Update dependencies: rand 0.10, rtnetlink 0.20, tun 0.8, and others

Bump rand (0.8→0.10), rtnetlink (0.14→0.20), tun (0.7→0.8),
simple-dns (0.9→0.11), socket2 (0.5→0.6), and criterion (0.5→0.8).

Migrate all rand call sites: thread_rng()→rng(), gen()→random(),
gen_range()→random_range(), RngCore→Rng trait. Work around secp256k1
0.30 requiring rand 0.8 by generating random bytes directly and
constructing SecretKey from slice.

Migrate rtnetlink to builder-based API: LinkSetRequest replaced with
LinkUnspec builder + change(), RouteAddRequest replaced with
RouteMessageBuilder.

Remove bloom benchmark (criterion 0.8 incompatible with old harness
config).

src/identity/auth.rs

@@ -17,7 +17,7 @@ impl AuthChallenge {
     /// Generate a new random challenge.
     pub fn generate() -> Self {
         let mut bytes = [0u8; 32];
-        rand::thread_rng().fill(&mut bytes);
+        rand::rng().fill_bytes(&mut bytes);
         Self(bytes)
     }
 

src/identity/local.rs

@@ -20,9 +20,11 @@ pub struct Identity {
 impl Identity {
     /// Create a new random identity.
     pub fn generate() -> Self {
-        let secp = Secp256k1::new();
-        let keypair = Keypair::new(&secp, &mut rand::thread_rng());
-        Self::from_keypair(keypair)
+        let mut secret_bytes = [0u8; 32];
+        rand::Rng::fill_bytes(&mut rand::rng(), &mut secret_bytes);
+        let secret_key = SecretKey::from_slice(&secret_bytes)
+            .expect("32 random bytes is a valid secret key");
+        Self::from_secret_key(secret_key)
     }
 
     /// Create an identity from an existing keypair.

src/node/mod.rs

@@ -33,7 +33,7 @@ use crate::upper::icmp_rate_limit::IcmpRateLimiter;
 use crate::upper::tun::{TunError, TunOutboundRx, TunState, TunTx};
 use self::wire::{build_encrypted, build_established_header, prepend_inner_header, FLAG_SP};
 use crate::{Config, ConfigError, Identity, IdentityError, NodeAddr, PeerIdentity};
-use rand::RngCore;
+use rand::Rng;
 use std::collections::{HashMap, VecDeque};
 use std::fmt;
 use std::thread::JoinHandle;
@@ -355,7 +355,7 @@ impl Node {
         let is_leaf_only = config.is_leaf_only();
 
         let mut startup_epoch = [0u8; 8];
-        rand::thread_rng().fill_bytes(&mut startup_epoch);
+        rand::rng().fill_bytes(&mut startup_epoch);
 
         let mut bloom_state = if is_leaf_only {
             BloomState::leaf_only(node_addr)
@@ -452,7 +452,7 @@ impl Node {
         let node_addr = *identity.node_addr();
 
         let mut startup_epoch = [0u8; 8];
-        rand::thread_rng().fill_bytes(&mut startup_epoch);
+        rand::rng().fill_bytes(&mut startup_epoch);
 
         let tun_state = if config.tun.enabled {
             TunState::Configured

src/node/tests/mod.rs

@@ -56,7 +56,7 @@ pub(super) fn make_completed_connection(
     let mut resp_conn = PeerConnection::inbound(LinkId::new(999), current_time_ms);
     let peer_keypair = peer_identity_full.keypair();
     let mut resp_epoch = [0u8; 8];
-    rand::RngCore::fill_bytes(&mut rand::thread_rng(), &mut resp_epoch);
+    rand::Rng::fill_bytes(&mut rand::rng(), &mut resp_epoch);
     let msg2 = resp_conn
         .receive_handshake_init(peer_keypair, resp_epoch, &msg1, current_time_ms)
         .unwrap();

src/node/tests/session.rs

@@ -499,7 +499,7 @@ async fn drain_to_quiescence(nodes: &mut [TestNode]) {
 #[tokio::test]
 async fn test_session_100_nodes() {
     use rand::rngs::StdRng;
-    use rand::{Rng, SeedableRng};
+    use rand::{RngExt, SeedableRng};
     use std::sync::mpsc;
     use std::time::Instant;
 
@@ -533,9 +533,9 @@ async fn test_session_100_nodes() {
     let mut rng = StdRng::seed_from_u64(SEED + 1);
     let mut session_pairs: Vec<(usize, usize)> = Vec::with_capacity(NUM_NODES);
     for src in 0..NUM_NODES {
-        let mut dst = rng.gen_range(0..NUM_NODES);
+        let mut dst = rng.random_range(0..NUM_NODES);
         while dst == src {
-            dst = rng.gen_range(0..NUM_NODES);
+            dst = rng.random_range(0..NUM_NODES);
         }
         session_pairs.push((src, dst));
     }
@@ -1192,10 +1192,10 @@ fn make_noise_session(
 
