Use custom topology

* Create bandwidth entry

* Remove mismatch possibilities

CHANGELOG.md

@@ -4,6 +4,80 @@ Post 1.0.0 release, the changelog format is based on [Keep a Changelog](https://
 
 ## [Unreleased]
 
+## [2024.12-aero] (2024-10-17)
+
+- nym-node: don't use bloomfilters for double spending checks ([#4960])
+- bugfix: replace unreachable macro with an error return ([#4958])
+- [DOCs:/operators]: Update FAQ sphinx size ([#4946])
+- [DOCs/operators]: Release notes v2024.11-wedel ([#4939])
+- Fix handle drop ([#4934])
+- Assume offline mode ([#4926])
+- Make ip-packet-request VERSION pub ([#4925])
+- Expose error type ([#4924])
+- Fix argument to cargo-deny action ([#4922])
+- Fix nymvpn.com url in mainnet defaults ([#4920])
+- Check both version and type in message header ([#4918])
+- Bump http-api-client default timeout to 30 sec ([#4917])
+- Max/proxy ffi ([#4906])
+- Data Observatory stub ([#4905])
+- Fix missing duplication of modified tables ([#4904])
+- Update cargo deny ([#4901])
+- docs: add hostname instructions for wss ([#4900])
+- build(deps): bump the patch-updates group across 1 directory with 9 updates ([#4898])
+- Fix clippy for beta toolchain ([#4897])
+- Remove clippy github PR annotations ([#4896])
+- Fix apt install in ci-build-upload-binaries.yml ([#4894])
+- Update network monitor entrypoint ([#4893])
+- Update nym-vpn metapackage and replace nymvpn-x with nym-vpn-app ([#4889])
+- Entry wireguard tickets ([#4888])
+- Build and Push CI ([#4887])
+- Feature/updated gateway registration ([#4885])
+- Few fixes to NNM pre deploy ([#4883])
+- Fix sql serde with enum ([#4875])
+- allow clients to send stateless gateway requests without prior registration ([#4873])
+- chore: remove queued migration for adding explicit admin ([#4871])
+- Gateway database modifications for different modes ([#4868])
+- build(deps): bump strum from 0.25.0 to 0.26.3 ([#4848])
+- Use serde from workspace ([#4833])
+- build(deps): bump toml from 0.5.11 to 0.8.14 ([#4805])
+- Max/rust sdk stream abstraction ([#4743])
+
+[#4960]: https://github.com/nymtech/nym/pull/4960
+[#4958]: https://github.com/nymtech/nym/pull/4958
+[#4946]: https://github.com/nymtech/nym/pull/4946
+[#4939]: https://github.com/nymtech/nym/pull/4939
+[#4934]: https://github.com/nymtech/nym/pull/4934
+[#4926]: https://github.com/nymtech/nym/pull/4926
+[#4925]: https://github.com/nymtech/nym/pull/4925
+[#4924]: https://github.com/nymtech/nym/pull/4924
+[#4922]: https://github.com/nymtech/nym/pull/4922
+[#4920]: https://github.com/nymtech/nym/pull/4920
+[#4918]: https://github.com/nymtech/nym/pull/4918
+[#4917]: https://github.com/nymtech/nym/pull/4917
+[#4906]: https://github.com/nymtech/nym/pull/4906
+[#4905]: https://github.com/nymtech/nym/pull/4905
+[#4904]: https://github.com/nymtech/nym/pull/4904
+[#4901]: https://github.com/nymtech/nym/pull/4901
+[#4900]: https://github.com/nymtech/nym/pull/4900
+[#4898]: https://github.com/nymtech/nym/pull/4898
+[#4897]: https://github.com/nymtech/nym/pull/4897
+[#4896]: https://github.com/nymtech/nym/pull/4896
+[#4894]: https://github.com/nymtech/nym/pull/4894
+[#4893]: https://github.com/nymtech/nym/pull/4893
+[#4889]: https://github.com/nymtech/nym/pull/4889
+[#4888]: https://github.com/nymtech/nym/pull/4888
+[#4887]: https://github.com/nymtech/nym/pull/4887
+[#4885]: https://github.com/nymtech/nym/pull/4885
+[#4883]: https://github.com/nymtech/nym/pull/4883
+[#4875]: https://github.com/nymtech/nym/pull/4875
+[#4873]: https://github.com/nymtech/nym/pull/4873
+[#4871]: https://github.com/nymtech/nym/pull/4871
+[#4868]: https://github.com/nymtech/nym/pull/4868
+[#4848]: https://github.com/nymtech/nym/pull/4848
+[#4833]: https://github.com/nymtech/nym/pull/4833
+[#4805]: https://github.com/nymtech/nym/pull/4805
+[#4743]: https://github.com/nymtech/nym/pull/4743
+
 ## [2024.11-wedel] (2024-09-23)
 
