Create tun_common subdir

* Create TaggedPacket

* Fix bug passing the correct data

Cargo.lock

@@ -6657,22 +6657,40 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+dependencies = [
+ "bincode",
+ "bytes",
+ "nym-service-providers-common",
+ "nym-sphinx",
+ "serde",
+]
+
 [[package]]
 name = "nym-ip-packet-router"
 version = "0.1.0"
 dependencies = [
+ "bincode",
+ "bytes",
  "etherparse",
  "futures",
  "log",
  "nym-bin-common",
  "nym-client-core",
  "nym-config",
+ "nym-exit-policy",
+ "nym-ip-packet-requests",
+ "nym-network-requester",
  "nym-sdk",
  "nym-service-providers-common",
  "nym-sphinx",
  "nym-task",
+ "nym-tun",
  "nym-wireguard",
  "nym-wireguard-types",
+ "reqwest",
  "serde",
  "serde_json",
  "tap",
@@ -6917,6 +6935,7 @@ dependencies = [
  "nym-crypto",
  "nym-node-requests",
  "nym-task",
+ "nym-wireguard",
  "nym-wireguard-types",
  "rand 0.7.3",
  "serde",
@@ -7459,6 +7478,19 @@ dependencies = [
  "wasm-utils",
 ]
 
+[[package]]
+name = "nym-tun"
+version = "0.1.0"
+dependencies = [
+ "boringtun",
+ "etherparse",
+ "log",
+ "nym-wireguard-types",
+ "thiserror",
+ "tokio",
+ "tokio-tun",
+]
+
 [[package]]
 name = "nym-types"
 version = "1.0.0"
@@ -7578,6 +7610,7 @@ version = "0.1.0"
 dependencies = [
  "async-recursion",
  "base64 0.21.4",
+ "bincode",
  "boringtun",
  "bytes",
  "dashmap",
@@ -7586,7 +7619,9 @@ dependencies = [
  "ip_network",
  "ip_network_table",
  "log",
+ "nym-sphinx",
  "nym-task",
+ "nym-tun",
  "nym-wireguard-types",
  "rand 0.8.5",
  "serde",
@@ -7602,14 +7637,19 @@ version = "0.1.0"
 dependencies = [
  "base64 0.21.4",
  "boringtun",
+ "bytes",
  "dashmap",
  "hmac 0.12.1",
+ "ip_network",
+ "ip_network_table",
+ "log",
  "nym-crypto",
  "rand 0.7.3",
  "serde",
  "serde_json",
  "sha2 0.10.8",
  "thiserror",
+ "tokio",
  "utoipa",
  "x25519-dalek 2.0.0",
 ]
@@ -9439,9 +9479,9 @@ checksum = "1ad4cc8da4ef723ed60bced201181d83791ad433213d8c24efffda1eec85d741"
 
 [[package]]
 name = "safer-ffi"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e9c1d19b288ca9898cd421c7b105fb7269918a7f8e9253a991e228981ca421ad"
+checksum = "395ace5aff9629c7268ca8255aceb945525b2cb644015f3caec5131a6a537c11"
 dependencies = [
  "inventory",
  "libc",
@@ -9456,9 +9496,9 @@ dependencies = [
 
 [[package]]
 name = "safer_ffi-proc_macros"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d7a04caa3ca2224f5ea4ddd850e2629c3b36b2b83621f87a8303bf41020110"
+checksum = "9255504d5467bae9e07d58b8de446ba6739b29bf72e1fa35b2387e30d29dcbfe"
 dependencies = [
  "macro_rules_attribute",
  "prettyplease",

Cargo.toml

@@ -49,6 +49,7 @@ members = [
     "common/exit-policy",
     "common/http-api-client",
     "common/inclusion-probability",
+    "common/ip-packet-requests",
     "common/ledger",
     "common/mixnode-common",
     "common/network-defaults",
@@ -74,6 +75,7 @@ members = [
     "common/store-cipher",
     "common/task",
     "common/topology",
+    "common/tun",
     "common/types",
     "common/wasm/client-core",
     "common/wasm/storage",

common/config/src/lib.rs

@@ -25,12 +25,20 @@ pub const DEFAULT_CONFIG_FILENAME: &str = "config.toml";
 
 #[cfg(feature = "dirs")]
 pub fn must_get_home() -> PathBuf {
-    dirs::home_dir().expect("Failed to evaluate $HOME value")
+    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
+        home_dir.into()
+    } else {
+        dirs::home_dir().expect("Failed to evaluate $HOME value")
+    }
 }
 
 #[cfg(feature = "dirs")]
 pub fn may_get_home() -> Option<PathBuf> {
-    dirs::home_dir()
+    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
+        Some(home_dir.into())
+    } else {
+        dirs::home_dir()
+    }
 }
 
 pub trait NymConfigTemplate: Serialize {

common/ip-packet-requests/Cargo.toml

@@ -0,0 +1,18 @@
+[package]
+name = "nym-ip-packet-requests"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+bincode = "1.3.3"
+bytes = "1.5.0"
+nym-service-providers-common = { path = "../../service-providers/common" }
+nym-sphinx = { path = "../nymsphinx" }
+serde = { workspace = true, features = ["derive"] }

common/ip-packet-requests/src/lib.rs

@@ -0,0 +1,33 @@
+use nym_service_providers_common::interface;
+
+pub type IpPacketRouterRequest = interface::Request<TaggedIpPacket>;
+pub type IpPacketRouterResponse = interface::Response<IpPacket>;
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct TaggedIpPacket {
+    pub packet: bytes::Bytes,
+    pub return_address: nym_sphinx::addressing::clients::Recipient,
+    pub return_mix_hops: Option<u8>,
+    pub return_mix_delays: Option<f64>,
+}
+
+#[derive(serde::Serialize, serde::Deserialize)]
+pub struct IpPacket {
+    pub packet: bytes::Bytes,
+}
+
+impl TaggedIpPacket {
+    pub fn from_message(
+        message: &nym_sphinx::receiver::ReconstructedMessage,
+    ) -> Result<Self, bincode::Error> {
+        use bincode::Options;
+        make_bincode_serializer().deserialize(&message.message)
+    }
+}
+
+fn make_bincode_serializer() -> impl bincode::Options {
+    use bincode::Options;
+    bincode::DefaultOptions::new()
+        .with_big_endian()
+        .with_varint_encoding()
+}

common/tun/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "nym-tun"
+version = "0.1.0"
+authors.workspace = true
+repository.workspace = true
+homepage.workspace = true
+documentation.workspace = true
+edition.workspace = true
+license.workspace = true
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[dependencies]
+thiserror.workspace = true
+tokio = { workspace = true, features = ["rt-multi-thread", "net", "io-util", "time", "sync", "macros"] }
+etherparse = "0.13.0"
+log.workspace = true
+# TODO: remove
+boringtun = { workspace = true }
+nym-wireguard-types = { path = "../wireguard-types", optional = true }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+tokio-tun = "0.9.0"
+
+[features]
+wireguard = ["nym-wireguard-types"]

common/tun/src/lib.rs

@@ -0,0 +1,7 @@
+#[cfg(target_os = "linux")]
+mod linux;
+
+pub mod tun_task_channel;
+
+#[cfg(target_os = "linux")]
+pub use linux::tun_device;

common/tun/src/linux/tun_device.rs

@@ -1,22 +1,67 @@
 use std::{
     collections::HashMap,
     net::{IpAddr, Ipv4Addr},
-    sync::Arc,
+    time::Duration,
 };
 
 use etherparse::{InternetSlice, SlicedPacket};
-use tap::TapFallible;
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-use crate::{
-    event::Event,
-    tun_task_channel::{
-        tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
-        TunTaskResponseTx, TunTaskRx, TunTaskTx,
-    },
-    udp_listener::PeersByIp,
+use tokio::{
+    io::{AsyncReadExt, AsyncWriteExt},
+    time::timeout,
 };
 
+use crate::tun_task_channel::{
+    tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
+    TunTaskResponseSendError, TunTaskResponseTx, TunTaskRx, TunTaskTx,
+};
+
+#[cfg(feature = "wireguard")]
+use nym_wireguard_types::tun_common::{
+    active_peers::{PeerEventSenderError, PeersByIp},
+    event::Event,
+};
+
+#[cfg(feature = "wireguard")]
+const MUTEX_LOCK_TIMEOUT_MS: u64 = 200;
+const TUN_WRITE_TIMEOUT_MS: u64 = 1000;
+
+#[derive(thiserror::Error, Debug)]
+pub enum TunDeviceError {
+    #[error("timeout writing to tun device, dropping packet")]
+    TunWriteTimeout,
+
+    #[error("error writing to tun device: {source}")]
+    TunWriteError { source: std::io::Error },
+
+    #[cfg(feature = "wireguard")]
+    #[error("failed forwarding packet to peer: {source}")]
+    ForwardToPeerFailed {
+        #[from]
+        source: PeerEventSenderError,
+    },
+
+    #[error("failed to forward responding packet with tag: {source}")]
+    ForwardNatResponseFailed {
+        #[from]
+        source: TunTaskResponseSendError,
+    },
+
+    #[error("unable to parse destination address from packet")]
+    UnableToParseDstAdddress,
+
+    #[error("unable to parse source address from packet")]
+    UnableToParseSrcAddress {
+        #[from]
+        source: etherparse::ReadError,
+    },
+
+    #[error("unable to parse source address from packet: ip header missing")]
+    UnableToParseSrcAddressIpHeaderMissing,
+
+    #[error("unable to lock peer mutex")]
+    FailedToLockPeer,
+}
+
 fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun {
     log::info!("Creating TUN device with: address={address}, netmask={netmask}");
     // Read MTU size from env variable NYM_MTU_SIZE, else default to 1420.
@@ -51,6 +96,7 @@ pub struct TunDevice {
 
 pub enum RoutingMode {
     // The routing table, as how wireguard does it
+    #[cfg(feature = "wireguard")]
     AllowedIps(AllowedIpsInner),
 
