add replay detection to packet processing

fixed nym-api config template

.github/workflows/ci-build-upload-binaries.yml

@@ -30,7 +30,6 @@ on:
       - "sdk/rust/nym-sdk/**"
       - "service-providers/**"
       - "tools/**"
-      - "nymvisor/**"
 
 jobs:
   publish-nym:
@@ -106,7 +105,6 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
-            target/release/nymvisor
           retention-days: 30
 
       # If this was a pull_request or nightly, upload to build server
@@ -124,7 +122,6 @@ jobs:
           cp target/release/nym-api $OUTPUT_DIR
           cp target/release/nym-network-requester $OUTPUT_DIR
           cp target/release/nym-network-statistics $OUTPUT_DIR
-          cp target/release/nymvisor $OUTPUT_DIR
           cp target/release/nym-cli $OUTPUT_DIR
           cp target/release/explorer-api $OUTPUT_DIR
           cp target/debian/*.deb $OUTPUT_DIR

.github/workflows/publish-nym-binaries.yml

@@ -29,7 +29,6 @@ jobs:
       client_hash: ${{ steps.binary-hashes.outputs.client_hash }}
       mixnode_hash: ${{ steps.binary-hashes.outputs.mixnode_hash }}
       gateway_hash: ${{ steps.binary-hashes.outputs.gateway_hash }}
-      nymvisor_hash: ${{ steps.binary-hashes.outputs.nymvisor_hash }}
       socks5_hash: ${{ steps.binary-hashes.outputs.socks5_hash }}
       netreq_hash: ${{ steps.binary-hashes.outputs.netreq_hash }}
       cli_hash: ${{ steps.binary-hashes.outputs.cli_hash }}
@@ -37,7 +36,6 @@ jobs:
       client_version: ${{ steps.binary-versions.outputs.client_version }}
       mixnode_version: ${{ steps.binary-versions.outputs.mixnode_version }}
       gateway_version: ${{ steps.binary-versions.outputs.gateway_version }}
-      nymvisor_version: ${{ steps.binary-versions.outputs.nymvisor_version }}
       socks5_version: ${{ steps.binary-versions.outputs.socks5_version }}
       netreq_version: ${{ steps.binary-versions.outputs.netreq_version }}
       cli_version: ${{ steps.binary-versions.outputs.cli_version }}
@@ -80,7 +78,6 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
-            target/release/nymvisor
           retention-days: 30
 
       - id: create-release
@@ -98,7 +95,6 @@ jobs:
             target/release/nym-network-requester
             target/release/nym-network-statistics
             target/release/nym-cli
-            target/release/nymvisor
 
   push-release-data-client:
     if: ${{ (startsWith(github.ref, 'refs/tags/nym-binaries-') && github.event_name == 'release') || github.event_name == 'workflow_dispatch' }}

CHANGELOG.md

@@ -4,23 +4,6 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
-## [2024.1-marabou] (2024-02-15)
-
-**New Features:**
-- Introduced nymvisor support for nym-api, gateway, and mixnode binaries ([#4158])
-- Revamped nym-api execution with the addition of init and run commands ([#4225])
-
-**Enhancements:**
-- Implemented internal improvements for gateways to optimize internal packet routing
-- Improved routing score calculation
-
-**Bug Fixes:**
-- Resolved various bugs to enhance overall stability
-
-[#4158]: https://github.com/nymtech/nym/pull/4158
-[#4225]: https://github.com/nymtech/nym/pull/4225
-
-
 ## [2023.5-rolo] (2023-11-28)
 
 - Gateway won't open websocket listener until embedded Network Requester becomes available ([#4166])

Cargo.toml

@@ -33,7 +33,7 @@ members = [
     "common/cosmwasm-smart-contracts/coconut-bandwidth-contract",
     "common/cosmwasm-smart-contracts/coconut-dkg",
     "common/cosmwasm-smart-contracts/contracts-common",
-    "common/cosmwasm-smart-contracts/ephemera",
+#    "common/cosmwasm-smart-contracts/ephemera",
     "common/cosmwasm-smart-contracts/group-contract",
     "common/cosmwasm-smart-contracts/mixnet-contract",
     "common/cosmwasm-smart-contracts/multisig-contract",

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.33"
+version = "1.1.32"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.33"
+version = "1.1.32"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/mixnode-common/Cargo.toml

@@ -24,6 +24,7 @@ tokio = { version = "1.24.1", features = [
 tokio-util = { workspace = true, features = ["codec"] }
 url = { workspace = true }
 thiserror = { workspace = true }
+fastbloom-rs = { git = "https://github.com/simonwicky/fastbloom"}
 
