Feature/vpn 4192 fix domain fronting

nym-vpn-core/crates/nym-gateway-directory/src/gateway_client.rs

@@ -108,6 +108,7 @@ impl ResolvedConfig {
 
 #[derive(Clone)]
 pub struct GatewayClient {
+    // TODO: Now that VpnApiClient can be constructed from both types of URLs, we can use it here.
     api_client: nym_http_api_client::Client,
     nym_vpn_api_client: Option<nym_vpn_api_client::VpnApiClient>,
     nyxd_url: Url,
@@ -122,7 +123,7 @@ impl GatewayClient {
     pub fn new_with_resolver_overrides(
         config: Config,
         user_agent: UserAgent,
-        static_nym_api_ip_addresses: Option<&[SocketAddr]>,
+        resolver_overrides: Option<&nym_vpn_api_client::ResolverOverrides>,
     ) -> Result<Self> {
         let api_client = nym_http_api_client::Client::builder(config.api_url.clone())
             .map_err(|e| Error::FailedToLookupDescribedGateways(e.into()))?
@@ -135,7 +136,7 @@ impl GatewayClient {
                 nym_vpn_api_client::VpnApiClient::new_with_resolver_overrides(
                     url,
                     user_agent.clone(),
-                    static_nym_api_ip_addresses,
+                    resolver_overrides,
                 )
             })
             .transpose()?;
@@ -153,7 +154,7 @@ impl GatewayClient {
         config: Config,
         network_details: &nym_network_defaults::NymNetworkDetails,
         user_agent: UserAgent,
-        static_nym_api_ip_addresses: Option<&[SocketAddr]>,
+        resolver_overrides: Option<&nym_vpn_api_client::ResolverOverrides>,
     ) -> Result<Self> {
         // Use the new unified HTTP client with domain fronting for the main API client
         let api_client = nym_http_api_client::ClientBuilder::from_network(network_details)
@@ -167,8 +168,9 @@ impl GatewayClient {
             Some(
                 nym_vpn_api_client::VpnApiClient::from_network_with_resolver_overrides(
                     network_details,
+                    true, // Using nym_vpn_api_urls from network_details
                     user_agent.clone(),
-                    static_nym_api_ip_addresses,
+                    resolver_overrides,
                 )?,
             )
         } else {

nym-vpn-core/crates/nym-gateway-probe/src/lib.rs

@@ -8,8 +8,7 @@ use std::{
 };
 
 use crate::{netstack::NetstackResult, types::Entry};
-use anyhow::Context;
-use anyhow::{anyhow, bail};
+use anyhow::{Context, anyhow, bail};
 use base64::{Engine as _, engine::general_purpose};
 use bytes::BytesMut;
 use clap::Args;
@@ -20,8 +19,7 @@ use nym_authenticator_requests::{
     v4, v5,
 };
 use nym_bandwidth_controller::error::BandwidthControllerError;
-use nym_client_core::client::base_client::storage::OnDiskPersistent;
-use nym_client_core::config::ForgetMe;
+use nym_client_core::{client::base_client::storage::OnDiskPersistent, config::ForgetMe};
 use nym_config::defaults::{
     NymNetworkDetails, WG_METADATA_PORT, WG_TUN_DEVICE_IP_ADDRESS_V4,
     mixnet_vpn::{NYM_TUN_DEVICE_ADDRESS_V4, NYM_TUN_DEVICE_ADDRESS_V6},
@@ -42,11 +40,13 @@ use nym_ip_packet_requests::{
         ControlResponse, DataResponse, InfoLevel, IpPacketResponse, IpPacketResponseData,
     },
 };
-use nym_sdk::bandwidth::BandwidthImporter;
-use nym_sdk::mixnet::{
-    CredentialStorage, DisconnectedMixnetClient, Ephemeral, EphemeralCredentialStorage, KeyStore,
-    MixnetClient, MixnetClientBuilder, MixnetClientStorage, NodeIdentity, ReconstructedMessage,
-    StoragePaths,
+use nym_sdk::{
+    bandwidth::BandwidthImporter,
+    mixnet::{
+        CredentialStorage, DisconnectedMixnetClient, Ephemeral, EphemeralCredentialStorage,
+        KeyStore, MixnetClient, MixnetClientBuilder, MixnetClientStorage, NodeIdentity,
+        ReconstructedMessage, StoragePaths,
+    },
 };
 use nym_validator_client::nyxd::error::NyxdError;
 use nym_wireguard_types::PeerPublicKey;

nym-vpn-core/crates/nym-vpn-account-controller/src/command_sender.rs

@@ -1,6 +1,8 @@
 // Copyright 2024 - Nym Technologies SA <[email protected]>
 // SPDX-License-Identifier: GPL-3.0-only
 