     // This is an alternative to the routing table, where we just match outgoing source IP with
@@ -65,13 +111,27 @@ impl RoutingMode {
         })
     }
 
-    pub fn new_allowed_ips(peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>) -> Self {
+    #[cfg(feature = "wireguard")]
+    pub fn new_allowed_ips(peers_by_ip: std::sync::Arc<tokio::sync::Mutex<PeersByIp>>) -> Self {
         RoutingMode::AllowedIps(AllowedIpsInner { peers_by_ip })
     }
 }
 
+#[cfg(feature = "wireguard")]
 pub struct AllowedIpsInner {
-    peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
+    peers_by_ip: std::sync::Arc<tokio::sync::Mutex<PeersByIp>>,
+}
+
+#[cfg(feature = "wireguard")]
+impl AllowedIpsInner {
+    async fn lock(&self) -> Result<tokio::sync::MutexGuard<PeersByIp>, TunDeviceError> {
+        timeout(
+            Duration::from_millis(MUTEX_LOCK_TIMEOUT_MS),
+            self.peers_by_ip.as_ref().lock(),
+        )
+        .await
+        .map_err(|_| TunDeviceError::FailedToLockPeer)
+    }
 }
 
 pub struct NatInner {
@@ -114,48 +174,38 @@ impl TunDevice {
     }
 
     // Send outbound packets out on the wild internet
-    async fn handle_tun_write(&mut self, data: TunTaskPayload) {
+    async fn handle_tun_write(&mut self, data: TunTaskPayload) -> Result<(), TunDeviceError> {
         let (tag, packet) = data;
-        let Some(dst_addr) = boringtun::noise::Tunn::dst_address(&packet) else {
-            log::error!("Unable to parse dst_address in packet that was supposed to be written to tun device");
-            return;
-        };
-        let Some(src_addr) = parse_src_address(&packet) else {
-            log::error!("Unable to parse src_address in packet that was supposed to be written to tun device");
-            return;
-        };
-        log::info!(
+        let dst_addr = boringtun::noise::Tunn::dst_address(&packet)
+            .ok_or_else(|| TunDeviceError::UnableToParseDstAdddress)?;
+
+        let src_addr = parse_src_address(&packet)?;
+        log::debug!(
             "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
             packet.len()
         );
 
         // TODO: expire old entries
+        #[allow(irrefutable_let_patterns)]
         if let RoutingMode::Nat(nat_table) = &mut self.routing_mode {
             nat_table.nat_table.insert(src_addr, tag);
         }
 
-        tokio::time::timeout(
-            std::time::Duration::from_millis(1000),
+        timeout(
+            Duration::from_millis(TUN_WRITE_TIMEOUT_MS),
             self.tun.write_all(&packet),
         )
         .await
-        .tap_err(|err| {
-            log::error!("iface: write error: {err}");
-        })
-        .ok();
+        .map_err(|_| TunDeviceError::TunWriteTimeout)?
+        .map_err(|err| TunDeviceError::TunWriteError { source: err })
     }
 
     // Receive reponse packets from the wild internet
-    async fn handle_tun_read(&self, packet: &[u8]) {
-        let Some(dst_addr) = boringtun::noise::Tunn::dst_address(packet) else {
-            log::error!("Unable to parse dst_address in packet that was read from tun device");
-            return;
-        };
-        let Some(src_addr) = parse_src_address(packet) else {
-            log::error!("Unable to parse src_address in packet that was read from tun device");
-            return;
-        };
-        log::info!(
+    async fn handle_tun_read(&self, packet: &[u8]) -> Result<(), TunDeviceError> {
+        let dst_addr = boringtun::noise::Tunn::dst_address(packet)
+            .ok_or(TunDeviceError::UnableToParseDstAdddress)?;
+        let src_addr = parse_src_address(packet)?;
+        log::debug!(
             "iface: read Packet({src_addr} -> {dst_addr}, {} bytes)",
             packet.len(),
         );
@@ -164,47 +214,32 @@ impl TunDevice {
 
         match self.routing_mode {
             // This is how wireguard does it, by consulting the AllowedIPs table.
+            #[cfg(feature = "wireguard")]
             RoutingMode::AllowedIps(ref peers_by_ip) => {
-                let Ok(peers) = tokio::time::timeout(
-                    std::time::Duration::from_millis(1000),
-                    peers_by_ip.peers_by_ip.as_ref().lock(),
-                )
-                .await
-                else {
-                    log::error!("Failed to lock peer");
-                    return;
-                };
-
+                let peers = peers_by_ip.lock().await?;
                 if let Some(peer_tx) = peers.longest_match(dst_addr).map(|(_, tx)| tx) {
-                    log::info!("Forward packet to wg tunnel");
-                    tokio::time::timeout(
-                        std::time::Duration::from_millis(1000),
-                        peer_tx.send(Event::Ip(packet.to_vec().into())),
-                    )
-                    .await
-                    .tap_err(|err| log::error!("Failed to forward packet to wg tunnel: {err}"))
-                    .ok();
-                    return;
+                    log::debug!("Forward packet to wg tunnel");
+                    return peer_tx
+                        .send(Event::Ip(packet.to_vec().into()))
+                        .await
+                        .map_err(|err| err.into());
                 }
             }
 
             // But we can also do it by consulting the NAT table.
             RoutingMode::Nat(ref nat_table) => {
                 if let Some(tag) = nat_table.nat_table.get(&dst_addr) {
-                    log::info!("Forward packet with tag: {tag}");
-                    tokio::time::timeout(
-                        std::time::Duration::from_millis(1000),
-                        self.tun_task_response_tx.send((*tag, packet.to_vec())),
-                    )
-                    .await
-                    .tap_err(|err| log::error!("Failed to foward packet with tag: {err}"))
-                    .ok();
-                    return;
+                    log::debug!("Forward packet with NAT tag: {tag}");
+                    return self
+                        .tun_task_response_tx
+                        .try_send((*tag, packet.to_vec()))
+                        .map_err(|err| err.into());
                 }
             }
         }
 
         log::info!("No peer found, packet dropped");
+        Ok(())
     }
 
     pub async fn run(mut self) {
@@ -216,13 +251,9 @@ impl TunDevice {
                 len = self.tun.read(&mut buf) => match len {
                     Ok(len) => {
                         let packet = &buf[..len];
-                        tokio::time::timeout(
-                            std::time::Duration::from_millis(1000),
-                            self.handle_tun_read(packet)
-                        )
-                        .await
-                        .tap_err(|_err| log::error!("Failed: handle_tun_read timeout"))
-                        .ok();
+                        if let Err(err) = self.handle_tun_read(packet).await {
+                            log::error!("iface: handle_tun_read failed: {err}")
+                        }
                     },
                     Err(err) => {
                         log::info!("iface: read error: {err}");
@@ -231,13 +262,9 @@ impl TunDevice {
                 },
                 // Writing to the TUN device
                 Some(data) = self.tun_task_rx.recv() => {
-                    tokio::time::timeout(
-                        std::time::Duration::from_millis(1000),
-                        self.handle_tun_write(data)
-                    )
-                    .await
-                    .tap_err(|_err| log::error!("Failed: handle_tun_write timeout"))
-                    .ok();
+                    if let Err(err) = self.handle_tun_write(data).await {
+                        log::error!("ifcae: handle_tun_write failed: {err}");
+                    }
                 }
             }
         }
@@ -249,12 +276,11 @@ impl TunDevice {
     }
 }
 