 ## tracing
 tracing = { version = "0.1.37", optional = true }

common/mixnode-common/src/packet_processor/error.rs

@@ -28,4 +28,7 @@ pub enum MixProcessingError {
 
     #[error("failed to process received outfox packet: {0}")]
     OutfoxProcessingError(#[from] OutfoxError),
+
+    #[error("this packet was already processed, it's a replay")]
+    ReplayedPacketDetected,
 }

common/mixnode-common/src/packet_processor/mod.rs

@@ -3,3 +3,4 @@
 
 pub mod error;
 pub mod processor;
+pub mod replay_detection;

common/mixnode-common/src/packet_processor/processor.rs

@@ -3,6 +3,7 @@
 
 use crate::measure;
 use crate::packet_processor::error::MixProcessingError;
+use crate::packet_processor::replay_detection::ReplayDetector;
 use log::*;
 use nym_sphinx_acknowledgements::surb_ack::SurbAck;
 use nym_sphinx_addressing::nodes::NymNodeRoutingAddress;
@@ -40,6 +41,9 @@ pub enum MixProcessingResult {
 pub struct SphinxPacketProcessor {
     /// Private sphinx key of this node required to unwrap received sphinx packet.
     sphinx_key: Arc<PrivateKey>,
+
+    /// Detector of replay attack
+    replay_detector: ReplayDetector,
 }
 
 impl SphinxPacketProcessor {
@@ -47,6 +51,7 @@ impl SphinxPacketProcessor {
     pub fn new(sphinx_key: PrivateKey) -> Self {
         SphinxPacketProcessor {
             sphinx_key: Arc::new(sphinx_key),
+            replay_detector: ReplayDetector::new(),
         }
     }
 
@@ -184,7 +189,7 @@ impl SphinxPacketProcessor {
         match packet {
             NymProcessedPacket::Sphinx(packet) => {
                 match packet {
-                    ProcessedPacket::ForwardHop(packet, address, delay) => self
+                    ProcessedPacket::ForwardHop(packet, address, delay, _) => self
                         .process_forward_hop(
                             NymPacket::Sphinx(*packet),
                             address,
@@ -193,12 +198,13 @@ impl SphinxPacketProcessor {
                         ),
                     // right now there's no use for the surb_id included in the header - probably it should get removed from the
                     // sphinx all together?
-                    ProcessedPacket::FinalHop(destination, _, payload) => self.process_final_hop(
-                        destination,
-                        payload.recover_plaintext()?,
-                        packet_size,
-                        packet_type,
-                    ),
+                    ProcessedPacket::FinalHop(destination, _, payload, _) => self
+                        .process_final_hop(
+                            destination,
+                            payload.recover_plaintext()?,
+                            packet_size,
+                            packet_type,
+                        ),
                 }
             }
             NymProcessedPacket::Outfox(packet) => {
@@ -239,6 +245,10 @@ impl SphinxPacketProcessor {
             // unwrap the sphinx packet and if possible and appropriate, cache keys
             let processed_packet = self.perform_initial_unwrapping(received)?;
 
+            //check for replay attack
+            self.replay_detector
+                .handle_replay_tag(&processed_packet.replay_tag())?;
+
             // for forward packets, extract next hop and set delay (but do NOT delay here)
             // for final packets, extract SURBAck
             let final_processing_result =

common/mixnode-common/src/packet_processor/replay_detection.rs

@@ -0,0 +1,76 @@
+// Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
+// SPDX-License-Identifier: Apache-2.0
+
+use crate::packet_processor::error::MixProcessingError;
+use fastbloom_rs::{BloomFilter, FilterBuilder, Membership};
+use std::sync::{Arc, Mutex};
+
+const BLOOM_FILTER_SIZE: u64 = 10_000_000;
+const FP_RATE: f64 = 1e-4;
+
+//alias for convenience
+type ReplayTag = [u8];
+
+#[derive(Clone, Debug)]
+pub struct ReplayDetector(Arc<Mutex<ReplayDetectorInner>>);
+
+impl ReplayDetector {
+    pub fn new() -> Self {
+        ReplayDetector(Arc::new(Mutex::new(ReplayDetectorInner::new())))
+    }
+
+    //check if secret has been seen already
+    //if no, return Ok
+    //if yes, add the secret to the list, then return an error
+    pub fn handle_replay_tag(&self, replay_tag: &ReplayTag) -> Result<(), MixProcessingError> {
+        match self.0.lock() {
+            Ok(mut inner) => {
+                if !inner.lookup_then_insert(replay_tag) {
+                    Ok(())
+                } else {
+                    Err(MixProcessingError::ReplayedPacketDetected)
+                }
+            }
+            Err(err) => {
+                log::warn!("Failed to handle replay_tag : {err}");
+                Ok(()) //what is the sensible thing to do, if the lock is poisoned? Reset the filter ?
+            }
+        }
+    }
+}
+
+impl Default for ReplayDetector {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[derive(Debug)]
+struct ReplayDetectorInner {
+    filter: BloomFilter,
+}
+
+impl ReplayDetectorInner {
+    pub fn new() -> Self {
+        ReplayDetectorInner {
+            filter: FilterBuilder::new(BLOOM_FILTER_SIZE, FP_RATE).build_bloom_filter(),
+        }
+    }
+
+    pub fn lookup_then_insert(&mut self, replay_tag: &ReplayTag) -> bool {
+        self.filter.contains_then_add(replay_tag)
+    }
+}
+
+#[cfg(test)]
+mod replay_detector_test {
+    use super::*;
+
+    #[test]
+    fn handle_replay_tag_correctly_detects_replay() {
+        let replay_detector = ReplayDetector::new();
+        let replay_tag = b"Hello World!";
+        assert!(replay_detector.handle_replay_tag(replay_tag).is_ok()); //first insert is fine
+        assert!(replay_detector.handle_replay_tag(replay_tag).is_err()); //second is not
+    }
+}

common/nymsphinx/types/Cargo.toml

@@ -8,9 +8,10 @@ license = { workspace = true }
 repository = { workspace = true }
 