+use std::net::SocketAddr;
+
 use crate::{
     AvailableTicketbooks,
     commands::{AccountCommand, CommonCommand, ReturnSender},
@@ -12,7 +14,6 @@ use nym_vpn_api_client::{
 };
 use nym_vpn_lib_types::{AccountCommandError, RegisterAccountResponse};
 use nym_vpn_store::types::StorableAccount;
-use std::net::SocketAddr;
 use tokio::sync::mpsc::UnboundedSender;
 
 #[derive(Clone)]
@@ -145,12 +146,12 @@ impl AccountCommandSender {
 
     pub async fn set_static_api_addresses(
         &self,
-        static_addresses: Option<Vec<SocketAddr>>,
+        static_api_addresses: Option<Vec<SocketAddr>>,
     ) -> Result<(), AccountCommandError> {
         let (tx, rx) = ReturnSender::new();
         self.command_tx
             .send(AccountCommand::Common(
-                CommonCommand::SetStaticApiAddresses(tx, static_addresses),
+                CommonCommand::SetStaticApiAddresses(tx, static_api_addresses),
             ))
             .map_err(AccountCommandError::internal)?;
         rx.await.map_err(AccountCommandError::internal)?

nym-vpn-core/crates/nym-vpn-account-controller/src/commands/common_handler.rs

@@ -1,10 +1,12 @@
-// Copyright 2025 - Nym Technologies SA <[email protected]>
-// SPDX-License-Identifier: GPL-3.0-only
-
 use std::net::SocketAddr;
 
+// Copyright 2025 - Nym Technologies SA <[email protected]>
+// SPDX-License-Identifier: GPL-3.0-only
 use nym_offline_monitor::ConnectivityMonitor;
-use nym_vpn_api_client::response::{NymVpnDevice, NymVpnUsage};
+use nym_vpn_api_client::{
+    ResolverOverrides,
+    response::{NymVpnDevice, NymVpnUsage},
+};
 use nym_vpn_lib_types::AccountCommandError;
 
 use crate::{
@@ -46,6 +48,12 @@ pub(crate) async fn handle_common_command<C: ConnectivityMonitor>(
                 static_api_addresses,
             ));
         }
+        CommonCommand::SetResolverOverrides(result_tx, resolver_overrides) => {
+            result_tx.send(handle_set_resolver_overrides(
+                shared_state,
+                resolver_overrides,
+            ));
+        }
     };
 }
 
@@ -164,6 +172,20 @@ pub(crate) fn handle_set_static_api_addresses<C: ConnectivityMonitor>(
 ) -> Result<(), AccountCommandError> {
     shared_state
         .vpn_api_client
-        .override_resolver(static_api_addresses.as_deref())
-        .map_err(|e| AccountCommandError::internal(format!("Failed to set static addresses: {e}")))
+        .override_resolver_addresses(static_api_addresses.as_ref())
+        .map_err(|e| {
+            AccountCommandError::internal(format!("Failed to set resolver overrides: {e}"))
+        })
+}
+
+pub(crate) fn handle_set_resolver_overrides<C: ConnectivityMonitor>(
+    shared_state: &mut SharedAccountState<C>,
+    resolver_overrides: Option<ResolverOverrides>,
+) -> Result<(), AccountCommandError> {
+    shared_state
+        .vpn_api_client
+        .override_resolver(resolver_overrides.as_ref())
+        .map_err(|e| {
+            AccountCommandError::internal(format!("Failed to set resolver overrides: {e}"))
+        })
 }

nym-vpn-core/crates/nym-vpn-account-controller/src/commands/dispatch.rs

@@ -1,15 +1,17 @@
 // Copyright 2025 - Nym Technologies SA <[email protected]>
 // SPDX-License-Identifier: GPL-3.0-only
 
+use std::net::SocketAddr;
+
 use nym_vpn_lib_types::{AccountCommandError, RegisterAccountResponse};
 use nym_vpn_store::account::StorableAccount;
 
 use nym_validator_client::nyxd::Coin;
 use nym_vpn_api_client::{
+    ResolverOverrides,
     response::{NymVpnDevice, NymVpnUsage},
     types::Platform,
 };
-use std::net::SocketAddr;
 use tokio::sync::oneshot;
 
 use crate::AvailableTicketbooks;
@@ -78,6 +80,9 @@ impl AccountCommand {
                 CommonCommand::SetStaticApiAddresses(return_sender, _) => {
                     return_sender.send(Err(error))
                 }
+                CommonCommand::SetResolverOverrides(return_sender, _) => {
+                    return_sender.send(Err(error))
+                }
             },
         }
     }
@@ -112,6 +117,12 @@ pub enum CommonCommand {
         ReturnSender<(), AccountCommandError>,
         Option<Vec<SocketAddr>>,
     ),
+
+    /// Override the VPN API client resolver to allow him to go through the firewall (witg Domain Fronting)
+    SetResolverOverrides(
+        ReturnSender<(), AccountCommandError>,
+        Option<ResolverOverrides>,
+    ),
 }
 