     // Set epochs for both sides (required for handshake message encryption)
     let mut init_epoch = [0u8; 8];
-    rand::RngCore::fill_bytes(&mut rand::thread_rng(), &mut init_epoch);
+    rand::Rng::fill_bytes(&mut rand::rng(), &mut init_epoch);
     initiator.set_local_epoch(init_epoch);
     let mut resp_epoch = [0u8; 8];
-    rand::RngCore::fill_bytes(&mut rand::thread_rng(), &mut resp_epoch);
+    rand::Rng::fill_bytes(&mut rand::rng(), &mut resp_epoch);
     responder.set_local_epoch(resp_epoch);
 
     let msg1 = initiator.write_message_1().unwrap();

src/node/tests/spanning_tree.rs

@@ -316,7 +316,7 @@ pub(super) async fn drain_all_packets(nodes: &mut [TestNode], verbose: bool) ->
 /// then adds extra edges up to the target count.
 pub(super) fn generate_random_edges(n: usize, target_edges: usize, seed: u64) -> Vec<(usize, usize)> {
     use rand::rngs::StdRng;
-    use rand::{Rng, SeedableRng};
+    use rand::{RngExt, SeedableRng};
 
     let mut rng = StdRng::seed_from_u64(seed);
     let mut edges = Vec::new();
@@ -328,11 +328,11 @@ pub(super) fn generate_random_edges(n: usize, target_edges: usize, seed: u64) ->
     let mut connected_count = 1;
 
     while connected_count < n {
-        let from = rng.gen_range(0..n);
+        let from = rng.random_range(0..n);
         if !connected[from] {
             continue;
         }
-        let to = rng.gen_range(0..n);
+        let to = rng.random_range(0..n);
         if connected[to] || from == to {
             continue;
         }
@@ -347,8 +347,8 @@ pub(super) fn generate_random_edges(n: usize, target_edges: usize, seed: u64) ->
     // Add random extra edges up to target
     let mut attempts = 0;
     while edges.len() < target_edges && attempts < target_edges * 10 {
-        let a = rng.gen_range(0..n);
-        let b = rng.gen_range(0..n);
+        let a = rng.random_range(0..n);
+        let b = rng.random_range(0..n);
         attempts += 1;
         if a == b || adj[a][b] {
             continue;

src/node/tests/unit.rs

@@ -498,7 +498,7 @@ fn test_promote_cleans_up_pending_outbound_to_same_peer() {
     let mut resp_conn = PeerConnection::inbound(LinkId::new(999), completing_time_ms);
     let peer_keypair = peer_b_full.keypair();
     let mut resp_epoch = [0u8; 8];
-    rand::RngCore::fill_bytes(&mut rand::thread_rng(), &mut resp_epoch);
+    rand::Rng::fill_bytes(&mut rand::rng(), &mut resp_epoch);
     let msg2 = resp_conn
         .receive_handshake_init(peer_keypair, resp_epoch, &msg1, completing_time_ms)
         .unwrap();

src/noise/handshake.rs

@@ -5,7 +5,7 @@ use super::{
     XK_HANDSHAKE_MSG1_SIZE, XK_HANDSHAKE_MSG2_SIZE, XK_HANDSHAKE_MSG3_SIZE,
 };
 use hkdf::Hkdf;
-use rand::RngCore;
+use rand::Rng;
 use secp256k1::{ecdh::shared_secret_point, Keypair, PublicKey, Secp256k1, SecretKey};
 use sha2::{Digest, Sha256};
 use std::fmt;
@@ -292,7 +292,7 @@ impl HandshakeState {
 
     /// Generate ephemeral keypair.
     fn generate_ephemeral(&mut self) {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
         let mut secret_bytes = [0u8; 32];
         rng.fill_bytes(&mut secret_bytes);
 

src/noise/tests.rs

@@ -1,17 +1,19 @@
 use super::*;
-use rand::RngCore;
+use rand::Rng;
 use secp256k1::Parity;
 
 fn generate_keypair() -> secp256k1::Keypair {
     let secp = secp256k1::Secp256k1::new();
-    let mut rng = rand::thread_rng();
-    let (secret_key, _) = secp.generate_keypair(&mut rng);
+    let mut secret_bytes = [0u8; 32];
+    rand::rng().fill_bytes(&mut secret_bytes);
+    let secret_key = secp256k1::SecretKey::from_slice(&secret_bytes)
+        .expect("32 random bytes is a valid secret key");
     secp256k1::Keypair::from_secret_key(&secp, &secret_key)
 }
 
 fn generate_epoch() -> [u8; 8] {
     let mut epoch = [0u8; 8];
-    rand::thread_rng().fill_bytes(&mut epoch);
+    rand::rng().fill_bytes(&mut epoch);
     epoch
 }
 

src/peer/connection.rs

@@ -583,7 +583,7 @@ impl fmt::Debug for PeerConnection {
 mod tests {
     use super::*;
     use crate::Identity;
-    use rand::RngCore;
+    use rand::Rng;
 
