lp-reg gw flow working-ish

Author: durch

Cargo.lock

@@ -39,6 +39,10 @@ impl PrivateKey {
         Ok(PrivateKey(SphinxPrivateKey::from(bytes)))
     }
 
+    pub fn from_bytes(bytes: &[u8; 32]) -> Self {
+        PrivateKey(SphinxPrivateKey::from(*bytes))
+    }
+
     pub fn public_key(&self) -> PublicKey {
         let public_key = SphinxPublicKey::from(&self.0);
         PublicKey(public_key)
@@ -102,6 +106,21 @@ impl Keypair {
         }
     }
 
+    pub fn from_private_key(private_key: PrivateKey) -> Self {
+        let public_key = private_key.public_key();
+        Self {
+            private_key,
+            public_key,
+        }
+    }
+
+    pub fn from_keys(private_key: PrivateKey, public_key: PublicKey) -> Self {
+        Self {
+            private_key,
+            public_key,
+        }
+    }
+
     pub fn private_key(&self) -> &PrivateKey {
         &self.private_key
     }

common/nym-lp/src/keypair.rs

@@ -225,37 +225,37 @@ impl LpStateMachine {
                                     //  LpState::Closed { reason }
                                     LpState::Handshaking { session }
                                  } else {
-                                     // 4. Check if handshake is now complete
-                                     if session.is_handshake_complete() {
-                                         result_action = Some(Ok(LpAction::HandshakeComplete));
-                                         LpState::Transport { session } // Transition to Transport
-                                     } else {
-                                         // 5. Check if we need to send the next handshake message
-                                         match session.prepare_handshake_message() {
-                                             Some(Ok(message)) => {
-                                                 match session.next_packet(message) {
-                                                     Ok(response_packet) => {
-                                                         result_action = Some(Ok(LpAction::SendPacket(response_packet)));
-                                                         // Check AGAIN if handshake became complete *after preparing*
-                                                         if session.is_handshake_complete() {
-                                                             LpState::Transport { session } // Transition to Transport
-                                                         } else {
-                                                             LpState::Handshaking { session } // Remain Handshaking
-                                                         }
-                                                     }
-                                                     Err(e) => {
-                                                         let reason = e.to_string();
-                                                         result_action = Some(Err(e));
-                                                         LpState::Closed { reason }
+                                     // 4. First check if we need to send a handshake message (before checking completion)
+                                     match session.prepare_handshake_message() {
+                                         Some(Ok(message)) => {
+                                             match session.next_packet(message) {
+                                                 Ok(response_packet) => {
+                                                     result_action = Some(Ok(LpAction::SendPacket(response_packet)));
+                                                     // Check if handshake became complete after preparing message
+                                                     if session.is_handshake_complete() {
+                                                         LpState::Transport { session } // Transition to Transport
+                                                     } else {
+                                                         LpState::Handshaking { session } // Remain Handshaking
                                                      }
                                                  }
+                                                 Err(e) => {
+                                                     let reason = e.to_string();
+                                                     result_action = Some(Err(e));
+                                                     LpState::Closed { reason }
+                                                 }
                                              }
-                                             Some(Err(e)) => {
-                                                 let reason = e.to_string();
-                                                 result_action = Some(Err(e));
-                                                 LpState::Closed { reason }
-                                             }
-                                             None => {
+                                         }
+                                         Some(Err(e)) => {
+                                             let reason = e.to_string();
+                                             result_action = Some(Err(e));
+                                             LpState::Closed { reason }
+                                         }
+                                         None => {
+                                             // 5. No message to send - check if handshake is complete
+                                             if session.is_handshake_complete() {
+                                                 result_action = Some(Ok(LpAction::HandshakeComplete));
+                                                 LpState::Transport { session } // Transition to Transport
+                                             } else {
                                                  // Handshake stalled unexpectedly
                                                  let err = LpError::NoiseError(NoiseError::Other(
                                                      "Handshake stalled unexpectedly".to_string(),

common/nym-lp/src/state_machine.rs

@@ -164,7 +164,7 @@ pub struct WireguardData {
 /// Start wireguard device
 #[cfg(target_os = "linux")]
 pub async fn start_wireguard(
-    ecash_manager: Arc<EcashManager>,
+    ecash_manager: Arc<dyn nym_credential_verification::ecash::traits::EcashManager + Send + Sync>,
     metrics: nym_node_metrics::NymNodeMetrics,
     peers: Vec<Peer>,
     upgrade_mode_status: nym_credential_verification::upgrade_mode::UpgradeModeStatus,

common/wireguard/src/lib.rs

@@ -81,6 +81,8 @@ Ports published to host:
 - 10001-10004 → Mixnet ports
 - 20001-20004 → Verloc ports
 - 30001-30004 → HTTP APIs
+- 41264 → LP control port (registration)
+- 51264 → LP data port
 