-fn parse_src_address(packet: &[u8]) -> Option<IpAddr> {
-    let headers = SlicedPacket::from_ip(packet)
-        .tap_err(|err| log::error!("Unable to parse IP packet: {err:?}"))
-        .ok()?;
-    Some(match headers.ip? {
-        InternetSlice::Ipv4(ip, _) => ip.source_addr().into(),
-        InternetSlice::Ipv6(ip, _) => ip.source_addr().into(),
-    })
+fn parse_src_address(packet: &[u8]) -> Result<IpAddr, TunDeviceError> {
+    let headers = SlicedPacket::from_ip(packet)?;
+    match headers.ip {
+        Some(InternetSlice::Ipv4(ip, _)) => Ok(ip.source_addr().into()),
+        Some(InternetSlice::Ipv6(ip, _)) => Ok(ip.source_addr().into()),
+        None => Err(TunDeviceError::UnableToParseSrcAddressIpHeaderMissing),
+    }
 }

common/tun/src/tun_task_channel.rs

@@ -0,0 +1,82 @@
+use std::time::Duration;
+
+use tokio::sync::mpsc::{
+    self,
+    error::{SendError, SendTimeoutError, TrySendError},
+};
+
+pub(crate) type TunTaskPayload = (u64, Vec<u8>);
+
+#[derive(Clone)]
+pub struct TunTaskTx(mpsc::Sender<TunTaskPayload>);
+pub(crate) struct TunTaskRx(mpsc::Receiver<TunTaskPayload>);
+
+impl TunTaskTx {
+    pub async fn send(&self, data: TunTaskPayload) -> Result<(), SendError<TunTaskPayload>> {
+        self.0.send(data).await
+    }
+
+    pub fn try_send(&self, data: TunTaskPayload) -> Result<(), TrySendError<TunTaskPayload>> {
+        self.0.try_send(data)
+    }
+}
+
+impl TunTaskRx {
+    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
+        self.0.recv().await
+    }
+}
+
+pub(crate) fn tun_task_channel() -> (TunTaskTx, TunTaskRx) {
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
+    (TunTaskTx(tun_task_tx), TunTaskRx(tun_task_rx))
+}
+
+const TUN_TASK_RESPONSE_SEND_TIMEOUT_MS: u64 = 1_000;
+
+// Send responses back from the tun device back to the PacketRelayer
+pub(crate) struct TunTaskResponseTx(mpsc::Sender<TunTaskPayload>);
+pub struct TunTaskResponseRx(mpsc::Receiver<TunTaskPayload>);
+
+#[derive(thiserror::Error, Debug)]
+pub enum TunTaskResponseSendError {
+    #[error("failed to send tun response: {0}")]
+    SendTimeoutError(#[from] SendTimeoutError<TunTaskPayload>),
+
+    #[error("failed to send tun response: {0}")]
+    SendError(#[from] SendError<TunTaskPayload>),
+
+    #[error("failed to send tun response: {0}")]
+    TrySendError(#[from] TrySendError<TunTaskPayload>),
+}
+
+impl TunTaskResponseTx {
+    #[allow(unused)]
+    pub(crate) async fn send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
+        Ok(self
+            .0
+            .send_timeout(
+                data,
+                Duration::from_millis(TUN_TASK_RESPONSE_SEND_TIMEOUT_MS),
+            )
+            .await?)
+    }
+
+    pub(crate) fn try_send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
+        Ok(self.0.try_send(data)?)
+    }
+}
+
+impl TunTaskResponseRx {
+    pub async fn recv(&mut self) -> Option<TunTaskPayload> {
+        self.0.recv().await
+    }
+}
+
+pub(crate) fn tun_task_response_channel() -> (TunTaskResponseTx, TunTaskResponseRx) {
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
+    (
+        TunTaskResponseTx(tun_task_tx),
+        TunTaskResponseRx(tun_task_rx),
+    )
+}

common/wireguard-types/Cargo.toml

@@ -12,9 +12,14 @@ license.workspace = true
 
 [dependencies]
 base64 = { workspace = true }
+bytes = "1.5.0"
 dashmap = { workspace = true }
+ip_network = "0.4.1"
+ip_network_table = "0.2.0"
+log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
+tokio = { workspace = true, features = ["sync", "time"] }
 
 nym-crypto = { path = "../crypto", features = ["asymmetric"] }
 
@@ -45,4 +50,4 @@ nym-crypto = { path = "../crypto", features = ["rand"]}
 default = ["verify"]
 openapi = ["utoipa", "serde_json"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
-verify = ["hmac", "sha2"]
+verify = ["hmac", "sha2"]

common/wireguard-types/src/lib.rs

@@ -4,6 +4,7 @@
 pub mod error;
 pub mod public_key;
 pub mod registration;
+pub mod tun_common;
 
 pub use error::Error;
 pub use public_key::PeerPublicKey;

common/wireguard-types/src/tun_common/active_peers.rs

@@ -1,4 +1,4 @@
-use std::net::SocketAddr;
+use std::{net::SocketAddr, time::Duration};
 
 use boringtun::x25519;
 use dashmap::{
@@ -7,26 +7,47 @@ use dashmap::{
 };
 use tokio::sync::mpsc::{self};
 
-use crate::event::Event;
+use crate::tun_common::{event::Event, network_table::NetworkTable};
+
+// Registered peers
+pub type PeersByIp = NetworkTable<PeerEventSender>;
 
 // Channels that are used to communicate with the various tunnels
 #[derive(Clone)]
 pub struct PeerEventSender(mpsc::Sender<Event>);
-pub(crate) struct PeerEventReceiver(mpsc::Receiver<Event>);
+pub struct PeerEventReceiver(mpsc::Receiver<Event>);
+
+#[derive(thiserror::Error, Debug)]
+pub enum PeerEventSenderError {
+    #[error("send failed: timeout: {source}")]
+    SendTimeoutError {
+        #[from]
+        source: mpsc::error::SendTimeoutError<Event>,
+    },
+
+    #[error("send failed: {source}")]
+    SendError {
+        #[from]
+        source: mpsc::error::SendError<Event>,
+    },
+}
 
 impl PeerEventSender {
-    pub(crate) async fn send(&self, event: Event) -> Result<(), mpsc::error::SendError<Event>> {
-        self.0.send(event).await
+    pub async fn send(&self, event: Event) -> Result<(), PeerEventSenderError> {
+        Ok(self
+            .0
+            .send_timeout(event, Duration::from_millis(1000))
+            .await?)
     }
 }
 
 impl PeerEventReceiver {
-    pub(crate) async fn recv(&mut self) -> Option<Event> {
+    pub async fn recv(&mut self) -> Option<Event> {
         self.0.recv().await
     }
 }
 
-pub(crate) fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
+pub fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
     let (tx, rx) = mpsc::channel(16);
     (PeerEventSender(tx), PeerEventReceiver(rx))
 }
@@ -35,20 +56,20 @@ pub(crate) type PeersByKey = DashMap<x25519::PublicKey, PeerEventSender>;
 pub(crate) type PeersByAddr = DashMap<SocketAddr, PeerEventSender>;
 
 #[derive(Default)]
-pub(crate) struct ActivePeers {
+pub struct ActivePeers {
     active_peers: PeersByKey,
     active_peers_by_addr: PeersByAddr,
 }
 
 impl ActivePeers {
-    pub(crate) fn remove(&self, public_key: &x25519::PublicKey) {
+    pub fn remove(&self, public_key: &x25519::PublicKey) {
         log::info!("Removing peer: {public_key:?}");
         self.active_peers.remove(public_key);
         log::warn!("TODO: remove from peers_by_ip?");
         log::warn!("TODO: remove from peers_by_addr");
     }
 
-    pub(crate) fn insert(
+    pub fn insert(
         &self,
         public_key: x25519::PublicKey,
         addr: SocketAddr,
@@ -58,17 +79,14 @@ impl ActivePeers {
         self.active_peers_by_addr.insert(addr, peer_tx);
     }
 
-    pub(crate) fn get_by_key_mut(
+    pub fn get_by_key_mut(
         &self,
         public_key: &x25519::PublicKey,
     ) -> Option<RefMut<'_, x25519::PublicKey, PeerEventSender>> {
         self.active_peers.get_mut(public_key)
     }
 
-    pub(crate) fn get_by_addr(
-        &self,
-        addr: &SocketAddr,
-    ) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
+    pub fn get_by_addr(&self, addr: &SocketAddr) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
         self.active_peers_by_addr.get(addr)
     }
 }

common/wireguard-types/src/tun_common/mod.rs

@@ -0,0 +1,3 @@
+pub mod active_peers;
+pub mod event;
+pub mod network_table;

common/wireguard-types/src/tun_common/network_table.rs

@@ -9,7 +9,7 @@ pub struct NetworkTable<T> {
 }
 
 impl<T> NetworkTable<T> {
-    pub(crate) fn new() -> Self {
+    pub fn new() -> Self {
         Self {
             ips: IpNetworkTable::new(),
         }

common/wireguard/Cargo.toml

@@ -13,6 +13,7 @@ license.workspace = true
 [dependencies]
 async-recursion = "1.0.4"
 base64 = "0.21.3"
+bincode = "1.3.3"
 # The latest version on crates.io at the time of writing this (6.0.0) has a
 # version mismatch with x25519-dalek/curve25519-dalek that is resolved in the
 # latest commit. So pick that for now.
@@ -27,6 +28,8 @@ ip_network_table = "0.2.0"
 log.workspace = true
 nym-task = { path = "../task" }
 nym-wireguard-types = { path = "../wireguard-types" }
+nym-sphinx = { path = "../nymsphinx" }
+nym-tun = { path = "../tun" , features = ["wireguard"] }
 rand.workspace = true
 serde = { workspace = true, features = ["derive"] }
 tap.workspace = true

common/wireguard/src/lib.rs

@@ -3,15 +3,15 @@
 // #![warn(clippy::expect_used)]
 // #![warn(clippy::unwrap_used)]
 