     fn make_peer_identity() -> PeerIdentity {
         let identity = Identity::generate();
@@ -597,7 +597,7 @@ mod tests {
 
     fn make_epoch() -> [u8; 8] {
         let mut epoch = [0u8; 8];
-        rand::thread_rng().fill_bytes(&mut epoch);
+        rand::rng().fill_bytes(&mut epoch);
         epoch
     }
 

src/protocol/discovery.rs

@@ -61,8 +61,8 @@ impl LookupRequest {
         ttl: u8,
         min_mtu: u16,
     ) -> Self {
-        use rand::Rng;
-        let request_id = rand::thread_rng().r#gen();
+        use rand::RngExt;
+        let request_id = rand::rng().random();
         Self::new(request_id, target, origin, origin_coords, ttl, min_mtu)
     }
 
@@ -428,7 +428,11 @@ mod tests {
 
         // Create a dummy signature for testing
         let secp = Secp256k1::new();
-        let keypair = secp256k1::Keypair::new(&secp, &mut rand::thread_rng());
+        let mut secret_bytes = [0u8; 32];
+        rand::Rng::fill_bytes(&mut rand::rng(), &mut secret_bytes);
+        let secret_key = secp256k1::SecretKey::from_slice(&secret_bytes)
+            .expect("32 random bytes is a valid secret key");
+        let keypair = secp256k1::Keypair::from_secret_key(&secp, &secret_key);
         let proof_data = LookupResponse::proof_bytes(999, &target, &coords);
         use sha2::Digest;
         let digest: [u8; 32] = sha2::Sha256::digest(&proof_data).into();
@@ -457,7 +461,11 @@ mod tests {
         let coords = make_coords(&[42, 1, 0]);
 
         let secp = Secp256k1::new();
-        let keypair = secp256k1::Keypair::new(&secp, &mut rand::thread_rng());
+        let mut secret_bytes = [0u8; 32];
+        rand::Rng::fill_bytes(&mut rand::rng(), &mut secret_bytes);
+        let secret_key = secp256k1::SecretKey::from_slice(&secret_bytes)
+            .expect("32 random bytes is a valid secret key");
+        let keypair = secp256k1::Keypair::from_secret_key(&secp, &secret_key);
         let proof_data = LookupResponse::proof_bytes(999, &target, &coords);
         use sha2::Digest;
         let digest: [u8; 32] = sha2::Sha256::digest(&proof_data).into();

src/upper/tun.rs

@@ -6,7 +6,7 @@
 
 use crate::{FipsAddress, TunConfig};
 use futures::TryStreamExt;
-use rtnetlink::{new_connection, Handle};
+use rtnetlink::{new_connection, Handle, LinkUnspec, RouteMessageBuilder};
 use std::fs::File;
 use std::io::{Read, Write};
 use std::net::Ipv6Addr;
@@ -443,22 +443,26 @@ async fn configure_interface(name: &str, addr: Ipv6Addr, mtu: u16) -> Result<(),
     // Set MTU
     handle
         .link()
-        .set(index)
-        .mtu(mtu as u32)
+        .change(LinkUnspec::new_with_index(index).mtu(mtu as u32).build())
         .execute()
         .await?;
 
     // Bring interface up
-    handle.link().set(index).up().execute().await?;
+    handle
+        .link()
+        .change(LinkUnspec::new_with_index(index).up().build())
+        .execute()
+        .await?;
 
     // Add route for fd00::/8 (FIPS address space) via this interface
     let fd_prefix: Ipv6Addr = "fd00::".parse().unwrap();
-    handle
-        .route()
-        .add()
-        .v6()
+    let route = RouteMessageBuilder::<Ipv6Addr>::new()
         .destination_prefix(fd_prefix, 8)
         .output_interface(index)
+        .build();
+    handle
+        .route()
+        .add(route)
         .execute()
         .await
         .map_err(|e| TunError::Configure(format!("failed to add fd00::/8 route: {}", e)))?;

src/utils/index.rs

@@ -19,7 +19,7 @@
 //! [0x00][receiver_idx:4 LE][counter:8 LE][ciphertext+tag]
 //! ```
 
-use rand::Rng;
+use rand::RngExt;
 use std::collections::HashSet;
 use thiserror::Error;
 
@@ -105,10 +105,10 @@ impl IndexAllocator {
     /// currently in use. Returns error if allocation fails after
     /// max_attempts tries (indicates too many active sessions).
     pub fn allocate(&mut self) -> Result<SessionIndex, IndexError> {
-        let mut rng = rand::thread_rng();
+        let mut rng = rand::rng();
 
         for _ in 0..self.max_attempts {
-            let candidate = rng.r#gen::<u32>();
+            let candidate = rng.random::<u32>();
             if !self.in_use.contains(&candidate) {
                 self.in_use.insert(candidate);
                 return Ok(SessionIndex(candidate));