 ### Startup Flow
 
@@ -246,6 +248,41 @@ container logs nym-gateway --follow &
 curl -L --socks5 localhost:1080 https://nymtech.com
 ```
 
+### LP (Lewes Protocol) Testing
+
+The gateway is configured with LP listener enabled and **mock ecash verification** for testing:
+
+```bash
+# LP listener ports (exposed on host):
+# - 41264: LP control port (TCP registration)
+# - 51264: LP data port
+
+# Check LP ports are listening
+nc -zv localhost 41264
+nc -zv localhost 51264
+
+# Test LP registration with nym-gateway-probe
+cargo run -p nym-gateway-probe run-local \
+  --mnemonic "test mnemonic here" \
+  --gateway-ip 'localhost:41264' \
+  --only-lp-registration
+```
+
+**Mock Ecash Mode**:
+- Gateway uses `--lp.use-mock-ecash true` flag
+- Accepts ANY bandwidth credential without blockchain verification
+- Perfect for testing LP protocol implementation
+- **WARNING**: Never use mock ecash in production!
+
+**Testing without blockchain**:
+The mock ecash manager allows testing the complete LP registration flow without requiring:
+- Running nyxd blockchain
+- Deploying smart contracts
+- Acquiring real bandwidth credentials
+- Setting up coconut signers
+
+This makes localnet perfect for rapid LP protocol development and testing.
+
 ## File Structure
 
 ```

docker/localnet/README.md

@@ -230,6 +230,8 @@ start_gateway() {
         -p 10004:10004 \
         -p 20004:20004 \
         -p 30004:30004 \
+        -p 41264:41264 \
+        -p 51264:51264 \
         -v "$VOLUME_PATH:/localnet" \
         -v "$NYM_VOLUME_PATH:/root/.nym" \
         -d \
@@ -250,14 +252,17 @@ start_gateway() {
                 --http-bind-address=0.0.0.0:30004 \
                 --http-access-token=lala \
                 --public-ips $CONTAINER_IP \
+                --enable-lp true \
+                --lp-use-mock-ecash true \
                 --output=json \
+                --wireguard-enabled true \
                 --bonding-information-output="/localnet/gateway.json";
 
             echo "Waiting for network.json...";
             while [ ! -f /localnet/network.json ]; do
                 sleep 2;
             done;
-            echo "Starting gateway...";
+            echo "Starting gateway with LP listener (mock ecash)...";
             exec nym-node run --id gateway-localnet --unsafe-disable-replay-protection --local
         '
 
@@ -429,13 +434,36 @@ show_status() {
 
     echo ""
     log_info "Port status:"
-    for port in 9000 1080 10001 10002 10003 10004; do
+    echo "  Mixnet:"
+    for port in 10001 10002 10003 10004; do
         if nc -z 127.0.0.1 $port 2>/dev/null; then
-            echo -e "  ${GREEN}●${NC} Port $port - listening"
+            echo -e "    ${GREEN}●${NC} Port $port - listening"
         else
-            echo -e "  ${RED}○${NC} Port $port - not listening"
+            echo -e "    ${RED}○${NC} Port $port - not listening"
         fi
     done
+    echo "  Gateway:"
+    for port in 9000 30004; do
+        if nc -z 127.0.0.1 $port 2>/dev/null; then
+            echo -e "    ${GREEN}●${NC} Port $port - listening"
+        else
+            echo -e "    ${RED}○${NC} Port $port - not listening"
+        fi
+    done
+    echo "  LP (Lewes Protocol):"
+    for port in 41264 51264; do
+        if nc -z 127.0.0.1 $port 2>/dev/null; then
+            echo -e "    ${GREEN}●${NC} Port $port - listening"
+        else
+            echo -e "    ${RED}○${NC} Port $port - not listening"
+        fi
+    done
+    echo "  SOCKS5:"
+    if nc -z 127.0.0.1 1080 2>/dev/null; then
+        echo -e "    ${GREEN}●${NC} Port 1080 - listening"
+    else
+        echo -e "    ${RED}○${NC} Port 1080 - not listening"
+    fi
 }
 
 # Build network topology with container IPs

docker/localnet/localnet.sh

@@ -7,7 +7,7 @@ use super::registration::process_registration;
 use super::LpHandlerState;
 use crate::error::GatewayError;
 use nym_lp::{
-    keypair::{Keypair, PublicKey},
+    keypair::{Keypair, PrivateKey as LpPrivateKey, PublicKey},
     LpMessage, LpPacket, LpSession,
 };
 use nym_metrics::{add_histogram_obs, inc};
@@ -109,10 +109,21 @@ impl LpConnectionHandler {
         // 2. Client's public key (will be received during handshake)
         // 3. PSK (pre-shared key) - for now use a placeholder
 
