Connections timeout after 5 minutes due to IPv6 DNS queries failing on IPv6-disabled networks

* distinguish authenticator errors by credential spent

* nitpicking fixes

* fix CI to see those changes

* error naming

Co-authored-by: Simon Wicky <simon@nymtech.net>

.github/workflows/ci-build.yml

@@ -8,10 +8,13 @@ on:
       - 'gateway/**'
       - 'integrations/**'
       - 'nym-api/**'
+      - 'nym-authenticator-client/**'
       - 'nym-credential-proxy/**'
+      - 'nym-ip-packet-client/**'
       - 'nym-network-monitor/**'
       - 'nym-node/**'
       - 'nym-node-status-api/**'
+      - 'nym-registration-client/**'
       - 'nym-statistics-api/**'
       - 'nym-outfox/**'
       - 'nym-validator-rewarder/**'

Cargo.lock

@@ -6050,6 +6050,7 @@ dependencies = [
  "thiserror 2.0.12",
  "tokio",
  "tracing",
+ "tracing-subscriber",
  "url",
  "wasmtimer",
 ]

common/client-core/src/error.rs

@@ -45,7 +45,7 @@ pub enum ClientCoreError {
 
     #[cfg(not(target_arch = "wasm32"))]
     #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),
+    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
 
     #[error("no gateways on network")]
     NoGatewaysOnNetwork,

common/client-core/src/init/websockets.rs

@@ -30,7 +30,6 @@ pub(crate) async fn connect_async(
             resolver
                 .resolve_str(domain)
                 .await?
-                .into_iter()
                 .map(|a| SocketAddr::new(a, port))
                 .collect()
         }

common/client-libs/gateway-client/src/client/websockets.rs

@@ -39,7 +39,6 @@ pub(crate) async fn connect_async(
             resolver
                 .resolve_str(domain)
                 .await?
-                .into_iter()
                 .map(|a| SocketAddr::new(a, port))
                 .collect()
         }

common/client-libs/gateway-client/src/error.rs

@@ -54,7 +54,7 @@ pub enum GatewayClientError {
 
     #[cfg(not(target_arch = "wasm32"))]
     #[error("resolution failed: {0}")]
-    ResolutionFailed(#[from] nym_http_api_client::HickoryDnsError),
+    ResolutionFailed(#[from] nym_http_api_client::ResolveError),
 
     #[error("No shared key was provided or obtained")]
     NoSharedKeyAvailable,

common/http-api-client/Cargo.toml

@@ -32,7 +32,7 @@ thiserror = { workspace = true }
 tracing = { workspace = true }
 itertools = { workspace = true }
 inventory = { workspace = true }
-
+tokio = { workspace = true, features = ["rt", "macros", "time"] }
 # used for decoding text responses (they were already implicitly included)
 bytes = { workspace = true }
 encoding_rs = { workspace = true }
@@ -52,5 +52,4 @@ workspace = true
 features = ["tokio"]
 
 [dev-dependencies]
-tokio = { workspace = true, features = ["rt", "macros"] }
-
+tracing-subscriber.workspace = true

common/http-api-client/src/dns.rs

@@ -30,19 +30,26 @@
 use crate::ClientBuilder;
 
 use std::{
-    net::SocketAddr,
+    collections::HashMap,
+    net::{IpAddr, SocketAddr},
+    str::FromStr,
     sync::{Arc, LazyLock},
+    time::Duration,
 };
 
 use hickory_resolver::{
-    ResolveError, TokioResolver,
+    TokioResolver,
     config::{LookupIpStrategy, NameServerConfigGroup, ResolverConfig, ServerOrderingStrategy},
-    lookup_ip::{LookupIp, LookupIpIntoIter},
+    lookup_ip::LookupIpIntoIter,
     name_server::TokioConnectionProvider,
 };
 use once_cell::sync::OnceCell;
 use reqwest::dns::{Addrs, Name, Resolve, Resolving};
-use tracing::warn;
+use tracing::*;
+
+mod constants;
+mod static_resolver;
+pub use static_resolver::*;
 
 impl ClientBuilder {
     /// Override the DNS resolver implementation used by the underlying http client.
@@ -59,10 +66,6 @@ impl ClientBuilder {
     }
 }
 
-struct SocketAddrs {
-    iter: LookupIpIntoIter,
-}
-
 // n.b. static items do not call [`Drop`] on program termination, so this won't be deallocated.
 // this is fine, as the OS can deallocate the terminated program faster than we can free memory
 // but tools like valgrind might report "memory leaks" as it isn't obvious this is intentional.
@@ -72,11 +75,17 @@ static SHARED_RESOLVER: LazyLock<HickoryDnsResolver> = LazyLock::new(|| {
 });
 
 #[derive(Debug, thiserror::Error)]
-#[error("hickory-dns resolver error: {hickory_error}")]
+#[allow(missing_docs)]
 /// Error occurring while resolving a hostname into an IP address.
-pub struct HickoryDnsError {
-    #[from]
-    hickory_error: ResolveError,
+pub enum ResolveError {
+    #[error("invalid name: {0}")]
+    InvalidNameError(String),
+    #[error("hickory-dns resolver error: {0}")]
+    ResolveError(#[from] hickory_resolver::ResolveError),
+    #[error("high level lookup timed out")]
+    Timeout,
+    #[error("hostname not found in static lookup table")]
+    StaticLookupMiss,
 }
 
