refactor: i/errorsx is now i/legacy/errorsx (#479)

We need still to add similar wrappers to internal/netxlite but we
will adopt a saner approach to error wrapping this time.

See https://github.com/ooni/probe/issues/1591

internal/engine/legacy/errorsx/dialer.go

@@ -0,0 +1,79 @@
+package errorsx
+
+import (
+	"context"
+	"net"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+)
+
+// Dialer establishes network connections.
+type Dialer interface {
+	// DialContext behaves like net.Dialer.DialContext.
+	DialContext(ctx context.Context, network, address string) (net.Conn, error)
+}
+
+// ErrorWrapperDialer is a dialer that performs error wrapping. The connection
+// returned by the DialContext function will also perform error wrapping.
+type ErrorWrapperDialer struct {
+	// Dialer is the underlying dialer.
+	Dialer
+}
+
+// DialContext implements Dialer.DialContext.
+func (d *ErrorWrapperDialer) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+	conn, err := d.Dialer.DialContext(ctx, network, address)
+	if err != nil {
+		return nil, SafeErrWrapperBuilder{
+			Classifier: errorsx.ClassifyGenericError,
+			Operation:  errorsx.ConnectOperation,
+			Error:      err,
+		}.MaybeBuild()
+	}
+	return &errorWrapperConn{Conn: conn}, nil
+}
+
+// errorWrapperConn is a net.Conn that performs error wrapping.
+type errorWrapperConn struct {
+	// Conn is the underlying connection.
+	net.Conn
+}
+
+// Read implements net.Conn.Read.
+func (c *errorWrapperConn) Read(b []byte) (int, error) {
+	count, err := c.Conn.Read(b)
+	if err != nil {
+		return 0, SafeErrWrapperBuilder{
+			Classifier: errorsx.ClassifyGenericError,
+			Operation:  errorsx.ReadOperation,
+			Error:      err,
+		}.MaybeBuild()
+	}
+	return count, nil
+}
+
+// Write implements net.Conn.Write.
+func (c *errorWrapperConn) Write(b []byte) (int, error) {
+	count, err := c.Conn.Write(b)
+	if err != nil {
+		return 0, SafeErrWrapperBuilder{
+			Classifier: errorsx.ClassifyGenericError,
+			Operation:  errorsx.WriteOperation,
+			Error:      err,
+		}.MaybeBuild()
+	}
+	return count, nil
+}
+
+// Close implements net.Conn.Close.
+func (c *errorWrapperConn) Close() error {
+	err := c.Conn.Close()
+	if err != nil {
+		return SafeErrWrapperBuilder{
+			Classifier: errorsx.ClassifyGenericError,
+			Operation:  errorsx.CloseOperation,
+			Error:      err,
+		}.MaybeBuild()
+	}
+	return nil
+}

