diff --git a/common/nym-lp/src/message.rs b/common/nym-lp/src/message.rs index 578395a957..05d1a39c6c 100644 --- a/common/nym-lp/src/message.rs +++ b/common/nym-lp/src/message.rs @@ -5,6 +5,7 @@ use crate::{BOOTSTRAP_RECEIVER_IDX, LpError}; use bytes::{BufMut, BytesMut}; use num_enum::{IntoPrimitive, TryFromPrimitive}; use nym_crypto::asymmetric::{ed25519, x25519}; +use rand::RngCore; use serde::{Deserialize, Serialize}; use std::fmt::{self, Display}; @@ -58,7 +59,6 @@ impl ClientHelloData { salt[..8].copy_from_slice(×tamp.to_le_bytes()); // Last 24 bytes: random nonce - use rand::RngCore; rand::thread_rng().fill_bytes(&mut salt[8..]); Self { diff --git a/common/nym-lp/src/noise_protocol.rs b/common/nym-lp/src/noise_protocol.rs index 41e601494b..293bd9ccd4 100644 --- a/common/nym-lp/src/noise_protocol.rs +++ b/common/nym-lp/src/noise_protocol.rs @@ -294,8 +294,8 @@ pub fn create_noise_state( remote_public_key: &[u8], psk: &[u8], ) -> Result { - let pattern_name = "Noise_XKpsk3_25519_ChaChaPoly_SHA256"; - let psk_index = 3; + let pattern_name = crate::NOISE_PATTERN; + let psk_index = crate::NOISE_PSK_INDEX; let noise_params: NoiseParams = pattern_name.parse().unwrap(); let builder = snow::Builder::new(noise_params.clone()); @@ -314,8 +314,8 @@ pub fn create_noise_state_responder( remote_public_key: &[u8], psk: &[u8], ) -> Result { - let pattern_name = "Noise_XKpsk3_25519_ChaChaPoly_SHA256"; - let psk_index = 3; + let pattern_name = crate::NOISE_PATTERN; + let psk_index = crate::NOISE_PSK_INDEX; let noise_params: NoiseParams = pattern_name.parse().unwrap(); let builder = snow::Builder::new(noise_params.clone()); diff --git a/common/nym-lp/src/session.rs b/common/nym-lp/src/session.rs index 3a26b6b3e9..774f148146 100644 --- a/common/nym-lp/src/session.rs +++ b/common/nym-lp/src/session.rs @@ -20,9 +20,11 @@ use nym_kkt::ciphersuite::{DecapsulationKey, EncapsulationKey}; use nym_kkt::encryption::KKTSessionSecret; use nym_kkt::kkt::decrypt_kkt_response_frame; use parking_lot::Mutex; +use rand::RngCore; use snow::Builder; use std::sync::Arc; use std::sync::atomic::{AtomicBool, AtomicU64, Ordering}; +use std::time::{SystemTime, UNIX_EPOCH}; use zeroize::{Zeroize, ZeroizeOnDrop}; /// PQ shared secret wrapper with automatic memory zeroization. @@ -236,9 +238,6 @@ pub struct LpSession { /// # Returns /// A 32-byte array containing fresh salt material pub fn generate_fresh_salt() -> [u8; 32] { - use rand::RngCore; - use std::time::{SystemTime, UNIX_EPOCH}; - let mut salt = [0u8; 32]; // First 8 bytes: current timestamp as u64 little-endian @@ -366,8 +365,8 @@ impl LpSession { ) -> Result { // XKpsk3 pattern requires remote static key known upfront (XK) // and PSK mixed at position 3. This provides forward secrecy with PSK authentication. - let pattern_name = "Noise_XKpsk3_25519_ChaChaPoly_SHA256"; - let psk_index = 3; + let pattern_name = crate::NOISE_PATTERN; + let psk_index = crate::NOISE_PSK_INDEX; let params = pattern_name.parse()?; let builder = Builder::new(params); diff --git a/gateway/src/node/lp_listener/handler.rs b/gateway/src/node/lp_listener/handler.rs index 5f70199637..7c98bd0f13 100644 --- a/gateway/src/node/lp_listener/handler.rs +++ b/gateway/src/node/lp_listener/handler.rs @@ -6,6 +6,7 @@ use super::registration::process_registration; use super::LpHandlerState; use crate::error::GatewayError; use nym_crypto::asymmetric::{ed25519, x25519}; +use nym_lp::state_machine::{LpAction, LpInput}; use nym_lp::{ codec::OuterAeadKey, message::ForwardPacketData, packet::LpHeader, LpMessage, LpPacket, OuterHeader, @@ -387,8 +388,6 @@ where receiver_idx: u32, packet: LpPacket, ) -> Result<(), GatewayError> { - use nym_lp::state_machine::{LpAction, LpInput}; - debug!