Expose the same pub key that's used for wg (#4157)

Cargo.lock

@@ -6922,6 +6922,7 @@ dependencies = [
  "nym-crypto",
  "nym-node-requests",
  "nym-task",
+ "nym-wireguard",
  "nym-wireguard-types",
  "rand 0.7.3",
  "serde",

common/wireguard/src/lib.rs

@@ -10,7 +10,7 @@ mod network_table;
 mod packet_relayer;
 mod platform;
 mod registered_peers;
-mod setup;
+pub mod setup;
 pub mod tun_task_channel;
 mod udp_listener;
 mod wg_tunnel;

gateway/src/http/mod.rs

@@ -229,14 +229,14 @@ impl<'a> HttpApiBuilder<'a> {
             IpAddr::from(Ipv4Addr::new(10, 1, 0, 0)),
             self.gateway_config.wireguard.private_network_prefix,
         )?;
-        let wg_state = self.client_registry.map(|client_registry| {
+        let wg_state = self.client_registry.and_then(|client_registry| {
             WireguardAppState::new(
-                self.sphinx_keypair,
                 client_registry,
                 Default::default(),
                 self.gateway_config.wireguard.bind_address.port(),
                 wireguard_private_network,
             )
+            .ok()
         });
 
         let router = nym_node::http::NymNodeRouter::new(config, wg_state);

nym-node/Cargo.toml

@@ -50,6 +50,7 @@ nym-config = { path = "../common/config" }
 nym-crypto = { path = "../common/crypto", features = ["asymmetric" ]}
 nym-node-requests = { path = "nym-node-requests", default-features = false, features = ["openapi"]}
 nym-task = { path = "../common/task" }
+nym-wireguard = { path = "../common/wireguard" }
 nym-wireguard-types = { path = "../common/wireguard-types", features = ["verify"] }
 
 [dev-dependencies]

nym-node/src/error.rs

@@ -31,6 +31,12 @@ pub enum NymNodeError {
         source: WireguardError,
     },
 
+    #[error(transparent)]
+    KeyRecoveryError {
+        #[from]
+        source: nym_crypto::asymmetric::encryption::KeyRecoveryError,
+    },
+
     #[error("unimplemented")]
     Unimplemented,
 }

nym-node/src/http/router/api/v1/gateway/client_interfaces/wireguard/client_registry.rs

@@ -31,10 +31,7 @@ async fn process_final_message(
         }
     };
 
-    if client
-        .verify(state.dh_keypair.private_key(), preshared_nonce)
-        .is_ok()
-    {
+    if client.verify(&state.private_key, preshared_nonce).is_ok() {
         state.registration_in_progress.remove(&client.pub_key());
         state.client_registry.insert(client.pub_key(), client);
 
@@ -104,7 +101,7 @@ pub(crate) async fn register_client(
             // mark it as used, even though it's not final
             *private_ip_ref = false;
             let gateway_data = GatewayClient::new(
-                state.dh_keypair.private_key(),
+                &state.private_key,
                 remote_public,
                 *private_ip_ref.key(),
                 nonce,

nym-node/src/http/router/api/v1/gateway/client_interfaces/wireguard/mod.rs

@@ -8,8 +8,9 @@ use crate::wireguard::types::{GatewayClientRegistry, PendingRegistrations};
 use axum::routing::{get, post};
 use axum::Router;
 use ipnetwork::IpNetwork;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::encryption::PrivateKey;
 use nym_node_requests::routes::api::v1::gateway::client_interfaces::wireguard;
+use nym_wireguard::setup;
 use nym_wireguard_types::registration::PrivateIPs;
 use std::sync::Arc;
 
@@ -24,15 +25,16 @@ pub struct WireguardAppState {
 
 impl WireguardAppState {
     pub fn new(
-        dh_keypair: Arc<encryption::KeyPair>,
         client_registry: Arc<GatewayClientRegistry>,
         registration_in_progress: Arc<PendingRegistrations>,
         binding_port: u16,
         private_ip_network: IpNetwork,
-    ) -> Self {
-        WireguardAppState {
+    ) -> Result<Self, crate::error::NymNodeError> {
+        Ok(WireguardAppState {
             inner: Some(WireguardAppStateInner {
-                dh_keypair,
+                private_key: Arc::new(PrivateKey::from_bytes(
+                    setup::server_static_private_key().as_ref(),
+                )?),
                 client_registry,
                 registration_in_progress,
                 binding_port,
@@ -40,7 +42,7 @@ impl WireguardAppState {
                     private_ip_network.iter().map(|ip| (ip, true)).collect(),
                 ),
             }),
-        }
+        })
     }
 
     // #[allow(dead_code)]
@@ -79,7 +81,7 @@ macro_rules! get_state {
 
 #[derive(Clone)]
 pub(crate) struct WireguardAppStateInner {
-    dh_keypair: Arc<encryption::KeyPair>,
+    private_key: Arc<PrivateKey>,
     client_registry: Arc<GatewayClientRegistry>,
     registration_in_progress: Arc<PendingRegistrations>,
     binding_port: u16,
@@ -112,6 +114,7 @@ mod test {
         PeerPublicKey,
     };
     use nym_node_requests::routes::api::v1::gateway::client_interfaces::wireguard;
+    use nym_wireguard::setup::server_static_private_key;
     use nym_wireguard_types::registration::HmacSha256;
     use std::net::IpAddr;
     use std::str::FromStr;
@@ -130,8 +133,15 @@ mod test {
         // 6. Gateway verifies mac digest and nonce, and stores client's public key and socket address and port
 
         let mut rng = rand::thread_rng();
+        let gateway_private_key =
+            encryption::PrivateKey::from_bytes(server_static_private_key().as_bytes()).unwrap();
+        let gateway_public_key = encryption::PublicKey::from(&gateway_private_key);
 
-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let gateway_key_pair = encryption::KeyPair::from_bytes(
+            &gateway_private_key.to_bytes(),
+            &gateway_public_key.to_bytes(),
+        )
+        .unwrap();
         let client_key_pair = encryption::KeyPair::new(&mut rng);
 
         let gateway_static_public =
@@ -158,7 +168,7 @@ mod test {
         let state = WireguardAppState {
             inner: Some(WireguardAppStateInner {
                 client_registry: Arc::clone(&client_registry),
-                dh_keypair: Arc::new(gateway_key_pair),
+                private_key: Arc::new(gateway_private_key),
                 registration_in_progress: Arc::clone(&registration_in_progress),
                 binding_port: 8080,
                 free_private_network_ips,