internal/engine/legacy/errorsx/dialer_test.go

@@ -0,0 +1,189 @@
+package errorsx
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net"
+	"testing"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
+)
+
+func TestErrorWrapperDialerFailure(t *testing.T) {
+	ctx := context.Background()
+	d := &ErrorWrapperDialer{Dialer: &mocks.Dialer{
+		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
+			return nil, io.EOF
+		},
+	}}
+	conn, err := d.DialContext(ctx, "tcp", "www.google.com:443")
+	var ew *errorsx.ErrWrapper
+	if !errors.As(err, &ew) {
+		t.Fatal("cannot convert to ErrWrapper")
+	}
+	if ew.Operation != errorsx.ConnectOperation {
+		t.Fatal("unexpected operation", ew.Operation)
+	}
+	if ew.Failure != errorsx.FailureEOFError {
+		t.Fatal("unexpected failure", ew.Failure)
+	}
+	if !errors.Is(ew.WrappedErr, io.EOF) {
+		t.Fatal("unexpected underlying error", ew.WrappedErr)
+	}
+	if conn != nil {
+		t.Fatal("expected a nil conn here")
+	}
+}
+
+func TestErrorWrapperDialerSuccess(t *testing.T) {
+	origConn := &net.TCPConn{}
+	ctx := context.Background()
+	d := &ErrorWrapperDialer{Dialer: &mocks.Dialer{
+		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
+			return origConn, nil
+		},
+	}}
+	conn, err := d.DialContext(ctx, "tcp", "www.google.com:443")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ewConn, ok := conn.(*errorWrapperConn)
+	if !ok {
+		t.Fatal("cannot cast to errorWrapperConn")
+	}
+	if ewConn.Conn != origConn {
+		t.Fatal("not the connection we expected")
+	}
+}
+
+func TestErrorWrapperConnReadFailure(t *testing.T) {
+	c := &errorWrapperConn{
+		Conn: &mocks.Conn{
+			MockRead: func(b []byte) (int, error) {
+				return 0, io.EOF
+			},
+		},
+	}
+	buf := make([]byte, 1024)
+	cnt, err := c.Read(buf)
+	var ew *errorsx.ErrWrapper
+	if !errors.As(err, &ew) {
+		t.Fatal("cannot cast error to ErrWrapper")
+	}
+	if ew.Operation != errorsx.ReadOperation {
+		t.Fatal("invalid operation", ew.Operation)
+	}
+	if ew.Failure != errorsx.FailureEOFError {
+		t.Fatal("invalid failure", ew.Failure)
+	}
+	if !errors.Is(ew.WrappedErr, io.EOF) {
+		t.Fatal("invalid wrapped error", ew.WrappedErr)
+	}
+	if cnt != 0 {
+		t.Fatal("expected zero here", cnt)
+	}
+}
+
+func TestErrorWrapperConnReadSuccess(t *testing.T) {
+	c := &errorWrapperConn{
+		Conn: &mocks.Conn{
+			MockRead: func(b []byte) (int, error) {
+				return len(b), nil
+			},
+		},
+	}
+	buf := make([]byte, 1024)
+	cnt, err := c.Read(buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cnt != len(buf) {
+		t.Fatal("expected len(buf) here", cnt)
+	}
+}
+
+func TestErrorWrapperConnWriteFailure(t *testing.T) {
+	c := &errorWrapperConn{
+		Conn: &mocks.Conn{
+			MockWrite: func(b []byte) (int, error) {
+				return 0, io.EOF
+			},
+		},
+	}
+	buf := make([]byte, 1024)
+	cnt, err := c.Write(buf)
+	var ew *errorsx.ErrWrapper
+	if !errors.As(err, &ew) {
+		t.Fatal("cannot cast error to ErrWrapper")
+	}
+	if ew.Operation != errorsx.WriteOperation {
+		t.Fatal("invalid operation", ew.Operation)
+	}
+	if ew.Failure != errorsx.FailureEOFError {
+		t.Fatal("invalid failure", ew.Failure)
+	}
+	if !errors.Is(ew.WrappedErr, io.EOF) {
+		t.Fatal("invalid wrapped error", ew.WrappedErr)
+	}
+	if cnt != 0 {
+		t.Fatal("expected zero here", cnt)
+	}
+}
+
+func TestErrorWrapperConnWriteSuccess(t *testing.T) {
+	c := &errorWrapperConn{
+		Conn: &mocks.Conn{
+			MockWrite: func(b []byte) (int, error) {
+				return len(b), nil
+			},
+		},
+	}
+	buf := make([]byte, 1024)
+	cnt, err := c.Write(buf)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cnt != len(buf) {
+		t.Fatal("expected len(buf) here", cnt)
+	}
+}
+
+func TestErrorWrapperConnCloseFailure(t *testing.T) {
+	c := &errorWrapperConn{
+		Conn: &mocks.Conn{
+			MockClose: func() error {
+				return io.EOF
+			},
+		},
+	}
+	err := c.Close()
+	var ew *errorsx.ErrWrapper
+	if !errors.As(err, &ew) {
+		t.Fatal("cannot cast error to ErrWrapper")
+	}
+	if ew.Operation != errorsx.CloseOperation {
+		t.Fatal("invalid operation", ew.Operation)
+	}
+	if ew.Failure != errorsx.FailureEOFError {
+		t.Fatal("invalid failure", ew.Failure)
+	}
+	if !errors.Is(ew.WrappedErr, io.EOF) {
+		t.Fatal("invalid wrapped error", ew.WrappedErr)
+	}
+}
+
+func TestErrorWrapperConnCloseSuccess(t *testing.T) {
+	c := &errorWrapperConn{
+		Conn: &mocks.Conn{
+			MockClose: func() error {
+				return nil
+			},
+		},
+	}
+	err := c.Close()
+	if err != nil {
+		t.Fatal(err)
+	}
+}

