Add FixMatomoProvider

.github/workflows/cd-docs.yml

@@ -1,15 +1,17 @@
-name: cd-docs
+name: CD docs
 
 on:
   workflow_dispatch:
+  push:
+    branches: master
+    paths:
+      - 'documentation/docs/**'
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: custom-linux
     steps:
       - uses: actions/checkout@v3
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -24,16 +26,43 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false
+          args: --workspace --release --all
+      - name: Install mdbook
+        run: (test -x $HOME/.cargo/bin/mdbook || cargo install --vers "^0.4.33" mdbook)
+      - name: Install mdbook plugins
+        run: |
+          cargo install --vers "=0.2.2" mdbook-variables && cargo install \
+            --vers "^1.8.0" mdbook-admonish && cargo install --vers \
+            "^0.1.2" mdbook-last-changed && cargo install --vers "^0.1.2" mdbook-theme \
+            && cargo install --vers "^0.7.7" mdbook-linkcheck
       - name: Build all projects in documentation/ & move to ~/dist/docs/
         run: cd documentation && ./build_all_to_dist.sh
         continue-on-error: false
 
+      - name: Deploy branch master to dev
+        continue-on-error: true
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CD_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-rltgoDzvO --delete"
+          SOURCE: "dist/docs/"
+          REMOTE_HOST: ${{ secrets.CD_WWW_REMOTE_HOST_DEV }}
+          REMOTE_USER: ${{ secrets.CD_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CD_WWW_REMOTE_TARGET }}/
+          EXCLUDE: "/node_modules/"
+
+      - name: Deploy branch master to prod
+        if: github.ref == 'refs/heads/master'
+        uses: easingthemes/ssh-deploy@main
+        env:
+          SSH_PRIVATE_KEY: ${{ secrets.CD_WWW_SSH_PRIVATE_KEY }}
+          ARGS: "-rltgoDzvO --delete"
+          SOURCE: "dist/docs/"
+          REMOTE_HOST: ${{ secrets.CD_WWW_REMOTE_HOST_PROD }}
+          REMOTE_USER: ${{ secrets.CD_WWW_REMOTE_USER }}
+          TARGET: ${{ secrets.CD_WWW_REMOTE_TARGET }}/
+          EXCLUDE: "/node_modules/"
+
       - name: Post process
         run: cd documentation && ./post_process.sh
         continue-on-error: false
@@ -48,7 +77,6 @@ jobs:
 
       - name: Install Vercel CLI
         run: npm install --global vercel@latest
-        continue-on-error: false
 
       - name: Pull Vercel Environment Information (preview)
         if: github.ref != 'refs/heads/master'
@@ -58,18 +86,15 @@ jobs:
         if: github.ref == 'refs/heads/master'
         run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }}
         working-directory: dist/docs
-        continue-on-error: false
 
       - name: Build Project Artifacts (preview)
         if: github.ref != 'refs/heads/master'
         run: vercel build --token=${{ secrets.VERCEL_TOKEN }}
         working-directory: dist/docs
-        continue-on-error: false
       - name: Build Project Artifacts (production)
         if: github.ref == 'refs/heads/master'
         run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }}
         working-directory: dist/docs
-        continue-on-error: false
 
       - name: Deploy Project Artifacts to Vercel (preview)
         if: github.ref != 'refs/heads/master'
@@ -79,7 +104,6 @@ jobs:
         if: github.ref == 'refs/heads/master'
         run: vercel deploy --prebuilt --prod --token=${{ secrets.VERCEL_TOKEN }}
         working-directory: dist/docs
-        continue-on-error: false
 
       - name: Matrix - Node Install
         run: npm install

.github/workflows/ci-binary-checker.yml

@@ -1,4 +1,4 @@
-name: ci-binary-config-checker
+name: Run config checks on all binaries
 
 on:
   workflow_dispatch:

.github/workflows/ci-contracts-upload-binaries.yml

@@ -35,14 +35,14 @@ jobs:
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
-          toolchain: stable
+          toolchain: 1.69.0
           target: wasm32-unknown-unknown
           override: true
 
       - name: Install wasm-opt
         uses: ./.github/actions/install-wasm-opt
         with:
-          version: '114'
+          version: '112'
 
       - name: Build release contracts
         run: make contracts

.github/workflows/ci-docs.yml

@@ -9,11 +9,9 @@ on:
 
 jobs:
   build:
-    runs-on: ubuntu-20.04-16-core
+    runs-on: custom-linux
     steps:
       - uses: actions/checkout@v3
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
       - name: Install rsync
         run: sudo apt-get install rsync
       - uses: rlespinasse/github-slug-action@v3.x
@@ -28,16 +26,23 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: --workspace --release
-      - name: Install mdbook and plugins
-        run: cd documentation && ./install_mdbook_deps.sh
-      - name: Remove existing Nym config directory (`~/.nym/`)
-        run: cd documentation && ./remove_existing_config.sh
-        continue-on-error: false
-      - name: Build all projects in documentation/ & move to ~/dist/docs/
-        run: cd documentation && ./build_all_to_dist.sh
-        continue-on-error: false
+          args: --workspace --release --all
+      - name: Install mdbook
+        run: (test -x $HOME/.cargo/bin/mdbook || cargo install --vers "^0.4.35" mdbook)
+      - name: Install mdbook plugins
+        run: |
+          cargo install --vers "=0.2.2" mdbook-variables && cargo install \
+            --vers "^1.8.0" mdbook-admonish --force && cargo install --vers \
+            "^0.1.2" mdbook-last-changed && cargo install --vers "^0.1.2" mdbook-theme \
+            && cargo install --vers "^0.7.7" mdbook-linkcheck \
+            # && cd documentation \
+            # && mdbook-admonish install dev-portal \
+            # && mdbook-admonish install docs \
+            # && mdbook-admonish install operators
 
+      - name: Build all projects in documentation/ & move to ~/dist/docs/
+        run: cd documentation && ./build_all_to_dist.sh 
+        continue-on-error: false
       - name: Deploy branch to CI www
         continue-on-error: true
         uses: easingthemes/ssh-deploy@main
@@ -49,7 +54,6 @@ jobs:
           REMOTE_USER: ${{ secrets.CI_WWW_REMOTE_USER }}
           TARGET: ${{ secrets.CI_WWW_REMOTE_TARGET }}/docs-${{ env.GITHUB_REF_SLUG }}
           EXCLUDE: "/node_modules/"
-
       - name: Matrix - Node Install
         run: npm install
         working-directory: .github/workflows/support-files

.github/workflows/ci-nym-api-tests.yml

@@ -1,4 +1,4 @@
-name: ci-nym-api-tests
+name: CI for Nym API Tests
 
 on:
   workflow_dispatch:
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-
+      
       - name: Install npm
         run: npm install
-
+        
       - name: Node v18
         uses: actions/setup-node@v3
         with:

.github/workflows/ci-nym-connect-desktop-rust.yml

@@ -33,12 +33,6 @@ jobs:
           override: true
           components: rustfmt, clippy
 
-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: --manifest-path nym-connect/desktop/Cargo.toml --all -- --check
-
       - name: Build all binaries
         uses: actions-rs/cargo@v1
         with:
@@ -51,6 +45,12 @@ jobs:
           command: test
           args: --manifest-path nym-connect/desktop/Cargo.toml --workspace
 
+      - name: Check formatting
+        uses: actions-rs/cargo@v1
+        with:
+          command: fmt
+          args: --manifest-path nym-connect/desktop/Cargo.toml --all -- --check
+
       - uses: actions-rs/clippy-check@v1
         name: Clippy checks
         continue-on-error: true

.github/workflows/ci-nym-vpn-ui-js.yml

@@ -1,7 +1,11 @@
 name: ci-nym-vpn-ui-js
 
 on:
-  workflow_dispatch:
+  push:
+    paths:
+      - 'nym-vpn/ui/src/**'
+      - 'nym-vpn/ui/package.json'
+      - 'nym-vpn/ui/index.html'
   pull_request:
     paths:
       - 'nym-vpn/ui/src/**'
@@ -10,7 +14,7 @@ on:
 
 jobs:
   check:
-    runs-on: custom-linux
+    runs-on: [ self-hosted, custom-linux ]
     steps:
       - name: Checkout
         uses: actions/checkout@v4

.github/workflows/ci-nym-vpn-ui-rust.yml

@@ -1,14 +1,16 @@
 name: ci-nym-vpn-ui-rust
 
 on:
-  workflow_dispatch:
+  push:
+    paths:
+      - 'nym-vpn/ui/src-tauri/**'
   pull_request:
     paths:
       - 'nym-vpn/ui/src-tauri/**'
 
 jobs:
   build:
-    runs-on: custom-linux
+    runs-on: [self-hosted, custom-linux]
     env:
       CARGO_TERM_COLOR: always
       CARGOTOML_PATH: ./nym-vpn/ui/src-tauri/Cargo.toml
@@ -29,19 +31,18 @@ jobs:
           components: rustfmt, clippy
 
       - name: Prepare build
-        run: mkdir nym-vpn/ui/dist
+        working-directory: nym-vpn/ui/
+        run: mkdir dist
 
-      - name: Build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --features custom-protocol
+      - name: Check build
+        working-directory: nym-vpn/ui/src-tauri
+        run: cargo build --release --lib --features custom-protocol
 
 #      - name: Run all tests
 #        uses: actions-rs/cargo@v1
 #        with:
 #          command: test
-#          args: --manifest-path ${{ env.CARGOTOML_PATH }}
+#          args: --manifest-path ${{ env.CARGOTOML_PATH }} --workspace
 
       - name: Check formatting
         uses: actions-rs/cargo@v1
@@ -49,15 +50,15 @@ jobs:
           command: fmt
           args: --manifest-path ${{ env.CARGOTOML_PATH }} --all -- --check
 
-      - name: Annotate with clippy checks
-        uses: actions-rs/clippy-check@v1
+      - uses: actions-rs/clippy-check@v1
+        name: Clippy checks
         continue-on-error: true
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all-features
+          args: --manifest-path ${{ env.CARGOTOML_PATH }} --workspace --all-features
 
-      - name: Clippy
+      - name: Run clippy
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: --manifest-path ${{ env.CARGOTOML_PATH }} --all-features --all-targets -- -D warnings
+          args: --manifest-path ${{ env.CARGOTOML_PATH }} --workspace --all-features -- -D warnings

.github/workflows/deploy-github-pages.yml

@@ -1,43 +0,0 @@
-# Simple workflow for deploying static content to GitHub Pages
-name: Deploy static content to Pages
-
-on:
-  # Runs on pushes targeting the default branch
-  push:
-    branches: ["feature/ppa-repo"]
-
-  # Allows you to run this workflow manually from the Actions tab
-  workflow_dispatch:
-
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
-  contents: read
-  pages: write
-  id-token: write
-
-# Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
-# However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
-concurrency:
-  group: "pages"
-  cancel-in-progress: false
-
-jobs:
-  # Single deploy job since we're just deploying
-  deploy:
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v3
-      - name: Setup Pages
-        uses: actions/configure-pages@v3
-      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v2
-        with:
-          # Upload entire repository
-          path: './ppa'
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v2

.github/workflows/nightly-build.yml

@@ -4,25 +4,25 @@ on:
   workflow_dispatch:
   schedule:
     - cron: '14 1 * * *'
-
 jobs:
   build:
     strategy:
       fail-fast: false
       matrix:
         rust: [stable, beta]
-        os: [ubuntu-20.04, windows-latest, macos-latest]
+        os: [custom-linux, windows10, custom-runner-mac-m1]
     runs-on: ${{ matrix.os }}
     env:
       CARGO_TERM_COLOR: always
     continue-on-error: true
     steps:
-      - name: Check out repository code
-        uses: actions/checkout@v3
-
       - name: Install Dependencies (Linux)
         run: sudo apt-get update && sudo apt-get install -y build-essential curl wget libssl-dev libudev-dev squashfs-tools protobuf-compiler
-        if: matrix.os == 'ubuntu-20.04'
+        continue-on-error: true
+        if: matrix.os == 'custom-linux'
+
+      - name: Check out repository code
+        uses: actions/checkout@v3
 
       - name: Install Rust toolchain
         uses: actions-rs/toolchain@v1
@@ -32,12 +32,6 @@ jobs:
           override: true
           components: rustfmt, clippy
 
-      - name: Install Protoc
-        uses: arduino/setup-protoc@v2
-        if: matrix.os == 'macos-latest' || matrix.os == 'windows-latest'
-        with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Check formatting
         uses: actions-rs/cargo@v1
         with:
@@ -48,27 +42,13 @@ jobs:
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: --release --workspace
+          args: --workspace
 
       - name: Build examples
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: --release --workspace --examples
-
-      # To avoid running out of disk space, skip generating debug symbols
-      - name: Set debug to false (unix)
-        if: matrix.os == 'ubuntu-20.04' || matrix.os == 'macos-latest'
-        run: |
-          sed -i.bak 's/\[profile.dev\]/\[profile.dev\]\ndebug = false/' Cargo.toml
-          git diff
-
-      - name: Set debug to false (win)
-        if: matrix.os == 'windows-latest'
-        shell: pwsh
-        run: |
-          (Get-Content Cargo.toml) -replace '\[profile.dev\]', "`$&`ndebug = false" | Set-Content Cargo.toml
-          git diff
+          args: --workspace --examples
 
       - name: Run unit tests
         uses: actions-rs/cargo@v1
@@ -82,11 +62,6 @@ jobs:
           command: test
           args: --workspace -- --ignored
 
-      - name: Clean
-        uses: actions-rs/cargo@v1
-        with:
-          command: clean
-
       - name: Clippy
         uses: actions-rs/cargo@v1
         with:

.github/workflows/nightly-nym-connect-desktop-build.yml

@@ -1,92 +0,0 @@
-name: nightly-nym-connect-desktop-build
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: '14 1 * * *'
-
-jobs:
-  build:
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [ubuntu-20.04, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    env:
-      CARGO_TERM_COLOR: always
-      MANIFEST_PATH: --manifest-path nym-connect/desktop/Cargo.toml
-    continue-on-error: true
-    steps:
-      - name: Check out repository code
-        uses: actions/checkout@v3
-
-      - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
-        if: matrix.os == 'ubuntu-20.04'
-
-      - name: Install rust toolchain
-        uses: actions-rs/toolchain@v1
-        with:
-          profile: minimal
-          toolchain: stable
-          override: true
-          components: rustfmt, clippy
-
-      - name: Check formatting
-        uses: actions-rs/cargo@v1
-        with:
-          command: fmt
-          args: ${{ env.MANIFEST_PATH }} --all -- --check
-
-      - name: Build
-        uses: actions-rs/cargo@v1
-        with:
-          command: build
-          args: ${{ env.MANIFEST_PATH }} --release --workspace
-
-      - name: Unit tests
-        uses: actions-rs/cargo@v1
-        with:
-          command: test
-          args: ${{ env.MANIFEST_PATH }} --workspace
-
-      - name: Clippy
-        uses: actions-rs/cargo@v1
-        with:
-          command: clippy
-          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings
-
-  notification:
-    needs: build
-    runs-on: custom-linux
-    steps:
-      - name: Collect jobs status
-        uses: technote-space/workflow-conclusion-action@v2
-      - name: Check out repository code
-        uses: actions/checkout@v3
-      - name: install npm
-        uses: actions/setup-node@v3
-        if: env.WORKFLOW_CONCLUSION == 'failure'
-        with:
-          node-version: 18
-      - name: Matrix - Node Install
-        if: env.WORKFLOW_CONCLUSION == 'failure'
-        run: npm install
-        working-directory: .github/workflows/support-files
-      - name: Matrix - Send Notification
-        if: env.WORKFLOW_CONCLUSION == 'failure'
-        env:
-          NYM_NOTIFICATION_KIND: nightly
-          NYM_PROJECT_NAME: "nym-connect-desktop-nightly-build"
-          GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
-          GIT_COMMIT_MESSAGE: "${{ github.event.head_commit.message }}"
-          GIT_BRANCH: "${GITHUB_REF##*/}"
-          IS_SUCCESS: "${{ env.WORKFLOW_CONCLUSION == 'success' }}"
-          MATRIX_SERVER: "${{ secrets.MATRIX_SERVER }}"
-          MATRIX_ROOM: "${{ secrets.MATRIX_ROOM_NIGHTLY }}"
-          MATRIX_USER_ID: "${{ secrets.MATRIX_USER_ID }}"
-          MATRIX_TOKEN: "${{ secrets.MATRIX_TOKEN }}"
-          MATRIX_DEVICE_ID: "${{ secrets.MATRIX_DEVICE_ID }}"
-        uses: docker://keybaseio/client:stable-node
-        with:
-          args: .github/workflows/support-files/notifications/entry_point.sh

.github/workflows/nightly-nym-wallet-build.yml

@@ -5,24 +5,27 @@ on:
   schedule:
     - cron: '14 1 * * *'
 
+defaults:
+  run:
+    working-directory: nym-wallet
+
 jobs:
   build:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-20.04, macos-latest, windows-latest]
+        os: [custom-ubuntu-20.04, macos-latest, windows10]
     runs-on: ${{ matrix.os }}
     env:
       CARGO_TERM_COLOR: always
-      MANIFEST_PATH: --manifest-path nym-wallet/Cargo.toml
     continue-on-error: true
     steps:
       - name: Check out repository code
         uses: actions/checkout@v3
 
       - name: Install Dependencies (Linux)
-        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev squashfs-tools
-        if: matrix.os == 'ubuntu-20.04'
+        run: sudo apt-get update && sudo apt-get install -y libwebkit2gtk-4.0-dev build-essential curl wget libssl-dev libgtk-3-dev libudev-dev squashfs-tools protobuf-compiler
+        if: matrix.os == 'custom-ubuntu-20.04'
 
       - name: Install rust toolchain
         uses: actions-rs/toolchain@v1
@@ -32,29 +35,40 @@ jobs:
           override: true
           components: rustfmt, clippy
 
+      - name: Install Protoc
+        uses: arduino/setup-protoc@v2
+        if: matrix.os == 'macos-latest'
+
       - name: Check formatting
         uses: actions-rs/cargo@v1
         with:
           command: fmt
-          args: ${{ env.MANIFEST_PATH }} --all -- --check
+          args: --all -- --check
 
       - name: Build
         uses: actions-rs/cargo@v1
         with:
           command: build
-          args: ${{ env.MANIFEST_PATH }} --release --workspace
+          args: --workspace
 
       - name: Unit tests
         uses: actions-rs/cargo@v1
         with:
           command: test
-          args: ${{ env.MANIFEST_PATH }} --workspace
+          args: --workspace
+
+      - name: Annotate with clippy warnings
+        uses: actions-rs/clippy-check@v1
+        continue-on-error: true
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          args: --workspace
 
       - name: Clippy
         uses: actions-rs/cargo@v1
         with:
           command: clippy
-          args: ${{ env.MANIFEST_PATH }} --workspace --all-targets -- -D warnings
+          args: --workspace --all-targets -- -D warnings
 
   notification:
     needs: build

.github/workflows/publish-nym-contracts.yml

@@ -14,13 +14,13 @@ jobs:
       - name: Install Rust stable
         uses: actions-rs/toolchain@v1
         with:
-          toolchain: stable
+          toolchain: 1.69.0
           target: wasm32-unknown-unknown
           override: true
           components: rustfmt, clippy
 
       - name: Install wasm-opt
-        run: cargo install --version 0.114.0 wasm-opt
+        run: cargo install --version 0.112.0 wasm-opt
 
       - name: Build release contracts
         run: make contracts

.github/workflows/publish-nym-wallet-macos.yml

@@ -39,7 +39,6 @@ jobs:
         env:
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
         run: |
           # create variables
@@ -74,7 +73,6 @@ jobs:
           ENABLE_CODE_SIGNING: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
           APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
-          APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_IDENTITY_ID }}
           APPLE_ID: ${{ secrets.APPLE_ID }}
           APPLE_PASSWORD: ${{ secrets.APPLE_PASSWORD }}

.github/workflows/publish-sdk-npm.yml

@@ -12,7 +12,7 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: 18
-          registry-url: "https://registry.npmjs.org"
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Setup yarn
         run: npm install -g yarn
@@ -28,16 +28,6 @@ jobs:
       - name: Install wasm-opt
         run: cargo install wasm-opt
 
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: "1.20"
-
-      - name: Install TinyGo
-        uses: acifani/setup-tinygo@v1
-        with:
-          tinygo-version: "0.27.0"
-
       - name: Install dependencies
         run: yarn
 

.gitignore

@@ -45,6 +45,4 @@ envs/qwerty.env
 cpu-cycles/libcpucycles/build
 foxyfox.env
 
-.next
-ppa-private-key.b64
-ppa-private-key.asc
+.next

CHANGELOG.md

@@ -3,66 +3,9 @@
 Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
-
-## [2023.5-rolo] (2023-11-28)
-
-- Gateway won't open websocket listener until embedded Network Requester becomes available ([#4166])
-- Feature/gateway described nr ([#4147])
-- Bugfix/prerelease versionbump ([#4145])
-- returning 'nil' for non-existing origin as opposed to an empty string ([#4135])
-- using performance^20 when calculating active set selection weight ([#4126])
-- Change default http API timeout from 3s to 10s ([#4117])
-
-[#4166]: https://github.com/nymtech/nym/issues/4166
-[#4147]: https://github.com/nymtech/nym/pull/4147
-[#4145]: https://github.com/nymtech/nym/pull/4145
-[#4135]: https://github.com/nymtech/nym/pull/4135
-[#4126]: https://github.com/nymtech/nym/pull/4126
-[#4117]: https://github.com/nymtech/nym/pull/4117
-
-## [2023.nyxd-upgrade] (2023-11-22)
-
-- Chore/nyxd 043 upgrade ([#3968])
-
-[#3968]: https://github.com/nymtech/nym/pull/3968
-
-## [2023.4-galaxy] (2023-11-07)
-
-- DRY up client cli ([#4077])
-- [mixnode] replace rocket with axum ([#4071])
-- incorporate the nym node HTTP api into the mixnode ([#4070])
-- replaced '--disable-sign-ext' with '--signext-lowering' when running wasm-opt ([#3896])
-- Added PPA repo hosting support and nym-mixnode package with tooling for publishing ([#4165])
-
-[#4077]: https://github.com/nymtech/nym/pull/4077
-[#4071]: https://github.com/nymtech/nym/pull/4071
-[#4070]: https://github.com/nymtech/nym/issues/4070
-[#3896]: https://github.com/nymtech/nym/pull/3896
-[#4165]: https://github.com/nymtech/nym/pull/4165
-
-## [2023.3-kinder] (2023-10-31)
-
-- suppress error output ([#4056])
-- Update frontend type for current vesting period ([#4042])
-- re-exported additional types for tx queries ([#4036])
-- fixed fmt::Display impl for GatewayNetworkRequesterDetails ([#4033])
-- Add exit node policy from TorNull and Tor Exit Node Policy ([#4024])
-- basic self-described api for gateways to dynamically announce its details + nym-api aggregation ([#4017])
-- use saturating sub in case outfox is not enabled ([#3986])
-- Fix sorting for mixnodes and gateways ([#3985])
-- Gateway client registry and api routes ([#3955])
-- Feature/configurable socks5 bind address ([#3992])
-
-[#4056]: https://github.com/nymtech/nym/pull/4056
-[#4042]: https://github.com/nymtech/nym/pull/4042
-[#4036]: https://github.com/nymtech/nym/pull/4036
-[#4033]: https://github.com/nymtech/nym/pull/4033
-[#4024]: https://github.com/nymtech/nym/issues/4024
-[#4017]: https://github.com/nymtech/nym/issues/4017
-[#3986]: https://github.com/nymtech/nym/pull/3986
-[#3985]: https://github.com/nymtech/nym/pull/3985
-[#3955]: https://github.com/nymtech/nym/pull/3955
-[#3992]: https://github.com/nymtech/nym/pull/3992
+- add client registry to Gateway ([#3955])
+- add HTTP API to Gateway ([#3955])
+- add `/client/<pub-key>`, `clients` and `register` routes to the gateway ([#3955])
 
 ## [2023.1-milka] (2023-09-24)
 

Cargo.toml

@@ -49,7 +49,6 @@ members = [
     "common/exit-policy",
     "common/http-api-client",
     "common/inclusion-probability",
-    "common/ip-packet-requests",
     "common/ledger",
     "common/mixnode-common",
     "common/network-defaults",
@@ -75,7 +74,6 @@ members = [
     "common/store-cipher",
     "common/task",
     "common/topology",
-    "common/tun",
     "common/types",
     "common/wasm/client-core",
     "common/wasm/storage",
@@ -92,7 +90,6 @@ members = [
     "sdk/lib/socks5-listener",
     "sdk/rust/nym-sdk",
     "service-providers/common",
-    "service-providers/ip-packet-router",
     "service-providers/network-requester",
     "service-providers/network-statistics",
     "nym-api",
@@ -107,7 +104,7 @@ members = [
     "tools/nym-nr-query",
     "tools/ts-rs-cli",
     "wasm/client",
-#    "wasm/full-nym-wasm",
+    "wasm/full-nym-wasm",
     "wasm/mix-fetch",
     "wasm/node-tester",
 ]
@@ -139,8 +136,23 @@ async-trait = "0.1.68"
 axum = "0.6.20"
 base64 = "0.21.4"
 bip39 = { version = "2.0.0", features = ["zeroize"] }
-clap = "4.4.7"
+boringtun = { git = "https://github.com/cloudflare/boringtun", rev = "e1d6360d6ab4529fc942a078e4c54df107abe2ba" }
 cfg-if = "1.0.0"
+cosmwasm-derive = "=1.3.0"
+cosmwasm-schema = "=1.3.0"
+cosmwasm-std = "=1.3.0"
+# use 0.5.0 as that's the version used by cosmwasm-std 1.3.0
+# (and ideally we don't want to pull the same dependency twice)
+serde-json-wasm = "=0.5.0"
+cosmwasm-storage = "=1.3.0"
+cosmrs = "=0.14.0"
+# same version as used by cosmrs
+cw-utils = "=1.0.1"
+cw-storage-plus = "=1.1.0"
+cw2 = { version = "=1.1.0" }
+cw3 = { version = "=1.1.0" }
+cw4 = { version = "=1.1.0" }
+cw-controllers = { version = "=1.1.0" }
 dashmap = "5.5.3"
 dotenvy = "0.15.6"
 futures = "0.3.28"
@@ -158,6 +170,7 @@ schemars = "0.8.1"
 serde = "1.0.152"
 serde_json = "1.0.91"
 tap = "1.0.1"
+tendermint-rpc = "0.32" # same version as used by cosmrs
 thiserror = "1.0.48"
 tokio = "1.24.1"
 tokio-tungstenite = "0.20.1"
@@ -169,28 +182,6 @@ utoipa-swagger-ui = "3.1.5"
 url = "2.4"
 zeroize = "1.6.0"
 
-# cosmwasm-related
-cosmwasm-derive = "=1.3.0"
-cosmwasm-schema = "=1.3.0"
-cosmwasm-std = "=1.3.0"
-# use 0.5.0 as that's the version used by cosmwasm-std 1.3.0
-# (and ideally we don't want to pull the same dependency twice)
-serde-json-wasm = "=0.5.0"
-cosmwasm-storage = "=1.3.0"
-# same version as used by cosmwasm
-cw-utils = "=1.0.1"
-cw-storage-plus = "=1.1.0"
-cw2 = { version = "=1.1.0" }
-cw3 = { version = "=1.1.0" }
-cw4 = { version = "=1.1.0" }
-cw-controllers = { version = "=1.1.0" }
-
-# cosmrs-related
-bip32 = "0.5.1"
-cosmrs = "=0.15.0"
-tendermint-rpc = "0.34" # same version as used by cosmrs
-prost = "0.12"
-
 # wasm-related dependencies
 gloo-utils = "0.1.7"
 js-sys = "0.3.63"

