refactor(netxlite): hide details without breaking the rest of the tree (#454)

## Description

This PR continues the refactoring of `netx` under the following principles:

1. do not break the rest of the tree and do not engage in extensive tree-wide refactoring yet
2. move under `netxlite` clearly related subpackages (e.g., `iox`, `netxmocks`)
3. move into `internal/netxlite/internal` stuff that is clearly private of `netxlite`
4. hide implementation details in `netxlite` pending new factories
5. refactor `tls` code in `netxlite` to clearly separate `crypto/tls` code from `utls` code

After each commit, I run `go test -short -race ./...` locally. Each individual commit explains what it does. I will squash, but this operation will preserve the original commit titles, so this will give further insight on each step.

## Commits

* refactor: rename netxmocks -> netxlite/mocks

Part of https://github.com/ooni/probe/issues/1591

* refactor: rename quicx -> netxlite/quicx

See https://github.com/ooni/probe/issues/1591

* refactor: rename iox -> netxlite/iox

Regenerate sources and make sure the tests pass.

See https://github.com/ooni/probe/issues/1591.

* refactor(iox): move MockableReader to netxlite/mocks

See https://github.com/ooni/probe/issues/1591

* refactor(netxlite): generator is an implementation detail

See https://github.com/ooni/probe/issues/1591

* refactor(netxlite): separate tls and utls code

See https://github.com/ooni/probe/issues/1591

* refactor(netxlite): hide most types but keep old names as legacy

With this change we avoid breaking the rest of the tree, but we start
hiding some implementation details a bit. Factories will follow.

See https://github.com/ooni/probe/issues/1591

CONTRIBUTING.md

@@ -65,8 +65,8 @@ run `go mod tidy` to minimize such changes.
 
 - use `./internal/fsx.OpenFile` when you need to open a file
 
-- use `./internal/iox.ReadAllContext` instead of `io.ReadAll`
+- use `./internal/netxlite/iox.ReadAllContext` instead of `io.ReadAll`
-and `./internal/iox.CopyContext` instead of `io.Copy`
+and `./internal/netxlite/iox.CopyContext` instead of `io.Copy`
 
 ## Code testing requirements
 

cmd/ooniprobe/internal/config/parser_test.go

@@ -8,7 +8,7 @@ import (
 	"os"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func getShasum(path string) (string, error) {

cmd/ooniprobe/internal/database/database.go

@@ -6,7 +6,7 @@ import (
 	"embed"
 
 	"github.com/apex/log"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	migrate "github.com/rubenv/sql-migrate"
 	"upper.io/db.v3/lib/sqlbuilder"
 	"upper.io/db.v3/sqlite"

internal/bytecounter/conn_test.go

@@ -4,12 +4,12 @@ import (
 	"errors"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestConnWorksOnSuccess(t *testing.T) {
 	counter := New()
-	underlying := &netxmocks.Conn{
+	underlying := &mocks.Conn{
 		MockRead: func(b []byte) (int, error) {
 			return 10, nil
 		},
@@ -39,7 +39,7 @@ func TestConnWorksOnFailure(t *testing.T) {
 	readError := errors.New("read error")
 	writeError := errors.New("write error")
 	counter := New()
-	underlying := &netxmocks.Conn{
+	underlying := &mocks.Conn{
 		MockRead: func(b []byte) (int, error) {
 			return 0, readError
 		},

internal/cmd/jafar/badproxy/badproxy.go

@@ -16,7 +16,7 @@ import (
 	"time"
 
 	"github.com/google/martian/v3/mitm"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 // CensoringProxy is a proxy that does not behave correctly.

internal/cmd/jafar/httpproxy/httpproxy_test.go

@@ -8,7 +8,7 @@ import (
 	"testing"
 
 	"github.com/ooni/probe-cli/v3/internal/cmd/jafar/uncensored"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestPass(t *testing.T) {

internal/cmd/jafar/iptables/iptables_linux.go

@@ -1,3 +1,4 @@
+//go:build linux
 // +build linux
 
 package iptables

internal/cmd/jafar/iptables/iptables_unsupported.go

@@ -1,3 +1,4 @@
+//go:build !linux
 // +build !linux
 
 package iptables

internal/cmd/jafar/uncensored/uncensored_test.go

@@ -7,7 +7,7 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestGood(t *testing.T) {

internal/cmd/oohelper/internal/client.go

@@ -14,7 +14,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/experiment/webconnectivity"
 	"github.com/ooni/probe-cli/v3/internal/engine/httpheader"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	"github.com/ooni/probe-cli/v3/internal/runtimex"
 	"github.com/ooni/probe-cli/v3/internal/version"
 )

internal/cmd/oohelper/internal/fake_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/atomicx"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeResolver struct {

internal/cmd/oohelperd/internal/webconnectivity/fake_test.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/atomicx"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeResolver struct {

internal/cmd/oohelperd/internal/webconnectivity/http.go

@@ -8,7 +8,7 @@ import (
 	"sync"
 
 	"github.com/ooni/probe-cli/v3/internal/engine/experiment/webconnectivity"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 // CtrlHTTPResponse is the result of the HTTP check performed by

internal/cmd/oohelperd/internal/webconnectivity/webconnectivity.go

@@ -7,7 +7,7 @@ import (
 	"net/http"
 
 	"github.com/ooni/probe-cli/v3/internal/engine/netx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	"github.com/ooni/probe-cli/v3/internal/runtimex"
 	"github.com/ooni/probe-cli/v3/internal/version"
 )

internal/cmd/oohelperd/internal/webconnectivity/webconnectivity_test.go

@@ -10,8 +10,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
 	"github.com/ooni/probe-cli/v3/internal/netxlite"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 const simplerequest = `{

internal/cmd/oohelperd/internal/websteps/websteps.go

@@ -13,7 +13,7 @@ import (
 	"net/http"
 