 /// Wrapper around an `AsyncResolver`, which implements the `Resolve` trait.
@@ -87,69 +96,118 @@ pub struct HickoryDnsError {
 /// The default initialization uses a shared underlying `AsyncResolver`. If a thread local resolver
 /// is required use `thread_resolver()` to build a resolver with an independently instantiated
 /// internal `AsyncResolver`.
-#[derive(Debug, Default, Clone)]
+#[derive(Debug, Clone)]
 pub struct HickoryDnsResolver {
     // Since we might not have been called in the context of a
     // Tokio Runtime in initialization, so we must delay the actual
     // construction of the resolver.
     state: Arc<OnceCell<TokioResolver>>,
     fallback: Option<Arc<OnceCell<TokioResolver>>>,
+    static_base: Option<Arc<OnceCell<StaticResolver>>>,
     dont_use_shared: bool,
+    /// Overall timeout for dns lookup associated with any individual host resolution. For example,
+    /// use of retries, server_ordering_strategy, etc. ends absolutely if this timeout is reached.
+    overall_dns_timeout: Duration,
+}
+
+impl Default for HickoryDnsResolver {
+    fn default() -> Self {
+        Self {
+            state: Default::default(),
+            // Disable system resolver fallback by default - often blocked by firewalls in VPN environments
+            // Enable static fallback for known domains
+            fallback: None,
+            static_base: Some(Default::default()),
+            dont_use_shared: Default::default(),
+            overall_dns_timeout: Duration::from_secs(10),
+        }
+    }
 }
 
 impl Resolve for HickoryDnsResolver {
     fn resolve(&self, name: Name) -> Resolving {
         let resolver = self.state.clone();
         let maybe_fallback = self.fallback.clone();
+        let maybe_static = self.static_base.clone();
         let independent = self.dont_use_shared;
+        let overall_dns_timeout = self.overall_dns_timeout;
         Box::pin(async move {
-            let resolver = resolver.get_or_try_init(|| {
-                // using a closure here is slightly gross, but this makes sure that if the
-                // lazy-init returns an error it can be handled by the client
-                if independent {
-                    new_resolver()
-                } else {
-                    Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
-                }
-            })?;
+            resolve(
+                name,
+                resolver,
+                maybe_fallback,
+                maybe_static,
+                independent,
+                overall_dns_timeout,
+            )
+            .await
+            .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)
+        })
+    }
+}
 
-            // try the primary DNS resolver that we set up (DoH or DoT or whatever)
-            let lookup = match resolver.lookup_ip(name.as_str()).await {
-                Ok(res) => res,
-                Err(e) => {
-                    if let Some(ref fallback) = maybe_fallback {
-                        // on failure use the fall back system configured DNS resolver
-                        if !e.is_no_records_found() {
-                            warn!("primary DNS failed w/ error {e}: using system fallback");
-                        }
-                        let resolver = fallback.get_or_try_init(|| {
-                            // using a closure here is slightly gross, but this makes sure that if the
-                            // lazy-init returns an error it can be handled by the client
-                            if independent {
-                                new_resolver_system()
-                            } else {
-                                Ok(SHARED_RESOLVER
-                                    .fallback
-                                    .as_ref()
-                                    .ok_or(e)? // if the shared resolver has no fallback return the original error
-                                    .get_or_try_init(new_resolver_system)?
-                                    .clone())
-                            }
-                        })?;
-
-                        resolver.lookup_ip(name.as_str()).await?
-                    } else {
-                        return Err(e.into());
-                    }
-                }
-            };
+async fn resolve(
+    name: Name,
+    resolver: Arc<OnceCell<TokioResolver>>,
+    maybe_fallback: Option<Arc<OnceCell<TokioResolver>>>,
+    maybe_static: Option<Arc<OnceCell<StaticResolver>>>,
+    independent: bool,
+    overall_dns_timeout: Duration,
+) -> Result<Addrs, ResolveError> {
+    let resolver = resolver.get_or_try_init(|| HickoryDnsResolver::new_resolver(independent))?;
 
+    // Attempt a lookup using the primary resolver
+    let resolve_fut = tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str()));
+    let primary_err = match resolve_fut.await {
+        Err(_) => ResolveError::Timeout,
+        Ok(Ok(lookup)) => {
             let addrs: Addrs = Box::new(SocketAddrs {
                 iter: lookup.into_iter(),
             });
-            Ok(addrs)
-        })
+            return Ok(addrs);
+        }
+        Ok(Err(e)) => {
+            // on failure use the fall back system configured DNS resolver
+            if !e.is_no_records_found() {
+                warn!("primary DNS failed w/ error: {e}");
+            }
+            e.into()
+        }
+    };
+
+    // If the primary resolver encountered an error, attempt a lookup using the fallback
+    // resolver if one is configured.
+    if let Some(ref fallback) = maybe_fallback {
+        let resolver =
+            fallback.get_or_try_init(|| HickoryDnsResolver::new_resolver_system(independent))?;
+
+        let resolve_fut =
+            tokio::time::timeout(overall_dns_timeout, resolver.lookup_ip(name.as_str()));
+        if let Ok(Ok(lookup)) = resolve_fut.await {
+            let addrs: Addrs = Box::new(SocketAddrs {
+                iter: lookup.into_iter(),
+            });
+            return Ok(addrs);
+        }
     }
+
+    // If no record has been found and a static map of fallback addresses is configured
+    // check the table for our entry
+    if let Some(ref static_resolver) = maybe_static {
+        debug!("checking static");
+        let resolver =
+            static_resolver.get_or_init(|| HickoryDnsResolver::new_static_fallback(independent));
+
+        if let Ok(addrs) = resolver.resolve(name).await {
+            return Ok(addrs);
+        }
+    }
+
+    Err(primary_err)
+}
+
+struct SocketAddrs {
+    iter: LookupIpIntoIter,
 }
 
 impl Iterator for SocketAddrs {
@@ -162,28 +220,22 @@ impl Iterator for SocketAddrs {
 
 impl HickoryDnsResolver {
     /// Attempt to resolve a domain name to a set of ['IpAddr']s
-    pub async fn resolve_str(&self, name: &str) -> Result<LookupIp, HickoryDnsError> {
-        let resolver = self.state.get_or_try_init(|| self.new_resolver())?;
-
-        // try the primary DNS resolver that we set up (DoH or DoT or whatever)
-        let lookup = match resolver.lookup_ip(name).await {
-            Ok(res) => res,
-            Err(e) => {
-                if let Some(ref fallback) = self.fallback {
-                    // on failure use the fall back system configured DNS resolver
-                    if !e.is_no_records_found() {
-                        warn!("primary DNS failed w/ error {e}: using system fallback");
-                    }
-
-                    let resolver = fallback.get_or_try_init(|| self.new_resolver_system())?;
-                    resolver.lookup_ip(name).await?
-                } else {
-                    return Err(e.into());
-                }
-            }
-        };
-
-        Ok(lookup)
+    pub async fn resolve_str(
+        &self,
+        name: &str,
+    ) -> Result<impl Iterator<Item = IpAddr> + use<>, ResolveError> {
+        let n =
+            Name::from_str(name).map_err(|_| ResolveError::InvalidNameError(name.to_string()))?;
+        resolve(
+            n,
+            self.state.clone(),
+            self.fallback.clone(),
+            self.static_base.clone(),
+            self.dont_use_shared,
+            self.overall_dns_timeout,
+        )
+        .await
+        .map(|addrs| addrs.map(|socket_addr| socket_addr.ip()))
     }
 