-mod active_peers;
+// mod active_peers;
 mod error;
-mod event;
-mod network_table;
+// mod event;
+// mod network_table;
 mod packet_relayer;
-mod platform;
+// mod platform;
 mod registered_peers;
-mod setup;
-pub mod tun_task_channel;
+pub mod setup;
+// pub mod tun_task_channel;
 mod udp_listener;
 mod wg_tunnel;
 
@@ -20,7 +20,9 @@ use std::sync::Arc;
 
 // Currently the module related to setting up the virtual network device is platform specific.
 #[cfg(target_os = "linux")]
-pub use platform::linux::tun_device;
+use nym_tun::tun_device;
+
+use nym_tun::tun_task_channel;
 
 /// Start wireguard UDP listener and TUN device
 ///
@@ -36,7 +38,9 @@ pub async fn start_wireguard(
 
     // We can optionally index peers by their IP like standard wireguard. If we don't then we do
     // plain NAT where we match incoming destination IP with outgoing source IP.
-    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(network_table::NetworkTable::new()));
+
+    use nym_wireguard_types::tun_common::network_table::NetworkTable;
+    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(NetworkTable::new()));
 
     // Alternative 1:
     let routing_mode = tun_device::RoutingMode::new_allowed_ips(peers_by_ip.clone());

common/wireguard/src/packet_relayer.rs

@@ -3,11 +3,9 @@ use std::{collections::HashMap, sync::Arc};
 use tap::TapFallible;
 use tokio::sync::mpsc::{self};
 
-use crate::{
-    active_peers::PeerEventSender,
-    event::Event,
-    tun_task_channel::{TunTaskResponseRx, TunTaskTx},
-};
+use crate::tun_task_channel::{TunTaskResponseRx, TunTaskTx};
+
+use nym_wireguard_types::tun_common::{active_peers::PeerEventSender, event::Event};
 
 #[derive(Clone)]
 pub struct PacketRelaySender(pub(crate) mpsc::Sender<(u64, Vec<u8>)>);

common/wireguard/src/tun_task_channel.rs

@@ -1,54 +0,0 @@
-use tokio::sync::mpsc;
-
-pub(crate) type TunTaskPayload = (u64, Vec<u8>);
-
-#[derive(Clone)]
-pub struct TunTaskTx(mpsc::Sender<TunTaskPayload>);
-pub(crate) struct TunTaskRx(mpsc::Receiver<TunTaskPayload>);
-
-impl TunTaskTx {
-    pub async fn send(
-        &self,
-        data: TunTaskPayload,
-    ) -> Result<(), tokio::sync::mpsc::error::SendError<TunTaskPayload>> {
-        self.0.send(data).await
-    }
-}
-
-impl TunTaskRx {
-    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
-        self.0.recv().await
-    }
-}
-
-pub(crate) fn tun_task_channel() -> (TunTaskTx, TunTaskRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
-    (TunTaskTx(tun_task_tx), TunTaskRx(tun_task_rx))
-}
-
-// Send responses back from the tun device back to the PacketRelayer
-pub(crate) struct TunTaskResponseTx(mpsc::Sender<TunTaskPayload>);
-pub struct TunTaskResponseRx(mpsc::Receiver<TunTaskPayload>);
-
-impl TunTaskResponseTx {
-    pub(crate) async fn send(
-        &self,
-        data: TunTaskPayload,
-    ) -> Result<(), tokio::sync::mpsc::error::SendError<TunTaskPayload>> {
-        self.0.send(data).await
-    }
-}
-
-impl TunTaskResponseRx {
-    pub async fn recv(&mut self) -> Option<TunTaskPayload> {
-        self.0.recv().await
-    }
-}
-
-pub(crate) fn tun_task_response_channel() -> (TunTaskResponseTx, TunTaskResponseRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
-    (
-        TunTaskResponseTx(tun_task_tx),
-        TunTaskResponseRx(tun_task_rx),
-    )
-}

common/wireguard/src/udp_listener.rs

@@ -7,15 +7,19 @@ use boringtun::{
 use futures::StreamExt;
 use log::error;
 use nym_task::TaskClient;
-use nym_wireguard_types::{registration::GatewayClientRegistry, PeerPublicKey, WG_PORT};
+use nym_wireguard_types::{
+    registration::GatewayClientRegistry,
+    tun_common::{
+        active_peers::{ActivePeers, PeersByIp},
+        event::Event,
+    },
+    PeerPublicKey, WG_PORT,
+};
 use tap::TapFallible;
 use tokio::{net::UdpSocket, sync::Mutex};
 
 use crate::{
-    active_peers::{ActivePeers, PeerEventSender},
     error::WgError,
-    event::Event,
-    network_table::NetworkTable,
     packet_relayer::PacketRelaySender,
     registered_peers::{RegisteredPeer, RegisteredPeers},
     setup::{self, WG_ADDRESS},
@@ -24,9 +28,6 @@ use crate::{
 
 const MAX_PACKET: usize = 65535;
 
-// Registered peers
-pub(crate) type PeersByIp = NetworkTable<PeerEventSender>;
-
 async fn add_test_peer(registered_peers: &mut RegisteredPeers) {
     let peer_static_public = PeerPublicKey::new(setup::peer_static_public_key());
     let peer_index = 0;

common/wireguard/src/wg_tunnel.rs

@@ -7,18 +7,16 @@ use boringtun::{
 };
 use bytes::Bytes;
 use log::{debug, error, info, warn};
+use nym_wireguard_types::tun_common::{
+    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
+    event::Event,
+    network_table::NetworkTable,
+};
 use rand::RngCore;
 use tap::TapFallible;
 use tokio::{net::UdpSocket, sync::broadcast, time::timeout};
 
-use crate::{
-    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
-    error::WgError,
-    event::Event,
-    network_table::NetworkTable,
-    packet_relayer::PacketRelaySender,
-    registered_peers::PeerIdx,
-};
+use crate::{error::WgError, packet_relayer::PacketRelaySender, registered_peers::PeerIdx};
 
 const HANDSHAKE_MAX_RATE: u64 = 10;
 

documentation/operators/src/faq/smoosh-faq.md

@@ -22,14 +22,17 @@ As we shared in our blog post article [*What does it take to build the wolds mos
 
 ### What are the changes?
 
-Project smoosh will have three steps:
+Project Smoosh will have four steps, please follow the table below to track the dynamic progress:
 
-1. Combine the `nym-gateway` and `nym-network-requester` into one binary ✅
-2. Create [Exit Gateway](../legal/exit-gateway.md): Take the `nym-gateway` binary including `nym-network-requester` combined in \#1 and switch from [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) ✅
-3. Combine all the nodes in the Nym Mixnet into one binary, that is `nym-mixnode`, `nym-gateway` (entry and exit) and `nym-network-requester`.
+| **Step** | **Status** |
+| :--- | :--- |
+| **1.** Combine the `nym-gateway` and `nym-network-requester` into one binary | ✅ done |
+| **2.** Create [Exit Gateway](../legal/exit-gateway.md): Take the `nym-gateway` binary including `nym-network-requester` combined in \#1 and switch from [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) to a new [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) | ✅ done |
+| **3.** Combine all the nodes in the Nym Mixnet into one binary, that is `nym-mixnode`, `nym-gateway` (entry and exit) and `nym-network-requester`. | 🛠️ in progress |
+| **4.** Adjust reward scheme to incentivise and reward Exit Gateways as a part of `nym-node` binary, implementing [zkNym credentials](https://youtu.be/nLmdsZ1BsQg?t=1717). | 🛠️ in progress |
 
-These three steps will be staggered over time - period of several months, and will be implemented one by one with enough time to take in feedback and fix bugs in between.  
-Generally, the software will be the same, just instead of multiple binaries, there will be one Nym Mixnet node binary. Delegations will remain on as they are now, per our token economics (staking, saturation etc)
+These steps will be staggered over time - period of several months, and will be implemented one by one with enough time to take in feedback and fix bugs in between.  
+Generally, the software will be the same, just instead of multiple binaries, there will be one Nym Node (`nym-node`) binary. Delegations will remain on as they are now, per our token economics (staking, saturation etc)
 
 ### What does it mean for Nym nodes operators?
 
@@ -49,13 +52,15 @@ The operators running Gateways would have to “open” their nodes to a wider r
 
 ### How will the Exit policy be implemented?
 
-The progression of exit policy on Gateways will have three steps:
+Follow the dynamic progress of exit policy implementation on Gateways below:
 
-1. By default the [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) filtering will be disabled and the current [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) filtering is going to continue be used. This is to prevent operators getting surprised by upgrading their Gateways (or Network Requesters) and suddenly be widely open to the internet. To enable the new exit policy, operators must use `--with-exit-policy` flag or modify the `config.toml` file. ✅
-2. Relatively soon the exit policy will be part of the Gateway setup by default. To disable this exit policy, operators must use `--disable-exit-policy` flag.
-3. Further down the line, it will be the only option. Then the `allowed.list` will be completely removed.
+| **Step** | **Status** |
+| :--- | :--- |
+| **1.** By default the [exit policy](https://nymtech.net/.wellknown/network-requester/exit-policy.txt) filtering is disabled and the [`allowed.list`](https://nymtech.net/.wellknown/network-requester/standard-allowed-list.txt) filtering is going to continue be used. This is to prevent operators getting surprised by upgrading their Gateways (or Network Requesters) and suddenly be widely open to the internet. To enable the new exit policy, operators must use `--with-exit-policy` flag or modify the `config.toml` file. | ✅ done |
+| **2.** The exit policy is part of the Gateway setup by default. To disable this exit policy, operators must use `--disable-exit-policy` flag. | 🛠️ in progress |
+| **3.** The exit policy is the only option. The `allowed.list` is completely removed. | 🛠️ in progress |
 
-Keep in mind this only relates to changes happening on Gateway and Network Requester side. Whether this will be optional or mandatory depends on the chosen [design](./smoosh-faq.md#what-does-it-mean-for-nym-nodes-operators).
+Keep in mind the table above only relates to changes happening on Gateways. For the Project Smoosh progress refer to the [table above](./smoosh-faq.md#what-are-the-changes). Whether Exit Gateway functionality will be optional or mandatory part of every active Nym Node depends on the chosen [design](./smoosh-faq.md#what-does-it-mean-for-nym-nodes-operators).
 
