to locate the
-/// SAN extension and ignores non-DNS GeneralName variants. Certificate validity
-/// and key matching are still delegated to rustls.
 fn certificate_dns_names(certificate: &[u8]) -> Result<Vec<String>> {
     let mut reader = certificate;
     let certs = rustls_pemfile::certs(&mut reader).collect::<io::Result<Vec<_>>>()?;
@@ -22,7 +18,6 @@ fn certificate_dns_names(certificate: &[u8]) -> Result<Vec<String>> {
     if tbs.first() == Some(&0xa0) {
         let _ = der_tlv(tbs, &mut tbs_offset)?;
     }
-    // serialNumber, signature, issuer, validity, subject, subjectPublicKeyInfo
     for _ in 0..6 {
         let _ = der_tlv(tbs, &mut tbs_offset)?;
     }
@@ -306,16 +301,11 @@ fn certificate_public_metadata(certificate: &[u8]) -> Result<CertificateMetadata
     })
 }
 
-/// Read DNS SubjectAltName coverage directly from an existing certificate file.
-/// Used by the authenticated certificate inventory to enrich older/manual entries
-/// that predate persisted `covered_hosts` metadata. Private key material is not read.
 pub fn certificate_covered_hosts(directory: &Path, cert_file: &str) -> Result<Vec<String>> {
     let certificate = read_configured_pem(directory, cert_file, false)?;
     certificate_dns_names(&certificate)
 }
 
-/// Read non-secret metadata directly from the configured public leaf certificate.
-/// Private keys are never opened by this path.
 pub fn certificate_metadata(directory: &Path, cert_file: &str) -> Result<CertificateMetadata> {
     let certificate = read_configured_pem(directory, cert_file, false)?;
     certificate_public_metadata(&certificate)
@@ -344,7 +334,6 @@ fn load_pair(directory: &Path, cert: &str, key: &str) -> Result<CertifiedKey> {
         &read_configured_pem(directory, key, true)?,
     )
 }
-/// Runs on a bounded control-plane blocking worker, never from a handshake.
 pub fn compile(settings: &Settings, directory: Option<&Path>) -> Result<Option<Arc<ServerConfig>>> {
     settings.policy.validate()?;
     let Some(directory) = directory else {
@@ -365,9 +354,6 @@ pub fn compile(settings: &Settings, directory: Option<&Path>) -> Result<Option<A
         for host in &cert.hosts {
             let host = normalize_host_pattern(host)?;
             ensure!(hosts.insert(host.clone()), "duplicate TLS hostname binding");
-            // Validate certificate/name compatibility with a concrete SNI name.
-            // rustls' stock resolver does not model routing wildcard precedence,
-            // so the immutable RustProxy resolver below owns exact/wildcard lookup.
             let validation_name = host
                 .strip_prefix("*.")
                 .map(|base| format!("rustproxy-wildcard-check.{base}"))
@@ -404,8 +390,6 @@ pub fn compile(settings: &Settings, directory: Option<&Path>) -> Result<Option<A
     )?))
 }
 
-/// Reuse the already validated immutable certificate resolver while narrowing
-/// protocols/ciphers for one frontend. No certificate I/O occurs here.
 pub fn variant(
     base: &Arc<ServerConfig>,
     policy: &ProtocolPolicy,