     /// Create a (lazy-initialized) resolver that is not shared across threads.
@@ -194,16 +246,20 @@ impl HickoryDnsResolver {
         }
     }
 
-    fn new_resolver(&self) -> Result<TokioResolver, HickoryDnsError> {
-        if self.dont_use_shared {
+    fn new_resolver(dont_use_shared: bool) -> Result<TokioResolver, ResolveError> {
+        // using a closure here is slightly gross, but this makes sure that if the
+        // lazy-init returns an error it can be handled by the client
+        if dont_use_shared {
             new_resolver()
         } else {
             Ok(SHARED_RESOLVER.state.get_or_try_init(new_resolver)?.clone())
         }
     }
 
-    fn new_resolver_system(&self) -> Result<TokioResolver, HickoryDnsError> {
-        if self.dont_use_shared || SHARED_RESOLVER.fallback.is_none() {
+    fn new_resolver_system(dont_use_shared: bool) -> Result<TokioResolver, ResolveError> {
+        // using a closure here is slightly gross, but this makes sure that if the
+        // lazy-init returns an error it can be handled by the client
+        if dont_use_shared || SHARED_RESOLVER.fallback.is_none() {
             new_resolver_system()
         } else {
             Ok(SHARED_RESOLVER
@@ -215,8 +271,18 @@ impl HickoryDnsResolver {
         }
     }
 
+    fn new_static_fallback(dont_use_shared: bool) -> StaticResolver {
+        if !dont_use_shared && let Some(ref shared_resolver) = SHARED_RESOLVER.static_base {
+            shared_resolver
+                .get_or_init(new_default_static_fallback)
+                .clone()
+        } else {
+            new_default_static_fallback()
+        }
+    }
+
     /// Enable fallback to the system default resolver if the primary (DoX) resolver fails
-    pub fn enable_system_fallback(&mut self) -> Result<(), HickoryDnsError> {
+    pub fn enable_system_fallback(&mut self) -> Result<(), ResolveError> {
         self.fallback = Some(Default::default());
         let _ = self
             .fallback
@@ -231,22 +297,52 @@ impl HickoryDnsResolver {
     pub fn disable_system_fallback(&mut self) {
         self.fallback = None;
     }
+
+    /// Get the current map of hostname to address in use by the fallback static lookup if one
+    /// exists.
+    pub fn get_static_fallbacks(&self) -> Option<HashMap<String, Vec<IpAddr>>> {
+        Some(self.static_base.as_ref()?.get()?.get_addrs())
+    }
+
+    /// Set (or overwrite) the map of addresses used in the fallback static hostname lookup
+    pub fn set_static_fallbacks(&mut self, addrs: HashMap<String, Vec<IpAddr>>) {
+        let cell = OnceCell::new();
+        cell.set(StaticResolver::new(addrs))
+            .expect("infallible assign");
+        self.static_base = Some(Arc::new(cell));
+    }
 }
 
 /// Create a new resolver with a custom DoT based configuration. The options are overridden to look
 /// up for both IPv4 and IPv6 addresses to work with "happy eyeballs" algorithm.
-fn new_resolver() -> Result<TokioResolver, HickoryDnsError> {
+///
+/// Timeout Defaults to 5 seconds
+/// Number of retries after lookup failure before giving up Defaults to 2
+///
+/// Caches successfully resolved addresses for 30 minutes to prevent continual use of remote lookup.
+/// This resolver is intended to be used for OUR API endpoints that do not rapidly rotate IPs.
+fn new_resolver() -> Result<TokioResolver, ResolveError> {
+    info!("building new configured resolver");
+
     let mut name_servers = NameServerConfigGroup::quad9_tls();
     name_servers.merge(NameServerConfigGroup::quad9_https());
     name_servers.merge(NameServerConfigGroup::cloudflare_tls());
     name_servers.merge(NameServerConfigGroup::cloudflare_https());
 
+    configure_and_build_resolver(name_servers)
+}
+
+fn configure_and_build_resolver(
+    name_servers: NameServerConfigGroup,
+) -> Result<TokioResolver, ResolveError> {
     let config = ResolverConfig::from_parts(None, Vec::new(), name_servers);
     let mut resolver_builder =
         TokioResolver::builder_with_config(config, TokioConnectionProvider::default());
 
-    resolver_builder.options_mut().ip_strategy = LookupIpStrategy::Ipv4AndIpv6;
+    resolver_builder.options_mut().ip_strategy = get_ip_strategy();
     resolver_builder.options_mut().server_ordering_strategy = ServerOrderingStrategy::RoundRobin;
+    // Cache successful responses for queries received by this resolver for 30 min minimum.
+    resolver_builder.options_mut().positive_min_ttl = Some(Duration::from_secs(1800));
 
     Ok(resolver_builder.build())
 }
@@ -254,20 +350,54 @@ fn new_resolver() -> Result<TokioResolver, HickoryDnsError> {
 /// Create a new resolver with the default configuration, which reads from the system DNS config
 /// (i.e. `/etc/resolve.conf` in unix). The options are overridden to look up for both IPv4 and IPv6
 /// addresses to work with "happy eyeballs" algorithm.
-fn new_resolver_system() -> Result<TokioResolver, HickoryDnsError> {
+fn new_resolver_system() -> Result<TokioResolver, ResolveError> {
     let mut resolver_builder = TokioResolver::builder_tokio()?;
-    resolver_builder.options_mut().ip_strategy = LookupIpStrategy::Ipv4AndIpv6;
+    resolver_builder.options_mut().ip_strategy = get_ip_strategy();
 