 ### Can I run a Mix Node only?
 

documentation/operators/src/nodes/maintenance.md

@@ -29,15 +29,14 @@ Follow these steps to upgrade your Node binary and update its config file:
     - if you run it as `systemd` service, run: `systemctl stop nym-<NODE>.service`
 * Replace the existing `<NODE>` binary with the newest binary (which you can either [compile yourself](https://nymtech.net/docs/binaries/building-nym.html) or grab from our [releases page](https://github.com/nymtech/nym/releases)).
 * Re-run `init` with the same values as you used initially for your `<NODE>` ([Mix Node](./mix-node-setup.md#initialising-your-mix-node), [Gateway](./gateway-setup.md#initialising-your-gateway)) . **This will just update the config file, it will not overwrite existing keys**.
-* Restart your node process with the new binary.
-    - if you automatized (recommended) run: 
+* Restart your node process with the new binary:
+    - if your node is not automitized, just `run` your `<NODE>` with `./nym-<NODE> run --id <ID>`. Here are exact guidelines for [Mix Node](./mix-node-setup.md#running-your-mix-node) and [Gateway](./gateway-setup.md#running-your-gateway). 
+    - if you automatized your node via systemd (recommended) run:  
 ```sh
 systemctl daemon-reload # to pickup the new unit file
 systemctl start nym-<NODE>.service
 journalctl -f -u <NODE>.service # to monitor log of you node
 ```
-    - if your node is not automitized, just `run` your `<NODE>` with `./nym-<NODE> run --id <ID>`. Here are exact guidelines for [Mix Node](./mix-node-setup.md#running-your-mix-node) and [Gateway](./gateway-setup.md#running-your-gateway). 
-
 
 If these steps are too difficult and you prefer to just run a script, you can use [ExploreNYM script](https://github.com/ExploreNYM/bash-tool) or one done by [Nym developers](https://gist.github.com/tommyv1987/4dca7cc175b70742c9ecb3d072eb8539).
 

ephemera/src/block/manager.rs

@@ -580,7 +580,9 @@ mod test {
     }
 
     #[tokio::test]
-    #[should_panic]
+    #[should_panic(
+        expected = "Received committed block which isn't last produced block, this is a bug!"
+    )]
     async fn test_on_committed_with_invalid_pending_block() {
         let (mut manager, _) = block_manager_with_defaults();
 

explorer/src/components/Footer.tsx

@@ -1,8 +1,11 @@
-import * as React from 'react';
+import React from 'react';
 import Box from '@mui/material/Box';
-import { Typography } from '@mui/material';
+import MuiLink from '@mui/material/Link';
+import { Link } from 'react-router-dom';
+import Typography from '@mui/material/Typography';
 import { Socials } from './Socials';
 import { useIsMobile } from '../hooks/useIsMobile';
+import { NymVpnIcon } from '../icons/NymVpn';
 
 export const Footer: FCWithChildren = () => {
   const isMobile = useIsMobile();
@@ -31,6 +34,9 @@ export const Footer: FCWithChildren = () => {
             mb: 2,
           }}
         >
+          <MuiLink component={Link} to="http://nymvpn.com" target="_blank" underline="none" marginRight={1}>
+            <NymVpnIcon />
+          </MuiLink>
           <Socials isFooter />
         </Box>
       )}

explorer/src/components/Nav.tsx

@@ -22,6 +22,7 @@ import { useMainContext } from '../context/main';
 import { MobileDrawerClose } from '../icons/MobileDrawerClose';
 import { Socials } from './Socials';
 import { Footer } from './Footer';
+import { NymVpnIcon } from '../icons/NymVpn';
 import { DarkLightSwitchDesktop } from './Switch';
 import { NavOptionType } from '../context/nav';
 
@@ -341,6 +342,9 @@ export const Nav: FCWithChildren = ({ children }) => {
                 alignItems: 'center',
               }}
             >
+              <MuiLink component={Link} to="http://nymvpn.com" target="_blank" underline="none" marginRight={1}>
+                <NymVpnIcon />
+              </MuiLink>
               <Socials />
               <DarkLightSwitchDesktop defaultChecked />
             </Box>

explorer/src/icons/NymVpn.tsx

@@ -0,0 +1,56 @@
+import * as React from 'react';
+
+interface DiscordIconProps {
+  size?: { width: number; height: number };
+}
+
+export const NymVpnIcon: FCWithChildren<DiscordIconProps> = ({ size }) => (
+  <svg width={size?.width} height={size?.height} viewBox="0 0 170 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path
+      d="M19.6118 0.128906H19.5405V0.187854V20.7961L10.7849 0.164277L10.773 0.128906H10.7255H5.75959H0.187819H0.128418V0.187854V23.8142V23.8732H0.187819H5.75959H5.81899V23.8142V3.17063L14.6103 23.8378L14.6222 23.8732H14.6697H19.6118H25.1717H25.2311V23.8142V0.187854V0.128906H25.1717H19.6118Z"
+      fill="white"
+    />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M19.4121 0H25.3603V24H14.5297L14.4901 23.8819L5.94824 3.80121V24H0V0H10.8663L10.906 0.118132L19.4121 20.1621V0ZM19.5409 20.7951L10.7853 0.163225L10.7734 0.127854H0.128835V23.8721H5.81941V3.16958L14.6107 23.8368L14.6226 23.8721H25.2315V0.127854H19.5409V20.7951Z"
+      fill="white"
+    />
+    <path
+      d="M89.8116 0.128906H79.1908H79.1314L79.1195 0.176068L73.6784 20.8904L68.2255 0.176068L68.2136 0.128906H68.1661H57.5215H57.4502V0.187854V23.8142V23.8732H57.5215H63.0814H63.1408V23.8142V3.33568L68.5225 23.826L68.5343 23.8732H68.5937H78.7394H78.7869L78.7988 23.826L84.1804 3.33568V23.8142V23.8732H84.2398H89.8116H89.871V23.8142V0.187854V0.128906H89.8116Z"
+      fill="white"
+    />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M79.0312 0H90.0003V24H84.052V4.33208L78.9242 23.856L78.9238 23.8572L78.8879 24H68.4342L68.3982 23.8572L68.3979 23.856L63.27 4.33208V24H57.3218V0H68.3146L68.3505 0.142699L68.3509 0.144015L73.6787 20.383L78.9949 0.144015L78.9953 0.142765L79.0312 0ZM73.6788 20.8894L68.2259 0.175015L68.214 0.127854H57.4506V23.8721H63.1412V3.33463L68.5229 23.825L68.5348 23.8721H78.7873L78.7992 23.825L84.1809 3.33463V23.8721H89.8714V0.127854H79.1318L79.1199 0.175015L73.6788 20.8894Z"
+      fill="white"
+    />
+    <path
+      d="M48.2909 0.128906H48.2553L48.2434 0.152487L41.4836 11.8124L34.6882 0.152487L34.6763 0.128906H34.6407H28.2135H28.0947L28.1541 0.223225L38.6205 18.2142V23.8142V23.8732H38.6799H44.2517H44.3111V23.8142V18.2142L54.7775 0.223225L54.8369 0.128906H54.7181H48.2909Z"
+      fill="white"
+    />
+    <path
+      fillRule="evenodd"
+      clipRule="evenodd"
+      d="M48.1757 0H55.0693L54.8879 0.288036L44.4399 18.2474V24H38.4917V18.2474L28.0437 0.288036L27.8623 0H34.756L34.8017 0.0907854L41.4833 11.5555L48.1299 0.0909153L48.1757 0ZM48.2434 0.151434L41.4836 11.8114L34.6882 0.151434L34.6763 0.127854H28.0948L28.1542 0.222173L38.6205 18.2131V23.8721H44.3111V18.2131L54.7775 0.222173L54.8369 0.127854H48.2553L48.2434 0.151434Z"
+      fill="white"
+    />
+    <path
+      d="M169.238 0V24H166.422C166.006 24 165.654 23.9341 165.366 23.8023C165.088 23.6596 164.811 23.418 164.534 23.0776L153.542 8.76321C153.584 9.19149 153.611 9.60878 153.622 10.0151C153.643 10.4104 153.654 10.7838 153.654 11.1352V24H148.886V0H151.734C151.968 0 152.166 0.0109813 152.326 0.032944C152.486 0.0549066 152.63 0.0988326 152.758 0.164722C152.886 0.219629 153.008 0.30199 153.126 0.411805C153.243 0.521619 153.376 0.669869 153.526 0.856553L164.614 15.2697C164.56 14.8085 164.523 14.3638 164.502 13.9355C164.48 13.4962 164.47 13.0844 164.47 12.7001V0H169.238Z"
+      fill="#A8A6A6"
+    />
+    <path
+      d="M134.206 11.7776C135.614 11.7776 136.627 11.4317 137.246 10.7399C137.865 10.048 138.174 9.08167 138.174 7.84077C138.174 7.29169 138.094 6.79204 137.934 6.3418C137.774 5.89156 137.529 5.50721 137.198 5.18874C136.878 4.8593 136.467 4.60673 135.966 4.43102C135.475 4.25532 134.889 4.16747 134.206 4.16747H131.39V11.7776H134.206ZM134.206 0C135.849 0 137.257 0.203157 138.43 0.609471C139.614 1.0048 140.585 1.55388 141.342 2.25669C142.11 2.95951 142.675 3.78861 143.038 4.74399C143.401 5.69938 143.582 6.73164 143.582 7.84077C143.582 9.03775 143.395 10.1359 143.022 11.1352C142.649 12.1345 142.078 12.9911 141.31 13.7049C140.542 14.4187 139.566 14.9787 138.382 15.385C137.209 15.7804 135.817 15.978 134.206 15.978H131.39V24H125.982V0H134.206Z"
+      fill="#A8A6A6"
+    />
+    <path
+      d="M121.584 0L112.24 24H107.344L98 0H102.352C102.821 0 103.2 0.115305 103.488 0.345915C103.776 0.565545 103.995 0.851064 104.144 1.20247L108.656 14.0508C108.869 14.6108 109.077 15.2258 109.28 15.8957C109.483 16.5546 109.675 17.2464 109.856 17.9712C110.005 17.2464 110.171 16.5546 110.352 15.8957C110.544 15.2258 110.747 14.6108 110.96 14.0508L115.44 1.20247C115.557 0.894989 115.765 0.620452 116.064 0.378861C116.373 0.126287 116.752 0 117.2 0H121.584Z"
+      fill="#A8A6A6"
+    />
+  </svg>
+);
+
+NymVpnIcon.defaultProps = {
+  size: { width: 80, height: 12 },
+};

