Struct Server 

pub struct Server<R: Read, W: Write, A: Attester> { /* private fields */ }

Server side of the wire, accepting encrypted sessions over a supplied byte stream. Server::recv handles client resets and handshakes. Each successful handshake returns a sender through Event::Connected. Later reads deliver decrypted messages or report that the session ended. Server::disconnect ends a session while leaving the stream available for another; Server::close permanently closes the stream.

On a local disconnect, a session failure, a failed handshake or data received outside a session, the server attempts an empty frame notification. A client receiving it drops its old session. Notifications are best effort and bounded by an output deadline. A failed write’s own notification uses only its remaining budget and is skipped after timeout. Later incoming traffic can prompt a standalone notification.

An Attester supplies the device attestation. Transport forwards it to the client, whose verifier decides whether to trust it.

Implementations

impl<R: Read, W: Write, A: Attester> Server<R, W, A>

pub fn new(stream: Stream<R, W>, signer: SecretKey, attester: A) -> Self

Creates a server owning the byte stream and its shutdown operation. The signer is the server’s identity key. It must match the key embedded in the device attestation. Output uses the stream’s configured write timeout. The adapter must enforce deadlines and shutdown cancellation.

pub fn set_handshake_timeout(self, timeout: Duration) -> Self

Sets the budget for each subsequent handshake, starting when a reset is received. Defaults to DEFAULT_HANDSHAKE_TIMEOUT. Output and peer replies share one deadline; progress and repeated resets within the attempt do not refresh it. An already pending handshake keeps its deadline. Each outgoing frame is also limited by the stream’s write timeout. Waiting for locks and attester callbacks can extend the call beyond the deadline. Time between recv calls also consumes the budget.

Zero expires attempts immediately. A duration too large to add to an Instant panics when the next handshake’s deadline is constructed.

pub fn closer(&self) -> Closer

A handle that permanently closes the stream from another thread.

pub fn close(&self)

Permanently closes the stream and waits for adapter shutdown. Senders observe closure through write failure; buffered messages remain readable. See Closer::close.

pub fn recv(&mut self) -> Result<Event<W>, Error>

Receives a decrypted message or a session transition. A client reset starts a handshake, whose completion returns Event::Connected with a sender before any messages from that session are delivered.

A client reset or invalid incoming data ends the current session and returns Event::Disconnected. Oversized frames count as invalid data. After a reset, the next call runs the handshake under one configured deadline starting at that reset. Repeated resets within that attempt do not refresh it. Expiry returns RecvFailed(TimedOut) and a fresh reset can start another attempt. A send failure also ends the session, but does not wake a blocked read. It is reported once receiving progresses. Sessions ended by a local disconnect are not reported again.

After decryption, message acceptance is ordered with session ending without waiting for the writer. A concurrent send failure can cause a decrypted message to be discarded before acceptance. An accepted message may reach the caller after another thread ends the session. Reporting a session’s end waits for outgoing writes to finish.

Junk outside a session and handshake protocol or authentication failures are logged, answered with a best-effort empty frame and skipped. Handshake write failures surface as errors; calling again waits for a new reset on the same stream. Adapter read failures and EOF also surface as errors, without removing the binding. The caller can retry a transient read error, disconnect the session or close the stream. Outside a handshake, reads wait for data or adapter shutdown without a session timeout.

Outgoing frames and standalone empty notifications use the stream’s configured write timeout. A notification sent while handling a failed write shares that frame’s remaining budget and is skipped after timeout. These output failures do not themselves close the byte stream.

pub fn disconnect(&mut self)

Ends the encrypted session and tells the client with an empty frame. The stream remains available for the client to connect again. Notification failures are logged. This does not produce a Disconnected event because the caller already knows the session ended.

Waits for the current writer and its flush, then retires the binding. The notification gets its own frame budget. Another thread can use the Closer to cancel output earlier.

Trait Implementations

impl<R: Read, W: Write, A: Attester> Drop for Server<R, W, A>

fn drop(&mut self)

Closes the stream to cancel blocked I/O, then ends the binding before releasing the contexts. Shutdown must precede waiting for the writer. Idle senders hold weak references and cannot extend the stream’s lifetime.

fn pin_drop(self: Pin<&mut Self>)

🔬This is a nightly-only experimental API. (pin_ergonomics)

Execute the destructor for this type, but different to Drop::drop, it requires self to be pinned.