Struct ResolvedDestination 

pub struct ResolvedDestination { /* private fields */ }

A normalized host and the exact address set that passed network policy.

Callers must dial Self::addresses directly. Resolving Self::host again would reopen the DNS-rebinding window this type closes, so the type deliberately offers no way to get from a value back to a fresh resolution.

Implementations

impl ResolvedDestination

pub fn new( host: &str, port: u16, addresses: impl IntoIterator<Item = SocketAddr>, private_access: PrivateNetworkAccess, nat64_prefixes: &[Nat64Prefix], ) -> Result<Self, NetworkGuardError>

Validate one DNS result and retain the exact addresses to dial.

nat64_prefixes is the deployment’s security.nat64_prefixes, parsed once by the caller at construction. Passing an empty slice states that the host runs no network-specific translator; it does not skip the well-known 64:ff9b::/96 form, which the address predicates decode unconditionally.

Three things happen here that a bare validator call does not do:

1. Cloud metadata is refused for both access modes, so an operator opt-in for private destinations never re-opens it.
2. A mixed public/private answer set is refused even when private access is authorized. Otherwise resolver ordering or connection fallback silently decides which trust zone the connection lands in.
3. The surviving addresses are retained, which is the pin.

Errors

Returns NetworkGuardError for a malformed host or port, an empty or mismatched answer set, a metadata endpoint, an unauthorized private address, or an answer spanning both address classes.

pub fn host(&self) -> &str

Canonical lowercase host, without IPv6 brackets or a trailing DNS dot. Use this for SNI and certificate verification, never for a second resolution.

pub fn port(&self) -> u16

Authorized destination port.

pub fn addresses(&self) -> &[SocketAddr]

Exact validated socket addresses. Dial these instead of resolving again.

Trait Implementations

impl Clone for ResolvedDestination

fn clone(&self) -> ResolvedDestination

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for ResolvedDestination

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ResolvedDestination

impl PartialEq for ResolvedDestination

fn eq(&self, other: &ResolvedDestination) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for ResolvedDestination