 [dependencies]
-sphinx-packet = { version = "0.1.0", optional = true }
+#sphinx-packet = { version = "0.1.0", optional = true }
 nym-outfox = { path = "../../../nym-outfox", optional = true }
 thiserror = { workspace = true }
+sphinx-packet = { git = "https://github.com/nymtech/sphinx.git", branch = "simon/replay_tag", optional = true}
 
 [features]
 default = ["sphinx"]

common/nymsphinx/types/src/lib.rs

@@ -9,6 +9,7 @@ pub use nym_outfox::{
 // re-exporting types and constants available in sphinx
 #[cfg(feature = "outfox")]
 use nym_outfox::packet::{OutfoxPacket, OutfoxProcessedPacket};
+use sphinx_packet::header::keys::ReplayTag;
 #[cfg(feature = "sphinx")]
 pub use sphinx_packet::{
     constants::{
@@ -57,6 +58,15 @@ pub enum NymProcessedPacket {
     Outfox(OutfoxProcessedPacket),
 }
 
+impl NymProcessedPacket {
+    pub fn replay_tag(&self) -> ReplayTag {
+        match self {
+            NymProcessedPacket::Sphinx(sphinx) => sphinx.replay_tag(),
+            NymProcessedPacket::Outfox(_) => todo!(), //SW temporary while I add a replay tag to outfox
+        }
+    }
+}
+
 impl fmt::Debug for NymPacket {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         #[allow(unreachable_patterns)]

explorer-api/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "explorer-api"
-version = "1.1.33"
+version = "1.1.32"
 edition = "2021"
 license.workspace = true
 

gateway/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-gateway"
 license = "GPL-3.0"
-version = "1.1.33"
+version = "1.1.32"
 authors = [
     "Dave Hrycyszyn <futurechimp@users.noreply.github.com>",
     "Jędrzej Stuczyński <andrew@nymtech.net>",

gateway/debian/postinst

@@ -1,63 +1,6 @@
-#!/bin/sh
-
-default_location="/usr/bin/nym-gateway"
-default_user="nym"
-default_group="nym"
-
-if [ -f "/tmp/nym_gateway_preinst_marker" ]; then
-    backup_path=$(cat /tmp/nym_gateway_preinst_marker)
-    echo "Upgrade detected. Previous version backed up at $backup_path"
-
-    existing_location=$(dirname "$backup_path" | sed 's/\.backup\..*//')
-    echo "Existing location: ${existing_location}"
-
-    if [ "$existing_location" != "$default_location" ]; then
-        echo "Custom installation location detected: $existing_location"
-
-        mv "$default_location" "$existing_location/nym-gateway"
-
-        original_user=$(stat -c "%U" "$backup_path")
-        original_group=$(stat -c "%G" "$backup_path")
-        original_perms=$(stat -c "%a" "$backup_path")
-
-        chown "$original_user:$original_group" "$existing_location/nym-gateway"
-        chmod "$original_perms" "$existing_location/nym-gateway"
-    fi
-
-    rm -f /tmp/nym_gateway_preinst_marker
-else
-    echo "Fresh installation detected."
-
-    if [ -f "$default_location" ]; then
-        # Leave the binary as the  user to perform the apt install
-        # It's down to the user to specify the correct ownership and permissions
-        chmod 755 "$default_location"
-
-        echo "Installation complete. Please configure and start the nym-gateway process manually."
-        echo "Refer to https://nymtech.net/operators/nodes/gateway-setup.html"
-        echo "Example for setting up the nym-gateway service:"
-        echo
-        cat <<EOF
-[Unit]
-Description=Nym Gateway
-After=network-online.target
-
-[Service]
-ExecStart=$default_location run --id nym-gateway
-User=$default_user
-
-[Install]
-WantedBy=multi-user.target
-EOF
-    else
-        echo "Error: the new binary $default_location does not exist."
-    fi
-fi
-
-echo
-echo "Consider restarting the nym-gateway service if it is already enabled."
-echo "systemctl restart nym-gateway.service"
-
-exit 0
-
 #DEBHELPER#
+
+useradd nym
+mkdir -p /etc/nym
+chown -R nym /etc/nym
+su nym -c 'NYM_HOME_DIR=/etc/nym nym-gateway init --host 0.0.0.0 --id nym-gateway --public-ips $(curl https://ipinfo.io/ip)'

gateway/debian/preinst

@@ -1,26 +0,0 @@
-#!/bin/sh
-
-backup_dir="/var/lib/nym-gateway-backup"
-mkdir -p "$backup_dir"
-
-existing_binaries=$(find / \( -path /proc -o -path /sys -o -path /dev -o -path /mnt -o -path /media \) -prune -o -type f -name "nym-gateway" -print 2>/dev/null)
-
-if [ -n "$existing_binaries" ]; then
-    echo "Existing installation(s) detected. Preparing for upgrade."
-
-    for binary_path in $existing_binaries; do
-        backup_path="$backup_dir/$(basename $binary_path).backup.$(date +%Y-%m-%dT%H:%M:%S)"
-        cp "$binary_path" "$backup_path"
-        
-        echo "Backed up existing binary from $binary_path to $backup_path"
-    done
-
-    oldest_binary=$(echo "$existing_binaries" | head -n 1)
-    echo "$oldest_binary" > /tmp/nym_gateway_preinst_marker
-else
-    echo "No existing nym-gateway installation detected. Proceeding with fresh installation."
-fi
-
-exit 0
-
-#DEBHELPER#