gateway/src/http/mod.rs

@@ -229,14 +229,14 @@ impl<'a> HttpApiBuilder<'a> {
             IpAddr::from(Ipv4Addr::new(10, 1, 0, 0)),
             self.gateway_config.wireguard.private_network_prefix,
         )?;
-        let wg_state = self.client_registry.map(|client_registry| {
+        let wg_state = self.client_registry.and_then(|client_registry| {
             WireguardAppState::new(
-                self.sphinx_keypair,
                 client_registry,
                 Default::default(),
                 self.gateway_config.wireguard.bind_address.port(),
                 wireguard_private_network,
             )
+            .ok()
         });
 
         let router = nym_node::http::NymNodeRouter::new(config, wg_state);

mixnode/Cargo.toml

@@ -81,3 +81,8 @@ cpucycles = [
     "opentelemetry",
     "nym-bin-common/tracing",
 ]
+
+[package.metadata.deb]
+name = "nym-mixnode"
+maintainer-scripts = "debian"
+systemd-units = { enable = false }

mixnode/debian/postinst

@@ -0,0 +1,6 @@
+#DEBHELPER#
+
+useradd nym
+mkdir -p /etc/nym
+chown -R nym /etc/nym
+su nym -c 'NYM_HOME_DIR=/etc/nym nym-mixnode init --host 0.0.0.0 --id nym-mixnode'

mixnode/debian/service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Nym Mixnode
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/nym-mixnode run --id nym-mixnode
+User=nym
+Environment="NYM_HOME_DIR=/etc/nym"
+
+[Install]
+WantedBy=multi-user.target

nym-node/Cargo.toml

@@ -50,6 +50,7 @@ nym-config = { path = "../common/config" }
 nym-crypto = { path = "../common/crypto", features = ["asymmetric" ]}
 nym-node-requests = { path = "nym-node-requests", default-features = false, features = ["openapi"]}
 nym-task = { path = "../common/task" }
+nym-wireguard = { path = "../common/wireguard" }
 nym-wireguard-types = { path = "../common/wireguard-types", features = ["verify"] }
 
 [dev-dependencies]

nym-node/src/error.rs

@@ -31,6 +31,12 @@ pub enum NymNodeError {
         source: WireguardError,
     },
 
+    #[error(transparent)]
+    KeyRecoveryError {
+        #[from]
+        source: nym_crypto::asymmetric::encryption::KeyRecoveryError,
+    },
+
     #[error("unimplemented")]
     Unimplemented,
 }

nym-node/src/http/router/api/v1/gateway/client_interfaces/wireguard/client_registry.rs

@@ -31,10 +31,7 @@ async fn process_final_message(
         }
     };
 
-    if client
-        .verify(state.dh_keypair.private_key(), preshared_nonce)
-        .is_ok()
-    {
+    if client.verify(&state.private_key, preshared_nonce).is_ok() {
         state.registration_in_progress.remove(&client.pub_key());
         state.client_registry.insert(client.pub_key(), client);
 
@@ -104,7 +101,7 @@ pub(crate) async fn register_client(
             // mark it as used, even though it's not final
             *private_ip_ref = false;
             let gateway_data = GatewayClient::new(
-                state.dh_keypair.private_key(),
+                &state.private_key,
                 remote_public,
                 *private_ip_ref.key(),
                 nonce,

nym-node/src/http/router/api/v1/gateway/client_interfaces/wireguard/mod.rs

@@ -8,8 +8,9 @@ use crate::wireguard::types::{GatewayClientRegistry, PendingRegistrations};
 use axum::routing::{get, post};
 use axum::Router;
 use ipnetwork::IpNetwork;
-use nym_crypto::asymmetric::encryption;
+use nym_crypto::asymmetric::encryption::PrivateKey;
 use nym_node_requests::routes::api::v1::gateway::client_interfaces::wireguard;
+use nym_wireguard::setup;
 use nym_wireguard_types::registration::PrivateIPs;
 use std::sync::Arc;
 
@@ -24,15 +25,16 @@ pub struct WireguardAppState {
 
 impl WireguardAppState {
     pub fn new(
-        dh_keypair: Arc<encryption::KeyPair>,
         client_registry: Arc<GatewayClientRegistry>,
         registration_in_progress: Arc<PendingRegistrations>,
         binding_port: u16,
         private_ip_network: IpNetwork,
-    ) -> Self {
-        WireguardAppState {
+    ) -> Result<Self, crate::error::NymNodeError> {
+        Ok(WireguardAppState {
             inner: Some(WireguardAppStateInner {
-                dh_keypair,
+                private_key: Arc::new(PrivateKey::from_bytes(
+                    setup::server_static_private_key().as_ref(),
+                )?),
                 client_registry,
                 registration_in_progress,
                 binding_port,
@@ -40,7 +42,7 @@ impl WireguardAppState {
                     private_ip_network.iter().map(|ip| (ip, true)).collect(),
                 ),
             }),
-        }
+        })
     }
 
     // #[allow(dead_code)]
@@ -79,7 +81,7 @@ macro_rules! get_state {
 
 #[derive(Clone)]
 pub(crate) struct WireguardAppStateInner {
-    dh_keypair: Arc<encryption::KeyPair>,
+    private_key: Arc<PrivateKey>,
     client_registry: Arc<GatewayClientRegistry>,
     registration_in_progress: Arc<PendingRegistrations>,
     binding_port: u16,
@@ -112,6 +114,7 @@ mod test {
         PeerPublicKey,
     };
     use nym_node_requests::routes::api::v1::gateway::client_interfaces::wireguard;
+    use nym_wireguard::setup::server_static_private_key;
     use nym_wireguard_types::registration::HmacSha256;
     use std::net::IpAddr;
     use std::str::FromStr;
@@ -130,8 +133,15 @@ mod test {
         // 6. Gateway verifies mac digest and nonce, and stores client's public key and socket address and port
 
         let mut rng = rand::thread_rng();
+        let gateway_private_key =
+            encryption::PrivateKey::from_bytes(server_static_private_key().as_bytes()).unwrap();
+        let gateway_public_key = encryption::PublicKey::from(&gateway_private_key);
 
-        let gateway_key_pair = encryption::KeyPair::new(&mut rng);
+        let gateway_key_pair = encryption::KeyPair::from_bytes(
+            &gateway_private_key.to_bytes(),
+            &gateway_public_key.to_bytes(),
+        )
+        .unwrap();
         let client_key_pair = encryption::KeyPair::new(&mut rng);
 
         let gateway_static_public =
@@ -158,7 +168,7 @@ mod test {
         let state = WireguardAppState {
             inner: Some(WireguardAppStateInner {
                 client_registry: Arc::clone(&client_registry),
-                dh_keypair: Arc::new(gateway_key_pair),
+                private_key: Arc::new(gateway_private_key),
                 registration_in_progress: Arc::clone(&registration_in_progress),
                 binding_port: 8080,
                 free_private_network_ips,

sdk/lib/socks5-listener/Cargo.toml

@@ -28,7 +28,7 @@ tokio = { workspace = true, features = ["sync", "time"] }
 log = "0.4.17"
 rand = "0.7.3"
 