 - Backport #4894 to fix ci ([#4899])

Cargo.lock

@@ -2317,7 +2317,7 @@ checksum = "0206175f82b8d6bf6652ff7d71a1e27fd2e4efde587fd368662814d6ec1d9ce0"
 
 [[package]]
 name = "explorer-api"
-version = "1.1.40"
+version = "1.1.41"
 dependencies = [
  "chrono",
  "clap 4.5.17",
@@ -4223,7 +4223,7 @@ checksum = "830b246a0e5f20af87141b25c173cd1b609bd7779a4617d6ec582abaf90870f3"
 
 [[package]]
 name = "nym-api"
-version = "1.1.44"
+version = "1.1.45"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -4469,7 +4469,7 @@ dependencies = [
 
 [[package]]
 name = "nym-cli"
-version = "1.1.42"
+version = "1.1.43"
 dependencies = [
  "anyhow",
  "base64 0.22.1",
@@ -4550,7 +4550,7 @@ dependencies = [
 
 [[package]]
 name = "nym-client"
-version = "1.1.41"
+version = "1.1.42"
 dependencies = [
  "bs58",
  "clap 4.5.17",
@@ -5589,7 +5589,7 @@ dependencies = [
 
 [[package]]
 name = "nym-network-requester"
-version = "1.1.42"
+version = "1.1.43"
 dependencies = [
  "addr",
  "anyhow",
@@ -5640,7 +5640,7 @@ dependencies = [
 
 [[package]]
 name = "nym-node"
-version = "1.1.8"
+version = "1.1.9"
 dependencies = [
  "anyhow",
  "bip39",
@@ -5929,7 +5929,7 @@ dependencies = [
 
 [[package]]
 name = "nym-socks5-client"
-version = "1.1.41"
+version = "1.1.42"
 dependencies = [
  "bs58",
  "clap 4.5.17",
@@ -6457,7 +6457,7 @@ dependencies = [
 
 [[package]]
 name = "nymvisor"
-version = "0.1.7"
+version = "0.1.8"
 dependencies = [
  "anyhow",
  "bytes",

clients/native/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-client"
-version = "1.1.41"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>", "Jędrzej Stuczyński <andrew@nymtech.net>"]
 description = "Implementation of the Nym Client"
 edition = "2021"

clients/socks5/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-socks5-client"
-version = "1.1.41"
+version = "1.1.42"
 authors = ["Dave Hrycyszyn <futurechimp@users.noreply.github.com>"]
 description = "A SOCKS5 localhost proxy that converts incoming messages to Sphinx and sends them to a Nym address"
 edition = "2021"