internal/engine/legacy/errorsx/errorsx.go

@@ -0,0 +1,70 @@
+// Package errorsx contains error extensions.
+package errorsx
+
+import (
+	"errors"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+)
+
+// SafeErrWrapperBuilder contains a builder for ErrWrapper that
+// is safe, i.e., behaves correctly when the error is nil.
+type SafeErrWrapperBuilder struct {
+	// Error is the error, if any
+	Error error
+
+	// Classifier is the local error to string classifier. When there is no
+	// configured classifier we will use the generic classifier.
+	Classifier func(err error) string
+
+	// Operation is the operation that failed
+	Operation string
+}
+
+// MaybeBuild builds a new ErrWrapper, if b.Error is not nil, and returns
+// a nil error value, instead, if b.Error is nil.
+func (b SafeErrWrapperBuilder) MaybeBuild() (err error) {
+	if b.Error != nil {
+		classifier := b.Classifier
+		if classifier == nil {
+			classifier = errorsx.ClassifyGenericError
+		}
+		err = &errorsx.ErrWrapper{
+			Failure:    classifier(b.Error),
+			Operation:  toOperationString(b.Error, b.Operation),
+			WrappedErr: b.Error,
+		}
+	}
+	return
+}
+
+func toOperationString(err error, operation string) string {
+	var errwrapper *errorsx.ErrWrapper
+	if errors.As(err, &errwrapper) {
+		// Basically, as explained in ErrWrapper docs, let's
+		// keep the child major operation, if any.
+		if errwrapper.Operation == errorsx.ConnectOperation {
+			return errwrapper.Operation
+		}
+		if errwrapper.Operation == errorsx.HTTPRoundTripOperation {
+			return errwrapper.Operation
+		}
+		if errwrapper.Operation == errorsx.ResolveOperation {
+			return errwrapper.Operation
+		}
+		if errwrapper.Operation == errorsx.TLSHandshakeOperation {
+			return errwrapper.Operation
+		}
+		if errwrapper.Operation == errorsx.QUICHandshakeOperation {
+			return errwrapper.Operation
+		}
+		if errwrapper.Operation == "quic_handshake_start" {
+			return errorsx.QUICHandshakeOperation
+		}
+		if errwrapper.Operation == "quic_handshake_done" {
+			return errorsx.QUICHandshakeOperation
+		}
+		// FALLTHROUGH
+	}
+	return operation
+}

