Refuse loopback, unspecified and link-local addresses in netcheck_request, on the address dialled, and use no proxy

modules/netcheck/cmd/netcheck/request_test.go

@@ -3,13 +3,58 @@ package main
 import (
 	"encoding/base64"
 	"io"
+	"net"
 	"net/http"
 	"net/http/httptest"
+	"os"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
 )
 
+// The httptest servers listen on loopback, which the tool refuses; the tests allow it, and the refusal
+// tests put the refusal back.
+func TestMain(m *testing.M) {
+	allowLoopback = true
+	os.Exit(m.Run())
+}
+
+func refusing(t *testing.T) {
+	t.Helper()
+	allowLoopback = false
+	t.Cleanup(func() { allowLoopback = true })
+}
+
+func TestRequestRefusesLocalAddresses(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Error("the server was reached")
+	}))
+	defer srv.Close()
+	port := srv.Listener.Addr().(*net.TCPAddr).Port
+	refusing(t)
+	for _, host := range []string{
+		"127.0.0.1", "localhost", "127.1", "[::1]", "[::ffff:127.0.0.1]", "0.0.0.0", "[::]",
+		"169.254.169.254", "[fe80::1]",
+	} {
+		u := "http://" + host + ":" + strconv.Itoa(port) + "/"
+		_, err := asked(t, map[string]any{"url": u, "timeout_ms": float64(2000)})
+		if err == nil || !strings.Contains(err.Error(), "refus") {
+			t.Errorf("%s: want a refusal, got %v", u, err)
+		}
+	}
+}
+
+func TestRequestIgnoresProxyEnvironment(t *testing.T) {
+	t.Setenv("HTTP_PROXY", "http://127.0.0.1:1")
+	t.Setenv("http_proxy", "http://127.0.0.1:1")
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
+	defer srv.Close()
+	if _, err := asked(t, map[string]any{"url": "http://example.invalid:80/"}); err == nil || strings.Contains(err.Error(), "127.0.0.1:1") {
+		t.Fatalf("a proxy seems to have been used: %v", err)
+	}
+}
+
 func asked(t *testing.T, args map[string]any) (RequestResult, error) {
 	t.Helper()
 	got, err := runRequest(args)
@@ -146,7 +191,7 @@ func TestRequestTimeout(t *testing.T) {
 	defer srv.Close()
 	defer close(release)
 	start := time.Now()
-	_, err := asked(t, map[string]any{"url": srv.URL, "timeout_ms": 100})
+	_, err := asked(t, map[string]any{"url": srv.URL, "timeout_ms": float64(100)})
 	if err == nil || time.Since(start) > 3*time.Second {
 		t.Fatalf("want a timeout error quickly, got %v after %v", err, time.Since(start))
 	}