ts_control_noise: use handshake primitives from ts_noise

Signed-off-by: David Anderson <danderson@tailscale.com>
Change-Id: Iffa6cb966097979b738ae22a946ac2aa6a6a6964

Author: danderson

Cargo.lock

@@ -255,7 +255,9 @@ where
         CapabilityVersion::CURRENT,
     );
 
-    let conn = crate::tokio::upgrade_ts2021(url, &init_msg, handshake, h1_client).await?;
+    let conn =
+        crate::tokio::upgrade_ts2021(url, &init_msg, handshake, machine_keys.private, h1_client)
+            .await?;
     let conn = crate::tokio::read_challenge_packet(conn).await?;
 
     let h2_conn = ts_http_util::http2::connect(conn).await?;

ts_control/src/control_dialer.rs

@@ -5,7 +5,7 @@ use bytes::Bytes;
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite};
 use ts_capabilityversion::CapabilityVersion;
 use ts_http_util::{BytesBody, ClientExt, EmptyBody, HeaderName, HeaderValue, Http2, ResponseExt};
-use ts_keys::{MachineKeyPair, MachinePublicKey};
+use ts_keys::{MachineKeyPair, MachinePrivateKey, MachinePublicKey};
 use url::Url;
 use zerocopy::network_endian::U32;
 
@@ -166,7 +166,14 @@ pub async fn connect(
         CapabilityVersion::CURRENT,
     );
 
-    let conn = upgrade_ts2021(control_url, &init_msg, handshake, h1_client).await?;
+    let conn = upgrade_ts2021(
+        control_url,
+        &init_msg,
+        handshake,
+        machine_keys.private,
+        h1_client,
+    )
+    .await?;
 
     // The early payload (challenge packet) is optional. The server may send
     // the magic prefix [FF FF FF 'T' 'S'] followed by a JSON challenge, or it
@@ -225,7 +232,8 @@ pub async fn fetch_control_key(control_url: &Url) -> Result<MachinePublicKey, Co
 pub async fn upgrade_ts2021(
     control_url: &Url,
     init_msg: &str,
-    mut handshake: ts_control_noise::Handshake,
+    handshake: ts_control_noise::Handshake,
+    machine_private_key: MachinePrivateKey,
     h1_client: impl ts_http_util::Client<EmptyBody>,
 ) -> Result<impl AsyncRead + AsyncWrite + Unpin + 'static, ConnectionError> {
     let ts2021_url = control_url.join("/ts2021")?;
@@ -251,7 +259,7 @@ pub async fn upgrade_ts2021(
         ConnectionError::Internal(InternalErrorKind::Http)
     })?;
 
-    let conn = handshake.complete(upgraded).await?;
+    let conn = handshake.complete(upgraded, &machine_private_key).await?;
 
     tracing::debug!("upgraded control connection from HTTP/1.1 to TS2021");
 

ts_control/src/tokio/connect.rs

@@ -15,22 +15,20 @@ rust-version.workspace = true
 ts_capabilityversion.workspace = true
 ts_hexdump.workspace = true
 ts_keys.workspace = true
+ts_noise.workspace = true
 
 # Unconditionally required dependencies.
 base64.workspace = true
 bytes.workspace = true
 chacha20poly1305 = "0.10"
 futures-util = { workspace = true, features = ["sink"] }
-noise-protocol = "0.2"
-noise-rust-crypto = "0.6"
 pin-project-lite.workspace = true
 static_assertions.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = ["io-util"] }
 tokio-util = { workspace = true, features = ["codec"] }
 tracing.workspace = true
 zerocopy.workspace = true
-zeroize = "1.8"
 
 [dev-dependencies]
 rand = "0.10"