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/archival"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	"github.com/ooni/probe-cli/v3/internal/runtimex"
 	"github.com/ooni/probe-cli/v3/internal/version"
 )

internal/cmd/oohelperd/internal/websteps/websteps_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 const requestnoredirect = `{

internal/engine/experiment/dash/dash.go

@@ -19,7 +19,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
 	"github.com/ooni/probe-cli/v3/internal/humanize"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 const (

internal/engine/experiment/hhfm/fake_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeDialer struct {

internal/engine/experiment/hhfm/hhfm.go

@@ -20,7 +20,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/archival"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/dialer"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	"github.com/ooni/probe-cli/v3/internal/randx"
 )
 

internal/engine/experiment/ndt7/download.go

@@ -7,7 +7,7 @@ import (
 	"time"
 
 	"github.com/gorilla/websocket"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type downloadManager struct {

internal/engine/experiment/urlgetter/runner.go

@@ -12,7 +12,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/httpheader"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	"github.com/ooni/probe-cli/v3/internal/runtimex"
 )
 

internal/engine/experiment/websteps/websteps.go

@@ -66,7 +66,7 @@ func (m Measurer) ExperimentVersion() string {
 
 // SupportedQUICVersions are the H3 over QUIC versions we currently support
 var SupportedQUICVersions = map[string]bool{
-	"h3":    true,
+	"h3": true,
 }
 
 var (

internal/engine/geolocate/fake_test.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeTransport struct {

internal/engine/httpx/fake_test.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeTransport struct {

internal/engine/httpx/jsonapi.go

@@ -10,7 +10,7 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 // Logger is the definition of Logger used by this package.

internal/engine/legacy/netx/emitterdialer_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/handlers"
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestEmitterFailure(t *testing.T) {
@@ -20,7 +20,7 @@ func TestEmitterFailure(t *testing.T) {
 		Beginning: time.Now(),
 		Handler:   saver,
 	})
-	d := EmitterDialer{Dialer: &netxmocks.Dialer{
+	d := EmitterDialer{Dialer: &mocks.Dialer{
 		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 			return nil, io.EOF
 		},
@@ -69,9 +69,9 @@ func TestEmitterSuccess(t *testing.T) {
 		Beginning: time.Now(),
 		Handler:   saver,
 	})
-	d := EmitterDialer{Dialer: &netxmocks.Dialer{
+	d := EmitterDialer{Dialer: &mocks.Dialer{
 		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
-			return &netxmocks.Conn{
+			return &mocks.Conn{
 				MockRead: func(b []byte) (int, error) {
 					return 0, io.EOF
 				},

internal/engine/legacy/netx/http_test.go

@@ -14,7 +14,7 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func dowithclient(t *testing.T, client *netx.HTTPClient) {

internal/engine/legacy/netx/oldhttptransport/bodytracer_test.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestBodyTracerSuccess(t *testing.T) {

internal/engine/legacy/netx/oldhttptransport/httptransport_test.go

@@ -5,7 +5,7 @@ import (
 	"net/http"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestGood(t *testing.T) {

internal/engine/legacy/netx/oldhttptransport/tracetripper.go

@@ -13,7 +13,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/atomicx"
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 // TraceTripper performs single HTTP transactions.

internal/engine/legacy/netx/oldhttptransport/tracetripper_test.go

@@ -13,7 +13,7 @@ import (
 
 	"github.com/miekg/dns"
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestTraceTripperSuccess(t *testing.T) {

internal/engine/legacy/netxlogger/netxlogger_test.go

@@ -10,7 +10,7 @@ import (
 	"github.com/apex/log/handlers/discard"
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx"
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestGood(t *testing.T) {

internal/engine/legacy/oonitemplates/oonitemplates.go

@@ -24,7 +24,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx"
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/handlers"
 	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	"github.com/ooni/probe-cli/v3/internal/runtimex"
 	"gitlab.com/yawning/obfs4.git/transports"
 	obfs4base "gitlab.com/yawning/obfs4.git/transports/base"

internal/engine/netx/dialer/bytecounter_test.go

@@ -9,8 +9,8 @@ import (
 	"testing"
 
 	"github.com/ooni/probe-cli/v3/internal/bytecounter"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func dorequest(ctx context.Context, url string) error {
@@ -76,7 +76,7 @@ func TestByteCounterNoHandlers(t *testing.T) {
 }
 
 func TestByteCounterConnectFailure(t *testing.T) {
-	dialer := &byteCounterDialer{Dialer: &netxmocks.Dialer{
+	dialer := &byteCounterDialer{Dialer: &mocks.Dialer{
 		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 			return nil, io.EOF
 		},

internal/engine/netx/dialer/proxy_test.go

@@ -8,13 +8,13 @@ import (
 	"net/url"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestProxyDialerDialContextNoProxyURL(t *testing.T) {
 	expected := errors.New("mocked error")
 	d := &proxyDialer{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 				return nil, expected
 			},
@@ -45,7 +45,7 @@ func TestProxyDialerDialContextInvalidScheme(t *testing.T) {
 func TestProxyDialerDialContextWithEOF(t *testing.T) {
 	const expect = "10.0.0.1:9050"
 	d := &proxyDialer{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 				if address != expect {
 					return nil, errors.New("unexpected address")

internal/engine/netx/dialer/saver_test.go

@@ -10,14 +10,14 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestSaverDialerFailure(t *testing.T) {
 	expected := errors.New("mocked error")
 	saver := &trace.Saver{}
 	dlr := &saverDialer{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 				return nil, expected
 			},
@@ -59,7 +59,7 @@ func TestSaverConnDialerFailure(t *testing.T) {
 	expected := errors.New("mocked error")
 	saver := &trace.Saver{}
 	dlr := &saverConnDialer{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 				return nil, expected
 			},
@@ -79,9 +79,9 @@ func TestSaverConnDialerSuccess(t *testing.T) {
 	saver := &trace.Saver{}
 	dlr := &saverConnDialer{
 		Dialer: &saverDialer{
-			Dialer: &netxmocks.Dialer{
+			Dialer: &mocks.Dialer{
 				MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
-					return &netxmocks.Conn{
+					return &mocks.Conn{
 						MockRead: func(b []byte) (int, error) {
 							return 0, io.EOF
 						},

internal/engine/netx/dialer/shaping_disabled.go

@@ -1,3 +1,4 @@
+//go:build !shaping
 // +build !shaping
 
 package dialer

internal/engine/netx/dialer/shaping_enabled.go

@@ -1,3 +1,4 @@
+//go:build shaping
 // +build shaping
 
 package dialer

internal/engine/netx/fake_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeDialer struct {

internal/engine/netx/httptransport/bytecounter_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/bytecounter"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/httptransport"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestByteCounterFailure(t *testing.T) {

internal/engine/netx/httptransport/fake_test.go

@@ -6,7 +6,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeDialer struct {

internal/engine/netx/httptransport/saver.go

@@ -10,7 +10,7 @@ import (
 	"time"
 
