More optimized parsing

try a different parse_dst_addr
Try with split state
2023-11-28 10:11:41 +01:00 · 2023-11-28 09:59:15 +01:00 · 2023-11-28 09:42:55 +01:00 · 2023-11-28 09:25:05 +01:00 · 2023-11-28 08:56:20 +01:00 · 2023-11-28 08:43:03 +01:00
623 changed files with 21258 additions and 4682 deletions
@@ -1,9 +1,8 @@
-name: CD docs
+name: cd-docs

 on:
  workflow_dispatch:
  push:
-    branches: master
    paths:
      - 'documentation/docs/**'

@@ -26,7 +25,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace --release --all
+          args: --workspace --release
      - name: Install mdbook
        run: (test -x $HOME/.cargo/bin/mdbook || cargo install --vers "^0.4.33" mdbook)
      - name: Install mdbook plugins
@@ -39,30 +38,6 @@ jobs:
        run: cd documentation && ./build_all_to_dist.sh
        continue-on-error: false

-      - name: Deploy branch master to dev
-        continue-on-error: true
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CD_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "dist/docs/"
-          REMOTE_HOST: ${{ secrets.CD_WWW_REMOTE_HOST_DEV }}
-          REMOTE_USER: ${{ secrets.CD_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CD_WWW_REMOTE_TARGET }}/
-          EXCLUDE: "/node_modules/"
-
-      - name: Deploy branch master to prod
-        if: github.ref == 'refs/heads/master'
-        uses: easingthemes/ssh-deploy@main
-        env:
-          SSH_PRIVATE_KEY: ${{ secrets.CD_WWW_SSH_PRIVATE_KEY }}
-          ARGS: "-rltgoDzvO --delete"
-          SOURCE: "dist/docs/"
-          REMOTE_HOST: ${{ secrets.CD_WWW_REMOTE_HOST_PROD }}
-          REMOTE_USER: ${{ secrets.CD_WWW_REMOTE_USER }}
-          TARGET: ${{ secrets.CD_WWW_REMOTE_TARGET }}/
-          EXCLUDE: "/node_modules/"
-
      - name: Post process
        run: cd documentation && ./post_process.sh
        continue-on-error: false
@@ -1,4 +1,4 @@
-name: Run config checks on all binaries
+name: ci-binary-config-checker

 on:
  workflow_dispatch:
@@ -35,14 +35,14 @@ jobs:
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: 1.69.0
+          toolchain: stable
          target: wasm32-unknown-unknown
          override: true

      - name: Install wasm-opt
        uses: ./.github/actions/install-wasm-opt
        with:
-          version: '112'
+          version: '114'

      - name: Build release contracts
        run: make contracts
@@ -26,7 +26,7 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace --release --all
+          args: --workspace --release
      - name: Install mdbook
        run: (test -x $HOME/.cargo/bin/mdbook || cargo install --vers "^0.4.35" mdbook)
      - name: Install mdbook plugins
@@ -1,4 +1,4 @@
-name: CI for Nym API Tests
+name: ci-nym-api-tests

 on:
  workflow_dispatch:
@@ -16,10 +16,10 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
-      
+
      - name: Install npm
        run: npm install
-        
+
      - name: Node v18
        uses: actions/setup-node@v3
        with:
@@ -33,6 +33,12 @@ jobs:
          override: true
          components: rustfmt, clippy

+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --manifest-path nym-connect/desktop/Cargo.toml --all -- --check
+
      - name: Build all binaries
        uses: actions-rs/cargo@v1
        with:
@@ -45,12 +51,6 @@ jobs:
          command: test
          args: --manifest-path nym-connect/desktop/Cargo.toml --workspace

-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path nym-connect/desktop/Cargo.toml --all -- --check
-
      - uses: actions-rs/clippy-check@v1
        name: Clippy checks
        continue-on-error: true
@@ -1,11 +1,7 @@
 name: ci-nym-vpn-ui-js

 on:
-  push:
-    paths:
-      - 'nym-vpn/ui/src/**'
-      - 'nym-vpn/ui/package.json'
-      - 'nym-vpn/ui/index.html'
+  workflow_dispatch:
  pull_request:
    paths:
      - 'nym-vpn/ui/src/**'
@@ -14,7 +10,7 @@ on:

 jobs:
  check:
-    runs-on: [ self-hosted, custom-linux ]
+    runs-on: custom-linux
    steps:
      - name: Checkout
        uses: actions/checkout@v4
@@ -1,16 +1,14 @@
 name: ci-nym-vpn-ui-rust

 on:
-  push:
-    paths:
-      - 'nym-vpn/ui/src-tauri/**'
+  workflow_dispatch:
  pull_request:
    paths:
      - 'nym-vpn/ui/src-tauri/**'

 jobs:
  build:
-    runs-on: [self-hosted, custom-linux]
+    runs-on: custom-linux
    env:
      CARGO_TERM_COLOR: always
      CARGOTOML_PATH: ./nym-vpn/ui/src-tauri/Cargo.toml
@@ -31,18 +29,19 @@ jobs:
          components: rustfmt, clippy

      - name: Prepare build
-        working-directory: nym-vpn/ui/
-        run: mkdir dist
+        run: mkdir nym-vpn/ui/dist

-      - name: Check build
-        working-directory: nym-vpn/ui/src-tauri
-        run: cargo build --release --lib --features custom-protocol
+      - name: Build
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: --manifest-path ${{ env.CARGOTOML_PATH }} --features custom-protocol

 #      - name: Run all tests
 #        uses: actions-rs/cargo@v1
 #        with:
 #          command: test
-#          args: --manifest-path ${{ env.CARGOTOML_PATH }} --workspace
+#          args: --manifest-path ${{ env.CARGOTOML_PATH }}

      - name: Check formatting
        uses: actions-rs/cargo@v1
@@ -50,15 +49,15 @@ jobs:
          command: fmt
          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all -- --check

-      - uses: actions-rs/clippy-check@v1
-        name: Clippy checks
+      - name: Annotate with clippy checks
+        uses: actions-rs/clippy-check@v1
        continue-on-error: true
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --workspace --all-features
+          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all-features

-      - name: Run clippy
+      - name: Clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --workspace --all-features -- -D warnings
+          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all-features --all-targets -- -D warnings
@@ -0,0 +1,43 @@
+# Simple workflow for deploying static content to GitHub Pages
+name: Deploy static content to Pages
+
+on:
+  # Runs on pushes targeting the default branch
+  push:
+    branches: ["feature/ppa-repo"]
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
+# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
+concurrency:
+  group: "pages"
+  cancel-in-progress: false
+
+jobs:
+  # Single deploy job since we're just deploying
+  deploy:
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Setup Pages
+        uses: actions/configure-pages@v3
+      - name: Upload artifact
+        uses: actions/upload-pages-artifact@v2
+        with:
+          # Upload entire repository
+          path: './ppa'
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@v2
@@ -4,26 +4,26 @@ on:
  workflow_dispatch:
  schedule:
    - cron: '14 1 * * *'
+
 jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
        rust: [stable, beta]
-        os: [custom-linux, windows10, custom-runner-mac-m1]
+        os: [ubuntu-20.04, windows-latest, macos-latest]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
    continue-on-error: true
    steps:
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
-        continue-on-error: true
-        if: matrix.os == 'custom-linux'
-
      - name: Check out repository code
        uses: actions/checkout@v3

+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
+        if: matrix.os == 'ubuntu-20.04'
+
      - name: Install Rust toolchain
        uses: actions-rs/toolchain@v1
        with:
@@ -32,6 +32,12 @@ jobs:
          override: true
          components: rustfmt, clippy

+      - name: Install Protoc
+        uses: arduino/setup-protoc@v2
+        if: matrix.os == 'macos-latest' || matrix.os == 'windows-latest'
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+
      - name: Check formatting
        uses: actions-rs/cargo@v1
        with:
@@ -42,13 +48,27 @@ jobs:
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace
+          args: --release --workspace

      - name: Build examples
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace --examples
+          args: --release --workspace --examples
+
+      # To avoid running out of disk space, skip generating debug symbols
+      - name: Set debug to false (unix)
+        if: matrix.os == 'ubuntu-20.04' || matrix.os == 'macos-latest'
+        run: |
+          sed -i.bak 's/\[profile.dev\]/\[profile.dev\]\ndebug = false/' Cargo.toml
+          git diff
+
+      - name: Set debug to false (win)
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: |
+          (Get-Content Cargo.toml) -replace '\[profile.dev\]', "`$&`ndebug = false" | Set-Content Cargo.toml
+          git diff

      - name: Run unit tests
        uses: actions-rs/cargo@v1
@@ -62,6 +82,11 @@ jobs:
          command: test
          args: --workspace -- --ignored

+      - name: Clean
+        uses: actions-rs/cargo@v1
+        with:
+          command: clean
+
      - name: Clippy
        uses: actions-rs/cargo@v1
        with:
@@ -0,0 +1,92 @@
+name: nightly-nym-connect-desktop-build
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '14 1 * * *'
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-20.04, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    env:
+      CARGO_TERM_COLOR: always
+      MANIFEST_PATH: --manifest-path nym-connect/desktop/Cargo.toml
+    continue-on-error: true
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v3
+
+      - name: Install Dependencies (Linux)
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        if: matrix.os == 'ubuntu-20.04'
+
+      - name: Install rust toolchain
+        uses: actions-rs/toolchain@v1
+        with:
+          profile: minimal
+          toolchain: stable
+          override: true
+          components: rustfmt, clippy
+
+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: ${{ env.MANIFEST_PATH }} --all -- --check
+
+      - name: Build
+        uses: actions-rs/cargo@v1
+        with:
+          command: build
+          args: ${{ env.MANIFEST_PATH }} --release --workspace
+
+      - name: Unit tests
+        uses: actions-rs/cargo@v1
+        with:
+          command: test
+          args: ${{ env.MANIFEST_PATH }} --workspace
+
+      - name: Clippy
+        uses: actions-rs/cargo@v1
+        with:
+          command: clippy
+          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings
+
+  notification:
+    needs: build
+    runs-on: custom-linux
+    steps:
+      - name: Collect jobs status
+        uses: technote-space/workflow-conclusion-action@v2
+      - name: Check out repository code
+        uses: actions/checkout@v3
+      - name: install npm
+        uses: actions/setup-node@v3
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        with:
+          node-version: 18
+      - name: Matrix - Node Install
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        run: npm install
+        working-directory: .github/workflows/support-files
+      - name: Matrix - Send Notification
+        if: env.WORKFLOW_CONCLUSION == 'failure'
+        env:
+          NYM_NOTIFICATION_KIND: nightly
+          NYM_PROJECT_NAME: "nym-connect-desktop-nightly-build"
+          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
+          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
+          GIT_BRANCH: "${GITHUB_REF##*/}"
+          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
+          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
+          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
+          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
+          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
+          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
+        uses: docker://keybaseio/client:stable-node
+        with:
+          args: .github/workflows/support-files/notifications/entry_point.sh
@@ -5,27 +5,24 @@ on:
  schedule:
    - cron: '14 1 * * *'

-defaults:
-  run:
-    working-directory: nym-wallet
-
 jobs:
  build:
    strategy:
      fail-fast: false
      matrix:
-        os: [custom-ubuntu-20.04, macos-latest, windows10]
+        os: [ubuntu-20.04, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    env:
      CARGO_TERM_COLOR: always
+      MANIFEST_PATH: --manifest-path nym-wallet/Cargo.toml
    continue-on-error: true
    steps:
      - name: Check out repository code
        uses: actions/checkout@v3

      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
-        if: matrix.os == 'custom-ubuntu-20.04'
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
+        if: matrix.os == 'ubuntu-20.04'

      - name: Install rust toolchain
        uses: actions-rs/toolchain@v1
@@ -35,40 +32,29 @@ jobs:
          override: true
          components: rustfmt, clippy

-      - name: Install Protoc
-        uses: arduino/setup-protoc@v2
-        if: matrix.os == 'macos-latest'
-
      - name: Check formatting
        uses: actions-rs/cargo@v1
        with:
          command: fmt
-          args: --all -- --check
+          args: ${{ env.MANIFEST_PATH }} --all -- --check

      - name: Build
        uses: actions-rs/cargo@v1
        with:
          command: build
-          args: --workspace
+          args: ${{ env.MANIFEST_PATH }} --release --workspace

      - name: Unit tests
        uses: actions-rs/cargo@v1
        with:
          command: test
-          args: --workspace
-
-      - name: Annotate with clippy warnings
-        uses: actions-rs/clippy-check@v1
-        continue-on-error: true
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          args: --workspace
+          args: ${{ env.MANIFEST_PATH }} --workspace

      - name: Clippy
        uses: actions-rs/cargo@v1
        with:
          command: clippy
-          args: --workspace --all-targets -- -D warnings
+          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings

  notification:
    needs: build
@@ -14,13 +14,13 @@ jobs:
      - name: Install Rust stable
        uses: actions-rs/toolchain@v1
        with:
-          toolchain: 1.69.0
+          toolchain: stable
          target: wasm32-unknown-unknown
          override: true
          components: rustfmt, clippy

      - name: Install wasm-opt
-        run: cargo install --version 0.112.0 wasm-opt
+        run: cargo install --version 0.114.0 wasm-opt

      - name: Build release contracts
        run: make contracts
@@ -39,6 +39,7 @@ jobs:
        env:
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
        run: |
          # create variables
@@ -73,6 +74,7 @@ jobs:
          ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
          APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
          APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_IDENTITY_ID }}
          APPLE_ID: ${{ secrets.APPLE_ID }}
          APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}
@@ -12,7 +12,7 @@ jobs:
        uses: actions/setup-node@v3
        with:
          node-version: 18
-          registry-url: 'https://registry.npmjs.org'
+          registry-url: "https://registry.npmjs.org"

      - name: Setup yarn
        run: npm install -g yarn
@@ -28,6 +28,16 @@ jobs:
      - name: Install wasm-opt
        run: cargo install wasm-opt

+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: "1.20"
+
+      - name: Install TinyGo
+        uses: acifani/setup-tinygo@v1
+        with:
+          tinygo-version: "0.27.0"
+
      - name: Install dependencies
        run: yarn

@@ -45,4 +45,6 @@ envs/qwerty.env
 cpu-cycles/libcpucycles/build
 foxyfox.env

-.next
+.next
+ppa-private-key.b64
+ppa-private-key.asc
@@ -3,9 +3,50 @@
 Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

 ## [Unreleased]
- add client registry to Gateway ([#3955])
- add HTTP API to Gateway ([#3955])
- add `/client/<pub-key>`, `clients` and `register` routes to the gateway ([#3955])
+
+## [2023.nyxd-upgrade] (2023-11-22)
+
+- Chore/nyxd 043 upgrade ([#3968])
+
+[#3968]: https://github.com/nymtech/nym/pull/3968
+
+## [2023.4-galaxy] (2023-11-07)
+
+- DRY up client cli ([#4077])
+- [mixnode] replace rocket with axum ([#4071])
+- incorporate the nym node HTTP api into the mixnode ([#4070])
+- replaced '--disable-sign-ext' with '--signext-lowering' when running wasm-opt ([#3896])
+- Added PPA repo hosting support and nym-mixnode package with tooling for publishing ([#4165])
+
+[#4077]: https://github.com/nymtech/nym/pull/4077
+[#4071]: https://github.com/nymtech/nym/pull/4071
+[#4070]: https://github.com/nymtech/nym/issues/4070
+[#3896]: https://github.com/nymtech/nym/pull/3896
+[#4165]: https://github.com/nymtech/nym/pull/4165
+
+## [2023.3-kinder] (2023-10-31)
+
+- suppress error output ([#4056])
+- Update frontend type for current vesting period ([#4042])
+- re-exported additional types for tx queries ([#4036])
+- fixed fmt::Display impl for GatewayNetworkRequesterDetails ([#4033])
+- Add exit node policy from TorNull and Tor Exit Node Policy ([#4024])
+- basic self-described api for gateways to dynamically announce its details + nym-api aggregation ([#4017])
+- use saturating sub in case outfox is not enabled ([#3986])
+- Fix sorting for mixnodes and gateways ([#3985])
+- Gateway client registry and api routes ([#3955])
+- Feature/configurable socks5 bind address ([#3992])
+
+[#4056]: https://github.com/nymtech/nym/pull/4056
+[#4042]: https://github.com/nymtech/nym/pull/4042
+[#4036]: https://github.com/nymtech/nym/pull/4036
+[#4033]: https://github.com/nymtech/nym/pull/4033
+[#4024]: https://github.com/nymtech/nym/issues/4024
+[#4017]: https://github.com/nymtech/nym/issues/4017
+[#3986]: https://github.com/nymtech/nym/pull/3986
+[#3985]: https://github.com/nymtech/nym/pull/3985
+[#3955]: https://github.com/nymtech/nym/pull/3955
+[#3992]: https://github.com/nymtech/nym/pull/3992

 ## [2023.1-milka] (2023-09-24)

@@ -1158,7 +1158,7 @@ checksum = "f769ab9e8c1652d78dd0b3ec59cdaa1e2bcb3b6b39f6681b256abcdbe101cc14"
 dependencies = [
 "anyhow",
 "cargo_metadata",
- "clap 4.4.6",
+ "clap 4.4.7",
 "concolor-control",
 "crates-index",
 "dirs-next",
@@ -1393,9 +1393,9 @@ dependencies = [

 [[package]]
 name = "clap"
-version = "4.4.6"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d04704f56c2cde07f43e8e2c154b43f216dc5c92fc98ada720177362f953b956"
+checksum = "ac495e00dcec98c83465d5ad66c5c4fabd652fd6686e7c6269b117e729a6f17b"
 dependencies = [
 "clap_builder",
 "clap_derive",
@@ -1403,13 +1403,13 @@ dependencies = [

 [[package]]
 name = "clap_builder"
-version = "4.4.6"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0e231faeaca65ebd1ea3c737966bf858971cd38c3849107aa3ea7de90a804e45"
+checksum = "c77ed9a32a62e6ca27175d00d29d05ca32e396ea1eb5fb01d8256b669cec7663"
 dependencies = [
 "anstream",
 "anstyle",
- "clap_lex 0.5.1",
+ "clap_lex 0.6.0",
 "strsim",
 "terminal_size",
 ]
@@ -1420,7 +1420,7 @@ version = "4.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3ae8ba90b9d8b007efe66e55e48fb936272f5ca00349b5b0e89877520d35ea7"
 dependencies = [
- "clap 4.4.6",
+ "clap 4.4.7",
 ]

 [[package]]
@@ -1429,15 +1429,15 @@ version = "4.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "29bdbe21a263b628f83fcbeac86a4416a1d588c7669dd41473bc4149e4e7d2f1"
 dependencies = [
- "clap 4.4.6",
+ "clap 4.4.7",
 "clap_complete",
 ]

 [[package]]
 name = "clap_derive"
-version = "4.4.2"
+version = "4.4.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0862016ff20d69b84ef8247369fabf5c008a7417002411897d40ee1f4532b873"
+checksum = "cf9804afaaf59a91e75b022a30fb7229a7901f60c755489cc61c9b423b836442"
 dependencies = [
 "heck 0.4.1",
 "proc-macro2",
@@ -1456,9 +1456,9 @@ dependencies = [

 [[package]]
 name = "clap_lex"
-version = "0.5.1"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cd7cc57abe963c6d3b9d8be5b06ba7c8957a930305ca90304f24ef040aa6f961"
+checksum = "702fc72eb24e5a1e48ce58027a675bc24edd52096d5397d4aea7c6dd9eca0bd1"

 [[package]]
 name = "cloudabi"
@@ -1554,8 +1554,8 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2895653b4d9f1538a83970077cb01dfc77a4810524e51a110944688e916b18e"
 dependencies = [
- "prost",
- "prost-types",
+ "prost 0.11.9",
+ "prost-types 0.11.9",
 "tonic",
 "tracing-core",
 ]
@@ -1572,7 +1572,7 @@ dependencies = [
 "futures",
 "hdrhistogram",
 "humantime 2.1.0",
- "prost-types",
+ "prost-types 0.11.9",
 "serde",
 "serde_json",
 "thread_local",
@@ -1661,30 +1661,30 @@ dependencies = [

 [[package]]
 name = "cosmos-sdk-proto"
-version = "0.19.0"
+version = "0.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73c9d2043a9e617b0d602fbc0a0ecd621568edbf3a9774890a6d562389bd8e1c"
+checksum = "32560304ab4c365791fd307282f76637213d8083c1a98490c35159cd67852237"
 dependencies = [
- "prost",
- "prost-types",
+ "prost 0.12.1",
+ "prost-types 0.12.1",
 "tendermint-proto",
 ]

 [[package]]
 name = "cosmrs"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af13955d6f356272e6def9ff5e2450a7650df536d8934f47052a20c76513d2f6"
+checksum = "47126f5364df9387b9d8559dcef62e99010e1d4098f39eb3f7ee4b5c254e40ea"
 dependencies = [
 "bip32",
 "cosmos-sdk-proto",
 "ecdsa 0.16.8",
 "eyre",
- "getrandom 0.2.10",
 "k256",
 "rand_core 0.6.4",
 "serde",
 "serde_json",
+ "signature 2.1.0",
 "subtle-encoding",
 "tendermint",
 "tendermint-rpc",
@@ -2009,15 +2009,6 @@ dependencies = [
 "subtle 2.4.1",
 ]

-[[package]]
-name = "ct-logs"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1a816186fa68d9e426e3cb4ae4dff1fcd8e4a2c34b781bf7a822574a0d0aac8"
-dependencies = [
- "sct 0.6.1",
-]
-
 [[package]]
 name = "ctor"
 version = "0.1.26"
@@ -2871,7 +2862,7 @@ dependencies = [
 "bytes",
 "cfg-if",
 "chrono",
- "clap 4.4.6",
+ "clap 4.4.7",
 "config",
 "digest 0.10.7",
 "dirs 5.0.1",
@@ -2938,10 +2929,10 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"

 [[package]]
 name = "explorer-api"
-version = "1.1.30"
+version = "1.1.31"
 dependencies = [
 "chrono",
- "clap 4.4.6",
+ "clap 4.4.7",
 "dotenvy",
 "humantime-serde",
 "isocountry",
@@ -2994,7 +2985,7 @@ dependencies = [

 [[package]]
 name = "extension-storage"
-version = "1.2.0"
+version = "1.2.4-rc.2"
 dependencies = [
 "bip39",
 "console_error_panic_hook",
@@ -3696,30 +3687,6 @@ dependencies = [
 "num-traits",
 ]

-[[package]]
-name = "headers"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06683b93020a07e3dbcf5f8c0f6d40080d725bea7936fc01ad345c01b97dc270"
-dependencies = [
- "base64 0.21.4",
- "bytes",
- "headers-core",
- "http",
- "httpdate",
- "mime",
- "sha1",
-]
-
-[[package]]
-name = "headers-core"
-version = "0.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7f66481bfee273957b1f20485a4ff3362987f85b2c236580d81b4eb7a326429"
-dependencies = [
- "http",
-]
-
 [[package]]
 name = "heck"
 version = "0.3.3"
@@ -3958,40 +3925,17 @@ dependencies = [
 ]