     Ok(resolver_builder.build())
 }
 
+fn new_default_static_fallback() -> StaticResolver {
+    StaticResolver::new(constants::default_static_addrs())
+}
+
+/// Check if IPv6 stack is available for DNS resolution.
+fn should_use_ipv6_dns() -> bool {
+    use std::net::UdpSocket;
+
+    match UdpSocket::bind("[::]:0") {
+        Ok(_) => {
+            debug!("IPv6 stack available - enabling dual-stack DNS");
+            true
+        }
+        Err(e) => {
+            debug!("IPv6 unavailable ({}), using IPv4-only DNS", e);
+            false
+        }
+    }
+}
+
+/// Get DNS lookup strategy based on IPv6 availability.
+fn get_ip_strategy() -> LookupIpStrategy {
+    if should_use_ipv6_dns() {
+        debug!("Using dual-stack DNS (IPv4 + IPv6)");
+        LookupIpStrategy::Ipv4AndIpv6
+    } else {
+        debug!("Using IPv4-only DNS");
+        LookupIpStrategy::Ipv4Only
+    }
+}
+
 #[cfg(test)]
 mod test {
     use super::*;
+    use itertools::Itertools;
+    use std::collections::HashMap;
 
     #[tokio::test]
-    async fn reqwest_hickory_doh() {
-        let resolver = HickoryDnsResolver::default();
+    async fn reqwest_with_custom_dns() {
+        let var_name = HickoryDnsResolver::default();
+        let resolver = var_name;
         let client = reqwest::ClientBuilder::new()
             .dns_resolver(resolver.into())
             .build()
@@ -286,7 +416,7 @@ mod test {
     }
 
     #[tokio::test]
-    async fn dns_lookup() -> Result<(), HickoryDnsError> {
+    async fn dns_lookup() -> Result<(), ResolveError> {
         let resolver = HickoryDnsResolver::default();
 
         let domain = "ifconfig.me";
@@ -296,4 +426,153 @@ mod test {
 
         Ok(())
     }
+
+    #[tokio::test]
+    async fn static_resolver_as_fallback() -> Result<(), ResolveError> {
+        let example_domain = "non-existent.nymvpn.com";
+        let mut resolver = HickoryDnsResolver {
+            ..Default::default()
+        };
+
+        let result = resolver.resolve_str(example_domain).await;
+        assert!(result.is_err()); // should be NXDomain
+
+        resolver.static_base = Some(Default::default());
+
+        let mut addr_map = HashMap::new();
+        let example_ip4: IpAddr = "10.10.10.10".parse().unwrap();
+        let example_ip6: IpAddr = "dead::beef".parse().unwrap();
+        addr_map.insert(example_domain.to_string(), vec![example_ip4, example_ip6]);
+
+        resolver.set_static_fallbacks(addr_map);
+
+        let mut addrs = resolver.resolve_str(example_domain).await?;
+        assert!(addrs.contains(&example_ip4));
+        assert!(addrs.contains(&example_ip6));
+        Ok(())
+    }
+
+    #[test]
+    fn default_resolver_fallback_config() {
+        let resolver = HickoryDnsResolver::default();
+        assert!(
+            resolver.fallback.is_none(),
+            "system fallback should be disabled by default for VPN environments"
+        );
+        assert!(
+            resolver.static_base.is_some(),
+            "static fallback should be enabled by default"
+        );
+    }
+
+    #[test]
+    fn ipv6_detection_returns_valid_strategy() {
+        let strategy = get_ip_strategy();
+        match strategy {
+            LookupIpStrategy::Ipv4Only | LookupIpStrategy::Ipv4AndIpv6 => {}
+            _ => panic!("Unexpected IP strategy returned: {:?}", strategy),
+        }
+    }
+
+    #[test]
+    fn ipv6_dns_detection_is_consistent() {
+        let first_result = should_use_ipv6_dns();
+        let second_result = should_use_ipv6_dns();
+        assert_eq!(first_result, second_result);
+    }
+}
+
+#[cfg(test)]
+mod failure_test {
+    use super::*;
+    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
+
+    /// IP addresses guaranteed to fail attempts to resolve
+    ///
+    /// Addresses drawn from blocks set off by RFC5737 (ipv4) and RFC3849 (ipv6)
+    const GUARANTEED_BROKEN_IPS_1: &[IpAddr] = &[
+        IpAddr::V4(Ipv4Addr::new(192, 0, 2, 1)),
+        IpAddr::V4(Ipv4Addr::new(198, 51, 100, 1)),
+        IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0, 0x1111)),
+        IpAddr::V6(Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0, 0x1001)),
+    ];
+
+    // Create a resolver that behaves the same as the custom configured router, except for the fact
+    // that it is guaranteed to fail.
+    fn build_broken_resolver() -> Result<TokioResolver, ResolveError> {
+        info!("building new faulty resolver");
+
+        let mut broken_ns_group = NameServerConfigGroup::from_ips_tls(
+            GUARANTEED_BROKEN_IPS_1,
+            853,
+            "cloudflare-dns.com".to_string(),
+            true,
+        );
+        let broken_ns_https = NameServerConfigGroup::from_ips_https(
+            GUARANTEED_BROKEN_IPS_1,
+            443,
+            "cloudflare-dns.com".to_string(),
+            true,
+        );
+        broken_ns_group.merge(broken_ns_https);
+
+        configure_and_build_resolver(broken_ns_group)
+    }
+
+    #[tokio::test]
+    async fn dns_lookup_failures() -> Result<(), ResolveError> {
+        let time_start = std::time::Instant::now();
+
+        let r = OnceCell::new();
+        r.set(build_broken_resolver().expect("failed to build resolver"))
+            .expect("broken resolver init error");
+
+        // create a new resolver that won't mess with the shared resolver used by other tests
+        let resolver = HickoryDnsResolver {
+            dont_use_shared: true,
+            state: Arc::new(r),
+            overall_dns_timeout: Duration::from_secs(5),
+            ..Default::default()
+        };
+        build_broken_resolver()?;
+        let domain = "ifconfig.me";
+        let result = resolver.resolve_str(domain).await;
+        assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
+
+        let duration = time_start.elapsed();
+        assert!(duration < resolver.overall_dns_timeout + Duration::from_secs(1));
+
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn fallback_to_static() -> Result<(), ResolveError> {
+        let r = OnceCell::new();
+        r.set(build_broken_resolver().expect("failed to build resolver"))
+            .expect("broken resolver init error");
+
+        // create a new resolver that won't mess with the shared resolver used by other tests
+        let resolver = HickoryDnsResolver {
+            dont_use_shared: true,
+            state: Arc::new(r),
+            static_base: Some(Default::default()),
+            overall_dns_timeout: Duration::from_secs(5),
+            ..Default::default()
+        };
+        build_broken_resolver()?;
+
+        // successful lookup using fallback to static resolver
+        let domain = "nymvpn.com";
+        let _ = resolver
+            .resolve_str(domain)
+            .await
+            .expect("failed to resolve address in static lookup");
+
+        // unsuccessful lookup - primary times out, and not in
+        let domain = "non-existent.nymtech.net";
+        let result = resolver.resolve_str(domain).await;
+        assert!(result.is_err_and(|e| matches!(e, ResolveError::Timeout)));
+
+        Ok(())
+    }
 }