LICENSES/CC-BY-NC-SA-4.0.txt

@@ -1,439 +0,0 @@
-Attribution-NonCommercial-ShareAlike 4.0 International
-
-=======================================================================
-
-Creative Commons Corporation ("Creative Commons") is not a law firm and
-does not provide legal services or legal advice. Distribution of
-Creative Commons public licenses does not create a lawyer-client or
-other relationship. Creative Commons makes its licenses and related
-information available on an "as-is" basis. Creative Commons gives no
-warranties regarding its licenses, any material licensed under their
-terms and conditions, or any related information. Creative Commons
-disclaims all liability for damages resulting from their use to the
-fullest extent possible.
-
-Using Creative Commons Public Licenses
-
-Creative Commons public licenses provide a standard set of terms and
-conditions that creators and other rights holders may use to share
-original works of authorship and other material subject to copyright
-and certain other rights specified in the public license below. The
-following considerations are for informational purposes only, are not
-exhaustive, and do not form part of our licenses.
-
-     Considerations for licensors: Our public licenses are
-     intended for use by those authorized to give the public
-     permission to use material in ways otherwise restricted by
-     copyright and certain other rights. Our licenses are
-     irrevocable. Licensors should read and understand the terms
-     and conditions of the license they choose before applying it.
-     Licensors should also secure all rights necessary before
-     applying our licenses so that the public can reuse the
-     material as expected. Licensors should clearly mark any
-     material not subject to the license. This includes other CC-
-     licensed material, or material used under an exception or
-     limitation to copyright. More considerations for licensors:
-    wiki.creativecommons.org/Considerations_for_licensors
-
-     Considerations for the public: By using one of our public
-     licenses, a licensor grants the public permission to use the
-     licensed material under specified terms and conditions. If
-     the licensor's permission is not necessary for any reason--for
-     example, because of any applicable exception or limitation to
-     copyright--then that use is not regulated by the license. Our
-     licenses grant only permissions under copyright and certain
-     other rights that a licensor has authority to grant. Use of
-     the licensed material may still be restricted for other
-     reasons, including because others have copyright or other
-     rights in the material. A licensor may make special requests,
-     such as asking that all changes be marked or described.
-     Although not required by our licenses, you are encouraged to
-     respect those requests where reasonable. More considerations
-     for the public:
-    wiki.creativecommons.org/Considerations_for_licensees
-
-=======================================================================
-
-Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International
-Public License
-
-By exercising the Licensed Rights (defined below), You accept and agree
-to be bound by the terms and conditions of this Creative Commons
-Attribution-NonCommercial-ShareAlike 4.0 International Public License
-("Public License"). To the extent this Public License may be
-interpreted as a contract, You are granted the Licensed Rights in
-consideration of Your acceptance of these terms and conditions, and the
-Licensor grants You such rights in consideration of benefits the
-Licensor receives from making the Licensed Material available under
-these terms and conditions.
-
-
-Section 1 -- Definitions.
-
-  a. Adapted Material means material subject to Copyright and Similar
-     Rights that is derived from or based upon the Licensed Material
-     and in which the Licensed Material is translated, altered,
-     arranged, transformed, or otherwise modified in a manner requiring
-     permission under the Copyright and Similar Rights held by the
-     Licensor. For purposes of this Public License, where the Licensed
-     Material is a musical work, performance, or sound recording,
-     Adapted Material is always produced where the Licensed Material is
-     synched in timed relation with a moving image.
-
-  b. Adapter's License means the license You apply to Your Copyright
-     and Similar Rights in Your contributions to Adapted Material in
-     accordance with the terms and conditions of this Public License.
-
-  c. BY-NC-SA Compatible License means a license listed at
-     creativecommons.org/compatiblelicenses, approved by Creative
-     Commons as essentially the equivalent of this Public License.
-
-  d. Copyright and Similar Rights means copyright and/or similar rights
-     closely related to copyright including, without limitation,
-     performance, broadcast, sound recording, and Sui Generis Database
-     Rights, without regard to how the rights are labeled or
-     categorized. For purposes of this Public License, the rights
-     specified in Section 2(b)(1)-(2) are not Copyright and Similar
-     Rights.
-
-  e. Effective Technological Measures means those measures that, in the
-     absence of proper authority, may not be circumvented under laws
-     fulfilling obligations under Article 11 of the WIPO Copyright
-     Treaty adopted on December 20, 1996, and/or similar international
-     agreements.
-
-  f. Exceptions and Limitations means fair use, fair dealing, and/or
-     any other exception or limitation to Copyright and Similar Rights
-     that applies to Your use of the Licensed Material.
-
-  g. License Elements means the license attributes listed in the name
-     of a Creative Commons Public License. The License Elements of this
-     Public License are Attribution, NonCommercial, and ShareAlike.
-
-  h. Licensed Material means the artistic or literary work, database,
-     or other material to which the Licensor applied this Public
-     License.
-
-  i. Licensed Rights means the rights granted to You subject to the
-     terms and conditions of this Public License, which are limited to
-     all Copyright and Similar Rights that apply to Your use of the
-     Licensed Material and that the Licensor has authority to license.
-
-  j. Licensor means the individual(s) or entity(ies) granting rights
-     under this Public License.
-
-  k. NonCommercial means not primarily intended for or directed towards
-     commercial advantage or monetary compensation. For purposes of
-     this Public License, the exchange of the Licensed Material for
-     other material subject to Copyright and Similar Rights by digital
-     file-sharing or similar means is NonCommercial provided there is
-     no payment of monetary compensation in connection with the
-     exchange.
-
-  l. Share means to provide material to the public by any means or
-     process that requires permission under the Licensed Rights, such
-     as reproduction, public display, public performance, distribution,
-     dissemination, communication, or importation, and to make material
-     available to the public including in ways that members of the
-     public may access the material from a place and at a time
-     individually chosen by them.
-
-  m. Sui Generis Database Rights means rights other than copyright
-     resulting from Directive 96/9/EC of the European Parliament and of
-     the Council of 11 March 1996 on the legal protection of databases,
-     as amended and/or succeeded, as well as other essentially
-     equivalent rights anywhere in the world.
-
-  n. You means the individual or entity exercising the Licensed Rights
-     under this Public License. Your has a corresponding meaning.
-
-
-Section 2 -- Scope.
-
-  a. License grant.
-
-       1. Subject to the terms and conditions of this Public License,
-          the Licensor hereby grants You a worldwide, royalty-free,
-          non-sublicensable, non-exclusive, irrevocable license to
-          exercise the Licensed Rights in the Licensed Material to:
-
-            a. reproduce and Share the Licensed Material, in whole or
-               in part, for NonCommercial purposes only; and
-
-            b. produce, reproduce, and Share Adapted Material for
-               NonCommercial purposes only.
-
-       2. Exceptions and Limitations. For the avoidance of doubt, where
-          Exceptions and Limitations apply to Your use, this Public
-          License does not apply, and You do not need to comply with
-          its terms and conditions.
-
-       3. Term. The term of this Public License is specified in Section
-          6(a).
-
-       4. Media and formats; technical modifications allowed. The
-          Licensor authorizes You to exercise the Licensed Rights in
-          all media and formats whether now known or hereafter created,
-          and to make technical modifications necessary to do so. The
-          Licensor waives and/or agrees not to assert any right or
-          authority to forbid You from making technical modifications
-          necessary to exercise the Licensed Rights, including
-          technical modifications necessary to circumvent Effective
-          Technological Measures. For purposes of this Public License,
-          simply making modifications authorized by this Section 2(a)
-          (4) never produces Adapted Material.
-
-       5. Downstream recipients.
-
-            a. Offer from the Licensor -- Licensed Material. Every
-               recipient of the Licensed Material automatically
-               receives an offer from the Licensor to exercise the
-               Licensed Rights under the terms and conditions of this
-               Public License.
-
-            b. Additional offer from the Licensor -- Adapted Material.
-               Every recipient of Adapted Material from You
-               automatically receives an offer from the Licensor to
-               exercise the Licensed Rights in the Adapted Material
-               under the conditions of the Adapter's License You apply.
-
-            c. No downstream restrictions. You may not offer or impose
-               any additional or different terms or conditions on, or
-               apply any Effective Technological Measures to, the
-               Licensed Material if doing so restricts exercise of the
-               Licensed Rights by any recipient of the Licensed
-               Material.
-
-       6. No endorsement. Nothing in this Public License constitutes or
-          may be construed as permission to assert or imply that You
-          are, or that Your use of the Licensed Material is, connected
-          with, or sponsored, endorsed, or granted official status by,
-          the Licensor or others designated to receive attribution as
-          provided in Section 3(a)(1)(A)(i).
-
-  b. Other rights.
-
-       1. Moral rights, such as the right of integrity, are not
-          licensed under this Public License, nor are publicity,
-          privacy, and/or other similar personality rights; however, to
-          the extent possible, the Licensor waives and/or agrees not to
-          assert any such rights held by the Licensor to the limited
-          extent necessary to allow You to exercise the Licensed
-          Rights, but not otherwise.
-
-       2. Patent and trademark rights are not licensed under this
-          Public License.
-
-       3. To the extent possible, the Licensor waives any right to
-          collect royalties from You for the exercise of the Licensed
-          Rights, whether directly or through a collecting society
-          under any voluntary or waivable statutory or compulsory
-          licensing scheme. In all other cases the Licensor expressly
-          reserves any right to collect such royalties, including when
-          the Licensed Material is used other than for NonCommercial
-          purposes.
-
-
-Section 3 -- License Conditions.
-
-Your exercise of the Licensed Rights is expressly made subject to the
-following conditions.
-
-  a. Attribution.
-
-       1. If You Share the Licensed Material (including in modified
-          form), You must:
-
-            a. retain the following if it is supplied by the Licensor
-               with the Licensed Material:
-
-                 i. identification of the creator(s) of the Licensed
-                    Material and any others designated to receive
-                    attribution, in any reasonable manner requested by
-                    the Licensor (including by pseudonym if
-                    designated);
-
-                ii. a copyright notice;
-
-               iii. a notice that refers to this Public License;
-
-                iv. a notice that refers to the disclaimer of
-                    warranties;
-
-                 v. a URI or hyperlink to the Licensed Material to the
-                    extent reasonably practicable;
-
-            b. indicate if You modified the Licensed Material and
-               retain an indication of any previous modifications; and
-
-            c. indicate the Licensed Material is licensed under this
-               Public License, and include the text of, or the URI or
-               hyperlink to, this Public License.
-
-       2. You may satisfy the conditions in Section 3(a)(1) in any
-          reasonable manner based on the medium, means, and context in
-          which You Share the Licensed Material. For example, it may be
-          reasonable to satisfy the conditions by providing a URI or
-          hyperlink to a resource that includes the required
-          information.
-       3. If requested by the Licensor, You must remove any of the
-          information required by Section 3(a)(1)(A) to the extent
-          reasonably practicable.
-
-  b. ShareAlike.
-
-     In addition to the conditions in Section 3(a), if You Share
-     Adapted Material You produce, the following conditions also apply.
-
-       1. The Adapter's License You apply must be a Creative Commons
-          license with the same License Elements, this version or
-          later, or a BY-NC-SA Compatible License.
-
-       2. You must include the text of, or the URI or hyperlink to, the
-          Adapter's License You apply. You may satisfy this condition
-          in any reasonable manner based on the medium, means, and
-          context in which You Share Adapted Material.
-
-       3. You may not offer or impose any additional or different terms
-          or conditions on, or apply any Effective Technological
-          Measures to, Adapted Material that restrict exercise of the
-          rights granted under the Adapter's License You apply.
-
-
-Section 4 -- Sui Generis Database Rights.
-
-Where the Licensed Rights include Sui Generis Database Rights that
-apply to Your use of the Licensed Material:
-
-  a. for the avoidance of doubt, Section 2(a)(1) grants You the right
-     to extract, reuse, reproduce, and Share all or a substantial
-     portion of the contents of the database for NonCommercial purposes
-     only;
-
-  b. if You include all or a substantial portion of the database
-     contents in a database in which You have Sui Generis Database
-     Rights, then the database in which You have Sui Generis Database
-     Rights (but not its individual contents) is Adapted Material,
-     including for purposes of Section 3(b); and
-
-  c. You must comply with the conditions in Section 3(a) if You Share
-     all or a substantial portion of the contents of the database.
-
-For the avoidance of doubt, this Section 4 supplements and does not
-replace Your obligations under this Public License where the Licensed
-Rights include other Copyright and Similar Rights.
-
-
-Section 5 -- Disclaimer of Warranties and Limitation of Liability.
-
-  a. UNLESS OTHERWISE SEPARATELY UNDERTAKEN BY THE LICENSOR, TO THE
-     EXTENT POSSIBLE, THE LICENSOR OFFERS THE LICENSED MATERIAL AS-IS
-     AND AS-AVAILABLE, AND MAKES NO REPRESENTATIONS OR WARRANTIES OF
-     ANY KIND CONCERNING THE LICENSED MATERIAL, WHETHER EXPRESS,
-     IMPLIED, STATUTORY, OR OTHER. THIS INCLUDES, WITHOUT LIMITATION,
-     WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR
-     PURPOSE, NON-INFRINGEMENT, ABSENCE OF LATENT OR OTHER DEFECTS,
-     ACCURACY, OR THE PRESENCE OR ABSENCE OF ERRORS, WHETHER OR NOT
-     KNOWN OR DISCOVERABLE. WHERE DISCLAIMERS OF WARRANTIES ARE NOT
-     ALLOWED IN FULL OR IN PART, THIS DISCLAIMER MAY NOT APPLY TO YOU.
-
-  b. TO THE EXTENT POSSIBLE, IN NO EVENT WILL THE LICENSOR BE LIABLE
-     TO YOU ON ANY LEGAL THEORY (INCLUDING, WITHOUT LIMITATION,
-     NEGLIGENCE) OR OTHERWISE FOR ANY DIRECT, SPECIAL, INDIRECT,
-     INCIDENTAL, CONSEQUENTIAL, PUNITIVE, EXEMPLARY, OR OTHER LOSSES,
-     COSTS, EXPENSES, OR DAMAGES ARISING OUT OF THIS PUBLIC LICENSE OR
-     USE OF THE LICENSED MATERIAL, EVEN IF THE LICENSOR HAS BEEN
-     ADVISED OF THE POSSIBILITY OF SUCH LOSSES, COSTS, EXPENSES, OR
-     DAMAGES. WHERE A LIMITATION OF LIABILITY IS NOT ALLOWED IN FULL OR
-     IN PART, THIS LIMITATION MAY NOT APPLY TO YOU.
-
-  c. The disclaimer of warranties and limitation of liability provided
-     above shall be interpreted in a manner that, to the extent
-     possible, most closely approximates an absolute disclaimer and
-     waiver of all liability.
-
-
-Section 6 -- Term and Termination.
-
-  a. This Public License applies for the term of the Copyright and
-     Similar Rights licensed here. However, if You fail to comply with
-     this Public License, then Your rights under this Public License
-     terminate automatically.
-
-  b. Where Your right to use the Licensed Material has terminated under
-     Section 6(a), it reinstates:
-
-       1. automatically as of the date the violation is cured, provided
-          it is cured within 30 days of Your discovery of the
-          violation; or
-
-       2. upon express reinstatement by the Licensor.
-
-     For the avoidance of doubt, this Section 6(b) does not affect any
-     right the Licensor may have to seek remedies for Your violations
-     of this Public License.
-
-  c. For the avoidance of doubt, the Licensor may also offer the
-     Licensed Material under separate terms or conditions or stop
-     distributing the Licensed Material at any time; however, doing so
-     will not terminate this Public License.
-
-  d. Sections 1, 5, 6, 7, and 8 survive termination of this Public
-     License.
-
-
-Section 7 -- Other Terms and Conditions.
-
-  a. The Licensor shall not be bound by any additional or different
-     terms or conditions communicated by You unless expressly agreed.
-
-  b. Any arrangements, understandings, or agreements regarding the
-     Licensed Material not stated herein are separate from and
-     independent of the terms and conditions of this Public License.
-
-
-Section 8 -- Interpretation.
-
-  a. For the avoidance of doubt, this Public License does not, and
-     shall not be interpreted to, reduce, limit, restrict, or impose
-     conditions on any use of the Licensed Material that could lawfully
-     be made without permission under this Public License.
-
-  b. To the extent possible, if any provision of this Public License is
-     deemed unenforceable, it shall be automatically reformed to the
-     minimum extent necessary to make it enforceable. If the provision
-     cannot be reformed, it shall be severed from this Public License
-     without affecting the enforceability of the remaining terms and
-     conditions.
-
-  c. No term or condition of this Public License will be waived and no
-     failure to comply consented to unless expressly agreed to by the
-     Licensor.
-
-  d. Nothing in this Public License constitutes or may be interpreted
-     as a limitation upon, or waiver of, any privileges and immunities
-     that apply to the Licensor or You, including from the legal
-     processes of any jurisdiction or authority.
-
-=======================================================================
-
-Creative Commons is not a party to its public
-licenses. Notwithstanding, Creative Commons may elect to apply one of
-its public licenses to material it publishes and in those instances
-will be considered the “Licensor.” The text of the Creative Commons
-public licenses is dedicated to the public domain under the CC0 Public
-Domain Dedication. Except for the limited purpose of indicating that
-material is shared under a Creative Commons public license or as
-otherwise permitted by the Creative Commons policies published at
-creativecommons.org/policies, Creative Commons does not authorize the
-use of the trademark "Creative Commons" or any other trademark or logo
-of Creative Commons without its prior written consent including,
-without limitation, in connection with any unauthorized modifications
-to any of its public licenses or any other arrangements,
-understandings, or agreements concerning use of licensed material. For
-the avoidance of doubt, this paragraph does not form part of the
-public licenses.
-
-Creative Commons may be contacted at creativecommons.org.
-
-

Makefile

@@ -93,6 +93,10 @@ $(eval $(call add_cargo_workspace,contracts,contracts,--lib --target wasm32-unkn
 $(eval $(call add_cargo_workspace,wallet,nym-wallet))
 $(eval $(call add_cargo_workspace,connect,nym-connect/desktop))
 
+# OVERRIDE: wasm-opt fails if the binary has been built with the latest rustc.
+# Pin to the last working version.
+contracts_BUILD_RELEASE_TOOLCHAIN := +1.69.0
+
 # -----------------------------------------------------------------------------
 # SDK
 # -----------------------------------------------------------------------------
@@ -104,7 +108,7 @@ sdk-wasm-build:
 	$(MAKE) -C wasm/client
 	$(MAKE) -C wasm/node-tester
 	$(MAKE) -C wasm/mix-fetch
-	#$(MAKE) -C wasm/full-nym-wasm
+	$(MAKE) -C wasm/full-nym-wasm
 
 # run this from npm/yarn to ensure tools are in the path, e.g. yarn build:sdk from root of repo
 sdk-typescript-build:
@@ -114,7 +118,7 @@ sdk-typescript-build:
 	yarn --cwd sdk/typescript/codegen/contract-clients build
 
 # NOTE: These targets are part of the main workspace (but not as wasm32-unknown-unknown)
-WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm
+WASM_CRATES = extension-storage nym-client-wasm nym-node-tester-wasm nym-wasm-sdk
 
 sdk-wasm-test:
 	#cargo test $(addprefix -p , $(WASM_CRATES)) --target wasm32-unknown-unknown -- -Dwarnings
@@ -140,7 +144,7 @@ contracts: build-release-contracts wasm-opt-contracts
 
 wasm-opt-contracts:
 	for contract in $(CONTRACTS_WASM); do \
-	  wasm-opt --signext-lowering -Os $(CONTRACTS_OUT_DIR)/$$contract -o $(CONTRACTS_OUT_DIR)/$$contract; \
+	  wasm-opt --disable-sign-ext -Os $(CONTRACTS_OUT_DIR)/$$contract -o $(CONTRACTS_OUT_DIR)/$$contract; \
 	done
 
 # Consider adding 's' to make plural consistent (beware: used in github workflow)
@@ -168,7 +172,3 @@ generate-typescript:
 run-api-tests:
 	cd nym-api/tests/functional_test && yarn test:qa
 
-# Build debian package, and update PPA
-# Requires base64 encode GPG key to be set up in environment PPA_SIGNING_KEY
-deb:
-	scripts/ppa.sh

README.md

@@ -15,6 +15,7 @@ The platform is composed of multiple Rust crates. Top-level executable binary cr
 * nym-explorer - a (projected) block explorer and (existing) mixnet viewer.
 * nym-wallet - a desktop wallet implemented using the [Tauri](https://tauri.studio/en/docs/about/intro) framework.
 
+[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg?style=for-the-badge)](https://opensource.org/licenses/Apache-2.0)
 [![Build Status](https://img.shields.io/github/actions/workflow/status/nymtech/nym/build.yml?branch=develop&style=for-the-badge&logo=github-actions)](https://github.com/nymtech/nym/actions?query=branch%3Adevelop)
 
 
@@ -82,11 +83,4 @@ where `s'` is stake `s` scaled over total token circulating supply.
 
 ### Licensing and copyright information
 
-This is a monorepo and components that make up Nym as a system are licensed individually, so for accurate information, please check individual files.
-
-As a general approach, licensing is as follows this pattern:
-- applications and binaries are GPLv3
-- libraries and components are Apache 2.0 or MIT
-- documentation is Apache 2.0 or CC0-1.0
-
-Again, for accurate information, please check individual files.
+This program is available as open source under the terms of the Apache 2.0 license. However, some elements are being licensed under CC0-1.0 and MIT. For accurate information, please check individual files.

SECURITY.md

@@ -1,90 +1,10 @@
 Critical bug or security issue 💥
 
-If you're here because you're trying to figure out how to notify us of a security issue, send us a PGP encrypted email to:
+If you're here because you're trying to figure out how to notify us of a security issue, go to Discord, and alert the core engineers:
 
-```
-security@nymte.ch
-```
-
-Encrypted with our public key which is available below in plain text and also on keyservers:
-
-```
-pub   rsa4096 2023-10-30 [SC] [expire : 2026-10-29]
-      24B2592E801A5AAA8666C8BA7C3C727F05090550
-uid          [  ultime ] Security Nym Technologies <security@nymte.ch>
-sub   rsa4096 2023-10-30 [E] [expire : 2026-10-29]
-
-```
-
-The fingerprint of the key is on the second line above.
-
-If you need to chat __urgently__ to our team for a __critical__ security issue:
-
-go to Matrix, and alert the core engineers with a private direct message:
-
-    Jedrzej Stuczynski @jstuczyn:nymtech.chat
-    Mark Sinclair @mark:nymtech.chat
-    Raphaël Walther @raphael:nymtech.chat
+    Dave Hrycyszyn futurechimp#5430
+    Jedrzej Stuczynski "Jedrzej | Nym#5666"
+    Fran Arbanas | franarbanas#0995
+    Mark Sinclair | marknym#8088 
 
 Please avoid opening public issues on GitHub that contain information about a potential security vulnerability as this makes it difficult to reduce the impact and harm of valid security issues.
-
-If you don't know what Matrix is, you can follow this documentation to create an account on this federation of instant messaging servers:
-
-[Matrix for Instant Messaging](https://matrix.org/docs/chat_basics/matrix-for-im/)
-
-
-
-```
------BEGIN PGP PUBLIC KEY BLOCK-----
-
-mQINBGU/XpcBEAC+ykz0yxn8FferjEBooptXlOH/v/28aa0Nv8DfImTgj9BNY5cR
-UdLk+Wa3CSXQVE7PIsi0egEjAMfyxPEywbvPlgklW4XAKDVUCf3gxpQNN47VuVgV
-VwrN0VBurhhIKoEw9daO6A0P44+6nmXGIfUulCr4fMxYq82SOooog/j5w0/LfITu
-rQXxVABLkXHGN/NGf4BE52QI/ppeXWoshlNVU1wdZIIYWwte+9ukikWpN+LYfJUR
-ybtyCjQ4Gdf8ap1GmkKHmAru24wbUuFsBWGVgHsXAwYlKxyiNGR9YwgAxmFk6vNf
-1PqKGO3i4erx5X/+mzylzNbFlCqFuksZRyUSDZvQ8fxkm8ra1zWbO38eOTp8Vhgg
-SKfRTzOKeZYURZicJPxmEIfA88U4tx+YWJ54YWT/gERZkjIJL5mzIuY9UulVvKUM
-vMFUIzBMHOPXH16036zGyFMC1esRd2qqil4b9KtLgCOkrD1VgpjcveoA0VyMJCN6
-LmKTrVjwjjDMxby+d49BolRWGnCofXozXwvNQx+CYv8M2WPErTpyYoofYFtpqr7A
-fIufc/e0+um3zoGIbHejrhsbuH9Qf+MKsI+Ng93bdDtjeHz6MEgAlsTm0qeizYpj
-IyKZIObPmfvrAm08hFZ8JnGk+XuooF36XWbJYjCCy0bOyMw1r7ZG99TcSwARAQAB
-tC1TZWN1cml0eSBOeW0gVGVjaG5vbG9naWVzIDxzZWN1cml0eUBueW10ZS5jaD6J
-AlQEEwEKAD4WIQQkslkugBpaqoZmyLp8PHJ/BQkFUAUCZT9elwIbAwUJBaOagAUL
-CQgHAwUVCgkICwUWAgMBAAIeAQIXgAAKCRB8PHJ/BQkFUL7dD/9zO73uI5VR+SWx
-PFmJW+9QsPiQbVRvGwNZurctmQ2s2Pe0vHRELFeqD5oYvSx2Lequ3Ir+zn/C3kDM
-kNs40obSL6jCBiLPkxEY0JqzPM9jZr7EjvlibWV3f6DxooRIqEyfN57I3OBGlqZE
-0Mx7sQuCcgau8C70DF952QhKUwXC2cmpmDKHVEEoio1xGSD4dQhGapCB32RQGtna
-OGfAO9celNMvSq0Lp+aJxeACmWFY5T4/y79JPcT5vSs/yEIRmaH/fn2piwaFBsIq
-gHJJMxO3740P1hF8j7KWUoUofuFaEALHBpEpjWTOj8ej1wmFlu+5F+jSVoc781Wb
-ZZXu04cOBXnGTogzSxMpBe9TtLb28zd6WzFotC25KTI3pngMzXsQGLJLOwvoZKiS
-LFjPRjg1rwobmB3Q3J2W5GYSveia0CDsZGP+g87GVVf/oD2Djpa68xyVYwIYeA6T
-3DNdS77qHiRuGiS4kWXyVjDqOICboR4uCvt09zlkBuLDdTWqWYARUvZjtjs4w/Ol
-rdrBI3A88ti8fRldYaNpu17ME1ilpN44yKoJtqiWc3Tisk8eYLfx6c7FQF3PrRva
-mr7FZvhFsYML5CeNFHTEzN6Y3jjKN/60DvCfodWnWFK47Txkl8UAXGY2W9B0fWqQ
-wUVr8uLuMyyMiKbeoufi7rGOj6AMErkCDQRlP16XARAA8FGmD5J3tM1BOM1niJxZ
-JTdCauzEtxEoBL0RuqGBkR8U29sRM6DwuzjU7PwscFnBaGyU+eU73GwGkH3ozFfF
-tllYhQrhP/kkN+0rEO5Xi+nR+4JCFRqrf3nJXAAPfiksURMp8er1dUOY2/e1ZSoL
-tS+nzUivV8CfE+pgj/5YtGwPC+KYHLATkKkMELCrbW4UO06VWOqQsvr6kivXuJQQ
-LdEAMpBlADmXFG45DmPKQzsBWUgvTwyGy3LX0nys8cgpex9BH8hhr01QmGyP469s
-N3cNrtFuu8U6RAsiCD/8mlBuD3EQEU5SF0lc7kCICAZk+wElmXnimEi0TOYsbz6k
-90lteicX70rA9GNeyI76H+VSOYvWpkRwaJAgUdzrAM1o9SHASq+cZ6nD85OZioQk
-DWM6+Q+sf2oen0qJnnGmUr93kJIC0PIdgrXRrtiNfeRa1Z/H0LmREyyEMoFiVivn
-z1vVk85Oq6Sf3ltUwvmDzuuJOtsp2Qp6+x6Snn/yKauI4uf4Cf/wKUch4r6Bwgg5
-Dw49ky7lwlnALio4GIVoGLpLef93wWoDmp4Klyh3ZPf2nB0U91u3bHRUo7m+D7QJ
-98cyKtqLLzjg7szGf60pIWNWRsadYQT3bSncynqknAjOV3BCvx6/ivsnpj//QjYR
-HtviUAcQ1DBB6UC6q23FIs0AEQEAAYkCPAQYAQoAJhYhBCSyWS6AGlqqhmbIunw8
-cn8FCQVQBQJlP16XAhsMBQkFo5qAAAoJEHw8cn8FCQVQzukP/iLxjOxT+UpPR//c
-prDVSLkP4pF5bmw36U07jvqpS+/KTXsxiiQleffRabOpNLcd+K1ueavyt9nnIwHH
-tHS9kM9A7DBw3LnpEbXki46QDCCI6niGijlLOEeAWqnocwMNTT05wVVgCtO3DQP2
-MoSCcqHpXDChvOyr5d5xjYLVJhlctIMSomcVzGryjknPu0Yj/TkC/4c+m86ZWQUD
-HqMHQIuiEenvb62/F4c5OJIRZPEn70wdddkgJuJU3eHdHrnuhCkjCC93GQGbGj03
-Zqos6699y6hmPeD3U5IUv8ujwZYVCCuDm8gJfrp3R6WLfeZeK9WmTVBpCzsDg3fV
-hSwmOk6pp8DAq1/Dev3yRkFggCEyGK6c9b+a0CRBncl8e5Q0QQIzNiS/uExQP3h+
-ELJs3P0MLP+6FWhNUry09n3lnWkr1hY+v1M0GAxbfdv/tsCN1Pq/VQEz+CTqXqya
-ftWldOHWw6Hh+gtwxcHjG4MBOrO5oICQ3lh2hGwQ58cDgZYSK/OGgJ9BggFl1CcM
-0uGC0/TRCI1zt/4y+7efSZQMZkHo7VC/3MFbp2hcNejpW+BxVuwKTunFvWK3TLhq
-sSlQ5yyhqchooepsFHq9bosKFjLJC01uprBv1rinoNduOy43FbyS7JPRRspANN0R
-iC2pMbWdE0ZTQaFq6tPIg058pjqi
-=nqgX
------END PGP PUBLIC KEY BLOCK-----
-```