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 // SaverPerformanceHTTPTransport is a RoundTripper that saves

internal/engine/netx/httptransport/saver_test.go

@@ -11,7 +11,7 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/httptransport"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestSaverPerformanceNoMultipleEvents(t *testing.T) {

internal/engine/netx/integration_test.go

@@ -11,7 +11,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/netx"
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func TestSuccess(t *testing.T) {

internal/engine/netx/quicdialer/system.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 // QUICListener listens for QUIC connections.

internal/engine/netx/quicdialer/system_test.go

@@ -12,14 +12,14 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/netx/trace"
 	"github.com/ooni/probe-cli/v3/internal/errorsx"
 	"github.com/ooni/probe-cli/v3/internal/netxlite"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 func TestQUICListenerSaverCannotListen(t *testing.T) {
 	expected := errors.New("mocked error")
 	qls := &quicdialer.QUICListenerSaver{
-		QUICListener: &netxmocks.QUICListener{
+		QUICListener: &mocks.QUICListener{
 			MockListen: func(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
 				return nil, expected
 			},

internal/engine/netx/resolver/dnsoverhttps.go

@@ -8,7 +8,7 @@ import (
 	"time"
 
 	"github.com/ooni/probe-cli/v3/internal/engine/httpheader"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 // DNSOverHTTPS is a DNS over HTTPS RoundTripper. Requests are submitted over

internal/engine/probeservices/collector_test.go

@@ -15,7 +15,7 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/ooni/probe-cli/v3/internal/engine/model"
 	"github.com/ooni/probe-cli/v3/internal/engine/probeservices"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type fakeTestKeys struct {

internal/engine/probeservices/probeservices_test.go

@@ -16,7 +16,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/model"
 	"github.com/ooni/probe-cli/v3/internal/engine/probeservices"
 	"github.com/ooni/probe-cli/v3/internal/engine/probeservices/testorchestra"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func newclient() *probeservices.Client {

internal/engine/session_integration_test.go

@@ -16,7 +16,7 @@ import (
 	"github.com/ooni/probe-cli/v3/internal/engine/geolocate"
 	"github.com/ooni/probe-cli/v3/internal/engine/model"
 	"github.com/ooni/probe-cli/v3/internal/engine/probeservices"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 	"github.com/ooni/probe-cli/v3/internal/version"
 )
 

internal/engine/session_nopsiphon.go

@@ -1,3 +1,4 @@
+//go:build !ooni_psiphon_config
 // +build !ooni_psiphon_config
 
 package engine

internal/engine/session_nopsiphon_test.go

@@ -1,3 +1,4 @@
+//go:build !ooni_psiphon_config
 // +build !ooni_psiphon_config
 
 package engine

internal/engine/session_psiphon.go

@@ -1,3 +1,4 @@
+//go:build ooni_psiphon_config
 // +build ooni_psiphon_config
 
 package engine
@@ -8,7 +9,7 @@ import (
 	_ "embed"
 
 	"filippo.io/age"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 //go:embed psiphon-config.json.age

internal/engine/session_psiphon_test.go

@@ -1,3 +1,4 @@
+//go:build ooni_psiphon_config
 // +build ooni_psiphon_config
 
 package engine

internal/errorsx/dialer_test.go

@@ -7,12 +7,12 @@ import (
 	"net"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestErrorWrapperDialerFailure(t *testing.T) {
 	ctx := context.Background()
-	d := &ErrorWrapperDialer{Dialer: &netxmocks.Dialer{
+	d := &ErrorWrapperDialer{Dialer: &mocks.Dialer{
 		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 			return nil, io.EOF
 		},
@@ -39,7 +39,7 @@ func TestErrorWrapperDialerFailure(t *testing.T) {
 func TestErrorWrapperDialerSuccess(t *testing.T) {
 	origConn := &net.TCPConn{}
 	ctx := context.Background()
-	d := &ErrorWrapperDialer{Dialer: &netxmocks.Dialer{
+	d := &ErrorWrapperDialer{Dialer: &mocks.Dialer{
 		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 			return origConn, nil
 		},
@@ -59,7 +59,7 @@ func TestErrorWrapperDialerSuccess(t *testing.T) {
 
 func TestErrorWrapperConnReadFailure(t *testing.T) {
 	c := &errorWrapperConn{
-		Conn: &netxmocks.Conn{
+		Conn: &mocks.Conn{
 			MockRead: func(b []byte) (int, error) {
 				return 0, io.EOF
 			},
@@ -87,7 +87,7 @@ func TestErrorWrapperConnReadFailure(t *testing.T) {
 
 func TestErrorWrapperConnReadSuccess(t *testing.T) {
 	c := &errorWrapperConn{
-		Conn: &netxmocks.Conn{
+		Conn: &mocks.Conn{
 			MockRead: func(b []byte) (int, error) {
 				return len(b), nil
 			},
@@ -105,7 +105,7 @@ func TestErrorWrapperConnReadSuccess(t *testing.T) {
 
 func TestErrorWrapperConnWriteFailure(t *testing.T) {
 	c := &errorWrapperConn{
-		Conn: &netxmocks.Conn{
+		Conn: &mocks.Conn{
 			MockWrite: func(b []byte) (int, error) {
 				return 0, io.EOF
 			},
@@ -133,7 +133,7 @@ func TestErrorWrapperConnWriteFailure(t *testing.T) {
 
 func TestErrorWrapperConnWriteSuccess(t *testing.T) {
 	c := &errorWrapperConn{
-		Conn: &netxmocks.Conn{
+		Conn: &mocks.Conn{
 			MockWrite: func(b []byte) (int, error) {
 				return len(b), nil
 			},
@@ -151,7 +151,7 @@ func TestErrorWrapperConnWriteSuccess(t *testing.T) {
 