gateway/debian/service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Nym Gateway
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/nym-gateway run --id nym-gateway
+User=nym
+Environment="NYM_HOME_DIR=/etc/nym"
+
+[Install]
+WantedBy=multi-user.target

mixnode/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-mixnode"
 license = "GPL-3.0"
-version = "1.1.35"
+version = "1.1.34"
 authors = [
     "Dave Hrycyszyn <futurechimp@users.noreply.github.com>",
     "Jędrzej Stuczyński <andrew@nymtech.net>",

mixnode/debian/postinst

@@ -1,64 +1,6 @@
-#!/bin/sh
-
-default_location="/usr/bin/nym-mixnode"
-default_user="nym"
-default_group="nym"
-
-if [ -f "/tmp/nym_mixnode_preinst_marker" ]; then
-    backup_path=$(cat /tmp/nym_mixnode_preinst_marker)
-    echo "Upgrade detected. Previous version backed up at $backup_path"
-
-    existing_location=$(dirname "$backup_path" | sed 's/\.backup\..*//')
-    echo "Existing location: ${existing_location}"
-
-    if [ "$existing_location" != "$default_location" ]; then
-        echo "Custom installation location detected: $existing_location"
-
-        mv "$default_location" "$existing_location/nym-mixnode"
-
-        original_user=$(stat -c "%U" "$backup_path")
-        original_group=$(stat -c "%G" "$backup_path")
-        original_perms=$(stat -c "%a" "$backup_path")
-
-        chown "$original_user:$original_group" "$existing_location/nym-mixnode"
-        chmod "$original_perms" "$existing_location/nym-mixnode"
-    fi
-
-    rm -f /tmp/nym_mixnode_preinst_marker
-else
-    echo "Fresh installation detected."
-
-    if [ -f "$default_location" ]; then
-        # Leave the binary as the  user to perform the apt install
-        # It's down to the user to specify the correct ownership and permissions
-        chmod 755 "$default_location"
-
-        echo "Installation complete. Please configure and start the nym-mixnode process manually."
-        echo "Refer to https://nymtech.net/operators/nodes/mixnode-setup.html"
-        echo "Example for setting up the nym-mixnode service:"
-        echo
-
-        cat <<EOF
-[Unit]
-Description=Nym mixnode
-After=network-online.target
-
-[Service]
-ExecStart=$default_location run --id nym-mixnode
-User=$default_user
-
-[Install]
-WantedBy=multi-user.target
-EOF
-    else
-        echo "Error: the new binary $default_location does not exist."
-    fi
-fi
-
-echo
-echo "Consider restarting the nym-mixnode service if it is already enabled."
-echo "systemctl restart nym-mixnode.service"
-
-exit 0
-
 #DEBHELPER#
+
+useradd nym
+mkdir -p /etc/nym
+chown -R nym /etc/nym
+su nym -c 'NYM_HOME_DIR=/etc/nym nym-mixnode init --host 0.0.0.0 --id nym-mixnode'

mixnode/debian/preinst

@@ -1,26 +0,0 @@
-#!/bin/sh
-
-backup_dir="/var/lib/nym-mixnode-backup"
-mkdir -p "$backup_dir"
-
-existing_binaries=$(find / \( -path /proc -o -path /sys -o -path /dev -o -path /mnt -o -path /media \) -prune -o -type f -name "nym-mixnode" -print 2>/dev/null)
-
-if [ -n "$existing_binaries" ]; then
-    echo "Existing installation(s) detected. Preparing for upgrade."
-
-    for binary_path in $existing_binaries; do
-        backup_path="$backup_dir/$(basename $binary_path).backup.$(date +%Y-%m-%dT%H:%M:%S)"
-        cp "$binary_path" "$backup_path"
-        
-        echo "Backed up existing binary from $binary_path to $backup_path"
-    done
-
-    oldest_binary=$(echo "$existing_binaries" | head -n 1)
-    echo "$oldest_binary" > /tmp/nym_mixnode_preinst_marker
-else
-    echo "No existing nym-mixnode installation detected. Proceeding with fresh installation."
-fi
-
-exit 0
-
-#DEBHELPER#

mixnode/debian/service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Nym Mixnode
+After=network-online.target
+
+[Service]
+ExecStart=/usr/bin/nym-mixnode run --id nym-mixnode
+User=nym
+Environment="NYM_HOME_DIR=/etc/nym"
+
+[Install]
+WantedBy=multi-user.target

nym-api/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.35"
+version = "1.1.34"
 authors = [
     "Dave Hrycyszyn <futurechimp@users.noreply.github.com>",
     "Jędrzej Stuczyński <andrew@nymtech.net>",
@@ -66,21 +66,20 @@ schemars = { workspace = true, features = ["preserve_order"] }
 zeroize = { workspace = true }
 
