move sessionfirewall into the tuntap. this needs testing. the name is also slightly wrong, since a crypto session can still be set up, packets are just accepted/rejected at the tun/tap level instead

src/tuntap/tun.go

@@ -44,7 +44,14 @@ type TunAdapter struct {
 	iface       tun.Device
 	phony.Inbox // Currently only used for _handlePacket from the reader, TODO: all the stuff that currently needs a mutex below
 	//mutex        sync.RWMutex // Protects the below
-	isOpen bool
+	isOpen     bool
+	gatekeeper func(pubkey ed25519.PublicKey, initiator bool) bool
+}
+
+func (tun *TunAdapter) SetSessionGatekeeper(gatekeeper func(pubkey ed25519.PublicKey, initiator bool) bool) {
+	phony.Block(tun, func() {
+		tun.gatekeeper = gatekeeper
+	})
 }
 
 // Gets the maximum supported MTU for the platform based on the defaults in