 func TestErrorWrapperConnCloseFailure(t *testing.T) {
 	c := &errorWrapperConn{
-		Conn: &netxmocks.Conn{
+		Conn: &mocks.Conn{
 			MockClose: func() error {
 				return io.EOF
 			},
@@ -175,7 +175,7 @@ func TestErrorWrapperConnCloseFailure(t *testing.T) {
 
 func TestErrorWrapperConnCloseSuccess(t *testing.T) {
 	c := &errorWrapperConn{
-		Conn: &netxmocks.Conn{
+		Conn: &mocks.Conn{
 			MockClose: func() error {
 				return nil
 			},

internal/errorsx/errno.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// Generated: 2021-07-02 17:54:06.182341 +0200 CEST m=+0.120124584
+// Generated: 2021-09-05 13:54:14.649711 +0200 CEST m=+0.136980959
 
 package errorsx
 

internal/errorsx/errno_test.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// Generated: 2021-07-02 17:54:06.226224 +0200 CEST m=+0.164008293
+// Generated: 2021-09-05 13:54:14.695896 +0200 CEST m=+0.183167084
 
 package errorsx
 

internal/errorsx/errno_unix.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// Generated: 2021-07-02 17:54:06.062944 +0200 CEST m=+0.000724793
+// Generated: 2021-09-05 13:54:14.514032 +0200 CEST m=+0.001299626
 
 package errorsx
 

internal/errorsx/errno_windows.go

@@ -1,5 +1,5 @@
 // Code generated by go generate; DO NOT EDIT.
-// Generated: 2021-07-02 17:54:06.155868 +0200 CEST m=+0.093650376
+// Generated: 2021-09-05 13:54:14.622035 +0200 CEST m=+0.109304917
 
 package errorsx
 

internal/errorsx/quic.go

@@ -7,7 +7,7 @@ import (
 	"net"
 
 	"github.com/lucas-clemente/quic-go"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 // QUICContextDialer is a dialer for QUIC using Context.

internal/errorsx/quic_test.go

@@ -9,13 +9,13 @@ import (
 	"testing"
 
 	"github.com/lucas-clemente/quic-go"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 func TestErrorWrapperQUICListenerSuccess(t *testing.T) {
 	ql := &ErrorWrapperQUICListener{
-		QUICListener: &netxmocks.QUICListener{
+		QUICListener: &mocks.QUICListener{
 			MockListen: func(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
 				return &net.UDPConn{}, nil
 			},
@@ -30,7 +30,7 @@ func TestErrorWrapperQUICListenerSuccess(t *testing.T) {
 
 func TestErrorWrapperQUICListenerFailure(t *testing.T) {
 	ql := &ErrorWrapperQUICListener{
-		QUICListener: &netxmocks.QUICListener{
+		QUICListener: &mocks.QUICListener{
 			MockListen: func(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
 				return nil, io.EOF
 			},
@@ -47,7 +47,7 @@ func TestErrorWrapperQUICListenerFailure(t *testing.T) {
 
 func TestErrorWrapperUDPConnWriteToSuccess(t *testing.T) {
 	quc := &errorWrapperUDPConn{
-		UDPLikeConn: &netxmocks.QUICUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
 			MockWriteTo: func(p []byte, addr net.Addr) (int, error) {
 				return 10, nil
 			},
@@ -67,7 +67,7 @@ func TestErrorWrapperUDPConnWriteToSuccess(t *testing.T) {
 func TestErrorWrapperUDPConnWriteToFailure(t *testing.T) {
 	expected := errors.New("mocked error")
 	quc := &errorWrapperUDPConn{
-		UDPLikeConn: &netxmocks.QUICUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
 			MockWriteTo: func(p []byte, addr net.Addr) (int, error) {
 				return 0, expected
 			},
@@ -87,7 +87,7 @@ func TestErrorWrapperUDPConnWriteToFailure(t *testing.T) {
 func TestErrorWrapperUDPConnReadFromSuccess(t *testing.T) {
 	expected := errors.New("mocked error")
 	quc := &errorWrapperUDPConn{
-		UDPLikeConn: &netxmocks.QUICUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
 			MockReadFrom: func(b []byte) (int, net.Addr, error) {
 				return 0, nil, expected
 			},
@@ -108,7 +108,7 @@ func TestErrorWrapperUDPConnReadFromSuccess(t *testing.T) {
 
 func TestErrorWrapperUDPConnReadFromFailure(t *testing.T) {
 	quc := &errorWrapperUDPConn{
-		UDPLikeConn: &netxmocks.QUICUDPConn{
+		UDPLikeConn: &mocks.QUICUDPConn{
 			MockReadFrom: func(b []byte) (int, net.Addr, error) {
 				return 10, nil, nil
 			},
@@ -129,7 +129,7 @@ func TestErrorWrapperUDPConnReadFromFailure(t *testing.T) {
 
 func TestErrorWrapperQUICDialerFailure(t *testing.T) {
 	ctx := context.Background()
-	d := &ErrorWrapperQUICDialer{Dialer: &netxmocks.QUICContextDialer{
+	d := &ErrorWrapperQUICDialer{Dialer: &mocks.QUICContextDialer{
 		MockDialContext: func(ctx context.Context, network, address string, tlsConfig *tls.Config, quicConfig *quic.Config) (quic.EarlySession, error) {
 			return nil, io.EOF
 		},

internal/errorsx/resolver_test.go

@@ -6,13 +6,13 @@ import (
 	"net"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestErrorWrapperResolverSuccess(t *testing.T) {
 	orig := []string{"8.8.8.8"}
 	r := &ErrorWrapperResolver{
-		Resolver: &netxmocks.Resolver{
+		Resolver: &mocks.Resolver{
 			MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 				return orig, nil
 			},
@@ -29,7 +29,7 @@ func TestErrorWrapperResolverSuccess(t *testing.T) {
 
 func TestErrorWrapperResolverFailure(t *testing.T) {
 	r := &ErrorWrapperResolver{
-		Resolver: &netxmocks.Resolver{
+		Resolver: &mocks.Resolver{
 			MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 				return nil, errors.New("no such host")
 			},
@@ -53,7 +53,7 @@ func TestErrorWrapperResolverFailure(t *testing.T) {
 }
 
 func TestErrorWrapperResolverChildNetworkAddress(t *testing.T) {
-	r := &ErrorWrapperResolver{Resolver: &netxmocks.Resolver{
+	r := &ErrorWrapperResolver{Resolver: &mocks.Resolver{
 		MockNetwork: func() string {
 			return "udp"
 		},

internal/errorsx/tls_test.go

@@ -8,17 +8,17 @@ import (
 	"net"
 	"testing"
 