common/http-api-client/src/dns/constants.rs

@@ -0,0 +1,73 @@
+#![allow(missing_docs)]
+
+use std::collections::HashMap;
+use std::net::{IpAddr, Ipv4Addr};
+
+pub const NYM_API_DOMAIN: &str = "validator.nymtech.net";
+pub const NYM_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(212, 71, 233, 232))];
+
+pub const NYM_VPN_API_DOMAIN: &str = "nymvpn.com";
+pub const NYM_VPN_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 21))];
+
+pub const NYM_FRONTDOOR_VERCEL_DOMAIN: &str = "nym-frontdoor.vercel.app";
+pub const NYM_FRONTDOOR_VERCEL_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)),
+    IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)),
+];
+
+pub const NYM_FRONTDOOR_FASTLY_DOMAIN: &str = "nym-frontdoor.global.ssl.fastly.net";
+pub const NYM_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)),
+];
+
+pub const NYMVPN_FRONTDOOR_FASTLY_DOMAIN: &str = "nymvpn-frontdoor.global.ssl.fastly.net";
+pub const NYMVPN_FRONTDOOR_FASTLY_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(151, 101, 193, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 129, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 1, 194)),
+    IpAddr::V4(Ipv4Addr::new(151, 101, 65, 194)),
+];
+
+pub const VERCEL_APP_DOMAIN: &str = "vercel.app";
+pub const VERCEL_APP_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(64, 29, 17, 195)),
+    IpAddr::V4(Ipv4Addr::new(216, 198, 79, 195)),
+];
+
+pub const VERCEL_COM_DOMAIN: &str = "vercel.com";
+pub const VERCEL_COM_IPS: &[IpAddr] = &[
+    IpAddr::V4(Ipv4Addr::new(198, 169, 2, 129)),
+    IpAddr::V4(Ipv4Addr::new(198, 169, 1, 193)),
+];
+
+pub const NYM_COM_DOMAIN: &str = "nym.com";
+pub const NYM_COM_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(76, 76, 21, 22))];
+
+pub const NYM_STATS_API_DOMAIN: &str = "nym-statistics-api.nymtech.cc";
+pub const NYM_STATS_API_IPS: &[IpAddr] = &[IpAddr::V4(Ipv4Addr::new(91, 92, 153, 96))];
+
+pub fn default_static_addrs() -> HashMap<String, Vec<IpAddr>> {
+    let mut m = HashMap::new();
+    m.insert(NYM_API_DOMAIN.to_string(), NYM_API_IPS.to_vec());
+    m.insert(NYM_VPN_API_DOMAIN.to_string(), NYM_VPN_API_IPS.to_vec());
+    m.insert(
+        NYM_FRONTDOOR_VERCEL_DOMAIN.to_string(),
+        NYM_FRONTDOOR_VERCEL_IPS.to_vec(),
+    );
+    m.insert(
+        NYM_FRONTDOOR_FASTLY_DOMAIN.to_string(),
+        NYM_FRONTDOOR_FASTLY_IPS.to_vec(),
+    );
+    m.insert(
+        NYMVPN_FRONTDOOR_FASTLY_DOMAIN.to_string(),
+        NYMVPN_FRONTDOOR_FASTLY_IPS.to_vec(),
+    );
+    m.insert(VERCEL_APP_DOMAIN.to_string(), VERCEL_APP_IPS.to_vec());
+    m.insert(VERCEL_COM_DOMAIN.to_string(), VERCEL_COM_IPS.to_vec());
+    m.insert(NYM_COM_DOMAIN.to_string(), NYM_COM_IPS.to_vec());
+    m.insert(NYM_STATS_API_DOMAIN.to_string(), NYM_STATS_API_IPS.to_vec());
+    m
+}