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.32"
+version = "1.1.30"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"
@@ -20,7 +20,7 @@ futures = { workspace = true } # bunch of futures stuff, however, now that I thi
 # and the single instance of abortable we have should really be refactored anyway
 url = { workspace = true }
 
-clap = { workspace = true, features = ["cargo", "derive"] }
+clap = { version = "4.0", features = ["cargo", "derive"] }
 dirs = "4.0"
 lazy_static = "1.4.0"
 log = { workspace = true } # self explanatory
@@ -36,7 +36,7 @@ tokio-tungstenite = { workspace = true }
 ## internal
 nym-bandwidth-controller = { path = "../../common/bandwidth-controller" }
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
+nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage"] }
 nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-config = { path = "../../common/config" }
 nym-credential-storage = { path = "../../common/credential-storage" }

clients/native/src/client/config/mod.rs

@@ -4,8 +4,6 @@
 use crate::client::config::persistence::ClientPaths;
 use crate::client::config::template::CONFIG_TEMPLATE;
 use nym_bin_common::logging::LoggingSettings;
-use nym_client_core::cli_helpers::client_init::ClientConfig;
-use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::defaults::DEFAULT_WEBSOCKET_LISTENING_PORT;
 use nym_config::{
     must_get_home, read_config_from_toml_file, save_formatted_config_to_file, NymConfigTemplate,
@@ -74,24 +72,6 @@ impl NymConfigTemplate for Config {
     }
 }
 
-impl ClientConfig for Config {
-    fn common_paths(&self) -> &CommonClientPaths {
-        &self.storage_paths.common_paths
-    }
-
-    fn core_config(&self) -> &BaseClientConfig {
-        &self.base
-    }
-
-    fn default_store_location(&self) -> PathBuf {
-        self.default_location()
-    }
-
-    fn save_to<P: AsRef<Path>>(&self, path: P) -> io::Result<()> {
-        save_formatted_config_to_file(self, path)
-    }
-}
-
 impl Config {
     pub fn new<S: AsRef<str>>(id: S) -> Self {
         Config {

clients/native/src/commands/init.rs

@@ -12,49 +12,55 @@ use crate::{
 };
 use clap::Args;
 use nym_bin_common::output_format::OutputFormat;
-use nym_client_core::cli_helpers::client_init::{
-    initialise_client, CommonClientInitArgs, InitResultsWithConfig, InitialisableClient,
-};
+use nym_client_core::client::base_client::storage::gateway_details::OnDiskGatewayDetails;
+use nym_client_core::client::key_manager::persistence::OnDiskKeys;
+use nym_client_core::config::GatewayEndpointConfig;
+use nym_client_core::error::ClientCoreError;
+use nym_client_core::init::helpers::current_gateways;
+use nym_client_core::init::types::{GatewayDetails, GatewaySelectionSpecification, GatewaySetup};
+use nym_crypto::asymmetric::identity;
+use nym_sphinx::addressing::clients::Recipient;
+use nym_topology::NymTopology;
 use serde::Serialize;
 use std::fmt::Display;
-use std::fs;
 use std::net::IpAddr;
 use std::path::PathBuf;
-
-struct NativeClientInit;
-
-impl InitialisableClient for NativeClientInit {
-    const NAME: &'static str = "native";
-    type Error = ClientError;
-    type InitArgs = Init;
-    type Config = Config;
-
-    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
-        try_upgrade_config(id)
-    }
-
-    fn initialise_storage_paths(id: &str) -> Result<(), Self::Error> {
-        fs::create_dir_all(default_data_directory(id))?;
-        fs::create_dir_all(default_config_directory(id))?;
-        Ok(())
-    }
-
-    fn default_config_path(id: &str) -> PathBuf {
-        default_config_filepath(id)
-    }
-
-    fn construct_config(init_args: &Self::InitArgs) -> Self::Config {
-        override_config(
-            Config::new(&init_args.common_args.id),
-            OverrideConfig::from(init_args.clone()),
-        )
-    }
-}
+use std::{fs, io};
+use tap::TapFallible;
 
 #[derive(Args, Clone)]
 pub(crate) struct Init {
-    #[command(flatten)]
-    common_args: CommonClientInitArgs,
+    /// Id of the nym-mixnet-client we want to create config for.
+    #[clap(long)]
+    id: String,
+
+    /// Id of the gateway we are going to connect to.
+    #[clap(long)]
+    gateway: Option<identity::PublicKey>,
+
+    /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
+    /// uniformly.
+    #[clap(long, conflicts_with = "gateway")]
+    latency_based_selection: bool,
+
+    /// Force register gateway. WARNING: this will overwrite any existing keys for the given id,
+    /// potentially causing loss of access.
+    #[clap(long)]
+    force_register_gateway: bool,
+
+    /// Comma separated list of rest endpoints of the nyxd validators
+    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
+    nyxd_urls: Option<Vec<url::Url>>,
+
+    /// Comma separated list of rest endpoints of the API validators
+    #[clap(
+        long,
+        alias = "api_validators",
+        value_delimiter = ',',
+        group = "network"
+    )]
+    // the alias here is included for backwards compatibility (1.1.4 and before)
+    nym_apis: Option<Vec<url::Url>>,
 
     /// Whether to not start the websocket
     #[clap(long)]
@@ -68,28 +74,40 @@ pub(crate) struct Init {
     #[clap(long)]
     host: Option<IpAddr>,
 
+    /// Path to .json file containing custom network specification.
+    #[clap(long, group = "network", hide = true)]
+    custom_mixnet: Option<PathBuf>,
+
+    /// Mostly debug-related option to increase default traffic rate so that you would not need to
+    /// modify config post init
+    #[clap(long, hide = true)]
+    fastmode: bool,
+
+    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
+    #[clap(long, hide = true)]
+    no_cover: bool,
+
+    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
+    /// with bandwidth credential requirement.
+    #[clap(long, hide = true)]
+    enabled_credentials_mode: Option<bool>,
+
     #[clap(short, long, default_value_t = OutputFormat::default())]
     output: OutputFormat,
 }
 
-impl AsRef<CommonClientInitArgs> for Init {
-    fn as_ref(&self) -> &CommonClientInitArgs {
-        &self.common_args
-    }
-}
-
 impl From<Init> for OverrideConfig {
     fn from(init_config: Init) -> Self {
         OverrideConfig {
-            nym_apis: init_config.common_args.nym_apis,
+            nym_apis: init_config.nym_apis,
             disable_socket: init_config.disable_socket,
             port: init_config.port,
             host: init_config.host,
-            fastmode: init_config.common_args.fastmode,
-            no_cover: init_config.common_args.no_cover,
+            fastmode: init_config.fastmode,
+            no_cover: init_config.no_cover,
 
-            nyxd_urls: init_config.common_args.nyxd_urls,
-            enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
+            nyxd_urls: init_config.nyxd_urls,
+            enabled_credentials_mode: init_config.enabled_credentials_mode,
         }
     }
 }
@@ -103,11 +121,15 @@ pub struct InitResults {
 }
 
 impl InitResults {
-    fn new(res: InitResultsWithConfig<Config>) -> Self {
+    fn new(config: &Config, address: &Recipient, gateway: &GatewayEndpointConfig) -> Self {
         Self {
-            client_address: res.init_results.address.to_string(),
-            client_core: res.init_results,
-            client_listening_port: res.config.socket.listening_port,
+            client_core: nym_client_core::init::types::InitResults::new(
+                &config.base,
+                address,
+                gateway,
+            ),
+            client_listening_port: config.socket.listening_port,
+            client_address: address.to_string(),
         }
     }
 }
@@ -120,14 +142,97 @@ impl Display for InitResults {
     }
 }
 
+fn init_paths(id: &str) -> io::Result<()> {
+    fs::create_dir_all(default_data_directory(id))?;
+    fs::create_dir_all(default_config_directory(id))
+}
+
 pub(crate) async fn execute(args: Init) -> Result<(), ClientError> {
     eprintln!("Initialising client...");
 
-    let output = args.output;
-    let res = initialise_client::<NativeClientInit>(args).await?;
+    let id = &args.id;
 
-    let init_results = InitResults::new(res);
-    println!("{}", output.format(&init_results));
+    let already_init = if default_config_filepath(id).exists() {
+        // in case we're using old config, try to upgrade it
+        // (if we're using the current version, it's a no-op)
+        try_upgrade_config(id)?;
+        eprintln!("Client \"{id}\" was already initialised before");
+        true
+    } else {
+        init_paths(id)?;
+        false
+    };
+
+    // Usually you only register with the gateway on the first init, however you can force
+    // re-registering if wanted.
+    let user_wants_force_register = args.force_register_gateway;
+    if user_wants_force_register {
+        eprintln!("Instructed to force registering gateway. This will overwrite keys!");
+    }
+
+    // If the client was already initialized, don't generate new keys and don't re-register with
+    // the gateway (because this would create a new shared key).
+    // Unless the user really wants to.
+    let register_gateway = !already_init || user_wants_force_register;
+
+    // Attempt to use a user-provided gateway, if possible
+    let user_chosen_gateway_id = args.gateway;
+    let selection_spec = GatewaySelectionSpecification::new(
+        user_chosen_gateway_id.map(|id| id.to_base58_string()),
+        Some(args.latency_based_selection),
+        false,
+    );
+
+    // Load and potentially override config
+    let config = override_config(Config::new(id), OverrideConfig::from(args.clone()));
+
+    // Setup gateway by either registering a new one, or creating a new config from the selected
+    // one but with keys kept, or reusing the gateway configuration.
+    let key_store = OnDiskKeys::new(config.storage_paths.common_paths.keys.clone());
+    let details_store =
+        OnDiskGatewayDetails::new(&config.storage_paths.common_paths.gateway_details);
+
+    let available_gateways = if let Some(hardcoded_topology) = args
+        .custom_mixnet
+        .map(NymTopology::new_from_file)
+        .transpose()?
+    {
+        // hardcoded_topology
+        hardcoded_topology.get_gateways()
+    } else {
+        let mut rng = rand::thread_rng();
+        current_gateways(&mut rng, &config.base.client.nym_api_urls).await?
+    };
+
+    let gateway_setup = GatewaySetup::New {
+        specification: selection_spec,
+        available_gateways,
+        overwrite_data: register_gateway,
+    };
+
+    let init_details =
+        nym_client_core::init::setup_gateway(gateway_setup, &key_store, &details_store)
+            .await
+            .tap_err(|err| eprintln!("Failed to setup gateway\nError: {err}"))?;
+
+    let config_save_location = config.default_location();
+    config.save_to_default_location().tap_err(|_| {
+        log::error!("Failed to save the config file");
+    })?;
+    eprintln!(
+        "Saved configuration file to {}",
+        config_save_location.display()
+    );
+
+    let address = init_details.client_address()?;
+
+    eprintln!("Client configuration completed.\n");
+
+    let GatewayDetails::Configured(gateway_details) = init_details.gateway_details else {
+        return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
+    };
+    let init_results = InitResults::new(&config, &address, &gateway_details);
+    println!("{}", args.output.format(&init_results));
 
     Ok(())
 }

clients/native/src/commands/run.rs

@@ -10,14 +10,35 @@ use crate::{
 use clap::Args;
 use log::*;
 use nym_bin_common::version_checker::is_minor_version_compatible;
-use nym_client_core::cli_helpers::client_run::CommonClientRunArgs;
+use nym_crypto::asymmetric::identity;
 use std::error::Error;
 use std::net::IpAddr;
+use std::path::PathBuf;
 
 #[derive(Args, Clone)]
 pub(crate) struct Run {
-    #[command(flatten)]
-    common_args: CommonClientRunArgs,
+    /// Id of the nym-mixnet-client we want to run.
+    #[clap(long)]
+    id: String,
+
+    /// Comma separated list of rest endpoints of the nyxd validators
+    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
+    nyxd_urls: Option<Vec<url::Url>>,
+
+    /// Comma separated list of rest endpoints of the API validators
+    #[clap(
+        long,
+        alias = "api_validators",
+        value_delimiter = ',',
+        group = "network"
+    )]
+    // the alias here is included for backwards compatibility (1.1.4 and before)
+    nym_apis: Option<Vec<url::Url>>,
+
+    /// Id of the gateway we want to connect to. If overridden, it is user's responsibility to
+    /// ensure prior registration happened
+    #[clap(long)]
+    gateway: Option<identity::PublicKey>,
 
     /// Whether to not start the websocket
     #[clap(long)]
@@ -30,19 +51,37 @@ pub(crate) struct Run {
     /// Ip for the socket (if applicable) to listen for requests.
     #[clap(long)]
     host: Option<IpAddr>,
+
+    /// Path to .json file containing custom network specification.
+    #[clap(long, group = "network", hide = true)]
+    custom_mixnet: Option<PathBuf>,
+
+    /// Mostly debug-related option to increase default traffic rate so that you would not need to
+    /// modify config post init
+    #[clap(long, hide = true)]
+    fastmode: bool,
+
+    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
+    #[clap(long, hide = true)]
+    no_cover: bool,
+
+    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
+    /// with bandwidth credential requirement.
+    #[clap(long, hide = true)]
+    enabled_credentials_mode: Option<bool>,
 }
 
 impl From<Run> for OverrideConfig {
     fn from(run_config: Run) -> Self {
         OverrideConfig {
-            nym_apis: run_config.common_args.nym_apis,
+            nym_apis: run_config.nym_apis,
             disable_socket: run_config.disable_socket,
             port: run_config.port,
             host: run_config.host,
-            fastmode: run_config.common_args.fastmode,
-            no_cover: run_config.common_args.no_cover,
-            nyxd_urls: run_config.common_args.nyxd_urls,
-            enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
+            fastmode: run_config.fastmode,
+            no_cover: run_config.no_cover,
+            nyxd_urls: run_config.nyxd_urls,
+            enabled_credentials_mode: run_config.enabled_credentials_mode,
         }
     }
 }
@@ -67,9 +106,9 @@ fn version_check(cfg: &Config) -> bool {
 }
 
 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn Error + Send + Sync>> {
-    eprintln!("Starting client {}...", args.common_args.id);
+    eprintln!("Starting client {}...", args.id);
 
-    let mut config = try_load_current_config(&args.common_args.id)?;
+    let mut config = try_load_current_config(&args.id)?;
     config = override_config(config, OverrideConfig::from(args.clone()));
 
     if !version_check(&config) {
@@ -77,7 +116,7 @@ pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn Error + Send + Sync
         return Err(Box::new(ClientError::FailedLocalVersionCheck));
     }
 
-    SocketClient::new(config, args.common_args.custom_mixnet)
+    SocketClient::new(config, args.custom_mixnet)
         .run_socket_forever()
         .await
 }

clients/native/src/main.rs

@@ -22,10 +22,5 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
     }
     setup_logging();
 
-    if let Err(err) = commands::execute(args).await {
-        log::error!("{err}");
-        println!("An error occurred: {err}");
-        std::process::exit(1);
-    }
-    Ok(())
+    commands::execute(args).await
 }

clients/socks5/Cargo.toml

@@ -1,13 +1,13 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.32"
+version = "1.1.30"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"
 rust-version = "1.56"
 
 [dependencies]
-clap = { workspace = true, features = ["cargo", "derive"] }
+clap = { version = "4.0", features = ["cargo", "derive"] }
 lazy_static = "1.4.0"
 log = { workspace = true }
 pretty_env_logger = "0.4"
@@ -21,7 +21,7 @@ url = { workspace = true }
 
 # internal
 nym-bin-common = { path = "../../common/bin-common", features = ["output_format"] }
-nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage", "cli"] }
+nym-client-core = { path = "../../common/client-core", features = ["fs-surb-storage"] }
 nym-coconut-interface = { path = "../../common/coconut-interface" }
 nym-config = { path = "../../common/config" }
 nym-credentials = { path = "../../common/credentials" }

clients/socks5/src/commands/init.rs

@@ -11,50 +11,27 @@ use crate::{
 };
 use clap::Args;
 use nym_bin_common::output_format::OutputFormat;
-use nym_client_core::cli_helpers::client_init::{
-    initialise_client, CommonClientInitArgs, InitResultsWithConfig, InitialisableClient,
-};
+use nym_client_core::client::base_client::storage::gateway_details::OnDiskGatewayDetails;
+use nym_client_core::client::key_manager::persistence::OnDiskKeys;
+use nym_client_core::config::GatewayEndpointConfig;
+use nym_client_core::error::ClientCoreError;
+use nym_client_core::init::helpers::current_gateways;
+use nym_client_core::init::types::{GatewayDetails, GatewaySelectionSpecification, GatewaySetup};
+use nym_crypto::asymmetric::identity;
 use nym_sphinx::addressing::clients::Recipient;
+use nym_topology::NymTopology;
 use serde::Serialize;
 use std::fmt::Display;
-use std::fs;
 use std::net::{IpAddr, SocketAddr};
 use std::path::PathBuf;
-
-struct Socks5ClientInit;
-
-impl InitialisableClient for Socks5ClientInit {
-    const NAME: &'static str = "socks5";
-    type Error = Socks5ClientError;
-    type InitArgs = Init;
-    type Config = Config;
-
-    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error> {
-        try_upgrade_config(id)
-    }
-
-    fn initialise_storage_paths(id: &str) -> Result<(), Self::Error> {
-        fs::create_dir_all(default_data_directory(id))?;
-        fs::create_dir_all(default_config_directory(id))?;
-        Ok(())
-    }
-
-    fn default_config_path(id: &str) -> PathBuf {
-        default_config_filepath(id)
-    }
-
-    fn construct_config(init_args: &Self::InitArgs) -> Self::Config {
-        override_config(
-            Config::new(&init_args.common_args.id, &init_args.provider.to_string()),
-            OverrideConfig::from(init_args.clone()),
-        )
-    }
-}
+use std::{fs, io};
+use tap::TapFallible;
 
 #[derive(Args, Clone)]
 pub(crate) struct Init {
-    #[command(flatten)]
-    common_args: CommonClientInitArgs,
+    /// Id of the nym-mixnet-client we want to create config for.
+    #[clap(long)]
+    id: String,
 
     /// Address of the socks5 provider to send messages to.
     #[clap(long)]
@@ -69,6 +46,34 @@ pub(crate) struct Init {
     #[clap(long, alias = "use_anonymous_sender_tag")]
     use_reply_surbs: Option<bool>,
 
+    /// Id of the gateway we are going to connect to.
+    #[clap(long)]
+    gateway: Option<identity::PublicKey>,
+
+    /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
+    /// uniformly.
+    #[clap(long, conflicts_with = "gateway")]
+    latency_based_selection: bool,
+
+    /// Force register gateway. WARNING: this will overwrite any existing keys for the given id,
+    /// potentially causing loss of access.
+    #[clap(long)]
+    force_register_gateway: bool,
+
+    /// Comma separated list of rest endpoints of the nyxd validators
+    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
+    nyxd_urls: Option<Vec<url::Url>>,
+
+    /// Comma separated list of rest endpoints of the API validators
+    #[clap(
+        long,
+        alias = "api_validators",
+        value_delimiter = ',',
+        group = "network"
+    )]
+    // the alias here is included for backwards compatibility (1.1.4 and before)
+    nym_apis: Option<Vec<url::Url>>,
+
     /// Port for the socket to listen on in all subsequent runs
     #[clap(short, long)]
     port: Option<u16>,
@@ -77,29 +82,41 @@ pub(crate) struct Init {
     #[clap(long)]
     host: Option<IpAddr>,
 
+    /// Path to .json file containing custom network specification.
+    #[clap(long, group = "network", hide = true)]
+    custom_mixnet: Option<PathBuf>,
+
+    /// Mostly debug-related option to increase default traffic rate so that you would not need to
+    /// modify config post init
+    #[clap(long, hide = true)]
+    fastmode: bool,
+
+    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
+    #[clap(long, hide = true)]
+    no_cover: bool,
+
+    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
+    /// with bandwidth credential requirement.
+    #[clap(long, hide = true)]
+    enabled_credentials_mode: Option<bool>,
+
     #[clap(short, long, default_value_t = OutputFormat::default())]
     output: OutputFormat,
 }
 
-impl AsRef<CommonClientInitArgs> for Init {
-    fn as_ref(&self) -> &CommonClientInitArgs {
-        &self.common_args
-    }
-}
-
 impl From<Init> for OverrideConfig {
     fn from(init_config: Init) -> Self {
         OverrideConfig {
-            nym_apis: init_config.common_args.nym_apis,
+            nym_apis: init_config.nym_apis,
             ip: init_config.host,
             port: init_config.port,
             use_anonymous_replies: init_config.use_reply_surbs,
-            fastmode: init_config.common_args.fastmode,
-            no_cover: init_config.common_args.no_cover,
+            fastmode: init_config.fastmode,
+            no_cover: init_config.no_cover,
             geo_routing: None,
             medium_toggle: false,
-            nyxd_urls: init_config.common_args.nyxd_urls,
-            enabled_credentials_mode: init_config.common_args.enabled_credentials_mode,
+            nyxd_urls: init_config.nyxd_urls,
+            enabled_credentials_mode: init_config.enabled_credentials_mode,
             outfox: false,
         }
     }
@@ -114,11 +131,15 @@ pub struct InitResults {
 }
 
 impl InitResults {
-    fn new(res: InitResultsWithConfig<Config>) -> Self {
+    fn new(config: &Config, address: &Recipient, gateway: &GatewayEndpointConfig) -> Self {
         Self {
-            client_address: res.init_results.address.to_string(),
-            client_core: res.init_results,
-            socks5_listening_address: res.config.core.socks5.bind_adddress,
+            client_core: nym_client_core::init::types::InitResults::new(
+                &config.core.base,
+                address,
+                gateway,
+            ),
+            socks5_listening_address: config.core.socks5.bind_adddress,
+            client_address: address.to_string(),
         }
     }
 }
@@ -135,14 +156,101 @@ impl Display for InitResults {
     }
 }
 
+fn init_paths(id: &str) -> io::Result<()> {
+    fs::create_dir_all(default_data_directory(id))?;
+    fs::create_dir_all(default_config_directory(id))
+}
+
 pub(crate) async fn execute(args: Init) -> Result<(), Socks5ClientError> {
     eprintln!("Initialising client...");
 
-    let output = args.output;
-    let res = initialise_client::<Socks5ClientInit>(args).await?;
+    let id = &args.id;
+    let provider_address = &args.provider;
 
-    let init_results = InitResults::new(res);
-    println!("{}", output.format(&init_results));
+    let already_init = if default_config_filepath(id).exists() {
+        // in case we're using old config, try to upgrade it
+        // (if we're using the current version, it's a no-op)
+        try_upgrade_config(id)?;
+        eprintln!("SOCKS5 client \"{id}\" was already initialised before");
+        true
+    } else {
+        init_paths(id)?;
+        false
+    };
+
+    // Usually you only register with the gateway on the first init, however you can force
+    // re-registering if wanted.
+    let user_wants_force_register = args.force_register_gateway;
+    if user_wants_force_register {
+        eprintln!("Instructed to force registering gateway. This might overwrite keys!");
+    }
+
+    // If the client was already initialized, don't generate new keys and don't re-register with
+    // the gateway (because this would create a new shared key).
+    // Unless the user really wants to.
+    let register_gateway = !already_init || user_wants_force_register;
+
+    // Attempt to use a user-provided gateway, if possible
+    let user_chosen_gateway_id = args.gateway;
+    let selection_spec = GatewaySelectionSpecification::new(
+        user_chosen_gateway_id.map(|id| id.to_base58_string()),
+        Some(args.latency_based_selection),
+        false,
+    );
+
+    // Load and potentially override config
+    let config = override_config(
+        Config::new(id, &provider_address.to_string()),
+        OverrideConfig::from(args.clone()),
+    );
+
+    // Setup gateway by either registering a new one, or creating a new config from the selected
+    // one but with keys kept, or reusing the gateway configuration.
+    let key_store = OnDiskKeys::new(config.storage_paths.common_paths.keys.clone());
+    let details_store =
+        OnDiskGatewayDetails::new(&config.storage_paths.common_paths.gateway_details);
+
+    let available_gateways = if let Some(hardcoded_topology) = args
+        .custom_mixnet
+        .map(NymTopology::new_from_file)
+        .transpose()?
+    {
+        // hardcoded_topology
+        hardcoded_topology.get_gateways()
+    } else {
+        let mut rng = rand::thread_rng();
+        current_gateways(&mut rng, &config.core.base.client.nym_api_urls).await?
+    };
+
+    let gateway_setup = GatewaySetup::New {
+        specification: selection_spec,
+        available_gateways,
+        overwrite_data: register_gateway,
+    };
+
+    let init_details =
+        nym_client_core::init::setup_gateway(gateway_setup, &key_store, &details_store)
+            .await
+            .tap_err(|err| eprintln!("Failed to setup gateway\nError: {err}"))?;
+
+    // TODO: ask the service provider we specified for its interface version and set it in the config
+
+    let config_save_location = config.default_location();
+    config.save_to_default_location().tap_err(|_| {
+        log::error!("Failed to save the config file");
+    })?;
+    eprintln!(
+        "Saved configuration file to {}",
+        config_save_location.display()
+    );
+
+    let address = init_details.client_address()?;
+
+    let GatewayDetails::Configured(gateway_details) = init_details.gateway_details else {
+        return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
+    };
+    let init_results = InitResults::new(&config, &address, &gateway_details);
+    println!("{}", args.output.format(&init_results));
 