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestErrorWrapperTLSHandshakerFailure(t *testing.T) {
-	th := ErrorWrapperTLSHandshaker{TLSHandshaker: &netxmocks.TLSHandshaker{
+	th := ErrorWrapperTLSHandshaker{TLSHandshaker: &mocks.TLSHandshaker{
 		MockHandshake: func(ctx context.Context, conn net.Conn, config *tls.Config) (net.Conn, tls.ConnectionState, error) {
 			return nil, tls.ConnectionState{}, io.EOF
 		},
 	}}
 	conn, _, err := th.Handshake(
-		context.Background(), &netxmocks.Conn{
+		context.Background(), &mocks.Conn{
 			MockRead: func(b []byte) (int, error) {
 				return 0, io.EOF
 			},

internal/fsx/example_test.go

@@ -9,7 +9,7 @@ import (
 	"syscall"
 
 	"github.com/ooni/probe-cli/v3/internal/fsx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func ExampleOpenFile_openingDir() {

internal/mlablocate/mlablocate.go

@@ -12,7 +12,7 @@ import (
 	"net/http"
 	"net/url"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 // Logger is the logger expected by this package.

internal/mlablocatev2/fake_test.go

@@ -4,7 +4,7 @@ import (
 	"net/http"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 type FakeTransport struct {

internal/mlablocatev2/mlablocatev2.go

@@ -12,7 +12,7 @@ import (
 	"net/url"
 	"regexp"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 const (

internal/netxlite/certifi.go

@@ -1,16 +1,16 @@
 // Code generated by go generate; DO NOT EDIT.
-// 2021-07-02 14:26:19.300018 +0200 CEST m=+0.978891751
+// 2021-09-05 14:01:12.627844 +0200 CEST m=+0.441951210
 // https://curl.haxx.se/ca/cacert.pem
 
 package netxlite
 
-//go:generate go run ./generator/ "https://curl.haxx.se/ca/cacert.pem"
+//go:generate go run ./internal/generator/ "https://curl.haxx.se/ca/cacert.pem"
 
 const pemcerts string = `
 ##
 ## Bundle of CA Root Certificates
 ##
-## Certificate data from Mozilla as of: Tue May 25 03:12:05 2021 GMT
+## Certificate data from Mozilla as of: Mon Jul  5 21:35:54 2021 GMT
 ##
 ## This is a bundle of X.509 certificates of public Certificate Authorities
 ## (CA). These were automatically extracted from Mozilla's root certificates
@@ -23,7 +23,7 @@ const pemcerts string = `
 ## Just configure this file as the SSLCACertificateFile.
 ##
 ## Conversion done with mk-ca-bundle.pl version 1.28.
-## SHA256: e292bd4e2d500c86df45b830d89417be5c42ee670408f1d2c454c63d8a782865
+## SHA256: c8f6733d1ff4e6a4769c182971a1234f95ae079247a9c439a13423fe8ba5c24f
 ##
 
 
@@ -165,38 +165,6 @@ Rt0vxuBqw8M0Ayx9lt1awg6nCpnBBYurDC/zXDrPbDdVCYfeU0BsWO/8tqtlbgT2G9w84FoVxp7Z
 12yxow+ev+to51byrvLjKzg6CYG1a4XXvi3tPxq3smPi9WIsgtRqAEFQ8TmDn5XpNpaYbg==
 -----END CERTIFICATE-----
 