( "Processing handshake packet from {} (receiver_idx={})", self.remote_addr, receiver_idx @@ -425,7 +424,6 @@ where .session() .ok() .and_then(|s| s.outer_aead_key()); - drop(state_entry); // Release borrow before send Some((response_packet, outer_key)) } LpAction::HandshakeComplete => { @@ -445,7 +443,6 @@ where // Move state machine to session_states (already in Transport state) // We keep the state machine (not just session) to enable // subsession/rekeying support during transport phase - drop(state_entry); // Release mutable borrow let (_receiver_idx, timestamped_state) = self .state @@ -473,11 +470,13 @@ where } other => { debug!("Received action during handshake: {:?}", other); - drop(state_entry); None } }; + // Release mutable borrow + drop(state_entry); + // Send response packet if needed if let Some((packet, outer_key)) = should_send { self.send_lp_packet(packet, outer_key.as_ref()).await?; diff --git a/integration-tests/src/lp_registration.rs b/integration-tests/src/lp_registration.rs index 28d209adc2..8c9d7c3fdc 100644 --- a/integration-tests/src/lp_registration.rs +++ b/integration-tests/src/lp_registration.rs @@ -385,7 +385,7 @@ mod tests { let client_key = *client_data.base.x25519_wg_keys.public_key(); let mut entry = Gateway::mock(&mut gateway_rng).await?; - let mut client = LpRegistrationClient::::new_with_default_psk( + let mut client = LpRegistrationClient::::new_with_default_config( client_data.base.ed25519_keys, *entry.base.ed25519_keys.public_key(), entry.base.socket_addr, @@ -476,7 +476,7 @@ mod tests { let client_data = Client::mock(&mut client_rng); let mut entry = Gateway::mock(&mut gateway_rng).await?; - let mut client = LpRegistrationClient::::new_with_default_psk( + let mut client = LpRegistrationClient::::new_with_default_config( client_data.base.ed25519_keys, *entry.base.ed25519_keys.public_key(), entry.base.socket_addr, @@ -536,7 +536,7 @@ mod tests { let mut entry = Gateway::mock(&mut entry_rng).await?; let mut exit = Gateway::mock(&mut exit_rng).await?; - let mut entry_client = LpRegistrationClient::::new_with_default_psk( + let mut entry_client = LpRegistrationClient::::new_with_default_config( client_data.base.ed25519_keys.clone(), *entry.base.ed25519_keys.public_key(), entry.base.socket_addr, diff --git a/nym-gateway-probe/src/lib.rs b/nym-gateway-probe/src/lib.rs index 53c3e097e2..604bfb381c 100644 --- a/nym-gateway-probe/src/lib.rs +++ b/nym-gateway-probe/src/lib.rs @@ -1109,7 +1109,7 @@ where let client_ed25519_keypair = std::sync::Arc::new(ed25519::KeyPair::new(&mut rng)); // Create LP registration client (uses Ed25519 keys directly, derives X25519 internally) - let mut client = LpRegistrationClient::::new_with_default_psk( + let mut client = LpRegistrationClient::::new_with_default_config( client_ed25519_keypair, gateway_identity, gateway_lp_address, @@ -1272,7 +1272,7 @@ where // LpRegistrationClient uses packet-per-connection model - connect() is gone, // connection is established automatically during handshake. info!("Establishing outer LP session with entry gateway..."); - let mut entry_client = LpRegistrationClient::::new_with_default_psk( + let mut entry_client = LpRegistrationClient::::new_with_default_config( entry_lp_keypair, entry_gateway.identity, entry_lp_address, diff --git a/nym-registration-client/src/lib.rs b/nym-registration-client/src/lib.rs index 516f7c6245..5843e4ecd4 100644 --- a/nym-registration-client/src/lib.rs +++ b/nym-registration-client/src/lib.rs @@ -7,9 +7,11 @@ use crate::config::RegistrationClientConfig; use nym_authenticator_client::{AuthClientMixnetListener, AuthenticatorClient}; use nym_bandwidth_controller::BandwidthTicketProvider; use nym_credentials_interface::TicketType; +use