     Ok(())
 }

clients/socks5/src/commands/run.rs

@@ -10,17 +10,19 @@ use crate::{
 use clap::Args;
 use log::*;
 use nym_bin_common::version_checker::is_minor_version_compatible;
-use nym_client_core::cli_helpers::client_run::CommonClientRunArgs;
 use nym_client_core::client::base_client::storage::OnDiskPersistent;
 use nym_client_core::client::topology_control::geo_aware_provider::CountryGroup;
+use nym_crypto::asymmetric::identity;
 use nym_socks5_client_core::NymClient;
 use nym_sphinx::addressing::clients::Recipient;
 use std::net::IpAddr;
+use std::path::PathBuf;
 
 #[derive(Args, Clone)]
 pub(crate) struct Run {
-    #[command(flatten)]
-    common_args: CommonClientRunArgs,
+    /// Id of the nym-mixnet-client we want to run.
+    #[clap(long)]
+    id: String,
 
     /// Specifies whether this client is going to use an anonymous sender tag for communication with the service provider.
     /// While this is going to hide its actual address information, it will make the actual communication
@@ -35,6 +37,19 @@ pub(crate) struct Run {
     #[clap(long)]
     provider: Option<Recipient>,
 
+    /// Id of the gateway we want to connect to. If overridden, it is user's responsibility to
+    /// ensure prior registration happened
+    #[clap(long)]
+    gateway: Option<identity::PublicKey>,
+
+    /// Comma separated list of rest endpoints of the nyxd validators
+    #[clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)]
+    nyxd_urls: Option<Vec<url::Url>>,
+
+    /// Comma separated list of rest endpoints of the Nym APIs
+    #[clap(long, value_delimiter = ',', group = "network")]
+    nym_apis: Option<Vec<url::Url>>,
+
     /// Port for the socket to listen on
     #[clap(short, long)]
     port: Option<u16>,
@@ -43,6 +58,19 @@ pub(crate) struct Run {
     #[clap(long)]
     host: Option<IpAddr>,
 
+    /// Path to .json file containing custom network specification.
+    #[clap(long, group = "network", group = "routing", hide = true)]
+    custom_mixnet: Option<PathBuf>,
+
+    /// Mostly debug-related option to increase default traffic rate so that you would not need to
+    /// modify config post init
+    #[clap(long, hide = true)]
+    fastmode: bool,
+
+    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
+    #[clap(long, hide = true)]
+    no_cover: bool,
+
     /// Set geo-aware mixnode selection when sending mixnet traffic, for experiments only.
     #[clap(long, hide = true, value_parser = validate_country_group, group="routing")]
     geo_routing: Option<CountryGroup>,
@@ -52,6 +80,11 @@ pub(crate) struct Run {
     #[clap(long, hide = true)]
     medium_toggle: bool,
 
+    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
+    /// with bandwidth credential requirement.
+    #[clap(long, hide = true)]
+    enabled_credentials_mode: Option<bool>,
+
     #[clap(long, hide = true, action)]
     outfox: bool,
 }
@@ -59,16 +92,16 @@ pub(crate) struct Run {
 impl From<Run> for OverrideConfig {
     fn from(run_config: Run) -> Self {
         OverrideConfig {
-            nym_apis: run_config.common_args.nym_apis,
+            nym_apis: run_config.nym_apis,
             ip: run_config.host,
             port: run_config.port,
             use_anonymous_replies: run_config.use_anonymous_replies,
-            fastmode: run_config.common_args.fastmode,
-            no_cover: run_config.common_args.no_cover,
+            fastmode: run_config.fastmode,
+            no_cover: run_config.no_cover,
             geo_routing: run_config.geo_routing,
             medium_toggle: run_config.medium_toggle,
-            nyxd_urls: run_config.common_args.nyxd_urls,
-            enabled_credentials_mode: run_config.common_args.enabled_credentials_mode,
+            nyxd_urls: run_config.nyxd_urls,
+            enabled_credentials_mode: run_config.enabled_credentials_mode,
             outfox: run_config.outfox,
         }
     }
@@ -103,9 +136,9 @@ fn version_check(cfg: &Config) -> bool {
 }
 
 pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
-    eprintln!("Starting client {}...", args.common_args.id);
+    eprintln!("Starting client {}...", args.id);
 
-    let mut config = try_load_current_config(&args.common_args.id)?;
+    let mut config = try_load_current_config(&args.id)?;
     config = override_config(config, OverrideConfig::from(args.clone()));
 
     if !version_check(&config) {
@@ -116,7 +149,7 @@ pub(crate) async fn execute(args: Run) -> Result<(), Box<dyn std::error::Error +
     let storage =
         OnDiskPersistent::from_paths(config.storage_paths.common_paths, &config.core.base.debug)
             .await?;
-    NymClient::new(config.core, storage, args.common_args.custom_mixnet)
+    NymClient::new(config.core, storage, args.custom_mixnet)
         .run_forever()
         .await
 }

clients/socks5/src/config/mod.rs

@@ -3,8 +3,6 @@
 
 use crate::config::template::CONFIG_TEMPLATE;
 use nym_bin_common::logging::LoggingSettings;
-use nym_client_core::cli_helpers::client_init::ClientConfig;
-use nym_client_core::config::disk_persistence::CommonClientPaths;
 use nym_config::{
     must_get_home, read_config_from_toml_file, save_formatted_config_to_file, NymConfigTemplate,
     DEFAULT_CONFIG_DIR, DEFAULT_CONFIG_FILENAME, DEFAULT_DATA_DIR, NYM_DIR,
@@ -71,24 +69,6 @@ impl NymConfigTemplate for Config {
     }
 }
 
-impl ClientConfig for Config {
-    fn common_paths(&self) -> &CommonClientPaths {
-        &self.storage_paths.common_paths
-    }
-
-    fn core_config(&self) -> &BaseClientConfig {
-        &self.core.base
-    }
-
-    fn default_store_location(&self) -> PathBuf {
-        self.default_location()
-    }
-
-    fn save_to<P: AsRef<Path>>(&self, path: P) -> io::Result<()> {
-        save_formatted_config_to_file(self, path)
-    }
-}
-
 impl Config {
     pub fn new<S: AsRef<str>>(id: S, provider_mix_address: S) -> Self {
         Config {

clients/socks5/src/main.rs

@@ -21,10 +21,5 @@ async fn main() -> Result<(), Box<dyn Error + Send + Sync>> {
     }
     setup_logging();
 
-    if let Err(err) = commands::execute(args).await {
-        log::error!("{err}");
-        println!("An error occurred: {err}");
-        std::process::exit(1);
-    }
-    Ok(())
+    commands::execute(args).await
 }

common/bin-common/Cargo.toml

@@ -9,7 +9,7 @@ repository = { workspace = true }
 
 [dependencies]
 atty = "0.2"
-clap = { workspace = true, features = ["derive"] }
+clap = { version = "4.0", features = ["derive"] }
 clap_complete = "4.0"
 clap_complete_fig = "4.0"
 log = { workspace = true }

common/client-core/Cargo.toml

@@ -11,7 +11,6 @@ rust-version = "1.66"
 async-trait = { workspace = true }
 base64 = "0.21.2"
 cfg-if = "1.0.0"
-clap = { workspace = true, optional = true }
 dashmap = { workspace = true }
 dirs = "4.0"
 futures = { workspace = true }
@@ -93,7 +92,6 @@ sqlx = { version = "0.6.2", features = ["runtime-tokio-rustls", "sqlite", "macro
 
 [features]
 default = []
-cli = ["clap"]
 fs-surb-storage = ["sqlx"]
 wasm = ["nym-gateway-client/wasm"]
 

common/client-core/src/cli_helpers/client_init.rs

@@ -1,210 +0,0 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::config::disk_persistence::CommonClientPaths;
-use crate::error::ClientCoreError;
-use crate::{
-    client::{
-        base_client::storage::gateway_details::OnDiskGatewayDetails,
-        key_manager::persistence::OnDiskKeys,
-    },
-    init::types::{GatewayDetails, GatewaySelectionSpecification, GatewaySetup, InitResults},
-};
-use log::info;
-use nym_crypto::asymmetric::identity;
-use nym_topology::NymTopology;
-use std::path::{Path, PathBuf};
-
-pub trait InitialisableClient {
-    const NAME: &'static str;
-    type Error: From<ClientCoreError>;
-    type InitArgs: AsRef<CommonClientInitArgs>;
-    type Config: ClientConfig;
-
-    fn try_upgrade_outdated_config(id: &str) -> Result<(), Self::Error>;
-
-    fn initialise_storage_paths(id: &str) -> Result<(), Self::Error>;
-
-    fn default_config_path(id: &str) -> PathBuf;
-
-    fn construct_config(init_args: &Self::InitArgs) -> Self::Config;
-}
-
-pub trait ClientConfig {
-    fn common_paths(&self) -> &CommonClientPaths;
-
-    fn core_config(&self) -> &crate::config::Config;
-
-    fn default_store_location(&self) -> PathBuf;
-
-    fn save_to<P: AsRef<Path>>(&self, path: P) -> std::io::Result<()>;
-}
-
-#[cfg_attr(feature = "cli", derive(clap::Args))]
-#[derive(Debug, Clone)]
-pub struct CommonClientInitArgs {
-    /// Id of client we want to create config for.
-    #[cfg_attr(feature = "cli", clap(long))]
-    pub id: String,
-
-    /// Id of the gateway we are going to connect to.
-    #[cfg_attr(feature = "cli", clap(long))]
-    pub gateway: Option<identity::PublicKey>,
-
-    /// Specifies whether the new gateway should be determined based by latency as opposed to being chosen
-    /// uniformly.
-    #[cfg_attr(feature = "cli", clap(long, conflicts_with = "gateway"))]
-    pub latency_based_selection: bool,
-
-    /// Force register gateway. WARNING: this will overwrite any existing keys for the given id,
-    /// potentially causing loss of access.
-    #[cfg_attr(feature = "cli", clap(long))]
-    pub force_register_gateway: bool,
-
-    /// Comma separated list of rest endpoints of the nyxd validators
-    #[cfg_attr(
-        feature = "cli",
-        clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)
-    )]
-    pub nyxd_urls: Option<Vec<url::Url>>,
-
-    /// Comma separated list of rest endpoints of the API validators
-    #[cfg_attr(
-        feature = "cli",
-        clap(
-            long,
-            alias = "api_validators",
-            value_delimiter = ',',
-            group = "network"
-        )
-    )]
-    pub nym_apis: Option<Vec<url::Url>>,
-
-    /// Path to .json file containing custom network specification.
-    #[cfg_attr(feature = "cli", clap(long, group = "network", hide = true))]
-    pub custom_mixnet: Option<PathBuf>,
-
-    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
-    /// with bandwidth credential requirement.
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub enabled_credentials_mode: Option<bool>,
-
-    /// Mostly debug-related option to increase default traffic rate so that you would not need to
-    /// modify config post init
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub fastmode: bool,
-
-    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub no_cover: bool,
-}
-
-pub struct InitResultsWithConfig<T> {
-    pub config: T,
-    pub init_results: InitResults,
-}
-
-pub async fn initialise_client<C>(
-    init_args: C::InitArgs,
-) -> Result<InitResultsWithConfig<C::Config>, C::Error>
-where
-    C: InitialisableClient,
-{
-    info!("initialising {} client", C::NAME);
-
-    let common_args = init_args.as_ref();
-    let id = &common_args.id;
-
-    let already_init = if C::default_config_path(id).exists() {
-        // in case we're using old config, try to upgrade it
-        // (if we're using the current version, it's a no-op)
-        C::try_upgrade_outdated_config(id)?;
-        eprintln!("{} client \"{id}\" was already initialised before", C::NAME);
-        true
-    } else {
-        C::initialise_storage_paths(id)?;
-        false
-    };
-
-    // Usually you only register with the gateway on the first init, however you can force
-    // re-registering if wanted.
-    let user_wants_force_register = common_args.force_register_gateway;
-    if user_wants_force_register {
-        eprintln!("Instructed to force registering gateway. This might overwrite keys!");
-    }
-
-    // If the client was already initialized, don't generate new keys and don't re-register with
-    // the gateway (because this would create a new shared key).
-    // Unless the user really wants to.
-    let register_gateway = !already_init || user_wants_force_register;
-
-    // Attempt to use a user-provided gateway, if possible
-    let user_chosen_gateway_id = common_args.gateway;
-    let selection_spec = GatewaySelectionSpecification::new(
-        user_chosen_gateway_id.map(|id| id.to_base58_string()),
-        Some(common_args.latency_based_selection),
-        false,
-    );
-
-    // Load and potentially override config
-    let config = C::construct_config(&init_args);
-    let paths = config.common_paths();
-    let core = config.core_config();
-
-    // Setup gateway by either registering a new one, or creating a new config from the selected
-    // one but with keys kept, or reusing the gateway configuration.
-    let key_store = OnDiskKeys::new(paths.keys.clone());
-    let details_store = OnDiskGatewayDetails::new(&paths.gateway_details);
-
-    let available_gateways = if let Some(custom_mixnet) = common_args.custom_mixnet.as_ref() {
-        let hardcoded_topology = NymTopology::new_from_file(custom_mixnet).map_err(|source| {
-            ClientCoreError::CustomTopologyLoadFailure {
-                file_path: custom_mixnet.clone(),
-                source,
-            }
-        })?;
-        hardcoded_topology.get_gateways()
-    } else {
-        let mut rng = rand::thread_rng();
-        crate::init::helpers::current_gateways(&mut rng, &core.client.nym_api_urls).await?
-    };
-
-    let gateway_setup = GatewaySetup::New {
-        specification: selection_spec,
-        available_gateways,
-        overwrite_data: register_gateway,
-    };
-
-    let init_details =
-        crate::init::setup_gateway(gateway_setup, &key_store, &details_store).await?;
-
-    // TODO: ask the service provider we specified for its interface version and set it in the config
-
-    let config_save_location = config.default_store_location();
-    if let Err(err) = config.save_to(&config_save_location) {
-        return Err(ClientCoreError::ConfigSaveFailure {
-            typ: C::NAME.to_string(),
-            id: id.to_string(),
-            path: config_save_location,
-            source: err,
-        }
-        .into());
-    }
-
-    eprintln!(
-        "Saved configuration file to {}",
-        config_save_location.display()
-    );
-
-    let address = init_details.client_address()?;
-
-    let GatewayDetails::Configured(gateway_details) = init_details.gateway_details else {
-        return Err(ClientCoreError::UnexpectedPersistedCustomGatewayDetails)?;
-    };
-    let init_results = InitResults::new(config.core_config(), address, &gateway_details);
-
-    Ok(InitResultsWithConfig {
-        config,
-        init_results,
-    })
-}

common/client-core/src/cli_helpers/client_run.rs

@@ -1,59 +0,0 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use nym_crypto::asymmetric::identity;
-use std::path::PathBuf;
-
-#[cfg_attr(feature = "cli", derive(clap::Args))]
-#[derive(Debug, Clone)]
-pub struct CommonClientRunArgs {
-    /// Id of client we want to create config for.
-    #[cfg_attr(feature = "cli", clap(long))]
-    pub id: String,
-
-    /// Id of the gateway we want to connect to. If overridden, it is user's responsibility to
-    /// ensure prior registration happened
-    #[cfg_attr(feature = "cli", clap(long))]
-    pub gateway: Option<identity::PublicKey>,
-
-    /// Comma separated list of rest endpoints of the nyxd validators
-    #[cfg_attr(
-        feature = "cli",
-        clap(long, alias = "nyxd_validators", value_delimiter = ',', hide = true)
-    )]
-    pub nyxd_urls: Option<Vec<url::Url>>,
-
-    /// Comma separated list of rest endpoints of the API validators
-    #[cfg_attr(
-        feature = "cli",
-        clap(
-            long,
-            alias = "api_validators",
-            value_delimiter = ',',
-            group = "network"
-        )
-    )]
-    pub nym_apis: Option<Vec<url::Url>>,
-
-    /// Path to .json file containing custom network specification.
-    #[cfg_attr(feature = "cli", clap(long, group = "network", hide = true))]
-    pub custom_mixnet: Option<PathBuf>,
-
-    /// Set this client to work in a enabled credentials mode that would attempt to use gateway
-    /// with bandwidth credential requirement.
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub enabled_credentials_mode: Option<bool>,
-
-    /// Mostly debug-related option to increase default traffic rate so that you would not need to
-    /// modify config post init
-    // note: we removed the 'conflicts_with = medium_toggle', but that's fine since NR
-    // has defined the conflict on that field itself
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub fastmode: bool,
-
-    /// Disable loop cover traffic and the Poisson rate limiter (for debugging only)
-    // note: we removed the 'conflicts_with = medium_toggle', but that's fine since NR
-    // has defined the conflict on that field itself
-    #[cfg_attr(feature = "cli", clap(long, hide = true))]
-    pub no_cover: bool,
-}

common/client-core/src/cli_helpers/mod.rs

@@ -1,5 +0,0 @@
-// Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-pub mod client_init;
-pub mod client_run;

common/client-core/src/client/base_client/storage/gateway_details.rs

@@ -77,7 +77,7 @@ pub struct PersistedGatewayConfig {
     key_hash: Vec<u8>,
 
     /// Actual gateway details being persisted.
-    pub details: GatewayEndpointConfig,
+    pub(crate) details: GatewayEndpointConfig,
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]

common/client-core/src/client/real_messages_control/acknowledgement_control/action_controller.rs

@@ -263,7 +263,7 @@ impl ActionController {
     pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
         debug!("Started ActionController with graceful shutdown support");
 
-        loop {
+        while !shutdown.is_shutdown() {
             tokio::select! {
                 action = self.incoming_actions.next() => match action {
                     Some(action) => self.process_action(action),
@@ -283,7 +283,6 @@ impl ActionController {
                 },
                 _ = shutdown.recv_with_delay() => {
                     log::trace!("ActionController: Received shutdown");
-                    break;
                 }
             }
         }

common/client-core/src/client/real_messages_control/acknowledgement_control/sent_notification_listener.rs

@@ -40,7 +40,7 @@ impl SentNotificationListener {
     pub(super) async fn run_with_shutdown(&mut self, mut shutdown: nym_task::TaskClient) {
         debug!("Started SentNotificationListener with graceful shutdown support");
 
-        loop {
+        while !shutdown.is_shutdown() {
             tokio::select! {
                 frag_id = self.sent_notifier.next() => match frag_id {
                     Some(frag_id) => {
@@ -53,7 +53,6 @@ impl SentNotificationListener {
                 },
                 _ = shutdown.recv_with_delay() => {
                     log::trace!("SentNotificationListener: Received shutdown");
-                    break;
                 }
             }
         }

common/client-core/src/client/real_messages_control/real_traffic_stream.rs

@@ -500,12 +500,11 @@ where
         {
             let mut status_timer = tokio::time::interval(Duration::from_secs(5));
 
-            loop {
+            while !shutdown.is_shutdown() {
                 tokio::select! {
                     biased;
                     _ = shutdown.recv_with_delay() => {
                         log::trace!("OutQueueControl: Received shutdown");
-                        break;
                     }
                     _ = status_timer.tick() => {
                         self.log_status(&mut shutdown);

common/client-core/src/client/replies/reply_storage/mod.rs

@@ -39,7 +39,7 @@ where
         mem_state: CombinedReplyStorage,
         mut shutdown: nym_task::TaskClient,
     ) {
-        use log::{debug, error, info};
+        use log::{debug, error, info, warn};
 
         debug!("Started PersistentReplyStorage");
         if let Err(err) = self.backend.start_storage_session().await {
@@ -50,7 +50,7 @@ where
         shutdown.recv().await;
 
         info!("PersistentReplyStorage is flushing all reply-related data to underlying storage");
-        info!("you MUST NOT forcefully shutdown now or you risk data corruption!");
+        warn!("you MUST NOT forcefully shutdown now or you risk data corruption!");
         if let Err(err) = self.backend.flush_surb_storage(&mem_state).await {
             error!("failed to flush our reply-related data to the persistent storage: {err}")
         } else {

common/client-core/src/error.rs

@@ -8,41 +8,40 @@ use nym_topology::gateway::GatewayConversionError;
 use nym_topology::NymTopologyError;
 use nym_validator_client::ValidatorClientError;
 use std::error::Error;
-use std::path::PathBuf;
 
 #[derive(thiserror::Error, Debug)]
 pub enum ClientCoreError {
     #[error("I/O error: {0}")]
     IoError(#[from] std::io::Error),
 
-    #[error("gateway client error ({gateway_id}): {source}")]
+    #[error("Gateway client error ({gateway_id}): {source}")]
     GatewayClientError {
         gateway_id: String,
         source: GatewayClientError,
     },
 
-    #[error("custom gateway client error: {source}")]
+    #[error("Custom gateway client error: {source}")]
     ErasedGatewayClientError {
         #[from]
         source: ErasedGatewayError,
     },
 
-    #[error("ed25519 error: {0}")]
+    #[error("Ed25519 error: {0}")]
     Ed25519RecoveryError(#[from] Ed25519RecoveryError),
 
-    #[error("validator client error: {0}")]
+    #[error("Validator client error: {0}")]
     ValidatorClientError(#[from] ValidatorClientError),
 
-    #[error("no gateway with id: {0}")]
+    #[error("No gateway with id: {0}")]
     NoGatewayWithId(String),
 
-    #[error("no gateways on network")]
+    #[error("No gateways on network")]
     NoGatewaysOnNetwork,
 
-    #[error("list of nym apis is empty")]
+    #[error("List of nym apis is empty")]
     ListOfNymApisIsEmpty,
 
-    #[error("the current network topology seem to be insufficient to route any packets through")]
+    #[error("The current network topology seem to be insufficient to route any packets through")]
     InsufficientNetworkTopology(#[from] NymTopologyError),
 
     #[error("experienced a failure with our reply surb persistent storage: {source}")]
@@ -60,7 +59,7 @@ pub enum ClientCoreError {
         source: Box<dyn Error + Send + Sync>,
     },
 
-    #[error("the gateway id is invalid - {0}")]
+    #[error("The gateway id is invalid - {0}")]
     UnableToCreatePublicKeyFromGatewayId(Ed25519RecoveryError),
 
     #[error("The gateway is malformed: {source}")]
@@ -79,23 +78,23 @@ pub enum ClientCoreError {
     #[error("failed to establish gateway connection (wasm)")]
     GatewayJsConnectionFailure,
 
-    #[error("gateway connection was abruptly closed")]
+    #[error("Gateway connection was abruptly closed")]
     GatewayConnectionAbruptlyClosed,
 
-    #[error("timed out while trying to establish gateway connection")]
+    #[error("Timed out while trying to establish gateway connection")]
     GatewayConnectionTimeout,
 
-    #[error("no ping measurements for the gateway ({identity}) performed")]
+    #[error("No ping measurements for the gateway ({identity}) performed")]
     NoGatewayMeasurements { identity: String },
 
     #[error("failed to register receiver for reconstructed mixnet messages")]
     FailedToRegisterReceiver,
 
-    #[error("unexpected exit")]
+    #[error("Unexpected exit")]
     UnexpectedExit,
 
     #[error(
-        "this operation would have resulted in clients keys being overwritten without permission"
+        "This operation would have resulted in clients keys being overwritten without permission"
     )]
     ForbiddenKeyOverwrite,
 
@@ -133,26 +132,6 @@ pub enum ClientCoreError {
 
     #[error("the specified gateway '{gateway}' does not support the wss protocol")]
     UnsupportedWssProtocol { gateway: String },
-
-    #[error(
-    "failed to load custom topology using path '{}'. detailed message: {source}", file_path.display()
-    )]
-    CustomTopologyLoadFailure {
-        file_path: PathBuf,
-        #[source]
-        source: std::io::Error,
-    },
-
-    #[error(
-    "failed to save config file for client-{typ} id {id} using path '{}'. detailed message: {source}", path.display()
-    )]
-    ConfigSaveFailure {
-        typ: String,
-        id: String,
-        path: PathBuf,
-        #[source]
-        source: std::io::Error,
-    },
 }
 
 /// Set of messages that the client can send to listeners via the task manager

common/client-core/src/init/helpers.rs

@@ -68,23 +68,13 @@ pub async fn current_gateways<R: Rng>(
     log::trace!("Fetching list of gateways from: {nym_api}");
 
     let gateways = client.get_cached_described_gateways().await?;
-    log::debug!("Found {} gateways", gateways.len());
-    log::trace!("Gateways: {:#?}", gateways);
-
     let valid_gateways = gateways
         .into_iter()
         .filter_map(|gateway| gateway.try_into().ok())
         .collect::<Vec<gateway::Node>>();
-    log::debug!("Ater checking validity: {}", valid_gateways.len());
-    log::trace!("Valid gateways: {:#?}", valid_gateways);
 
     // we were always filtering by version so I'm not removing that 'feature'
     let filtered_gateways = valid_gateways.filter_by_version(env!("CARGO_PKG_VERSION"));
-    log::debug!("After filtering for version: {}", filtered_gateways.len());
-    log::trace!("Filtered gateways: {:#?}", filtered_gateways);
-
-    log::info!("nym-api reports {} valid gateways", filtered_gateways.len());
-
     Ok(filtered_gateways)
 }
 

common/client-core/src/init/mod.rs

@@ -94,8 +94,6 @@ where
     D::StorageError: Send + Sync + 'static,
     T: DeserializeOwned + Serialize + Send + Sync,
 {
-    log::trace!("Setting up new gateway");
-
     // if we're setting up new gateway, failing to load existing information is fine.
     // as a matter of fact, it's only potentially a problem if we DO succeed
     if _load_gateway_details(details_store).await.is_ok() && !overwrite_data {
@@ -212,7 +210,6 @@ where
     D::StorageError: Send + Sync + 'static,
     T: DeserializeOwned + Serialize + Send + Sync,
 {
-    log::trace!("Setting up gateway");
     match setup {
         GatewaySetup::MustLoad => use_loaded_gateway_details(key_store, details_store).await,
         GatewaySetup::New {

common/client-core/src/init/types.rs

@@ -296,17 +296,16 @@ impl<T> GatewaySetup<T> {
 /// Struct describing the results of the client initialization procedure.
 #[derive(Debug, Serialize)]
 pub struct InitResults {
-    pub version: String,
-    pub id: String,
-    pub identity_key: String,
-    pub encryption_key: String,
-    pub gateway_id: String,
-    pub gateway_listener: String,
-    pub address: Recipient,
+    version: String,
+    id: String,
+    identity_key: String,
+    encryption_key: String,
+    gateway_id: String,
+    gateway_listener: String,
 }
 
 impl InitResults {
-    pub fn new(config: &Config, address: Recipient, gateway: &GatewayEndpointConfig) -> Self {
+    pub fn new(config: &Config, address: &Recipient, gateway: &GatewayEndpointConfig) -> Self {
         Self {
             version: config.client.version.clone(),
             id: config.client.id.clone(),
@@ -314,7 +313,6 @@ impl InitResults {
             encryption_key: address.encryption_key().to_base58_string(),
             gateway_id: gateway.gateway_id.clone(),
             gateway_listener: gateway.gateway_listener.clone(),
-            address,
         }
     }
 }

common/client-core/src/lib.rs

@@ -1,7 +1,5 @@
 use std::future::Future;
 