-QuoVadis Root CA
-================
------BEGIN CERTIFICATE-----
-MIIF0DCCBLigAwIBAgIEOrZQizANBgkqhkiG9w0BAQUFADB/MQswCQYDVQQGEwJCTTEZMBcGA1UE
-ChMQUXVvVmFkaXMgTGltaXRlZDElMCMGA1UECxMcUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0
-eTEuMCwGA1UEAxMlUXVvVmFkaXMgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw0wMTAz
-MTkxODMzMzNaFw0yMTAzMTcxODMzMzNaMH8xCzAJBgNVBAYTAkJNMRkwFwYDVQQKExBRdW9WYWRp
-cyBMaW1pdGVkMSUwIwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MS4wLAYDVQQD
-EyVRdW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5MIIBIjANBgkqhkiG9w0BAQEF
-AAOCAQ8AMIIBCgKCAQEAv2G1lVO6V/z68mcLOhrfEYBklbTRvM16z/Ypli4kVEAkOPcahdxYTMuk
-J0KX0J+DisPkBgNbAKVRHnAEdOLB1Dqr1607BxgFjv2DrOpm2RgbaIr1VxqYuvXtdj182d6UajtL
-F8HVj71lODqV0D1VNk7feVcxKh7YWWVJWCCYfqtffp/p1k3sg3Spx2zY7ilKhSoGFPlU5tPaZQeL
-YzcS19Dsw3sgQUSj7cugF+FxZc4dZjH3dgEZyH0DWLaVSR2mEiboxgx24ONmy+pdpibu5cxfvWen
-AScOospUxbF6lR1xHkopigPcakXBpBlebzbNw6Kwt/5cOOJSvPhEQ+aQuwIDAQABo4ICUjCCAk4w
-PQYIKwYBBQUHAQEEMTAvMC0GCCsGAQUFBzABhiFodHRwczovL29jc3AucXVvdmFkaXNvZmZzaG9y
-ZS5jb20wDwYDVR0TAQH/BAUwAwEB/zCCARoGA1UdIASCAREwggENMIIBCQYJKwYBBAG+WAABMIH7
-MIHUBggrBgEFBQcCAjCBxxqBxFJlbGlhbmNlIG9uIHRoZSBRdW9WYWRpcyBSb290IENlcnRpZmlj
-YXRlIGJ5IGFueSBwYXJ0eSBhc3N1bWVzIGFjY2VwdGFuY2Ugb2YgdGhlIHRoZW4gYXBwbGljYWJs
-ZSBzdGFuZGFyZCB0ZXJtcyBhbmQgY29uZGl0aW9ucyBvZiB1c2UsIGNlcnRpZmljYXRpb24gcHJh
-Y3RpY2VzLCBhbmQgdGhlIFF1b1ZhZGlzIENlcnRpZmljYXRlIFBvbGljeS4wIgYIKwYBBQUHAgEW
-Fmh0dHA6Ly93d3cucXVvdmFkaXMuYm0wHQYDVR0OBBYEFItLbe3TKbkGGew5Oanwl4Rqy+/fMIGu
-BgNVHSMEgaYwgaOAFItLbe3TKbkGGew5Oanwl4Rqy+/foYGEpIGBMH8xCzAJBgNVBAYTAkJNMRkw
-FwYDVQQKExBRdW9WYWRpcyBMaW1pdGVkMSUwIwYDVQQLExxSb290IENlcnRpZmljYXRpb24gQXV0
-aG9yaXR5MS4wLAYDVQQDEyVRdW9WYWRpcyBSb290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5ggQ6
-tlCLMA4GA1UdDwEB/wQEAwIBBjANBgkqhkiG9w0BAQUFAAOCAQEAitQUtf70mpKnGdSkfnIYj9lo
-fFIk3WdvOXrEql494liwTXCYhGHoG+NpGA7O+0dQoE7/8CQfvbLO9Sf87C9TqnN7Az10buYWnuul
-LsS/VidQK2K6vkscPFVcQR0kvoIgR13VRH56FmjffU1RcHhXHTMe/QKZnAzNCgVPx7uOpHX6Sm2x
-gI4JVrmcGmD+XcHXetwReNDWXcG31a0ymQM6isxUJTkxgXsTIlG6Rmyhu576BGxJJnSP0nPrzDCi
-5upZIof4l/UO/erMkqQWxFIY6iHOsfHmhIHluqmGKPJDWl0Snawe2ajlCmqnf6CHKc/yiU3U7MXi
-5nrQNiOKSnQ2+Q==
------END CERTIFICATE-----
-
 QuoVadis Root CA 2
 ==================
 -----BEGIN CERTIFICATE-----
@@ -284,26 +252,6 @@ s58+OmJYxUmtYg5xpTKqL8aJdkNAExNnPaJUJRDL8Try2frbSVa7pv6nQTXD4IhhyYjH3zYQIphZ
 FL39vmwLAw==
 -----END CERTIFICATE-----
 
-Sonera Class 2 Root CA
-======================
------BEGIN CERTIFICATE-----
-MIIDIDCCAgigAwIBAgIBHTANBgkqhkiG9w0BAQUFADA5MQswCQYDVQQGEwJGSTEPMA0GA1UEChMG
-U29uZXJhMRkwFwYDVQQDExBTb25lcmEgQ2xhc3MyIENBMB4XDTAxMDQwNjA3Mjk0MFoXDTIxMDQw
-NjA3Mjk0MFowOTELMAkGA1UEBhMCRkkxDzANBgNVBAoTBlNvbmVyYTEZMBcGA1UEAxMQU29uZXJh
-IENsYXNzMiBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJAXSjWdyvANlsdE+hY3
-/Ei9vX+ALTU74W+oZ6m/AxxNjG8yR9VBaKQTBME1DJqEQ/xcHf+Js+gXGM2RX/uJ4+q/Tl18GybT
-dXnt5oTjV+WtKcT0OijnpXuENmmz/V52vaMtmdOQTiMofRhj8VQ7Jp12W5dCsv+u8E7s3TmVToMG
-f+dJQMjFAbJUWmYdPfz56TwKnoG4cPABi+QjVHzIrviQHgCWctRUz2EjvOr7nQKV0ba5cTppCD8P
-tOFCx4j1P5iop7oc4HFx71hXgVB6XGt0Rg6DA5jDjqhu8nYybieDwnPz3BjotJPqdURrBGAgcVeH
-nfO+oJAjPYok4doh28MCAwEAAaMzMDEwDwYDVR0TAQH/BAUwAwEB/zARBgNVHQ4ECgQISqCqWITT
-XjwwCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBBQUAA4IBAQBazof5FnIVV0sd2ZvnoiYw7JNn39Yt
-0jSv9zilzqsWuasvfDXLrNAPtEwr/IDva4yRXzZ299uzGxnq9LIR/WFxRL8oszodv7ND6J+/3DEI
-cbCdjdY0RzKQxmUk96BKfARzjzlvF4xytb1LyHr4e4PDKE6cCepnP7JnBBvDFNr450kkkdAdavph
-Oe9r5yF1BgfYErQhIHBCcYHaPJo2vqZbDWpsmh+Re/n570K6Tk6ezAyNlNzZRZxe7EJQY670XcSx
-EtzKO6gunRRaBXW37Ndj4ro1tgQIkejanZz2ZrUYrAqmVCY0M9IbwdR/GjqOC6oybtv8TyWf2TLH
-llpwrN9M
------END CERTIFICATE-----
-
 XRamp Global CA Root
 ====================
 -----BEGIN CERTIFICATE-----
@@ -1203,27 +1151,6 @@ OR/qnuOf0GZvBeyqdn6/axag67XH/JJULysRJyU3eExRarDzzFhdFPFqSBX/wge2sY0PjlxQRrM9
 vwGYT7JZVEc+NHt4bVaTLnPqZih4zR0Uv6CPLy64Lo7yFIrM6bV8+2ydDKXhlg==
 -----END CERTIFICATE-----
 