-safer-ffi = { version = "0.1.0-rc1" }
+safer-ffi = { version = "0.1.4" }
 
 [target.'cfg(target_os="android")'.dependencies]
 jni = { version = "0.21", default-features = false }

service-providers/ip-packet-router/Cargo.toml

@@ -9,18 +9,25 @@ edition.workspace = true
 license.workspace = true
 
 [dependencies]
+bincode = "1.3.3"
+bytes = "1.5.0"
 etherparse = "0.13.0"
 futures = { workspace = true }
 log = { workspace = true }
 nym-bin-common = { path = "../../common/bin-common" }
 nym-client-core = { path = "../../common/client-core" }
 nym-config = { path = "../../common/config" }
+nym-exit-policy = { path = "../../common/exit-policy" }
+nym-ip-packet-requests = { path = "../../common/ip-packet-requests" }
+nym-network-requester = { path = "../network-requester" }
 nym-sdk = { path = "../../sdk/rust/nym-sdk" }
 nym-service-providers-common = { path = "../common" }
 nym-sphinx = { path = "../../common/nymsphinx" }
 nym-task = { path = "../../common/task" }
+nym-tun = { path = "../../common/tun" }
 nym-wireguard = { path = "../../common/wireguard" }
 nym-wireguard-types = { path = "../../common/wireguard-types" }
+reqwest.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tap.workspace = true

service-providers/ip-packet-router/src/error.rs

@@ -1,4 +1,7 @@
+use std::net::SocketAddr;
+
 pub use nym_client_core::error::ClientCoreError;
+use nym_exit_policy::PolicyError;
 
 #[derive(thiserror::Error, Debug)]
 pub enum IpPacketRouterError {
@@ -27,9 +30,41 @@ pub enum IpPacketRouterError {
     #[error("the entity wrapping the network requester has disconnected")]
     DisconnectedParent,
 
+    #[error("failed to deserialize tagged packet: {source}")]
+    FailedToDeserializeTaggedPacket { source: bincode::Error },
+
     #[error("failed to parse incoming packet: {source}")]
     PacketParseFailed { source: etherparse::ReadError },
 
     #[error("parsed packet is missing IP header")]
-    PacketMissingHeader,
+    PacketMissingIpHeader,
+
+    #[error("parsed packet is missing transport header")]
+    PacketMissingTransportHeader,
+
+    #[error("failed to send packet to tun device: {source}")]
+    FailedToSendPacketToTun {
+        source: tokio::sync::mpsc::error::TrySendError<(u64, Vec<u8>)>,
+    },
+
+    #[error("the provided socket address, '{addr}' is not covered by the exit policy!")]
+    AddressNotCoveredByExitPolicy { addr: SocketAddr },
+
+    #[error("failed filter check: '{addr}'")]
+    AddressFailedFilterCheck { addr: SocketAddr },
+
+    #[error("failed to apply the exit policy: {source}")]
+    ExitPolicyFailure {
+        #[from]
+        source: PolicyError,
+    },
+
+    #[error("the url provided for the upstream exit policy source is malformed: {source}")]
+    MalformedExitPolicyUpstreamUrl {
+        #[source]
+        source: reqwest::Error,
+    },
+
+    #[error("can't setup an exit policy without any upstream urls")]
+    NoUpstreamExitPolicy,
 }

service-providers/ip-packet-router/src/lib.rs

@@ -1,4 +1,9 @@
-use std::{net::IpAddr, path::Path};
+#![cfg_attr(not(target_os = "linux"), allow(dead_code))]
+
+use std::{
+    net::{IpAddr, SocketAddr},
+    path::Path,
+};
 
 use error::IpPacketRouterError;
 use futures::{channel::oneshot, StreamExt};
@@ -12,7 +17,7 @@ use nym_sdk::{
 };
 use nym_sphinx::receiver::ReconstructedMessage;
 use nym_task::{connections::TransmissionLane, TaskClient, TaskHandle};
-use tap::TapFallible;
+use request_filter::RequestFilter;
 
 use crate::config::BaseClientConfig;
 
@@ -20,6 +25,7 @@ pub use crate::config::Config;
 
 pub mod config;
 pub mod error;
+mod request_filter;
 
 // The interface used to route traffic
 pub const TUN_BASE_NAME: &str = "nymtun";
@@ -29,11 +35,16 @@ pub const TUN_DEVICE_NETMASK: &str = "255.255.255.0";
 pub struct OnStartData {
     // to add more fields as required
     pub address: Recipient,
+
+    pub request_filter: RequestFilter,
 }
 
 impl OnStartData {
-    pub fn new(address: Recipient) -> Self {
-        Self { address }
+    pub fn new(address: Recipient, request_filter: RequestFilter) -> Self {
+        Self {
+            address,
+            request_filter,
+        }
     }
 }
 
@@ -128,20 +139,23 @@ impl IpPacketRouterBuilder {
         let self_address = *mixnet_client.nym_address();
 
         // Create the TUN device that we interact with the rest of the world with
-        let config = nym_wireguard::tun_device::TunDeviceConfig {
+        let config = nym_tun::tun_device::TunDeviceConfig {
             base_name: TUN_BASE_NAME.to_string(),
             ip: TUN_DEVICE_ADDRESS.parse().unwrap(),
             netmask: TUN_DEVICE_NETMASK.parse().unwrap(),
         };
-        let (tun, tun_task_tx, tun_task_response_rx) = nym_wireguard::tun_device::TunDevice::new(
-            nym_wireguard::tun_device::RoutingMode::new_nat(),
+        let (tun, tun_task_tx, tun_task_response_rx) = nym_tun::tun_device::TunDevice::new(
+            nym_tun::tun_device::RoutingMode::new_nat(),
             config,
         );
         tun.start();
 
+        let request_filter = request_filter::RequestFilter::new(&self.config).await?;
+        request_filter.start_update_tasks().await;
+
         let ip_packet_router_service = IpPacketRouter {
             _config: self.config,
-            // tun,
+            request_filter: request_filter.clone(),
             tun_task_tx,
             tun_task_response_rx,
             mixnet_client,
@@ -152,7 +166,10 @@ impl IpPacketRouterBuilder {
         log::info!("All systems go. Press CTRL-C to stop the server.");
 
         if let Some(on_start) = self.on_start {
-            if on_start.send(OnStartData::new(self_address)).is_err() {
+            if on_start
+                .send(OnStartData::new(self_address, request_filter))
+                .is_err()
+            {
                 // the parent has dropped the channel before receiving the response
                 return Err(IpPacketRouterError::DisconnectedParent);
             }
@@ -165,9 +182,9 @@ impl IpPacketRouterBuilder {
 #[allow(unused)]
 struct IpPacketRouter {
     _config: Config,
-    // tun: nym_wireguard::tun_device::TunDevice,
-    tun_task_tx: nym_wireguard::tun_task_channel::TunTaskTx,
-    tun_task_response_rx: nym_wireguard::tun_task_channel::TunTaskResponseRx,
+    request_filter: request_filter::RequestFilter,
+    tun_task_tx: nym_tun::tun_task_channel::TunTaskTx,
+    tun_task_response_rx: nym_tun::tun_task_channel::TunTaskResponseRx,
     mixnet_client: nym_sdk::mixnet::MixnetClient,
     task_handle: TaskHandle,
 }
@@ -184,7 +201,9 @@ impl IpPacketRouter {
                 },
                 msg = self.mixnet_client.next() => {
                     if let Some(msg) = msg {
-                        self.on_message(msg).await.ok();
+                        if let Err(err) = self.on_message(msg).await {
+                            log::error!("Error handling mixnet message: {err}");
+                        };
                     } else {
                         log::trace!("IpPacketRouter [main loop]: stopping since channel closed");
                         break;
@@ -207,13 +226,9 @@ impl IpPacketRouter {
                             let packet_type = None;
                             let input_message = InputMessage::new_regular(recipient, packet, lane, packet_type);
 
-                            self.mixnet_client
-                                .send(input_message)
-                                .await
-                                .tap_err(|err| {
-                                    log::error!("IpPacketRouter [main loop]: failed to send packet to mixnet: {err}");
-                                })
-                                .ok();
+                            if let Err(err) = self.mixnet_client.send(input_message).await {
+                                log::error!("IpPacketRouter [main loop]: failed to send packet to mixnet: {err}");
+                            };
                         } else {
                             log::error!("NYM_CLIENT_ADDR not set or invalid");
                         }
@@ -233,43 +248,104 @@ impl IpPacketRouter {
         &mut self,
         reconstructed: ReconstructedMessage,
     ) -> Result<(), IpPacketRouterError> {
-        log::info!("Received message: {:?}", reconstructed.sender_tag);
+        log::debug!(
+            "Received message with sender_tag: {:?}",
+            reconstructed.sender_tag
+        );
 
