Firezone has released sanstun, a ground-up Rust implementation of the WireGuard protocol state machine built on sans-IO principles. The project is the direct result of more than two years of patching Cloudflare's boringtun library, accumulating over 70 pull requests that fixed edge cases, added missing APIs, and wrestled with an interface that was never designed for their use case. Rather than continue maintaining a diverging fork, Firezone wrote the library they wished they'd had from the start. The core design principle — sans-IO — means the library performs no network operations, no file access, no time queries, and no random number generation internally. Every side effect is the caller's responsibility. This sounds like more work for the integrator, but the payoff is composability: because the library is a pure state machine, it can be tested deterministically, embedded in simulation harnesses, and composed with any async runtime or threading model without the library imposing its own opinions. The most consequential architectural choice is separating cryptographic work from protocol bookkeeping. In WireGuard, each data packet carries a monotonically increasing counter for replay protection. sanstun's API splits encapsulation into two phases: beginencapsulate reserves the counter and advances timer state (~21 ns for a 64-byte packet), then hands back a PendingEncapsulate token that is Send-safe and can be shipped to another thread for the actual ChaCha20-Poly1305 encryption (~226 ns). The crypto dominates the cost by roughly 10:1, so the parallelizable portion is where the real wall-clock time lives. The type system does real security work here. Handshake initiation messages, handshake responses, cookie replies, and transport data each get their own types, and the only way to obtain them is through Interface::receive, which enforces rate limiting and MAC validation before handing anything to a Tunnel. Constructors are crate-private. You literally cannot feed an unvalidated handshake to a tunnel in safe Rust — the compiler rejects it. This eliminates an entire class of bugs where rate limiting is accidentally bypassed or packets are routed to the wrong peer. The removal of internal buffering is a small decision with large consequences. boringtun would silently buffer packets and initiate sessions on your behalf, requiring the caller to drain buffers by passing zero-length datagrams — an unintuitive contract that leaked implementation details. sanstun pushes buffering entirely to the caller, which simplifies both the library's internals and the caller's mental model. If you want to buffer, you control the buffer size and drain strategy. The WireGuard cookie mechanism — designed to prevent DoS via forged handshake initiations — is handled at the Interface level, not per-tunnel. This matches the protocol's design: rate limits scope to an entire interface. sanstun's API mirrors this by making Interface::receive the single entry point for all inbound datagrams, parsing headers, verifying MACs, checking cookies, and rate-limiting sources before any tunnel-level dispatch occurs. This is infrastructure work in the truest sense — not a product announcement but the open-sourcing of a building block that other WireGuard-based products can use. The 70+ PRs worth of edge-case knowledge baked into sanstun represents real operational learning that would otherwise remain locked inside Firezone's fork. Whether the broader Rust networking ecosystem adopts it depends on whether the API proves as clean in other people's codebases as it does in Firezone's.