common/credential-verification/src/ecash/double_spending.rs

@@ -1,100 +0,0 @@
-// Copyright 2022-2024 - Nym Technologies SA <contact@nymtech.net>
-// SPDX-License-Identifier: GPL-3.0-only
-
-use crate::ecash::error::EcashTicketError;
-use crate::ecash::state::SharedState;
-use nym_ecash_double_spending::DoubleSpendingFilter;
-use nym_gateway_storage::Storage;
-use nym_task::TaskClient;
-use nym_validator_client::client::NymApiClientExt;
-use nym_validator_client::EcashApiClient;
-use rand::prelude::SliceRandom;
-use rand::thread_rng;
-use std::sync::Arc;
-use tokio::sync::{RwLock, RwLockReadGuard};
-use tokio::time::{interval, Duration};
-use tracing::{info, trace, warn};
-
-#[derive(Clone)]
-pub(crate) struct DoubleSpendingDetector<S> {
-    spent_serial_numbers: Arc<RwLock<DoubleSpendingFilter>>,
-    shared_state: SharedState<S>,
-}
-
-impl<S> DoubleSpendingDetector<S>
-where
-    S: Storage + Clone + Send + Sync + 'static,
-{
-    pub(crate) fn new(shared_state: SharedState<S>) -> Self {
-        DoubleSpendingDetector {
-            spent_serial_numbers: Arc::new(RwLock::new(DoubleSpendingFilter::new_empty_ecash())),
-            shared_state,
-        }
-    }
-
-    pub(crate) async fn check(&self, serial_number: &Vec<u8>) -> bool {
-        self.spent_serial_numbers.read().await.check(serial_number)
-    }
-
-    async fn latest_api_endpoints(
-        &self,
-    ) -> Result<RwLockReadGuard<Vec<EcashApiClient>>, EcashTicketError> {
-        let epoch_id = self.shared_state.current_epoch_id().await?;
-        self.shared_state.api_clients(epoch_id).await
-    }
-
-    async fn refresh_bloomfilter(&self) {
-        let mut filter_builder = self.spent_serial_numbers.read().await.rebuild();
-
-        let api_clients = match self.latest_api_endpoints().await {
-            Ok(clients) => clients,
-            Err(err) => {
-                warn!("failed to obtain current api clients: {err}");
-                return;
-            }
-        };
-
-        let mut clients = api_clients
-            .iter()
-            .map(|c| c.api_client.clone())
-            .collect::<Vec<_>>();
-        clients.shuffle(&mut thread_rng());
-
-        for client in clients {
-            match client.nym_api.double_spending_filter_v1().await {
-                Ok(response) => {
-                    // due to relative big size of the filter, query only one api since all of them should contain
-                    // roughly the same data anyway.
-                    filter_builder.add_bytes(&response.bitmap);
-                    *self.spent_serial_numbers.write().await = filter_builder.build();
-                    return;
-                }
-                Err(err) => {
-                    warn!("Validator @ {} could not be reached. There might be a problem with the ecash endpoint: {err}", client.api_url());
-                }
-            }
-        }
-
-        warn!("none of the validators could be reached. the bloomfilter will remain unchanged.");
-    }
-
-    async fn run(&self, mut shutdown: TaskClient) {
-        info!("Starting Ecash DoubleSpendingDetector");
-        let mut interval = interval(Duration::from_secs(600));
-
-        while !shutdown.is_shutdown() {
-            tokio::select! {
-                biased;
-                _ = shutdown.recv() => {
-                    trace!("ecash_verifier::DoubleSpendingDetector : received shutdown");
-                },
-                _ = interval.tick() => self.refresh_bloomfilter().await,
-
-            }
-        }
-    }
-
-    pub(crate) fn start(self, shutdown: nym_task::TaskClient) {
-        tokio::spawn(async move { self.run(shutdown).await });
-    }
-}

common/credential-verification/src/ecash/mod.rs

@@ -4,7 +4,6 @@
 use crate::Error;
 use credential_sender::CredentialHandler;
 use credential_sender::CredentialHandlerConfig;
-use double_spending::DoubleSpendingDetector;
 use error::EcashTicketError;
 use futures::channel::mpsc::{self, UnboundedSender};
 use nym_credentials::CredentialSpendingData;
@@ -18,7 +17,6 @@ use tokio::sync::{Mutex, RwLockReadGuard};
 use tracing::error;
 
 pub mod credential_sender;
-pub(crate) mod double_spending;
 pub mod error;
 mod helpers;
 mod state;
@@ -31,7 +29,6 @@ pub struct EcashManager<S> {
     pk_bytes: [u8; 32], // bytes representation of a pub key representing the verifier
     pay_infos: Mutex<Vec<NymPayInfo>>,
     cred_sender: UnboundedSender<ClientTicket>,
-    double_spend_detector: DoubleSpendingDetector<S>,
 }
 
 impl<S> EcashManager<S>
@@ -47,9 +44,6 @@ where
     ) -> Result<Self, Error> {
         let shared_state = SharedState::new(nyxd_client, storage).await?;
 
-        let double_spend_detector = DoubleSpendingDetector::new(shared_state.clone());
-        double_spend_detector.clone().start(shutdown.clone());
-
         let (cred_sender, cred_receiver) = mpsc::unbounded();
 
         let cs =
@@ -62,7 +56,6 @@ where
             pk_bytes,
             pay_infos: Default::default(),
             cred_sender,
-            double_spend_detector,
         })
     }
 
@@ -163,10 +156,6 @@ where
         Ok(())
     }
 
-    pub async fn check_double_spend(&self, serial_number: &Vec<u8>) -> bool {
-        self.double_spend_detector.check(serial_number).await
-    }
-
     pub fn async_verify(&self, ticket: ClientTicket) {
         // TODO: I guess do something for shutdowns
         let _ = self

common/credential-verification/src/lib.rs

@@ -53,18 +53,6 @@ impl<S: Storage + Clone + 'static> CredentialVerifier<S> {
         Ok(())
     }
 
