Struct TcpSessionTransport 

pub struct TcpSessionTransport { /* private fields */ }

Implementations

impl TcpSessionTransport

pub fn new(stream: TcpStream) -> Self

Trait Implementations

impl SessionTransport for TcpSessionTransport

async fn send_bytes(&self, data: &[u8]) -> Result<(), CoreError>

Send raw bytes to the peer.

async fn recv_bytes(&self) -> Result<Bytes, CoreError>

Receive the next message from the peer. The returned Bytes is a refcounted view over an opaque buffer; subsequent clone()s are cheap.

fn set_frame_phase(&self, phase: FramePhase)

Move the transport to a new FramePhase, adjusting the receive frame-size cap (WIRE-001). Default no-op — transports that do not length-prefix / buffer, or are inherently bounded, need not implement it. Called once by the session machinery at the handshake → data-pump boundary. Adding this defaulted method is source-compatible for every existing impl.

fn set_outbound_cid(&self, _cid: [u8; 8])

Stamp this transport’s outbound routing CID (ε / WIRE v5). Called once by the session machinery at the handshake → data-pump boundary with the session’s current_outbound_cid() (the rotating CID_0), switching the transport off the bootstrap ConnId onto the chain. Default no-op — socket-routed transports (TCP / WebSocket / WASI / Embedded) carry no on-wire CID and ignore it. Source-compatible for every existing impl.

fn has_migration_candidate(&self) -> bool

Whether the transport has observed an unvalidated candidate source for this session — a connection-migration signal (Phase 4). Only an address-aware transport (the UDP server) ever returns true; stream transports (TCP / WebSocket / WASI / Embedded) have no migration and use the default false. Deliberately SocketAddr-free so the generic data pump that calls it stays no_std-clean (std::net::SocketAddr does not exist in core/alloc); the candidate address is held inside the concrete transport.

fn send_to_candidate( &self, _data: &[u8], ) -> impl Future<Output = Result<bool, CoreError>> + Send

Send data — an already-encrypted PATH_VALIDATION challenge built by the session — to the transport’s internally-tracked candidate source, distinct from the established peer, under the transport’s own anti-amplification cap (RFC 9000 §8.2). Returns Ok(true) if a candidate existed and the send was within budget, Ok(false) otherwise (no candidate, or the 3× cap was hit). Default (non-address transports): a no-op Ok(false). The candidate address never crosses this boundary, keeping the trait no_std-safe.

fn confirm_authenticated_source(&self)

Commit the most-recently-received frame’s source as the migration candidate — call ONLY from the post-decrypt path, i.e. once that frame has been AEAD-verified (M-1). On the address-aware UDP server this is the migration-integrity fix: the candidate (and hence the server’s PATH_CHALLENGE target) is only ever an AEAD-authenticated source, so a spoofed CID-matched datagram (which never decrypts) cannot clobber the candidate slot and misdirect / stall a legitimate migration. SocketAddr-free — the address stays inside the concrete transport. Default no-op for transports without migration.

fn promote_candidate(&self) -> bool

Promote the migration candidate to the established peer (Phase 4, the switch): after the candidate’s path validates, subsequent app data and retransmits go to it instead of the old peer. Returns true if a candidate was promoted. Default no-op (false) for transports without migration. SocketAddr-free — the address is internal to the concrete transport.

fn migrate( &self, _local_addr: String, ) -> impl Future<Output = Result<(), CoreError>> + Send

Migrate this transport to a new local address (Phase 4 / P4.2c — embedder- triggered connection migration). The address crosses as a String (parsed inside the concrete native transport) so the trait stays SocketAddr-free and no_std-clean — std::net::SocketAddr does not exist in core/alloc. Best-effort: a parse / bind / connect failure returns Err and the session is expected to keep running on its existing socket — migration never tears it down. Default no-op Ok(()) for transports without migration (TCP / WebSocket / WASI / Embedded / the in-memory test pipe); only the native UDP client implements it.

fn migrate_server( &self, _local_addr: String, ) -> impl Future<Output = Result<(), CoreError>> + Send

Migrate the server side of this transport to a new local send address — the mirror of migrate for the accepting peer. The server binds a fresh local socket, sends subsequent server→client datagrams from it (so the client sees a new s2c source and follows it), and receives on it too (so once the client switches its send target the c2s frames are delivered transparently). The address crosses as a String to keep the trait SocketAddr-free / no_std-clean. Best-effort: a parse / bind failure returns Err and the session keeps running on the old socket. Default no-op Ok(()) — only the native UDP server implements it. Kept distinct from migrate so the FFI-exported client migrate() cannot trigger a server migration.