internal/engine/legacy/errorsx/errorsx_test.go

@@ -0,0 +1,76 @@
+package errorsx
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+)
+
+func TestMaybeBuildFactory(t *testing.T) {
+	err := SafeErrWrapperBuilder{
+		Error: errors.New("mocked error"),
+	}.MaybeBuild()
+	var target *errorsx.ErrWrapper
+	if errors.As(err, &target) == false {
+		t.Fatal("not the expected error type")
+	}
+	if target.Failure != "unknown_failure: mocked error" {
+		t.Fatal("the failure string is wrong")
+	}
+	if target.WrappedErr.Error() != "mocked error" {
+		t.Fatal("the wrapped error is wrong")
+	}
+}
+
+func TestToOperationString(t *testing.T) {
+	t.Run("for connect", func(t *testing.T) {
+		// You're doing HTTP and connect fails. You want to know
+		// that connect failed not that HTTP failed.
+		err := &errorsx.ErrWrapper{Operation: errorsx.ConnectOperation}
+		if toOperationString(err, errorsx.HTTPRoundTripOperation) != errorsx.ConnectOperation {
+			t.Fatal("unexpected result")
+		}
+	})
+	t.Run("for http_round_trip", func(t *testing.T) {
+		// You're doing DoH and something fails inside HTTP. You want
+		// to know about the internal HTTP error, not resolve.
+		err := &errorsx.ErrWrapper{Operation: errorsx.HTTPRoundTripOperation}
+		if toOperationString(err, errorsx.ResolveOperation) != errorsx.HTTPRoundTripOperation {
+			t.Fatal("unexpected result")
+		}
+	})
+	t.Run("for resolve", func(t *testing.T) {
+		// You're doing HTTP and the DNS fails. You want to
+		// know that resolve failed.
+		err := &errorsx.ErrWrapper{Operation: errorsx.ResolveOperation}
+		if toOperationString(err, errorsx.HTTPRoundTripOperation) != errorsx.ResolveOperation {
+			t.Fatal("unexpected result")
+		}
+	})
+	t.Run("for tls_handshake", func(t *testing.T) {
+		// You're doing HTTP and the TLS handshake fails. You want
+		// to know about a TLS handshake error.
+		err := &errorsx.ErrWrapper{Operation: errorsx.TLSHandshakeOperation}
+		if toOperationString(err, errorsx.HTTPRoundTripOperation) != errorsx.TLSHandshakeOperation {
+			t.Fatal("unexpected result")
+		}
+	})
+	t.Run("for minor operation", func(t *testing.T) {
+		// You just noticed that TLS handshake failed and you
+		// have a child error telling you that read failed. Here
+		// you want to know about a TLS handshake error.
+		err := &errorsx.ErrWrapper{Operation: errorsx.ReadOperation}
+		if toOperationString(err, errorsx.TLSHandshakeOperation) != errorsx.TLSHandshakeOperation {
+			t.Fatal("unexpected result")
+		}
+	})
+	t.Run("for quic_handshake", func(t *testing.T) {
+		// You're doing HTTP and the TLS handshake fails. You want
+		// to know about a TLS handshake error.
+		err := &errorsx.ErrWrapper{Operation: errorsx.QUICHandshakeOperation}
+		if toOperationString(err, errorsx.HTTPRoundTripOperation) != errorsx.QUICHandshakeOperation {
+			t.Fatal("unexpected result")
+		}
+	})
+}

internal/engine/legacy/errorsx/integration_test.go

@@ -0,0 +1,55 @@
+package errorsx_test
+
+import (
+	"context"
+	"crypto/tls"
+	"testing"
+
+	"github.com/lucas-clemente/quic-go"
+	errorsxlegacy "github.com/ooni/probe-cli/v3/internal/engine/legacy/errorsx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+)
+
+func TestErrorWrapperQUICDialerInvalidCertificate(t *testing.T) {
+	nextprotos := []string{"h3"}
+	servername := "example.com"
+	tlsConf := &tls.Config{
+		NextProtos: nextprotos,
+		ServerName: servername,
+	}
+
+	dlr := &errorsxlegacy.ErrorWrapperQUICDialer{Dialer: &netxlite.QUICDialerQUICGo{
+		QUICListener: &netxlite.QUICListenerStdlib{},
+	}}
+	// use Google IP
+	sess, err := dlr.DialContext(context.Background(), "udp",
+		"216.58.212.164:443", tlsConf, &quic.Config{})
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	if sess != nil {
+		t.Fatal("expected nil sess here")
+	}
+	if err.Error() != errorsx.FailureSSLInvalidCertificate {
+		t.Fatal("unexpected failure")
+	}
+}
+
+func TestErrorWrapperQUICDialerSuccess(t *testing.T) {
+	ctx := context.Background()
+	tlsConf := &tls.Config{
+		NextProtos: []string{"h3"},
+		ServerName: "www.google.com",
+	}
+	d := &errorsxlegacy.ErrorWrapperQUICDialer{Dialer: &netxlite.QUICDialerQUICGo{
+		QUICListener: &netxlite.QUICListenerStdlib{},
+	}}
+	sess, err := d.DialContext(ctx, "udp", "216.58.212.164:443", tlsConf, &quic.Config{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if sess == nil {
+		t.Fatal("expected non-nil sess here")
+	}
+}

