Struct PeerIdPinningVerifier 

pub struct PeerIdPinningVerifier { /* private fields */ }

A rustls ServerCertVerifier for the DIG self-authenticating overlay.

It does not validate a CA chain (DIG certs are self-signed and the key is the identity). It derives peer_id = SHA-256(SPKI DER) from the presented leaf, records it into Self::captured for the caller, and — when Self::expected is set — REJECTS the handshake unless the derived id matches. Signature checks (that the peer actually holds the private key for the presented key) are delegated to ring’s default crypto provider via Self::defaults.

Implementations

impl PeerIdPinningVerifier

pub fn new(expected: Option<PeerId>, captured: CapturedPeerId) -> Self

Build a verifier that pins expected (or accepts any peer when None) and writes the derived id into captured.

Trait Implementations

impl Debug for PeerIdPinningVerifier

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl ServerCertVerifier for PeerIdPinningVerifier

fn verify_server_cert( &self, end_entity: &CertificateDer<'_>, _intermediates: &[CertificateDer<'_>], _server_name: &ServerName<'_>, _ocsp_response: &[u8], _now: UnixTime, ) -> Result<ServerCertVerified, TlsError>

Verify the end-entity certificate end_entity is valid for the hostname dns_name and chains to at least one trust anchor.

fn verify_tls12_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, TlsError>

Verify a signature allegedly by the given server certificate.

fn verify_tls13_signature( &self, message: &[u8], cert: &CertificateDer<'_>, dss: &DigitallySignedStruct, ) -> Result<HandshakeSignatureValid, TlsError>

Verify a signature allegedly by the given server certificate.

fn supported_verify_schemes(&self) -> Vec<SignatureScheme>

Return the list of SignatureSchemes that this verifier will handle, in verify_tls12_signature and verify_tls13_signature calls.

fn requires_raw_public_keys(&self) -> bool

Returns whether this verifier requires raw public keys as defined in RFC 7250.

fn root_hint_subjects(&self) -> Option<&[DistinguishedName]>

Return the DistinguishedNames of certificate authorities that this verifier trusts.