Enum HandshakeRelayClassification 

pub enum HandshakeRelayClassification {
    Unclassified,
    Transport,
    TlsProtocol,
    CertTrust,
}

Available on crate feature boring only.

Classification of a handshake-time failure.

Designed so callers can mix-and-match against direction (via TlsMitmRelayError::direction) to express policy. The intended shape for an MITM relay caching SNI bypass exceptions is:

match (err.kind(), err.direction()) {
    (TlsMitmRelayErrorKind::Handshake {
        classification: HandshakeRelayClassification::CertTrust, ..
    }, Some(TlsMitmRelayErrorDirection::Ingress)) => {
        // peer's trust store doesn't include our CA — cache SNI bypass
    }
    _ => { /* don't cache; log/event per classification */ }
}

Variants

Unclassified

No recognizable signal (e.g. builder-style error with no SSL code, no io::Error, no error stack).

Transport

Transport-layer failure during handshake. Covers both real io::Errors (TCP RST, ECONNRESET, broken pipe, EOF with errno) and the SSL_ERROR_SYSCALL-with-empty-error-queue case (peer FIN’d mid-handshake without sending a TLS alert). In neither case did the peer engage with us at TLS protocol layer.

TlsProtocol

Peer / library engaged at TLS protocol layer and the handshake failed there. Covers any peer-sent alert (handshake_failure, protocol_version, decrypt_error, internal_error, …), any library protocol error (WRONG_VERSION_NUMBER, NO_SHARED_CIPHER, DOWNGRADE_DETECTED, …), and any cert-shaped error that is not a trust outcome — cert format, protocol, or config mismatches (CERT_LENGTH_MISMATCH, BAD_ECC_CERT, CERTIFICATE_AND_PRIVATE_KEY_MISMATCH, UNSUPPORTED_CERTIFICATE, CERTIFICATE_REQUIRED, …).

CertTrust

Trust-outcome failure: the peer’s TLS stack rejected our cert chain as untrusted, or our local verifier rejected the peer’s chain. Matches:

• Peer alerts that signal trust validation failure: unknown_ca, bad_certificate, certificate_expired, certificate_revoked, certificate_unknown.
• Library validation outcomes: CERTIFICATE_VERIFY_FAILED, NO_MATCHING_ISSUER (and OpenSSL-compatible *untrusted*).

This is the only classification where caching an SNI bypass exception is meaningful — it indicates a structural trust mismatch (e.g. our managed CA is not in the peer’s trust store) that will not clear up on retry.

Trait Implementations

impl Clone for HandshakeRelayClassification

fn clone(&self) -> HandshakeRelayClassification

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HandshakeRelayClassification

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl PartialEq for HandshakeRelayClassification

fn eq(&self, other: &HandshakeRelayClassification) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Copy for HandshakeRelayClassification

impl Eq for HandshakeRelayClassification

impl StructuralPartialEq for HandshakeRelayClassification