 [[package]]
-name = "hyper-proxy"
-version = "0.9.1"
+name = "hyper-rustls"
+version = "0.24.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca815a891b24fdfb243fa3239c86154392b0953ee584aa1a2a1f66d20cbe75cc"
+checksum = "8d78e1e73ec14cf7375674f74d7dde185c8206fd9dea6fb6295e8a98098aaa97"
 dependencies = [
- "bytes",
- "futures",
- "headers",
+ "futures-util",
 "http",
 "hyper",
- "hyper-rustls",
- "rustls-native-certs",
+ "rustls 0.21.7",
 "tokio",
- "tokio-rustls 0.22.0",
- "tower-service",
- "webpki 0.21.4",
-]
-
-[[package]]
-name = "hyper-rustls"
-version = "0.22.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f9f7a97316d44c0af9b0301e65010573a853a9fc97046d7331d7f6bc0fd5a64"
-dependencies = [
- "ct-logs",
- "futures-util",
- "hyper",
- "log",
- "rustls 0.19.1",
- "rustls-native-certs",
- "tokio",
- "tokio-rustls 0.22.0",
- "webpki 0.21.4",
- "webpki-roots 0.21.1",
+ "tokio-rustls 0.24.1",
 ]

 [[package]]
@@ -4282,6 +4226,15 @@ version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28b29a3cd74f0f4598934efe3aeba42bae0eb4680554128851ebbecb02af14e6"

+[[package]]
+name = "ipnetwork"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8eca9f51da27bc908ef3dd85c21e1bbba794edaf94d7841e37356275b82d31e"
+dependencies = [
+ "serde",
+]
+
 [[package]]
 name = "ipnetwork"
 version = "0.18.0"
@@ -4649,7 +4602,7 @@ dependencies = [
 "once_cell",
 "parking_lot 0.12.1",
 "pin-project",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "rand 0.8.5",
 "rw-stream-sink 0.3.0 (git+https://github.com/ChainSafe/rust-libp2p.git?rev=e3440d25681df380c9f0f8cfdcfd5ecc0a4f2fb6)",
@@ -4735,7 +4688,7 @@ dependencies = [
 "libp2p-swarm 0.42.0",
 "log",
 "prometheus-client",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "prost-codec",
 "rand 0.8.5",
@@ -4793,7 +4746,7 @@ dependencies = [
 "libp2p-swarm 0.42.0",
 "log",
 "lru 0.9.0",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "prost-codec",
 "smallvec",
@@ -4943,7 +4896,7 @@ dependencies = [
 "libp2p-core 0.39.0",
 "log",
 "once_cell",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "rand 0.8.5",
 "sha2 0.10.8",
@@ -5195,7 +5148,7 @@ dependencies = [
 "libp2p-noise 0.42.0",
 "log",
 "multihash",
- "prost",
+ "prost 0.11.9",
 "prost-build",
 "prost-codec",
 "rand 0.8.5",
@@ -5559,12 +5512,13 @@ dependencies = [

 [[package]]
 name = "mix-fetch-wasm"
-version = "1.2.0"
+version = "1.2.4-rc.2"
 dependencies = [
 "async-trait",
 "futures",
 "http-api-client",
 "js-sys",
+ "nym-bin-common",
 "nym-ordered-buffer",
 "nym-service-providers-common",
 "nym-socks5-requests",
@@ -5951,7 +5905,7 @@ dependencies = [

 [[package]]
 name = "nym-api"
-version = "1.1.31"
+version = "1.1.33"
 dependencies = [
 "actix-web",
 "anyhow",
@@ -5961,7 +5915,7 @@ dependencies = [
 "bs58 0.4.0",
 "cfg-if",
 "chrono",
- "clap 4.4.6",
+ "clap 4.4.7",
 "console-subscriber",
 "cosmwasm-std",
 "cw-utils",
@@ -6066,7 +6020,7 @@ name = "nym-bin-common"
 version = "0.6.0"
 dependencies = [
 "atty",
- "clap 4.4.6",
+ "clap 4.4.7",
 "clap_complete",
 "clap_complete_fig",
 "log",
@@ -6101,13 +6055,13 @@ dependencies = [

 [[package]]
 name = "nym-cli"
-version = "1.1.30"
+version = "1.1.32"
 dependencies = [
 "anyhow",
 "base64 0.13.1",
 "bip39",
 "bs58 0.4.0",
- "clap 4.4.6",
+ "clap 4.4.7",
 "clap_complete",
 "clap_complete_fig",
 "dotenvy",
@@ -6132,7 +6086,7 @@ dependencies = [
 "bip39",
 "bs58 0.4.0",
 "cfg-if",
- "clap 4.4.6",
+ "clap 4.4.7",
 "comfy-table",
 "cosmrs",
 "cosmwasm-std",
@@ -6174,9 +6128,9 @@ dependencies = [

 [[package]]
 name = "nym-client"
-version = "1.1.30"
+version = "1.1.31"
 dependencies = [
- "clap 4.4.6",
+ "clap 4.4.7",
 "dirs 4.0.0",
 "futures",
 "lazy_static",
@@ -6215,6 +6169,7 @@ dependencies = [
 "async-trait",
 "base64 0.21.4",
 "cfg-if",
+ "clap 4.4.7",
 "dashmap",
 "dirs 4.0.0",
 "futures",
@@ -6259,11 +6214,12 @@ dependencies = [

 [[package]]
 name = "nym-client-wasm"
-version = "1.2.0"
+version = "1.2.4-rc.2"
 dependencies = [
 "anyhow",
 "futures",
 "js-sys",
+ "nym-bin-common",
 "nym-node-tester-utils",
 "nym-node-tester-wasm",
 "rand 0.7.3",
@@ -6516,14 +6472,14 @@ dependencies = [

 [[package]]
 name = "nym-gateway"
-version = "1.1.30"
+version = "1.1.31"
 dependencies = [
 "anyhow",
 "async-trait",
 "atty",
 "bip39",
 "bs58 0.4.0",
- "clap 4.4.6",
+ "clap 4.4.7",
 "colored",
 "dashmap",
 "dirs 4.0.0",
@@ -6531,6 +6487,7 @@ dependencies = [
 "futures",
 "humantime-serde",
 "hyper",
+ "ipnetwork 0.16.0",
 "lazy_static",
 "log",
 "nym-api-requests",
@@ -6540,6 +6497,7 @@ dependencies = [
 "nym-credentials",
 "nym-crypto",
 "nym-gateway-requests",
+ "nym-ip-packet-router",
 "nym-mixnet-client",
 "nym-mixnode-common",
 "nym-network-defaults",
@@ -6643,6 +6601,51 @@ dependencies = [
 "thiserror",
 ]

+[[package]]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "bytes",
+ "nym-sphinx",
+ "rand 0.8.5",
+ "serde",
+ "thiserror",
+]
+
+[[package]]
+name = "nym-ip-packet-router"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "bytes",
+ "dashmap",
+ "etherparse",
+ "futures",
+ "log",
+ "nym-bin-common",
+ "nym-client-core",
+ "nym-config",
+ "nym-exit-policy",
+ "nym-ip-packet-requests",
+ "nym-network-requester",
+ "nym-sdk",
+ "nym-service-providers-common",
+ "nym-sphinx",
+ "nym-task",
+ "nym-tun",
+ "nym-wireguard",
+ "nym-wireguard-types",
+ "rand 0.8.5",
+ "reqwest",
+ "serde",
+ "serde_json",
+ "tap",
+ "thiserror",
+ "tokio",
+ "url",
+]
+
 [[package]]
 name = "nym-mixnet-client"
 version = "0.1.0"
@@ -6678,12 +6681,13 @@ dependencies = [

 [[package]]
 name = "nym-mixnode"
-version = "1.1.31"
+version = "1.1.33"
 dependencies = [
 "anyhow",
+ "axum",
 "bs58 0.4.0",
 "cfg-if",
- "clap 4.4.6",
+ "clap 4.4.7",
 "colored",
 "cpu-cycles",
 "cupid",
@@ -6698,6 +6702,7 @@ dependencies = [
 "nym-crypto",
 "nym-mixnet-client",
 "nym-mixnode-common",
+ "nym-node",
 "nym-nonexhaustive-delayqueue",
 "nym-pemstore",
 "nym-sphinx",
@@ -6710,10 +6715,10 @@ dependencies = [
 "opentelemetry",
 "pretty_env_logger",
 "rand 0.7.3",
- "rocket",
 "serde",
 "serde_json",
 "sysinfo",
+ "thiserror",
 "tokio",
 "tokio-util",
 "toml 0.5.11",
@@ -6796,13 +6801,13 @@ dependencies = [

 [[package]]
 name = "nym-network-requester"
-version = "1.1.30"
+version = "1.1.31"
 dependencies = [
 "anyhow",
 "async-file-watcher",
 "async-trait",
 "bs58 0.4.0",
- "clap 4.4.6",
+ "clap 4.4.7",
 "dirs 4.0.0",
 "futures",
 "humantime-serde",
@@ -6844,7 +6849,7 @@ dependencies = [

 [[package]]
 name = "nym-network-statistics"
-version = "1.1.30"
+version = "1.1.31"
 dependencies = [
 "dirs 4.0.0",
 "log",
@@ -6871,11 +6876,13 @@ dependencies = [
 "fastrand 2.0.1",
 "hmac 0.12.1",
 "hyper",
+ "ipnetwork 0.16.0",
 "mime",
 "nym-config",
 "nym-crypto",
 "nym-node-requests",
 "nym-task",
+ "nym-wireguard",
 "nym-wireguard-types",
 "rand 0.7.3",
 "serde",
@@ -6931,7 +6938,7 @@ dependencies = [

 [[package]]
 name = "nym-node-tester-wasm"
-version = "1.2.0"
+version = "1.2.4-rc.2"
 dependencies = [
 "futures",
 "js-sys",
@@ -6964,7 +6971,7 @@ name = "nym-nr-query"
 version = "0.1.0"
 dependencies = [
 "anyhow",
- "clap 4.4.6",
+ "clap 4.4.7",
 "log",
 "nym-bin-common",
 "nym-network-defaults",
@@ -7087,9 +7094,9 @@ dependencies = [

 [[package]]
 name = "nym-socks5-client"
-version = "1.1.30"
+version = "1.1.31"
 dependencies = [
- "clap 4.4.6",
+ "clap 4.4.7",
 "lazy_static",
 "log",
 "nym-bin-common",
@@ -7418,6 +7425,18 @@ dependencies = [
 "wasm-utils",
 ]

+[[package]]
+name = "nym-tun"
+version = "0.1.0"
+dependencies = [
+ "etherparse",
+ "log",
+ "nym-wireguard-types",
+ "thiserror",
+ "tokio",
+ "tokio-tun",
+]
+
 [[package]]
 name = "nym-types"
 version = "1.0.0"
@@ -7454,6 +7473,7 @@ version = "0.1.0"
 dependencies = [
 "async-trait",
 "base64 0.13.1",
+ "bip32",
 "bip39",
 "colored",
 "cosmrs",
@@ -7484,7 +7504,7 @@ dependencies = [
 "nym-service-provider-directory-common",
 "nym-vesting-contract-common",
 "openssl",
- "prost",
+ "prost 0.12.1",
 "reqwest",
 "serde",
 "serde_json",
@@ -7531,21 +7551,13 @@ dependencies = [
 "ts-rs",
 ]

-[[package]]
-name = "nym-wasm-sdk"
-version = "1.2.0"
-dependencies = [
- "mix-fetch-wasm",
- "nym-client-wasm",
- "nym-node-tester-wasm",
-]
-
 [[package]]
 name = "nym-wireguard"
 version = "0.1.0"
 dependencies = [
 "async-recursion",
 "base64 0.21.4",
+ "bincode",
 "boringtun",
 "bytes",
 "dashmap",
@@ -7554,7 +7566,10 @@ dependencies = [
 "ip_network",
 "ip_network_table",
 "log",
+ "nym-network-defaults",
+ "nym-sphinx",
 "nym-task",
+ "nym-tun",
 "nym-wireguard-types",
 "rand 0.8.5",
 "serde",
@@ -7570,14 +7585,19 @@ version = "0.1.0"
 dependencies = [
 "base64 0.21.4",
 "boringtun",
+ "bytes",
 "dashmap",
 "hmac 0.12.1",
+ "ip_network",
+ "ip_network_table",
+ "log",
 "nym-crypto",
 "rand 0.7.3",
 "serde",
 "serde_json",
 "sha2 0.10.8",
 "thiserror",
+ "tokio",
 "utoipa",
 "x25519-dalek 2.0.0",
 ]
@@ -8361,7 +8381,17 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
 dependencies = [
 "bytes",
- "prost-derive",
+ "prost-derive 0.11.9",
+]
+
+[[package]]
+name = "prost"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f4fdd22f3b9c31b53c060df4a0613a1c7f062d4115a2b984dd15b1858f7e340d"
+dependencies = [
+ "bytes",
+ "prost-derive 0.12.1",
 ]

 [[package]]
@@ -8378,8 +8408,8 @@ dependencies = [
 "multimap",
 "petgraph",
 "prettyplease",
- "prost",
- "prost-types",
+ "prost 0.11.9",
+ "prost-types 0.11.9",
 "regex",
 "syn 1.0.109",
 "tempfile",
@@ -8393,7 +8423,7 @@ source = "git+https://github.com/ChainSafe/rust-libp2p.git?rev=e3440d25681df380c
 dependencies = [
 "asynchronous-codec",
 "bytes",
- "prost",
+ "prost 0.11.9",
 "thiserror",
 "unsigned-varint",
 ]
@@ -8411,13 +8441,35 @@ dependencies = [
 "syn 1.0.109",
 ]

+[[package]]
+name = "prost-derive"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "265baba7fabd416cf5078179f7d2cbeca4ce7a9041111900675ea7c4cb8a4c32"
+dependencies = [
+ "anyhow",
+ "itertools 0.11.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.38",
+]
+
 [[package]]
 name = "prost-types"
 version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "213622a1460818959ac1181aaeb2dc9c7f63df720db7d788b3e24eacd1983e13"
 dependencies = [
- "prost",
+ "prost 0.11.9",
+]
+
+[[package]]
+name = "prost-types"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e081b29f63d83a4bc75cfc9f3fe424f9156cf92d8a4f0c9407cce9a1b67327cf"
+dependencies = [
+ "prost 0.12.1",
 ]

 [[package]]
@@ -8929,6 +8981,7 @@ dependencies = [
 "http",
 "http-body",
 "hyper",
+ "hyper-rustls",
 "hyper-tls",
 "ipnet",
 "js-sys",
@@ -8938,12 +8991,16 @@ dependencies = [
 "once_cell",
 "percent-encoding",
 "pin-project-lite 0.2.13",
+ "rustls 0.21.7",
+ "rustls-native-certs",
+ "rustls-pemfile",
 "serde",
 "serde_json",
 "serde_urlencoded",
 "system-configuration",
 "tokio",
 "tokio-native-tls",
+ "tokio-rustls 0.24.1",
 "tokio-socks",
 "tower-service",
 "url",
@@ -9343,12 +9400,12 @@ dependencies = [

 [[package]]
 name = "rustls-native-certs"
-version = "0.5.0"
+version = "0.6.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a07b7c1885bd8ed3831c289b7870b13ef46fe0e856d288c30d9cc17d75a2092"
+checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
 dependencies = [
 "openssl-probe",
- "rustls 0.19.1",
+ "rustls-pemfile",
 "schannel",
 "security-framework",
 ]
@@ -9407,9 +9464,9 @@ checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"

 [[package]]
 name = "safer-ffi"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9c1d19b288ca9898cd421c7b105fb7269918a7f8e9253a991e228981ca421ad"
+checksum = "395ace5aff9629c7268ca8255aceb945525b2cb644015f3caec5131a6a537c11"
 dependencies = [
 "inventory",
 "libc",
@@ -9424,9 +9481,9 @@ dependencies = [

 [[package]]
 name = "safer_ffi-proc_macros"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d7a04caa3ca2224f5ea4ddd850e2629c3b36b2b83621f87a8303bf41020110"
+checksum = "9255504d5467bae9e07d58b8de446ba6739b29bf72e1fa35b2387e30d29dcbfe"
 dependencies = [
 "macro_rules_attribute",
 "prettyplease",
@@ -9516,7 +9573,7 @@ version = "0.1.0"
 dependencies = [
 "anyhow",
 "cargo-edit",
- "clap 4.4.6",
+ "clap 4.4.7",
 "semver 1.0.20",
 "serde",
 "serde_json",
@@ -10278,7 +10335,7 @@ name = "ssl-inject"
 version = "0.1.0"
 dependencies = [
 "anyhow",
- "clap 4.4.6",
+ "clap 4.4.7",
 "hex",
 "tokio",
 ]
@@ -10549,9 +10606,9 @@ dependencies = [

 [[package]]
 name = "tendermint"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f0a7d05cf78524782337f8edd55cbc578d159a16ad4affe2135c92f7dbac7f0"
+checksum = "bc2294fa667c8b548ee27a9ba59115472d0a09c2ba255771092a7f1dcf03a789"
 dependencies = [
 "bytes",
 "digest 0.10.7",
@@ -10562,8 +10619,8 @@ dependencies = [
 "k256",
 "num-traits",
 "once_cell",
- "prost",
- "prost-types",
+ "prost 0.12.1",
+ "prost-types 0.12.1",
 "ripemd",
 "serde",
 "serde_bytes",
@@ -10580,9 +10637,9 @@ dependencies = [

 [[package]]
 name = "tendermint-config"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "71a72dbbea6dde12045d261f2c70c0de039125675e8a026c8d5ad34522756372"
+checksum = "5a25dbe8b953e80f3d61789fbdb83bf9ad6c0ef16df5ca6546f49912542cc137"
 dependencies = [
 "flex-error",
 "serde",
@@ -10594,16 +10651,16 @@ dependencies = [

 [[package]]
 name = "tendermint-proto"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0cec054567d16d85e8c3f6a3139963d1a66d9d3051ed545d31562550e9bcc3d"
+checksum = "2cc728a4f9e891d71adf66af6ecaece146f9c7a11312288a3107b3e1d6979aaf"
 dependencies = [
 "bytes",
 "flex-error",
 "num-derive",
 "num-traits",
- "prost",
- "prost-types",
+ "prost 0.12.1",
+ "prost-types 0.12.1",
 "serde",
 "serde_bytes",
 "subtle-encoding",
@@ -10612,21 +10669,18 @@ dependencies = [

 [[package]]
 name = "tendermint-rpc"
-version = "0.32.2"
+version = "0.34.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d119d83a130537fc4a98c3c9eb6899ebe857fea4860400a61675bfb5f0b35129"
+checksum = "dfbf0a4753b46a190f367337e0163d0b552a2674a6bac54e74f9f2cdcde2969b"
 dependencies = [
 "async-trait",
 "bytes",
 "flex-error",
 "futures",
 "getrandom 0.2.10",
- "http",
- "hyper",
- "hyper-proxy",
- "hyper-rustls",
 "peg",
 "pin-project",
+ "reqwest",
 "semver 1.0.20",
 "serde",
 "serde_bytes",
@@ -10850,6 +10904,16 @@ dependencies = [
 "webpki 0.22.4",
 ]

+[[package]]
+name = "tokio-rustls"
+version = "0.24.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+dependencies = [
+ "rustls 0.21.7",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-socks"
 version = "0.5.1"
@@ -11041,7 +11105,7 @@ dependencies = [
 "hyper-timeout",
 "percent-encoding",
 "pin-project",
- "prost",
+ "prost 0.11.9",
 "tokio",
 "tokio-stream",
 "tower",
@@ -49,6 +49,7 @@ members = [
    "common/exit-policy",
    "common/http-api-client",
    "common/inclusion-probability",
+    "common/ip-packet-requests",
    "common/ledger",
    "common/mixnode-common",
    "common/network-defaults",
@@ -74,6 +75,7 @@ members = [
    "common/store-cipher",
    "common/task",
    "common/topology",
+    "common/tun",
    "common/types",
    "common/wasm/client-core",
    "common/wasm/storage",
@@ -90,6 +92,7 @@ members = [
    "sdk/lib/socks5-listener",
    "sdk/rust/nym-sdk",
    "service-providers/common",
+    "service-providers/ip-packet-router",
    "service-providers/network-requester",
    "service-providers/network-statistics",
    "nym-api",
@@ -104,7 +107,7 @@ members = [
    "tools/nym-nr-query",
    "tools/ts-rs-cli",
    "wasm/client",
-    "wasm/full-nym-wasm",
+#    "wasm/full-nym-wasm",
    "wasm/mix-fetch",
    "wasm/node-tester",
 ]
@@ -137,22 +140,8 @@ axum = "0.6.20"
 base64 = "0.21.4"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
 boringtun = { git = "https://github.com/cloudflare/boringtun", rev = "e1d6360d6ab4529fc942a078e4c54df107abe2ba" }
+clap = "4.4.7"
 cfg-if = "1.0.0"
-cosmwasm-derive = "=1.3.0"
-cosmwasm-schema = "=1.3.0"
-cosmwasm-std = "=1.3.0"
-# use 0.5.0 as that's the version used by cosmwasm-std 1.3.0
-# (and ideally we don't want to pull the same dependency twice)
-serde-json-wasm = "=0.5.0"
-cosmwasm-storage = "=1.3.0"
-cosmrs = "=0.14.0"
-# same version as used by cosmrs
-cw-utils = "=1.0.1"
-cw-storage-plus = "=1.1.0"
-cw2 = { version = "=1.1.0" }
-cw3 = { version = "=1.1.0" }
-cw4 = { version = "=1.1.0" }
-cw-controllers = { version = "=1.1.0" }
 dashmap = "5.5.3"
 dotenvy = "0.15.6"
 futures = "0.3.28"
@@ -170,7 +159,6 @@ schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
 tap = "1.0.1"
-tendermint-rpc = "0.32" # same version as used by cosmrs
 thiserror = "1.0.48"
 tokio = "1.24.1"
 tokio-tungstenite = "0.20.1"
@@ -182,6 +170,28 @@ utoipa-swagger-ui = "3.1.5"
 url = "2.4"
 zeroize = "1.6.0"

+# cosmwasm-related
+cosmwasm-derive = "=1.3.0"
+cosmwasm-schema = "=1.3.0"
+cosmwasm-std = "=1.3.0"
+# use 0.5.0 as that's the version used by cosmwasm-std 1.3.0
+# (and ideally we don't want to pull the same dependency twice)
+serde-json-wasm = "=0.5.0"
+cosmwasm-storage = "=1.3.0"
+# same version as used by cosmwasm
+cw-utils = "=1.0.1"
+cw-storage-plus = "=1.1.0"
+cw2 = { version = "=1.1.0" }
+cw3 = { version = "=1.1.0" }
+cw4 = { version = "=1.1.0" }
+cw-controllers = { version = "=1.1.0" }
+
+# cosmrs-related
+bip32 = "0.5.1"
+cosmrs = "=0.15.0"
+tendermint-rpc = "0.34" # same version as used by cosmrs
+prost = "0.12"
+
 # wasm-related dependencies
 gloo-utils = "0.1.7"
 js-sys = "0.3.63"
@@ -93,10 +93,6 @@ $(eval $(call add_cargo_workspace,contracts,contracts,--lib --target wasm32-unkn
 $(eval $(call add_cargo_workspace,wallet,nym-wallet))
 $(eval $(call add_cargo_workspace,connect,nym-connect/desktop))

-# OVERRIDE: wasm-opt fails if the binary has been built with the latest rustc.
-# Pin to the last working version.
-contracts_BUILD_RELEASE_TOOLCHAIN := +1.69.0
-
 # -----------------------------------------------------------------------------
 # SDK
 # -----------------------------------------------------------------------------
@@ -108,7 +104,7 @@ sdk-wasm-build:
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
 	$(MAKE) -C wasm/mix-fetch
-	$(MAKE) -C wasm/full-nym-wasm
+	#$(MAKE) -C wasm/full-nym-wasm

 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
@@ -118,7 +114,7 @@ sdk-typescript-build:
 	yarn --cwd sdk/typescript/codegen/contract-clients build

 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
-WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm nym-wasm-sdk
+WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm

 sdk-wasm-test:
 	#cargo test $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
@@ -144,7 +140,7 @@ contracts: build-release-contracts wasm-opt-contracts

 wasm-opt-contracts:
 	for contract in $(CONTRACTS_WASM); do \
-	  wasm-opt --disable-sign-ext -Os $(CONTRACTS_OUT_DIR)/$$contract -o $(CONTRACTS_OUT_DIR)/$$contract; \
+	  wasm-opt --signext-lowering -Os $(CONTRACTS_OUT_DIR)/$$contract -o $(CONTRACTS_OUT_DIR)/$$contract; \
 	done

 # Consider adding 's' to make plural consistent (beware: used in github workflow)
@@ -172,3 +168,7 @@ generate-typescript:
 run-api-tests:
 	cd nym-api/tests/functional_test && yarn test:qa

+# Build debian package, and update PPA
+# Requires base64 encode GPG key to be set up in environment PPA_SIGNING_KEY
+deb:
+	scripts/ppa.sh
@@ -15,7 +15,6 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr
 * nym-explorer - a (projected) block explorer and (existing) mixnet viewer.
 * nym-wallet - a desktop wallet implemented using the [Tauri](https://tauri.studio/en/docs/about/intro) framework.