internal/engine/legacy/errorsx/quic.go

@@ -0,0 +1,98 @@
+package errorsx
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+
+	"github.com/lucas-clemente/quic-go"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
+)
+
+// QUICContextDialer is a dialer for QUIC using Context.
+type QUICContextDialer interface {
+	// DialContext establishes a new QUIC session using the given
+	// network and address. The tlsConfig and the quicConfig arguments
+	// MUST NOT be nil. Returns either the session or an error.
+	DialContext(ctx context.Context, network, address string,
+		tlsConfig *tls.Config, quicConfig *quic.Config) (quic.EarlySession, error)
+}
+
+// QUICListener listens for QUIC connections.
+type QUICListener interface {
+	// Listen creates a new listening UDPConn.
+	Listen(addr *net.UDPAddr) (quicx.UDPLikeConn, error)
+}
+
+// ErrorWrapperQUICListener is a QUICListener that wraps errors.
+type ErrorWrapperQUICListener struct {
+	// QUICListener is the underlying listener.
+	QUICListener QUICListener
+}
+
+var _ QUICListener = &ErrorWrapperQUICListener{}
+
+// Listen implements QUICListener.Listen.
+func (qls *ErrorWrapperQUICListener) Listen(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
+	pconn, err := qls.QUICListener.Listen(addr)
+	if err != nil {
+		return nil, SafeErrWrapperBuilder{
+			Error:     err,
+			Operation: errorsx.QUICListenOperation,
+		}.MaybeBuild()
+	}
+	return &errorWrapperUDPConn{pconn}, nil
+}
+
+// errorWrapperUDPConn is a quicx.UDPLikeConn that wraps errors.
+type errorWrapperUDPConn struct {
+	// UDPLikeConn is the underlying conn.
+	quicx.UDPLikeConn
+}
+
+var _ quicx.UDPLikeConn = &errorWrapperUDPConn{}
+
+// WriteTo implements quicx.UDPLikeConn.WriteTo.
+func (c *errorWrapperUDPConn) WriteTo(p []byte, addr net.Addr) (int, error) {
+	count, err := c.UDPLikeConn.WriteTo(p, addr)
+	if err != nil {
+		return 0, SafeErrWrapperBuilder{
+			Error:     err,
+			Operation: errorsx.WriteToOperation,
+		}.MaybeBuild()
+	}
+	return count, nil
+}
+
+// ReadFrom implements quicx.UDPLikeConn.ReadFrom.
+func (c *errorWrapperUDPConn) ReadFrom(b []byte) (int, net.Addr, error) {
+	n, addr, err := c.UDPLikeConn.ReadFrom(b)
+	if err != nil {
+		return 0, nil, SafeErrWrapperBuilder{
+			Error:     err,
+			Operation: errorsx.ReadFromOperation,
+		}.MaybeBuild()
+	}
+	return n, addr, nil
+}
+
+// ErrorWrapperQUICDialer is a dialer that performs quic err wrapping
+type ErrorWrapperQUICDialer struct {
+	Dialer QUICContextDialer
+}
+
+// DialContext implements ContextDialer.DialContext
+func (d *ErrorWrapperQUICDialer) DialContext(
+	ctx context.Context, network string, host string,
+	tlsCfg *tls.Config, cfg *quic.Config) (quic.EarlySession, error) {
+	sess, err := d.Dialer.DialContext(ctx, network, host, tlsCfg, cfg)
+	if err != nil {
+		return nil, SafeErrWrapperBuilder{
+			Classifier: errorsx.ClassifyQUICHandshakeError,
+			Error:      err,
+			Operation:  errorsx.QUICHandshakeOperation,
+		}.MaybeBuild()
+	}
+	return sess, nil
+}