 ## ephemera-specific
-actix-web = "4"
-array-bytes = "6.0.0"
-chrono = { version = "0.4.24", default-features = false, features = ["clock"] }
-futures-util = "0.3.25"
-serde_derive = "1.0.149"
-tempfile = "3.3.0"
-uuid = { version = "1.3.0", features = ["serde", "v4"] }
+#actix-web = "4"
+#array-bytes = "6.0.0"
+#chrono = { version = "0.4.24", default-features = false, features = ["clock"] }
+#futures-util = "0.3.25"
+#serde_derive = "1.0.149"
+#uuid = { version = "1.3.0", features = ["serde", "v4"] }
 
 ## internal
-ephemera = { path = "../ephemera" }
+#ephemera = { path = "../ephemera" }
 nym-bandwidth-controller = { path = "../common/bandwidth-controller" }
 nym-coconut-bandwidth-contract-common = { path = "../common/cosmwasm-smart-contracts/coconut-bandwidth-contract" }
 nym-coconut-dkg-common = { path = "../common/cosmwasm-smart-contracts/coconut-dkg" }
 nym-coconut-interface = { path = "../common/coconut-interface" }
-nym-ephemera-common = { path = "../common/cosmwasm-smart-contracts/ephemera" }
+#nym-ephemera-common = { path = "../common/cosmwasm-smart-contracts/ephemera" }
 nym-config = { path = "../common/config" }
 cosmwasm-std = { workspace = true }
 nym-credential-storage = { path = "../common/credential-storage" }
@@ -123,6 +122,7 @@ sqlx = { workspace = true, features = [
 ] }
 
 [dev-dependencies]
+tempfile = "3.3.0"
 cw3 = { workspace = true }
 cw-utils = { workspace = true }
 rand_chacha = "0.3"

nym-api/src/coconut/dkg/state/dealing_exchange.rs

@@ -5,7 +5,7 @@ use super::serde_helpers::generated_dealings;
 use crate::coconut::dkg::state::DkgParticipant;
 use nym_coconut_dkg_common::types::DealingIndex;
 use nym_dkg::{Dealing, NodeIndex};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::collections::{BTreeMap, HashMap};
 
 #[derive(Debug, Clone, Default, Serialize, Deserialize)]

nym-api/src/coconut/dkg/state/in_progress.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Copy, Default, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]

nym-api/src/coconut/dkg/state/key_derivation.rs

@@ -5,7 +5,7 @@ use super::serde_helpers::recovered_keys;
 use cosmwasm_std::Addr;
 use nym_coconut_dkg_common::types::{DealingIndex, EpochId};
 use nym_dkg::{G2Projective, NodeIndex, RecoveredVerificationKeys, Threshold};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::collections::{BTreeMap, HashMap};
 use thiserror::Error;
 

nym-api/src/coconut/dkg/state/key_finalization.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Copy, Default, Serialize, Deserialize)]
 #[serde(rename_all = "lowercase")]

nym-api/src/coconut/dkg/state/key_validation.rs

@@ -1,7 +1,7 @@
 // Copyright 2024 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 
 type ProposalId = u64;

nym-api/src/coconut/dkg/state/registration.rs

@@ -7,7 +7,7 @@ use nym_coconut_dkg_common::dealer::DealerDetails;
 use nym_coconut_dkg_common::types::EncodedBTEPublicKeyWithProof;
 use nym_dkg::bte::PublicKeyWithProof;
 use nym_dkg::{bte, NodeIndex};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use thiserror::Error;
 
 #[derive(Clone, Deserialize, Debug, Serialize)]

nym-api/src/ephemera/mod.rs

@@ -1,11 +1,14 @@
 // Copyright 2023 - Nym Technologies SA <contact@nymtech.net>
 // SPDX-License-Identifier: GPL-3.0-only
 
+// while those files are completely unused now, I'm going to leave them here for future reference once we decide to revive the project to have a starting point
+// but whoever picks it up: you are forbidden from trying to use actix
+
 extern crate core;
 
 use clap::Parser;
 use ephemera::cli::init::Cmd;
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 use std::path::PathBuf;
 
 pub(crate) mod application;

nym-api/src/epoch_operations/helpers.rs

@@ -5,7 +5,7 @@ use crate::epoch_operations::RewardedSetUpdater;
 use cosmwasm_std::{Decimal, Fraction};
 use nym_mixnet_contract_common::reward_params::Performance;
 use nym_mixnet_contract_common::{ExecuteMsg, Interval, MixId};
-use serde_derive::{Deserialize, Serialize};
+use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Copy, Serialize, Deserialize)]
 pub(crate) struct MixnodeWithPerformance {

nym-api/src/epoch_operations/mod.rs

@@ -12,7 +12,6 @@
 // 3. Eventually this whole procedure is going to get expanded to allow for distribution of rewarded set generation
 //    and hence this might be a good place for it.
 