common/http-api-client/src/dns/static_resolver.rs

@@ -0,0 +1,89 @@
+use crate::dns::ResolveError;
+
+use std::{
+    collections::HashMap,
+    net::{IpAddr, SocketAddr},
+    sync::{Arc, Mutex},
+};
+
+use reqwest::dns::{Addrs, Name, Resolve, Resolving};
+use tracing::*;
+
+#[derive(Debug, Default, Clone)]
+pub struct StaticResolver {
+    static_addr_map: Arc<Mutex<HashMap<String, Vec<IpAddr>>>>,
+}
+
+impl StaticResolver {
+    pub fn new(static_entries: HashMap<String, Vec<IpAddr>>) -> StaticResolver {
+        debug!("building static resolver");
+        Self {
+            static_addr_map: Arc::new(Mutex::new(static_entries)),
+        }
+    }
+
+    pub fn get_addrs(&self) -> HashMap<String, Vec<IpAddr>> {
+        self.static_addr_map.lock().unwrap().clone()
+    }
+}
+
+impl Resolve for StaticResolver {
+    fn resolve(&self, name: Name) -> Resolving {
+        debug!("looking up {name:?} in static resolver");
+        let addr_map = self.static_addr_map.clone();
+        Box::pin(async move {
+            let addr_map = addr_map.lock().unwrap();
+            let lookup = match addr_map.get(name.as_str()) {
+                None => return Err(ResolveError::StaticLookupMiss.into()),
+                Some(addrs) => addrs,
+            };
+            let addrs: Addrs = Box::new(
+                lookup
+                    .clone()
+                    .into_iter()
+                    .map(|ip_addr| SocketAddr::new(ip_addr, 0)),
+            );
+
+            Ok(addrs)
+        })
+    }
+}
+
+#[cfg(test)]
+mod test {
+    use itertools::Itertools;
+
+    use super::*;
+    use std::error::Error as StdError;
+    use std::str::FromStr;
+
+    #[tokio::test]
+    async fn lookup_using_static_resolver() -> Result<(), Box<dyn StdError + Send + Sync>> {
+        let example_domain = String::from("static.nymvpn.com");
+
+        // lookup for domain for which there is no entry
+        let resolver = StaticResolver::new(HashMap::new());
+
+        let url = reqwest::dns::Name::from_str(&example_domain).unwrap();
+        let result = resolver.resolve(url).await;
+        assert!(result.is_err());
+        match result {
+            Ok(_) => panic!("lookup with empty map should fail"),
+            Err(e) => assert_eq!(e.to_string(), ResolveError::StaticLookupMiss.to_string()),
+        }
+
+        // Successful lookup
+        let mut addr_map = HashMap::new();
+        let example_ip4: IpAddr = "10.10.10.10".parse().unwrap();
+        let example_ip6: IpAddr = "dead::beef".parse().unwrap();
+        addr_map.insert(example_domain.clone(), vec![example_ip4, example_ip6]);
+
+        let url = reqwest::dns::Name::from_str(&example_domain).unwrap();
+        let resolver = StaticResolver::new(addr_map);
+        let mut addrs = resolver.resolve(url).await?;
+        assert!(addrs.contains(&SocketAddr::new(example_ip4, 0)));
+        assert!(addrs.contains(&SocketAddr::new(example_ip6, 0)));
+
+        Ok(())
+    }
+}

common/http-api-client/src/lib.rs

@@ -179,7 +179,7 @@ mod dns;
 mod path;
 
 #[cfg(not(target_arch = "wasm32"))]
-pub use dns::{HickoryDnsError, HickoryDnsResolver};
+pub use dns::{HickoryDnsResolver, ResolveError};
 
 // helper for generating user agent based on binary information
 #[cfg(not(target_arch = "wasm32"))]

nym-authenticator-client/src/error.rs

@@ -2,7 +2,7 @@ use nym_credentials_interface::TicketType;
 use nym_sdk::mixnet::InputMessage;
 
 #[derive(thiserror::Error, Debug)]
-pub enum Error {
+pub enum AuthenticationClientError {
     #[error("mixnet client stopped returning responses")]
     NoMixnetMessagesReceived,
 
@@ -42,10 +42,19 @@ pub enum Error {
 
     #[error("unknown authenticator version number")]
     UnsupportedAuthenticatorVersion,
+}
 
-    #[error("failed to wait on AuthenticatorClientListener")]
-    FailedToJoinOnTask(#[from] tokio::task::JoinError),
+#[derive(thiserror::Error, Debug)]
+pub enum RegistrationError {
+    #[error(transparent)]
+    NoCredentialSent(AuthenticationClientError), // This intentionnally doesn't use `from` to avoid random ? operator to land here when they shouldn't
+
+    #[error("an error occured after a credential was sent : {source}")]
+    CredentialSent {
+        #[source]
+        source: AuthenticationClientError,
+    },
 }
 
 // Result type based on our error type
-pub type Result<T> = std::result::Result<T, Error>;
+pub(crate) type Result<T> = std::result::Result<T, AuthenticationClientError>;

nym-authenticator-client/src/lib.rs

@@ -6,11 +6,11 @@ use nym_bandwidth_controller::{BandwidthTicketProvider, DEFAULT_TICKETS_TO_SPEND
 use nym_crypto::asymmetric::x25519::KeyPair;
 use nym_registration_common::GatewayData;
 use std::net::{IpAddr, SocketAddr};
-use std::str::FromStr;
 use std::sync::Arc;
 use std::time::Duration;
 use tracing::{debug, error, trace};
 
+use crate::error::Result;
 use crate::mixnet_listener::{MixnetMessageBroadcastReceiver, MixnetMessageInputSender};
 use nym_authenticator_requests::{
     AuthenticatorVersion, client_message::ClientMessage, response::AuthenticatorResponse,
@@ -25,7 +25,7 @@ mod error;
 mod helpers;
 mod mixnet_listener;
 
-pub use crate::error::{Error, Result};
+pub use crate::error::{AuthenticationClientError, RegistrationError};
 pub use crate::mixnet_listener::{AuthClientMixnetListener, AuthClientMixnetListenerHandle};
 
 pub struct AuthenticatorClient {
@@ -91,7 +91,7 @@ impl AuthenticatorClient {
         self.mixnet_sender
             .send(input_message)
             .await
-            .map_err(|e| Error::SendMixnetMessage(Box::new(e)))?;
+            .map_err(|e| AuthenticationClientError::SendMixnetMessage(Box::new(e)))?;
 