-    async fn check_bloomfilter(&self, serial_number: &Vec<u8>) -> Result<()> {
-        trace!("checking the bloomfilter...");
-
-        let spent = self.ecash_verifier.check_double_spend(serial_number).await;
-
-        if spent {
-            trace!("the credential has already been spent before at some gateway before (bloomfilter failure)");
-            return Err(Error::BandwidthCredentialAlreadySpent);
-        }
-        Ok(())
-    }
-
     async fn check_local_db_for_double_spending(&self, serial_number: &[u8]) -> Result<()> {
         trace!("checking local db for double spending...");
 
@@ -128,7 +116,6 @@ impl<S: Storage + Clone + 'static> CredentialVerifier<S> {
         }
 
         self.check_credential_spending_date(spend_date.ecash_date())?;
-        self.check_bloomfilter(&serial_number).await?;
         self.check_local_db_for_double_spending(&serial_number)
             .await?;
 

common/wireguard/src/error.rs

@@ -3,9 +3,6 @@
 
 #[derive(Debug, thiserror::Error)]
 pub enum Error {
-    #[error("peers in wireguard don't match with in-memory ")]
-    PeerMismatch,
-
     #[error("traffic byte data needs to be increasing")]
     InconsistentConsumedBytes,
 
@@ -20,4 +17,7 @@ pub enum Error {
 
     #[error("{0}")]
     GatewayStorage(#[from] nym_gateway_storage::error::StorageError),
+
+    #[error("{0}")]
+    SystemTime(#[from] std::time::SystemTimeError),
 }

common/wireguard/src/peer_controller.rs

@@ -160,13 +160,10 @@ impl<St: Storage + Clone + 'static> PeerController<St> {
             .ok_or(Error::MissingClientBandwidthEntry)?
             .client_id
         {
-            let bandwidth = storage
-                .get_available_bandwidth(client_id)
-                .await?
-                .ok_or(Error::MissingClientBandwidthEntry)?;
+            storage.create_bandwidth_entry(client_id).await?;
             Ok(Some(BandwidthStorageManager::new(
                 storage,
-                ClientBandwidth::new(bandwidth.into()),
+                ClientBandwidth::new(Default::default()),
                 client_id,
                 BandwidthFlushingBehaviourConfig::default(),
                 true,
@@ -228,14 +225,10 @@ impl<St: Storage + Clone + 'static> PeerController<St> {
                 .available_bandwidth()
                 .await
         } else {
-            let peer = self
-                .host_information
-                .read()
-                .await
-                .peers
-                .get(key)
-                .ok_or(Error::PeerMismatch)?
-                .clone();
+            let Some(peer) = self.host_information.read().await.peers.get(key).cloned() else {
+                // host information not updated yet
+                return Ok(None);
+            };
             BANDWIDTH_CAP_PER_DAY.saturating_sub((peer.rx_bytes + peer.tx_bytes) as i64)
         };
 

common/wireguard/src/peer_handle.rs

@@ -3,6 +3,7 @@
 
 use crate::error::Error;
 use crate::peer_controller::PeerControlRequest;
+use defguard_wireguard_rs::host::Peer;
 use defguard_wireguard_rs::{host::Host, key::Key};
 use futures::channel::oneshot;
 use nym_authenticator_requests::v2::registration::BANDWIDTH_CAP_PER_DAY;
@@ -12,10 +13,12 @@ use nym_gateway_storage::Storage;
 use nym_task::TaskClient;
 use nym_wireguard_types::DEFAULT_PEER_TIMEOUT_CHECK;
 use std::sync::Arc;
+use std::time::{Duration, SystemTime};
 use tokio::sync::{mpsc, RwLock};
 use tokio_stream::{wrappers::IntervalStream, StreamExt};
 
 pub(crate) type SharedBandwidthStorageManager<St> = Arc<RwLock<BandwidthStorageManager<St>>>;
+const AUTO_REMOVE_AFTER: Duration = Duration::from_secs(60 * 60 * 24); // 24 hours
 
 pub struct PeerHandle<St> {
     storage: St,
@@ -25,6 +28,7 @@ pub struct PeerHandle<St> {
     request_tx: mpsc::Sender<PeerControlRequest>,
     timeout_check_interval: IntervalStream,
     task_client: TaskClient,
+    startup_timestamp: SystemTime,
 }
 