internal/engine/legacy/errorsx/quic_test.go

@@ -0,0 +1,156 @@
+package errorsx
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+	"net"
+	"testing"
+
+	"github.com/lucas-clemente/quic-go"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
+)
+
+func TestErrorWrapperQUICListenerSuccess(t *testing.T) {
+	ql := &ErrorWrapperQUICListener{
+		QUICListener: &mocks.QUICListener{
+			MockListen: func(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
+				return &net.UDPConn{}, nil
+			},
+		},
+	}
+	pconn, err := ql.Listen(&net.UDPAddr{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	pconn.Close()
+}
+
+func TestErrorWrapperQUICListenerFailure(t *testing.T) {
+	ql := &ErrorWrapperQUICListener{
+		QUICListener: &mocks.QUICListener{
+			MockListen: func(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
+				return nil, io.EOF
+			},
+		},
+	}
+	pconn, err := ql.Listen(&net.UDPAddr{})
+	if err.Error() != "eof_error" {
+		t.Fatal("not the error we expected", err)
+	}
+	if pconn != nil {
+		t.Fatal("expected nil pconn here")
+	}
+}
+
+func TestErrorWrapperUDPConnWriteToSuccess(t *testing.T) {
+	quc := &errorWrapperUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
+			MockWriteTo: func(p []byte, addr net.Addr) (int, error) {
+				return 10, nil
+			},
+		},
+	}
+	pkt := make([]byte, 128)
+	addr := &net.UDPAddr{}
+	cnt, err := quc.WriteTo(pkt, addr)
+	if err != nil {
+		t.Fatal("not the error we expected", err)
+	}
+	if cnt != 10 {
+		t.Fatal("expected 10 here")
+	}
+}
+
+func TestErrorWrapperUDPConnWriteToFailure(t *testing.T) {
+	expected := errors.New("mocked error")
+	quc := &errorWrapperUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
+			MockWriteTo: func(p []byte, addr net.Addr) (int, error) {
+				return 0, expected
+			},
+		},
+	}
+	pkt := make([]byte, 128)
+	addr := &net.UDPAddr{}
+	cnt, err := quc.WriteTo(pkt, addr)
+	if !errors.Is(err, expected) {
+		t.Fatal("not the error we expected", err)
+	}
+	if cnt != 0 {
+		t.Fatal("expected 0 here")
+	}
+}
+
+func TestErrorWrapperUDPConnReadFromSuccess(t *testing.T) {
+	expected := errors.New("mocked error")
+	quc := &errorWrapperUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
+			MockReadFrom: func(b []byte) (int, net.Addr, error) {
+				return 0, nil, expected
+			},
+		},
+	}
+	b := make([]byte, 128)
+	n, addr, err := quc.ReadFrom(b)
+	if !errors.Is(err, expected) {
+		t.Fatal("not the error we expected", err)
+	}
+	if n != 0 {
+		t.Fatal("expected 0 here")
+	}
+	if addr != nil {
+		t.Fatal("expected nil here")
+	}
+}
+
+func TestErrorWrapperUDPConnReadFromFailure(t *testing.T) {
+	quc := &errorWrapperUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
+			MockReadFrom: func(b []byte) (int, net.Addr, error) {
+				return 10, nil, nil
+			},
+		},
+	}
+	b := make([]byte, 128)
+	n, addr, err := quc.ReadFrom(b)
+	if err != nil {
+		t.Fatal("not the error we expected", err)
+	}
+	if n != 10 {
+		t.Fatal("expected 10 here")
+	}
+	if addr != nil {
+		t.Fatal("expected nil here")
+	}
+}
+
+func TestErrorWrapperQUICDialerFailure(t *testing.T) {
+	ctx := context.Background()
+	d := &ErrorWrapperQUICDialer{Dialer: &mocks.QUICContextDialer{
+		MockDialContext: func(ctx context.Context, network, address string, tlsConfig *tls.Config, quicConfig *quic.Config) (quic.EarlySession, error) {
+			return nil, io.EOF
+		},
+	}}
+	sess, err := d.DialContext(
+		ctx, "udp", "www.google.com:443", &tls.Config{}, &quic.Config{})
+	if sess != nil {
+		t.Fatal("expected a nil sess here")
+	}
+	if !errors.Is(err, io.EOF) {
+		t.Fatal("expected another error here")
+	}
+	var errWrapper *errorsx.ErrWrapper
+	if !errors.As(err, &errWrapper) {
+		t.Fatal("cannot cast to ErrWrapper")
+	}
+	if errWrapper.Operation != errorsx.QUICHandshakeOperation {
+		t.Fatal("unexpected Operation")
+	}
+	if errWrapper.Failure != errorsx.FailureEOFError {
+		t.Fatal("unexpected failure")
+	}
+}

