feat: rename functions and variables for clarity in safehttp package; enhance URL validation tests

backend/internal/safehttp/safehttp_test.go

@@ -2,6 +2,9 @@ package safehttp
 
 import (
 	"context"
+	"io"
+	"net"
+	"net/http"
 	"net/netip"
 	"testing"
 	"time"
@@ -15,9 +18,6 @@ func TestValidateURLRejectsUnsafeDestinations(t *testing.T) {
 		"http://127.0.0.1/image",
 		"http://[::1]/image",
 		"http://169.254.169.254/latest/meta-data",
-		"http://10.0.0.1/image",
-		"http://192.168.1.10/image",
-		"http://100.64.0.1/image",
 		"http://example.com:99999/image",
 	} {
 		if _, err := ValidateURL(rawURL); err == nil {
@@ -26,6 +26,21 @@ func TestValidateURLRejectsUnsafeDestinations(t *testing.T) {
 	}
 }
 
+func TestValidateURLAcceptsPrivateNetworkMirror(t *testing.T) {
+	t.Parallel()
+	for _, rawURL := range []string{
+		"http://10.0.0.10/images/rootfs.tar.xz",
+		"http://172.16.20.30:8080/images/vm.qcow2",
+		"https://192.168.1.10/image.iso",
+		"http://100.64.0.10/image.qcow2",
+		"http://[fd00::10]/rootfs.tar.xz",
+	} {
+		if _, err := ValidateURL(rawURL); err != nil {
+			t.Errorf("ValidateURL(%q) returned error: %v", rawURL, err)
+		}
+	}
+}
+
 func TestValidateURLAcceptsPublicHTTPURL(t *testing.T) {
 	t.Parallel()
 	parsed, err := ValidateURL("https://example.com/images/rootfs.tar.xz?variant=default")
@@ -37,29 +52,31 @@ func TestValidateURLAcceptsPublicHTTPURL(t *testing.T) {
 	}
 }
 
-func TestIsPublicAddress(t *testing.T) {
+func TestIsAllowedDownloadAddress(t *testing.T) {
 	t.Parallel()
 	tests := map[string]bool{
 		"8.8.8.8":              true,
 		"1.1.1.1":              true,
 		"2606:4700:4700::1111": true,
 		"127.0.0.1":            false,
-		"10.0.0.1":             false,
-		"100.64.0.1":           false,
+		"10.0.0.1":             true,
+		"100.64.0.1":           true,
+		"172.16.0.1":           true,
+		"192.168.1.1":          true,
 		"169.254.169.254":      false,
 		"192.0.2.1":            false,
 		"198.18.0.1":           false,
 		"::1":                  false,
 		"64:ff9b::127.0.0.1":   false,
 		"2002:7f00:1::1":       false,
-		"fc00::1":              false,
+		"fc00::1":              true,
 		"fec0::1":              false,
 		"fe80::1":              false,
 		"2001:db8::1":          false,
 	}
 	for raw, expected := range tests {
-		if actual := isPublicAddress(netip.MustParseAddr(raw)); actual != expected {
-			t.Errorf("isPublicAddress(%s) = %v, want %v", raw, actual, expected)
+		if actual := isAllowedDownloadAddress(netip.MustParseAddr(raw)); actual != expected {
+			t.Errorf("isAllowedDownloadAddress(%s) = %v, want %v", raw, actual, expected)
 		}
 	}
 }
@@ -72,3 +89,53 @@ func TestGetRejectsLoopbackBeforeRequest(t *testing.T) {
 		t.Fatal("Get accepted a loopback destination")
 	}
 }
+
+func TestGetAllowsPrivateNetworkMirror(t *testing.T) {
+	privateIP := privateInterfaceIPv4(t)
+	listener, err := net.Listen("tcp4", net.JoinHostPort(privateIP.String(), "0"))
+	if err != nil {
+		t.Fatalf("failed to listen on private interface: %v", err)
+	}
+	defer listener.Close()
+
+	server := &http.Server{Handler: http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = io.WriteString(w, "private mirror ok")
+	})}
+	go func() { _ = server.Serve(listener) }()
+	defer server.Close()
+
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	response, err := Get(ctx, "http://"+listener.Addr().String()+"/image", "test", 5*time.Second)
+	if err != nil {
+		t.Fatalf("Get rejected private mirror: %v", err)
+	}
+	defer response.Body.Close()
+	body, err := io.ReadAll(response.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(body) != "private mirror ok" {
+		t.Fatalf("body = %q, want private mirror response", body)
+	}
+}
+
+func privateInterfaceIPv4(t *testing.T) netip.Addr {
+	t.Helper()
+	addresses, err := net.InterfaceAddrs()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, rawAddress := range addresses {
+		prefix, err := netip.ParsePrefix(rawAddress.String())
+		if err != nil {
+			continue
+		}
+		address := prefix.Addr().Unmap()
+		if address.Is4() && address.IsPrivate() && isAllowedDownloadAddress(address) {
+			return address
+		}
+	}
+	t.Skip("no private IPv4 interface is available")
+	return netip.Addr{}
+}