Struct Server 

pub struct Server<R: Read, W: Write, A: Attester> { /* private fields */ }

Server side of the wire, accepting encrypted sessions over a supplied byte stream.

Server::recv handles client resets and handshakes. Each successful handshake returns a sender through Event::Connected. Later reads deliver decrypted messages or report that the session ended. Server::disconnect ends a session while leaving the stream available for another; Server::close permanently closes the stream.

On a local disconnect, a session failure, a failed handshake or data received outside a session, the server attempts an empty frame notification. A client receiving it drops its old session. Notifications are best effort and bounded by an output deadline. A failed write’s own notification uses only its remaining budget and is skipped after timeout. Later incoming traffic can prompt a standalone notification.

An Attester supplies the device attestation. Transport forwards it to the client, whose Verifier decides whether to trust it.

Implementations

impl<R: Read, W: Write, A: Attester> Server<R, W, A>

pub fn new(stream: Stream<R, W>, signer: SecretKey, attester: A) -> Self

Creates a server that owns the byte stream and its shutdown operation.

The signer is the server’s identity key. It must match the key embedded in the device attestation. Output uses the stream’s configured write timeout. The stream’s Read and Write adapters must enforce deadlines and let shutdown cancel blocked I/O.

pub fn set_handshake_timeout(self, timeout: Duration) -> Self

Sets the budget for each later handshake, counted from the reset that requests it.

Defaults to DEFAULT_HANDSHAKE_TIMEOUT. Output and peer replies share one deadline; progress and repeated resets within the attempt do not refresh it. An already pending handshake keeps its deadline. Each outgoing frame is also limited by the stream’s write timeout. Waiting for locks and attester callbacks can extend the call beyond the deadline. Time between Server::recv calls also consumes the budget.

Zero expires attempts immediately. A duration too large to add to an Instant panics when the next handshake’s deadline is constructed.

pub fn closer(&self) -> Closer

Returns a handle that permanently closes the stream from another thread.

pub fn close(&self)

Permanently closes the stream and waits for adapter shutdown.

Senders observe closure through write failure, and buffered messages remain readable. See Closer::close.

pub fn recv(&mut self) -> Result<Event<W>, Error>

Receives the next decrypted message or session transition.

A client reset starts a handshake, whose completion returns Event::Connected with a sender before any messages from that session are delivered.

A client reset or invalid incoming data ends the current session and returns Event::Disconnected. Oversized frames count as invalid data. A send failure also ends the session, but does not wake a blocked read. It is reported once receiving progresses. Sessions ended by a local disconnect are not reported again.

The handshake after a reset runs under one configured deadline, starting at that reset. It runs in the same call, or in the next one when the reset ended a session. Repeated resets within the attempt do not refresh the deadline. Expiry returns a TimedOut I/O error, as Error::SendFailed while writing and as Error::RecvFailed otherwise. A fresh reset can start another attempt.

After decryption, message acceptance is ordered with session ending without waiting for the writer. A concurrent send failure can cause a decrypted message to be discarded before acceptance. An accepted message may reach the caller after another thread ends the session. Reporting a session’s end waits for outgoing writes to finish.

Junk outside a session and handshake protocol or authentication failures are logged, answered with a best-effort empty frame and skipped. Handshake write failures surface as errors; calling again waits for a new reset on the same stream. Adapter read failures and EOF also surface as errors, without removing the binding. The caller can retry a transient read error, disconnect the session or close the stream. Outside a handshake, reads wait for data or adapter shutdown without a session timeout.

Outgoing frames and standalone empty notifications use the stream’s configured write timeout. A notification sent while handling a failed write shares that frame’s remaining budget and is skipped after timeout. These output failures do not themselves close the byte stream.

Panics

Panics if a handshake or write timeout is too large to add to an Instant, or if a handshake reads a wall time before the Unix epoch from the stream’s clock.

pub fn disconnect(&mut self)

Ends the current session, if any, and notifies the client with an empty frame.

The stream remains available for the client to connect again. Notification failures are logged. This produces no Event::Disconnected, since the caller already knows the session ended.

Waits for the current writer and its flush, then retires the binding. The notification gets its own frame budget. Another thread can use a Closer to cancel output earlier.

Trait Implementations

impl<R: Read, W: Write, A: Attester> Debug for Server<R, W, A>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Shows the session label, whether a session is established and the handshake budget, never the adapters, the keys or the encryption contexts.

impl<R: Read, W: Write, A: Attester> Drop for Server<R, W, A>

fn drop(&mut self)

Closes the stream to cancel blocked I/O, then ends the binding before releasing the contexts.

Shutdown must come before waiting for the writer, which a blocked write could otherwise hold until its deadline. Idle senders hold weak references and cannot extend the stream’s lifetime.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.