-        let headers = etherparse::SlicedPacket::from_ip(&reconstructed.message).map_err(|err| {
-            log::warn!("Received non-IP packet: {err}");
-            IpPacketRouterError::PacketParseFailed { source: err }
-        })?;
+        let tagged_packet = nym_ip_packet_requests::TaggedIpPacket::from_message(&reconstructed)
+            .map_err(|err| IpPacketRouterError::FailedToDeserializeTaggedPacket { source: err })?;
 
-        let (src_addr, dst_addr): (IpAddr, IpAddr) = match headers.ip {
-            Some(etherparse::InternetSlice::Ipv4(ipv4_header, _)) => (
-                ipv4_header.source_addr().into(),
-                ipv4_header.destination_addr().into(),
-            ),
-            Some(etherparse::InternetSlice::Ipv6(ipv6_header, _)) => (
-                ipv6_header.source_addr().into(),
-                ipv6_header.destination_addr().into(),
-            ),
-            None => {
-                log::warn!("Received non-IP packet");
-                return Err(IpPacketRouterError::PacketMissingHeader);
+        // We don't forward packets that we are not able to parse. BUT, there might be a good
+        // reason to still forward them.
+        //
+        // For example, if we are running in a mode where we are only supposed to forward
+        // packets to a specific destination, we might want to forward them anyway.
+        //
+        // TODO: look into this
+        let ParsedPacket {
+            packet_type,
+            src_addr,
+            dst_addr,
+            dst,
+        } = parse_packet(&tagged_packet.packet)?;
+
+        let dst_str = dst.map_or(dst_addr.to_string(), |dst| dst.to_string());
+        log::info!("Received packet: {packet_type}: {src_addr} -> {dst_str}");
+
+        // Filter check
+        if let Some(dst) = dst {
+            if !self.request_filter.check_address(&dst).await {
+                log::warn!("Failed filter check: {dst}");
+                // TODO: we could consider sending back a response here
+                return Err(IpPacketRouterError::AddressFailedFilterCheck { addr: dst });
             }
-        };
-        log::info!("Received packet: {src_addr} -> {dst_addr}");
+        } else {
+            // TODO: we should also filter packets without port number
+            log::warn!("Ignoring filter check for packet without port number! TODO!");
+        }
 
         // TODO: set the tag correctly. Can we just reuse sender_tag?
         let peer_tag = 0;
         self.tun_task_tx
-            .send((peer_tag, reconstructed.message))
-            .await
-            .tap_err(|err| {
-                log::error!("Failed to send packet to tun device: {err}");
-            })
-            .ok();
+            .try_send((peer_tag, tagged_packet.packet.into()))
+            .map_err(|err| IpPacketRouterError::FailedToSendPacketToTun { source: err })?;
 
         Ok(())
     }
 }
 
+struct ParsedPacket<'a> {
+    packet_type: &'a str,
+    src_addr: IpAddr,
+    dst_addr: IpAddr,
+    dst: Option<SocketAddr>,
+}
+
+fn parse_packet(packet: &[u8]) -> Result<ParsedPacket, IpPacketRouterError> {
+    let headers = etherparse::SlicedPacket::from_ip(packet).map_err(|err| {
+        log::warn!("Unable to parse incoming data as IP packet: {err}");
+        IpPacketRouterError::PacketParseFailed { source: err }
+    })?;
+
+    let (packet_type, dst_port) = match headers.transport {
+        Some(etherparse::TransportSlice::Udp(header)) => ("ipv4", Some(header.destination_port())),
+        Some(etherparse::TransportSlice::Tcp(header)) => ("ipv6", Some(header.destination_port())),
+        Some(etherparse::TransportSlice::Icmpv4(_)) => ("icmpv4", None),
+        Some(etherparse::TransportSlice::Icmpv6(_)) => ("icmpv6", None),
+        Some(etherparse::TransportSlice::Unknown(_)) => ("unknown", None),
+        None => {
+            log::warn!("Received packet missing transport header");
+            return Err(IpPacketRouterError::PacketMissingTransportHeader);
+        }
+    };
+
+    let (src_addr, dst_addr, dst) = match headers.ip {
+        Some(etherparse::InternetSlice::Ipv4(ipv4_header, _)) => {
+            let src_addr: IpAddr = ipv4_header.source_addr().into();
+            let dst_addr: IpAddr = ipv4_header.destination_addr().into();
+            let dst = dst_port.map(|port| SocketAddr::new(dst_addr, port));
+            (src_addr, dst_addr, dst)
+        }
+        Some(etherparse::InternetSlice::Ipv6(ipv6_header, _)) => {
+            let src_addr: IpAddr = ipv6_header.source_addr().into();
+            let dst_addr: IpAddr = ipv6_header.destination_addr().into();
+            let dst = dst_port.map(|port| SocketAddr::new(dst_addr, port));
+            (src_addr, dst_addr, dst)
+        }
+        None => {
+            log::warn!("Received packet missing IP header");
+            return Err(IpPacketRouterError::PacketMissingIpHeader);
+        }
+    };
+    Ok(ParsedPacket {
+        packet_type,
+        src_addr,
+        dst_addr,
+        dst,
+    })
+}
+
 // Helper function to create the mixnet client.
 // This is NOT in the SDK since we don't want to expose any of the client-core config types.
 // We could however consider moving it to a crate in common in the future.

service-providers/ip-packet-router/src/request_filter/exit_policy/mod.rs

@@ -0,0 +1,50 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use std::net::SocketAddr;
+
+use crate::error::IpPacketRouterError;
+use nym_exit_policy::client::get_exit_policy;
+use nym_exit_policy::ExitPolicy;
+use reqwest::IntoUrl;
+use url::Url;
+
+pub struct ExitPolicyRequestFilter {
+    upstream: Option<Url>,
+    policy: ExitPolicy,
+}
+
+impl ExitPolicyRequestFilter {
+    pub(crate) async fn new_upstream(url: impl IntoUrl) -> Result<Self, IpPacketRouterError> {
+        let url = url
+            .into_url()
+            .map_err(|source| IpPacketRouterError::MalformedExitPolicyUpstreamUrl { source })?;
+
+        Ok(ExitPolicyRequestFilter {
+            upstream: Some(url.clone()),
+            policy: get_exit_policy(url).await?,
+        })
+    }
+
+    #[allow(unused)]
+    pub(crate) fn new(policy: ExitPolicy) -> Self {
+        ExitPolicyRequestFilter {
+            upstream: None,
+            policy,
+        }
+    }
+
+    pub fn policy(&self) -> &ExitPolicy {
+        &self.policy
+    }
+
+    pub fn upstream(&self) -> Option<&Url> {
+        self.upstream.as_ref()
+    }
+
+    pub(crate) async fn check(&self, addr: &SocketAddr) -> Result<bool, IpPacketRouterError> {
+        self.policy
+            .allows_sockaddr(addr)
+            .ok_or(IpPacketRouterError::AddressNotCoveredByExitPolicy { addr: *addr })
+    }
+}

service-providers/ip-packet-router/src/request_filter/mod.rs

@@ -0,0 +1,68 @@
+// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::config::Config;
+use crate::error::IpPacketRouterError;
+use crate::request_filter::exit_policy::ExitPolicyRequestFilter;
+use log::{info, warn};
+use std::{net::SocketAddr, sync::Arc};
+
+pub mod exit_policy;
+
+enum RequestFilterInner {
+    ExitPolicy {
+        policy_filter: ExitPolicyRequestFilter,
+    },
+}
+
+#[derive(Clone)]
+pub struct RequestFilter {
+    inner: Arc<RequestFilterInner>,
+}
+
+impl RequestFilter {
+    pub(crate) async fn new(config: &Config) -> Result<Self, IpPacketRouterError> {
+        info!("setting up ExitPolicy based request filter...");
+        Self::new_exit_policy_filter(config).await
+    }
+
+    pub fn current_exit_policy_filter(&self) -> Option<&ExitPolicyRequestFilter> {
+        match &*self.inner {
+            RequestFilterInner::ExitPolicy { policy_filter } => Some(policy_filter),
+        }
+    }
+
+    pub(crate) async fn start_update_tasks(&self) {
+        match &*self.inner {
+            RequestFilterInner::ExitPolicy { .. } => {
+                // nothing to do for the exit policy (yet; we might add a refresher at some point)
+            }
+        }
+    }
+
+    async fn new_exit_policy_filter(config: &Config) -> Result<Self, IpPacketRouterError> {
+        let upstream_url = config
+            .ip_packet_router
+            .upstream_exit_policy_url
+            .as_ref()
+            .ok_or(IpPacketRouterError::NoUpstreamExitPolicy)?;
+        let policy_filter = ExitPolicyRequestFilter::new_upstream(upstream_url.clone()).await?;
+        Ok(RequestFilter {
+            inner: Arc::new(RequestFilterInner::ExitPolicy { policy_filter }),
+        })
+    }
+
+    pub(crate) async fn check_address(&self, address: &SocketAddr) -> bool {
+        match &*self.inner {
+            RequestFilterInner::ExitPolicy { policy_filter } => {
+                match policy_filter.check(address).await {
+                    Err(err) => {
+                        warn!("failed to validate '{address}' against the exit policy: {err}");
+                        false
+                    }
+                    Ok(res) => res,
+                }
+            }
+        }
+    }
+}