-#[cfg(not(target_arch = "wasm32"))]
-pub mod cli_helpers;
 pub mod client;
 pub mod config;
 pub mod error;

common/client-libs/validator-client/Cargo.toml

@@ -45,17 +45,13 @@ cosmrs = { workspace = true, features = ["bip32", "cosmwasm"] }
 # import it just for the `Client` trait
 tendermint-rpc = { workspace = true }
 
-# this is an extremely nasty import. we're explicitly bringing in bip32 so that via the magic (or curse, pick your poison)
-# of cargo's feature unification we'd get `bip32/std` meaning we'd get `std::error::Error` for the re-exported (via cosmrs) bip32::Error type
-bip32 = { workspace = true, default-features = false, features = ["std"] }
-
 eyre = { version = "0.6" }
 cw-utils = { workspace = true }
 cw2 = { workspace = true }
 cw3 = { workspace = true }
 cw4 = { workspace = true }
 cw-controllers = { workspace = true }
-prost = { workspace = true, default-features = false }
+prost = { version = "0.11", default-features = false }
 flate2 = { version = "1.0.20" }
 sha2 = { version = "0.9.5" }
 itertools = { version = "0.10" }

common/client-libs/validator-client/src/nyxd/cosmwasm_client/helpers.rs

@@ -20,12 +20,12 @@ impl CheckResponse for broadcast::tx_commit::Response {
             });
         }
 
-        if self.tx_result.code.is_err() {
+        if self.deliver_tx.code.is_err() {
             return Err(NyxdError::BroadcastTxErrorDeliverTx {
                 hash: self.hash,
                 height: Some(self.height),
-                code: self.tx_result.code.value(),
-                raw_log: self.tx_result.log,
+                code: self.deliver_tx.code.value(),
+                raw_log: self.deliver_tx.log,
             });
         }
 

common/client-libs/validator-client/src/nyxd/fee/mod.rs

@@ -11,7 +11,7 @@ pub mod gas_price;
 
 pub type GasAdjustment = f32;
 
-pub const DEFAULT_SIMULATED_GAS_MULTIPLIER: GasAdjustment = 1.5;
+pub const DEFAULT_SIMULATED_GAS_MULTIPLIER: GasAdjustment = 1.3;
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct AutoFeeGrant {

common/client-libs/validator-client/src/nyxd/mod.rs

@@ -34,9 +34,7 @@ pub use crate::nyxd::fee::Fee;
 pub use crate::rpc::TendermintRpcClient;
 pub use coin::Coin;
 pub use cosmrs::bank::MsgSend;
-pub use cosmrs::tendermint::abci::{
-    response::DeliverTx, types::ExecTxResult, Event, EventAttribute,
-};
+pub use cosmrs::tendermint::abci::{response::DeliverTx, Event, EventAttribute};
 pub use cosmrs::tendermint::block::Height;
 pub use cosmrs::tendermint::hash::{self, Algorithm, Hash};
 pub use cosmrs::tendermint::validator::Info as TendermintValidatorInfo;

common/client-libs/validator-client/src/rpc/mod.rs

@@ -28,7 +28,7 @@ where
     U: TryInto<HttpClientUrl, Error = Error>,
 {
     HttpRpcClient::builder(url.try_into()?)
-        .compat_mode(CompatMode::V0_37)
+        .compat_mode(CompatMode::V0_34)
         .build()
 }
 

common/client-libs/validator-client/src/rpc/reqwest.rs

@@ -36,8 +36,7 @@ pub struct ReqwestRpcClient {
 impl ReqwestRpcClient {
     pub fn new(url: Url) -> Self {
         ReqwestRpcClient {
-            // after updating to nyxd 0.42 and thus updating to cometbft, the compat mode changed
-            compat: CompatMode::V0_37,
+            compat: CompatMode::V0_34,
             inner: reqwest::Client::new(),
             url,
         }

common/commands/Cargo.toml

@@ -11,7 +11,7 @@ bip39 = { workspace = true }
 bs58 = "0.4"
 comfy-table = "6.0.0"
 cfg-if = "1.0.0"
-clap = { workspace = true, features = ["derive"] }
+clap = { version = "4.0", features = ["derive"] }
 cw-utils = { workspace = true }
 handlebars = "3.0.1"
 humantime-serde = "1.0"

common/commands/src/validator/mixnet/operators/mixnode/settings/mod.rs

@@ -4,7 +4,6 @@
 use clap::{Args, Subcommand};
 
 pub mod update_config;
-pub mod update_cost_params;
 pub mod vesting_update_config;
 
 #[derive(Debug, Args)]
@@ -21,5 +20,7 @@ pub enum MixnetOperatorsMixnodeSettingsCommands {
     /// Update mixnode configuration for a mixnode bonded with locked tokens
     VestingUpdateConfig(vesting_update_config::Args),
     /// Update mixnode cost parameters
-    UpdateCostParameters(update_cost_params::Args),
+    UpdateCostParameters,
+    /// Update mixnode cost parameters for a mixnode bonded with locked tokens
+    VestingUpdateCostParameters,
 }

common/commands/src/validator/mixnet/operators/mixnode/settings/update_cost_params.rs

@@ -1,48 +0,0 @@
-// Copyright 2021 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: Apache-2.0
-
-use crate::context::SigningClient;
-use clap::Parser;
-use cosmwasm_std::Uint128;
-use log::info;
-use nym_mixnet_contract_common::{MixNodeCostParams, Percent};
-use nym_validator_client::nyxd::contract_traits::MixnetSigningClient;
-use nym_validator_client::nyxd::CosmWasmCoin;
-
-#[derive(Debug, Parser)]
-pub struct Args {
-    #[clap(
-        long,
-        help = "input your profit margin as follows; (so it would be 10, rather than 0.1)"
-    )]
-    pub profit_margin_percent: Option<u8>,
-
-    #[clap(
-        long,
-        help = "operating cost in current DENOMINATION (so it would be 'unym', rather than 'nym')"
-    )]
-    pub interval_operating_cost: Option<u128>,
-}
-
-pub async fn update_cost_params(args: Args, client: SigningClient) {
-    let denom = client.current_chain_details().mix_denom.base.as_str();
-
-    let cost_params = MixNodeCostParams {
-        profit_margin_percent: Percent::from_percentage_value(
-            args.profit_margin_percent.unwrap_or(10) as u64,
-        )
-        .unwrap(),
-        interval_operating_cost: CosmWasmCoin {
-            denom: denom.into(),
-            amount: Uint128::new(args.interval_operating_cost.unwrap_or(40_000_000)),
-        },
-    };
-
-    info!("Starting mixnode params updating!");
-    let res = client
-        .update_mixnode_cost_params(cost_params, None)
-        .await
-        .expect("failed to update cost params");
-
-    info!("Cost params result: {:?}", res)
-}

common/config/src/lib.rs

@@ -25,20 +25,12 @@ pub const DEFAULT_CONFIG_FILENAME: &str = "config.toml";
 
 #[cfg(feature = "dirs")]
 pub fn must_get_home() -> PathBuf {
-    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
-        home_dir.into()
-    } else {
-        dirs::home_dir().expect("Failed to evaluate $HOME value")
-    }
+    dirs::home_dir().expect("Failed to evaluate $HOME value")
 }
 
 #[cfg(feature = "dirs")]
 pub fn may_get_home() -> Option<PathBuf> {
-    if let Some(home_dir) = std::env::var_os("NYM_HOME_DIR") {
-        Some(home_dir.into())
-    } else {
-        dirs::home_dir()
-    }
+    dirs::home_dir()
 }
 
 pub trait NymConfigTemplate: Serialize {

common/cosmwasm-smart-contracts/coconut-bandwidth-contract/src/spend_credential.rs

@@ -142,7 +142,7 @@ pub fn funds_from_cosmos_msgs(msgs: Vec<CosmosMsg>) -> Option<Coin> {
         contract_addr: _,
         msg,
         funds: _,
-    })) = msgs.first()
+    })) = msgs.get(0)
     {
         if let Ok(ExecuteMsg::ReleaseFunds { funds }) = from_binary::<ExecuteMsg>(msg) {
             return Some(funds);

common/cosmwasm-smart-contracts/coconut-dkg/src/verification_key.rs

@@ -62,7 +62,7 @@ pub fn owner_from_cosmos_msgs(msgs: &[CosmosMsg]) -> Option<Addr> {
         contract_addr: _,
         msg,
         funds: _,
-    })) = msgs.first()
+    })) = msgs.get(0)
     {
         if let Ok(ExecuteMsg::VerifyVerificationKeyShare { owner, .. }) =
             from_binary::<ExecuteMsg>(msg)

common/cosmwasm-smart-contracts/contracts-common/src/types.rs

@@ -3,7 +3,6 @@
 
 use cosmwasm_schema::cw_serde;
 use cosmwasm_std::Decimal;
-use cosmwasm_std::OverflowError;
 use cosmwasm_std::Uint128;
 use serde::de::Error;
 use serde::{Deserialize, Deserializer};
@@ -72,10 +71,6 @@ impl Percent {
         // we know the cast from u128 to u8 is a safe one since the internal value must be within 0 - 1 range
         truncate_decimal(hundred * self.0).u128() as u8
     }
-
-    pub fn checked_pow(&self, exp: u32) -> Result<Self, OverflowError> {
-        self.0.checked_pow(exp).map(Percent)
-    }
 }
 
 impl Display for Percent {

common/cosmwasm-smart-contracts/vesting-contract/src/account.rs

@@ -49,7 +49,7 @@ impl Account {
 
     pub fn period_duration(&self) -> Result<u64, VestingContractError> {
         self.periods
-            .first()
+            .get(0)
             .ok_or(VestingContractError::UnpopulatedVestingPeriods {
                 owner: self.owner_address.clone(),
             })

common/dkg/benches/benchmarks.rs

@@ -366,7 +366,11 @@ pub fn creating_proof_of_chunking_for_100_parties(c: &mut Criterion) {
         .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
         .collect::<Vec<_>>();
 
-    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
+    let remote_share_key_pairs = shares
+        .iter()
+        .zip(receivers.values())
+        .map(|(share, key)| (share, key))
+        .collect::<Vec<_>>();
     let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();
 
     let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
@@ -396,7 +400,11 @@ pub fn verifying_proof_of_chunking_for_100_parties(c: &mut Criterion) {
         .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
         .collect::<Vec<_>>();
 
-    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
+    let remote_share_key_pairs = shares
+        .iter()
+        .zip(receivers.values())
+        .map(|(share, key)| (share, key))
+        .collect::<Vec<_>>();
     let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();
 
     let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
@@ -428,7 +436,11 @@ pub fn creating_proof_of_secret_sharing_for_100_parties(c: &mut Criterion) {
         .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
         .collect::<Vec<_>>();
 
-    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
+    let remote_share_key_pairs = shares
+        .iter()
+        .zip(receivers.values())
+        .map(|(share, key)| (share, key))
+        .collect::<Vec<_>>();
 
     let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
 
@@ -466,7 +478,11 @@ pub fn verifying_proof_of_secret_sharing_for_100_parties(c: &mut Criterion) {
         .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
         .collect::<Vec<_>>();
 
-    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
+    let remote_share_key_pairs = shares
+        .iter()
+        .zip(receivers.values())
+        .map(|(share, key)| (share, key))
+        .collect::<Vec<_>>();
 
     let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, &params, &mut rng);
 
@@ -529,7 +545,11 @@ pub fn share_encryption_100(c: &mut Criterion) {
         .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
         .collect::<Vec<_>>();
 
-    let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
+    let remote_share_key_pairs = shares
+        .iter()
+        .zip(receivers.values())
+        .map(|(share, key)| (share, key))
+        .collect::<Vec<_>>();
 
     c.bench_function("100 shares encryption", |b| {
         b.iter(|| black_box(encrypt_shares(&remote_share_key_pairs, &params, &mut rng)))

common/dkg/src/dealing.rs

@@ -115,7 +115,11 @@ impl Dealing {
             .map(|&node_index| polynomial.evaluate_at(&Scalar::from(node_index)).into())
             .collect::<Vec<_>>();
 
-        let remote_share_key_pairs = shares.iter().zip(receivers.values()).collect::<Vec<_>>();
+        let remote_share_key_pairs = shares
+            .iter()
+            .zip(receivers.values())
+            .map(|(share, key)| (share, key))
+            .collect::<Vec<_>>();
         let ordered_public_keys = receivers.values().copied().collect::<Vec<_>>();
 
         let (ciphertexts, hazmat) = encrypt_shares(&remote_share_key_pairs, params, &mut rng);

common/http-api-client/src/lib.rs

@@ -11,7 +11,7 @@ use thiserror::Error;
 use tracing::warn;
 use url::Url;
 
-pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(10);
+pub const DEFAULT_TIMEOUT: Duration = Duration::from_secs(3);
 
 pub type PathSegments<'a> = &'a [&'a str];
 pub type Params<'a, K, V> = &'a [(K, V)];

common/ip-packet-requests/Cargo.toml

@@ -1,19 +0,0 @@
-[package]
-name = "nym-ip-packet-requests"
-version = "0.1.0"
-authors.workspace = true
-repository.workspace = true
-homepage.workspace = true
-documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-bincode = "1.3.3"
-bytes = "1.5.0"
-nym-sphinx = { path = "../nymsphinx" }
-rand = "0.8.5"
-serde = { workspace = true, features = ["derive"] }
-thiserror = { workspace = true }

common/ip-packet-requests/src/lib.rs

@@ -1,373 +0,0 @@
-use std::net::IpAddr;
-
-use nym_sphinx::addressing::clients::Recipient;
-use serde::{Deserialize, Serialize};
-
-pub const CURRENT_VERSION: u8 = 1;
-
-fn generate_random() -> u64 {
-    use rand::RngCore;
-    let mut rng = rand::rngs::OsRng;
-    rng.next_u64()
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct IpPacketRequest {
-    pub version: u8,
-    pub data: IpPacketRequestData,
-}
-
-impl IpPacketRequest {
-    pub fn new_static_connect_request(
-        ip: IpAddr,
-        reply_to: Recipient,
-        reply_to_hops: Option<u8>,
-        reply_to_avg_mix_delays: Option<f64>,
-    ) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                version: CURRENT_VERSION,
-                data: IpPacketRequestData::StaticConnect(StaticConnectRequest {
-                    request_id,
-                    ip,
-                    reply_to,
-                    reply_to_hops,
-                    reply_to_avg_mix_delays,
-                }),
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_dynamic_connect_request(
-        reply_to: Recipient,
-        reply_to_hops: Option<u8>,
-        reply_to_avg_mix_delays: Option<f64>,
-    ) -> (Self, u64) {
-        let request_id = generate_random();
-        (
-            Self {
-                version: CURRENT_VERSION,
-                data: IpPacketRequestData::DynamicConnect(DynamicConnectRequest {
-                    request_id,
-                    reply_to,
-                    reply_to_hops,
-                    reply_to_avg_mix_delays,
-                }),
-            },
-            request_id,
-        )
-    }
-
-    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketRequestData::Data(DataRequest { ip_packet }),
-        }
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            IpPacketRequestData::StaticConnect(request) => Some(request.request_id),
-            IpPacketRequestData::DynamicConnect(request) => Some(request.request_id),
-            IpPacketRequestData::Data(_) => None,
-        }
-    }
-
-    pub fn recipient(&self) -> Option<&Recipient> {
-        match &self.data {
-            IpPacketRequestData::StaticConnect(request) => Some(&request.reply_to),
-            IpPacketRequestData::DynamicConnect(request) => Some(&request.reply_to),
-            IpPacketRequestData::Data(_) => None,
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-}
-
-#[allow(clippy::large_enum_variant)]
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub enum IpPacketRequestData {
-    StaticConnect(StaticConnectRequest),
-    DynamicConnect(DynamicConnectRequest),
-    Data(DataRequest),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct StaticConnectRequest {
-    pub request_id: u64,
-    pub ip: IpAddr,
-    pub reply_to: Recipient,
-    pub reply_to_hops: Option<u8>,
-    pub reply_to_avg_mix_delays: Option<f64>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct DynamicConnectRequest {
-    pub request_id: u64,
-    pub reply_to: Recipient,
-    pub reply_to_hops: Option<u8>,
-    pub reply_to_avg_mix_delays: Option<f64>,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
-pub struct DataRequest {
-    pub ip_packet: bytes::Bytes,
-}
-
-// ---
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct IpPacketResponse {
-    pub version: u8,
-    pub data: IpPacketResponseData,
-}
-
-impl IpPacketResponse {
-    pub fn new_static_connect_success(request_id: u64, reply_to: Recipient) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
-                request_id,
-                reply_to,
-                reply: StaticConnectResponseReply::Success,
-            }),
-        }
-    }
-
-    pub fn new_static_connect_failure(
-        request_id: u64,
-        reply_to: Recipient,
-        reason: StaticConnectFailureReason,
-    ) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::StaticConnect(StaticConnectResponse {
-                request_id,
-                reply_to,
-                reply: StaticConnectResponseReply::Failure(reason),
-            }),
-        }
-    }
-
-    pub fn new_dynamic_connect_success(request_id: u64, reply_to: Recipient, ip: IpAddr) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
-                request_id,
-                reply_to,
-                reply: DynamicConnectResponseReply::Success(DynamicConnectSuccess { ip }),
-            }),
-        }
-    }
-
-    pub fn new_dynamic_connect_failure(
-        request_id: u64,
-        reply_to: Recipient,
-        reason: DynamicConnectFailureReason,
-    ) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::DynamicConnect(DynamicConnectResponse {
-                request_id,
-                reply_to,
-                reply: DynamicConnectResponseReply::Failure(reason),
-            }),
-        }
-    }
-
-    pub fn new_ip_packet(ip_packet: bytes::Bytes) -> Self {
-        Self {
-            version: CURRENT_VERSION,
-            data: IpPacketResponseData::Data(DataResponse { ip_packet }),
-        }
-    }
-
-    pub fn id(&self) -> Option<u64> {
-        match &self.data {
-            IpPacketResponseData::StaticConnect(response) => Some(response.request_id),
-            IpPacketResponseData::DynamicConnect(response) => Some(response.request_id),
-            IpPacketResponseData::Data(_) => None,
-        }
-    }
-
-    pub fn recipient(&self) -> Option<&Recipient> {
-        match &self.data {
-            IpPacketResponseData::StaticConnect(response) => Some(&response.reply_to),
-            IpPacketResponseData::DynamicConnect(response) => Some(&response.reply_to),
-            IpPacketResponseData::Data(_) => None,
-        }
-    }
-
-    pub fn to_bytes(&self) -> Result<Vec<u8>, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().serialize(self)
-    }
-
-    pub fn from_reconstructed_message(
-        message: &nym_sphinx::receiver::ReconstructedMessage,
-    ) -> Result<Self, bincode::Error> {
-        use bincode::Options;
-        make_bincode_serializer().deserialize(&message.message)
-    }
-}
-
-#[allow(clippy::large_enum_variant)]
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum IpPacketResponseData {
-    StaticConnect(StaticConnectResponse),
-    DynamicConnect(DynamicConnectResponse),
-    Data(DataResponse),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct StaticConnectResponse {
-    pub request_id: u64,
-    pub reply_to: Recipient,
-    pub reply: StaticConnectResponseReply,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum StaticConnectResponseReply {
-    Success,
-    Failure(StaticConnectFailureReason),
-}
-
-impl StaticConnectResponseReply {
-    pub fn is_success(&self) -> bool {
-        match self {
-            StaticConnectResponseReply::Success => true,
-            StaticConnectResponseReply::Failure(_) => false,
-        }
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum StaticConnectFailureReason {
-    #[error("requested ip address is already in use")]
-    RequestedIpAlreadyInUse,
-    #[error("requested nym-address is already in use")]
-    RequestedNymAddressAlreadyInUse,
-    #[error("{0}")]
-    Other(String),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DynamicConnectResponse {
-    pub request_id: u64,
-    pub reply_to: Recipient,
-    pub reply: DynamicConnectResponseReply,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub enum DynamicConnectResponseReply {
-    Success(DynamicConnectSuccess),
-    Failure(DynamicConnectFailureReason),
-}
-
-impl DynamicConnectResponseReply {
-    pub fn is_success(&self) -> bool {
-        match self {
-            DynamicConnectResponseReply::Success(_) => true,
-            DynamicConnectResponseReply::Failure(_) => false,
-        }
-    }
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DynamicConnectSuccess {
-    pub ip: IpAddr,
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize, thiserror::Error)]
-pub enum DynamicConnectFailureReason {
-    #[error("requested nym-address is already in use")]
-    RequestedNymAddressAlreadyInUse,
-    #[error("no available ip address")]
-    NoAvailableIp,
-    #[error("{0}")]
-    Other(String),
-}
-
-#[derive(Clone, Debug, Serialize, Deserialize)]
-pub struct DataResponse {
-    pub ip_packet: bytes::Bytes,
-}
-
-fn make_bincode_serializer() -> impl bincode::Options {
-    use bincode::Options;
-    bincode::DefaultOptions::new()
-        .with_big_endian()
-        .with_varint_encoding()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn check_size_of_request() {
-        let connect = IpPacketRequest {
-            version: 4,
-            data: IpPacketRequestData::StaticConnect(
-                StaticConnectRequest {
-                    request_id: 123,
-                    ip: IpAddr::from([10, 0, 0, 1]),
-                    reply_to: Recipient::try_from_base58_string("D1rrpsysCGCYXy9saP8y3kmNpGtJZUXN9SvFoUcqAsM9.9Ssso1ea5NfkbMASdiseDSjTN1fSWda5SgEVjdSN4CvV@GJqd3ZxpXWSNxTfx7B1pPtswpetH4LnJdFeLeuY5KUuN").unwrap(),
-                    reply_to_hops: None,
-                    reply_to_avg_mix_delays: None,
-                },
-            )
-        };
-        assert_eq!(connect.to_bytes().unwrap().len(), 107);
-    }
-
-    #[test]
-    fn check_size_of_data() {
-        let data = IpPacketRequest {
-            version: 4,
-            data: IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1u8; 32]),
-            }),
-        };
-        assert_eq!(data.to_bytes().unwrap().len(), 35);
-    }
-
-    #[test]
-    fn serialize_and_deserialize_data_request() {
-        let data = IpPacketRequest {
-            version: 4,
-            data: IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
-            }),
-        };
-
-        let serialized = data.to_bytes().unwrap();
-        let deserialized = IpPacketRequest::from_reconstructed_message(
-            &nym_sphinx::receiver::ReconstructedMessage {
-                message: serialized,
-                sender_tag: None,
-            },
-        )
-        .unwrap();
-
-        assert_eq!(deserialized.version, 4);
-        assert_eq!(
-            deserialized.data,
-            IpPacketRequestData::Data(DataRequest {
-                ip_packet: bytes::Bytes::from(vec![1, 2, 4, 2, 5]),
-            })
-        );
-    }
-}

common/mixnode-common/src/verloc/measurement.rs

@@ -9,12 +9,11 @@ use std::sync::Arc;
 use std::time::Duration;
 use tokio::sync::RwLock;
 
-#[derive(Clone, Default)]
 pub struct AtomicVerlocResult {
     inner: Arc<RwLock<VerlocResult>>,
 }
 
-#[derive(Debug, Clone, Serialize, Default)]
+#[derive(Debug, Clone, Serialize)]
 pub struct VerlocResult {
     total_tested: usize,
     #[serde(with = "humantime_serde")]
@@ -36,6 +35,13 @@ impl AtomicVerlocResult {
         }
     }
 
+    // this could have also been achieved with a normal #[derive(Clone)] but I prefer to be explicit about it
+    pub(crate) fn clone_data_pointer(&self) -> Self {
+        AtomicVerlocResult {
+            inner: Arc::clone(&self.inner),
+        }
+    }
+
     pub(crate) async fn reset_results(&self, new_tested: usize) {
         let mut write_permit = self.inner.write().await;
         write_permit.total_tested = new_tested;

common/mixnode-common/src/verloc/mod.rs

@@ -226,7 +226,7 @@ impl VerlocMeasurer {
     }
 
     pub fn get_verloc_results_pointer(&self) -> AtomicVerlocResult {
-        self.results.clone()
+        self.results.clone_data_pointer()
     }
 
     fn start_listening(&self) -> JoinHandle<()> {

common/network-defaults/src/lib.rs

@@ -476,11 +476,3 @@ pub const DEFAULT_NYM_NODE_HTTP_PORT: u16 = 8080;
 pub const TOTAL_SUPPLY: u128 = 1_000_000_000_000_000;
 
 pub const DEFAULT_PROFIT_MARGIN: u8 = 10;
-
-// WIREGUARD
-pub const WG_PORT: u16 = 51822;
-
-// The interface used to route traffic
-pub const WG_TUN_BASE_NAME: &str = "nymwg";
-pub const WG_TUN_DEVICE_ADDRESS: &str = "10.1.0.1";
-pub const WG_TUN_DEVICE_NETMASK: &str = "255.255.255.0";

common/nymcoconut/benches/benchmarks.rs

@@ -6,10 +6,9 @@ use criterion::{criterion_group, criterion_main, Criterion};
 use ff::Field;
 use group::{Curve, Group};
 use nym_coconut::{
-    aggregate_signature_shares, aggregate_verification_keys, blind_sign, prepare_blind_sign,
-    prove_bandwidth_credential, setup, ttp_keygen, verify_credential,
-    verify_partial_blind_signature, Attribute, BlindedSignature, Parameters, Signature,
-    SignatureShare, VerificationKey,
+    aggregate_signature_shares, aggregate_verification_keys, blind_sign, elgamal_keygen,
+    prepare_blind_sign, prove_bandwidth_credential, setup, ttp_keygen, verify_credential,
+    Attribute, BlindedSignature, Parameters, Signature, SignatureShare, VerificationKey,
 };
 use rand::seq::SliceRandom;
 use std::ops::Neg;
@@ -176,6 +175,8 @@ fn bench_coconut(c: &mut Criterion) {
     let binding_number = params.random_scalar();
     let private_attributes = vec![serial_number, binding_number];
 
+    let _elgamal_keypair = elgamal_keygen(&params);
+
     // The prepare blind sign is performed by the user
     let (pedersen_commitments_openings, blind_sign_request) =
         prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
@@ -241,29 +242,6 @@ fn bench_coconut(c: &mut Criterion) {
         .map(|keypair| keypair.verification_key())
         .collect();
 
-    // verify a random partial blind signature
-    let rand_idx = 1;
-    let random_blind_signature = blinded_signatures.get(rand_idx).unwrap();
-    let partial_verification_key = verification_keys.get(rand_idx).unwrap();
-
-    group.bench_function(
-        &format!(
-            "verify_partial_blind_signature_{}_private_attributes_{}_public_attributes",
-            case.num_private_attrs, case.num_public_attrs
-        ),
-        |b| {
-            b.iter(|| {
-                verify_partial_blind_signature(
-                    &params,
-                    &blind_sign_request,
-                    &public_attributes,
-                    random_blind_signature,
-                    partial_verification_key,
-                )
-            })
-        },
-    );
-
     // Lets bench worse case, ie aggregating all
     let indices: Vec<u64> = (1..=case.num_authorities).collect();
     // aggregate verification keys

common/nymcoconut/src/lib.rs

@@ -14,7 +14,6 @@ pub use scheme::aggregation::aggregate_signature_shares;
 pub use scheme::aggregation::aggregate_verification_keys;
 pub use scheme::issuance::blind_sign;
 pub use scheme::issuance::prepare_blind_sign;
-pub use scheme::issuance::verify_partial_blind_signature;
 pub use scheme::issuance::BlindSignRequest;
 pub use scheme::keygen::ttp_keygen;
 pub use scheme::keygen::KeyPair;

common/nymcoconut/src/scheme/aggregation.rs

@@ -50,7 +50,7 @@ where
 impl Aggregatable for PartialSignature {
     fn aggregate(sigs: &[PartialSignature], indices: Option<&[u64]>) -> Result<Signature> {
         let h = sigs
-            .first()
+            .get(0)
             .ok_or_else(|| CoconutError::Aggregation("Empty set of signatures".to_string()))?
             .sig1();
 

common/nymcoconut/src/scheme/issuance.rs

@@ -3,14 +3,12 @@
 
 use std::convert::TryFrom;
 use std::convert::TryInto;
-use std::ops::Neg;
 
