ts_noise: factor out Noise implementation

Cargo.toml

@@ -26,6 +26,7 @@ members = [
     "ts_netstack_smoltcp_core",
     "ts_netstack_smoltcp_socket",
     "ts_nodecapability",
+    "ts_noise",
     "ts_overlay_router",
     "ts_packet",
     "ts_packetfilter",
@@ -99,9 +100,10 @@ tokio-util = { version = "0.7", default-features = false }
 tracing = { version = "0.1", default-features = false, features = ["attributes"] }
 tracing-test = "0.2"
 url = { version = "2", default-features = false }
-x25519-dalek = { version = "3.0.0-pre.6", features = ["getrandom", "reusable_secrets", "static_secrets"] }
+x25519-dalek = { version = "3.0.0-pre.6", features = ["getrandom", "reusable_secrets", "static_secrets", "zeroize"] }
 yoke = { version = "0.8", default-features = false }
 zerocopy = { version = "0.8", features = ["derive"] }
+zeroize = { version = "1.8.2", features = ["zeroize_derive"] }
 
 # local workspace deps
 tailscale = { path = ".", version = "0.3.3" }
@@ -125,6 +127,7 @@ ts_netstack_smoltcp = { path = "ts_netstack_smoltcp", version = "0.3.3" }
 ts_netstack_smoltcp_core = { path = "ts_netstack_smoltcp_core", version = "0.3.3" }
 ts_netstack_smoltcp_socket = { path = "ts_netstack_smoltcp_socket", version = "0.3.3" }
 ts_nodecapability = { path = "ts_nodecapability", version = "0.3.3" }
+ts_noise = { path = "ts_noise", version = "0.3.3" }
 ts_overlay_router = { path = "ts_overlay_router", version = "0.3.3" }
 ts_packet = { path = "ts_packet", version = "0.3.3" }
 ts_packetfilter = { path = "ts_packetfilter", version = "0.3.3" }

ts_control/src/control_dialer.rs

@@ -255,7 +255,9 @@ where
         CapabilityVersion::CURRENT,
     );
 
-    let conn = crate::tokio::upgrade_ts2021(url, &init_msg, handshake, h1_client).await?;
+    let conn =
+        crate::tokio::upgrade_ts2021(url, &init_msg, handshake, machine_keys.private, h1_client)
+            .await?;
     let conn = crate::tokio::read_challenge_packet(conn).await?;
 
     let h2_conn = ts_http_util::http2::connect(conn).await?;

ts_control/src/tokio/connect.rs

@@ -5,7 +5,7 @@ use bytes::Bytes;
 use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite};
 use ts_capabilityversion::CapabilityVersion;
 use ts_http_util::{BytesBody, ClientExt, EmptyBody, HeaderName, HeaderValue, Http2, ResponseExt};
-use ts_keys::{MachineKeyPair, MachinePublicKey};
+use ts_keys::{MachineKeyPair, MachinePrivateKey, MachinePublicKey};
 use url::Url;
 use zerocopy::network_endian::U32;
 
@@ -166,7 +166,14 @@ pub async fn connect(
         CapabilityVersion::CURRENT,
     );
 
-    let conn = upgrade_ts2021(control_url, &init_msg, handshake, h1_client).await?;
+    let conn = upgrade_ts2021(
+        control_url,
+        &init_msg,
+        handshake,
+        machine_keys.private,
+        h1_client,
+    )
+    .await?;
 
     // The early payload (challenge packet) is optional. The server may send
     // the magic prefix [FF FF FF 'T' 'S'] followed by a JSON challenge, or it
@@ -225,7 +232,8 @@ pub async fn fetch_control_key(control_url: &Url) -> Result<MachinePublicKey, Co
 pub async fn upgrade_ts2021(
     control_url: &Url,
     init_msg: &str,
-    mut handshake: ts_control_noise::Handshake,
+    handshake: ts_control_noise::Handshake,
+    machine_private_key: MachinePrivateKey,
     h1_client: impl ts_http_util::Client<EmptyBody>,
 ) -> Result<impl AsyncRead + AsyncWrite + Unpin + 'static, ConnectionError> {
     let ts2021_url = control_url.join("/ts2021")?;
@@ -251,7 +259,7 @@ pub async fn upgrade_ts2021(
         ConnectionError::Internal(InternalErrorKind::Http)
     })?;
 
-    let conn = handshake.complete(upgraded).await?;
+    let conn = handshake.complete(upgraded, &machine_private_key).await?;
 
     tracing::debug!("upgraded control connection from HTTP/1.1 to TS2021");
 

ts_control_noise/Cargo.toml

@@ -15,22 +15,20 @@ rust-version.workspace = true
 ts_capabilityversion.workspace = true
 ts_hexdump.workspace = true
 ts_keys.workspace = true
+ts_noise.workspace = true
 
 # Unconditionally required dependencies.
 base64.workspace = true
 bytes.workspace = true
 chacha20poly1305 = "0.10"
 futures-util = { workspace = true, features = ["sink"] }
-noise-protocol = "0.2"
-noise-rust-crypto = "0.6"
 pin-project-lite.workspace = true
 static_assertions.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = ["io-util"] }
 tokio-util = { workspace = true, features = ["codec"] }
 tracing.workspace = true
 zerocopy.workspace = true
-zeroize = "1.8"
 
 [dev-dependencies]
 rand = "0.10"