-use crate::ephemera::reward::{EpochOperations, RewardManager};
 use crate::node_status_api::ONE_DAY;
 use crate::nym_contract_cache::cache::NymContractCache;
 use crate::support::nyxd::Client;
@@ -33,7 +32,6 @@ mod rewarding;
 mod transition_beginning;
 
 pub struct RewardedSetUpdater {
-    ephemera_reward_manager: Option<RewardManager>,
     nyxd_client: Client,
     nym_contract_cache: NymContractCache,
     storage: NymApiStorage,
@@ -47,13 +45,11 @@ impl RewardedSetUpdater {
     }
 
     pub(crate) fn new(
-        ephemera_reward_manager: Option<RewardManager>,
         nyxd_client: Client,
         nym_contract_cache: NymContractCache,
         storage: NymApiStorage,
     ) -> Self {
         RewardedSetUpdater {
-            ephemera_reward_manager,
             nyxd_client,
             nym_contract_cache,
             storage,
@@ -92,11 +88,6 @@ impl RewardedSetUpdater {
     /// 8. the whole process repeats once the new epoch finishes
     async fn perform_epoch_operations(&mut self, interval: Interval) -> Result<(), RewardingError> {
         let mut rewards = self.nodes_to_reward(interval).await;
-        if let Some(ephemera_reward_manager) = self.ephemera_reward_manager.as_mut() {
-            rewards = ephemera_reward_manager
-                .perform_epoch_operations(rewards)
-                .await?;
-        }
         rewards.sort_by_key(|a| a.mix_id);
 
         log::info!("The current epoch has finished.");
@@ -274,14 +265,12 @@ impl RewardedSetUpdater {
     }
 
     pub(crate) fn start(
-        ephemera_reward_manager: Option<RewardManager>,
         nyxd_client: Client,
         nym_contract_cache: &NymContractCache,
         storage: &NymApiStorage,
         shutdown: &TaskManager,
     ) {
         let mut rewarded_set_updater = RewardedSetUpdater::new(
-            ephemera_reward_manager,
             nyxd_client,
             nym_contract_cache.to_owned(),
             storage.to_owned(),

nym-api/src/main.rs

@@ -16,7 +16,6 @@ use crate::support::cli;
 use crate::support::config::Config;
 use crate::support::storage;
 use crate::support::storage::NymApiStorage;
-use ::ephemera::configuration::Configuration as EphemeraConfiguration;
 use ::nym_config::defaults::setup_env;
 use circulating_supply_api::cache::CirculatingSupplyCache;
 use clap::Parser;
@@ -32,7 +31,6 @@ use support::{http, nyxd};
 
 mod circulating_supply_api;
 mod coconut;
-mod ephemera;
 mod epoch_operations;
 pub(crate) mod network;
 mod network_monitor;
@@ -163,33 +161,6 @@ async fn start_nym_api_tasks(config: Config) -> anyhow::Result<ShutdownHandles>
     // and then only start the uptime updater (and the monitor itself, duh)
     // if the monitoring if it's enabled
     if config.network_monitor.enabled {
-        let ephemera_config =
-            match EphemeraConfiguration::try_load(config.get_ephemera_config_path()) {
-                Ok(c) => c,
-                Err(_) => {
-                    config
-                        .get_ephemera_args()
-                        .cmd
-                        .clone()
-                        .execute(Some(&config.get_id()));
-                    EphemeraConfiguration::try_load(config.get_ephemera_config_path())
-                        .expect("Config file should be created now")
-                }
-            };
-        let ephemera_reward_manager = if config.ephemera.enabled {
-            Some(
-                ephemera::application::NymApi::run(
-                    config.get_ephemera_args().clone(),
-                    ephemera_config,
-                    nyxd_client.clone(),
-                    &shutdown,
-                )
-                .await?,
-            )
-        } else {
-            None
-        };
-
         // if network monitor is enabled, the storage MUST BE available
         let storage = maybe_storage.unwrap();
 
@@ -207,13 +178,7 @@ async fn start_nym_api_tasks(config: Config) -> anyhow::Result<ShutdownHandles>
         // start 'rewarding' if its enabled
         if config.rewarding.enabled {
             epoch_operations::ensure_rewarding_permission(&nyxd_client).await?;
-            RewardedSetUpdater::start(
-                ephemera_reward_manager,
-                nyxd_client,
-                nym_contract_cache_state,
-                storage,
-                &shutdown,
-            );
+            RewardedSetUpdater::start(nyxd_client, nym_contract_cache_state, storage, &shutdown);
         }
     }
 

nym-api/src/node_describe_cache/mod.rs

@@ -6,7 +6,7 @@ use crate::support::caching::cache::{SharedCache, UninitialisedCache};
 use crate::support::caching::refresher::{CacheItemProvider, CacheRefresher};
 use crate::support::config;
 use crate::support::config::DEFAULT_NODE_DESCRIBE_BATCH_SIZE;
-use futures_util::{stream, StreamExt};
+use futures::{stream, StreamExt};
 use nym_api_requests::models::{
     IpPacketRouterDetails, NetworkRequesterDetails, NymNodeDescription,
 };

nym-api/src/support/config/mod.rs

@@ -106,8 +106,6 @@ pub struct Config {
     pub rewarding: Rewarding,
 
     pub coconut_signer: CoconutSigner,
-
-    pub ephemera: Ephemera,
 }
 
 impl NymConfigTemplate for Config {
@@ -127,7 +125,6 @@ impl Config {
             circulating_supply_cacher: Default::default(),
             rewarding: Default::default(),
             coconut_signer: CoconutSigner::new_default(id.as_ref()),
-            ephemera: Ephemera::new_default(id.as_ref()),
         }
     }
 
@@ -142,10 +139,6 @@ impl Config {
             bail!("can't enable coconut signer without providing a mnemonic")
         }
 
-        if !can_sign && self.ephemera.enabled {
-            bail!("can't enable ephemera without providing a mnemonic")
-        }
-
         Ok(())
     }
 