-use bls12_381::{multi_miller_loop, G1Affine, G1Projective, G2Prepared, Scalar};
-use group::{Curve, Group, GroupEncoding};
+use bls12_381::{G1Affine, G1Projective, Scalar};
+use group::{Curve, GroupEncoding};
 
 use crate::error::{CoconutError, Result};
 use crate::proofs::ProofCmCs;
-use crate::scheme::keygen::VerificationKey;
 use crate::scheme::setup::Parameters;
 use crate::scheme::BlindedSignature;
 use crate::scheme::SecretKey;
@@ -320,97 +318,6 @@ pub fn blind_sign(
     Ok(BlindedSignature(h, sig))
 }
 
-/// Verifies a partial blind signature using the provided parameters and validator's verification key.
-///
-/// # Arguments
-///
-/// * `params` - A reference to the cryptographic parameters.
-/// * `blind_sign_request` - A reference to the blind signature request signed by the client.
-/// * `public_attributes` - A reference to the public attributes included in the client's request.
-/// * `blind_sig` - A reference to the issued partial blinded signature to be verified.
-/// * `partial_verification_key` - A reference to the validator's partial verification key.
-///
-/// # Returns
-///
-/// A boolean indicating whether the partial blind signature is valid (`true`) or not (`false`).
-///
-/// # Remarks
-///
-/// This function verifies the correctness and validity of a partial blind signature using
-/// the provided cryptographic parameters, blind signature request, blinded signature,
-/// and partial verification key.
-/// It calculates pairings based on the provided values and checks whether the partial blind signature
-/// is consistent with the verification key and commitments in the blind signature request.
-/// The function returns `true` if the partial blind signature is valid, and `false` otherwise.
-pub fn verify_partial_blind_signature(
-    params: &Parameters,
-    blind_sign_request: &BlindSignRequest,
-    public_attributes: &[Attribute],
-    blind_sig: &BlindedSignature,
-    partial_verification_key: &VerificationKey,
-) -> bool {
-    let num_private_attributes = blind_sign_request.private_attributes_commitments.len();
-    if num_private_attributes + public_attributes.len() > partial_verification_key.beta_g2.len() {
-        return false;
-    }
-
-    // TODO: we're losing some memory here due to extra allocation,
-    // but worst-case scenario (given SANE amount of attributes), it's just few kb at most
-    let c_neg = blind_sig.1.to_affine().neg();
-    let g2_prep = params.prepared_miller_g2();
-
-    let mut terms = vec![
-        // (c^{-1}, g2)
-        (c_neg, g2_prep.clone()),
-        // (s, alpha)
-        (
-            blind_sig.0.to_affine(),
-            G2Prepared::from(partial_verification_key.alpha.to_affine()),
-        ),
-    ];
-
-    // for each private attribute, add (cm_i, beta_i) to the miller terms
-    for (private_attr_commit, beta_g2) in blind_sign_request
-        .private_attributes_commitments
-        .iter()
-        .zip(&partial_verification_key.beta_g2)
-    {
-        // (cm_i, beta_i)
-        terms.push((
-            private_attr_commit.to_affine(),
-            G2Prepared::from(beta_g2.to_affine()),
-        ))
-    }
-
-    // for each public attribute, add (s^pub_j, beta_{priv + j}) to the miller terms
-    for (pub_attr, beta_g2) in public_attributes.iter().zip(
-        partial_verification_key
-            .beta_g2
-            .iter()
-            .skip(num_private_attributes),
-    ) {
-        // (s^pub_j, beta_j)
-        terms.push((
-            (blind_sig.0 * pub_attr).to_affine(),
-            G2Prepared::from(beta_g2.to_affine()),
-        ))
-    }
-
-    // get the references to all the terms to get the arguments the miller loop expects
-    #[allow(clippy::map_identity)]
-    let terms_refs = terms.iter().map(|(g1, g2)| (g1, g2)).collect::<Vec<_>>();
-
-    // since checking whether e(a, b) == e(c, d)
-    // is equivalent to checking e(a, b) • e(c, d)^{-1} == id
-    // and thus to e(a, b) • e(c^{-1}, d) == id
-    //
-    // compute e(c^1, g2) • e(s, alpha) • e(cm_0, beta_0) • e(cm_i, beta_i) • (s^pub_0, beta_{i+1}) (s^pub_j, beta_{i + j})
-    multi_miller_loop(&terms_refs)
-        .final_exponentiation()
-        .is_identity()
-        .into()
-}
-
 #[cfg(test)]
 pub fn sign(
     params: &mut Parameters,
@@ -447,7 +354,6 @@ pub fn sign(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use crate::scheme::keygen::keygen;
 
     #[test]
     fn blind_sign_request_bytes_roundtrip() {
@@ -479,81 +385,4 @@ mod tests {
             lambda
         );
     }
-
-    #[test]
-    fn successful_verify_partial_blind_signature() {
-        let params = Parameters::new(4).unwrap();
-        let private_attributes = params.n_random_scalars(2);
-        let public_attributes = params.n_random_scalars(2);
-
-        let (_commitments_openings, request) =
-            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
-
-        let validator_keypair = keygen(&params);
-        let blind_sig = blind_sign(
-            &params,
-            &validator_keypair.secret_key(),
-            &request,
-            &public_attributes,
-        )
-        .unwrap();
-
-        assert!(verify_partial_blind_signature(
-            &params,
-            &request,
-            &public_attributes,
-            &blind_sig,
-            &validator_keypair.verification_key()
-        ));
-    }
-
-    #[test]
-    fn successful_verify_partial_blind_signature_no_public_attributes() {
-        let params = Parameters::new(4).unwrap();
-        let private_attributes = params.n_random_scalars(2);
-
-        let (_commitments_openings, request) =
-            prepare_blind_sign(&params, &private_attributes, &[]).unwrap();
-
-        let validator_keypair = keygen(&params);
-        let blind_sig =
-            blind_sign(&params, &validator_keypair.secret_key(), &request, &[]).unwrap();
-
-        assert!(verify_partial_blind_signature(
-            &params,
-            &request,
-            &[],
-            &blind_sig,
-            &validator_keypair.verification_key()
-        ));
-    }
-
-    #[test]
-    fn fail_verify_partial_blind_signature_with_wrong_key() {
-        let params = Parameters::new(4).unwrap();
-        let private_attributes = params.n_random_scalars(2);
-        let public_attributes = params.n_random_scalars(2);
-
-        let (_commitments_openings, request) =
-            prepare_blind_sign(&params, &private_attributes, &public_attributes).unwrap();
-
-        let validator_keypair = keygen(&params);
-        let validator2_keypair = keygen(&params);
-        let blind_sig = blind_sign(
-            &params,
-            &validator_keypair.secret_key(),
-            &request,
-            &public_attributes,
-        )
-        .unwrap();
-
-        // this assertion should fail, as we try to verify with a wrong validator key
-        assert!(!verify_partial_blind_signature(
-            &params,
-            &request,
-            &public_attributes,
-            &blind_sig,
-            &validator2_keypair.verification_key()
-        ),);
-    }
 }

common/task/src/manager.rs

@@ -493,13 +493,10 @@ impl TaskClient {
 impl Drop for TaskClient {
     fn drop(&mut self) {
         if !self.mode.should_signal_on_drop() {
-            self.log(
-                Level::Trace,
-                "the task client is getting dropped (but instructed to not signal)",
-            );
+            self.log(Level::Debug, "the task client is getting dropped");
             return;
         } else {
-            self.log(Level::Debug, "the task client is getting dropped");
+            self.log(Level::Info, "the task client is getting dropped");
         }
 
         if !self.is_shutdown_poll() {

common/tun/Cargo.toml

@@ -1,21 +0,0 @@
-[package]
-name = "nym-tun"
-version = "0.1.0"
-authors.workspace = true
-repository.workspace = true
-homepage.workspace = true
-documentation.workspace = true
-edition.workspace = true
-license.workspace = true
-
-# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
-
-[dependencies]
-thiserror.workspace = true
-tokio = { workspace = true, features = ["rt-multi-thread", "net", "io-util", "time", "sync", "macros"] }
-etherparse = "0.13.0"
-log.workspace = true
-nym-wireguard-types = { path = "../wireguard-types", optional = true }
-
-[target.'cfg(target_os = "linux")'.dependencies]
-tokio-tun = "0.11.2"

common/tun/src/lib.rs

@@ -1,7 +0,0 @@
-#[cfg(target_os = "linux")]
-mod linux;
-
-pub mod tun_task_channel;
-
-#[cfg(target_os = "linux")]
-pub use linux::tun_device;

common/tun/src/linux/mod.rs

@@ -1 +0,0 @@
-pub mod tun_device;

common/tun/src/linux/tun_device.rs

@@ -1,255 +0,0 @@
-use std::{
-    collections::HashMap,
-    net::{IpAddr, Ipv4Addr},
-    time::Duration,
-};
-
-use etherparse::{InternetSlice, SlicedPacket};
-use tokio::{
-    io::{AsyncReadExt, AsyncWriteExt},
-    time::timeout,
-};
-
-use crate::tun_task_channel::{
-    tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
-    TunTaskResponseSendError, TunTaskResponseTx, TunTaskRx, TunTaskTx,
-};
-
-const TUN_WRITE_TIMEOUT_MS: u64 = 1000;
-
-#[derive(thiserror::Error, Debug)]
-pub enum TunDeviceError {
-    #[error("timeout writing to tun device, dropping packet")]
-    TunWriteTimeout,
-
-    #[error("error writing to tun device: {source}")]
-    TunWriteError { source: std::io::Error },
-
-    #[error("failed to forward responding packet with tag: {source}")]
-    ForwardNatResponseFailed {
-        #[from]
-        source: TunTaskResponseSendError,
-    },
-
-    #[error("unable to parse headers in packet")]
-    UnableToParseHeaders {
-        #[from]
-        source: etherparse::ReadError,
-    },
-
-    #[error("unable to parse src and dst address from packet: ip header missing")]
-    UnableToParseAddressIpHeaderMissing,
-
-    #[error("unable to lock peer mutex")]
-    FailedToLockPeer,
-}
-
-fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun {
-    log::info!("Creating TUN device with: address={address}, netmask={netmask}");
-    // Read MTU size from env variable NYM_MTU_SIZE, else default to 1420.
-    let mtu = std::env::var("NYM_MTU_SIZE")
-        .map(|mtu| mtu.parse().expect("NYM_MTU_SIZE must be a valid integer"))
-        .unwrap_or(1420);
-    log::info!("Using MTU size: {mtu}");
-    tokio_tun::Tun::builder()
-        .name(name)
-        .tap(false)
-        .packet_info(false)
-        .mtu(mtu)
-        .up()
-        .address(address)
-        .netmask(netmask)
-        .try_build()
-        .expect("Failed to setup tun device, do you have permission?")
-}
-
-pub struct TunDevice {
-    // The TUN device that we read/write to, to send/receive packets
-    tun: tokio_tun::Tun,
-
-    // Incoming data that we should send
-    tun_task_rx: TunTaskRx,
-
-    // And when we get replies, this is where we should send it
-    tun_task_response_tx: TunTaskResponseTx,
-
-    routing_mode: RoutingMode,
-}
-
-pub enum RoutingMode {
-    // This is an alternative to the routing table, where we just match outgoing source IP with
-    // incoming destination IP.
-    Nat(NatInner),
-
-    // Just forward without checking anything
-    Passthrough,
-}
-
-impl RoutingMode {
-    pub fn new_nat() -> Self {
-        RoutingMode::Nat(NatInner {
-            nat_table: HashMap::new(),
-        })
-    }
-
-    pub fn new_passthrough() -> Self {
-        RoutingMode::Passthrough
-    }
-}
-
-pub struct NatInner {
-    nat_table: HashMap<IpAddr, u64>,
-}
-
-pub struct TunDeviceConfig {
-    pub base_name: String,
-    pub ip: Ipv4Addr,
-    pub netmask: Ipv4Addr,
-}
-
-impl TunDevice {
-    pub fn new(
-        routing_mode: RoutingMode,
-        config: TunDeviceConfig,
-    ) -> (Self, TunTaskTx, TunTaskResponseRx) {
-        let tun = Self::new_device_only(config);
-
-        // Channels to communicate with the other tasks
-        let (tun_task_tx, tun_task_rx) = tun_task_channel();
-        let (tun_task_response_tx, tun_task_response_rx) = tun_task_response_channel();
-
-        let tun_device = TunDevice {
-            tun_task_rx,
-            tun_task_response_tx,
-            tun,
-            routing_mode,
-        };
-
-        (tun_device, tun_task_tx, tun_task_response_rx)
-    }
-
-    pub fn new_device_only(config: TunDeviceConfig) -> tokio_tun::Tun {
-        let TunDeviceConfig {
-            base_name,
-            ip,
-            netmask,
-        } = config;
-        let name = format!("{base_name}%d");
-
-        let tun = setup_tokio_tun_device(&name, ip, netmask);
-        log::info!("Created TUN device: {}", tun.name());
-        tun
-    }
-
-    // Send outbound packets out on the wild internet
-    async fn handle_tun_write(&mut self, data: TunTaskPayload) -> Result<(), TunDeviceError> {
-        let (tag, packet) = data;
-        let ParsedAddresses { src_addr, dst_addr } = parse_src_dst_address(&packet)?;
-        log::debug!(
-            "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
-            packet.len()
-        );
-
-        // TODO: expire old entries
-        if let RoutingMode::Nat(nat_table) = &mut self.routing_mode {
-            nat_table.nat_table.insert(src_addr, tag);
-        }
-
-        timeout(
-            Duration::from_millis(TUN_WRITE_TIMEOUT_MS),
-            self.tun.write_all(&packet),
-        )
-        .await
-        .map_err(|_| TunDeviceError::TunWriteTimeout)?
-        .map_err(|err| TunDeviceError::TunWriteError { source: err })
-    }
-
-    // Receive reponse packets from the wild internet
-    async fn handle_tun_read(&self, packet: &[u8]) -> Result<(), TunDeviceError> {
-        let ParsedAddresses { src_addr, dst_addr } = parse_src_dst_address(packet)?;
-        log::debug!(
-            "iface: read Packet({dst_addr} <- {src_addr}, {} bytes)",
-            packet.len(),
-        );
-
-        // Route packet to the correct peer.
-
-        match self.routing_mode {
-            // But we can also do it by consulting the NAT table.
-            RoutingMode::Nat(ref nat_table) => {
-                if let Some(tag) = nat_table.nat_table.get(&dst_addr) {
-                    log::debug!("Forward packet with NAT tag: {tag}");
-                    return self
-                        .tun_task_response_tx
-                        .try_send((*tag, packet.to_vec()))
-                        .map_err(|err| err.into());
-                }
-            }
-
-            RoutingMode::Passthrough => {
-                // TODO: skip the parsing at the top of the function
-                log::debug!("Forward packet without checking anything");
-                return self
-                    .tun_task_response_tx
-                    .try_send((0, packet.to_vec()))
-                    .map_err(|err| err.into());
-            }
-        }
-
-        log::info!("No peer found, packet dropped");
-        Ok(())
-    }
-
-    pub async fn run(mut self) {
-        let mut buf = [0u8; 65535];
-
-        loop {
-            tokio::select! {
-                // Reading from the TUN device
-                len = self.tun.read(&mut buf) => match len {
-                    Ok(len) => {
-                        let packet = &buf[..len];
-                        if let Err(err) = self.handle_tun_read(packet).await {
-                            log::error!("iface: handle_tun_read failed: {err}")
-                        }
-                    },
-                    Err(err) => {
-                        log::info!("iface: read error: {err}");
-                        // break;
-                    }
-                },
-                // Writing to the TUN device
-                Some(data) = self.tun_task_rx.recv() => {
-                    if let Err(err) = self.handle_tun_write(data).await {
-                        log::error!("iface: handle_tun_write failed: {err}");
-                    }
-                }
-            }
-        }
-        // log::info!("TUN device shutting down");
-    }
-
-    pub fn start(self) {
-        tokio::spawn(async move { self.run().await });
-    }
-}
-
-struct ParsedAddresses {
-    src_addr: IpAddr,
-    dst_addr: IpAddr,
-}
-
-fn parse_src_dst_address(packet: &[u8]) -> Result<ParsedAddresses, TunDeviceError> {
-    let headers = SlicedPacket::from_ip(packet)?;
-    match headers.ip {
-        Some(InternetSlice::Ipv4(ip, _)) => Ok(ParsedAddresses {
-            src_addr: ip.source_addr().into(),
-            dst_addr: ip.destination_addr().into(),
-        }),
-        Some(InternetSlice::Ipv6(ip, _)) => Ok(ParsedAddresses {
-            src_addr: ip.source_addr().into(),
-            dst_addr: ip.destination_addr().into(),
-        }),
-        None => Err(TunDeviceError::UnableToParseAddressIpHeaderMissing),
-    }
-}

common/tun/src/tun_task_channel.rs

@@ -1,84 +0,0 @@
-#![cfg_attr(not(target_os = "linux"), allow(dead_code))]
-
-use std::time::Duration;
-
-use tokio::sync::mpsc::{
-    self,
-    error::{SendError, SendTimeoutError, TrySendError},
-};
-
-pub(crate) type TunTaskPayload = (u64, Vec<u8>);
-
-#[derive(Clone)]
-pub struct TunTaskTx(mpsc::Sender<TunTaskPayload>);
-pub(crate) struct TunTaskRx(mpsc::Receiver<TunTaskPayload>);
-
-impl TunTaskTx {
-    pub async fn send(&self, data: TunTaskPayload) -> Result<(), SendError<TunTaskPayload>> {
-        self.0.send(data).await
-    }
-
-    pub fn try_send(&self, data: TunTaskPayload) -> Result<(), TrySendError<TunTaskPayload>> {
-        self.0.try_send(data)
-    }
-}
-
-impl TunTaskRx {
-    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
-        self.0.recv().await
-    }
-}
-
-pub(crate) fn tun_task_channel() -> (TunTaskTx, TunTaskRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
-    (TunTaskTx(tun_task_tx), TunTaskRx(tun_task_rx))
-}
-
-const TUN_TASK_RESPONSE_SEND_TIMEOUT_MS: u64 = 1_000;
-
-// Send responses back from the tun device back to the PacketRelayer
-pub(crate) struct TunTaskResponseTx(mpsc::Sender<TunTaskPayload>);
-pub struct TunTaskResponseRx(mpsc::Receiver<TunTaskPayload>);
-
-#[derive(thiserror::Error, Debug)]
-pub enum TunTaskResponseSendError {
-    #[error("failed to send tun response: {0}")]
-    SendTimeoutError(#[from] SendTimeoutError<TunTaskPayload>),
-
-    #[error("failed to send tun response: {0}")]
-    SendError(#[from] SendError<TunTaskPayload>),
-
-    #[error("failed to send tun response: {0}")]
-    TrySendError(#[from] TrySendError<TunTaskPayload>),
-}
-
-impl TunTaskResponseTx {
-    #[allow(unused)]
-    pub(crate) async fn send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
-        Ok(self
-            .0
-            .send_timeout(
-                data,
-                Duration::from_millis(TUN_TASK_RESPONSE_SEND_TIMEOUT_MS),
-            )
-            .await?)
-    }
-
-    pub(crate) fn try_send(&self, data: TunTaskPayload) -> Result<(), TunTaskResponseSendError> {
-        Ok(self.0.try_send(data)?)
-    }
-}
-
-impl TunTaskResponseRx {
-    pub async fn recv(&mut self) -> Option<TunTaskPayload> {
-        self.0.recv().await
-    }
-}
-
-pub(crate) fn tun_task_response_channel() -> (TunTaskResponseTx, TunTaskResponseRx) {
-    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(128);
-    (
-        TunTaskResponseTx(tun_task_tx),
-        TunTaskResponseRx(tun_task_rx),
-    )
-}

common/types/src/gateway.rs

@@ -119,7 +119,6 @@ pub struct GatewayNetworkRequesterDetails {
     pub encryption_key: String,
 
     pub open_proxy: bool,
-    pub exit_policy: bool,
     pub enabled_statistics: bool,
 
     // just a convenience wrapper around all the keys
@@ -141,35 +140,9 @@ impl fmt::Display for GatewayNetworkRequesterDetails {
         writeln!(f, "\taddress: {}", self.address)?;
 
         writeln!(f, "\tuses open proxy: {}", self.open_proxy)?;
-        writeln!(f, "\tuses exit policy: {}", self.exit_policy)?;
         writeln!(f, "\tsends statistics: {}", self.enabled_statistics)?;
 
         writeln!(f, "\tallow list path: {}", self.allow_list_path)?;
         writeln!(f, "\tunknown list path: {}", self.unknown_list_path)
     }
 }
-
-#[derive(Serialize, Deserialize)]
-pub struct GatewayIpPacketRouterDetails {
-    pub enabled: bool,
-
-    pub identity_key: String,
-    pub encryption_key: String,
-
-    // just a convenience wrapper around all the keys
-    pub address: String,
-
-    pub config_path: String,
-}
-
-impl fmt::Display for GatewayIpPacketRouterDetails {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        writeln!(f, "IP packet router:")?;
-        writeln!(f, "\tenabled: {}", self.enabled)?;
-        writeln!(f, "\tconfig path: {}", self.config_path)?;
-
-        writeln!(f, "\tidentity key: {}", self.identity_key)?;
-        writeln!(f, "\tencryption key: {}", self.encryption_key)?;
-        writeln!(f, "\taddress: {}", self.address)
-    }
-}

common/wireguard-types/Cargo.toml

@@ -13,7 +13,6 @@ license.workspace = true
 [dependencies]
 base64 = { workspace = true }
 dashmap = { workspace = true }
-log = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 thiserror = { workspace = true }
 
@@ -29,7 +28,13 @@ sha2 = { version = "0.10.8", optional = true }
 utoipa = { workspace = true, optional = true }
 serde_json = { workspace = true, optional = true }
 
-x25519-dalek = { version = "2.0.0", features = ["static_secrets"] }
+# target-specific dependencies
+[target."cfg(not(target_arch = \"wasm32\"))".dependencies.boringtun]
+workspace = true
+
+[target."cfg(target_arch = \"wasm32\")".dependencies.x25519-dalek]
+version = "2.0.0"
+
 
 [dev-dependencies]
 rand = "0.7.3"
@@ -40,4 +45,4 @@ nym-crypto = { path = "../crypto", features = ["rand"]}
 default = ["verify"]
 openapi = ["utoipa", "serde_json"]
 # this is moved to a separate feature as we really need clients to import it (especially, *cough*, wasm)
-verify = ["hmac", "sha2"]
+verify = ["hmac", "sha2"]

common/wireguard-types/src/public_key.rs

@@ -10,14 +10,20 @@ use std::hash::{Hash, Hasher};
 use std::ops::Deref;
 use std::str::FromStr;
 
-use x25519_dalek::PublicKey;
+// underneath the same library is being used, i.e. x25519-dalek 2.0,
+// which is being reexported by boringtun but wasm hates internals of boringtun
+#[cfg(target_arch = "wasm32")]
+use x25519_dalek::PublicKey as BoringtunPublicKey;
+
+#[cfg(not(target_arch = "wasm32"))]
+use boringtun::x25519::PublicKey as BoringtunPublicKey;
 
 #[derive(Debug, Clone, Copy, Eq, PartialEq)]
-pub struct PeerPublicKey(PublicKey);
+pub struct PeerPublicKey(BoringtunPublicKey);
 
 impl PeerPublicKey {
     #[allow(dead_code)]
-    pub fn new(key: PublicKey) -> Self {
+    pub fn new(key: BoringtunPublicKey) -> Self {
         PeerPublicKey(key)
     }
 
@@ -39,7 +45,7 @@ impl Hash for PeerPublicKey {
 }
 
 impl Deref for PeerPublicKey {
-    type Target = PublicKey;
+    type Target = BoringtunPublicKey;
 
     fn deref(&self) -> &Self::Target {
         &self.0
@@ -65,7 +71,7 @@ impl FromStr for PeerPublicKey {
             })?;
         };
 
-        Ok(PeerPublicKey(PublicKey::from(key_arr)))
+        Ok(PeerPublicKey(BoringtunPublicKey::from(key_arr)))
     }
 }
 

common/wireguard-types/src/registration.rs

@@ -6,7 +6,7 @@ use crate::PeerPublicKey;
 use base64::{engine::general_purpose, Engine};
 use dashmap::DashMap;
 use serde::{Deserialize, Serialize};
-use std::net::IpAddr;
+use std::net::SocketAddr;
 use std::{fmt, ops::Deref, str::FromStr};
 
 #[cfg(feature = "verify")]
@@ -18,13 +18,11 @@ use sha2::Sha256;
 
 pub type GatewayClientRegistry = DashMap<PeerPublicKey, GatewayClient>;
 pub type PendingRegistrations = DashMap<PeerPublicKey, Nonce>;
-pub type PrivateIPs = DashMap<IpAddr, Free>;
 
 #[cfg(feature = "verify")]
 pub type HmacSha256 = Hmac<Sha256>;
 
 pub type Nonce = u64;
-pub type Free = bool;
 
 #[derive(Serialize, Deserialize, Debug, Clone)]
 #[serde(tag = "type", rename_all = "camelCase")]
@@ -56,17 +54,11 @@ impl InitMessage {
 #[serde(tag = "type", rename_all = "camelCase")]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
 pub enum ClientRegistrationResponse {
-    PendingRegistration {
-        nonce: u64,
-        gateway_data: GatewayClient,
-        wg_port: u16,
-    },
-    Registered {
-        success: bool,
-    },
+    PendingRegistration { nonce: u64 },
+    Registered { success: bool },
 }
 
-/// Client that wants to register sends its PublicKey bytes mac digest encrypted with a DH shared secret.
+/// Client that wants to register sends its PublicKey and SocketAddr bytes mac digest encrypted with a DH shared secret.
 /// Gateway/Nym node can then verify pub_key payload using the same process
 #[derive(Serialize, Deserialize, Debug, Clone)]
 #[cfg_attr(feature = "openapi", derive(utoipa::ToSchema))]
@@ -75,8 +67,9 @@ pub struct GatewayClient {
     #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
     pub pub_key: PeerPublicKey,
 
-    /// Assigned private IP
-    pub private_ip: IpAddr,
+    /// Client's socket address
+    #[cfg_attr(feature = "openapi", schema(example = "1.2.3.4:51820", value_type = String))]
+    pub socket: SocketAddr,
 
     /// Sha256 hmac on the data (alongside the prior nonce)
     #[cfg_attr(feature = "openapi", schema(value_type = String, format = Byte))]
@@ -88,15 +81,16 @@ impl GatewayClient {
     pub fn new(
         local_secret: &PrivateKey,
         remote_public: PublicKey,
-        private_ip: IpAddr,
+        socket_address: SocketAddr,
         nonce: u64,
     ) -> Self {
         // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
         #[allow(clippy::expect_used)]
-        let static_secret = x25519_dalek::StaticSecret::from(local_secret.to_bytes());
-        let local_public: x25519_dalek::PublicKey = (&static_secret).into();
+        let static_secret = boringtun::x25519::StaticSecret::try_from(local_secret.to_bytes())
+            .expect("conversion between x25519 private keys is infallible");
+        let local_public: boringtun::x25519::PublicKey = (&static_secret).into();
 
