Enum CallerClass 

pub enum CallerClass {
    OnBox,
    Lifeline,
    OperatorLan,
    Remote,
}

Who is on the other end of a request, derived once at the transport edge by classify_caller.

An unpaired node is a unit someone powered on and has not claimed yet, in a hangar, an office or a hotel. The obvious remedy for its exposure — bind only loopback and link-local until paired — cannot be used, and the reason is worth stating so nobody reaches for it again. A headless node has exactly two operator lifelines and NEITHER is loopback or link-local: the AP hotspot on 192.168.4.1 (the primary first-boot route) and the USB gadget on 192.168.7.1. Binding them away would leave a fresh unit reachable only from a shell the customer does not have. There is also no runtime re-bind: listeners are bound once at startup, so a bind keyed on pairing would need a service restart at the exact moment the operator is mid-claim on that socket.

So the gate is drawn at the caller, per request, where it follows pairing state in both directions with no restart. The honest limitation is that this is request-layer defence: the port stays open and a refused caller receives a refusal rather than finding nothing listening.

Variants

OnBox

A loopback peer whose request carries none of FORWARDED_HEADERS: the local operator (the ados CLI, a root-owned job), who already holds shell-level privilege that exceeds API auth.

Lifeline

A first-boot lifeline: IPv4/IPv6 link-local, or a peer reached through the agent’s own AP hotspot (192.168.4.1) or USB gadget (192.168.7.1) address. These are the surfaces a fresh unit is reached from and its PIN is first set on. The subnet alone is not enough: a home or office LAN can be numbered 192.168.4.0/24 too, and every host on it would otherwise be a lifeline.

OperatorLan

Any other RFC1918 private-LAN peer (10/8, 172.16/12, 192.168/16): plausibly the operator’s own browser on the local network rather than a public-WAN host. Trusted less than a lifeline: while unpaired the HTTP surface serves it data only behind a dashboard PIN session, and the direct MAVLink proxies do not serve it at all.

Remote

Everything else: a public-WAN host, ANY request that carries a proxy-forwarding header (a reverse proxy or tunnel, including one that terminates on this host’s loopback), or a caller whose address is unknown.

Implementations

impl CallerClass

pub fn is_first_boot_reach(self) -> bool

Whether this caller may reach an UNPAIRED node’s data plane with no credential at all: the local operator and the first-boot lifelines.

Trait Implementations

impl Clone for CallerClass

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for CallerClass

impl Debug for CallerClass

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for CallerClass

impl PartialEq for CallerClass

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for CallerClass