-[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg?style=for-the-badge)](https://opensource.org/licenses/Apache-2.0)
 [![Build Status](https://img.shields.io/github/actions/workflow/status/nymtech/nym/build.yml?branch=develop&style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)


@@ -83,4 +82,11 @@ where `s'` is stake `s` scaled over total token circulating supply.

 ### Licensing and copyright information

-This program is available as open source under the terms of the Apache 2.0 license. However, some elements are being licensed under CC0-1.0 and MIT. For accurate information, please check individual files.
+This is a monorepo and components that make up Nym as a system are licensed individually, so for accurate information, please check individual files.
+
+As a general approach, licensing is as follows this pattern:
+- applications and binaries are GPLv3
+- libraries and components are Apache 2.0 or MIT
+- documentation is Apache 2.0 or CC0-1.0
+
+Again, for accurate information, please check individual files.
@@ -1,10 +1,90 @@
 Critical bug or security issue 💥

-If you're here because you're trying to figure out how to notify us of a security issue, go to Discord, and alert the core engineers:
+If you're here because you're trying to figure out how to notify us of a security issue, send us a PGP encrypted email to:

-    Dave Hrycyszyn futurechimp#5430
-    Jedrzej Stuczynski "Jedrzej | Nym#5666"
-    Fran Arbanas | franarbanas#0995
-    Mark Sinclair | marknym#8088 
+```
+security@nymte.ch
+```
+
+Encrypted with our public key which is available below in plain text and also on keyservers:
+
+```
+pub   rsa4096 2023-10-30 [SC] [expire : 2026-10-29]
+      24B2592E801A5AAA8666C8BA7C3C727F05090550
+uid          [  ultime ] Security Nym Technologies <security@nymte.ch>
+sub   rsa4096 2023-10-30 [E] [expire : 2026-10-29]
+
+```
+
+The fingerprint of the key is on the second line above.
+
+If you need to chat __urgently__ to our team for a __critical__ security issue:
+
+go to Matrix, and alert the core engineers with a private direct message:
+
+    Jedrzej Stuczynski @jstuczyn:nymtech.chat
+    Mark Sinclair @mark:nymtech.chat
+    Raphaël Walther @raphael:nymtech.chat

 Please avoid opening public issues on GitHub that contain information about a potential security vulnerability as this makes it difficult to reduce the impact and harm of valid security issues.
+
+If you don't know what Matrix is, you can follow this documentation to create an account on this federation of instant messaging servers:
+
+[Matrix for Instant Messaging](https://matrix.org/docs/chat_basics/matrix-for-im/)
+
+
+
+```
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+mQINBGU/XpcBEAC+ykz0yxn8FferjEBooptXlOH/v/28aa0Nv8DfImTgj9BNY5cR
+UdLk+Wa3CSXQVE7PIsi0egEjAMfyxPEywbvPlgklW4XAKDVUCf3gxpQNN47VuVgV
+VwrN0VBurhhIKoEw9daO6A0P44+6nmXGIfUulCr4fMxYq82SOooog/j5w0/LfITu
+rQXxVABLkXHGN/NGf4BE52QI/ppeXWoshlNVU1wdZIIYWwte+9ukikWpN+LYfJUR
+ybtyCjQ4Gdf8ap1GmkKHmAru24wbUuFsBWGVgHsXAwYlKxyiNGR9YwgAxmFk6vNf
+1PqKGO3i4erx5X/+mzylzNbFlCqFuksZRyUSDZvQ8fxkm8ra1zWbO38eOTp8Vhgg
+SKfRTzOKeZYURZicJPxmEIfA88U4tx+YWJ54YWT/gERZkjIJL5mzIuY9UulVvKUM
+vMFUIzBMHOPXH16036zGyFMC1esRd2qqil4b9KtLgCOkrD1VgpjcveoA0VyMJCN6
+LmKTrVjwjjDMxby+d49BolRWGnCofXozXwvNQx+CYv8M2WPErTpyYoofYFtpqr7A
+fIufc/e0+um3zoGIbHejrhsbuH9Qf+MKsI+Ng93bdDtjeHz6MEgAlsTm0qeizYpj
+IyKZIObPmfvrAm08hFZ8JnGk+XuooF36XWbJYjCCy0bOyMw1r7ZG99TcSwARAQAB
+tC1TZWN1cml0eSBOeW0gVGVjaG5vbG9naWVzIDxzZWN1cml0eUBueW10ZS5jaD6J
+AlQEEwEKAD4WIQQkslkugBpaqoZmyLp8PHJ/BQkFUAUCZT9elwIbAwUJBaOagAUL
+CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRB8PHJ/BQkFUL7dD/9zO73uI5VR+SWx
+PFmJW+9QsPiQbVRvGwNZurctmQ2s2Pe0vHRELFeqD5oYvSx2Lequ3Ir+zn/C3kDM
+kNs40obSL6jCBiLPkxEY0JqzPM9jZr7EjvlibWV3f6DxooRIqEyfN57I3OBGlqZE
+0Mx7sQuCcgau8C70DF952QhKUwXC2cmpmDKHVEEoio1xGSD4dQhGapCB32RQGtna
+OGfAO9celNMvSq0Lp+aJxeACmWFY5T4/y79JPcT5vSs/yEIRmaH/fn2piwaFBsIq
+gHJJMxO3740P1hF8j7KWUoUofuFaEALHBpEpjWTOj8ej1wmFlu+5F+jSVoc781Wb
+ZZXu04cOBXnGTogzSxMpBe9TtLb28zd6WzFotC25KTI3pngMzXsQGLJLOwvoZKiS
+LFjPRjg1rwobmB3Q3J2W5GYSveia0CDsZGP+g87GVVf/oD2Djpa68xyVYwIYeA6T
+3DNdS77qHiRuGiS4kWXyVjDqOICboR4uCvt09zlkBuLDdTWqWYARUvZjtjs4w/Ol
+rdrBI3A88ti8fRldYaNpu17ME1ilpN44yKoJtqiWc3Tisk8eYLfx6c7FQF3PrRva
+mr7FZvhFsYML5CeNFHTEzN6Y3jjKN/60DvCfodWnWFK47Txkl8UAXGY2W9B0fWqQ
+wUVr8uLuMyyMiKbeoufi7rGOj6AMErkCDQRlP16XARAA8FGmD5J3tM1BOM1niJxZ
+JTdCauzEtxEoBL0RuqGBkR8U29sRM6DwuzjU7PwscFnBaGyU+eU73GwGkH3ozFfF
+tllYhQrhP/kkN+0rEO5Xi+nR+4JCFRqrf3nJXAAPfiksURMp8er1dUOY2/e1ZSoL
+tS+nzUivV8CfE+pgj/5YtGwPC+KYHLATkKkMELCrbW4UO06VWOqQsvr6kivXuJQQ
+LdEAMpBlADmXFG45DmPKQzsBWUgvTwyGy3LX0nys8cgpex9BH8hhr01QmGyP469s
+N3cNrtFuu8U6RAsiCD/8mlBuD3EQEU5SF0lc7kCICAZk+wElmXnimEi0TOYsbz6k
+90lteicX70rA9GNeyI76H+VSOYvWpkRwaJAgUdzrAM1o9SHASq+cZ6nD85OZioQk
+DWM6+Q+sf2oen0qJnnGmUr93kJIC0PIdgrXRrtiNfeRa1Z/H0LmREyyEMoFiVivn
+z1vVk85Oq6Sf3ltUwvmDzuuJOtsp2Qp6+x6Snn/yKauI4uf4Cf/wKUch4r6Bwgg5
+Dw49ky7lwlnALio4GIVoGLpLef93wWoDmp4Klyh3ZPf2nB0U91u3bHRUo7m+D7QJ
+98cyKtqLLzjg7szGf60pIWNWRsadYQT3bSncynqknAjOV3BCvx6/ivsnpj//QjYR
+HtviUAcQ1DBB6UC6q23FIs0AEQEAAYkCPAQYAQoAJhYhBCSyWS6AGlqqhmbIunw8
+cn8FCQVQBQJlP16XAhsMBQkFo5qAAAoJEHw8cn8FCQVQzukP/iLxjOxT+UpPR//c
+prDVSLkP4pF5bmw36U07jvqpS+/KTXsxiiQleffRabOpNLcd+K1ueavyt9nnIwHH
+tHS9kM9A7DBw3LnpEbXki46QDCCI6niGijlLOEeAWqnocwMNTT05wVVgCtO3DQP2
+MoSCcqHpXDChvOyr5d5xjYLVJhlctIMSomcVzGryjknPu0Yj/TkC/4c+m86ZWQUD
+HqMHQIuiEenvb62/F4c5OJIRZPEn70wdddkgJuJU3eHdHrnuhCkjCC93GQGbGj03
+Zqos6699y6hmPeD3U5IUv8ujwZYVCCuDm8gJfrp3R6WLfeZeK9WmTVBpCzsDg3fV
+hSwmOk6pp8DAq1/Dev3yRkFggCEyGK6c9b+a0CRBncl8e5Q0QQIzNiS/uExQP3h+
+ELJs3P0MLP+6FWhNUry09n3lnWkr1hY+v1M0GAxbfdv/tsCN1Pq/VQEz+CTqXqya
+ftWldOHWw6Hh+gtwxcHjG4MBOrO5oICQ3lh2hGwQ58cDgZYSK/OGgJ9BggFl1CcM
+0uGC0/TRCI1zt/4y+7efSZQMZkHo7VC/3MFbp2hcNejpW+BxVuwKTunFvWK3TLhq
+sSlQ5yyhqchooepsFHq9bosKFjLJC01uprBv1rinoNduOy43FbyS7JPRRspANN0R
+iC2pMbWdE0ZTQaFq6tPIg058pjqi
+=nqgX
+-----END PGP PUBLIC KEY BLOCK-----
+```
@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.30"
+version = "1.1.31"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -20,7 +20,7 @@ futures = { workspace = true } # bunch of futures stuff, however, now that I thi
 # and the single instance of abortable we have should really be refactored anyway
 url = { workspace = true }

-clap = { version = "4.0", features = ["cargo", "derive"] }
+clap = { workspace = true, features = ["cargo", "derive"] }
 dirs = "4.0"
 lazy_static = "1.4.0"
 log = { workspace = true } # self explanatory
@@ -36,7 +36,7 @@ tokio-tungstenite = { workspace = true }
 ## internal
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage"] }
+nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
 nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-config = { path = "../../common/config" }
 nym-credential-storage = { path = "../../common/credential-storage" }
@@ -4,6 +4,8 @@
 use crate::client::config::persistence::ClientPaths;
 use crate::client::config::template::CONFIG_TEMPLATE;
 use nym_bin_common::logging::LoggingSettings;
+use nym_client_core::cli_helpers::client_init::ClientConfig;
+use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::defaults::DEFAULT_WEBSOCKET_LISTENING_PORT;
 use nym_config::{
    must_get_home, read_config_from_toml_file, save_formatted_config_to_file, NymConfigTemplate,
@@ -72,6 +74,24 @@ impl NymConfigTemplate for Config {
    }
 }

+impl ClientConfig for Config {
+    fn common_paths(&self) -> &CommonClientPaths {
+        &self.storage_paths.common_paths
+    }
+
+    fn core_config(&self) -> &BaseClientConfig {
+        &self.base
+    }
+
+    fn default_store_location(&self) -> PathBuf {
+        self.default_location()
+    }
+
+    fn save_to<P: AsRef<Path>>(&self, path: P) -> io::Result<()> {
+        save_formatted_config_to_file(self, path)
+    }
+}
+
 impl Config {
    pub fn new<S: AsRef<str>>(id: S) -> Self {
        Config {
@@ -12,55 +12,49 @@ use crate::{
 };
 use clap::Args;
 use nym_bin_common::output_format::OutputFormat;
-use nym_client_core::client::base_client::storage::gateway_details::OnDiskGatewayDetails;
-use nym_client_core::client::key_manager::persistence::OnDiskKeys;
-use nym_client_core::config::GatewayEndpointConfig;
-use nym_client_core::error::ClientCoreError;
-use nym_client_core::init::helpers::current_gateways;
-use nym_client_core::init::types::{GatewayDetails, GatewaySelectionSpecification, GatewaySetup};
-use nym_crypto::asymmetric::identity;
-use nym_sphinx::addressing::clients::Recipient;
-use nym_topology::NymTopology;
+use nym_client_core::cli_helpers::client_init::{
+    initialise_client, CommonClientInitArgs, InitResultsWithConfig, InitialisableClient,
+};
 use serde::Serialize;
 use std::fmt::Display;
+use std::fs;
 use std::net::IpAddr;
 use std::path::PathBuf;
-use std::{fs, io};
-use tap::TapFallible;
+
+struct NativeClientInit;
+
+impl InitialisableClient for NativeClientInit {
+    const NAME: &'static str = "native";
+    type Error = ClientError;
+    type InitArgs = Init;
+    type Config = Config;
+
+    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
+        try_upgrade_config(id)
+    }
+
+    fn initialise_storage_paths(id: &str) -> Result<(), Self::Error> {
+        fs::create_dir_all(default_data_directory(id))?;
+        fs::create_dir_all(default_config_directory(id))?;
+        Ok(())
+    }
+
+    fn default_config_path(id: &str) -> PathBuf {
+        default_config_filepath(id)
+    }
+
+    fn construct_config(init_args: &Self::InitArgs) -> Self::Config {
+        override_config(
+            Config::new(&init_args.common_args.id),
+            OverrideConfig::from(init_args.clone()),
+        )
+    }
+}

 #[derive(Args, Clone)]
 pub(crate) struct Init {
-    /// Id of the nym-mixnet-client we want to create config for.
-    #[clap(long)]
-    id: String,
-
-    /// Id of the gateway we are going to connect to.
-    #[clap(long)]
-    gateway: Option<identity::PublicKey>,
-
-    /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
-    /// uniformly.
-    #[clap(long, conflicts_with = "gateway")]
-    latency_based_selection: bool,
-
-    /// Force register gateway. WARNING: this will overwrite any existing keys for the given id,
-    /// potentially causing loss of access.
-    #[clap(long)]
-    force_register_gateway: bool,
-
-    /// Comma separated list of rest endpoints of the nyxd validators
-    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
-    nyxd_urls: Option<Vec<url::Url>>,
-
-    /// Comma separated list of rest endpoints of the API validators
-    #[clap(
-        long,
-        alias = "api_validators",
-        value_delimiter = ',',
-        group = "network"
-    )]
-    // the alias here is included for backwards compatibility (1.1.4 and before)
-    nym_apis: Option<Vec<url::Url>>,
+    #[command(flatten)]
+    common_args: CommonClientInitArgs,

    /// Whether to not start the websocket
    #[clap(long)]
@@ -74,40 +68,28 @@ pub(crate) struct Init {
    #[clap(long)]
    host: Option<IpAddr>,

-    /// Path to .json file containing custom network specification.
-    #[clap(long, group = "network", hide = true)]
-    custom_mixnet: Option<PathBuf>,
-
-    /// Mostly debug-related option to increase default traffic rate so that you would not need to
-    /// modify config post init
-    #[clap(long, hide = true)]
-    fastmode: bool,
-
-    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
-    #[clap(long, hide = true)]
-    no_cover: bool,
-
-    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
-    /// with bandwidth credential requirement.
-    #[clap(long, hide = true)]
-    enabled_credentials_mode: Option<bool>,
-
    #[clap(short, long, default_value_t = OutputFormat::default())]
    output: OutputFormat,
 }

+impl AsRef<CommonClientInitArgs> for Init {
+    fn as_ref(&self) -> &CommonClientInitArgs {
+        &self.common_args
+    }
+}
+
 impl From<Init> for OverrideConfig {
    fn from(init_config: Init) -> Self {
        OverrideConfig {
-            nym_apis: init_config.nym_apis,
+            nym_apis: init_config.common_args.nym_apis,
            disable_socket: init_config.disable_socket,
            port: init_config.port,
            host: init_config.host,
-            fastmode: init_config.fastmode,
-            no_cover: init_config.no_cover,
+            fastmode: init_config.common_args.fastmode,
+            no_cover: init_config.common_args.no_cover,

-            nyxd_urls: init_config.nyxd_urls,
-            enabled_credentials_mode: init_config.enabled_credentials_mode,
+            nyxd_urls: init_config.common_args.nyxd_urls,
+            enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
        }
    }
 }
@@ -121,15 +103,11 @@ pub struct InitResults {
 }

 impl InitResults {
-    fn new(config: &Config, address: &Recipient, gateway: &GatewayEndpointConfig) -> Self {
+    fn new(res: InitResultsWithConfig<Config>) -> Self {
        Self {
-            client_core: nym_client_core::init::types::InitResults::new(
-                &config.base,
-                address,
-                gateway,
-            ),
-            client_listening_port: config.socket.listening_port,
-            client_address: address.to_string(),
+            client_address: res.init_results.address.to_string(),
+            client_core: res.init_results,
+            client_listening_port: res.config.socket.listening_port,
        }
    }
 }
@@ -142,97 +120,14 @@ impl Display for InitResults {
    }
 }

-fn init_paths(id: &str) -> io::Result<()> {
-    fs::create_dir_all(default_data_directory(id))?;
-    fs::create_dir_all(default_config_directory(id))
-}
-
 pub(crate) async fn execute(args: Init) -> Result<(), ClientError> {
    eprintln!("Initialising client...");

-    let id = &args.id;
+    let output = args.output;
+    let res = initialise_client::<NativeClientInit>(args).await?;

-    let already_init = if default_config_filepath(id).exists() {
-        // in case we're using old config, try to upgrade it
-        // (if we're using the current version, it's a no-op)
-        try_upgrade_config(id)?;
-        eprintln!("Client \"{id}\" was already initialised before");
-        true
-    } else {
-        init_paths(id)?;
-        false
-    };
-
-    // Usually you only register with the gateway on the first init, however you can force
-    // re-registering if wanted.
-    let user_wants_force_register = args.force_register_gateway;
-    if user_wants_force_register {
-        eprintln!("Instructed to force registering gateway. This will overwrite keys!");
-    }
-
-    // If the client was already initialized, don't generate new keys and don't re-register with
-    // the gateway (because this would create a new shared key).
-    // Unless the user really wants to.
-    let register_gateway = !already_init || user_wants_force_register;
-
-    // Attempt to use a user-provided gateway, if possible
-    let user_chosen_gateway_id = args.gateway;
-    let selection_spec = GatewaySelectionSpecification::new(
-        user_chosen_gateway_id.map(|id| id.to_base58_string()),
-        Some(args.latency_based_selection),
-        false,
-    );
-
-    // Load and potentially override config
-    let config = override_config(Config::new(id), OverrideConfig::from(args.clone()));
-
-    // Setup gateway by either registering a new one, or creating a new config from the selected
-    // one but with keys kept, or reusing the gateway configuration.
-    let key_store = OnDiskKeys::new(config.storage_paths.common_paths.keys.clone());
-    let details_store =
-        OnDiskGatewayDetails::new(&config.storage_paths.common_paths.gateway_details);
-
-    let available_gateways = if let Some(hardcoded_topology) = args
-        .custom_mixnet
-        .map(NymTopology::new_from_file)
-        .transpose()?
-    {
-        // hardcoded_topology
-        hardcoded_topology.get_gateways()
-    } else {
-        let mut rng = rand::thread_rng();
-        current_gateways(&mut rng, &config.base.client.nym_api_urls).await?
-    };
-
-    let gateway_setup = GatewaySetup::New {
-        specification: selection_spec,
-        available_gateways,
-        overwrite_data: register_gateway,
-    };
-
-    let init_details =
-        nym_client_core::init::setup_gateway(gateway_setup, &key_store, &details_store)
-            .await
-            .tap_err(|err| eprintln!("Failed to setup gateway\nError: {err}"))?;
-
-    let config_save_location = config.default_location();
-    config.save_to_default_location().tap_err(|_| {
-        log::error!("Failed to save the config file");
-    })?;
-    eprintln!(
-        "Saved configuration file to {}",
-        config_save_location.display()
-    );
-
-    let address = init_details.client_address()?;
-
-    eprintln!("Client configuration completed.\n");
-
-    let GatewayDetails::Configured(gateway_details) = init_details.gateway_details else {
-        return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
-    };
-    let init_results = InitResults::new(&config, &address, &gateway_details);
-    println!("{}", args.output.format(&init_results));
+    let init_results = InitResults::new(res);
+    println!("{}", output.format(&init_results));

