ts_tunnel: use the handshake primitives from ts_noise

Signed-off-by: David Anderson <danderson@tailscale.com>
Change-Id: Id81c21d18d19205b249d89d477a3d9a96a6a6964

Author: danderson

Cargo.lock

@@ -15,16 +15,15 @@ rust-version.workspace = true
 ts_keys.workspace = true
 ts_packet.workspace = true
 ts_time.workspace = true
+ts_noise.workspace = true
 
 # Unconditionally required dependencies.
 aead.workspace = true
 blake2.workspace = true
 chacha20poly1305.workspace = true
-hkdf.workspace = true
 itertools.workspace = true
 rand.workspace = true
 tracing.workspace = true
-x25519-dalek.workspace = true
 zerocopy.workspace = true
 
 [dev-dependencies]

ts_tunnel/Cargo.toml

@@ -1,40 +1,11 @@
-use rand::{
-    Rng, RngExt,
-    distr::{Distribution, StandardUniform},
-};
 use ts_keys::NodePublicKey;
 
 /// A handle for a wireguard peer.
 #[derive(Debug, Copy, Clone, Eq, PartialEq, PartialOrd, Ord, Hash)]
 pub struct PeerId(pub u32);
 
 /// A wireguard symmetric pre-shared key.
-#[derive(Copy, Clone)]
-pub struct Psk([u8; 32]);
-
-impl From<[u8; 32]> for Psk {
-    fn from(bytes: [u8; 32]) -> Self {
-        Psk(bytes)
-    }
-}
-
-impl AsRef<[u8]> for Psk {
-    fn as_ref(&self) -> &[u8] {
-        &self.0
-    }
-}
-
-impl AsMut<[u8]> for Psk {
-    fn as_mut(&mut self) -> &mut [u8] {
-        &mut self.0
-    }
-}
-
-impl Distribution<Psk> for StandardUniform {
-    fn sample<R: Rng + ?Sized>(&self, rng: &mut R) -> Psk {
-        Psk(rng.random())
-    }
-}
+pub type Psk = ts_noise::core::Psk;
 
 /// The cryptographic configuration for a wireguard peer.
 pub struct PeerConfig {

ts_tunnel/src/config.rs

@@ -15,7 +15,7 @@ use crate::{
     config::{PeerConfig, PeerId},
     handshake::{Handshake, ReceivedHandshake, SessionPair, initiate_handshake},
     macs::{MACReceiver, MACSender},
-    messages::{CookieReply, HandshakeResponse, Message, SessionId},
+    messages::{CookieReply, HandshakeResponse, Message, MessageMut, SessionId},
     session::{ReceiveSession, TransmitSession},
     time::{TAI64N, TAI64NClock},
 };
@@ -347,21 +347,21 @@ impl Peer {
     ) {
         let pre_len = packets.len();
 
-        packets.retain_mut(|packet| match Message::try_from(packet.as_ref()) {
+        packets.retain_mut(|packet| match MessageMut::try_from(packet.as_mut()) {
             Err(()) => {
                 tracing::trace!("dropping invalid packet");
                 false
             }
-            Ok(Message::TransportDataHeader(_)) => true,
-            Ok(Message::HandshakeResponse(resp)) => {
+            Ok(MessageMut::TransportDataHeader(_)) => true,
+            Ok(MessageMut::HandshakeResponse(resp)) => {
                 self.recv_handshake_response(endpoint, resp, out);
                 false
             }
-            Ok(Message::CookieReply(resp)) => {
+            Ok(MessageMut::CookieReply(resp)) => {
                 self.recv_cookie_reply(resp);
                 false
             }
-            Ok(Message::HandshakeInitiation(_)) => {
+            Ok(MessageMut::HandshakeInitiation(_)) => {
                 debug_assert!(
                     false,
                     "handshake initiations should have been filtered out prior to calling recv"
@@ -390,11 +390,12 @@ impl Peer {
     fn recv_handshake_response(
         &mut self,
         endpoint: &mut EndpointState,
-        packet: &HandshakeResponse,
+        packet: &mut HandshakeResponse,
         out: &mut RecvResult,
     ) {
         let Some(session) = self.handshake.finish(
             packet,
+            &endpoint.my_key.private,
             &self.config.psk,
             &endpoint.my_cookie,
             Instant::now(),
@@ -657,8 +658,9 @@ impl Endpoint {
         ret
     }
 
-    fn process_one_handshake(&mut self, packet: PacketMut, out: &mut RecvResult) {
-        let Ok(Message::HandshakeInitiation(init)) = Message::try_from(packet.as_ref()) else {
+    fn process_one_handshake(&mut self, mut packet: PacketMut, out: &mut RecvResult) {
+        let Ok(MessageMut::HandshakeInitiation(init)) = MessageMut::try_from(packet.as_mut())
+        else {
             tracing::error!("message parsing failed");
             return;
         };