test: replace Tunn unit tests with integration test suite

[thomaseizinger]

The behavioural unit tests in noise/mod.rs and the replay-counter test in session.rs reached into private state, duplicated handshake plumbing per test and left notable gaps: no coverage for the cookie/DoS mechanism, wire-level replay, rekey/session rotation, tampered or malformed input, or the next_timer_update contract.

This replaces them with an integration test suite (tests/it) that drives two Tunn instances against each other through the public sans-IO API on a virtual clock. A harness provides an in-memory network with fault injection and a timestamped packet log, so each test reads as a short scenario. Protocol constants are redefined from the WireGuard whitepaper and each test cites the section it exercises, so the suite asserts conformance to the paper rather than to the implementation. Sans-IO-specific behaviour (jittered handshake scheduling, next_timer_update accuracy, tolerance to coarse polling, seed determinism, the internal packet queue) is covered separately in tests/it/sans_io.rs.

The suite is deterministic (fixed jitter seeds), runs in ~0.2s and passes under every feature combination with -Dwarnings. The crypto test vectors, the Index unit tests and the docker-based device tests are kept as-is.

[thomaseizinger]

I reviewed these tests. They are all sound and the harness is quite well written. Should enable us to update and merge #94 with confidence.

[jamilbk]

Concept ACK. Would it be a good idea to add this to our coverage reporting so we have better visibility into this change?

[thomaseizinger]

Concept ACK. Would it be a good idea to add this to our coverage reporting so we have better visibility into this change?

Are you worried about the removed tests? Or just interested in coverage in general?

Happy to play with that in a follow-up! I don't know how Coveralls interacts with forks but I guess there is no reason why it wouldn't work.