Sanstun: A sans-IO, parallel-friendly WireGuard implementation in Rust

The article introduces sanstun, a sans-IO Rust implementation of the WireGuard state machine, designed for ease of use, security, and performance through a parallel-friendly and idiomatic API. The sans-IO concept separates IO and side-effects from state and business logic, with IO encompassing file, network, time, and randomness.

This design allows for better composition, testing, and adherence to Rust's ownership rules. The article highlights the challenges faced when patching Firezone's fork of boringtun, a WireGuard implementation, and the decision to make it fully sans-IO, particularly for time handling. This change led to the introduction of new APIs for time-related operations, enhancing the overall system simulation.

Another key feature highlighted is internal buffering, which the article argues should not be present in the library due to its simplicity issues. The article outlines the core components of the sans-IO API, including the Tunnel::begin_encapsulate function for packet sending and Tunnel::initiate_handshake for creating new sessions.

The WireGuard protocol's message format, which includes handshake init, handshake response, cookie reply, and encrypted data, is also discussed, emphasizing the importance of rate-limiting to prevent DoS attacks. The article concludes by emphasizing the role of types and compile-time invariants in enforcing protocol correctness and simplifying API design.