-        // Generate fresh LP keypair (x25519) for this connection
-        // Using Keypair::default() which generates a new random x25519 keypair
-        // This is secure and simple - each connection gets its own keypair
-        let gateway_keypair = Keypair::default();
+        // Derive LP keypair from gateway's ed25519 identity using proper conversion
+        // This creates a valid x25519 keypair for ECDH operations in Noise protocol
+        let x25519_private = self.state.local_identity.private_key().to_x25519();
+        let x25519_public = self.state.local_identity.public_key().to_x25519()
+            .map_err(|e| GatewayError::LpHandshakeError(
+                format!("Failed to convert ed25519 public key to x25519: {}", e)
+            ))?;
+
+        let lp_private = LpPrivateKey::from_bytes(x25519_private.as_bytes());
+        let lp_public = PublicKey::from_bytes(x25519_public.as_bytes())
+            .map_err(|e| GatewayError::LpHandshakeError(
+                format!("Failed to create LP public key: {}", e)
+            ))?;
+
+        let gateway_keypair = Keypair::from_keys(lp_private, lp_public);
 
         // Receive client's public key and salt via ClientHello message
         // The client initiates by sending ClientHello as first packet
@@ -289,11 +300,7 @@ impl LpConnectionHandler {
                             .duration_since(UNIX_EPOCH)
                             .expect("System time before UNIX epoch")
                             .as_secs();
-                        if now >= timestamp {
-                            now - timestamp
-                        } else {
-                            timestamp - now
-                        }
+                        now.abs_diff(timestamp)
                     },
                     self.state.lp_config.timestamp_tolerance_secs
                 );
@@ -333,22 +340,20 @@ impl LpConnectionHandler {
             )));
         }
 
-        // Extract registration request from LP message
-        match packet.message() {
-            LpMessage::EncryptedData(data) => {
-                // Deserialize registration request
-                bincode::deserialize(&data).map_err(|e| {
-                    GatewayError::LpProtocolError(format!(
-                        "Failed to deserialize registration request: {}",
-                        e
-                    ))
-                })
-            }
-            other => Err(GatewayError::LpProtocolError(format!(
-                "Expected EncryptedData message, got {:?}",
-                other
-            ))),
-        }
+        // Decrypt the packet payload using the established session
+        let decrypted_bytes = session
+            .decrypt_data(packet.message())
+            .map_err(|e| {
+                GatewayError::LpProtocolError(format!("Failed to decrypt registration request: {}", e))
+            })?;
+
+        // Deserialize the decrypted bytes into LpRegistrationRequest
+        bincode::deserialize(&decrypted_bytes).map_err(|e| {
+            GatewayError::LpProtocolError(format!(
+                "Failed to deserialize registration request: {}",
+                e
+            ))
+        })
     }
 
     /// Send registration response after processing

gateway/src/node/lp_listener/handler.rs

@@ -108,17 +108,29 @@ pub struct LpConfig {
     /// Recommended: 30-60 seconds
     #[serde(default = "default_timestamp_tolerance_secs")]
     pub timestamp_tolerance_secs: u64,
+
+    /// Use mock ecash manager for testing (default: false)
+    ///
+    /// When enabled, the LP listener will use a mock ecash verifier that
+    /// accepts any credential without blockchain verification. This is
+    /// useful for testing the LP protocol implementation without requiring
+    /// a full blockchain/contract setup.
+    ///
+    /// WARNING: Only use this for local testing! Never enable in production.
+    #[serde(default = "default_use_mock_ecash")]
+    pub use_mock_ecash: bool,
 }
 
 impl Default for LpConfig {
     fn default() -> Self {
         Self {
-            enabled: false,
+            enabled: true,
             bind_address: default_bind_address(),
             control_port: default_control_port(),
             data_port: default_data_port(),
             max_connections: default_max_connections(),
             timestamp_tolerance_secs: default_timestamp_tolerance_secs(),
+            use_mock_ecash: default_use_mock_ecash(),
         }
     }
 }
@@ -143,6 +155,10 @@ fn default_timestamp_tolerance_secs() -> u64 {
     30 // 30 seconds - balances security vs clock skew tolerance
 }
 
+fn default_use_mock_ecash() -> bool {
+    false // Always default to real ecash for security
+}
+
 /// Shared state for LP connection handlers
 #[derive(Clone)]
 pub struct LpHandlerState {

gateway/src/node/lp_listener/mod.rs

@@ -315,8 +315,8 @@ async fn register_wg_peer(
             .unwrap_or_else(|_| SocketAddr::from_str("0.0.0.0:51820").unwrap()),
     );
     peer.allowed_ips = vec![
-        format!("{}/32", client_ipv4).parse().unwrap(),
-        format!("{}/128", client_ipv6).parse().unwrap(),
+        format!("{client_ipv4}/32").parse().unwrap(),
+        format!("{client_ipv6}/128").parse().unwrap(),
     ];
     peer.persistent_keepalive_interval = Some(25);