    Ok(())
 }
@@ -10,35 +10,14 @@ use crate::{
 use clap::Args;
 use log::*;
 use nym_bin_common::version_checker::is_minor_version_compatible;
-use nym_crypto::asymmetric::identity;
+use nym_client_core::cli_helpers::client_run::CommonClientRunArgs;
 use std::error::Error;
 use std::net::IpAddr;
-use std::path::PathBuf;

 #[derive(Args, Clone)]
 pub(crate) struct Run {
-    /// Id of the nym-mixnet-client we want to run.
-    #[clap(long)]
-    id: String,
-
-    /// Comma separated list of rest endpoints of the nyxd validators
-    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
-    nyxd_urls: Option<Vec<url::Url>>,
-
-    /// Comma separated list of rest endpoints of the API validators
-    #[clap(
-        long,
-        alias = "api_validators",
-        value_delimiter = ',',
-        group = "network"
-    )]
-    // the alias here is included for backwards compatibility (1.1.4 and before)
-    nym_apis: Option<Vec<url::Url>>,
-
-    /// Id of the gateway we want to connect to. If overridden, it is user's responsibility to
-    /// ensure prior registration happened
-    #[clap(long)]
-    gateway: Option<identity::PublicKey>,
+    #[command(flatten)]
+    common_args: CommonClientRunArgs,

    /// Whether to not start the websocket
    #[clap(long)]
@@ -51,37 +30,19 @@ pub(crate) struct Run {
    /// Ip for the socket (if applicable) to listen for requests.
    #[clap(long)]
    host: Option<IpAddr>,
-
-    /// Path to .json file containing custom network specification.
-    #[clap(long, group = "network", hide = true)]
-    custom_mixnet: Option<PathBuf>,
-
-    /// Mostly debug-related option to increase default traffic rate so that you would not need to
-    /// modify config post init
-    #[clap(long, hide = true)]
-    fastmode: bool,
-
-    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
-    #[clap(long, hide = true)]
-    no_cover: bool,
-
-    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
-    /// with bandwidth credential requirement.
-    #[clap(long, hide = true)]
-    enabled_credentials_mode: Option<bool>,
 }

 impl From<Run> for OverrideConfig {
    fn from(run_config: Run) -> Self {
        OverrideConfig {
-            nym_apis: run_config.nym_apis,
+            nym_apis: run_config.common_args.nym_apis,
            disable_socket: run_config.disable_socket,
            port: run_config.port,
            host: run_config.host,
-            fastmode: run_config.fastmode,
-            no_cover: run_config.no_cover,
-            nyxd_urls: run_config.nyxd_urls,
-            enabled_credentials_mode: run_config.enabled_credentials_mode,
+            fastmode: run_config.common_args.fastmode,
+            no_cover: run_config.common_args.no_cover,
+            nyxd_urls: run_config.common_args.nyxd_urls,
+            enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
        }
    }
 }
@@ -106,9 +67,9 @@ fn version_check(cfg: &Config) -> bool {
 }

 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn Error + Send + Sync>> {
-    eprintln!("Starting client {}...", args.id);
+    eprintln!("Starting client {}...", args.common_args.id);

-    let mut config = try_load_current_config(&args.id)?;
+    let mut config = try_load_current_config(&args.common_args.id)?;
    config = override_config(config, OverrideConfig::from(args.clone()));

    if !version_check(&config) {
@@ -116,7 +77,7 @@ pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn Error + Send + Sync
        return Err(Box::new(ClientError::FailedLocalVersionCheck));
    }

-    SocketClient::new(config, args.custom_mixnet)
+    SocketClient::new(config, args.common_args.custom_mixnet)
        .run_socket_forever()
        .await
 }
@@ -22,5 +22,10 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
    }
    setup_logging();

-    commands::execute(args).await
+    if let Err(err) = commands::execute(args).await {
+        log::error!("{err}");
+        println!("An error occurred: {err}");
+        std::process::exit(1);
+    }
+    Ok(())
 }
@@ -1,13 +1,13 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.30"
+version = "1.1.31"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
 rust-version = "1.56"

 [dependencies]
-clap = { version = "4.0", features = ["cargo", "derive"] }
+clap = { workspace = true, features = ["cargo", "derive"] }
 lazy_static = "1.4.0"
 log = { workspace = true }
 pretty_env_logger = "0.4"
@@ -21,7 +21,7 @@ url = { workspace = true }

 # internal
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage"] }
+nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
 nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-config = { path = "../../common/config" }
 nym-credentials = { path = "../../common/credentials" }
@@ -11,27 +11,50 @@ use crate::{
 };
 use clap::Args;
 use nym_bin_common::output_format::OutputFormat;
-use nym_client_core::client::base_client::storage::gateway_details::OnDiskGatewayDetails;
-use nym_client_core::client::key_manager::persistence::OnDiskKeys;
-use nym_client_core::config::GatewayEndpointConfig;
-use nym_client_core::error::ClientCoreError;
-use nym_client_core::init::helpers::current_gateways;
-use nym_client_core::init::types::{GatewayDetails, GatewaySelectionSpecification, GatewaySetup};
-use nym_crypto::asymmetric::identity;
+use nym_client_core::cli_helpers::client_init::{
+    initialise_client, CommonClientInitArgs, InitResultsWithConfig, InitialisableClient,
+};
 use nym_sphinx::addressing::clients::Recipient;
-use nym_topology::NymTopology;
 use serde::Serialize;
 use std::fmt::Display;
+use std::fs;
 use std::net::{IpAddr, SocketAddr};
 use std::path::PathBuf;
-use std::{fs, io};
-use tap::TapFallible;
+
+struct Socks5ClientInit;
+
+impl InitialisableClient for Socks5ClientInit {
+    const NAME: &'static str = "socks5";
+    type Error = Socks5ClientError;
+    type InitArgs = Init;
+    type Config = Config;
+
+    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
+        try_upgrade_config(id)
+    }
+
+    fn initialise_storage_paths(id: &str) -> Result<(), Self::Error> {
+        fs::create_dir_all(default_data_directory(id))?;
+        fs::create_dir_all(default_config_directory(id))?;
+        Ok(())
+    }
+
+    fn default_config_path(id: &str) -> PathBuf {
+        default_config_filepath(id)
+    }
+
+    fn construct_config(init_args: &Self::InitArgs) -> Self::Config {
+        override_config(
+            Config::new(&init_args.common_args.id, &init_args.provider.to_string()),
+            OverrideConfig::from(init_args.clone()),
+        )
+    }
+}

 #[derive(Args, Clone)]
 pub(crate) struct Init {
-    /// Id of the nym-mixnet-client we want to create config for.
-    #[clap(long)]
-    id: String,
+    #[command(flatten)]
+    common_args: CommonClientInitArgs,

    /// Address of the socks5 provider to send messages to.
    #[clap(long)]
@@ -46,34 +69,6 @@ pub(crate) struct Init {
    #[clap(long, alias = "use_anonymous_sender_tag")]
    use_reply_surbs: Option<bool>,

-    /// Id of the gateway we are going to connect to.
-    #[clap(long)]
-    gateway: Option<identity::PublicKey>,
-
-    /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
-    /// uniformly.
-    #[clap(long, conflicts_with = "gateway")]
-    latency_based_selection: bool,
-
-    /// Force register gateway. WARNING: this will overwrite any existing keys for the given id,
-    /// potentially causing loss of access.
-    #[clap(long)]
-    force_register_gateway: bool,
-
-    /// Comma separated list of rest endpoints of the nyxd validators
-    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
-    nyxd_urls: Option<Vec<url::Url>>,
-
-    /// Comma separated list of rest endpoints of the API validators
-    #[clap(
-        long,
-        alias = "api_validators",
-        value_delimiter = ',',
-        group = "network"
-    )]
-    // the alias here is included for backwards compatibility (1.1.4 and before)
-    nym_apis: Option<Vec<url::Url>>,
-
    /// Port for the socket to listen on in all subsequent runs
    #[clap(short, long)]
    port: Option<u16>,
@@ -82,41 +77,29 @@ pub(crate) struct Init {
    #[clap(long)]
    host: Option<IpAddr>,

-    /// Path to .json file containing custom network specification.
-    #[clap(long, group = "network", hide = true)]
-    custom_mixnet: Option<PathBuf>,
-
-    /// Mostly debug-related option to increase default traffic rate so that you would not need to
-    /// modify config post init
-    #[clap(long, hide = true)]
-    fastmode: bool,
-
-    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
-    #[clap(long, hide = true)]
-    no_cover: bool,
-
-    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
-    /// with bandwidth credential requirement.
-    #[clap(long, hide = true)]
-    enabled_credentials_mode: Option<bool>,
-
    #[clap(short, long, default_value_t = OutputFormat::default())]
    output: OutputFormat,
 }

+impl AsRef<CommonClientInitArgs> for Init {
+    fn as_ref(&self) -> &CommonClientInitArgs {
+        &self.common_args
+    }
+}
+
 impl From<Init> for OverrideConfig {
    fn from(init_config: Init) -> Self {
        OverrideConfig {
-            nym_apis: init_config.nym_apis,
+            nym_apis: init_config.common_args.nym_apis,
            ip: init_config.host,
            port: init_config.port,
            use_anonymous_replies: init_config.use_reply_surbs,
-            fastmode: init_config.fastmode,
-            no_cover: init_config.no_cover,
+            fastmode: init_config.common_args.fastmode,
+            no_cover: init_config.common_args.no_cover,
            geo_routing: None,
            medium_toggle: false,
-            nyxd_urls: init_config.nyxd_urls,
-            enabled_credentials_mode: init_config.enabled_credentials_mode,
+            nyxd_urls: init_config.common_args.nyxd_urls,
+            enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
            outfox: false,
        }
    }
@@ -131,15 +114,11 @@ pub struct InitResults {
 }

 impl InitResults {
-    fn new(config: &Config, address: &Recipient, gateway: &GatewayEndpointConfig) -> Self {
+    fn new(res: InitResultsWithConfig<Config>) -> Self {
        Self {
-            client_core: nym_client_core::init::types::InitResults::new(
-                &config.core.base,
-                address,
-                gateway,
-            ),
-            socks5_listening_address: config.core.socks5.bind_adddress,
-            client_address: address.to_string(),
+            client_address: res.init_results.address.to_string(),
+            client_core: res.init_results,
+            socks5_listening_address: res.config.core.socks5.bind_adddress,
        }
    }
 }
@@ -156,101 +135,14 @@ impl Display for InitResults {
    }
 }

-fn init_paths(id: &str) -> io::Result<()> {
-    fs::create_dir_all(default_data_directory(id))?;
-    fs::create_dir_all(default_config_directory(id))
-}
-
 pub(crate) async fn execute(args: Init) -> Result<(), Socks5ClientError> {
    eprintln!("Initialising client...");

-    let id = &args.id;
-    let provider_address = &args.provider;
+    let output = args.output;
+    let res = initialise_client::<Socks5ClientInit>(args).await?;

-    let already_init = if default_config_filepath(id).exists() {
-        // in case we're using old config, try to upgrade it
-        // (if we're using the current version, it's a no-op)
-        try_upgrade_config(id)?;
-        eprintln!("SOCKS5 client \"{id}\" was already initialised before");
-        true
-    } else {
-        init_paths(id)?;
-        false
-    };
-
-    // Usually you only register with the gateway on the first init, however you can force
-    // re-registering if wanted.
-    let user_wants_force_register = args.force_register_gateway;
-    if user_wants_force_register {
-        eprintln!("Instructed to force registering gateway. This might overwrite keys!");
-    }
-
-    // If the client was already initialized, don't generate new keys and don't re-register with
-    // the gateway (because this would create a new shared key).
-    // Unless the user really wants to.
-    let register_gateway = !already_init || user_wants_force_register;
-
-    // Attempt to use a user-provided gateway, if possible
-    let user_chosen_gateway_id = args.gateway;
-    let selection_spec = GatewaySelectionSpecification::new(
-        user_chosen_gateway_id.map(|id| id.to_base58_string()),
-        Some(args.latency_based_selection),
-        false,
-    );
-
-    // Load and potentially override config
-    let config = override_config(
-        Config::new(id, &provider_address.to_string()),
-        OverrideConfig::from(args.clone()),
-    );
-
-    // Setup gateway by either registering a new one, or creating a new config from the selected
-    // one but with keys kept, or reusing the gateway configuration.
-    let key_store = OnDiskKeys::new(config.storage_paths.common_paths.keys.clone());
-    let details_store =
-        OnDiskGatewayDetails::new(&config.storage_paths.common_paths.gateway_details);
-
-    let available_gateways = if let Some(hardcoded_topology) = args
-        .custom_mixnet
-        .map(NymTopology::new_from_file)
-        .transpose()?
-    {
-        // hardcoded_topology
-        hardcoded_topology.get_gateways()
-    } else {
-        let mut rng = rand::thread_rng();
-        current_gateways(&mut rng, &config.core.base.client.nym_api_urls).await?
-    };
-
-    let gateway_setup = GatewaySetup::New {
-        specification: selection_spec,
-        available_gateways,
-        overwrite_data: register_gateway,
-    };
-
-    let init_details =
-        nym_client_core::init::setup_gateway(gateway_setup, &key_store, &details_store)
-            .await
-            .tap_err(|err| eprintln!("Failed to setup gateway\nError: {err}"))?;
-
-    // TODO: ask the service provider we specified for its interface version and set it in the config
-
-    let config_save_location = config.default_location();
-    config.save_to_default_location().tap_err(|_| {
-        log::error!("Failed to save the config file");
-    })?;
-    eprintln!(
-        "Saved configuration file to {}",
-        config_save_location.display()
-    );
-
-    let address = init_details.client_address()?;
-
-    let GatewayDetails::Configured(gateway_details) = init_details.gateway_details else {
-        return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
-    };
-    let init_results = InitResults::new(&config, &address, &gateway_details);
-    println!("{}", args.output.format(&init_results));
+    let init_results = InitResults::new(res);
+    println!("{}", output.format(&init_results));

    Ok(())
 }
@@ -10,19 +10,17 @@ use crate::{
 use clap::Args;
 use log::*;
 use nym_bin_common::version_checker::is_minor_version_compatible;
+use nym_client_core::cli_helpers::client_run::CommonClientRunArgs;
 use nym_client_core::client::base_client::storage::OnDiskPersistent;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
-use nym_crypto::asymmetric::identity;
 use nym_socks5_client_core::NymClient;
 use nym_sphinx::addressing::clients::Recipient;
 use std::net::IpAddr;
-use std::path::PathBuf;

 #[derive(Args, Clone)]
 pub(crate) struct Run {
-    /// Id of the nym-mixnet-client we want to run.
-    #[clap(long)]
-    id: String,
+    #[command(flatten)]
+    common_args: CommonClientRunArgs,

    /// Specifies whether this client is going to use an anonymous sender tag for communication with the service provider.
    /// While this is going to hide its actual address information, it will make the actual communication
@@ -37,19 +35,6 @@ pub(crate) struct Run {
    #[clap(long)]
    provider: Option<Recipient>,

-    /// Id of the gateway we want to connect to. If overridden, it is user's responsibility to
-    /// ensure prior registration happened
-    #[clap(long)]
-    gateway: Option<identity::PublicKey>,
-
-    /// Comma separated list of rest endpoints of the nyxd validators
-    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
-    nyxd_urls: Option<Vec<url::Url>>,
-
-    /// Comma separated list of rest endpoints of the Nym APIs
-    #[clap(long, value_delimiter = ',', group = "network")]
-    nym_apis: Option<Vec<url::Url>>,
-
    /// Port for the socket to listen on
    #[clap(short, long)]
    port: Option<u16>,
@@ -58,19 +43,6 @@ pub(crate) struct Run {
    #[clap(long)]
    host: Option<IpAddr>,

-    /// Path to .json file containing custom network specification.
-    #[clap(long, group = "network", group = "routing", hide = true)]
-    custom_mixnet: Option<PathBuf>,
-
-    /// Mostly debug-related option to increase default traffic rate so that you would not need to
-    /// modify config post init
-    #[clap(long, hide = true)]
-    fastmode: bool,
-
-    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
-    #[clap(long, hide = true)]
-    no_cover: bool,
-
    /// Set geo-aware mixnode selection when sending mixnet traffic, for experiments only.
    #[clap(long, hide = true, value_parser = validate_country_group, group="routing")]
    geo_routing: Option<CountryGroup>,
@@ -80,11 +52,6 @@ pub(crate) struct Run {
    #[clap(long, hide = true)]
    medium_toggle: bool,

-    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
-    /// with bandwidth credential requirement.
-    #[clap(long, hide = true)]
-    enabled_credentials_mode: Option<bool>,
-
    #[clap(long, hide = true, action)]
    outfox: bool,
 }
@@ -92,16 +59,16 @@ pub(crate) struct Run {
 impl From<Run> for OverrideConfig {
    fn from(run_config: Run) -> Self {
        OverrideConfig {
-            nym_apis: run_config.nym_apis,
+            nym_apis: run_config.common_args.nym_apis,
            ip: run_config.host,
            port: run_config.port,
            use_anonymous_replies: run_config.use_anonymous_replies,
-            fastmode: run_config.fastmode,
-            no_cover: run_config.no_cover,
+            fastmode: run_config.common_args.fastmode,
+            no_cover: run_config.common_args.no_cover,
            geo_routing: run_config.geo_routing,
            medium_toggle: run_config.medium_toggle,
-            nyxd_urls: run_config.nyxd_urls,
-            enabled_credentials_mode: run_config.enabled_credentials_mode,
+            nyxd_urls: run_config.common_args.nyxd_urls,
+            enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
            outfox: run_config.outfox,
        }
    }
@@ -136,9 +103,9 @@ fn version_check(cfg: &Config) -> bool {
 }

 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    eprintln!("Starting client {}...", args.id);
+    eprintln!("Starting client {}...", args.common_args.id);

-    let mut config = try_load_current_config(&args.id)?;
+    let mut config = try_load_current_config(&args.common_args.id)?;
    config = override_config(config, OverrideConfig::from(args.clone()));

    if !version_check(&config) {
@@ -149,7 +116,7 @@ pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn std::error::Error +
    let storage =
        OnDiskPersistent::from_paths(config.storage_paths.common_paths, &config.core.base.debug)
            .await?;
-    NymClient::new(config.core, storage, args.custom_mixnet)
+    NymClient::new(config.core, storage, args.common_args.custom_mixnet)
        .run_forever()
        .await
 }
@@ -3,6 +3,8 @@

 use crate::config::template::CONFIG_TEMPLATE;
 use nym_bin_common::logging::LoggingSettings;
+use nym_client_core::cli_helpers::client_init::ClientConfig;
+use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::{
    must_get_home, read_config_from_toml_file, save_formatted_config_to_file, NymConfigTemplate,
    DEFAULT_CONFIG_DIR, DEFAULT_CONFIG_FILENAME, DEFAULT_DATA_DIR, NYM_DIR,
@@ -69,6 +71,24 @@ impl NymConfigTemplate for Config {
    }
 }

+impl ClientConfig for Config {
+    fn common_paths(&self) -> &CommonClientPaths {
+        &self.storage_paths.common_paths
+    }
+
+    fn core_config(&self) -> &BaseClientConfig {
+        &self.core.base
+    }
+
+    fn default_store_location(&self) -> PathBuf {
+        self.default_location()
+    }
+
+    fn save_to<P: AsRef<Path>>(&self, path: P) -> io::Result<()> {
+        save_formatted_config_to_file(self, path)
+    }
+}
+
 impl Config {
    pub fn new<S: AsRef<str>>(id: S, provider_mix_address: S) -> Self {
        Config {
@@ -21,5 +21,10 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
    }
    setup_logging();

-    commands::execute(args).await
+    if let Err(err) = commands::execute(args).await {
+        log::error!("{err}");
+        println!("An error occurred: {err}");
+        std::process::exit(1);
+    }
+    Ok(())
 }
@@ -9,7 +9,7 @@ repository = { workspace = true }

 [dependencies]
 atty = "0.2"
-clap = { version = "4.0", features = ["derive"] }
+clap = { workspace = true, features = ["derive"] }
 clap_complete = "4.0"
 clap_complete_fig = "4.0"
 log = { workspace = true }
@@ -11,6 +11,7 @@ rust-version = "1.66"
 async-trait = { workspace = true }
 base64 = "0.21.2"
 cfg-if = "1.0.0"
+clap = { workspace = true, optional = true }
 dashmap = { workspace = true }
 dirs = "4.0"
 futures = { workspace = true }
@@ -92,6 +93,7 @@ sqlx = { version = "0.6.2", features = ["runtime-tokio-rustls", "sqlite", "macro

 [features]
 default = []
+cli = ["clap"]
 fs-surb-storage = ["sqlx"]
 wasm = ["nym-gateway-client/wasm"]

