feat: complete wgcloak v1 transports

tests/tls_tcp.rs

@@ -36,6 +36,14 @@ fn codec_rejects_oversized_before_payload() {
     assert!(decoder.finish().is_ok());
 }
 
+#[test]
+fn codec_rejects_maximum_above_u16_wire_limit() {
+    assert_eq!(
+        FrameCodec::new(65_536).unwrap_err(),
+        FrameError::MaxTooLarge
+    );
+}
+
 #[test]
 fn codec_reports_truncated_header_or_payload() {
     let mut decoder = FrameCodec::new(32).unwrap();
@@ -95,6 +103,40 @@ async fn tls_stream_authentication_exchange_uses_challenge_response() {
     assert_eq!(authenticated.id, "laptop");
 }
 
+#[tokio::test]
+async fn tls_authentication_accepts_validated_maximum_datagram_size() {
+    let (left, right) = duplex(4096);
+    let (mut server_reader, mut server_writer) = split(left);
+    let (mut client_reader, mut client_writer) = split(right);
+    let mut clients = HashMap::new();
+    clients.insert("laptop".to_owned(), vec![7u8; 32]);
+    let server_clients = clients.clone();
+
+    let server = tokio::spawn(async move {
+        server_authenticate(
+            &mut server_reader,
+            &mut server_writer,
+            &server_clients,
+            65_503 + 512,
+            Duration::from_secs(1),
+        )
+        .await
+    });
+    let client = tokio::spawn(async move {
+        client_authenticate(
+            &mut client_reader,
+            &mut client_writer,
+            "laptop",
+            &[7u8; 32],
+            65_503 + 512,
+            Duration::from_secs(1),
+        )
+        .await
+    });
+    assert!(client.await.unwrap().is_ok());
+    assert_eq!(server.await.unwrap().unwrap().id, "laptop");
+}
+
 #[tokio::test]
 async fn bad_secret_is_rejected_without_authenticating() {
     let (left, right) = duplex(4096);