internal/engine/legacy/errorsx/resolver.go

@@ -0,0 +1,56 @@
+package errorsx
+
+import (
+	"context"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+)
+
+// Resolver is a DNS resolver. The *net.Resolver used by Go implements
+// this interface, but other implementations are possible.
+type Resolver interface {
+	// LookupHost resolves a hostname to a list of IP addresses.
+	LookupHost(ctx context.Context, hostname string) (addrs []string, err error)
+}
+
+// ErrorWrapperResolver is a Resolver that knows about wrapping errors.
+type ErrorWrapperResolver struct {
+	Resolver
+}
+
+var _ Resolver = &ErrorWrapperResolver{}
+
+// LookupHost implements Resolver.LookupHost
+func (r *ErrorWrapperResolver) LookupHost(ctx context.Context, hostname string) ([]string, error) {
+	addrs, err := r.Resolver.LookupHost(ctx, hostname)
+	err = SafeErrWrapperBuilder{
+		Classifier: errorsx.ClassifyResolverError,
+		Error:      err,
+		Operation:  errorsx.ResolveOperation,
+	}.MaybeBuild()
+	return addrs, err
+}
+
+type resolverNetworker interface {
+	Network() string
+}
+
+// Network implements Resolver.Network.
+func (r *ErrorWrapperResolver) Network() string {
+	if rn, ok := r.Resolver.(resolverNetworker); ok {
+		return rn.Network()
+	}
+	return "errorWrapper"
+}
+
+type resolverAddresser interface {
+	Address() string
+}
+
+// Address implements Resolver.Address.
+func (r *ErrorWrapperResolver) Address() string {
+	if ra, ok := r.Resolver.(resolverAddresser); ok {
+		return ra.Address()
+	}
+	return ""
+}