-        let remote_public = x25519_dalek::PublicKey::from(remote_public.to_bytes());
+        let remote_public = boringtun::x25519::PublicKey::from(remote_public.to_bytes());
 
         let dh = static_secret.diffie_hellman(&remote_public);
 
@@ -106,12 +100,13 @@ impl GatewayClient {
             .expect("x25519 shared secret is always 32 bytes long");
 
         mac.update(local_public.as_bytes());
-        mac.update(private_ip.to_string().as_bytes());
+        mac.update(socket_address.ip().to_string().as_bytes());
+        mac.update(socket_address.port().to_string().as_bytes());
         mac.update(&nonce.to_le_bytes());
 
         GatewayClient {
             pub_key: PeerPublicKey::new(local_public),
-            private_ip,
+            socket: socket_address,
             mac: ClientMac(mac.finalize().into_bytes().to_vec()),
         }
     }
@@ -122,7 +117,8 @@ impl GatewayClient {
     pub fn verify(&self, gateway_key: &PrivateKey, nonce: u64) -> Result<(), Error> {
         // convert from 1.0 x25519-dalek private key into 2.0 x25519-dalek
         #[allow(clippy::expect_used)]
-        let static_secret = x25519_dalek::StaticSecret::from(gateway_key.to_bytes());
+        let static_secret = boringtun::x25519::StaticSecret::try_from(gateway_key.to_bytes())
+            .expect("conversion between x25519 private keys is infallible");
 
         let dh = static_secret.diffie_hellman(&self.pub_key);
 
@@ -132,7 +128,8 @@ impl GatewayClient {
             .expect("x25519 shared secret is always 32 bytes long");
 
         mac.update(self.pub_key.as_bytes());
-        mac.update(self.private_ip.to_string().as_bytes());
+        mac.update(self.socket.ip().to_string().as_bytes());
+        mac.update(self.socket.port().to_string().as_bytes());
         mac.update(&nonce.to_le_bytes());
 
         mac.verify_slice(&self.mac)
@@ -145,6 +142,10 @@ impl GatewayClient {
     pub fn pub_key(&self) -> PeerPublicKey {
         self.pub_key
     }
+
+    pub fn socket(&self) -> SocketAddr {
+        self.socket
+    }
 }
 
 // TODO: change the inner type into generic array of size HmacSha256::OutputSize
@@ -216,12 +217,13 @@ mod tests {
         let gateway_key_pair = encryption::KeyPair::new(&mut rng);
         let client_key_pair = encryption::KeyPair::new(&mut rng);
 
+        let socket: SocketAddr = "1.2.3.4:5678".parse().unwrap();
         let nonce = 1234567890;
 
         let client = GatewayClient::new(
             client_key_pair.private_key(),
             *gateway_key_pair.public_key(),
-            "10.0.0.42".parse().unwrap(),
+            socket,
             nonce,
         );
         assert!(client.verify(gateway_key_pair.private_key(), nonce).is_ok())

common/wireguard/Cargo.toml

@@ -11,15 +11,27 @@ license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
+async-recursion = "1.0.4"
 base64 = "0.21.3"
 # The latest version on crates.io at the time of writing this (6.0.0) has a
 # version mismatch with x25519-dalek/curve25519-dalek that is resolved in the
 # latest commit. So pick that for now.
-x25519-dalek = "2.0.0"
-defguard_wireguard_rs = { git = "https://github.com/neacsu/wireguard-rs.git", rev = "c2cd0c1119f699f4bc43f5e6ffd6fc242caa42ed" }
+#boringtun = "0.6.0"
+boringtun = { workspace = true }
+bytes = "1.5.0"
+dashmap = "5.5.3"
+etherparse = "0.13.0"
+futures = "0.3.28"
 ip_network = "0.4.1"
+ip_network_table = "0.2.0"
 log.workspace = true
-nym-network-defaults = { path = "../network-defaults" }
 nym-task = { path = "../task" }
 nym-wireguard-types = { path = "../wireguard-types" }
+rand.workspace = true
+serde = { workspace = true, features = ["derive"] }
+tap.workspace = true
+thiserror.workspace = true
 tokio = { workspace = true, features = ["rt-multi-thread", "net", "io-util"] }
+
+[target.'cfg(target_os = "linux")'.dependencies]
+tokio-tun = "0.9.0"

common/wireguard/src/active_peers.rs

@@ -0,0 +1,74 @@
+use std::net::SocketAddr;
+
+use boringtun::x25519;
+use dashmap::{
+    mapref::one::{Ref, RefMut},
+    DashMap,
+};
+use tokio::sync::mpsc::{self};
+
+use crate::event::Event;
+
+// Channels that are used to communicate with the various tunnels
+#[derive(Clone)]
+pub struct PeerEventSender(mpsc::Sender<Event>);
+pub(crate) struct PeerEventReceiver(mpsc::Receiver<Event>);
+
+impl PeerEventSender {
+    pub(crate) async fn send(&self, event: Event) -> Result<(), mpsc::error::SendError<Event>> {
+        self.0.send(event).await
+    }
+}
+
+impl PeerEventReceiver {
+    pub(crate) async fn recv(&mut self) -> Option<Event> {
+        self.0.recv().await
+    }
+}
+
+pub(crate) fn peer_event_channel() -> (PeerEventSender, PeerEventReceiver) {
+    let (tx, rx) = mpsc::channel(16);
+    (PeerEventSender(tx), PeerEventReceiver(rx))
+}
+
+pub(crate) type PeersByKey = DashMap<x25519::PublicKey, PeerEventSender>;
+pub(crate) type PeersByAddr = DashMap<SocketAddr, PeerEventSender>;
+
+#[derive(Default)]
+pub(crate) struct ActivePeers {
+    active_peers: PeersByKey,
+    active_peers_by_addr: PeersByAddr,
+}
+
+impl ActivePeers {
+    pub(crate) fn remove(&self, public_key: &x25519::PublicKey) {
+        log::info!("Removing peer: {public_key:?}");
+        self.active_peers.remove(public_key);
+        log::warn!("TODO: remove from peers_by_ip?");
+        log::warn!("TODO: remove from peers_by_addr");
+    }
+
+    pub(crate) fn insert(
+        &self,
+        public_key: x25519::PublicKey,
+        addr: SocketAddr,
+        peer_tx: PeerEventSender,
+    ) {
+        self.active_peers.insert(public_key, peer_tx.clone());
+        self.active_peers_by_addr.insert(addr, peer_tx);
+    }
+
+    pub(crate) fn get_by_key_mut(
+        &self,
+        public_key: &x25519::PublicKey,
+    ) -> Option<RefMut<'_, x25519::PublicKey, PeerEventSender>> {
+        self.active_peers.get_mut(public_key)
+    }
+
+    pub(crate) fn get_by_addr(
+        &self,
+        addr: &SocketAddr,
+    ) -> Option<Ref<'_, SocketAddr, PeerEventSender>> {
+        self.active_peers_by_addr.get(addr)
+    }
+}

common/wireguard/src/error.rs

@@ -0,0 +1,9 @@
+use thiserror::Error;
+
+#[derive(Error, Debug)]
+pub enum WgError {
+    #[error("unable to get tunnel")]
+    UnableToGetTunnel,
+    #[error("handshake failed")]
+    HandshakeFailed,
+}

common/wireguard/src/event.rs

@@ -0,0 +1,34 @@
+use std::fmt::{Display, Formatter};
+
+use bytes::Bytes;
+
+#[allow(unused)]
+#[derive(Debug)]
+pub enum Event {
+    /// IP packet received from the WireGuard tunnel that should be passed through to the
+    /// corresponding virtual device/internet.
+    Wg(Bytes),
+    /// IP packet received from the WireGuard tunnel that was verified as part of the handshake.
+    WgVerified(Bytes),
+    /// IP packet to be sent through the WireGuard tunnel as crafted by the virtual device.
+    Ip(Bytes),
+}
+
+impl Display for Event {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Event::Wg(data) => {
+                let size = data.len();
+                write!(f, "Wg{{ size={size} }}")
+            }
+            Event::WgVerified(data) => {
+                let size = data.len();
+                write!(f, "WgVerified{{ size={size} }}")
+            }
+            Event::Ip(data) => {
+                let size = data.len();
+                write!(f, "Ip{{ size={size} }}")
+            }
+        }
+    }
+}

common/wireguard/src/lib.rs

@@ -3,55 +3,76 @@
 // #![warn(clippy::expect_used)]
 // #![warn(clippy::unwrap_used)]
 
-pub mod setup;
+mod active_peers;
+mod error;
+mod event;
+mod network_table;
+mod packet_relayer;
+mod platform;
+mod registered_peers;
+mod setup;
+mod tun_task_channel;
+mod udp_listener;
+mod wg_tunnel;
 
 use nym_wireguard_types::registration::GatewayClientRegistry;
 use std::sync::Arc;
 
 // Currently the module related to setting up the virtual network device is platform specific.
 #[cfg(target_os = "linux")]
-use crate::setup::{peer_allowed_ips, peer_static_public_key, PRIVATE_KEY};
-use defguard_wireguard_rs::WGApi;
-#[cfg(target_os = "linux")]
-use defguard_wireguard_rs::{
-    host::Peer, key::Key, net::IpAddrMask, InterfaceConfiguration, WireguardInterfaceApi,
-};
-#[cfg(target_os = "linux")]
-use nym_network_defaults::{WG_PORT, WG_TUN_DEVICE_ADDRESS};
+use platform::linux::tun_device;
 
-/// Start wireguard device
+/// Start wireguard UDP listener and TUN device
+///
+/// # Errors
+///
+/// This function will return an error if either the UDP listener of the TUN device fails to start.
 #[cfg(target_os = "linux")]
 pub async fn start_wireguard(
-    mut task_client: nym_task::TaskClient,
-    _gateway_client_registry: Arc<GatewayClientRegistry>,
-) -> Result<WGApi, Box<dyn std::error::Error + Send + Sync + 'static>> {
-    let ifname = String::from("wg0");
-    let wgapi = WGApi::new(ifname.clone(), false)?;
-    wgapi.create_interface()?;
-    let interface_config = InterfaceConfiguration {
-        name: ifname.clone(),
-        prvkey: PRIVATE_KEY.to_string(),
-        address: WG_TUN_DEVICE_ADDRESS.to_string(),
-        port: WG_PORT as u32,
-        peers: vec![],
-    };
-    wgapi.configure_interface(&interface_config)?;
-    let peer = peer_static_public_key();
-    let mut peer = Peer::new(Key::new(peer.to_bytes()));
-    let peer_ip = peer_allowed_ips();
-    let peer_ip_mask = IpAddrMask::new(peer_ip.network_address(), peer_ip.netmask());
-    peer.set_allowed_ips(vec![peer_ip_mask]);
-    wgapi.configure_peer(&peer)?;
-    wgapi.configure_peer_routing(&[peer.clone()])?;
+    task_client: nym_task::TaskClient,
+    gateway_client_registry: Arc<GatewayClientRegistry>,
+) -> Result<(), Box<dyn std::error::Error + Send + Sync + 'static>> {
+    // We can either index peers by their IP like standard wireguard
+    let peers_by_ip = Arc::new(tokio::sync::Mutex::new(network_table::NetworkTable::new()));
 
-    tokio::spawn(async move { task_client.recv().await });
+    // ... or by their tunnel tag, which is a random number assigned to them
+    let peers_by_tag = Arc::new(tokio::sync::Mutex::new(wg_tunnel::PeersByTag::new()));
 
-    Ok(wgapi)
+    // Start the tun device that is used to relay traffic outbound
+    let (tun, tun_task_tx, tun_task_response_rx) = tun_device::TunDevice::new(peers_by_ip.clone());
+    tun.start();
+
+    // If we want to have the tun device on a separate host, it's the tun_task and
+    // tun_task_response channels that needs to be sent over the network to the host where the tun
+    // device is running.
+
+    // The packet relayer's responsibility is to route packets between the correct tunnel and the
+    // tun device. The tun device may or may not be on a separate host, which is why we can't do
+    // this routing in the tun device itself.
+    let (packet_relayer, packet_tx) = packet_relayer::PacketRelayer::new(
+        tun_task_tx.clone(),
+        tun_task_response_rx,
+        peers_by_tag.clone(),
+    );
+    packet_relayer.start();
+
+    // Start the UDP listener that clients connect to
+    let udp_listener = udp_listener::WgUdpListener::new(
+        packet_tx,
+        peers_by_ip,
+        peers_by_tag,
+        Arc::clone(&gateway_client_registry),
+    )
+    .await?;
+    udp_listener.start(task_client);
+
+    Ok(())
 }
+
 #[cfg(not(target_os = "linux"))]
 pub async fn start_wireguard(
     _task_client: nym_task::TaskClient,
     _gateway_client_registry: Arc<GatewayClientRegistry>,
-) -> Result<WGApi, Box<dyn std::error::Error + Send + Sync + 'static>> {
+) -> Result<(), Box<dyn std::error::Error + Send + Sync + 'static>> {
     todo!("WireGuard is currently only supported on Linux")
 }

common/wireguard/src/network_table.rs

@@ -0,0 +1,25 @@
+use std::net::IpAddr;
+
+use ip_network::IpNetwork;
+use ip_network_table::IpNetworkTable;
+
+#[derive(Default)]
+pub struct NetworkTable<T> {
+    ips: IpNetworkTable<T>,
+}
+
+impl<T> NetworkTable<T> {
+    pub(crate) fn new() -> Self {
+        Self {
+            ips: IpNetworkTable::new(),
+        }
+    }
+
+    pub fn insert<N: Into<IpNetwork>>(&mut self, network: N, data: T) -> Option<T> {
+        self.ips.insert(network, data)
+    }
+
+    pub fn longest_match<I: Into<IpAddr>>(&self, ip: I) -> Option<(IpNetwork, &T)> {
+        self.ips.longest_match(ip)
+    }
+}

common/wireguard/src/packet_relayer.rs

@@ -0,0 +1,76 @@
+use std::{collections::HashMap, sync::Arc};
+
+use tap::TapFallible;
+use tokio::sync::mpsc::{self};
+
+use crate::{
+    active_peers::PeerEventSender,
+    event::Event,
+    tun_task_channel::{TunTaskResponseRx, TunTaskTx},
+};
+
+#[derive(Clone)]
+pub struct PacketRelaySender(pub(crate) mpsc::Sender<(u64, Vec<u8>)>);
+pub(crate) struct PacketRelayReceiver(pub(crate) mpsc::Receiver<(u64, Vec<u8>)>);
+
+pub(crate) fn packet_relay_channel() -> (PacketRelaySender, PacketRelayReceiver) {
+    let (tx, rx) = mpsc::channel(16);
+    (PacketRelaySender(tx), PacketRelayReceiver(rx))
+}
+
+// The tunnels send packets to the packet relayer, which then relays it to the tun device. And
+// conversely, it's where the tun device send responses to, which are relayed back to the correct
+// tunnel.
+pub(crate) struct PacketRelayer {
+    // Receive packets from the various tunnels
+    packet_rx: PacketRelayReceiver,
+
+    // After receive from tunnels, send to the tun device
+    tun_task_tx: TunTaskTx,
+
+    // Receive responses from the tun device
+    tun_task_response_rx: TunTaskResponseRx,
+
+    // After receiving from the tun device, relay back to the correct tunnel
+    peers_by_tag: Arc<tokio::sync::Mutex<HashMap<u64, PeerEventSender>>>,
+}
+
+impl PacketRelayer {
+    pub(crate) fn new(
+        tun_task_tx: TunTaskTx,
+        tun_task_response_rx: TunTaskResponseRx,
+        peers_by_tag: Arc<tokio::sync::Mutex<HashMap<u64, PeerEventSender>>>,
+    ) -> (Self, PacketRelaySender) {
+        let (packet_tx, packet_rx) = packet_relay_channel();
+        (
+            Self {
+                packet_rx,
+                tun_task_tx,
+                tun_task_response_rx,
+                peers_by_tag,
+            },
+            packet_tx,
+        )
+    }
+
+    pub(crate) async fn run(mut self) {
+        loop {
+            tokio::select! {
+                Some((tag, packet)) = self.packet_rx.0.recv() => {
+                    log::info!("Sent packet to tun device with tag: {tag}");
+                    self.tun_task_tx.send((tag, packet)).await.tap_err(|e| log::error!("{e}")).ok();
+                },
+                Some((tag, packet)) = self.tun_task_response_rx.recv() => {
+                    log::info!("Received response from tun device with tag: {tag}");
+                    if let Some(tx) = self.peers_by_tag.lock().await.get(&tag) {
+                        tx.send(Event::Ip(packet.into())).await.tap_err(|e| log::error!("{e}")).ok();
+                    }
+                }
+            }
+        }
+    }
+
+    pub(crate) fn start(self) {
+        tokio::spawn(async move { self.run().await });
+    }
+}

common/wireguard/src/platform/linux/mod.rs

@@ -0,0 +1 @@
+pub(crate) mod tun_device;

common/wireguard/src/platform/linux/tun_device.rs

@@ -0,0 +1,192 @@
+use std::{
+    collections::HashMap,
+    net::{IpAddr, Ipv4Addr},
+    sync::Arc,
+};
+
+use etherparse::{InternetSlice, SlicedPacket};
+use tap::TapFallible;
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+
+use crate::{
+    event::Event,
+    setup::{TUN_BASE_NAME, TUN_DEVICE_ADDRESS, TUN_DEVICE_NETMASK},
+    tun_task_channel::{
+        tun_task_channel, tun_task_response_channel, TunTaskPayload, TunTaskResponseRx,
+        TunTaskResponseTx, TunTaskRx, TunTaskTx,
+    },
+    udp_listener::PeersByIp,
+};
+
+fn setup_tokio_tun_device(name: &str, address: Ipv4Addr, netmask: Ipv4Addr) -> tokio_tun::Tun {
+    log::info!("Creating TUN device with: address={address}, netmask={netmask}");
+    tokio_tun::Tun::builder()
+        .name(name)
+        .tap(false)
+        .packet_info(false)
+        .mtu(1350)
+        .up()
+        .address(address)
+        .netmask(netmask)
+        .try_build()
+        .expect("Failed to setup tun device, do you have permission?")
+}
+
+pub struct TunDevice {
+    // The TUN device that we read/write to, to send/receive packets
+    tun: tokio_tun::Tun,
+
+    // Incoming data that we should send
+    tun_task_rx: TunTaskRx,
+
+    // And when we get replies, this is where we should send it
+    tun_task_response_tx: TunTaskResponseTx,
+
+    // The routing table, as how wireguard does it
+    peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
+
+    // This is an alternative to the routing table, where we just match outgoing source IP with
+    // incoming destination IP.
+    nat_table: HashMap<IpAddr, u64>,
+}
+
+impl TunDevice {
+    pub fn new(
+        peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
+    ) -> (Self, TunTaskTx, TunTaskResponseRx) {
+        let tun = setup_tokio_tun_device(
+            format!("{TUN_BASE_NAME}%d").as_str(),
+            TUN_DEVICE_ADDRESS.parse().unwrap(),
+            TUN_DEVICE_NETMASK.parse().unwrap(),
+        );
+        log::info!("Created TUN device: {}", tun.name());
+
+        // Channels to communicate with the other tasks
+        let (tun_task_tx, tun_task_rx) = tun_task_channel();
+        let (tun_task_response_tx, tun_task_response_rx) = tun_task_response_channel();
+
+        let tun_device = TunDevice {
+            tun_task_rx,
+            tun_task_response_tx,
+            tun,
+            peers_by_ip,
+            nat_table: HashMap::new(),
+        };
+
+        (tun_device, tun_task_tx, tun_task_response_rx)
+    }
+
+    // Send outbound packets out on the wild internet
+    async fn handle_tun_write(&mut self, data: TunTaskPayload) {
+        let (tag, packet) = data;
+        let Some(dst_addr) = boringtun::noise::Tunn::dst_address(&packet) else {
+            log::error!("Unable to parse dst_address in packet that was supposed to be written to tun device");
+            return;
+        };
+        let Some(src_addr) = parse_src_address(&packet) else {
+            log::error!("Unable to parse src_address in packet that was supposed to be written to tun device");
+            return;
+        };
+        log::info!(
+            "iface: write Packet({src_addr} -> {dst_addr}, {} bytes)",
+            packet.len()
+        );
+
+        // TODO: expire old entries
+        self.nat_table.insert(src_addr, tag);
+
+        self.tun
+            .write_all(&packet)
+            .await
+            .tap_err(|err| {
+                log::error!("iface: write error: {err}");
+            })
+            .ok();
+    }
+
+    // Receive reponse packets from the wild internet
+    async fn handle_tun_read(&self, packet: &[u8]) {
+        let Some(dst_addr) = boringtun::noise::Tunn::dst_address(packet) else {
+            log::error!("Unable to parse dst_address in packet that was read from tun device");
+            return;
+        };
+        let Some(src_addr) = parse_src_address(packet) else {
+            log::error!("Unable to parse src_address in packet that was read from tun device");
+            return;
+        };
+        log::info!(
+            "iface: read Packet({src_addr} -> {dst_addr}, {} bytes)",
+            packet.len(),
+        );
+
+        // Route packet to the correct peer.
+
+        // This is how wireguard does it, by consulting the AllowedIPs table.
+        if false {
+            let peers = self.peers_by_ip.lock().await;
+            if let Some(peer_tx) = peers.longest_match(dst_addr).map(|(_, tx)| tx) {
+                log::info!("Forward packet to wg tunnel");
+                peer_tx
+                    .send(Event::Ip(packet.to_vec().into()))
+                    .await
+                    .tap_err(|err| log::error!("{err}"))
+                    .ok();
+                return;
+            }
+        }
+
+        // But we do it by consulting the NAT table.
+        {
+            if let Some(tag) = self.nat_table.get(&dst_addr) {
+                log::info!("Forward packet to wg tunnel with tag: {tag}");
+                self.tun_task_response_tx
+                    .send((*tag, packet.to_vec()))
+                    .await
+                    .tap_err(|err| log::error!("{err}"))
+                    .ok();
+                return;
+            }
+        }
+
+        log::info!("No peer found, packet dropped");
+    }
+
+    pub async fn run(mut self) {
+        let mut buf = [0u8; 1024];
+
+        loop {
+            tokio::select! {
+                // Reading from the TUN device
+                len = self.tun.read(&mut buf) => match len {
+                    Ok(len) => {
+                        let packet = &buf[..len];
+                        self.handle_tun_read(packet).await;
+                    },
+                    Err(err) => {
+                        log::info!("iface: read error: {err}");
+                        break;
+                    }
+                },
+                // Writing to the TUN device
+                Some(data) = self.tun_task_rx.recv() => {
+                    self.handle_tun_write(data).await;
+                }
+            }
+        }
+        log::info!("TUN device shutting down");
+    }
+
+    pub fn start(self) {
+        tokio::spawn(async move { self.run().await });
+    }
+}
+
+fn parse_src_address(packet: &[u8]) -> Option<IpAddr> {
+    let headers = SlicedPacket::from_ip(packet)
+        .tap_err(|err| log::error!("Unable to parse IP packet: {err:?}"))
+        .ok()?;
+    Some(match headers.ip? {
+        InternetSlice::Ipv4(ip, _) => ip.source_addr().into(),
+        InternetSlice::Ipv6(ip, _) => ip.source_addr().into(),
+    })
+}

common/wireguard/src/platform/mod.rs

@@ -0,0 +1,2 @@
+#[cfg(target_os = "linux")]
+pub(crate) mod linux;

common/wireguard/src/registered_peers.rs

@@ -0,0 +1,61 @@
+use std::{collections::HashMap, sync::Arc};
+
+use ip_network::IpNetwork;
+use nym_wireguard_types::PeerPublicKey;
+
+pub(crate) type PeerIdx = u32;
+
+#[derive(Debug)]
+pub(crate) struct RegisteredPeer {
+    pub(crate) public_key: PeerPublicKey,
+    pub(crate) index: PeerIdx,
+    pub(crate) allowed_ips: IpNetwork,
+    // endpoint: SocketAddr,
+}
+
+#[derive(Debug, Default)]
+pub(crate) struct RegisteredPeers {
+    peers: HashMap<PeerPublicKey, Arc<tokio::sync::Mutex<RegisteredPeer>>>,
+    peers_by_idx: HashMap<PeerIdx, Arc<tokio::sync::Mutex<RegisteredPeer>>>,
+}
+
+impl RegisteredPeers {
+    pub(crate) fn contains_key(&self, public_key: &PeerPublicKey) -> bool {
+        self.peers.contains_key(public_key)
+    }
+
+    pub(crate) fn next_idx(&self) -> PeerIdx {
+        self.peers_by_idx.keys().max().unwrap_or(&0) + 1
+    }
+
+    pub(crate) async fn insert(&mut self, peer: Arc<tokio::sync::Mutex<RegisteredPeer>>) {
+        let peer_idx = { peer.lock().await.index };
+        let public_key = { peer.lock().await.public_key };
+        self.peers.insert(public_key, Arc::clone(&peer));
+        self.peers_by_idx.insert(peer_idx, peer);
+    }
+
+    #[allow(unused)]
+    pub(crate) async fn remove(&mut self, public_key: &PeerPublicKey) {
+        if let Some(peer) = self.peers.remove(public_key) {
+            let peer_idx = peer.lock().await.index;
+            if self.peers_by_idx.remove(&peer_idx).is_none() {
+                log::error!("Removed registered peer but no registered index was found");
+            }
+        }
+    }
+
+    pub(crate) fn get_by_key(
+        &self,
+        public_key: &PeerPublicKey,
+    ) -> Option<&Arc<tokio::sync::Mutex<RegisteredPeer>>> {
+        self.peers.get(public_key)
+    }
+
+    pub(crate) fn get_by_idx(
+        &self,
+        peer_idx: PeerIdx,
+    ) -> Option<&Arc<tokio::sync::Mutex<RegisteredPeer>>> {
+        self.peers_by_idx.get(&peer_idx)
+    }
+}

common/wireguard/src/setup.rs

@@ -1,18 +1,29 @@
 use std::net::IpAddr;
 
 use base64::{engine::general_purpose, Engine as _};
+use boringtun::x25519;
 use log::info;
 
 // The wireguard UDP listener
 pub const WG_ADDRESS: &str = "0.0.0.0";
+pub const WG_PORT: u16 = 51822;
+
+// The interface used to route traffic
+pub const TUN_BASE_NAME: &str = "nymtun";
+pub const TUN_DEVICE_ADDRESS: &str = "10.0.0.1";
+pub const TUN_DEVICE_NETMASK: &str = "255.255.255.0";
 
 // The private key of the listener
 // Corresponding public key: "WM8s8bYegwMa0TJ+xIwhk+dImk2IpDUKslDBCZPizlE="
-pub(crate) const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg=";
+const PRIVATE_KEY: &str = "AEqXrLFT4qjYq3wmX0456iv94uM6nDj5ugp6Jedcflg=";
+
+// The public keys of the registered peer (clients)
+// Corresponding private key: "ILeN6gEh6vJ3Ju8RJ3HVswz+sPgkcKtAYTqzQRhTtlo="
+const PEER: &str = "NCIhkgiqxFx1ckKl3Zuh595DzIFl8mxju1Vg995EZhI=";
 
 // The AllowedIPs for the connected peer, which is one a single IP and the same as the IP that the
 // peer has configured on their side.
-const ALLOWED_IPS: &str = "10.1.0.2";
+const ALLOWED_IPS: &str = "10.0.0.2";
 
 fn decode_base64_key(base64_key: &str) -> [u8; 32] {
     general_purpose::STANDARD
@@ -22,11 +33,11 @@ fn decode_base64_key(base64_key: &str) -> [u8; 32] {
         .unwrap()
 }
 