@@ -0,0 +1,210 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::config::disk_persistence::CommonClientPaths;
+use crate::error::ClientCoreError;
+use crate::{
+    client::{
+        base_client::storage::gateway_details::OnDiskGatewayDetails,
+        key_manager::persistence::OnDiskKeys,
+    },
+    init::types::{GatewayDetails, GatewaySelectionSpecification, GatewaySetup, InitResults},
+};
+use log::info;
+use nym_crypto::asymmetric::identity;
+use nym_topology::NymTopology;
+use std::path::{Path, PathBuf};
+
+pub trait InitialisableClient {
+    const NAME: &'static str;
+    type Error: From<ClientCoreError>;
+    type InitArgs: AsRef<CommonClientInitArgs>;
+    type Config: ClientConfig;
+
+    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error>;
+
+    fn initialise_storage_paths(id: &str) -> Result<(), Self::Error>;
+
+    fn default_config_path(id: &str) -> PathBuf;
+
+    fn construct_config(init_args: &Self::InitArgs) -> Self::Config;
+}
+
+pub trait ClientConfig {
+    fn common_paths(&self) -> &CommonClientPaths;
+
+    fn core_config(&self) -> &crate::config::Config;
+
+    fn default_store_location(&self) -> PathBuf;
+
+    fn save_to<P: AsRef<Path>>(&self, path: P) -> std::io::Result<()>;
+}
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[derive(Debug, Clone)]
+pub struct CommonClientInitArgs {
+    /// Id of client we want to create config for.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Id of the gateway we are going to connect to.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub gateway: Option<identity::PublicKey>,
+
+    /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
+    /// uniformly.
+    #[cfg_attr(feature = "cli", clap(long, conflicts_with = "gateway"))]
+    pub latency_based_selection: bool,
+
+    /// Force register gateway. WARNING: this will overwrite any existing keys for the given id,
+    /// potentially causing loss of access.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub force_register_gateway: bool,
+
+    /// Comma separated list of rest endpoints of the nyxd validators
+    #[cfg_attr(
+        feature = "cli",
+        clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)
+    )]
+    pub nyxd_urls: Option<Vec<url::Url>>,
+
+    /// Comma separated list of rest endpoints of the API validators
+    #[cfg_attr(
+        feature = "cli",
+        clap(
+            long,
+            alias = "api_validators",
+            value_delimiter = ',',
+            group = "network"
+        )
+    )]
+    pub nym_apis: Option<Vec<url::Url>>,
+
+    /// Path to .json file containing custom network specification.
+    #[cfg_attr(feature = "cli", clap(long, group = "network", hide = true))]
+    pub custom_mixnet: Option<PathBuf>,
+
+    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
+    /// with bandwidth credential requirement.
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub enabled_credentials_mode: Option<bool>,
+
+    /// Mostly debug-related option to increase default traffic rate so that you would not need to
+    /// modify config post init
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub fastmode: bool,
+
+    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub no_cover: bool,
+}
+
+pub struct InitResultsWithConfig<T> {
+    pub config: T,
+    pub init_results: InitResults,
+}
+
+pub async fn initialise_client<C>(
+    init_args: C::InitArgs,
+) -> Result<InitResultsWithConfig<C::Config>, C::Error>
+where
+    C: InitialisableClient,
+{
+    info!("initialising {} client", C::NAME);
+
+    let common_args = init_args.as_ref();
+    let id = &common_args.id;
+
+    let already_init = if C::default_config_path(id).exists() {
+        // in case we're using old config, try to upgrade it
+        // (if we're using the current version, it's a no-op)
+        C::try_upgrade_outdated_config(id)?;
+        eprintln!("{} client \"{id}\" was already initialised before", C::NAME);
+        true
+    } else {
+        C::initialise_storage_paths(id)?;
+        false
+    };
+
+    // Usually you only register with the gateway on the first init, however you can force
+    // re-registering if wanted.
+    let user_wants_force_register = common_args.force_register_gateway;
+    if user_wants_force_register {
+        eprintln!("Instructed to force registering gateway. This might overwrite keys!");
+    }
+
+    // If the client was already initialized, don't generate new keys and don't re-register with
+    // the gateway (because this would create a new shared key).
+    // Unless the user really wants to.
+    let register_gateway = !already_init || user_wants_force_register;
+
+    // Attempt to use a user-provided gateway, if possible
+    let user_chosen_gateway_id = common_args.gateway;
+    let selection_spec = GatewaySelectionSpecification::new(
+        user_chosen_gateway_id.map(|id| id.to_base58_string()),
+        Some(common_args.latency_based_selection),
+        false,
+    );
+
+    // Load and potentially override config
+    let config = C::construct_config(&init_args);
+    let paths = config.common_paths();
+    let core = config.core_config();
+
+    // Setup gateway by either registering a new one, or creating a new config from the selected
+    // one but with keys kept, or reusing the gateway configuration.
+    let key_store = OnDiskKeys::new(paths.keys.clone());
+    let details_store = OnDiskGatewayDetails::new(&paths.gateway_details);
+
+    let available_gateways = if let Some(custom_mixnet) = common_args.custom_mixnet.as_ref() {
+        let hardcoded_topology = NymTopology::new_from_file(custom_mixnet).map_err(|source| {
+            ClientCoreError::CustomTopologyLoadFailure {
+                file_path: custom_mixnet.clone(),
+                source,
+            }
+        })?;
+        hardcoded_topology.get_gateways()
+    } else {
+        let mut rng = rand::thread_rng();
+        crate::init::helpers::current_gateways(&mut rng, &core.client.nym_api_urls).await?
+    };
+
+    let gateway_setup = GatewaySetup::New {
+        specification: selection_spec,
+        available_gateways,
+        overwrite_data: register_gateway,
+    };
+
+    let init_details =
+        crate::init::setup_gateway(gateway_setup, &key_store, &details_store).await?;
+
+    // TODO: ask the service provider we specified for its interface version and set it in the config
+
+    let config_save_location = config.default_store_location();
+    if let Err(err) = config.save_to(&config_save_location) {
+        return Err(ClientCoreError::ConfigSaveFailure {
+            typ: C::NAME.to_string(),
+            id: id.to_string(),
+            path: config_save_location,
+            source: err,
+        }
+        .into());
+    }
+
+    eprintln!(
+        "Saved configuration file to {}",
+        config_save_location.display()
+    );
+
+    let address = init_details.client_address()?;
+
+    let GatewayDetails::Configured(gateway_details) = init_details.gateway_details else {
+        return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
+    };
+    let init_results = InitResults::new(config.core_config(), address, &gateway_details);
+
+    Ok(InitResultsWithConfig {
+        config,
+        init_results,
+    })
+}
@@ -0,0 +1,59 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use nym_crypto::asymmetric::identity;
+use std::path::PathBuf;
+
+#[cfg_attr(feature = "cli", derive(clap::Args))]
+#[derive(Debug, Clone)]
+pub struct CommonClientRunArgs {
+    /// Id of client we want to create config for.
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub id: String,
+
+    /// Id of the gateway we want to connect to. If overridden, it is user's responsibility to
+    /// ensure prior registration happened
+    #[cfg_attr(feature = "cli", clap(long))]
+    pub gateway: Option<identity::PublicKey>,
+
+    /// Comma separated list of rest endpoints of the nyxd validators
+    #[cfg_attr(
+        feature = "cli",
+        clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)
+    )]
+    pub nyxd_urls: Option<Vec<url::Url>>,
+
+    /// Comma separated list of rest endpoints of the API validators
+    #[cfg_attr(
+        feature = "cli",
+        clap(
+            long,
+            alias = "api_validators",
+            value_delimiter = ',',
+            group = "network"
+        )
+    )]
+    pub nym_apis: Option<Vec<url::Url>>,
+
+    /// Path to .json file containing custom network specification.
+    #[cfg_attr(feature = "cli", clap(long, group = "network", hide = true))]
+    pub custom_mixnet: Option<PathBuf>,
+
+    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
+    /// with bandwidth credential requirement.
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub enabled_credentials_mode: Option<bool>,
+
+    /// Mostly debug-related option to increase default traffic rate so that you would not need to
+    /// modify config post init
+    // note: we removed the 'conflicts_with = medium_toggle', but that's fine since NR
+    // has defined the conflict on that field itself
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub fastmode: bool,
+
+    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
+    // note: we removed the 'conflicts_with = medium_toggle', but that's fine since NR
+    // has defined the conflict on that field itself
+    #[cfg_attr(feature = "cli", clap(long, hide = true))]
+    pub no_cover: bool,
+}
@@ -0,0 +1,5 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+pub mod client_init;
+pub mod client_run;
@@ -77,7 +77,7 @@ pub struct PersistedGatewayConfig {
    key_hash: Vec<u8>,

    /// Actual gateway details being persisted.
-    pub(crate) details: GatewayEndpointConfig,
+    pub details: GatewayEndpointConfig,
 }

 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -263,7 +263,7 @@ impl ActionController {
    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
        debug!("Started ActionController with graceful shutdown support");

-        while !shutdown.is_shutdown() {
+        loop {
            tokio::select! {
                action = self.incoming_actions.next() => match action {
                    Some(action) => self.process_action(action),
@@ -283,6 +283,7 @@ impl ActionController {
                },
                _ = shutdown.recv_with_delay() => {
                    log::trace!("ActionController: Received shutdown");
+                    break;
                }
            }
        }
@@ -40,7 +40,7 @@ impl SentNotificationListener {
    pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
        debug!("Started SentNotificationListener with graceful shutdown support");

-        while !shutdown.is_shutdown() {
+        loop {
            tokio::select! {
                frag_id = self.sent_notifier.next() => match frag_id {
                    Some(frag_id) => {
@@ -53,6 +53,7 @@ impl SentNotificationListener {
                },
                _ = shutdown.recv_with_delay() => {
                    log::trace!("SentNotificationListener: Received shutdown");
+                    break;
                }
            }
        }
@@ -500,11 +500,12 @@ where
        {
            let mut status_timer = tokio::time::interval(Duration::from_secs(5));

-            while !shutdown.is_shutdown() {
+            loop {
                tokio::select! {
                    biased;
                    _ = shutdown.recv_with_delay() => {
                        log::trace!("OutQueueControl: Received shutdown");
+                        break;
                    }
                    _ = status_timer.tick() => {
                        self.log_status(&mut shutdown);
@@ -39,7 +39,7 @@ where
        mem_state: CombinedReplyStorage,
        mut shutdown: nym_task::TaskClient,
    ) {
-        use log::{debug, error, info, warn};
+        use log::{debug, error, info};

        debug!("Started PersistentReplyStorage");
        if let Err(err) = self.backend.start_storage_session().await {
@@ -50,7 +50,7 @@ where
        shutdown.recv().await;

        info!("PersistentReplyStorage is flushing all reply-related data to underlying storage");
-        warn!("you MUST NOT forcefully shutdown now or you risk data corruption!");
+        info!("you MUST NOT forcefully shutdown now or you risk data corruption!");
        if let Err(err) = self.backend.flush_surb_storage(&mem_state).await {
            error!("failed to flush our reply-related data to the persistent storage: {err}")
        } else {
@@ -8,40 +8,41 @@ use nym_topology::gateway::GatewayConversionError;
 use nym_topology::NymTopologyError;
 use nym_validator_client::ValidatorClientError;
 use std::error::Error;
+use std::path::PathBuf;

 #[derive(thiserror::Error, Debug)]
 pub enum ClientCoreError {
    #[error("I/O error: {0}")]
    IoError(#[from] std::io::Error),

-    #[error("Gateway client error ({gateway_id}): {source}")]
+    #[error("gateway client error ({gateway_id}): {source}")]
    GatewayClientError {
        gateway_id: String,
        source: GatewayClientError,
    },

-    #[error("Custom gateway client error: {source}")]
+    #[error("custom gateway client error: {source}")]
    ErasedGatewayClientError {
        #[from]
        source: ErasedGatewayError,
    },

-    #[error("Ed25519 error: {0}")]
+    #[error("ed25519 error: {0}")]
    Ed25519RecoveryError(#[from] Ed25519RecoveryError),

-    #[error("Validator client error: {0}")]
+    #[error("validator client error: {0}")]
    ValidatorClientError(#[from] ValidatorClientError),

-    #[error("No gateway with id: {0}")]
+    #[error("no gateway with id: {0}")]
    NoGatewayWithId(String),

-    #[error("No gateways on network")]
+    #[error("no gateways on network")]
    NoGatewaysOnNetwork,

-    #[error("List of nym apis is empty")]
+    #[error("list of nym apis is empty")]
    ListOfNymApisIsEmpty,

-    #[error("The current network topology seem to be insufficient to route any packets through")]
+    #[error("the current network topology seem to be insufficient to route any packets through")]
    InsufficientNetworkTopology(#[from] NymTopologyError),

    #[error("experienced a failure with our reply surb persistent storage: {source}")]
@@ -59,7 +60,7 @@ pub enum ClientCoreError {
        source: Box<dyn Error + Send + Sync>,
    },

-    #[error("The gateway id is invalid - {0}")]
+    #[error("the gateway id is invalid - {0}")]
    UnableToCreatePublicKeyFromGatewayId(Ed25519RecoveryError),

    #[error("The gateway is malformed: {source}")]
@@ -78,23 +79,23 @@ pub enum ClientCoreError {
    #[error("failed to establish gateway connection (wasm)")]
    GatewayJsConnectionFailure,

-    #[error("Gateway connection was abruptly closed")]
+    #[error("gateway connection was abruptly closed")]
    GatewayConnectionAbruptlyClosed,

-    #[error("Timed out while trying to establish gateway connection")]
+    #[error("timed out while trying to establish gateway connection")]
    GatewayConnectionTimeout,

-    #[error("No ping measurements for the gateway ({identity}) performed")]
+    #[error("no ping measurements for the gateway ({identity}) performed")]
    NoGatewayMeasurements { identity: String },

    #[error("failed to register receiver for reconstructed mixnet messages")]
    FailedToRegisterReceiver,

-    #[error("Unexpected exit")]
+    #[error("unexpected exit")]
    UnexpectedExit,

    #[error(
-        "This operation would have resulted in clients keys being overwritten without permission"
+        "this operation would have resulted in clients keys being overwritten without permission"
    )]
    ForbiddenKeyOverwrite,

@@ -132,6 +133,26 @@ pub enum ClientCoreError {

    #[error("the specified gateway '{gateway}' does not support the wss protocol")]
    UnsupportedWssProtocol { gateway: String },
+
+    #[error(
+    "failed to load custom topology using path '{}'. detailed message: {source}", file_path.display()
+    )]
+    CustomTopologyLoadFailure {
+        file_path: PathBuf,
+        #[source]
+        source: std::io::Error,
+    },
+
+    #[error(
+    "failed to save config file for client-{typ} id {id} using path '{}'. detailed message: {source}", path.display()
+    )]
+    ConfigSaveFailure {
+        typ: String,
+        id: String,
+        path: PathBuf,
+        #[source]
+        source: std::io::Error,
+    },
 }

 /// Set of messages that the client can send to listeners via the task manager
@@ -68,13 +68,23 @@ pub async fn current_gateways<R: Rng>(
    log::trace!("Fetching list of gateways from: {nym_api}");

    let gateways = client.get_cached_described_gateways().await?;
+    log::debug!("Found {} gateways", gateways.len());
+    log::trace!("Gateways: {:#?}", gateways);
+
    let valid_gateways = gateways
        .into_iter()
        .filter_map(|gateway| gateway.try_into().ok())
        .collect::<Vec<gateway::Node>>();
+    log::debug!("Ater checking validity: {}", valid_gateways.len());
+    log::trace!("Valid gateways: {:#?}", valid_gateways);

    // we were always filtering by version so I'm not removing that 'feature'
    let filtered_gateways = valid_gateways.filter_by_version(env!("CARGO_PKG_VERSION"));
+    log::debug!("After filtering for version: {}", filtered_gateways.len());
+    log::trace!("Filtered gateways: {:#?}", filtered_gateways);
+
+    log::info!("nym-api reports {} valid gateways", filtered_gateways.len());
+
    Ok(filtered_gateways)
 }

@@ -94,6 +94,8 @@ where
    D::StorageError: Send + Sync + 'static,
    T: DeserializeOwned + Serialize + Send + Sync,
 {
+    log::trace!("Setting up new gateway");
+
    // if we're setting up new gateway, failing to load existing information is fine.
    // as a matter of fact, it's only potentially a problem if we DO succeed
    if _load_gateway_details(details_store).await.is_ok() && !overwrite_data {
@@ -210,6 +212,7 @@ where
    D::StorageError: Send + Sync + 'static,
    T: DeserializeOwned + Serialize + Send + Sync,
 {
+    log::trace!("Setting up gateway");
    match setup {
        GatewaySetup::MustLoad => use_loaded_gateway_details(key_store, details_store).await,
        GatewaySetup::New {
@@ -296,16 +296,17 @@ impl<T> GatewaySetup<T> {
 /// Struct describing the results of the client initialization procedure.
 #[derive(Debug, Serialize)]
 pub struct InitResults {
-    version: String,
-    id: String,
-    identity_key: String,
-    encryption_key: String,
-    gateway_id: String,
-    gateway_listener: String,
+    pub version: String,
+    pub id: String,
+    pub identity_key: String,
+    pub encryption_key: String,
+    pub gateway_id: String,
+    pub gateway_listener: String,
+    pub address: Recipient,
 }

 impl InitResults {
-    pub fn new(config: &Config, address: &Recipient, gateway: &GatewayEndpointConfig) -> Self {
+    pub fn new(config: &Config, address: Recipient, gateway: &GatewayEndpointConfig) -> Self {
        Self {
            version: config.client.version.clone(),
            id: config.client.id.clone(),
@@ -313,6 +314,7 @@ impl InitResults {
            encryption_key: address.encryption_key().to_base58_string(),
            gateway_id: gateway.gateway_id.clone(),
            gateway_listener: gateway.gateway_listener.clone(),
+            address,
        }
    }
 }
@@ -1,5 +1,7 @@
 use std::future::Future;

+#[cfg(not(target_arch = "wasm32"))]
+pub mod cli_helpers;
 pub mod client;
 pub mod config;
 pub mod error;
@@ -45,13 +45,17 @@ cosmrs = { workspace = true, features = ["bip32", "cosmwasm"] }
 # import it just for the `Client` trait
 tendermint-rpc = { workspace = true }

+# this is an extremely nasty import. we're explicitly bringing in bip32 so that via the magic (or curse, pick your poison)
+# of cargo's feature unification we'd get `bip32/std` meaning we'd get `std::error::Error` for the re-exported (via cosmrs) bip32::Error type
+bip32 = { workspace = true, default-features = false, features = ["std"] }
+
 eyre = { version = "0.6" }
 cw-utils = { workspace = true }
 cw2 = { workspace = true }
 cw3 = { workspace = true }
 cw4 = { workspace = true }
 cw-controllers = { workspace = true }
-prost = { version = "0.11", default-features = false }
+prost = { workspace = true, default-features = false }
 flate2 = { version = "1.0.20" }
 sha2 = { version = "0.9.5" }
 itertools = { version = "0.10" }
@@ -20,12 +20,12 @@ impl CheckResponse for broadcast::tx_commit::Response {
            });
        }

-        if self.deliver_tx.code.is_err() {
+        if self.tx_result.code.is_err() {
            return Err(NyxdError::BroadcastTxErrorDeliverTx {
                hash: self.hash,
                height: Some(self.height),
-                code: self.deliver_tx.code.value(),
-                raw_log: self.deliver_tx.log,
+                code: self.tx_result.code.value(),
+                raw_log: self.tx_result.log,
            });
        }

@@ -11,7 +11,7 @@ pub mod gas_price;

 pub type GasAdjustment = f32;

-pub const DEFAULT_SIMULATED_GAS_MULTIPLIER: GasAdjustment = 1.3;
+pub const DEFAULT_SIMULATED_GAS_MULTIPLIER: GasAdjustment = 1.5;

 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AutoFeeGrant {
@@ -34,7 +34,9 @@ pub use crate::nyxd::fee::Fee;
 pub use crate::rpc::TendermintRpcClient;
 pub use coin::Coin;
 pub use cosmrs::bank::MsgSend;
-pub use cosmrs::tendermint::abci::{response::DeliverTx, Event, EventAttribute};
+pub use cosmrs::tendermint::abci::{
+    response::DeliverTx, types::ExecTxResult, Event, EventAttribute,
+};
 pub use cosmrs::tendermint::block::Height;
 pub use cosmrs::tendermint::hash::{self, Algorithm, Hash};
 pub use cosmrs::tendermint::validator::Info as TendermintValidatorInfo;
@@ -28,7 +28,7 @@ where
    U: TryInto<HttpClientUrl, Error = Error>,
 {
    HttpRpcClient::builder(url.try_into()?)
-        .compat_mode(CompatMode::V0_34)
+        .compat_mode(CompatMode::V0_37)
        .build()
 }

@@ -36,7 +36,8 @@ pub struct ReqwestRpcClient {
 impl ReqwestRpcClient {
    pub fn new(url: Url) -> Self {
        ReqwestRpcClient {
-            compat: CompatMode::V0_34,
+            // after updating to nyxd 0.42 and thus updating to cometbft, the compat mode changed
+            compat: CompatMode::V0_37,
            inner: reqwest::Client::new(),
            url,
        }
@@ -11,7 +11,7 @@ bip39 = { workspace = true }
 bs58 = "0.4"
 comfy-table = "6.0.0"
 cfg-if = "1.0.0"
-clap = { version = "4.0", features = ["derive"] }
+clap = { workspace = true, features = ["derive"] }
 cw-utils = { workspace = true }
 handlebars = "3.0.1"
 humantime-serde = "1.0"
@@ -4,6 +4,7 @@
 use clap::{Args, Subcommand};

 pub mod update_config;
+pub mod update_cost_params;
 pub mod vesting_update_config;

 #[derive(Debug, Args)]
@@ -20,7 +21,5 @@ pub enum MixnetOperatorsMixnodeSettingsCommands {
    /// Update mixnode configuration for a mixnode bonded with locked tokens
    VestingUpdateConfig(vesting_update_config::Args),
    /// Update mixnode cost parameters
-    UpdateCostParameters,
-    /// Update mixnode cost parameters for a mixnode bonded with locked tokens
-    VestingUpdateCostParameters,
+    UpdateCostParameters(update_cost_params::Args),
 }
@@ -0,0 +1,48 @@
+// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::context::SigningClient;
+use clap::Parser;
+use cosmwasm_std::Uint128;
+use log::info;
+use nym_mixnet_contract_common::{MixNodeCostParams, Percent};
+use nym_validator_client::nyxd::contract_traits::MixnetSigningClient;
+use nym_validator_client::nyxd::CosmWasmCoin;
+
+#[derive(Debug, Parser)]
+pub struct Args {
+    #[clap(
+        long,
+        help = "input your profit margin as follows; (so it would be 10, rather than 0.1)"
+    )]
+    pub profit_margin_percent: Option<u8>,
+
+    #[clap(
+        long,
+        help = "operating cost in current DENOMINATION (so it would be 'unym', rather than 'nym')"
+    )]
+    pub interval_operating_cost: Option<u128>,
+}
+
+pub async fn update_cost_params(args: Args, client: SigningClient) {
+    let denom = client.current_chain_details().mix_denom.base.as_str();
+
+    let cost_params = MixNodeCostParams {
+        profit_margin_percent: Percent::from_percentage_value(
+            args.profit_margin_percent.unwrap_or(10) as u64,
+        )
+        .unwrap(),
+        interval_operating_cost: CosmWasmCoin {
+            denom: denom.into(),
+            amount: Uint128::new(args.interval_operating_cost.unwrap_or(40_000_000)),
+        },
+    };
+
+    info!("Starting mixnode params updating!");
+    let res = client
+        .update_mixnode_cost_params(cost_params, None)
+        .await
+        .expect("failed to update cost params");
+
+    info!("Cost params result: {:?}", res)
+}
@@ -25,12 +25,20 @@ pub const DEFAULT_CONFIG_FILENAME: &str = "config.toml";

 #[cfg(feature = "dirs")]
 pub fn must_get_home() -> PathBuf {
-    dirs::home_dir().expect("Failed to evaluate $HOME value")
+    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
+        home_dir.into()
+    } else {
+        dirs::home_dir().expect("Failed to evaluate $HOME value")
+    }
 }