 #[derive(Debug)]

nym-vpn-core/crates/nym-vpn-account-controller/src/state_machine/decentralised_state.rs

@@ -78,7 +78,8 @@ impl<C: ConnectivityMonitor> AccountControllerStateHandler<C> for DecentralisedS
                             CommonCommand::GetStoredAccount(return_sender) => return_sender.send(common_handler::handle_get_stored_account(shared_state).await),
                             CommonCommand::GetDeviceIdentity(return_sender) => return_decentralised(return_sender),
                             CommonCommand::GetAccountIdentity(return_sender) => return_sender.send(common_handler::handle_get_account_identity(shared_state)),
-                            CommonCommand::SetStaticApiAddresses(return_sender,socket_addrs) => return_sender.send(common_handler::handle_set_static_api_addresses(shared_state,socket_addrs)),
+                            CommonCommand::SetStaticApiAddresses(return_sender, static_api_addresses) => return_sender.send(common_handler::handle_set_static_api_addresses(shared_state, static_api_addresses)),
+                            CommonCommand::SetResolverOverrides(return_sender, resolver_overrides) => return_sender.send(common_handler::handle_set_resolver_overrides(shared_state, resolver_overrides)),
                             CommonCommand::GetUsage(return_sender) => return_decentralised(return_sender),
                             CommonCommand::GetDevices(return_sender) => return_decentralised(return_sender),
                             CommonCommand::GetActiveDevices(return_sender) => return_decentralised(return_sender),

nym-vpn-core/crates/nym-vpn-account-controller/src/state_machine/logged_out_state.rs

@@ -84,7 +84,8 @@ impl<C: ConnectivityMonitor> AccountControllerStateHandler<C> for LoggedOutState
 
                     AccountCommand::Common(common_command) => {
                         match common_command {
-                            CommonCommand::SetStaticApiAddresses(return_sender, socket_addrs) => return_sender.send(common_handler::handle_set_static_api_addresses(shared_state,socket_addrs)),
+                            CommonCommand::SetStaticApiAddresses(return_sender, static_api_addresses) => return_sender.send(common_handler::handle_set_static_api_addresses(shared_state, static_api_addresses)),
+                            CommonCommand::SetResolverOverrides(return_sender, resolver_overrides) => return_sender.send(common_handler::handle_set_resolver_overrides(shared_state, resolver_overrides)),
 
                             CommonCommand::GetAccountIdentity(return_sender) => return_sender.send(Ok(None)),
                             CommonCommand::GetStoredAccount(return_sender) => return_sender.send(Ok(None)),

nym-vpn-core/crates/nym-vpn-account-controller/src/state_machine/offline_state.rs

@@ -82,7 +82,8 @@ impl<C: ConnectivityMonitor> AccountControllerStateHandler<C> for OfflineState {
                             CommonCommand::GetStoredAccount(return_sender) => return_sender.send(common_handler::handle_get_stored_account(shared_state).await),
                             CommonCommand::GetDeviceIdentity(return_sender) => return_sender.send(common_handler::handle_get_device_identity(shared_state)),
                             CommonCommand::GetAccountIdentity(return_sender) => return_sender.send(common_handler::handle_get_account_identity(shared_state)),
-                            CommonCommand::SetStaticApiAddresses(return_sender,socket_addrs) => return_sender.send(common_handler::handle_set_static_api_addresses(shared_state,socket_addrs)),
+                            CommonCommand::SetStaticApiAddresses(return_sender, static_api_addresses) => return_sender.send(common_handler::handle_set_static_api_addresses(shared_state, static_api_addresses)),
+                            CommonCommand::SetResolverOverrides(return_sender, resolver_overrides) => return_sender.send(common_handler::handle_set_resolver_overrides(shared_state, resolver_overrides)),
                             CommonCommand::GetUsage(return_sender) => return_no_connectivity(return_sender),
                             CommonCommand::GetDevices(return_sender) => return_no_connectivity(return_sender),
                             CommonCommand::GetActiveDevices(return_sender) => return_no_connectivity(return_sender),