         Ok(request_id)
     }
@@ -104,11 +104,11 @@ impl AuthenticatorClient {
             tokio::select! {
                 _ = &mut timeout => {
                     error!("Timed out waiting for reply to connect request");
-                    return Err(Error::TimeoutWaitingForConnectResponse);
+                    return Err(AuthenticationClientError::TimeoutWaitingForConnectResponse);
                 }
                 msg = self.mixnet_listener.recv() => match msg {
                     Err(_) => {
-                        return Err(Error::NoMixnetMessagesReceived);
+                        return Err(AuthenticationClientError::NoMixnetMessagesReceived);
                     }
                     Ok(msg) => {
                         let Some(header) = msg.message.first_chunk::<2>() else {
@@ -131,12 +131,12 @@ impl AuthenticatorClient {
                         // Then we deserialize the message
                         debug!("AuthClient: got message while waiting for connect response with version {version:?}");
                         let ret: Result<AuthenticatorResponse> = match version {
-                            AuthenticatorVersion::V1 => Err(Error::UnsupportedVersion),
+                            AuthenticatorVersion::V1 => Err(AuthenticationClientError::UnsupportedVersion),
                             AuthenticatorVersion::V2 => v2::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                             AuthenticatorVersion::V3 => v3::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                             AuthenticatorVersion::V4 => v4::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
                             AuthenticatorVersion::V5 => v5::response::AuthenticatorResponse::from_reconstructed_message(&msg).map(Into::into).map_err(Into::into),
-                            AuthenticatorVersion::UNKNOWN => Err(Error::UnknownVersion),
+                            AuthenticatorVersion::UNKNOWN => Err(AuthenticationClientError::UnknownVersion),
                         };
                         let Ok(response) = ret else {
                             // This is ok, it's likely just one of our self-pings
@@ -158,10 +158,14 @@ impl AuthenticatorClient {
         &mut self,
         controller: &dyn BandwidthTicketProvider,
         ticketbook_type: TicketType,
-    ) -> Result<GatewayData> {
+    ) -> std::result::Result<GatewayData, RegistrationError> {
         debug!("Registering with the wg gateway...");
         let init_message = match self.auth_version {
-            AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
+            AuthenticatorVersion::V1 | AuthenticatorVersion::UNKNOWN => {
+                return Err(RegistrationError::NoCredentialSent(
+                    AuthenticationClientError::UnsupportedAuthenticatorVersion,
+                ));
+            }
             AuthenticatorVersion::V2 => {
                 ClientMessage::Initial(Box::new(v2::registration::InitMessage {
                     pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
@@ -182,16 +186,20 @@ impl AuthenticatorClient {
                     pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                 }))
             }
-            AuthenticatorVersion::UNKNOWN => return Err(Error::UnsupportedAuthenticatorVersion),
         };
         trace!("sending init msg to {}: {:?}", &self.ip_addr, &init_message);
-        let response = self.send_and_wait_for_response(&init_message).await?;
+        let response = self
+            .send_and_wait_for_response(&init_message)
+            .await
+            .map_err(RegistrationError::NoCredentialSent)?;
         let registered_data = match response {
             AuthenticatorResponse::PendingRegistration(pending_registration_response) => {
                 // Unwrap since we have already checked that we have the keypair.
                 debug!("Verifying data");
                 if let Err(e) = pending_registration_response.verify(self.keypair.private_key()) {
-                    return Err(Error::VerificationFailed(e));
+                    return Err(RegistrationError::NoCredentialSent(
+                        AuthenticationClientError::VerificationFailed(e),
+                    ));
                 }
 
                 trace!(
@@ -199,6 +207,7 @@ impl AuthenticatorClient {
                     &self.ip_addr, &pending_registration_response
                 );
 
+                // This call takes care of updating the credential count in storage, so failure of this must be counted as credential waste
                 let credential = Some(
                     controller
                         .get_ecash_ticket(
@@ -207,15 +216,21 @@ impl AuthenticatorClient {
                             DEFAULT_TICKETS_TO_SPEND,
                         )
                         .await
-                        .map_err(|source| Error::GetTicket {
-                            ticketbook_type,
-                            source,
+                        .map_err(|source| RegistrationError::CredentialSent {
+                            source: AuthenticationClientError::GetTicket {
+                                ticketbook_type,
+                                source,
+                            },
                         })?
                         .data,
                 );
 
                 let finalized_message = match self.auth_version {
-                    AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
+                    AuthenticatorVersion::V1 | AuthenticatorVersion::UNKNOWN => {
+                        return Err(RegistrationError::CredentialSent {
+                            source: AuthenticationClientError::UnsupportedAuthenticatorVersion,
+                        });
+                    }
                     AuthenticatorVersion::V2 => {
                         ClientMessage::Final(Box::new(v2::registration::FinalMessage {
                             gateway_client: v2::registration::GatewayClient::new(
@@ -260,23 +275,29 @@ impl AuthenticatorClient {
                             credential,
                         }))
                     }
-                    AuthenticatorVersion::UNKNOWN => {
-                        return Err(Error::UnsupportedAuthenticatorVersion);
-                    }
                 };
                 trace!(
                     "sending final msg to {}: {:?}",
                     &self.ip_addr, &finalized_message
                 );
 
-                let response = self.send_and_wait_for_response(&finalized_message).await?;
+                let response = self
+                    .send_and_wait_for_response(&finalized_message)
+                    .await
+                    .map_err(|source| RegistrationError::CredentialSent { source })?;
                 let AuthenticatorResponse::Registered(registered_response) = response else {
-                    return Err(Error::InvalidGatewayAuthResponse);
+                    return Err(RegistrationError::CredentialSent {
+                        source: AuthenticationClientError::InvalidGatewayAuthResponse,
+                    });
                 };
                 registered_response
             }
             AuthenticatorResponse::Registered(registered_response) => registered_response,
-            _ => return Err(Error::InvalidGatewayAuthResponse),
+            _ => {
+                return Err(RegistrationError::NoCredentialSent(
+                    AuthenticationClientError::InvalidGatewayAuthResponse,
+                ));
+            }
         };
 
         trace!(
@@ -286,12 +307,7 @@ impl AuthenticatorClient {
 
         let gateway_data = GatewayData {
             public_key: registered_data.pub_key().inner().into(),
-            endpoint: SocketAddr::from_str(&format!(
-                "{}:{}",
-                self.ip_addr,
-                registered_data.wg_port()
-            ))
-            .map_err(Error::FailedToParseEntryGatewaySocketAddr)?,
+            endpoint: SocketAddr::new(self.ip_addr, registered_data.wg_port()),
             private_ipv4: registered_data.private_ips().ipv4,
             private_ipv6: registered_data.private_ips().ipv6,
         };
@@ -299,9 +315,12 @@ impl AuthenticatorClient {
         Ok(gateway_data)
     }
 
+    // This is up to the caller to know nothing is ever spent there
     pub async fn query_bandwidth(&mut self) -> Result<Option<i64>> {
         let query_message = match self.auth_version {
-            AuthenticatorVersion::V1 => return Err(Error::UnsupportedAuthenticatorVersion),
+            AuthenticatorVersion::V1 => {
+                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
+            }
             AuthenticatorVersion::V2 => ClientMessage::Query(Box::new(QueryMessageImpl {
                 pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                 version: AuthenticatorVersion::V2,
@@ -318,7 +337,9 @@ impl AuthenticatorClient {
                 pub_key: PeerPublicKey::new(self.keypair.public_key().to_bytes().into()),
                 version: AuthenticatorVersion::V5,
             })),
-            AuthenticatorVersion::UNKNOWN => return Err(Error::UnsupportedAuthenticatorVersion),
+            AuthenticatorVersion::UNKNOWN => {
+                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
+            }
         };
         let response = self.send_and_wait_for_response(&query_message).await?;
 