 impl<St: Storage + Clone + 'static> PeerHandle<St> {
@@ -39,7 +43,8 @@ impl<St: Storage + Clone + 'static> PeerHandle<St> {
         let timeout_check_interval = tokio_stream::wrappers::IntervalStream::new(
             tokio::time::interval(DEFAULT_PEER_TIMEOUT_CHECK),
         );
-        let task_client = task_client.fork(format!("peer{public_key}"));
+        let mut task_client = task_client.fork(format!("peer-{public_key}"));
+        task_client.disarm();
         PeerHandle {
             storage,
             public_key,
@@ -48,14 +53,11 @@ impl<St: Storage + Clone + 'static> PeerHandle<St> {
             request_tx,
             timeout_check_interval,
             task_client,
+            startup_timestamp: SystemTime::now(),
         }
     }
 
-    async fn remove_depleted_peer(&self) -> Result<bool, Error> {
-        log::debug!(
-            "Peer {} doesn't have bandwidth anymore, removing it",
-            self.public_key.to_string()
-        );
+    async fn remove_peer(&self) -> Result<bool, Error> {
         let (response_tx, response_rx) = oneshot::channel();
         self.request_tx
             .send(PeerControlRequest::RemovePeer {
@@ -71,15 +73,11 @@ impl<St: Storage + Clone + 'static> PeerHandle<St> {
         Ok(success)
     }
 
-    async fn active_peer(&mut self, storage_peer: WireguardPeer) -> Result<bool, Error> {
-        let kernel_peer = self
-            .host_information
-            .read()
-            .await
-            .peers
-            .get(&self.public_key)
-            .ok_or(Error::PeerMismatch)?
-            .clone();
+    async fn active_peer(
+        &mut self,
+        storage_peer: WireguardPeer,
+        kernel_peer: Peer,
+    ) -> Result<bool, Error> {
         if let Some(bandwidth_manager) = &self.bandwidth_storage_manager {
             let spent_bandwidth = (kernel_peer.rx_bytes + kernel_peer.tx_bytes)
                 .checked_sub(storage_peer.rx_bytes as u64 + storage_peer.tx_bytes as u64)
@@ -93,13 +91,25 @@ impl<St: Storage + Clone + 'static> PeerHandle<St> {
                 .await
                 .is_err()
             {
-                let success = self.remove_depleted_peer().await?;
+                let success = self.remove_peer().await?;
                 return Ok(!success);
             }
         } else {
+            if SystemTime::now().duration_since(self.startup_timestamp)? >= AUTO_REMOVE_AFTER {
+                log::debug!(
+                    "Peer {} has been present for 24 hours, removing it",
+                    self.public_key.to_string()
+                );
+                let success = self.remove_peer().await?;
+                return Ok(!success);
+            }
             let spent_bandwidth = kernel_peer.rx_bytes + kernel_peer.tx_bytes;
             if spent_bandwidth >= BANDWIDTH_CAP_PER_DAY {
-                let success = self.remove_depleted_peer().await?;
+                log::debug!(
+                    "Peer {} doesn't have bandwidth anymore, removing it",
+                    self.public_key.to_string()
+                );
+                let success = self.remove_peer().await?;
                 return Ok(!success);
             }
         }
@@ -111,11 +121,21 @@ impl<St: Storage + Clone + 'static> PeerHandle<St> {
         while !self.task_client.is_shutdown() {
             tokio::select! {
                 _ = self.timeout_check_interval.next() => {
-                    let Some(peer) = self.storage.get_wireguard_peer(&self.public_key.to_string()).await? else {
+                    let Some(kernel_peer) = self
+                        .host_information
+                        .read()
+                        .await
+                        .peers
+                        .get(&self.public_key)
+                        .cloned() else {
+                            // the host information hasn't beed updated yet
+                            continue;
+                        };
+                    let Some(storage_peer) = self.storage.get_wireguard_peer(&self.public_key.to_string()).await? else {
                         log::debug!("Peer {:?} not in storage anymore, shutting down handle", self.public_key);
                         return Ok(());
                     };
-                    if !self.active_peer(peer).await? {
+                    if !self.active_peer(storage_peer, kernel_peer).await? {
                         log::debug!("Peer {:?} doesn't have bandwidth anymore, shutting down handle", self.public_key);
                         return Ok(());
                     }

explorer-api/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "explorer-api"
-version = "1.1.40"
+version = "1.1.41"
 edition = "2021"
 license.workspace = true
 

gateway/src/node/client_handling/websocket/connection_handler/fresh.rs

@@ -73,6 +73,9 @@ pub(crate) enum InitialAuthenticationError {
     #[error("Only 'Register' or 'Authenticate' requests are allowed")]
     InvalidRequest,
 