@@ -223,10 +216,6 @@ impl Config {
         }
     }
 
-    pub fn get_id(&self) -> String {
-        self.base.id.clone()
-    }
-
     pub fn get_nyxd_url(&self) -> Url {
         self.base.local_validator.clone()
     }
@@ -234,14 +223,6 @@ impl Config {
     pub fn get_mnemonic(&self) -> Option<&bip39::Mnemonic> {
         self.base.mnemonic.as_ref()
     }
-
-    pub fn get_ephemera_args(&self) -> &crate::ephemera::Args {
-        &self.ephemera.args
-    }
-
-    pub fn get_ephemera_config_path(&self) -> PathBuf {
-        self.ephemera.args.ephemera_config.clone()
-    }
 }
 
 // we only really care about the mnemonic being zeroized
@@ -558,25 +539,3 @@ impl Default for CoconutSignerDebug {
         }
     }
 }
-
-#[derive(Debug, Default, Deserialize, PartialEq, Eq, Serialize)]
-#[serde(default)]
-pub struct Ephemera {
-    pub enabled: bool,
-    args: crate::ephemera::Args,
-}
-
-impl Ephemera {
-    fn new_default(id: &str) -> Self {
-        Ephemera {
-            enabled: false,
-            args: crate::ephemera::Args {
-                ephemera_config: ephemera::configuration::Configuration::ephemera_config_file_home(
-                    Some(id),
-                )
-                .unwrap(),
-                ..Default::default()
-            },
-        }
-    }
-}

nym-api/src/support/config/template.rs

@@ -127,12 +127,4 @@ decryption_key_path = '{{ coconut_signer.storage_paths.decryption_key_path }}'
 # Path to the dkg dealer public key with proof
 public_key_with_proof_path = '{{ coconut_signer.storage_paths.public_key_with_proof_path }}'
 
-[ephemera]
-
-enabled = {{ ephemera.enabled }}
-
-[ephemera.args]
-
-ephemera_config = '{{ ephemera.args.ephemera_config }}'
-
 "#;

nym-api/src/support/nyxd/mod.rs

@@ -23,8 +23,7 @@ use nym_coconut_dkg_common::{
     verification_key::{ContractVKShare, VerificationKeyShare},
 };
 use nym_config::defaults::{ChainDetails, NymNetworkDetails};
-use nym_ephemera_common::msg::QueryMsg as EphemeraQueryMsg;
-use nym_ephemera_common::types::JsonPeerInfo;
+
 use nym_mixnet_contract_common::families::FamilyHead;
 use nym_mixnet_contract_common::mixnode::MixNodeDetails;
 use nym_mixnet_contract_common::reward_params::RewardingParams;
@@ -38,11 +37,10 @@ use nym_validator_client::nyxd::contract_traits::{NameServiceQueryClient, PagedD
 use nym_validator_client::nyxd::error::NyxdError;
 use nym_validator_client::nyxd::{
     contract_traits::{
-        CoconutBandwidthQueryClient, DkgQueryClient, DkgSigningClient, EphemeraQueryClient,
-        EphemeraSigningClient, GroupQueryClient, MixnetQueryClient, MixnetSigningClient,
-        MultisigQueryClient, MultisigSigningClient, NymContractsProvider, PagedEphemeraQueryClient,
-        PagedMixnetQueryClient, PagedMultisigQueryClient, PagedVestingQueryClient,
-        SpDirectoryQueryClient,
+        CoconutBandwidthQueryClient, DkgQueryClient, DkgSigningClient, GroupQueryClient,
+        MixnetQueryClient, MixnetSigningClient, MultisigQueryClient, MultisigSigningClient,
+        NymContractsProvider, PagedMixnetQueryClient, PagedMultisigQueryClient,
+        PagedVestingQueryClient, SpDirectoryQueryClient,
     },
     cosmwasm_client::types::ExecuteResult,
     CosmWasmClient, Fee,
@@ -569,23 +567,6 @@ impl crate::coconut::client::Client for Client {
     }
 }
 
-#[async_trait]
-impl crate::ephemera::client::Client for Client {
-    async fn get_ephemera_peers(&self) -> crate::ephemera::error::Result<Vec<JsonPeerInfo>> {
-        Ok(nyxd_query!(self, get_all_ephemera_peers().await?))
-    }
-
-    async fn register_ephemera_peer(
-        &self,
-        peer_info: JsonPeerInfo,
-    ) -> crate::ephemera::error::Result<ExecuteResult> {
-        Ok(nyxd_signing!(
-            self,
-            register_as_peer(peer_info, None).await?
-        ))
-    }
-}
-
 #[async_trait]
 impl DkgQueryClient for Client {
     async fn query_dkg_contract<T>(&self, query: DkgQueryMsg) -> std::result::Result<T, NyxdError>
@@ -596,19 +577,6 @@ impl DkgQueryClient for Client {
     }
 }
 
-#[async_trait]
-impl EphemeraQueryClient for Client {
-    async fn query_ephemera_contract<T>(
-        &self,
-        query: EphemeraQueryMsg,
-    ) -> std::result::Result<T, NyxdError>
-    where
-        for<'a> T: Deserialize<'a>,
-    {
-        nyxd_query!(self, query_ephemera_contract(query).await)
-    }
-}
-
 #[async_trait]
 impl SpDirectoryQueryClient for Client {
     async fn query_service_provider_contract<T>(

nym-connect/desktop/Cargo.lock

@@ -958,6 +958,12 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28c122c3980598d243d63d9a704629a2d748d101f278052ff068be5a4423ab6f"
 
