resolve non stream-related PR comments

Cargo.lock

@@ -6434,6 +6434,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]

common/nymnoise/Cargo.toml

@@ -16,6 +16,7 @@ snow = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["net", "io-util", "time"] }
 tokio-util = { workspace = true, features = ["codec"] }
+zeroize = { workspace = true }
 
 # internal
 nym-crypto = { path = "../crypto" }

common/nymnoise/src/config.rs

@@ -115,19 +115,11 @@ impl NoiseConfig {
     // Only for phased update
     //SW This can lead to some troubles if two nodes shares the same IP and one support Noise but not the other. This in only for the progressive update though and there is no workaround
     pub(crate) fn get_noise_support(&self, ip_addr: IpAddr) -> Option<NoiseVersion> {
-        self.network
-            .support
-            .inner
-            .load()
-            .get(&ip_addr)
-            .copied()
-            .or_else(|| {
-                self.network
-                    .support
-                    .inner
-                    .load()
-                    .get(&ip_addr.to_canonical()) // SW default bind address being [::]:1789, it can happen that a responder sees the ipv6-mapped address of the initiator, this check for that
-                    .copied()
-            })
+        let plain_ip_support = self.network.support.inner.load().get(&ip_addr).copied();
+
+        // SW default bind address being [::]:1789, it can happen that a responder sees the ipv6-mapped address of the initiator, this check for that
+        let canonical_ip = &ip_addr.to_canonical();
+        let canonical_ip_support = self.network.support.inner.load().get(canonical_ip).copied();
+        plain_ip_support.or(canonical_ip_support)
     }
 }

common/nymnoise/src/lib.rs

@@ -11,6 +11,7 @@ use sha2::{Digest, Sha256};
 use snow::{error::Prerequisite, Builder, Error};
 use tokio::net::TcpStream;
 use tracing::*;
+use zeroize::Zeroizing;
 
 pub mod config;
 pub mod connection;
@@ -21,6 +22,13 @@ const NOISE_PSK_PREFIX: &[u8] = b"NYMTECH_NOISE_dQw4w9WgXcQ";
 
 pub const LATEST_NOISE_VERSION: NoiseVersion = NoiseVersion::V1;
 
+fn generate_psk_v1(responder_pub_key: &x25519::PublicKey) -> [u8; 32] {
+    let mut hasher = Sha256::new();
+    hasher.update(NOISE_PSK_PREFIX);
+    hasher.update(responder_pub_key.to_bytes());
+    hasher.finalize().into()
+}
+
 async fn upgrade_noise_initiator_v1(
     conn: TcpStream,
     config: &NoiseConfig,
@@ -28,15 +36,10 @@ async fn upgrade_noise_initiator_v1(
 ) -> Result<Connection, NoiseError> {
     trace!("Perform Noise Handshake, initiator side");
 
-    let secret = [
-        NOISE_PSK_PREFIX.to_vec(),
-        remote_pub_key.to_bytes().to_vec(),
-    ]
-    .concat();
-    let secret_hash = Sha256::digest(secret);
+    let secret_hash = generate_psk_v1(remote_pub_key);
 
     let handshake = Builder::new(config.pattern.as_str().parse()?)
-        .local_private_key(&config.local_key.private_key().to_bytes())
+        .local_private_key(Zeroizing::new(config.local_key.private_key().to_bytes()).as_ref())
         .remote_public_key(&remote_pub_key.to_bytes())
         .psk(config.pattern.psk_position(), &secret_hash)
         .build_initiator()?;
@@ -86,12 +89,7 @@ async fn upgrade_noise_responder_v1(
 ) -> Result<Connection, NoiseError> {
     trace!("Perform Noise Handshake, responder side");
 
-    let secret = [
-        NOISE_PSK_PREFIX.to_vec(),
-        config.local_key.public_key().to_bytes().to_vec(),
-    ]
-    .concat();
-    let secret_hash = Sha256::digest(secret);
+    let secret_hash = generate_psk_v1(config.local_key.public_key());
 
     let handshake = Builder::new(config.pattern.as_str().parse()?)
         .local_private_key(&config.local_key.private_key().to_bytes())