 #[cfg(feature = "dirs")]
 pub fn may_get_home() -> Option<PathBuf> {
-    dirs::home_dir()
+    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
+        Some(home_dir.into())
+    } else {
+        dirs::home_dir()
+    }
 }

 pub trait NymConfigTemplate: Serialize {
@@ -142,7 +142,7 @@ pub fn funds_from_cosmos_msgs(msgs: Vec<CosmosMsg>) -> Option<Coin> {
        contract_addr: _,
        msg,
        funds: _,
-    })) = msgs.get(0)
+    })) = msgs.first()
    {
        if let Ok(ExecuteMsg::ReleaseFunds { funds }) = from_binary::<ExecuteMsg>(msg) {
            return Some(funds);
@@ -62,7 +62,7 @@ pub fn owner_from_cosmos_msgs(msgs: &[CosmosMsg]) -> Option<Addr> {
        contract_addr: _,
        msg,
        funds: _,
-    })) = msgs.get(0)
+    })) = msgs.first()
    {
        if let Ok(ExecuteMsg::VerifyVerificationKeyShare { owner, .. }) =
            from_binary::<ExecuteMsg>(msg)
@@ -3,6 +3,7 @@

 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::Decimal;
+use cosmwasm_std::OverflowError;
 use cosmwasm_std::Uint128;
 use serde::de::Error;
 use serde::{Deserialize, Deserializer};
@@ -71,6 +72,10 @@ impl Percent {
        // we know the cast from u128 to u8 is a safe one since the internal value must be within 0 - 1 range
        truncate_decimal(hundred * self.0).u128() as u8
    }
+
+    pub fn checked_pow(&self, exp: u32) -> Result<Self, OverflowError> {
+        self.0.checked_pow(exp).map(Percent)
+    }
 }

 impl Display for Percent {
@@ -49,7 +49,7 @@ impl Account {

    pub fn period_duration(&self) -> Result<u64, VestingContractError> {
        self.periods
-            .get(0)
+            .first()
            .ok_or(VestingContractError::UnpopulatedVestingPeriods {
                owner: self.owner_address.clone(),
            })
@@ -366,11 +366,7 @@ pub fn creating_proof_of_chunking_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
    let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
@@ -400,11 +396,7 @@ pub fn verifying_proof_of_chunking_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
    let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
@@ -436,11 +428,7 @@ pub fn creating_proof_of_secret_sharing_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);

@@ -478,11 +466,7 @@ pub fn verifying_proof_of_secret_sharing_for_100_parties(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();

    let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);

@@ -545,11 +529,7 @@ pub fn share_encryption_100(c: &mut Criterion) {
        .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
        .collect::<Vec<_>>();

-    let remote_share_key_pairs = shares
-        .iter()
-        .zip(receivers.values())
-        .map(|(share, key)| (share, key))
-        .collect::<Vec<_>>();
+    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();

    c.bench_function("100 shares encryption", |b| {
        b.iter(|| black_box(encrypt_shares(&remote_share_key_pairs, &params, &mut rng)))
@@ -115,11 +115,7 @@ impl Dealing {
            .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
            .collect::<Vec<_>>();

-        let remote_share_key_pairs = shares
-            .iter()
-            .zip(receivers.values())
-            .map(|(share, key)| (share, key))
-            .collect::<Vec<_>>();
+        let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
        let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();

        let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, params, &mut rng);
@@ -11,7 +11,7 @@ use thiserror::Error;
 use tracing::warn;
 use url::Url;

-pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(3);
+pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(10);

 pub type PathSegments<'a> = &'a [&'a str];
 pub type Params<'a, K, V> = &'a [(K, V)];
@@ -0,0 +1,19 @@
+[package]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+bincode = "1.3.3"
+bytes = "1.5.0"
+nym-sphinx = { path = "../nymsphinx" }
+rand = "0.8.5"
+serde = { workspace = true, features = ["derive"] }
+thiserror = { workspace = true }
@@ -0,0 +1,373 @@
+use std::net::IpAddr;
+
+use nym_sphinx::addressing::clients::Recipient;
+use serde::{Deserialize, Serialize};
+
+pub const CURRENT_VERSION: u8 = 1;
+
+fn generate_random() -> u64 {
+    use rand::RngCore;
+    let mut rng = rand::rngs::OsRng;
+    rng.next_u64()
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct IpPacketRequest {
+    pub version: u8,
+    pub data: IpPacketRequestData,
+}
+
+impl IpPacketRequest {
+    pub fn new_static_connect_request(
+        ip: IpAddr,
+        reply_to: Recipient,
+        reply_to_hops: Option<u8>,
+        reply_to_avg_mix_delays: Option<f64>,
+    ) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::StaticConnect(StaticConnectRequest {
+                    request_id,
+                    ip,
+                    reply_to,
+                    reply_to_hops,
+                    reply_to_avg_mix_delays,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_dynamic_connect_request(
+        reply_to: Recipient,
+        reply_to_hops: Option<u8>,
+        reply_to_avg_mix_delays: Option<f64>,
+    ) -> (Self, u64) {
+        let request_id = generate_random();
+        (
+            Self {
+                version: CURRENT_VERSION,
+                data: IpPacketRequestData::DynamicConnect(DynamicConnectRequest {
+                    request_id,
+                    reply_to,
+                    reply_to_hops,
+                    reply_to_avg_mix_delays,
+                }),
+            },
+            request_id,
+        )
+    }
+
+    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketRequestData::Data(DataRequest { ip_packet }),
+        }
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            IpPacketRequestData::StaticConnect(request) => Some(request.request_id),
+            IpPacketRequestData::DynamicConnect(request) => Some(request.request_id),
+            IpPacketRequestData::Data(_) => None,
+        }
+    }
+
+    pub fn recipient(&self) -> Option<&Recipient> {
+        match &self.data {
+            IpPacketRequestData::StaticConnect(request) => Some(&request.reply_to),
+            IpPacketRequestData::DynamicConnect(request) => Some(&request.reply_to),
+            IpPacketRequestData::Data(_) => None,
+        }
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub enum IpPacketRequestData {
+    StaticConnect(StaticConnectRequest),
+    DynamicConnect(DynamicConnectRequest),
+    Data(DataRequest),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct StaticConnectRequest {
+    pub request_id: u64,
+    pub ip: IpAddr,
+    pub reply_to: Recipient,
+    pub reply_to_hops: Option<u8>,
+    pub reply_to_avg_mix_delays: Option<f64>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DynamicConnectRequest {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply_to_hops: Option<u8>,
+    pub reply_to_avg_mix_delays: Option<f64>,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+pub struct DataRequest {
+    pub ip_packet: bytes::Bytes,
+}
+
+// ---
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct IpPacketResponse {
+    pub version: u8,
+    pub data: IpPacketResponseData,
+}
+
+impl IpPacketResponse {
+    pub fn new_static_connect_success(request_id: u64, reply_to: Recipient) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
+                request_id,
+                reply_to,
+                reply: StaticConnectResponseReply::Success,
+            }),
+        }
+    }
+
+    pub fn new_static_connect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: StaticConnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
+                request_id,
+                reply_to,
+                reply: StaticConnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_dynamic_connect_success(request_id: u64, reply_to: Recipient, ip: IpAddr) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
+                request_id,
+                reply_to,
+                reply: DynamicConnectResponseReply::Success(DynamicConnectSuccess { ip }),
+            }),
+        }
+    }
+
+    pub fn new_dynamic_connect_failure(
+        request_id: u64,
+        reply_to: Recipient,
+        reason: DynamicConnectFailureReason,
+    ) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
+                request_id,
+                reply_to,
+                reply: DynamicConnectResponseReply::Failure(reason),
+            }),
+        }
+    }
+
+    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
+        Self {
+            version: CURRENT_VERSION,
+            data: IpPacketResponseData::Data(DataResponse { ip_packet }),
+        }
+    }
+
+    pub fn id(&self) -> Option<u64> {
+        match &self.data {
+            IpPacketResponseData::StaticConnect(response) => Some(response.request_id),
+            IpPacketResponseData::DynamicConnect(response) => Some(response.request_id),
+            IpPacketResponseData::Data(_) => None,
+        }
+    }
+
+    pub fn recipient(&self) -> Option<&Recipient> {
+        match &self.data {
+            IpPacketResponseData::StaticConnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::DynamicConnect(response) => Some(&response.reply_to),
+            IpPacketResponseData::Data(_) => None,
+        }
+    }
+
+    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().serialize(self)
+    }
+
+    pub fn from_reconstructed_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+#[allow(clippy::large_enum_variant)]
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum IpPacketResponseData {
+    StaticConnect(StaticConnectResponse),
+    DynamicConnect(DynamicConnectResponse),
+    Data(DataResponse),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct StaticConnectResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: StaticConnectResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum StaticConnectResponseReply {
+    Success,
+    Failure(StaticConnectFailureReason),
+}
+
+impl StaticConnectResponseReply {
+    pub fn is_success(&self) -> bool {
+        match self {
+            StaticConnectResponseReply::Success => true,
+            StaticConnectResponseReply::Failure(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum StaticConnectFailureReason {
+    #[error("requested ip address is already in use")]
+    RequestedIpAlreadyInUse,
+    #[error("requested nym-address is already in use")]
+    RequestedNymAddressAlreadyInUse,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DynamicConnectResponse {
+    pub request_id: u64,
+    pub reply_to: Recipient,
+    pub reply: DynamicConnectResponseReply,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub enum DynamicConnectResponseReply {
+    Success(DynamicConnectSuccess),
+    Failure(DynamicConnectFailureReason),
+}
+
+impl DynamicConnectResponseReply {
+    pub fn is_success(&self) -> bool {
+        match self {
+            DynamicConnectResponseReply::Success(_) => true,
+            DynamicConnectResponseReply::Failure(_) => false,
+        }
+    }
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DynamicConnectSuccess {
+    pub ip: IpAddr,
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
+pub enum DynamicConnectFailureReason {
+    #[error("requested nym-address is already in use")]
+    RequestedNymAddressAlreadyInUse,
+    #[error("no available ip address")]
+    NoAvailableIp,
+    #[error("{0}")]
+    Other(String),
+}
+
+#[derive(Clone, Debug, Serialize, Deserialize)]
+pub struct DataResponse {
+    pub ip_packet: bytes::Bytes,
+}
+
+fn make_bincode_serializer() -> impl bincode::Options {
+    use bincode::Options;
+    bincode::DefaultOptions::new()
+        .with_big_endian()
+        .with_varint_encoding()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn check_size_of_request() {
+        let connect = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::StaticConnect(
+                StaticConnectRequest {
+                    request_id: 123,
+                    ip: IpAddr::from([10, 0, 0, 1]),
+                    reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
+                    reply_to_hops: None,
+                    reply_to_avg_mix_delays: None,
+                },
+            )
+        };
+        assert_eq!(connect.to_bytes().unwrap().len(), 107);
+    }
+
+    #[test]
+    fn check_size_of_data() {
+        let data = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::Data(DataRequest {
+                ip_packet: bytes::Bytes::from(vec![1u8; 32]),
+            }),
+        };
+        assert_eq!(data.to_bytes().unwrap().len(), 35);
+    }
+
+    #[test]
+    fn serialize_and_deserialize_data_request() {
+        let data = IpPacketRequest {
+            version: 4,
+            data: IpPacketRequestData::Data(DataRequest {
+                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+            }),
+        };
+
+        let serialized = data.to_bytes().unwrap();
+        let deserialized = IpPacketRequest::from_reconstructed_message(
+            &nym_sphinx::receiver::ReconstructedMessage {
+                message: serialized,
+                sender_tag: None,
+            },
+        )
+        .unwrap();
+
+        assert_eq!(deserialized.version, 4);
+        assert_eq!(
+            deserialized.data,
+            IpPacketRequestData::Data(DataRequest {
+                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
+            })
+        );
+    }
+}
@@ -9,11 +9,12 @@ use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::RwLock;

+#[derive(Clone, Default)]
 pub struct AtomicVerlocResult {
    inner: Arc<RwLock<VerlocResult>>,
 }

-#[derive(Debug, Clone, Serialize)]
+#[derive(Debug, Clone, Serialize, Default)]
 pub struct VerlocResult {
    total_tested: usize,
    #[serde(with = "humantime_serde")]
@@ -35,13 +36,6 @@ impl AtomicVerlocResult {
        }
    }

-    // this could have also been achieved with a normal #[derive(Clone)] but I prefer to be explicit about it
-    pub(crate) fn clone_data_pointer(&self) -> Self {
-        AtomicVerlocResult {
-            inner: Arc::clone(&self.inner),
-        }
-    }
-
    pub(crate) async fn reset_results(&self, new_tested: usize) {
        let mut write_permit = self.inner.write().await;
        write_permit.total_tested = new_tested;
@@ -226,7 +226,7 @@ impl VerlocMeasurer {
    }

    pub fn get_verloc_results_pointer(&self) -> AtomicVerlocResult {
-        self.results.clone_data_pointer()
+        self.results.clone()
    }

    fn start_listening(&self) -> JoinHandle<()> {
@@ -476,3 +476,11 @@ pub const DEFAULT_NYM_NODE_HTTP_PORT: u16 = 8080;
 pub const TOTAL_SUPPLY: u128 = 1_000_000_000_000_000;

 pub const DEFAULT_PROFIT_MARGIN: u8 = 10;
+
+// WIREGUARD
+pub const WG_PORT: u16 = 51822;
+
+// The interface used to route traffic
+pub const WG_TUN_BASE_NAME: &str = "nymwg";
+pub const WG_TUN_DEVICE_ADDRESS: &str = "10.1.0.1";
+pub const WG_TUN_DEVICE_NETMASK: &str = "255.255.255.0";
@@ -6,9 +6,10 @@ use criterion::{criterion_group, criterion_main, Criterion};
 use ff::Field;
 use group::{Curve, Group};
 use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, elgamal_keygen,
-    prepare_blind_sign, prove_bandwidth_credential, setup, ttp_keygen, verify_credential,
-    Attribute, BlindedSignature, Parameters, Signature, SignatureShare, VerificationKey,
+    aggregate_signature_shares, aggregate_verification_keys, blind_sign, prepare_blind_sign,
+    prove_bandwidth_credential, setup, ttp_keygen, verify_credential,
+    verify_partial_blind_signature, Attribute, BlindedSignature, Parameters, Signature,
+    SignatureShare, VerificationKey,
 };
 use rand::seq::SliceRandom;
 use std::ops::Neg;
@@ -175,8 +176,6 @@ fn bench_coconut(c: &mut Criterion) {
    let binding_number = params.random_scalar();
    let private_attributes = vec![serial_number, binding_number];

-    let _elgamal_keypair = elgamal_keygen(&params);
-
    // The prepare blind sign is performed by the user
    let (pedersen_commitments_openings, blind_sign_request) =
        prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
@@ -242,6 +241,29 @@ fn bench_coconut(c: &mut Criterion) {
        .map(|keypair| keypair.verification_key())
        .collect();

+    // verify a random partial blind signature
+    let rand_idx = 1;
+    let random_blind_signature = blinded_signatures.get(rand_idx).unwrap();
+    let partial_verification_key = verification_keys.get(rand_idx).unwrap();
+
+    group.bench_function(
+        &format!(
+            "verify_partial_blind_signature_{}_private_attributes_{}_public_attributes",
+            case.num_private_attrs, case.num_public_attrs
+        ),
+        |b| {
+            b.iter(|| {
+                verify_partial_blind_signature(
+                    &params,
+                    &blind_sign_request,
+                    &public_attributes,
+                    random_blind_signature,
+                    partial_verification_key,
+                )
+            })
+        },
+    );
+
    // Lets bench worse case, ie aggregating all
    let indices: Vec<u64> = (1..=case.num_authorities).collect();
    // aggregate verification keys
@@ -14,6 +14,7 @@ pub use scheme::aggregation::aggregate_signature_shares;
 pub use scheme::aggregation::aggregate_verification_keys;
 pub use scheme::issuance::blind_sign;
 pub use scheme::issuance::prepare_blind_sign;
+pub use scheme::issuance::verify_partial_blind_signature;
 pub use scheme::issuance::BlindSignRequest;
 pub use scheme::keygen::ttp_keygen;
 pub use scheme::keygen::KeyPair;
@@ -50,7 +50,7 @@ where
 impl Aggregatable for PartialSignature {
    fn aggregate(sigs: &[PartialSignature], indices: Option<&[u64]>) -> Result<Signature> {
        let h = sigs
-            .get(0)
+            .first()
            .ok_or_else(|| CoconutError::Aggregation("Empty set of signatures".to_string()))?
            .sig1();

@@ -3,12 +3,14 @@

 use std::convert::TryFrom;
 use std::convert::TryInto;
+use std::ops::Neg;

-use bls12_381::{G1Affine, G1Projective, Scalar};
-use group::{Curve, GroupEncoding};
+use bls12_381::{multi_miller_loop, G1Affine, G1Projective, G2Prepared, Scalar};
+use group::{Curve, Group, GroupEncoding};

 use crate::error::{CoconutError, Result};
 use crate::proofs::ProofCmCs;
+use crate::scheme::keygen::VerificationKey;
 use crate::scheme::setup::Parameters;
 use crate::scheme::BlindedSignature;
 use crate::scheme::SecretKey;
@@ -318,6 +320,96 @@ pub fn blind_sign(
    Ok(BlindedSignature(h, sig))
 }

+/// Verifies a partial blind signature using the provided parameters and validator's verification key.
+///
+/// # Arguments
+///
+/// * `params` - A reference to the cryptographic parameters.
+/// * `blind_sign_request` - A reference to the blind signature request signed by the client.
+/// * `public_attributes` - A reference to the public attributes included in the client's request.
+/// * `blind_sig` - A reference to the issued partial blinded signature to be verified.
+/// * `partial_verification_key` - A reference to the validator's partial verification key.
+///
+/// # Returns
+///
+/// A boolean indicating whether the partial blind signature is valid (`true`) or not (`false`).
+///
+/// # Remarks
+///
+/// This function verifies the correctness and validity of a partial blind signature using
+/// the provided cryptographic parameters, blind signature request, blinded signature,
+/// and partial verification key.
+/// It calculates pairings based on the provided values and checks whether the partial blind signature
+/// is consistent with the verification key and commitments in the blind signature request.
+/// The function returns `true` if the partial blind signature is valid, and `false` otherwise.
+pub fn verify_partial_blind_signature(
+    params: &Parameters,
+    blind_sign_request: &BlindSignRequest,
+    public_attributes: &[Attribute],
+    blind_sig: &BlindedSignature,
+    partial_verification_key: &VerificationKey,
+) -> bool {
+    let num_private_attributes = blind_sign_request.private_attributes_commitments.len();
+    if num_private_attributes + public_attributes.len() > partial_verification_key.beta_g2.len() {
+        return false;
+    }
+
+    // TODO: we're losing some memory here due to extra allocation,
+    // but worst-case scenario (given SANE amount of attributes), it's just few kb at most
+    let c_neg = blind_sig.1.to_affine().neg();
+    let g2_prep = params.prepared_miller_g2();
+
+    let mut terms = vec![
+        // (c^{-1}, g2)
+        (c_neg, g2_prep.clone()),
+        // (s, alpha)
+        (
+            blind_sig.0.to_affine(),
+            G2Prepared::from(partial_verification_key.alpha.to_affine()),
+        ),
+    ];
+
+    // for each private attribute, add (cm_i, beta_i) to the miller terms
+    for (private_attr_commit, beta_g2) in blind_sign_request
+        .private_attributes_commitments
+        .iter()
+        .zip(&partial_verification_key.beta_g2)
+    {
+        // (cm_i, beta_i)
+        terms.push((
+            private_attr_commit.to_affine(),
+            G2Prepared::from(beta_g2.to_affine()),
+        ))
+    }
+
+    // for each public attribute, add (s^pub_j, beta_{priv + j}) to the miller terms
+    for (pub_attr, beta_g2) in public_attributes.iter().zip(
+        partial_verification_key
+            .beta_g2
+            .iter()
+            .skip(num_private_attributes),
+    ) {
+        // (s^pub_j, beta_j)
+        terms.push((
+            (blind_sig.0 * pub_attr).to_affine(),
+            G2Prepared::from(beta_g2.to_affine()),
+        ))
+    }
+
+    // get the references to all the terms to get the arguments the miller loop expects
+    let terms_refs = terms.iter().map(|(g1, g2)| (g1, g2)).collect::<Vec<_>>();
+
+    // since checking whether e(a, b) == e(c, d)
+    // is equivalent to checking e(a, b) • e(c, d)^{-1} == id
+    // and thus to e(a, b) • e(c^{-1}, d) == id
+    //
+    // compute e(c^1, g2) • e(s, alpha) • e(cm_0, beta_0) • e(cm_i, beta_i) • (s^pub_0, beta_{i+1}) (s^pub_j, beta_{i + j})
+    multi_miller_loop(&terms_refs)
+        .final_exponentiation()
+        .is_identity()
+        .into()
+}
+
 #[cfg(test)]
 pub fn sign(
    params: &mut Parameters,
@@ -354,6 +446,7 @@ pub fn sign(
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::scheme::keygen::keygen;