+    #[error("received a Message of type {typ} which was not expected in this context")]
+    UnexpectedMessageType { typ: String },
+
     #[error("Experienced connection error: {0}")]
     ConnectionError(#[from] WsError),
 
@@ -861,9 +864,27 @@ where
             Message::Binary(_) => {
                 return Err(InitialAuthenticationError::BinaryRequestWithoutAuthentication);
             }
-            _ => unreachable!(
-                "the underlying tunsgenite stream should be handling other message types"
-            ),
+            other => {
+                if other.is_ping() {
+                    debug!("unexpected ping message!");
+                    return Err(InitialAuthenticationError::UnexpectedMessageType {
+                        typ: "ping".to_string(),
+                    });
+                } else if other.is_pong() {
+                    debug!("unexpected pong message!");
+                    return Err(InitialAuthenticationError::UnexpectedMessageType {
+                        typ: "pong".to_string(),
+                    });
+                } else if other.is_close() {
+                    debug!("unexpected close message!");
+                    return Err(InitialAuthenticationError::UnexpectedMessageType {
+                        typ: "close".to_string(),
+                    });
+                }
+
+                // at this point this is definitely unreachable, but just in case, let's not panic...
+                return Err(InitialAuthenticationError::InvalidRequest);
+            }
         };
 
         text.parse()

nym-api/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-api"
 license = "GPL-3.0"
-version = "1.1.44"
+version = "1.1.45"
 authors = [
     "Dave Hrycyszyn <futurechimp@users.noreply.github.com>",
     "Jędrzej Stuczyński <andrew@nymtech.net>",

nym-api/src/ecash/api_routes/spending.rs

@@ -193,10 +193,7 @@ pub async fn batch_redeem_tickets(
 #[openapi(tag = "Ecash")]
 #[get("/double-spending-filter-v1")]
 pub async fn double_spending_filter_v1(
-    state: &RocketState<EcashState>,
+    _state: &RocketState<EcashState>,
 ) -> crate::ecash::error::Result<Json<SpentCredentialsResponse>> {
-    let spent_credentials_export = state.get_bloomfilter_bytes().await;
-    Ok(Json(SpentCredentialsResponse::new(
-        spent_credentials_export,
-    )))
+    Err(EcashError::Restricted)
 }

nym-api/src/ecash/api_routes/spending_axum.rs

@@ -3,7 +3,7 @@
 
 use crate::ecash::error::EcashError;
 use crate::ecash::state::EcashState;
-use crate::node_status_api::models::AxumResult;
+use crate::node_status_api::models::{AxumErrorResponse, AxumResult};
 use crate::v2::AxumAppState;
 use axum::{Json, Router};
 use nym_api_requests::constants::MIN_BATCH_REDEMPTION_DELAY;
@@ -236,10 +236,7 @@ async fn batch_redeem_tickets(
     )
 )]
 async fn double_spending_filter_v1(
-    state: Arc<EcashState>,
+    _state: Arc<EcashState>,
 ) -> AxumResult<Json<SpentCredentialsResponse>> {
-    let spent_credentials_export = state.get_bloomfilter_bytes().await;
-    Ok(Json(SpentCredentialsResponse::new(
-        spent_credentials_export,
-    )))
+    AxumResult::Err(AxumErrorResponse::internal_msg("permanently restricted"))
 }

nym-api/src/ecash/error.rs

@@ -32,6 +32,9 @@ pub type Result<T, E = EcashError> = std::result::Result<T, E>;
 
 #[derive(Debug, Error)]
 pub enum EcashError {
+    #[error("permanently restricted")]
+    Restricted,
+
     #[error(transparent)]
     IOError(#[from] std::io::Error),
 

nym-api/src/ecash/state/local.rs

@@ -9,9 +9,8 @@ use crate::ecash::keys::KeyPair;
 use nym_config::defaults::BloomfilterParameters;
 use nym_crypto::asymmetric::identity;
 use nym_ecash_double_spending::DoubleSpendingFilter;
-use std::sync::atomic::{AtomicBool, Ordering};
 use std::sync::Arc;
-use time::{Date, OffsetDateTime};
+use time::Date;
 use tokio::sync::RwLock;
 
 pub(crate) struct TicketDoubleSpendingFilter {
@@ -70,10 +69,6 @@ impl TicketDoubleSpendingFilter {
         self.today_filter.dump_bitmap()
     }
 
