ACME certificate resolver. Wraps a `CertifiedKey` that is hot-swapped when the certificate is renewed. Implements `ResolvesServerCert` for use with r

Adaptive shaper that adjusts rate based on queuing delay (RTT inflation). Algorithm (run every 100ms): - qdelay = current_rtt - base_rtt - qdelay < 5

Trait for authentication verification. Returns username on success.

RAII guard that unregisters the client from the router on drop.

Routes TUN-read packets to the correct client based on destination IP.

Result of a successful transport connection.

RAII guard to decrement connection count on drop.

Shared state that the IPC server reads to produce status.

Accumulates small packets for batching, flushes when full.

Background health monitor for an active transport connection. - **QUIC transports**: checks RTT every 30s. If RTT exceeds 3x the baseline for 2 conse

Idle padding generator - sends dummy packets during inactivity to prevent traffic analysis based on idle patterns.

IP address allocator for the VPN subnet. Allocates from base+2 to base+254 (e.g. 10.0.1.2 - 10.0.1.254). base+0 is the network address, base+1 is the

All server metrics, registered with a Prometheus registry.

Priority queue with two lanes: realtime (timestamped) and bulk. Dequeue always drains realtime first. Stale realtime packets are dropped.

Builder for camouflaged QUIC connections. Produces a `quinn::ClientConfig` with: - Fake SNI from the configured pool (round-robin rotation) - Certifi

QUIC Camouflaged connector.

Camouflaged QUIC transport - wraps QuicRawTransport with packet padding.

QUIC direct connector - wraps quinn endpoint + PSK auth handshake.

QUIC raw transport - sends IP packets as QUIC DATAGRAM frames.

QUIC transport parameters matching a real browser.

Rate limiter wrapping a token bucket with drop counters.

Configuration for handling a TCP Reality connection.

Result of handling a TCP Reality connection.

RAII guard to decrement session metrics on drop (prevents stale counters on hard kill).

SNI pool with round-robin rotation.

Builder for TCP Reality connections.

TCP Reality connector.

TCP Reality transport - length-framed IP packets over TLS stream. Thread safety: the TLS stream is split into read/write halves protected by separate

Token bucket rate limiter. Tokens represent bytes. Uses x1000 fixed-point for sub-byte precision. Thread-safe via atomics (lock-free).

Configuration for building a TransportManager.

Transport manager: probes transports in priority order and connects.

How the tunnel exited - determines reconnect behavior.

Builder for WebSocket CDN connections (client-side).

WebSocket CDN connector.

WebSocket CDN transport - each binary WS message is one IP packet. Thread safety: sink and stream are split and protected by separate mutexes.