    #[test]
    fn blind_sign_request_bytes_roundtrip() {
@@ -385,4 +478,81 @@ mod tests {
            lambda
        );
    }
+
+    #[test]
+    fn successful_verify_partial_blind_signature() {
+        let params = Parameters::new(4).unwrap();
+        let private_attributes = params.n_random_scalars(2);
+        let public_attributes = params.n_random_scalars(2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let blind_sig = blind_sign(
+            &params,
+            &validator_keypair.secret_key(),
+            &request,
+            &public_attributes,
+        )
+        .unwrap();
+
+        assert!(verify_partial_blind_signature(
+            &params,
+            &request,
+            &public_attributes,
+            &blind_sig,
+            &validator_keypair.verification_key()
+        ));
+    }
+
+    #[test]
+    fn successful_verify_partial_blind_signature_no_public_attributes() {
+        let params = Parameters::new(4).unwrap();
+        let private_attributes = params.n_random_scalars(2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &[]).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let blind_sig =
+            blind_sign(&params, &validator_keypair.secret_key(), &request, &[]).unwrap();
+
+        assert!(verify_partial_blind_signature(
+            &params,
+            &request,
+            &[],
+            &blind_sig,
+            &validator_keypair.verification_key()
+        ));
+    }
+
+    #[test]
+    fn fail_verify_partial_blind_signature_with_wrong_key() {
+        let params = Parameters::new(4).unwrap();
+        let private_attributes = params.n_random_scalars(2);
+        let public_attributes = params.n_random_scalars(2);
+
+        let (_commitments_openings, request) =
+            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
+
+        let validator_keypair = keygen(&params);
+        let validator2_keypair = keygen(&params);
+        let blind_sig = blind_sign(
+            &params,
+            &validator_keypair.secret_key(),
+            &request,
+            &public_attributes,
+        )
+        .unwrap();
+
+        // this assertion should fail, as we try to verify with a wrong validator key
+        assert!(!verify_partial_blind_signature(
+            &params,
+            &request,
+            &public_attributes,
+            &blind_sig,
+            &validator2_keypair.verification_key()
+        ),);
+    }
 }
@@ -493,10 +493,13 @@ impl TaskClient {
 impl Drop for TaskClient {
    fn drop(&mut self) {
        if !self.mode.should_signal_on_drop() {
-            self.log(Level::Debug, "the task client is getting dropped");
+            self.log(
+                Level::Trace,
+                "the task client is getting dropped (but instructed to not signal)",
+            );
            return;
        } else {
-            self.log(Level::Info, "the task client is getting dropped");
+            self.log(Level::Debug, "the task client is getting dropped");
        }

        if !self.is_shutdown_poll() {
@@ -0,0 +1,24 @@
+[package]
+name = "nym-tun"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+thiserror.workspace = true
+tokio = { workspace = true, features = ["rt-multi-thread", "net", "io-util", "time", "sync", "macros"] }
+etherparse = "0.13.0"
+log.workspace = true
+nym-wireguard-types = { path = "../wireguard-types", optional = true }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+tokio-tun = "0.9.0"
+
+[features]
+wireguard = ["nym-wireguard-types"]
@@ -0,0 +1,7 @@
+#[cfg(target_os = "linux")]
+mod linux;
+
+pub mod tun_task_channel;
+
+#[cfg(target_os = "linux")]
+pub use linux::tun_device;
@@ -0,0 +1 @@
+pub mod tun_device;
@@ -0,0 +1,326 @@
+use std::{
+    collections::HashMap,
+    net::{IpAddr, Ipv4Addr},
+    time::Duration,
+};
+
+use etherparse::{InternetSlice, SlicedPacket};
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    time::timeout,
+};
+
+use crate::tun_task_channel::{
+    tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
+    TunTaskResponseSendError, TunTaskResponseTx, TunTaskRx, TunTaskTx,
+};
+
+#[cfg(feature = "wireguard")]
+use nym_wireguard_types::tun_common::{
+    active_peers::{PeerEventSenderError, PeersByIp},
+    event::Event,
+};
+
+#[cfg(feature = "wireguard")]
+const MUTEX_LOCK_TIMEOUT_MS: u64 = 200;
+const TUN_WRITE_TIMEOUT_MS: u64 = 1000;
+
+#[derive(thiserror::Error, Debug)]
+pub enum TunDeviceError {
+    #[error("timeout writing to tun device, dropping packet")]
+    TunWriteTimeout,
+
+    #[error("error writing to tun device: {source}")]
+    TunWriteError { source: std::io::Error },
+
+    #[cfg(feature = "wireguard")]
+    #[error("failed forwarding packet to peer: {source}")]
+    ForwardToPeerFailed {
+        #[from]
+        source: PeerEventSenderError,
+    },
+
+    #[error("failed to forward responding packet with tag: {source}")]
+    ForwardNatResponseFailed {
+        #[from]
+        source: TunTaskResponseSendError,
+    },
+
+    #[error("unable to parse headers in packet")]
+    UnableToParseHeaders {
+        #[from]
+        source: etherparse::ReadError,
+    },
+
+    #[error("unable to parse src and dst address from packet: ip header missing")]
+    UnableToParseAddressIpHeaderMissing,
+
+    #[error("unable to lock peer mutex")]
+    FailedToLockPeer,
+}
+
+fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun {
+    log::info!("Creating TUN device with: address={address}, netmask={netmask}");
+    // Read MTU size from env variable NYM_MTU_SIZE, else default to 1420.
+    let mtu = std::env::var("NYM_MTU_SIZE")
+        .map(|mtu| mtu.parse().expect("NYM_MTU_SIZE must be a valid integer"))
+        .unwrap_or(1420);
+    log::info!("Using MTU size: {mtu}");
+    tokio_tun::Tun::builder()
+        .name(name)
+        .tap(false)
+        .packet_info(false)
+        .mtu(mtu)
+        .up()
+        .address(address)
+        .netmask(netmask)
+        .try_build()
+        .expect("Failed to setup tun device, do you have permission?")
+}
+
+pub struct TunDevice {
+    // The TUN device that we read/write to, to send/receive packets
+    tun: tokio_tun::Tun,
+
+    // Incoming data that we should send
+    tun_task_rx: TunTaskRx,
+
+    // And when we get replies, this is where we should send it
+    tun_task_response_tx: TunTaskResponseTx,
+
+    routing_mode: RoutingMode,
+}
+
+pub enum RoutingMode {
+    // The routing table, as how wireguard does it
+    #[cfg(feature = "wireguard")]
+    AllowedIps(AllowedIpsInner),
+
+    // This is an alternative to the routing table, where we just match outgoing source IP with
+    // incoming destination IP.
+    Nat(NatInner),
+}
+
+impl RoutingMode {
+    pub fn new_nat() -> Self {
+        RoutingMode::Nat(NatInner {
+            nat_table: HashMap::new(),
+        })
+    }
+
+    #[cfg(feature = "wireguard")]
+    pub fn new_allowed_ips(peers_by_ip: std::sync::Arc<tokio::sync::Mutex<PeersByIp>>) -> Self {
+        RoutingMode::AllowedIps(AllowedIpsInner { peers_by_ip })
+    }
+}
+
+#[cfg(feature = "wireguard")]
+pub struct AllowedIpsInner {
+    peers_by_ip: std::sync::Arc<tokio::sync::Mutex<PeersByIp>>,
+}
+
+#[cfg(feature = "wireguard")]
+impl AllowedIpsInner {
+    async fn lock(&self) -> Result<tokio::sync::MutexGuard<PeersByIp>, TunDeviceError> {
+        timeout(
+            Duration::from_millis(MUTEX_LOCK_TIMEOUT_MS),
+            self.peers_by_ip.as_ref().lock(),
+        )
+        .await
+        .map_err(|_| TunDeviceError::FailedToLockPeer)
+    }
+}
+
+pub struct NatInner {
+    nat_table: HashMap<IpAddr, u64>,
+}
+
+pub struct TunDeviceConfig {
+    pub base_name: String,
+    pub ip: Ipv4Addr,
+    pub netmask: Ipv4Addr,
+}
+
+impl TunDevice {
+    pub fn new(
+        routing_mode: RoutingMode,
+        config: TunDeviceConfig,
+    ) -> (Self, TunTaskTx, TunTaskResponseRx) {
+        let TunDeviceConfig {
+            base_name,
+            ip,
+            netmask,
+        } = config;
+        let name = format!("{base_name}%d");
+
+        let tun = setup_tokio_tun_device(&name, ip, netmask);
+        log::info!("Created TUN device: {}", tun.name());
+
+        // Channels to communicate with the other tasks
+        let (tun_task_tx, tun_task_rx) = tun_task_channel();
+        let (tun_task_response_tx, tun_task_response_rx) = tun_task_response_channel();
+
+        let tun_device = TunDevice {
+            tun_task_rx,
+            tun_task_response_tx,
+            tun,
+            routing_mode,
+        };
+
+        (tun_device, tun_task_tx, tun_task_response_rx)
+    }
+
+    // Send outbound packets out on the wild internet
+    async fn handle_tun_write(&mut self, data: TunTaskPayload) -> Result<(), TunDeviceError> {
+        let (tag, packet) = data;
+        let ParsedAddresses { src_addr, dst_addr } = parse_src_dst_address(&packet)?;
+        log::debug!(
+            "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
+            packet.len()
+        );
+
+        // TODO: expire old entries
+        // #[allow(irrefutable_let_patterns)]
+        // if let RoutingMode::Nat(nat_table) = &mut self.routing_mode {
+        //     nat_table.nat_table.insert(src_addr, tag);
+        // }
+
+        timeout(
+            Duration::from_millis(TUN_WRITE_TIMEOUT_MS),
+            self.tun.write_all(&packet),
+        )
+        .await
+        .map_err(|_| TunDeviceError::TunWriteTimeout)?
+        .map_err(|err| TunDeviceError::TunWriteError { source: err })
+    }
+
+    // Receive reponse packets from the wild internet
+    async fn handle_tun_read(&self, packet: &[u8]) -> Result<(), TunDeviceError> {
+        // let ParsedAddresses { src_addr, dst_addr } = parse_src_dst_address(packet)?;
+        // log::debug!(
+        //     "iface: read Packet({dst_addr} <- {src_addr}, {} bytes)",
+        //     packet.len(),
+        // );
+        let dst_addr =
+            parse_dst_addr(packet).ok_or(TunDeviceError::UnableToParseAddressIpHeaderMissing)?;
+
+        // Route packet to the correct peer.
+
+        match self.routing_mode {
+            // This is how wireguard does it, by consulting the AllowedIPs table.
+            #[cfg(feature = "wireguard")]
+            RoutingMode::AllowedIps(ref peers_by_ip) => {
+                let peers = peers_by_ip.lock().await?;
+                if let Some(peer_tx) = peers.longest_match(dst_addr).map(|(_, tx)| tx) {
+                    log::debug!("Forward packet to wg tunnel");
+                    return peer_tx
+                        .send(Event::Ip(packet.to_vec().into()))
+                        .await
+                        .map_err(|err| err.into());
+                }
+            }
+
+            // But we can also do it by consulting the NAT table.
+            RoutingMode::Nat(ref nat_table) => {
+                // if let Some(tag) = nat_table.nat_table.get(&dst_addr) {
+                // log::debug!("Forward packet with NAT tag: {tag}");
+                return self
+                    .tun_task_response_tx
+                    // .try_send((*tag, packet.to_vec()))
+                    .try_send((0, packet.to_vec()))
+                    .map_err(|err| err.into());
+                // }
+            }
+        }
+
+        log::info!("No peer found, packet dropped");
+        Ok(())
+    }
+
+    pub async fn run(mut self) {
+        let mut buf = [0u8; 65535];
+
+        loop {
+            tokio::select! {
+                // Reading from the TUN device
+                len = self.tun.read(&mut buf) => match len {
+                    Ok(len) => {
+                        let packet = &buf[..len];
+                        if let Err(err) = self.handle_tun_read(packet).await {
+                            log::error!("iface: handle_tun_read failed: {err}")
+                        }
+                    },
+                    Err(err) => {
+                        log::info!("iface: read error: {err}");
+                        // break;
+                    }
+                },
+                // Writing to the TUN device
+                Some(data) = self.tun_task_rx.recv() => {
+                    if let Err(err) = self.handle_tun_write(data).await {
+                        log::error!("ifcae: handle_tun_write failed: {err}");
+                    }
+                }
+            }
+        }
+        // log::info!("TUN device shutting down");
+    }
+
+    pub fn start(self) {
+        tokio::spawn(async move { self.run().await });
+    }
+}
+
+struct ParsedAddresses {
+    src_addr: IpAddr,
+    dst_addr: IpAddr,
+}
+
+fn parse_src_dst_address(packet: &[u8]) -> Result<ParsedAddresses, TunDeviceError> {
+    let headers = SlicedPacket::from_ip(packet)?;
+    match headers.ip {
+        Some(InternetSlice::Ipv4(ip, _)) => Ok(ParsedAddresses {
+            src_addr: ip.source_addr().into(),
+            dst_addr: ip.destination_addr().into(),
+        }),
+        Some(InternetSlice::Ipv6(ip, _)) => Ok(ParsedAddresses {
+            src_addr: ip.source_addr().into(),
+            dst_addr: ip.destination_addr().into(),
+        }),
+        None => Err(TunDeviceError::UnableToParseAddressIpHeaderMissing),
+    }
+}
+
+// Copyright (c) 2019 Cloudflare, Inc. All rights reserved.
+// SPDX-License-Identifier: BSD-3-Clause
+const IPV4_MIN_HEADER_SIZE: usize = 20;
+const IPV4_DST_IP_OFF: usize = 16;
+const IPV4_IP_SZ: usize = 4;
+
+const IPV6_MIN_HEADER_SIZE: usize = 40;
+const IPV6_DST_IP_OFF: usize = 24;
+const IPV6_IP_SZ: usize = 16;
+
+pub fn parse_dst_addr(packet: &[u8]) -> Option<IpAddr> {
+    if packet.is_empty() {
+        return None;
+    }
+
+    match packet[0] >> 4 {
+        4 if packet.len() >= IPV4_MIN_HEADER_SIZE => {
+            let addr_bytes: [u8; IPV4_IP_SZ] = packet
+                [IPV4_DST_IP_OFF..IPV4_DST_IP_OFF + IPV4_IP_SZ]
+                .try_into()
+                .unwrap();
+            Some(IpAddr::from(addr_bytes))
+        }
+        6 if packet.len() >= IPV6_MIN_HEADER_SIZE => {
+            let addr_bytes: [u8; IPV6_IP_SZ] = packet
+                [IPV6_DST_IP_OFF..IPV6_DST_IP_OFF + IPV6_IP_SZ]
+                .try_into()
+                .unwrap();
+            Some(IpAddr::from(addr_bytes))
+        }
+        _ => None,
+    }
+}
@@ -0,0 +1,84 @@
+#![cfg_attr(not(target_os = "linux"), allow(dead_code))]
+
+use std::time::Duration;
+
+use tokio::sync::mpsc::{
+    self,
+    error::{SendError, SendTimeoutError, TrySendError},
+};
+
+pub(crate) type TunTaskPayload = (u64, Vec<u8>);
+
+#[derive(Clone)]
+pub struct TunTaskTx(mpsc::Sender<TunTaskPayload>);
+pub(crate) struct TunTaskRx(mpsc::Receiver<TunTaskPayload>);
+
+impl TunTaskTx {
+    pub async fn send(&self, data: TunTaskPayload) -> Result<(), SendError<TunTaskPayload>> {
+        self.0.send(data).await
+    }
+
+    pub fn try_send(&self, data: TunTaskPayload) -> Result<(), TrySendError<TunTaskPayload>> {
+        self.0.try_send(data)
+    }
+}
+
+impl TunTaskRx {
+    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
+        self.0.recv().await
+    }
+}
+
+pub(crate) fn tun_task_channel() -> (TunTaskTx, TunTaskRx) {
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
+    (TunTaskTx(tun_task_tx), TunTaskRx(tun_task_rx))
+}
+
+const TUN_TASK_RESPONSE_SEND_TIMEOUT_MS: u64 = 1_000;
+
+// Send responses back from the tun device back to the PacketRelayer
+pub(crate) struct TunTaskResponseTx(mpsc::Sender<TunTaskPayload>);
+pub struct TunTaskResponseRx(mpsc::Receiver<TunTaskPayload>);
+
+#[derive(thiserror::Error, Debug)]
+pub enum TunTaskResponseSendError {
+    #[error("failed to send tun response: {0}")]
+    SendTimeoutError(#[from] SendTimeoutError<TunTaskPayload>),
+
+    #[error("failed to send tun response: {0}")]
+    SendError(#[from] SendError<TunTaskPayload>),
+
+    #[error("failed to send tun response: {0}")]
+    TrySendError(#[from] TrySendError<TunTaskPayload>),
+}
+
+impl TunTaskResponseTx {
+    #[allow(unused)]
+    pub(crate) async fn send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
+        Ok(self
+            .0
+            .send_timeout(
+                data,
+                Duration::from_millis(TUN_TASK_RESPONSE_SEND_TIMEOUT_MS),
+            )
+            .await?)
+    }
+
+    pub(crate) fn try_send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
+        Ok(self.0.try_send(data)?)
+    }
+}
+
+impl TunTaskResponseRx {
+    pub async fn recv(&mut self) -> Option<TunTaskPayload> {
+        self.0.recv().await
+    }
+}
+
+pub(crate) fn tun_task_response_channel() -> (TunTaskResponseTx, TunTaskResponseRx) {
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
+    (
+        TunTaskResponseTx(tun_task_tx),
+        TunTaskResponseRx(tun_task_rx),
+    )
+}
@@ -119,6 +119,7 @@ pub struct GatewayNetworkRequesterDetails {
    pub encryption_key: String,

    pub open_proxy: bool,
+    pub exit_policy: bool,
    pub enabled_statistics: bool,

    // just a convenience wrapper around all the keys
@@ -140,9 +141,35 @@ impl fmt::Display for GatewayNetworkRequesterDetails {
        writeln!(f, "\taddress: {}", self.address)?;

        writeln!(f, "\tuses open proxy: {}", self.open_proxy)?;
+        writeln!(f, "\tuses exit policy: {}", self.exit_policy)?;
        writeln!(f, "\tsends statistics: {}", self.enabled_statistics)?;

        writeln!(f, "\tallow list path: {}", self.allow_list_path)?;
        writeln!(f, "\tunknown list path: {}", self.unknown_list_path)
    }
 }
+
+#[derive(Serialize, Deserialize)]
+pub struct GatewayIpPacketRouterDetails {
+    pub enabled: bool,
+
+    pub identity_key: String,
+    pub encryption_key: String,
+
+    // just a convenience wrapper around all the keys
+    pub address: String,
+
+    pub config_path: String,
+}
+
+impl fmt::Display for GatewayIpPacketRouterDetails {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        writeln!(f, "IP packet router:")?;
+        writeln!(f, "\tenabled: {}", self.enabled)?;
+        writeln!(f, "\tconfig path: {}", self.config_path)?;
+
+        writeln!(f, "\tidentity key: {}", self.identity_key)?;
+        writeln!(f, "\tencryption key: {}", self.encryption_key)?;
+        writeln!(f, "\taddress: {}", self.address)
+    }
+}
@@ -12,9 +12,14 @@ license.workspace = true

 [dependencies]
 base64 = { workspace = true }
+bytes = "1.5.0"
 dashmap = { workspace = true }
+ip_network = "0.4.1"
+ip_network_table = "0.2.0"
+log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
+tokio = { workspace = true, features = ["sync", "time"] }

 nym-crypto = { path = "../crypto", features = ["asymmetric"] }

@@ -45,4 +50,4 @@ nym-crypto = { path = "../crypto", features = ["rand"]}
 default = ["verify"]
 openapi = ["utoipa", "serde_json"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
-verify = ["hmac", "sha2"]
+verify = ["hmac", "sha2"]
@@ -4,6 +4,8 @@
 pub mod error;
 pub mod public_key;
 pub mod registration;
+#[cfg(not(target_arch = "wasm32"))]
+pub mod tun_common;

 pub use error::Error;
 pub use public_key::PeerPublicKey;
@@ -6,7 +6,7 @@ use crate::PeerPublicKey;
 use base64::{engine::general_purpose, Engine};
 use dashmap::DashMap;
 use serde::{Deserialize, Serialize};
-use std::net::SocketAddr;
+use std::net::IpAddr;
 use std::{fmt, ops::Deref, str::FromStr};

 #[cfg(feature = "verify")]
@@ -18,11 +18,13 @@ use sha2::Sha256;

 pub type GatewayClientRegistry = DashMap<PeerPublicKey, GatewayClient>;
 pub type PendingRegistrations = DashMap<PeerPublicKey, Nonce>;
+pub type PrivateIPs = DashMap<IpAddr, Free>;

 #[cfg(feature = "verify")]
 pub type HmacSha256 = Hmac<Sha256>;

 pub type Nonce = u64;
+pub type Free = bool;

 #[derive(Serialize, Deserialize, Debug, Clone)]
 #[serde(tag = "type", rename_all = "camelCase")]
@@ -54,11 +56,17 @@ impl InitMessage {
 #[serde(tag = "type", rename_all = "camelCase")]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub enum ClientRegistrationResponse {
-    PendingRegistration { nonce: u64 },
-    Registered { success: bool },
+    PendingRegistration {
+        nonce: u64,
+        gateway_data: GatewayClient,
+        wg_port: u16,
+    },
+    Registered {
+        success: bool,
+    },
 }

-/// Client that wants to register sends its PublicKey and SocketAddr bytes mac digest encrypted with a DH shared secret.
+/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
 #[derive(Serialize, Deserialize, Debug, Clone)]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
@@ -67,9 +75,8 @@ pub struct GatewayClient {
    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
    pub pub_key: PeerPublicKey,

-    /// Client's socket address
-    #[cfg_attr(feature = "openapi", schema(example = "1.2.3.4:51820", value_type = String))]
-    pub socket: SocketAddr,
+    /// Assigned private IP
+    pub private_ip: IpAddr,

    /// Sha256 hmac on the data (alongside the prior nonce)
    #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
@@ -81,13 +88,12 @@ impl GatewayClient {
    pub fn new(
        local_secret: &PrivateKey,
        remote_public: PublicKey,
-        socket_address: SocketAddr,
+        private_ip: IpAddr,
        nonce: u64,
    ) -> Self {
        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
        #[allow(clippy::expect_used)]
-        let static_secret = boringtun::x25519::StaticSecret::try_from(local_secret.to_bytes())
-            .expect("conversion between x25519 private keys is infallible");
+        let static_secret = boringtun::x25519::StaticSecret::from(local_secret.to_bytes());
        let local_public: boringtun::x25519::PublicKey = (&static_secret).into();

        let remote_public = boringtun::x25519::PublicKey::from(remote_public.to_bytes());
@@ -100,13 +106,12 @@ impl GatewayClient {
            .expect("x25519 shared secret is always 32 bytes long");

        mac.update(local_public.as_bytes());
-        mac.update(socket_address.ip().to_string().as_bytes());
-        mac.update(socket_address.port().to_string().as_bytes());
+        mac.update(private_ip.to_string().as_bytes());
        mac.update(&nonce.to_le_bytes());

        GatewayClient {
            pub_key: PeerPublicKey::new(local_public),
-            socket: socket_address,
+            private_ip,
            mac: ClientMac(mac.finalize().into_bytes().to_vec()),
        }
    }
@@ -117,8 +122,7 @@ impl GatewayClient {
    pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
        // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
        #[allow(clippy::expect_used)]
-        let static_secret = boringtun::x25519::StaticSecret::try_from(gateway_key.to_bytes())
-            .expect("conversion between x25519 private keys is infallible");
+        let static_secret = boringtun::x25519::StaticSecret::from(gateway_key.to_bytes());

        let dh = static_secret.diffie_hellman(&self.pub_key);

@@ -128,8 +132,7 @@ impl GatewayClient {
            .expect("x25519 shared secret is always 32 bytes long");

        mac.update(self.pub_key.as_bytes());
-        mac.update(self.socket.ip().to_string().as_bytes());
-        mac.update(self.socket.port().to_string().as_bytes());
+        mac.update(self.private_ip.to_string().as_bytes());
        mac.update(&nonce.to_le_bytes());

        mac.verify_slice(&self.mac)
@@ -142,10 +145,6 @@ impl GatewayClient {
    pub fn pub_key(&self) -> PeerPublicKey {
        self.pub_key
    }
-
-    pub fn socket(&self) -> SocketAddr {
-        self.socket
-    }
 }

 // TODO: change the inner type into generic array of size HmacSha256::OutputSize
@@ -217,13 +216,12 @@ mod tests {
        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
        let client_key_pair = encryption::KeyPair::new(&mut rng);