-pub fn server_static_private_key() -> x25519_dalek::StaticSecret {
+pub fn server_static_private_key() -> x25519::StaticSecret {
     // TODO: this is a temporary solution for development
     let static_private_bytes: [u8; 32] = decode_base64_key(PRIVATE_KEY);
-    let static_private = x25519_dalek::StaticSecret::from(static_private_bytes);
-    let static_public = x25519_dalek::PublicKey::from(&static_private);
+    let static_private = x25519::StaticSecret::try_from(static_private_bytes).unwrap();
+    let static_public = x25519::PublicKey::from(&static_private);
     info!(
         "wg public key: {}",
         general_purpose::STANDARD.encode(static_public)
@@ -34,14 +45,10 @@ pub fn server_static_private_key() -> x25519_dalek::StaticSecret {
     static_private
 }
 
-pub fn peer_static_public_key() -> x25519_dalek::PublicKey {
+pub fn peer_static_public_key() -> x25519::PublicKey {
     // A single static public key is used during development
-
-    // Read from NYM_PEER_PUBLIC_KEY env variable
-    let peer = std::env::var("NYM_PEER_PUBLIC_KEY").expect("NYM_PEER_PUBLIC_KEY must be set");
-
-    let peer_static_public_bytes: [u8; 32] = decode_base64_key(&peer);
-    let peer_static_public = x25519_dalek::PublicKey::from(peer_static_public_bytes);
+    let peer_static_public_bytes: [u8; 32] = decode_base64_key(PEER);
+    let peer_static_public = x25519::PublicKey::try_from(peer_static_public_bytes).unwrap();
     info!(
         "Adding wg peer public key: {}",
         general_purpose::STANDARD.encode(peer_static_public)
@@ -51,6 +58,6 @@ pub fn peer_static_public_key() -> x25519_dalek::PublicKey {
 
 pub fn peer_allowed_ips() -> ip_network::IpNetwork {
     let key: IpAddr = ALLOWED_IPS.parse().unwrap();
-    let cidr = 32u8;
+    let cidr = 0u8;
     ip_network::IpNetwork::new_truncate(key, cidr).unwrap()
 }

common/wireguard/src/tun_task_channel.rs

@@ -0,0 +1,54 @@
+use tokio::sync::mpsc;
+
+pub(crate) type TunTaskPayload = (u64, Vec<u8>);
+
+#[derive(Clone)]
+pub struct TunTaskTx(mpsc::Sender<TunTaskPayload>);
+pub(crate) struct TunTaskRx(mpsc::Receiver<TunTaskPayload>);
+
+impl TunTaskTx {
+    pub(crate) async fn send(
+        &self,
+        data: TunTaskPayload,
+    ) -> Result<(), tokio::sync::mpsc::error::SendError<TunTaskPayload>> {
+        self.0.send(data).await
+    }
+}
+
+impl TunTaskRx {
+    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
+        self.0.recv().await
+    }
+}
+
+pub(crate) fn tun_task_channel() -> (TunTaskTx, TunTaskRx) {
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
+    (TunTaskTx(tun_task_tx), TunTaskRx(tun_task_rx))
+}
+
+// Send responses back from the tun device back to the PacketRelayer
+pub(crate) struct TunTaskResponseTx(mpsc::Sender<TunTaskPayload>);
+pub struct TunTaskResponseRx(mpsc::Receiver<TunTaskPayload>);
+
+impl TunTaskResponseTx {
+    pub(crate) async fn send(
+        &self,
+        data: TunTaskPayload,
+    ) -> Result<(), tokio::sync::mpsc::error::SendError<TunTaskPayload>> {
+        self.0.send(data).await
+    }
+}
+
+impl TunTaskResponseRx {
+    pub(crate) async fn recv(&mut self) -> Option<TunTaskPayload> {
+        self.0.recv().await
+    }
+}
+
+pub(crate) fn tun_task_response_channel() -> (TunTaskResponseTx, TunTaskResponseRx) {
+    let (tun_task_tx, tun_task_rx) = tokio::sync::mpsc::channel(16);
+    (
+        TunTaskResponseTx(tun_task_tx),
+        TunTaskResponseRx(tun_task_rx),
+    )
+}

common/wireguard/src/udp_listener.rs

@@ -0,0 +1,279 @@
+use std::{net::SocketAddr, sync::Arc, time::Duration};
+
+use boringtun::{
+    noise::{self, handshake::parse_handshake_anon, rate_limiter::RateLimiter, TunnResult},
+    x25519,
+};
+use futures::StreamExt;
+use log::error;
+use nym_task::TaskClient;
+use nym_wireguard_types::{registration::GatewayClientRegistry, PeerPublicKey};
+use tap::TapFallible;
+use tokio::{net::UdpSocket, sync::Mutex};
+
+use crate::{
+    active_peers::{ActivePeers, PeerEventSender},
+    error::WgError,
+    event::Event,
+    network_table::NetworkTable,
+    packet_relayer::PacketRelaySender,
+    registered_peers::{RegisteredPeer, RegisteredPeers},
+    setup::{self, WG_ADDRESS, WG_PORT},
+    wg_tunnel::PeersByTag,
+};
+
+const MAX_PACKET: usize = 65535;
+
+// Registered peers
+pub(crate) type PeersByIp = NetworkTable<PeerEventSender>;
+
+async fn add_test_peer(registered_peers: &mut RegisteredPeers) {
+    let peer_static_public = PeerPublicKey::new(setup::peer_static_public_key());
+    let peer_index = 0;
+    let peer_allowed_ips = setup::peer_allowed_ips();
+    let test_peer = Arc::new(tokio::sync::Mutex::new(RegisteredPeer {
+        public_key: peer_static_public,
+        index: peer_index,
+        allowed_ips: peer_allowed_ips,
+    }));
+    registered_peers.insert(test_peer).await;
+}
+
+pub struct WgUdpListener {
+    // Our private key
+    static_private: x25519::StaticSecret,
+
+    // Our public key
+    static_public: x25519::PublicKey,
+
+    // The list of registered peers that we allow
+    registered_peers: RegisteredPeers,
+
+    // The routing table, as defined by wireguard
+    peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
+
+    // ... or alternatively we can map peers by their tag
+    peers_by_tag: Arc<tokio::sync::Mutex<PeersByTag>>,
+
+    // The UDP socket to the peer
+    udp: Arc<UdpSocket>,
+
+    // Send data to the TUN device for sending
+    packet_tx: PacketRelaySender,
+
+    // Wireguard rate limiter
+    rate_limiter: RateLimiter,
+
+    gateway_client_registry: Arc<GatewayClientRegistry>,
+}
+
+impl WgUdpListener {
+    pub async fn new(
+        packet_tx: PacketRelaySender,
+        peers_by_ip: Arc<tokio::sync::Mutex<PeersByIp>>,
+        peers_by_tag: Arc<tokio::sync::Mutex<PeersByTag>>,
+        gateway_client_registry: Arc<GatewayClientRegistry>,
+    ) -> Result<Self, Box<dyn std::error::Error + Send + Sync + 'static>> {
+        let wg_address = SocketAddr::new(WG_ADDRESS.parse().unwrap(), WG_PORT);
+        log::info!("Starting wireguard UDP listener on {wg_address}");
+        let udp = Arc::new(UdpSocket::bind(wg_address).await?);
+
+        // Setup our own keys
+        let static_private = setup::server_static_private_key();
+        let static_public = x25519::PublicKey::from(&static_private);
+        let handshake_max_rate = 100u64;
+        let rate_limiter = RateLimiter::new(&static_public, handshake_max_rate);
+
+        // Create a test peer for dev
+        let mut registered_peers = RegisteredPeers::default();
+        add_test_peer(&mut registered_peers).await;
+
+        Ok(Self {
+            static_private,
+            static_public,
+            registered_peers,
+            peers_by_ip,
+            peers_by_tag,
+            udp,
+            packet_tx,
+            rate_limiter,
+            gateway_client_registry,
+        })
+    }
+
+    pub async fn run(mut self, mut task_client: TaskClient) {
+        // The set of active tunnels
+        let active_peers = ActivePeers::default();
+        // Each tunnel is run in its own task, and the task handle is stored here so we can remove
+        // it from `active_peers` when the tunnel is closed
+        let mut active_peers_task_handles = futures::stream::FuturesUnordered::new();
+
+        let mut buf = [0u8; MAX_PACKET];
+        let mut dst_buf = [0u8; MAX_PACKET];
+
+        while !task_client.is_shutdown() {
+            tokio::select! {
+                () = task_client.recv() => {
+                    log::trace!("WireGuard UDP listener: received shutdown");
+                    break;
+                }
+                // Reset the rate limiter every 1 sec
+                () = tokio::time::sleep(Duration::from_secs(1)) => {
+                    self.rate_limiter.reset_count();
+                },
+                // Handle tunnel closing
+                Some(public_key) = active_peers_task_handles.next() => {
+                    match public_key {
+                        Ok(public_key) => {
+                            active_peers.remove(&public_key);
+                        }
+                        Err(err) => {
+                            error!("WireGuard UDP listener: error receiving shutdown from peer: {err}");
+                        }
+                    }
+                },
+                // Handle incoming packets
+                Ok((len, addr)) = self.udp.recv_from(&mut buf) => {
+                    log::trace!("udp: received {} bytes from {}", len, addr);
+
+                    // If this addr has already been encountered, send directly to tunnel
+                    // TODO: optimization opportunity to instead create a connected UDP socket
+                    // inside the wg tunnel, where you can recv the data directly.
+                    if let Some(peer_tx) = active_peers.get_by_addr(&addr) {
+                        log::info!("udp: received {len} bytes from {addr} from known peer");
+                        peer_tx
+                            .send(Event::Wg(buf[..len].to_vec().into()))
+                            .await
+                            .tap_err(|e| log::error!("{e}"))
+                            .ok();
+                        continue;
+                    }
+
+                    // Verify the incoming packet
+                    let verified_packet = match self.rate_limiter.verify_packet(Some(addr.ip()), &buf[..len], &mut dst_buf) {
+                        Ok(packet) => packet,
+                        Err(TunnResult::WriteToNetwork(cookie)) => {
+                            log::info!("Send back cookie to: {addr}");
+                            self.udp.send_to(cookie, addr).await.tap_err(|e| log::error!("{e}")).ok();
+                            continue;
+                        }
+                        Err(err) => {
+                            log::warn!("{err:?}");
+                            continue;
+                        }
+                    };
+
+                    // Check if this is a registered peer, if not, just skip
+                    let registered_peer = match parse_peer(
+                        verified_packet,
+                        &mut self.registered_peers,
+                        &self.static_private,
+                        &self.static_public,
+                        Arc::clone(&self.gateway_client_registry),
+                    ).await {
+                        Ok(Some(peer)) => peer.lock().await,
+                        Ok(None) => {
+                            log::warn!("Peer not registered: {addr}");
+                            continue;
+                        }
+                        Err(err) => {
+                            log::error!("{err}");
+                            continue;
+                        },
+                    };
+
+                    // Look up if the peer is already connected
+                    if let Some(peer_tx) = active_peers.get_by_key_mut(&registered_peer.public_key) {
+                        // We found the peer as connected, even though the addr was not known
+                        log::info!("udp: received {len} bytes from {addr} which is a known peer with unknown addr");
+                        peer_tx.send(Event::WgVerified(buf[..len].to_vec().into()))
+                            .await
+                            .tap_err(|err| log::error!("{err}"))
+                            .ok();
+                    } else {
+                        // If it isn't, start a new tunnel
+                        log::info!("udp: received {len} bytes from {addr} from unknown peer, starting tunnel");
+                        // NOTE: we are NOT passing in the existing rate_limiter. Re-visit this
+                        // choice later.
+                        log::warn!("Creating new rate limiter, consider re-using?");
+                        let (join_handle, peer_tx, tag) = crate::wg_tunnel::start_wg_tunnel(
+                            addr,
+                            self.udp.clone(),
+                            self.static_private.clone(),
+                            *registered_peer.public_key,
+                            registered_peer.index,
+                            registered_peer.allowed_ips,
+                            // self.tun_task_tx.clone(),
+                            self.packet_tx.clone(),
+                        );
+
+                        self.peers_by_ip.lock().await.insert(registered_peer.allowed_ips, peer_tx.clone());
+                        self.peers_by_tag.lock().await.insert(tag, peer_tx.clone());
+
+                        peer_tx.send(Event::Wg(buf[..len].to_vec().into()))
+                            .await
+                            .tap_err(|e| log::error!("{e}"))
+                            .ok();
+
+                        log::info!("Adding peer: {:?}: {addr}", registered_peer.public_key);
+                        active_peers.insert(*registered_peer.public_key, addr, peer_tx);
+                        active_peers_task_handles.push(join_handle);
+                    }
+                },
+            }
+        }
+        log::info!("WireGuard listener: shutting down");
+    }
+
+    pub fn start(self, task_client: TaskClient) {
+        tokio::spawn(async move { self.run(task_client).await });
+    }
+}
+
+async fn parse_peer<'a>(
+    verified_packet: noise::Packet<'a>,
+    registered_peers: &'a mut RegisteredPeers,
+    static_private: &x25519::StaticSecret,
+    static_public: &x25519::PublicKey,
+    gateway_client_registry: Arc<GatewayClientRegistry>,
+) -> Result<Option<&'a Arc<tokio::sync::Mutex<RegisteredPeer>>>, WgError> {
+    let registered_peer = match verified_packet {
+        noise::Packet::HandshakeInit(ref packet) => {
+            let Ok(handshake) = parse_handshake_anon(static_private, static_public, packet) else {
+                return Err(WgError::HandshakeFailed);
+            };
+            let peer_public_key =
+                PeerPublicKey::new(x25519::PublicKey::from(handshake.peer_static_public));
+
+            let already_registered = registered_peers.contains_key(&peer_public_key);
+
+            if already_registered {
+                registered_peers.get_by_key(&peer_public_key)
+            } else if gateway_client_registry.contains_key(&peer_public_key) {
+                let peer_idx = registered_peers.next_idx();
+                let peer = Arc::new(Mutex::new(RegisteredPeer {
+                    public_key: peer_public_key,
+                    index: peer_idx,
+                    allowed_ips: setup::peer_allowed_ips(),
+                }));
+                registered_peers.insert(peer).await;
+                registered_peers.get_by_key(&peer_public_key)
+            } else {
+                None
+            }
+        }
+        noise::Packet::HandshakeResponse(packet) => {
+            let peer_idx = packet.receiver_idx >> 8;
+            registered_peers.get_by_idx(peer_idx)
+        }
+        noise::Packet::PacketCookieReply(packet) => {
+            let peer_idx = packet.receiver_idx >> 8;
+            registered_peers.get_by_idx(peer_idx)
+        }
+        noise::Packet::PacketData(packet) => {
+            let peer_idx = packet.receiver_idx >> 8;
+            registered_peers.get_by_idx(peer_idx)
+        }
+    };
+    Ok(registered_peer)
+}

common/wireguard/src/wg_tunnel.rs

@@ -0,0 +1,353 @@
+use std::{collections::HashMap, net::SocketAddr, sync::Arc, time::Duration};
+
+use async_recursion::async_recursion;
+use boringtun::{
+    noise::{errors::WireGuardError, rate_limiter::RateLimiter, Tunn, TunnResult},
+    x25519,
+};
+use bytes::Bytes;
+use log::{debug, error, info, warn};
+use rand::RngCore;
+use tap::TapFallible;
+use tokio::{net::UdpSocket, sync::broadcast, time::timeout};
+
+use crate::{
+    active_peers::{peer_event_channel, PeerEventReceiver, PeerEventSender},
+    error::WgError,
+    event::Event,
+    network_table::NetworkTable,
+    packet_relayer::PacketRelaySender,
+    registered_peers::PeerIdx,
+};
+
+const HANDSHAKE_MAX_RATE: u64 = 10;
+
+const MAX_PACKET: usize = 65535;
+
+// We index the tunnels by tag
+pub(crate) type PeersByTag = HashMap<u64, PeerEventSender>;
+
+pub struct WireGuardTunnel {
+    // Incoming data from the UDP socket received in the main event loop
+    peer_rx: PeerEventReceiver,
+
+    // UDP socket used for sending data
+    udp: Arc<UdpSocket>,
+
+    // Peer endpoint
+    endpoint: Arc<tokio::sync::RwLock<SocketAddr>>,
+
+    // AllowedIPs for this peer
+    allowed_ips: NetworkTable<()>,
+
+    // `boringtun` tunnel, used for crypto & WG protocol
+    wg_tunnel: Arc<tokio::sync::Mutex<Tunn>>,
+
+    // Signal close
+    close_tx: broadcast::Sender<()>,
+    close_rx: broadcast::Receiver<()>,
+
+    // Send data to the task that handles sending data through the tun device
+    packet_tx: PacketRelaySender,
+
+    tag: u64,
+}
+
+impl Drop for WireGuardTunnel {
+    fn drop(&mut self) {
+        info!("WireGuard tunnel: dropping");
+        self.close();
+    }
+}
+
+impl WireGuardTunnel {
+    pub(crate) fn new(
+        udp: Arc<UdpSocket>,
+        endpoint: SocketAddr,
+        static_private: x25519::StaticSecret,
+        peer_static_public: x25519::PublicKey,
+        index: PeerIdx,
+        peer_allowed_ips: ip_network::IpNetwork,
+        // rate_limiter: Option<RateLimiter>,
+        packet_tx: PacketRelaySender,
+    ) -> (Self, PeerEventSender, u64) {
+        let local_addr = udp.local_addr().unwrap();
+        let peer_addr = udp.peer_addr();
+        log::info!("New wg tunnel: endpoint: {endpoint}, local_addr: {local_addr}, peer_addr: {peer_addr:?}");
+
+        let preshared_key = None;
+        let persistent_keepalive = None;
+
+        let static_public = x25519::PublicKey::from(&static_private);
+        let rate_limiter = Some(Arc::new(RateLimiter::new(
+            &static_public,
+            HANDSHAKE_MAX_RATE,
+        )));
+
+        let wg_tunnel = Arc::new(tokio::sync::Mutex::new(
+            Tunn::new(
+                static_private,
+                peer_static_public,
+                preshared_key,
+                persistent_keepalive,
+                index,
+                rate_limiter,
+            )
+            .expect("failed to create Tunn instance"),
+        ));
+
+        // Channels with incoming data that is received by the main event loop
+        let (peer_tx, peer_rx) = peer_event_channel();
+
+        // Signal close tunnel
+        let (close_tx, close_rx) = broadcast::channel(1);
+
+        let mut allowed_ips = NetworkTable::new();
+        allowed_ips.insert(peer_allowed_ips, ());
+
+        let tag = Self::new_tag();
+
+        let tunnel = WireGuardTunnel {
+            peer_rx,
+            udp,
+            endpoint: Arc::new(tokio::sync::RwLock::new(endpoint)),
+            allowed_ips,
+            wg_tunnel,
+            close_tx,
+            close_rx,
+            packet_tx,
+            tag,
+        };
+
+        (tunnel, peer_tx, tag)
+    }
+
+    fn new_tag() -> u64 {
+        // TODO: check for collisions
+        rand::thread_rng().next_u64()
+    }
+
+    fn close(&self) {
+        let _ = self.close_tx.send(());
+    }
+
+    pub async fn spin_off(&mut self) {
+        loop {
+            tokio::select! {
+                _ = self.close_rx.recv() => {
+                    info!("WireGuard tunnel: received msg to close");
+                    break;
+                },
+                packet = self.peer_rx.recv() => match packet {
+                    Some(packet) => {
+                        info!("event loop: {packet}");
+                        match packet {
+                            Event::Wg(data) => {
+                                let _ = self.consume_wg(&data)
+                                    .await
+                                    .tap_err(|err| error!("WireGuard tunnel: consume_wg error: {err}"));
+                            },
+                            Event::WgVerified(data) => {
+                                let _ = self.consume_verified_wg(&data)
+                                    .await
+                                    .tap_err(|err| error!("WireGuard tunnel: consume_verified_wg error: {err}"));
+                            }
+                            Event::Ip(data) => self.consume_eth(&data).await,
+                        }
+                    },
+                    None => {
+                        info!("WireGuard tunnel: incoming UDP stream closed, closing tunnel");
+                        break;
+                    },
+                },
+                () = tokio::time::sleep(Duration::from_millis(250)) => {
+                    let _ = self.update_wg_timers()
+                        .await
+                        .map_err(|err| error!("WireGuard tunnel: update_wg_timers error: {err}"));
+                },
+            }
+        }
+        info!("WireGuard tunnel ({}): closed", self.endpoint.read().await);
+    }
+
+    async fn wg_tunnel_lock(&self) -> Result<tokio::sync::MutexGuard<'_, Tunn>, WgError> {
+        timeout(Duration::from_millis(100), self.wg_tunnel.lock())
+            .await
+            .map_err(|_| WgError::UnableToGetTunnel)
+    }
+
+    #[allow(unused)]
+    async fn set_endpoint(&self, addr: SocketAddr) {
+        if *self.endpoint.read().await != addr {
+            log::info!("wg tunnel update endpoint: {addr}");
+            *self.endpoint.write().await = addr;
+        }
+    }
+
+    async fn consume_wg(&mut self, data: &[u8]) -> Result<(), WgError> {
+        let mut send_buf = [0u8; MAX_PACKET];
+        let mut tunnel = self.wg_tunnel_lock().await?;
+        match tunnel.decapsulate(None, data, &mut send_buf) {
+            TunnResult::WriteToNetwork(packet) => {
+                let endpoint = self.endpoint.read().await;
+                log::info!("udp: send {} bytes to {}", packet.len(), *endpoint);
+                if let Err(err) = self.udp.send_to(packet, *endpoint).await {
+                    error!("Failed to send decapsulation-instructed packet to WireGuard endpoint: {err:?}");
+                };
+                // Flush pending queue
+                loop {
+                    let mut send_buf = [0u8; MAX_PACKET];
+                    match tunnel.decapsulate(None, &[], &mut send_buf) {
+                        TunnResult::WriteToNetwork(packet) => {
+                            log::info!("udp: send {} bytes to {}", packet.len(), *endpoint);
+                            if let Err(err) = self.udp.send_to(packet, *endpoint).await {
+                                error!("Failed to send decapsulation-instructed packet to WireGuard endpoint: {err:?}");
+                                break;
+                            };
+                        }
+                        _ => {
+                            break;
+                        }
+                    }
+                }
+            }
+            TunnResult::WriteToTunnelV4(packet, addr) => {
+                if self.allowed_ips.longest_match(addr).is_some() {
+                    self.packet_tx
+                        .0
+                        .send((self.tag, packet.to_vec()))
+                        .await
+                        .unwrap();
+                } else {
+                    warn!("Packet from {addr} not in allowed_ips");
+                }
+            }
+            TunnResult::WriteToTunnelV6(packet, addr) => {
+                if self.allowed_ips.longest_match(addr).is_some() {
+                    self.packet_tx
+                        .0
+                        .send((self.tag, packet.to_vec()))
+                        .await
+                        .unwrap();
+                } else {
+                    warn!("Packet (v6) from {addr} not in allowed_ips");
+                }
+            }
+            TunnResult::Done => {
+                debug!("WireGuard: decapsulate done");
+            }
+            TunnResult::Err(err) => {
+                error!("WireGuard: decapsulate error: {err:?}");
+            }
+        }
+        Ok(())
+    }
+
+    async fn consume_verified_wg(&mut self, data: &[u8]) -> Result<(), WgError> {
+        // Potentially we could take some shortcuts here in the name of performance, but currently
+        // I don't see that the needed functions in boringtun is exposed in the public API.
+        // TODO: make sure we don't put double pressure on the rate limiter!
+        self.consume_wg(data).await
+    }
+
+    async fn consume_eth(&self, data: &Bytes) {
+        info!("consume_eth: raw packet size: {}", data.len());
+        let encapsulated_packet = self.encapsulate_packet(data).await;
+        info!(
+            "consume_eth: after encapsulate: {}",
+            encapsulated_packet.len()
+        );
+
+        let endpoint = self.endpoint.read().await;
+        info!("consume_eth: send to {}: {}", *endpoint, data.len());
+        self.udp
+            .send_to(&encapsulated_packet, *endpoint)
+            .await
+            .unwrap();
+    }
+
+    async fn encapsulate_packet(&self, payload: &[u8]) -> Vec<u8> {
+        // TODO: use fixed dst and src buffers that we can reuse
+        let len = 148.max(payload.len() + 32);
+        let mut dst = vec![0; len];
+
+        let mut wg_tunnel = self.wg_tunnel_lock().await.unwrap();
+
+        match wg_tunnel.encapsulate(payload, &mut dst) {
+            TunnResult::WriteToNetwork(packet) => packet.to_vec(),
+            unexpected => {
+                error!("{:?}", unexpected);
+                vec![]
+            }
+        }
+    }
+
+    async fn update_wg_timers(&mut self) -> Result<(), WgError> {
+        let mut send_buf = [0u8; MAX_PACKET];
+        let mut tun = self.wg_tunnel_lock().await?;
+        let tun_result = tun.update_timers(&mut send_buf);
+        self.handle_routine_tun_result(tun_result).await;
+        Ok(())
+    }
+
+    #[async_recursion]
+    async fn handle_routine_tun_result<'a: 'async_recursion>(&self, result: TunnResult<'a>) {
+        match result {
+            TunnResult::WriteToNetwork(packet) => {
+                let endpoint = self.endpoint.read().await;
+                log::info!("routine: write to network: {}: {}", endpoint, packet.len());
+                if let Err(err) = self.udp.send_to(packet, *endpoint).await {
+                    error!("routine: failed to send packet: {err:?}");
+                };
+            }
+            TunnResult::Err(WireGuardError::ConnectionExpired) => {
+                warn!("Wireguard handshake has expired!");
+                // WIP(JON): consider just closing the tunnel here
+                let mut buf = vec![0u8; MAX_PACKET];
+                let Ok(mut peer) = self.wg_tunnel_lock().await else {
+                    warn!("Failed to lock WireGuard peer, closing tunnel");
+                    self.close();
+                    return;
+                };
+                peer.format_handshake_initiation(&mut buf[..], false);
+                self.handle_routine_tun_result(result).await;
+            }
+            TunnResult::Err(err) => {
+                error!("Failed to prepare routine packet for WireGuard endpoint: {err:?}");
+            }
+            TunnResult::Done => {}
+            other => {
+                warn!("Unexpected WireGuard routine task state: {other:?}");
+            }
+        };
+    }
+}
+
+pub(crate) fn start_wg_tunnel(
+    endpoint: SocketAddr,
+    udp: Arc<UdpSocket>,
+    static_private: x25519::StaticSecret,
+    peer_static_public: x25519::PublicKey,
+    peer_index: PeerIdx,
+    peer_allowed_ips: ip_network::IpNetwork,
+    packet_tx: PacketRelaySender,
+) -> (
+    tokio::task::JoinHandle<x25519::PublicKey>,
+    PeerEventSender,
+    u64,
+) {
+    let (mut tunnel, peer_tx, tag) = WireGuardTunnel::new(
+        udp,
+        endpoint,
+        static_private,
+        peer_static_public,
+        peer_index,
+        peer_allowed_ips,
+        packet_tx,
+    );
+    let join_handle = tokio::spawn(async move {
+        tunnel.spin_off().await;
+        peer_static_public
+    });
+    (join_handle, peer_tx, tag)
+}

contracts/mixnet/Makefile

@@ -1,5 +1,5 @@
 opt: wasm
-	wasm-opt --signext-lowering -Os ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm -o ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm
+	wasm-opt --disable-sign-ext -Os ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm -o ../target/wasm32-unknown-unknown/release/mixnet_contract.wasm
 
 wasm:
 	RUSTFLAGS='-C link-arg=-s' cargo build --release --target wasm32-unknown-unknown