Validate TLS-PSK TCP tunnel transport (iOS 18.2+) e2e on a Wi-Fi-reachable device

[danielpaulus]

Follow-up from #748.

The TLS-PSK TCP tunnel transport for iOS 18.2+ (Apple removed QUIC) is implemented and the TLS-PSK client crypto is validated against OpenSSL (tlspsk_openssl_test.go, cipher TLS_PSK_WITH_AES_256_GCM_SHA384), but the full transport has never been exercised against a real device.

Blocker

ManualPairAndConnectToTunnelTCP uses the RemotePairing network path (FindDeviceInterfaceAddress / mDNS _remoted._tcp), which is not reachable over USB — it times out on a USB-tethered device (USB already works via the lockdown tunnel). It needs a Wi-Fi / network-reachable iOS 18.2+ device (paired, on the LAN / Tailscale).

To do once such a device is available

• Run the e2e probe: TCP_PSK_UDID=<udid> go test -tags e2e -run TestTCPPSKTunnelE2E -v ./ios/tunnel/ and confirm the TLS-PSK tunnel establishes (RSD reachable through it).
• Verify a few RemoteXPC commands work over it (e.g. rsd ls, screenshot, syslog).
• Wire the TCP/PSK transport into transport auto-selection (currently it's implemented but not selected automatically, precisely because it's unvalidated). Consider whether the lockdown-reuse path (connectToTunnelLockdown) should request the larger MTU (pymd3 uses 16000 for the TCP tunnel) on this path.

Done / not blocking

• TLS-PSK 1.2 plain-PSK client (ios/tunnel/tlspsk) — validated vs openssl s_server -psk -cipher PSK-AES256-GCM-SHA384 -tls1_2 (handshake + data round-trip).
• createTcpTunnelListener + ManualPairAndConnectToTunnelTCP wiring — builds, vets, reuses the validated lockdown data plane.

🤖 Generated with Claude Code