nym_crypto::asymmetric::ed25519; use nym_ip_packet_client::IprClientConnect; use nym_registration_common::AssignedAddresses; use nym_sdk::mixnet::{EventReceiver, MixnetClient, Recipient}; +use rand::rngs::OsRng; use std::sync::Arc; use tokio::net::TcpStream; @@ -152,8 +154,6 @@ impl RegistrationClient { } async fn register_lp(self) -> Result { - use crate::lp_client::{LpRegistrationClient, NestedLpSession}; - // Extract and validate LP addresses let entry_lp_address = self.config.entry.node.lp_address.ok_or( RegistrationClientError::LpRegistrationNotPossible { @@ -172,8 +172,6 @@ impl RegistrationClient { // Generate fresh Ed25519 keypairs for LP registration // These are ephemeral and used only for the LP handshake protocol - use nym_crypto::asymmetric::ed25519; - use rand::rngs::OsRng; let entry_lp_keypair = Arc::new(ed25519::KeyPair::new(&mut OsRng)); let exit_lp_keypair = Arc::new(ed25519::KeyPair::new(&mut OsRng)); @@ -181,7 +179,7 @@ impl RegistrationClient { // This creates the LP session that will be used to forward packets to exit. // Uses packet-per-connection model: each handshake packet on new TCP connection. tracing::info!("Establishing outer session with entry gateway"); - let mut entry_client = LpRegistrationClient::::new_with_default_psk( + let mut entry_client = LpRegistrationClient::new_with_default_config( entry_lp_keypair.clone(), self.config.entry.node.identity, entry_lp_address, diff --git a/nym-registration-client/src/lp_client/client.rs b/nym-registration-client/src/lp_client/client.rs index 6e350eeb50..99afac0c88 100644 --- a/nym-registration-client/src/lp_client/client.rs +++ b/nym-registration-client/src/lp_client/client.rs @@ -104,7 +104,7 @@ where /// Uses default config (LpConfig::default()) with sane timeout and TCP parameters. /// PSK is derived automatically during handshake inside the state machine. /// For custom config, use `new()` directly. - pub fn new_with_default_psk( + pub fn new_with_default_config( local_ed25519_keypair: Arc, gateway_ed25519_public_key: ed25519::PublicKey, gateway_lp_address: SocketAddr, @@ -1222,7 +1222,7 @@ mod tests { let address = "127.0.0.1:41264".parse().unwrap(); let client_ip = "192.168.1.100".parse().unwrap(); - let client = LpRegistrationClient::::new_with_default_psk( + let client = LpRegistrationClient::::new_with_default_config( keypair, gateway_key, address, diff --git a/nym-registration-client/src/lp_client/mod.rs b/nym-registration-client/src/lp_client/mod.rs index d4085bbbaa..a83cd80853 100644 --- a/nym-registration-client/src/lp_client/mod.rs +++ b/nym-registration-client/src/lp_client/mod.rs @@ -17,7 +17,7 @@ //! ```ignore //! use nym_registration_client::lp_client::LpRegistrationClient; //! -//! let mut client = LpRegistrationClient::new_with_default_psk( +//! let mut client = LpRegistrationClient::new_with_default_config( //! keypair, //! gateway_public_key, //! gateway_lp_address, diff --git a/tools/nym-lp-client/src/client.rs b/tools/nym-lp-client/src/client.rs index 6d35cb47a5..c9d0d58bbb 100644 --- a/tools/nym-lp-client/src/client.rs +++ b/tools/nym-lp-client/src/client.rs @@ -118,7 +118,7 @@ impl SpeedtestClient { let client_ip = "0.0.0.0".parse()?; - let mut lp_client = LpRegistrationClient::::new_with_default_psk( + let mut lp_client = LpRegistrationClient::::new_with_default_config( self.identity_keypair.clone(), self.gateway.identity, self.gateway.lp_address, @@ -161,7 +161,7 @@ impl SpeedtestClient { let client_ip = "0.0.0.0".parse()?; - let mut lp_client = LpRegistrationClient::::new_with_default_psk( + let mut lp_client = LpRegistrationClient::new_with_default_config( self.identity_keypair.clone(), self.gateway.identity, self.gateway.lp_address,