Load all `*.key` files from the given directory. Each file contains a 64-char hex PSK.

Register a client and return a RAII handle that unregisters on drop. Also returns a reference to the client's priority queue.

Push a packet into the appropriate queue. Returns false if the queue is full (backpressure).

Encode to wire format (66 bytes).

Compute HMAC-SHA256(psk, nonce).

Release an IP back to the pool.

Allocate the next available IP. Returns None if pool is exhausted.

Connect to the server using TCP + TLS Reality. 1. TCP connect to server 2. TLS handshake with fake SNI (target domain) + cert pinning 3. Send ClientA

Flush the current batch. Returns the encoded batch (or empty if nothing pending).

Update with a new RTT measurement. Called periodically (every 100ms).

Add a packet to the batch. Returns `Some(batch)` if the batch is full and should be flushed. If the packet is too large for batching, returns None (ca

Add a user: generate random PSK, write to file, add to store. Returns the hex PSK.

Get the device name.

Resolve `Random` to a concrete profile.

Strip padding from a received packet using the IP header's total_length. - IPv4: bytes 2-3 = total length (header + payload) - IPv6: bytes 4-5 = payl

Build the production QUIC transport config (no-op CC, 16MB window). No-op CC with 16 MB constant window - inner TCP handles congestion control. Datag

Parse a PEM string into a DER certificate.

Remove PID file.

Send via instant send_datagram (realtime path or batched).

Verify a client's auth: HMAC-SHA256(psk, nonce) == mac.

Pad a packet to the next standard size boundary. The receiver strips padding using `strip_padding()` which reads the real length from the IP header.

Parse a PSK from a hex string (64 hex chars).

Platform-specific PID file location.

Platform-specific IPC socket path.

Verify client auth. Returns Some(username) on success, None on failure. For single PSK mode, username is "default".

Encode multiple packets into a single batched datagram. Wire format: `[2B len BE][data][2B len BE][data]...` All packets must be < BATCH_SIZE_THRESHO

Build a rustls `ClientConfig` for camouflaged QUIC with a specific browser profile.

Build a `rustls::CryptoProvider` matching the given browser profile.

Classify a raw IP packet into a priority level. Realtime: DSCP EF (46), small UDP (<300B), DNS (UDP port 53). Bulk: everything else.

Clean up all NOTRACK iptables rules (handles duplicates from previous runs).

Get current adaptive rate in bytes/sec.

Generate a random-length padding packet. First nibble is 0 so it's not confused with a real IP packet.

Generate a self-signed placeholder cert (used while waiting for ACME).

Generate a self-signed certificate.

Check if a daemon is already running (by PID file + process check).

Load a CertifiedKey from PEM files.

Load cert+key from files, or generate and persist them.

Load a 32-byte PSK from a hex-encoded file (64 hex chars, optional newline).

Wait for a packet to become available, then pop it.

Read PID from file. Returns None if file doesn't exist or is invalid.

Remove a user: delete key file and remove from store.

Render all metrics in Prometheus text format.

Report stats without QUIC-specific path info (for TCP/WS transports).

Request a certificate from Let's Encrypt. Uses HTTP-01 challenge via a temporary TCP listener on port 80. This is simpler than TLS-ALPN-01 and works

Monitor PMTU changes and send SessionUpdate messages over the control stream. Checks every 5s, sends update if MTU changes by >50 bytes.

Spawn the metrics HTTP server on the given address. Returns a JoinHandle that can be aborted on shutdown.

Pop the highest-priority packet, dropping stale realtime packets.

Validate that the source IP of an IPv4 packet matches the expected IP. For IPv6 packets, validation is skipped (returns true). Returns false for inval

Write an IP packet to a TUN device (platform-specific). - Linux: raw write (TUN is IFF_NO_PI, no header) - macOS: writev with 4-byte big-endian AF he

Set up conntrack bypass for UDP:443 via iptables NOTRACK. Conntrack is the main bottleneck for high-rate UDP. NOTRACK skips it entirely.

Decode a batched datagram into individual packets. Returns the list of decoded packets. Invalid trailing bytes are ignored.

Bind the IPC socket synchronously (call before spawning the async server). Returns the std UnixListener ready for conversion to tokio.

Build a rustls `ClientConfig` for camouflaged QUIC with browser-like fingerprint.

Build QUIC transport config matching a real browser's transport parameters. Overlays browser-specific values on top of our VPN transport config (no-o

Build a quinn ClientConfig with camouflage settings. Returns (client_config, fake_sni) - the caller must use the fake SNI as the server_name when call

Build a TransportManager based on client configuration. Connectors are ordered by preference (fastest first). Mode "auto" adds all available transpor