-    pub(crate) fn export_global_bitmap(&self) -> Vec<u8> {
-        self.global_filter.dump_bitmap()
-    }
-
     pub(crate) fn advance_day(&mut self, date: Date, new_global: DoubleSpendingFilter) {
         self.built_on = date;
         self.global_filter = new_global;
@@ -81,17 +76,6 @@ impl TicketDoubleSpendingFilter {
     }
 }
 
-pub(crate) struct ExportedDoubleSpendingFilterData {
-    pub(crate) last_exported_at: OffsetDateTime,
-    pub(crate) bytes: Vec<u8>,
-}
-
-#[derive(Clone)]
-pub(crate) struct ExportedDoubleSpendingFilter {
-    pub(crate) being_exported: Arc<AtomicBool>,
-    pub(crate) data: Arc<RwLock<ExportedDoubleSpendingFilterData>>,
-}
-
 pub(crate) struct LocalEcashState {
     pub(crate) ecash_keypair: KeyPair,
     pub(crate) identity_keypair: identity::KeyPair,
@@ -102,9 +86,6 @@ pub(crate) struct LocalEcashState {
 
     // the actual, up to date, bloomfilter
     pub(crate) double_spending_filter: Arc<RwLock<TicketDoubleSpendingFilter>>,
-
-    // the cached byte representation of the bloomfilter to be used by the clients
-    pub(crate) exported_double_spending_filter: ExportedDoubleSpendingFilter,
 }
 
 impl LocalEcashState {
@@ -118,38 +99,7 @@ impl LocalEcashState {
             identity_keypair,
             partial_coin_index_signatures: Default::default(),
             partial_expiration_date_signatures: Default::default(),
-            exported_double_spending_filter: ExportedDoubleSpendingFilter {
-                being_exported: Arc::new(Default::default()),
-                data: Arc::new(RwLock::new(ExportedDoubleSpendingFilterData {
-                    last_exported_at: OffsetDateTime::now_utc(),
-                    bytes: double_spending_filter.export_global_bitmap(),
-                })),
-            },
             double_spending_filter: Arc::new(RwLock::new(double_spending_filter)),
         }
     }
-
-    pub(crate) fn maybe_background_update_exported_bloomfilter(&self) {
-        // make sure another query hasn't already spawned an exporting task
-        let Ok(should_export) = self
-            .exported_double_spending_filter
-            .being_exported
-            .compare_exchange(false, true, Ordering::SeqCst, Ordering::SeqCst)
-        else {
-            return;
-        };
-
-        let filter = self.double_spending_filter.clone();
-        let exported = self.exported_double_spending_filter.clone();
-
-        if should_export {
-            tokio::spawn(async move {
-                log::debug!("exporting bloomfilter bitmap");
-                let new = filter.read().await.export_global_bitmap();
-                let mut exported_guard = exported.data.write().await;
-                exported_guard.last_exported_at = OffsetDateTime::now_utc();
-                exported_guard.bytes = new;
-            });
-        }
-    }
 }

nym-api/src/ecash/state/mod.rs

@@ -45,7 +45,7 @@ use nym_ecash_time::cred_exp_date;
 use nym_validator_client::nyxd::AccountId;
 use nym_validator_client::EcashApiClient;
 use time::ext::NumericalDuration;
-use time::{Date, Duration, OffsetDateTime};
+use time::{Date, OffsetDateTime};
 use tokio::sync::RwLockReadGuard;
 
 pub(crate) mod auxiliary;
@@ -839,17 +839,4 @@ impl EcashState {
 
         res
     }
-
-    pub async fn get_bloomfilter_bytes(&self) -> Vec<u8> {
-        let guard = self.local.exported_double_spending_filter.data.read().await;
-
-        let bytes = guard.bytes.clone();
-
-        // see if it's been > 5min since last export (that value is arbitrary)
-        if guard.last_exported_at + Duration::minutes(5) < OffsetDateTime::now_utc() {
-            self.local.maybe_background_update_exported_bloomfilter();
-        }
-
-        bytes
-    }
 }

nym-node/Cargo.toml

@@ -3,7 +3,7 @@
 
 [package]
 name = "nym-node"
-version = "1.1.8"
+version = "1.1.9"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true