-Trustis FPS Root CA
-===================
------BEGIN CERTIFICATE-----
-MIIDZzCCAk+gAwIBAgIQGx+ttiD5JNM2a/fH8YygWTANBgkqhkiG9w0BAQUFADBFMQswCQYDVQQG
-EwJHQjEYMBYGA1UEChMPVHJ1c3RpcyBMaW1pdGVkMRwwGgYDVQQLExNUcnVzdGlzIEZQUyBSb290
-IENBMB4XDTAzMTIyMzEyMTQwNloXDTI0MDEyMTExMzY1NFowRTELMAkGA1UEBhMCR0IxGDAWBgNV
-BAoTD1RydXN0aXMgTGltaXRlZDEcMBoGA1UECxMTVHJ1c3RpcyBGUFMgUm9vdCBDQTCCASIwDQYJ
-KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMVQe547NdDfxIzNjpvto8A2mfRC6qc+gIMPpqdZh8mQ
-RUN+AOqGeSoDvT03mYlmt+WKVoaTnGhLaASMk5MCPjDSNzoiYYkchU59j9WvezX2fihHiTHcDnlk
-H5nSW7r+f2C/revnPDgpai/lkQtV/+xvWNUtyd5MZnGPDNcE2gfmHhjjvSkCqPoc4Vu5g6hBSLwa
-cY3nYuUtsuvffM/bq1rKMfFMIvMFE/eC+XN5DL7XSxzA0RU8k0Fk0ea+IxciAIleH2ulrG6nS4zt
-o3Lmr2NNL4XSFDWaLk6M6jKYKIahkQlBOrTh4/L68MkKokHdqeMDx4gVOxzUGpTXn2RZEm0CAwEA
-AaNTMFEwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBS6+nEleYtXQSUhhgtx67JkDoshZzAd
-BgNVHQ4EFgQUuvpxJXmLV0ElIYYLceuyZA6LIWcwDQYJKoZIhvcNAQEFBQADggEBAH5Y//01GX2c
-GE+esCu8jowU/yyg2kdbw++BLa8F6nRIW/M+TgfHbcWzk88iNVy2P3UnXwmWzaD+vkAMXBJV+JOC
-yinpXj9WV4s4NvdFGkwozZ5BuO1WTISkQMi4sKUraXAEasP41BIy+Q7DsdwyhEQsb8tGD+pmQQ9P
-8Vilpg0ND2HepZ5dfWWhPBfnqFVO76DH7cZEf1T1o+CP8HxVIo8ptoGj4W1OLBuAZ+ytIJ8MYmHV
-l/9D7S3B2l0pKoU/rGXuhg8FjZBf3+6f9L/uHfuY5H+QK4R4EA5sSVPvFVtlRkpdr7r7OnIdzfYl
-iB6XzCGcKQENZetX2fNXlrtIzYE=
------END CERTIFICATE-----
-
 Buypass Class 2 Root CA
 =======================
 -----BEGIN CERTIFICATE-----
@@ -3146,4 +3073,113 @@ vLtoURMMA/cVi4RguYv/Uo7njLwcAjA8+RHUjE7AwWHCFUyqqx0LMV87HOIAl0Qx5v5zli/altP+
 CAezNIm8BZ/3Hobui3A=
 -----END CERTIFICATE-----
 
