Module auth 

Client certificate authentication checks.

Policy-free building blocks used by the broker: name matching against the subject CN or a SAN kind, thumbprint allow-lists and validity period checks. Trust (chain) verification is in crate::x509::trust. Every failure is a distinct Failure so callers can map it to their own error codes.

Decisions:

• Name comparison is case-insensitive (Unicode lowercase of both sides).
• Subject matching uses the first CN attribute only.
• SAN matching succeeds if any entry of the kind matches.
• IP matching compares parsed addresses (::0:1 equals ::1); SAN IP entries that are not 4 or 16 octets are ignored when matching, but rejected by field.
• Thumbprints are hex, compared case-insensitively; exactly 40 characters selects SHA-1, anything else SHA-256 (see crate::x509::digest::Algorithm::for_hex_thumbprint).

Enums

Failure

Authentication check failure.

NameField

Certificate field used as the client name.

Functions

field

Returns the client name stored in the certificate field, lowercased.

name_matches

Checks that name matches the certificate field.

thumbprint_matches

Returns true if any of the hex thumbprints matches the certificate.

validity

Checks that now is within the certificate validity period (bounds inclusive) and returns notAfter.

verify_thumbprint

Checks validity period and thumbprint allow-list, returns notAfter.