-        let socket: SocketAddr = "1.2.3.4:5678".parse().unwrap();
        let nonce = 1234567890;

        let client = GatewayClient::new(
            client_key_pair.private_key(),
            *gateway_key_pair.public_key(),
-            socket,
+            "10.0.0.42".parse().unwrap(),
            nonce,
        );
        assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())
@@ -1,4 +1,4 @@
-use std::net::SocketAddr;
+use std::{net::SocketAddr, time::Duration};

 use boringtun::x25519;
 use dashmap::{
@@ -7,26 +7,47 @@ use dashmap::{
 };
 use tokio::sync::mpsc::{self};

-use crate::event::Event;
+use crate::tun_common::{event::Event, network_table::NetworkTable};
+
+// Registered peers
+pub type PeersByIp = NetworkTable<PeerEventSender>;

 // Channels that are used to communicate with the various tunnels
 #[derive(Clone)]
 pub struct PeerEventSender(mpsc::Sender<Event>);
-pub(crate) struct PeerEventReceiver(mpsc::Receiver<Event>);
+pub struct PeerEventReceiver(mpsc::Receiver<Event>);
+
+#[derive(thiserror::Error, Debug)]
+pub enum PeerEventSenderError {
+    #[error("send failed: timeout: {source}")]
+    SendTimeoutError {
+        #[from]
+        source: mpsc::error::SendTimeoutError<Event>,
+    },
+
+    #[error("send failed: {source}")]
+    SendError {
+        #[from]
+        source: mpsc::error::SendError<Event>,
+    },
+}

 impl PeerEventSender {
-    pub(crate) async fn send(&self, event: Event) -> Result<(), mpsc::error::SendError<Event>> {
-        self.0.send(event).await
+    pub async fn send(&self, event: Event) -> Result<(), PeerEventSenderError> {
+        Ok(self
+            .0
+            .send_timeout(event, Duration::from_millis(1000))
+            .await?)
    }
 }

 impl PeerEventReceiver {
-    pub(crate) async fn recv(&mut self) -> Option<Event> {
+    pub async fn recv(&mut self) -> Option<Event> {
        self.0.recv().await
    }
 }

-pub(crate) fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
+pub fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
    let (tx, rx) = mpsc::channel(16);
    (PeerEventSender(tx), PeerEventReceiver(rx))
 }
@@ -35,20 +56,20 @@ pub(crate) type PeersByKey = DashMap<x25519::PublicKey, PeerEventSender>;
 pub(crate) type PeersByAddr = DashMap<SocketAddr, PeerEventSender>;

 #[derive(Default)]
-pub(crate) struct ActivePeers {
+pub struct ActivePeers {
    active_peers: PeersByKey,
    active_peers_by_addr: PeersByAddr,
 }

 impl ActivePeers {
-    pub(crate) fn remove(&self, public_key: &x25519::PublicKey) {
+    pub fn remove(&self, public_key: &x25519::PublicKey) {
        log::info!("Removing peer: {public_key:?}");
        self.active_peers.remove(public_key);
        log::warn!("TODO: remove from peers_by_ip?");
        log::warn!("TODO: remove from peers_by_addr");
    }

-    pub(crate) fn insert(
+    pub fn insert(
        &self,
        public_key: x25519::PublicKey,
        addr: SocketAddr,
@@ -58,17 +79,14 @@ impl ActivePeers {
        self.active_peers_by_addr.insert(addr, peer_tx);
    }

-    pub(crate) fn get_by_key_mut(
+    pub fn get_by_key_mut(
        &self,
        public_key: &x25519::PublicKey,
    ) -> Option<RefMut<'_, x25519::PublicKey, PeerEventSender>> {
        self.active_peers.get_mut(public_key)
    }

-    pub(crate) fn get_by_addr(
-        &self,
-        addr: &SocketAddr,
-    ) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
+    pub fn get_by_addr(&self, addr: &SocketAddr) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
        self.active_peers_by_addr.get(addr)
    }
 }
@@ -0,0 +1,3 @@
+pub mod active_peers;
+pub mod event;
+pub mod network_table;
@@ -9,7 +9,7 @@ pub struct NetworkTable<T> {
 }

 impl<T> NetworkTable<T> {
-    pub(crate) fn new() -> Self {
+    pub fn new() -> Self {
        Self {
            ips: IpNetworkTable::new(),
        }
@@ -13,6 +13,7 @@ license.workspace = true
 [dependencies]
 async-recursion = "1.0.4"
 base64 = "0.21.3"
+bincode = "1.3.3"
 # The latest version on crates.io at the time of writing this (6.0.0) has a
 # version mismatch with x25519-dalek/curve25519-dalek that is resolved in the
 # latest commit. So pick that for now.
@@ -25,8 +26,11 @@ futures = "0.3.28"
 ip_network = "0.4.1"
 ip_network_table = "0.2.0"
 log.workspace = true
+nym-network-defaults = { path = "../network-defaults" }
 nym-task = { path = "../task" }
 nym-wireguard-types = { path = "../wireguard-types" }
+nym-sphinx = { path = "../nymsphinx" }
+nym-tun = { path = "../tun" , features = ["wireguard"] }
 rand.workspace = true
 serde = { workspace = true, features = ["derive"] }
 tap.workspace = true
@@ -3,15 +3,10 @@
 // #![warn(clippy::expect_used)]
 // #![warn(clippy::unwrap_used)]

-mod active_peers;
 mod error;
-mod event;
-mod network_table;
 mod packet_relayer;
-mod platform;
 mod registered_peers;
-mod setup;
-mod tun_task_channel;
+pub mod setup;
 mod udp_listener;
 mod wg_tunnel;

@@ -20,7 +15,9 @@ use std::sync::Arc;

 // Currently the module related to setting up the virtual network device is platform specific.
 #[cfg(target_os = "linux")]
-use platform::linux::tun_device;
+use nym_tun::tun_device;
+
+use nym_tun::tun_task_channel;

 /// Start wireguard UDP listener and TUN device
 ///
@@ -32,16 +29,31 @@ pub async fn start_wireguard(
    task_client: nym_task::TaskClient,
    gateway_client_registry: Arc<GatewayClientRegistry>,
 ) -> Result<(), Box<dyn std::error::Error + Send + Sync + 'static>> {
-    // We can either index peers by their IP like standard wireguard
-    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(network_table::NetworkTable::new()));
+    // TODO: make this configurable

-    // ... or by their tunnel tag, which is a random number assigned to them
-    let peers_by_tag = Arc::new(tokio::sync::Mutex::new(wg_tunnel::PeersByTag::new()));
+    // We can optionally index peers by their IP like standard wireguard. If we don't then we do
+    // plain NAT where we match incoming destination IP with outgoing source IP.
+
+    use nym_wireguard_types::tun_common::network_table::NetworkTable;
+    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(NetworkTable::new()));
+
+    // Alternative 1:
+    let routing_mode = tun_device::RoutingMode::new_allowed_ips(peers_by_ip.clone());
+    // Alternative 2:
+    //let routing_mode = tun_device::RoutingMode::new_nat();

    // Start the tun device that is used to relay traffic outbound
-    let (tun, tun_task_tx, tun_task_response_rx) = tun_device::TunDevice::new(peers_by_ip.clone());
+    let config = tun_device::TunDeviceConfig {
+        base_name: nym_network_defaults::WG_TUN_BASE_NAME.to_string(),
+        ip: nym_network_defaults::WG_TUN_DEVICE_ADDRESS.parse().unwrap(),
+        netmask: nym_network_defaults::WG_TUN_DEVICE_NETMASK.parse().unwrap(),
+    };
+    let (tun, tun_task_tx, tun_task_response_rx) = tun_device::TunDevice::new(routing_mode, config);
    tun.start();

+    // We also index peers by a tag
+    let peers_by_tag = Arc::new(tokio::sync::Mutex::new(wg_tunnel::PeersByTag::new()));
+
    // If we want to have the tun device on a separate host, it's the tun_task and
    // tun_task_response channels that needs to be sent over the network to the host where the tun
    // device is running.
@@ -3,11 +3,9 @@ use std::{collections::HashMap, sync::Arc};
 use tap::TapFallible;
 use tokio::sync::mpsc::{self};

-use crate::{
-    active_peers::PeerEventSender,
-    event::Event,
-    tun_task_channel::{TunTaskResponseRx, TunTaskTx},
-};
+use crate::tun_task_channel::{TunTaskResponseRx, TunTaskTx};
+
+use nym_wireguard_types::tun_common::{active_peers::PeerEventSender, event::Event};

 #[derive(Clone)]
 pub struct PacketRelaySender(pub(crate) mpsc::Sender<(u64, Vec<u8>)>);
@@ -1 +0,0 @@
-pub(crate) mod tun_device;
@@ -1,192 +0,0 @@
-use std::{
-    collections::HashMap,
-    net::{IpAddr, Ipv4Addr},
-    sync::Arc,
-};
-
-use etherparse::{InternetSlice, SlicedPacket};
-use tap::TapFallible;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-use crate::{
-    event::Event,
-    setup::{TUN_BASE_NAME, TUN_DEVICE_ADDRESS, TUN_DEVICE_NETMASK},
-    tun_task_channel::{
-        tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
-        TunTaskResponseTx, TunTaskRx, TunTaskTx,
-    },
-    udp_listener::PeersByIp,
-};
-
-fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun {
-    log::info!("Creating TUN device with: address={address}, netmask={netmask}");
-    tokio_tun::Tun::builder()
-        .name(name)
-        .tap(false)
-        .packet_info(false)
-        .mtu(1350)
-        .up()
-        .address(address)
-        .netmask(netmask)
-        .try_build()
-        .expect("Failed to setup tun device, do you have permission?")
-}
-
-pub struct TunDevice {
-    // The TUN device that we read/write to, to send/receive packets
-    tun: tokio_tun::Tun,
-
-    // Incoming data that we should send
-    tun_task_rx: TunTaskRx,
-
-    // And when we get replies, this is where we should send it
-    tun_task_response_tx: TunTaskResponseTx,
-
-    // The routing table, as how wireguard does it
-    peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
-
-    // This is an alternative to the routing table, where we just match outgoing source IP with
-    // incoming destination IP.
-    nat_table: HashMap<IpAddr, u64>,
-}
-
-impl TunDevice {
-    pub fn new(
-        peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
-    ) -> (Self, TunTaskTx, TunTaskResponseRx) {
-        let tun = setup_tokio_tun_device(
-            format!("{TUN_BASE_NAME}%d").as_str(),
-            TUN_DEVICE_ADDRESS.parse().unwrap(),
-            TUN_DEVICE_NETMASK.parse().unwrap(),
-        );
-        log::info!("Created TUN device: {}", tun.name());
-
-        // Channels to communicate with the other tasks
-        let (tun_task_tx, tun_task_rx) = tun_task_channel();
-        let (tun_task_response_tx, tun_task_response_rx) = tun_task_response_channel();
-
-        let tun_device = TunDevice {
-            tun_task_rx,
-            tun_task_response_tx,
-            tun,
-            peers_by_ip,
-            nat_table: HashMap::new(),
-        };
-
-        (tun_device, tun_task_tx, tun_task_response_rx)
-    }
-
-    // Send outbound packets out on the wild internet
-    async fn handle_tun_write(&mut self, data: TunTaskPayload) {
-        let (tag, packet) = data;
-        let Some(dst_addr) = boringtun::noise::Tunn::dst_address(&packet) else {
-            log::error!("Unable to parse dst_address in packet that was supposed to be written to tun device");
-            return;
-        };
-        let Some(src_addr) = parse_src_address(&packet) else {
-            log::error!("Unable to parse src_address in packet that was supposed to be written to tun device");
-            return;
-        };
-        log::info!(
-            "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
-            packet.len()
-        );
-
-        // TODO: expire old entries
-        self.nat_table.insert(src_addr, tag);
-
-        self.tun
-            .write_all(&packet)
-            .await
-            .tap_err(|err| {
-                log::error!("iface: write error: {err}");
-            })
-            .ok();
-    }
-
-    // Receive reponse packets from the wild internet
-    async fn handle_tun_read(&self, packet: &[u8]) {
-        let Some(dst_addr) = boringtun::noise::Tunn::dst_address(packet) else {
-            log::error!("Unable to parse dst_address in packet that was read from tun device");
-            return;
-        };
-        let Some(src_addr) = parse_src_address(packet) else {
-            log::error!("Unable to parse src_address in packet that was read from tun device");
-            return;
-        };
-        log::info!(
-            "iface: read Packet({src_addr} -> {dst_addr}, {} bytes)",
-            packet.len(),
-        );
-
-        // Route packet to the correct peer.
-
-        // This is how wireguard does it, by consulting the AllowedIPs table.
-        if false {
-            let peers = self.peers_by_ip.lock().await;
-            if let Some(peer_tx) = peers.longest_match(dst_addr).map(|(_, tx)| tx) {
-                log::info!("Forward packet to wg tunnel");
-                peer_tx
-                    .send(Event::Ip(packet.to_vec().into()))
-                    .await
-                    .tap_err(|err| log::error!("{err}"))
-                    .ok();
-                return;
-            }
-        }
-
-        // But we do it by consulting the NAT table.
-        {
-            if let Some(tag) = self.nat_table.get(&dst_addr) {
-                log::info!("Forward packet to wg tunnel with tag: {tag}");
-                self.tun_task_response_tx
-                    .send((*tag, packet.to_vec()))
-                    .await
-                    .tap_err(|err| log::error!("{err}"))
-                    .ok();
-                return;
-            }
-        }
-
-        log::info!("No peer found, packet dropped");
-    }
-
-    pub async fn run(mut self) {
-        let mut buf = [0u8; 1024];
-
-        loop {
-            tokio::select! {
-                // Reading from the TUN device
-                len = self.tun.read(&mut buf) => match len {
-                    Ok(len) => {
-                        let packet = &buf[..len];
-                        self.handle_tun_read(packet).await;
-                    },
-                    Err(err) => {
-                        log::info!("iface: read error: {err}");
-                        break;
-                    }
-                },
-                // Writing to the TUN device
-                Some(data) = self.tun_task_rx.recv() => {
-                    self.handle_tun_write(data).await;
-                }
-            }
-        }
-        log::info!("TUN device shutting down");
-    }
-
-    pub fn start(self) {
-        tokio::spawn(async move { self.run().await });
-    }
-}
-
-fn parse_src_address(packet: &[u8]) -> Option<IpAddr> {
-    let headers = SlicedPacket::from_ip(packet)
-        .tap_err(|err| log::error!("Unable to parse IP packet: {err:?}"))
-        .ok()?;
-    Some(match headers.ip? {
-        InternetSlice::Ipv4(ip, _) => ip.source_addr().into(),
-        InternetSlice::Ipv6(ip, _) => ip.source_addr().into(),
-    })
-}
@@ -1,2 +0,0 @@
-#[cfg(target_os = "linux")]
-pub(crate) mod linux;
@@ -6,24 +6,14 @@ use log::info;

 // The wireguard UDP listener
 pub const WG_ADDRESS: &str = "0.0.0.0";
-pub const WG_PORT: u16 = 51822;
-
-// The interface used to route traffic
-pub const TUN_BASE_NAME: &str = "nymtun";
-pub const TUN_DEVICE_ADDRESS: &str = "10.0.0.1";
-pub const TUN_DEVICE_NETMASK: &str = "255.255.255.0";

 // The private key of the listener
 // Corresponding public key: "WM8s8bYegwMa0TJ+xIwhk+dImk2IpDUKslDBCZPizlE="
 const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg=";

-// The public keys of the registered peer (clients)
-// Corresponding private key: "ILeN6gEh6vJ3Ju8RJ3HVswz+sPgkcKtAYTqzQRhTtlo="
-const PEER: &str = "NCIhkgiqxFx1ckKl3Zuh595DzIFl8mxju1Vg995EZhI=";
-
 // The AllowedIPs for the connected peer, which is one a single IP and the same as the IP that the
 // peer has configured on their side.
-const ALLOWED_IPS: &str = "10.0.0.2";
+const ALLOWED_IPS: &str = "10.1.0.2";

 fn decode_base64_key(base64_key: &str) -> [u8; 32] {
    general_purpose::STANDARD
@@ -36,7 +26,7 @@ fn decode_base64_key(base64_key: &str) -> [u8; 32] {
 pub fn server_static_private_key() -> x25519::StaticSecret {
    // TODO: this is a temporary solution for development
    let static_private_bytes: [u8; 32] = decode_base64_key(PRIVATE_KEY);
-    let static_private = x25519::StaticSecret::try_from(static_private_bytes).unwrap();
+    let static_private = x25519::StaticSecret::from(static_private_bytes);
    let static_public = x25519::PublicKey::from(&static_private);
    info!(
        "wg public key: {}",
@@ -47,8 +37,12 @@ pub fn server_static_private_key() -> x25519::StaticSecret {

 pub fn peer_static_public_key() -> x25519::PublicKey {
    // A single static public key is used during development
-    let peer_static_public_bytes: [u8; 32] = decode_base64_key(PEER);
-    let peer_static_public = x25519::PublicKey::try_from(peer_static_public_bytes).unwrap();
+
+    // Read from NYM_PEER_PUBLIC_KEY env variable
+    let peer = std::env::var("NYM_PEER_PUBLIC_KEY").expect("NYM_PEER_PUBLIC_KEY must be set");
+
+    let peer_static_public_bytes: [u8; 32] = decode_base64_key(&peer);
+    let peer_static_public = x25519::PublicKey::from(peer_static_public_bytes);
    info!(
        "Adding wg peer public key: {}",
        general_purpose::STANDARD.encode(peer_static_public)
@@ -1,54 +0,0 @@
-use tokio::sync::mpsc;
-
-pub(crate) type TunTaskPayload = (u64, Vec<u8>);
-
-#[derive(Clone)]
-pub struct TunTaskTx(mpsc::Sender<TunTaskPayload>);
-pub(crate) struct TunTaskRx(mpsc::Receiver<TunTaskPayload>);
-
-impl TunTaskTx {
-    pub(crate) async fn send(
-        &self,
-        data: TunTaskPayload,
-    ) -> Result<(), tokio::sync::mpsc::error::SendError<TunTaskPayload>> {
-        self.0.send(data).await
-    }
-}
-
-impl TunTaskRx {
-    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
-        self.0.recv().await
-    }
-}
-
-pub(crate) fn tun_task_channel() -> (TunTaskTx, TunTaskRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
-    (TunTaskTx(tun_task_tx), TunTaskRx(tun_task_rx))
-}
-
-// Send responses back from the tun device back to the PacketRelayer
-pub(crate) struct TunTaskResponseTx(mpsc::Sender<TunTaskPayload>);
-pub struct TunTaskResponseRx(mpsc::Receiver<TunTaskPayload>);
-
-impl TunTaskResponseTx {
-    pub(crate) async fn send(
-        &self,
-        data: TunTaskPayload,
-    ) -> Result<(), tokio::sync::mpsc::error::SendError<TunTaskPayload>> {
-        self.0.send(data).await
-    }
-}
-
-impl TunTaskResponseRx {
-    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
-        self.0.recv().await
-    }
-}
-
-pub(crate) fn tun_task_response_channel() -> (TunTaskResponseTx, TunTaskResponseRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
-    (
-        TunTaskResponseTx(tun_task_tx),
-        TunTaskResponseRx(tun_task_rx),
-    )
-}
@@ -6,27 +6,29 @@ use boringtun::{
 };
 use futures::StreamExt;
 use log::error;
+use nym_network_defaults::WG_PORT;
 use nym_task::TaskClient;
-use nym_wireguard_types::{registration::GatewayClientRegistry, PeerPublicKey};
+use nym_wireguard_types::{
+    registration::GatewayClientRegistry,
+    tun_common::{
+        active_peers::{ActivePeers, PeersByIp},
+        event::Event,
+    },
+    PeerPublicKey,
+};
 use tap::TapFallible;
 use tokio::{net::UdpSocket, sync::Mutex};

 use crate::{
-    active_peers::{ActivePeers, PeerEventSender},
    error::WgError,
-    event::Event,
-    network_table::NetworkTable,
    packet_relayer::PacketRelaySender,
    registered_peers::{RegisteredPeer, RegisteredPeers},
-    setup::{self, WG_ADDRESS, WG_PORT},
+    setup::{self, WG_ADDRESS},
    wg_tunnel::PeersByTag,
 };

 const MAX_PACKET: usize = 65535;

-// Registered peers
-pub(crate) type PeersByIp = NetworkTable<PeerEventSender>;
-
 async fn add_test_peer(registered_peers: &mut RegisteredPeers) {
    let peer_static_public = PeerPublicKey::new(setup::peer_static_public_key());
    let peer_index = 0;
@@ -7,18 +7,16 @@ use boringtun::{
 };
 use bytes::Bytes;
 use log::{debug, error, info, warn};
+use nym_wireguard_types::tun_common::{
+    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
+    event::Event,
+    network_table::NetworkTable,
+};
 use rand::RngCore;
 use tap::TapFallible;
 use tokio::{net::UdpSocket, sync::broadcast, time::timeout};

-use crate::{
-    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
-    error::WgError,
-    event::Event,
-    network_table::NetworkTable,
-    packet_relayer::PacketRelaySender,
-    registered_peers::PeerIdx,
-};
+use crate::{error::WgError, packet_relayer::PacketRelaySender, registered_peers::PeerIdx};

 const HANDSHAKE_MAX_RATE: u64 = 10;

@@ -1,5 +1,5 @@
 opt: wasm
-	wasm-opt --disable-sign-ext -Os ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm -o ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm
+	wasm-opt --signext-lowering -Os ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm -o ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm

 wasm:
 	RUSTFLAGS='-C link-arg=-s' cargo build --release --target wasm32-unknown-unknown
@@ -9,5 +9,15 @@ Each directory contains a readme with more information about running and contrib
 ## Scripts 
 * `bump_versions.sh` allows you to update the ~~`platform_release_version` and~~ `wallet_release_version` variable~~s~~ in the `book.toml` of each mdbook project at once. You can also optionally update the `minimum_rust_version` as well. Helpful for lazy-updating when cutting a new version of the docs. 
 * `build_all_to_dist.sh` is used by the `ci-dev.yml` and `cd-dev.yml` scripts for building all mdbook projects and moving the rendered html to `../dist/` to be rsynced with various servers. 
+* `post_process.sh` is a script called by the github CI and CD workflows to post process CSS/image/href links for serving several mdbooks from a subdirectory. 


+### Licensing and copyright information
+This is a monorepo and components that make up Nym as a system are licensed individually, so for accurate information, please check individual files.
+
+As a general approach, licensing is as follows this pattern:
+- applications and binaries are GPLv3
+- libraries and components are Apache 2.0 or MIT
+- documentation is Apache 2.0 or CC0-1.0
+
+For accurate information, please check individual files.
@@ -19,4 +19,6 @@ theme/
 theme
 theme/*

-.idea
+.idea
+
+notes
--- a/Show More
+++ b/Show More