+[[package]]
+name = "const-str"
+version = "0.5.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aca749d3d3f5b87a0d6100509879f9cf486ab510803a4a4e1001da1ff61c2bd6"
+
 [[package]]
 name = "constant_time_eq"
 version = "0.3.0"
@@ -3722,6 +3728,7 @@ dependencies = [
  "clap",
  "clap_complete",
  "clap_complete_fig",
+ "const-str",
  "log",
  "pretty_env_logger",
  "schemars",
@@ -3762,6 +3769,7 @@ dependencies = [
  "serde",
  "serde_json",
  "sha2 0.10.8",
+ "si-scale",
  "sqlx",
  "tap",
  "thiserror",
@@ -4138,6 +4146,7 @@ dependencies = [
  "cfg-if",
  "dotenvy",
  "hex-literal",
+ "log",
  "once_cell",
  "schemars",
  "serde",
@@ -6221,6 +6230,12 @@ dependencies = [
  "lazy_static",
 ]
 
+[[package]]
+name = "si-scale"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44beb68bf488343b13ddbd74d1d5d5e6559a58b6dfaee74eb8d5ed4f7ed7666f"
+
 [[package]]
 name = "signal-hook"
 version = "0.3.17"

nym-node/Cargo.toml

@@ -37,12 +37,7 @@ mime = "0.3.17"
 hyper = { workspace = true }
 tower = { version = "0.4.13" }
 tower-http = { version = "0.4.4", features = ["fs"] }
-
-# `actix_extras`? what the hell?
-# hear me out first!
-# we can't use `axum_extras` because of freaking ephemera that depends on `actix_extras`.
-# however, it seems that pulling in `actix_extras` pulls in just enough shared features to improve `IntoParams` for our Query attributes
-utoipa = { workspace = true, features = ["actix_extras"] } # can't use `"axum_extras"` feature because ephemera uses `"actix_extras"` -.-'
+utoipa = { workspace = true, features = ["axum_extras"] }
 utoipa-swagger-ui = { workspace = true, features = ["axum"] }
 
 # if we ever wanted redoc/rapidoc bridges:

nym-outfox/Cargo.toml

@@ -18,7 +18,8 @@ curve25519-dalek = "3.2"
 chacha20poly1305 = "0.10.1"
 getrandom = { workspace = true, features = ["js"] }
 thiserror = { workspace = true }
-sphinx-packet = "0.1.0"
+#sphinx-packet = "0.1.0"
+sphinx-packet = { git = "https://github.com/nymtech/sphinx.git", branch = "simon/replay_tag"}
 rand = "0.7.3"
 log = "0.4"
 

nym-wallet/Cargo.lock

@@ -3454,6 +3454,7 @@ dependencies = [
  "nym-network-defaults",
  "nym-service-provider-directory-common",
  "nym-vesting-contract-common",
+ "openssl",
  "prost",
  "reqwest",
  "serde",
@@ -3685,6 +3686,15 @@ version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ff011a302c396a5197692431fc1948019154afc178baf7d8e37367442a4601cf"
 
+[[package]]
+name = "openssl-src"
+version = "111.27.0+1.1.1v"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06e8f197c82d7511c5b014030c9b1efeda40d7d5f99d23b4ceed3524a5e63f02"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.91"
@@ -3693,6 +3703,7 @@ checksum = "866b5f16f90776b9bb8dc1e1802ac6f0513de3a7a7465867bfbc563dc737faac"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -4443,7 +4454,6 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots",
  "winreg",
 ]
 
@@ -6260,12 +6270,6 @@ dependencies = [
  "system-deps 6.1.1",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.25.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f20c57d8d7db6d3b86154206ae5d8fba62dd39573114de97c2cb0578251f8e1"
-
 [[package]]
 name = "webview2-com"
 version = "0.19.1"

nym-wallet/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nymproject/nym-wallet-app",
-  "version": "1.2.13",
+  "version": "1.2.12-rc.2",
   "license": "MIT",
   "main": "index.js",
   "scripts": {

nym-wallet/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym_wallet"
-version = "1.2.12"
+version = "1.2.11"
 description = "Nym Native Wallet"
 authors = ["Nym Technologies SA"]
 license = ""

nym-wallet/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "package": {
     "productName": "nym-wallet",
-    "version": "1.2.12"
+    "version": "1.2.11"
   },
   "build": {
     "distDir": "../dist",

service-providers/network-requester/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.33"
+version = "1.1.32"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.65"

service-providers/network-statistics/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-network-statistics"
-version = "1.1.33"
+version = "1.1.32"
 edition = "2021"
 license.workspace = true
 

tools/nym-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.34"
+version = "1.1.33"
 authors.workspace = true
 edition = "2021"
 license.workspace = true
@@ -30,4 +30,4 @@ nym-network-defaults = { path = "../../common/network-defaults" }
 [package.metadata.deb]
 name = "nym-cli"
 maintainer-scripts = "debian"
-systemd-units = { enable = false }
+systemd-units = { enable = false }