@@ -332,7 +353,7 @@ impl AuthenticatorClient {
                     return Ok(None);
                 }
             }
-            _ => return Err(Error::InvalidGatewayAuthResponse),
+            _ => return Err(AuthenticationClientError::InvalidGatewayAuthResponse),
         };
 
         let remaining_pretty = if available_bandwidth > 1024 * 1024 {
@@ -347,13 +368,13 @@ impl AuthenticatorClient {
         );
         if available_bandwidth < 1024 * 1024 {
             tracing::warn!(
-                            "Remaining bandwidth is under 1 MB. The wireguard mode will get suspended after that until tomorrow, UTC time. The client might shutdown with timeout soon
-            "
-                        );
+                "Remaining bandwidth is under 1 MB. The wireguard mode will get suspended after that until tomorrow, UTC time. The client might shutdown with timeout soon"
+            );
         }
         Ok(Some(available_bandwidth))
     }
 
+    // Since the caller provides the credential, it knows it is spent
     pub async fn top_up(&mut self, credential: CredentialSpendingData) -> Result<i64> {
         let top_up_message = match self.auth_version {
             AuthenticatorVersion::V3 => ClientMessage::TopUp(Box::new(v3::topup::TopUpMessage {
@@ -371,7 +392,7 @@ impl AuthenticatorClient {
                 credential,
             })),
             AuthenticatorVersion::V1 | AuthenticatorVersion::V2 | AuthenticatorVersion::UNKNOWN => {
-                return Err(Error::UnsupportedAuthenticatorVersion);
+                return Err(AuthenticationClientError::UnsupportedAuthenticatorVersion);
             }
         };
         let response = self.send_and_wait_for_response(&top_up_message).await?;
@@ -380,7 +401,7 @@ impl AuthenticatorClient {
             AuthenticatorResponse::TopUpBandwidth(top_up_bandwidth_response) => {
                 top_up_bandwidth_response.available_bandwidth()
             }
-            _ => return Err(Error::InvalidGatewayAuthResponse),
+            _ => return Err(AuthenticationClientError::InvalidGatewayAuthResponse),
         };
 
         Ok(remaining_bandwidth)

nym-registration-client/src/error.rs

@@ -35,19 +35,85 @@ pub enum RegistrationClientError {
     #[error("timeout connecting the mixnet client")]
     Timeout(#[from] tokio::time::error::Elapsed),
 
-    #[error("failed to register wireguard with the gateway for {gateway_id}")]
-    EntryGatewayRegisterWireguard {
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, no credential was sent"
+    )]
+    WireguardEntryRegistration {
         gateway_id: String,
         authenticator_address: Box<nym_sdk::mixnet::Recipient>,
         #[source]
-        source: Box<nym_authenticator_client::Error>,
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
     },
 
-    #[error("failed to register wireguard with the gateway for {gateway_id}")]
-    ExitGatewayRegisterWireguard {
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, no credential was sent"
+    )]
+    WireguardExitRegistration {
         gateway_id: String,
         authenticator_address: Box<nym_sdk::mixnet::Recipient>,
         #[source]
-        source: Box<nym_authenticator_client::Error>,
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
+    },
+
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, a credential was sent"
+    )]
+    WireguardEntryRegistrationCredentialSent {
+        gateway_id: String,
+        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
+        #[source]
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
+    },
+
+    #[error(
+        "failed to register wireguard with the gateway for {gateway_id}, a credential was sent"
+    )]
+    WireguardExitRegistrationCredentialSent {
+        gateway_id: String,
+        authenticator_address: Box<nym_sdk::mixnet::Recipient>,
+        #[source]
+        source: Box<nym_authenticator_client::AuthenticationClientError>,
     },
 }
+
+impl RegistrationClientError {
+    pub fn from_authenticator_error(
+        error: nym_authenticator_client::RegistrationError,
+        gateway_id: String,
+        authenticator_address: nym_sdk::mixnet::Recipient,
+        entry: bool,
+    ) -> Self {
+        match error {
+            nym_authenticator_client::RegistrationError::NoCredentialSent(source) => {
+                if entry {
+                    Self::WireguardEntryRegistration {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                } else {
+                    Self::WireguardExitRegistration {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                }
+            }
+            nym_authenticator_client::RegistrationError::CredentialSent { source } => {
+                if entry {
+                    Self::WireguardEntryRegistrationCredentialSent {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                } else {
+                    Self::WireguardExitRegistrationCredentialSent {
+                        gateway_id,
+                        authenticator_address: Box::new(authenticator_address),
+                        source: Box::new(source),
+                    }
+                }
+            }
+        }
+    }
+}

nym-registration-client/src/lib.rs

@@ -162,20 +162,22 @@ impl RegistrationClient {
 
         let entry = entry.map_err(|source| RegistrationError {
             mixnet_client: None,
-            source: RegistrationClientError::EntryGatewayRegisterWireguard {
-                gateway_id: self.config.entry.node.identity.to_base58_string(),
-                authenticator_address: Box::new(entry_auth_address),
-                source: Box::new(source),
-            },
+            source: RegistrationClientError::from_authenticator_error(
+                source,
+                self.config.entry.node.identity.to_base58_string(),
+                entry_auth_address,
+                true,
+            ),
         })?;
 
         let exit = exit.map_err(|source| RegistrationError {
             mixnet_client: None,
-            source: RegistrationClientError::EntryGatewayRegisterWireguard {
-                gateway_id: self.config.exit.node.identity.to_base58_string(),
-                authenticator_address: Box::new(exit_auth_address),
-                source: Box::new(source),
-            },
+            source: RegistrationClientError::from_authenticator_error(
+                source,
+                self.config.exit.node.identity.to_base58_string(),
+                exit_auth_address,
+                false,
+            ),
         })?;
 
         Ok(RegistrationResult::Wireguard(Box::new(