nym-node/src/config/entry_gateway.rs

@@ -11,8 +11,8 @@ use nym_config::serde_helpers::de_maybe_port;
 use nym_gateway::node::LocalAuthenticatorOpts;
 use serde::{Deserialize, Serialize};
 use std::net::SocketAddr;
-use std::path::Path;
 use std::time::Duration;
+use std::{path::Path, str::FromStr};
 
 use super::helpers::{base_client_config, EphemeralConfig};
 use super::LocalWireguardOpts;
@@ -182,7 +182,7 @@ pub fn ephemeral_entry_gateway_config(
             private_network_prefix: config.wireguard.private_network_prefix,
             storage_paths: config.wireguard.storage_paths.clone(),
         },
-        custom_mixnet_path: None,
+        custom_mixnet_path: std::path::PathBuf::from_str("/tmp/topology2").ok(),
     };
 
     let gateway = ephemeral_gateway_config(config, mnemonic)?;

nym-node/src/config/exit_gateway.rs

@@ -11,7 +11,7 @@ use nym_gateway::node::{
     LocalAuthenticatorOpts, LocalIpPacketRouterOpts, LocalNetworkRequesterOpts,
 };
 use serde::{Deserialize, Serialize};
-use std::path::Path;
+use std::{path::Path, str::FromStr};
 use url::Url;
 
 use super::{
@@ -236,7 +236,7 @@ pub fn ephemeral_exit_gateway_config(
 
             logging: config.logging,
         },
-        custom_mixnet_path: None,
+        custom_mixnet_path: std::path::PathBuf::from_str("/tmp/topology2").ok(),
     };
 
     if ipr_opts.config.ip_packet_router.disable_poisson_rate {

service-providers/authenticator/src/mixnet_listener.rs

@@ -122,10 +122,17 @@ impl<S: Storage + Clone + 'static> MixnetListener<S> {
                     reg.gateway_data.private_ip
                 )))?;
 
-            let timestamp = ip.ok_or(AuthenticatorError::InternalDataCorruption(
-                "timestamp should be set".to_string(),
-            ))?;
-            let duration = SystemTime::now().duration_since(timestamp).map_err(|_| {
+            let Some(timestamp) = ip else {
+                registred_and_free
+                    .registration_in_progres
+                    .remove(&reg.gateway_data.pub_key());
+                log::debug!(
+                    "Removed stale registration of {}",
+                    reg.gateway_data.pub_key()
+                );
+                continue;
+            };
+            let duration = SystemTime::now().duration_since(*timestamp).map_err(|_| {
                 AuthenticatorError::InternalDataCorruption(
                     "set timestamp shouldn't have been set in the future".to_string(),
                 )
@@ -152,10 +159,8 @@ impl<S: Storage + Clone + 'static> MixnetListener<S> {
     ) -> AuthenticatorHandleResult {
         let remote_public = init_message.pub_key;
         let nonce: u64 = fastrand::u64(..);
-        if let Some(registration_data) = self
-            .registred_and_free
-            .read()
-            .await
+        let mut registred_and_free = self.registred_and_free.write().await;
+        if let Some(registration_data) = registred_and_free
             .registration_in_progres
             .get(&remote_public)
         {
@@ -184,7 +189,6 @@ impl<S: Storage + Clone + 'static> MixnetListener<S> {
             ));
         }
 
-        let mut registred_and_free = self.registred_and_free.write().await;
         let private_ip_ref = registred_and_free
             .free_private_network_ips
             .iter_mut()
@@ -289,10 +293,6 @@ impl<S: Storage + Clone + 'static> MixnetListener<S> {
         credential: CredentialSpendingData,
         client_id: i64,
     ) -> Result<i64> {
-        ecash_verifier
-            .storage()
-            .create_bandwidth_entry(client_id)
-            .await?;
         let bandwidth = ecash_verifier
             .storage()
             .get_available_bandwidth(client_id)

service-providers/network-requester/Cargo.toml

@@ -4,7 +4,7 @@
 [package]
 name = "nym-network-requester"
 license = "GPL-3.0"
-version = "1.1.42"
+version = "1.1.43"
 authors.workspace = true
 edition.workspace = true
 rust-version = "1.70"

tools/nym-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nym-cli"
-version = "1.1.42"
+version = "1.1.43"
 authors.workspace = true
 edition = "2021"
 license.workspace = true

tools/nymvisor/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "nymvisor"
-version = "0.1.7"
+version = "0.1.8"
 authors.workspace = true
 repository.workspace = true
 homepage.workspace = true