internal/engine/legacy/errorsx/resolver_test.go

@@ -0,0 +1,81 @@
+package errorsx
+
+import (
+	"context"
+	"errors"
+	"net"
+	"testing"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
+)
+
+func TestErrorWrapperResolverSuccess(t *testing.T) {
+	orig := []string{"8.8.8.8"}
+	r := &ErrorWrapperResolver{
+		Resolver: &mocks.Resolver{
+			MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
+				return orig, nil
+			},
+		},
+	}
+	addrs, err := r.LookupHost(context.Background(), "dns.google.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(addrs) != len(orig) || addrs[0] != orig[0] {
+		t.Fatal("not the result we expected")
+	}
+}
+
+func TestErrorWrapperResolverFailure(t *testing.T) {
+	r := &ErrorWrapperResolver{
+		Resolver: &mocks.Resolver{
+			MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
+				return nil, errors.New("no such host")
+			},
+		},
+	}
+	ctx := context.Background()
+	addrs, err := r.LookupHost(ctx, "dns.google.com")
+	if addrs != nil {
+		t.Fatal("expected nil addr here")
+	}
+	var errWrapper *errorsx.ErrWrapper
+	if !errors.As(err, &errWrapper) {
+		t.Fatal("cannot properly cast the returned error")
+	}
+	if errWrapper.Failure != errorsx.FailureDNSNXDOMAINError {
+		t.Fatal("unexpected failure")
+	}
+	if errWrapper.Operation != errorsx.ResolveOperation {
+		t.Fatal("unexpected Operation")
+	}
+}
+
+func TestErrorWrapperResolverChildNetworkAddress(t *testing.T) {
+	r := &ErrorWrapperResolver{Resolver: &mocks.Resolver{
+		MockNetwork: func() string {
+			return "udp"
+		},
+		MockAddress: func() string {
+			return "8.8.8.8:53"
+		},
+	}}
+	if r.Network() != "udp" {
+		t.Fatal("invalid Network")
+	}
+	if r.Address() != "8.8.8.8:53" {
+		t.Fatal("invalid Address")
+	}
+}
+
+func TestErrorWrapperResolverNoChildNetworkAddress(t *testing.T) {
+	r := &ErrorWrapperResolver{Resolver: &net.Resolver{}}
+	if r.Network() != "errorWrapper" {
+		t.Fatal("invalid Network")
+	}
+	if r.Address() != "" {
+		t.Fatal("invalid Address")
+	}
+}

internal/engine/legacy/errorsx/tls.go

@@ -0,0 +1,33 @@
+package errorsx
+
+import (
+	"context"
+	"crypto/tls"
+	"net"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+)
+
+// TLSHandshaker is the generic TLS handshaker
+type TLSHandshaker interface {
+	Handshake(ctx context.Context, conn net.Conn, config *tls.Config) (
+		net.Conn, tls.ConnectionState, error)
+}
+
+// ErrorWrapperTLSHandshaker wraps the returned error to be an OONI error
+type ErrorWrapperTLSHandshaker struct {
+	TLSHandshaker
+}
+
+// Handshake implements TLSHandshaker.Handshake
+func (h *ErrorWrapperTLSHandshaker) Handshake(
+	ctx context.Context, conn net.Conn, config *tls.Config,
+) (net.Conn, tls.ConnectionState, error) {
+	tlsconn, state, err := h.TLSHandshaker.Handshake(ctx, conn, config)
+	err = SafeErrWrapperBuilder{
+		Classifier: errorsx.ClassifyTLSHandshakeError,
+		Error:      err,
+		Operation:  errorsx.TLSHandshakeOperation,
+	}.MaybeBuild()
+	return tlsconn, state, err
+}

internal/engine/legacy/errorsx/tls_test.go

@@ -0,0 +1,43 @@
+package errorsx
+
+import (
+	"context"
+	"crypto/tls"
+	"errors"
+	"io"
+	"net"
+	"testing"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/errorsx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
+)
+
+func TestErrorWrapperTLSHandshakerFailure(t *testing.T) {
+	th := ErrorWrapperTLSHandshaker{TLSHandshaker: &mocks.TLSHandshaker{
+		MockHandshake: func(ctx context.Context, conn net.Conn, config *tls.Config) (net.Conn, tls.ConnectionState, error) {
+			return nil, tls.ConnectionState{}, io.EOF
+		},
+	}}
+	conn, _, err := th.Handshake(
+		context.Background(), &mocks.Conn{
+			MockRead: func(b []byte) (int, error) {
+				return 0, io.EOF
+			},
+		}, new(tls.Config))
+	if !errors.Is(err, io.EOF) {
+		t.Fatal("not the error that we expected")
+	}
+	if conn != nil {
+		t.Fatal("expected nil con here")
+	}
+	var errWrapper *errorsx.ErrWrapper
+	if !errors.As(err, &errWrapper) {
+		t.Fatal("cannot cast to ErrWrapper")
+	}
+	if errWrapper.Failure != errorsx.FailureEOFError {
+		t.Fatal("unexpected Failure")
+	}
+	if errWrapper.Operation != errorsx.TLSHandshakeOperation {
+		t.Fatal("unexpected Operation")
+	}
+}