+GLOBALTRUST 2020
+================
+-----BEGIN CERTIFICATE-----
+MIIFgjCCA2qgAwIBAgILWku9WvtPilv6ZeUwDQYJKoZIhvcNAQELBQAwTTELMAkGA1UEBhMCQVQx
+IzAhBgNVBAoTGmUtY29tbWVyY2UgbW9uaXRvcmluZyBHbWJIMRkwFwYDVQQDExBHTE9CQUxUUlVT
+VCAyMDIwMB4XDTIwMDIxMDAwMDAwMFoXDTQwMDYxMDAwMDAwMFowTTELMAkGA1UEBhMCQVQxIzAh
+BgNVBAoTGmUtY29tbWVyY2UgbW9uaXRvcmluZyBHbWJIMRkwFwYDVQQDExBHTE9CQUxUUlVTVCAy
+MDIwMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAri5WrRsc7/aVj6B3GyvTY4+ETUWi
+D59bRatZe1E0+eyLinjF3WuvvcTfk0Uev5E4C64OFudBc/jbu9G4UeDLgztzOG53ig9ZYybNpyrO
+VPu44sB8R85gfD+yc/LAGbaKkoc1DZAoouQVBGM+uq/ufF7MpotQsjj3QWPKzv9pj2gOlTblzLmM
+CcpL3TGQlsjMH/1WljTbjhzqLL6FLmPdqqmV0/0plRPwyJiT2S0WR5ARg6I6IqIoV6Lr/sCMKKCm
+fecqQjuCgGOlYx8ZzHyyZqjC0203b+J+BlHZRYQfEs4kUmSFC0iAToexIiIwquuuvuAC4EDosEKA
+A1GqtH6qRNdDYfOiaxaJSaSjpCuKAsR49GiKweR6NrFvG5Ybd0mN1MkGco/PU+PcF4UgStyYJ9OR
+JitHHmkHr96i5OTUawuzXnzUJIBHKWk7buis/UDr2O1xcSvy6Fgd60GXIsUf1DnQJ4+H4xj04KlG
+DfV0OoIu0G4skaMxXDtG6nsEEFZegB31pWXogvziB4xiRfUg3kZwhqG8k9MedKZssCz3AwyIDMvU
+clOGvGBG85hqwvG/Q/lwIHfKN0F5VVJjjVsSn8VoxIidrPIwq7ejMZdnrY8XD2zHc+0klGvIg5rQ
+mjdJBKuxFshsSUktq6HQjJLyQUp5ISXbY9e2nKd+Qmn7OmMCAwEAAaNjMGEwDwYDVR0TAQH/BAUw
+AwEB/zAOBgNVHQ8BAf8EBAMCAQYwHQYDVR0OBBYEFNwuH9FhN3nkq9XVsxJxaD1qaJwiMB8GA1Ud
+IwQYMBaAFNwuH9FhN3nkq9XVsxJxaD1qaJwiMA0GCSqGSIb3DQEBCwUAA4ICAQCR8EICaEDuw2jA
+VC/f7GLDw56KoDEoqoOOpFaWEhCGVrqXctJUMHytGdUdaG/7FELYjQ7ztdGl4wJCXtzoRlgHNQIw
+4Lx0SsFDKv/bGtCwr2zD/cuz9X9tAy5ZVp0tLTWMstZDFyySCstd6IwPS3BD0IL/qMy/pJTAvoe9
+iuOTe8aPmxadJ2W8esVCgmxcB9CpwYhgROmYhRZf+I/KARDOJcP5YBugxZfD0yyIMaK9MOzQ0MAS
+8cE54+X1+NZK3TTN+2/BT+MAi1bikvcoskJ3ciNnxz8RFbLEAwW+uxF7Cr+obuf/WEPPm2eggAe2
+HcqtbepBEX4tdJP7wry+UUTF72glJ4DjyKDUEuzZpTcdN3y0kcra1LGWge9oXHYQSa9+pTeAsRxS
+vTOBTI/53WXZFM2KJVj04sWDpQmQ1GwUY7VA3+vA/MRYfg0UFodUJ25W5HCEuGwyEn6CMUO+1918
+oa2u1qsgEu8KwxCMSZY13At1XrFP1U80DhEgB3VDRemjEdqso5nCtnkn4rnvyOL2NSl6dPrFf4IF
+YqYK6miyeUcGbvJXqBUzxvd4Sj1Ce2t+/vdG6tHrju+IaFvowdlxfv1k7/9nR4hYJS8+hge9+6jl
+gqispdNpQ80xiEmEU5LAsTkbOYMBMMTyqfrQA71yN2BWHzZ8vTmR9W0Nv3vXkg==
+-----END CERTIFICATE-----
+
+ANF Secure Server Root CA
+=========================
+-----BEGIN CERTIFICATE-----
+MIIF7zCCA9egAwIBAgIIDdPjvGz5a7EwDQYJKoZIhvcNAQELBQAwgYQxEjAQBgNVBAUTCUc2MzI4
+NzUxMDELMAkGA1UEBhMCRVMxJzAlBgNVBAoTHkFORiBBdXRvcmlkYWQgZGUgQ2VydGlmaWNhY2lv
+bjEUMBIGA1UECxMLQU5GIENBIFJhaXoxIjAgBgNVBAMTGUFORiBTZWN1cmUgU2VydmVyIFJvb3Qg
+Q0EwHhcNMTkwOTA0MTAwMDM4WhcNMzkwODMwMTAwMDM4WjCBhDESMBAGA1UEBRMJRzYzMjg3NTEw
+MQswCQYDVQQGEwJFUzEnMCUGA1UEChMeQU5GIEF1dG9yaWRhZCBkZSBDZXJ0aWZpY2FjaW9uMRQw
+EgYDVQQLEwtBTkYgQ0EgUmFpejEiMCAGA1UEAxMZQU5GIFNlY3VyZSBTZXJ2ZXIgUm9vdCBDQTCC
+AiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANvrayvmZFSVgpCjcqQZAZ2cC4Ffc0m6p6zz
+BE57lgvsEeBbphzOG9INgxwruJ4dfkUyYA8H6XdYfp9qyGFOtibBTI3/TO80sh9l2Ll49a2pcbnv
+T1gdpd50IJeh7WhM3pIXS7yr/2WanvtH2Vdy8wmhrnZEE26cLUQ5vPnHO6RYPUG9tMJJo8gN0pcv
+B2VSAKduyK9o7PQUlrZXH1bDOZ8rbeTzPvY1ZNoMHKGESy9LS+IsJJ1tk0DrtSOOMspvRdOoiXse
+zx76W0OLzc2oD2rKDF65nkeP8Nm2CgtYZRczuSPkdxl9y0oukntPLxB3sY0vaJxizOBQ+OyRp1RM
+VwnVdmPF6GUe7m1qzwmd+nxPrWAI/VaZDxUse6mAq4xhj0oHdkLePfTdsiQzW7i1o0TJrH93PB0j
+7IKppuLIBkwC/qxcmZkLLxCKpvR/1Yd0DVlJRfbwcVw5Kda/SiOL9V8BY9KHcyi1Swr1+KuCLH5z
+JTIdC2MKF4EA/7Z2Xue0sUDKIbvVgFHlSFJnLNJhiQcND85Cd8BEc5xEUKDbEAotlRyBr+Qc5RQe
+8TZBAQIvfXOn3kLMTOmJDVb3n5HUA8ZsyY/b2BzgQJhdZpmYgG4t/wHFzstGH6wCxkPmrqKEPMVO
+Hj1tyRRM4y5Bu8o5vzY8KhmqQYdOpc5LMnndkEl/AgMBAAGjYzBhMB8GA1UdIwQYMBaAFJxf0Gxj
+o1+TypOYCK2Mh6UsXME3MB0GA1UdDgQWBBScX9BsY6Nfk8qTmAitjIelLFzBNzAOBgNVHQ8BAf8E
+BAMCAYYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEATh65isagmD9uw2nAalxJ
+UqzLK114OMHVVISfk/CHGT0sZonrDUL8zPB1hT+L9IBdeeUXZ701guLyPI59WzbLWoAAKfLOKyzx
+j6ptBZNscsdW699QIyjlRRA96Gejrw5VD5AJYu9LWaL2U/HANeQvwSS9eS9OICI7/RogsKQOLHDt
+dD+4E5UGUcjohybKpFtqFiGS3XNgnhAY3jyB6ugYw3yJ8otQPr0R4hUDqDZ9MwFsSBXXiJCZBMXM
+5gf0vPSQ7RPi6ovDj6MzD8EpTBNO2hVWcXNyglD2mjN8orGoGjR0ZVzO0eurU+AagNjqOknkJjCb
+5RyKqKkVMoaZkgoQI1YS4PbOTOK7vtuNknMBZi9iPrJyJ0U27U1W45eZ/zo1PqVUSlJZS2Db7v54
+EX9K3BR5YLZrZAPbFYPhor72I5dQ8AkzNqdxliXzuUJ92zg/LFis6ELhDtjTO0wugumDLmsx2d1H
+hk9tl5EuT+IocTUW0fJz/iUrB0ckYyfI+PbZa/wSMVYIwFNCr5zQM378BvAxRAMU8Vjq8moNqRGy
+g77FGr8H6lnco4g175x2MjxNBiLOFeXdntiP2t7SxDnlF4HPOEfrf4htWRvfn0IUrn7PqLBmZdo3
+r5+qPeoott7VMVgWglvquxl1AnMaykgaIZOQCo6ThKd9OyMYkomgjaw=
+-----END CERTIFICATE-----
+
+Certum EC-384 CA
+================
+-----BEGIN CERTIFICATE-----
+MIICZTCCAeugAwIBAgIQeI8nXIESUiClBNAt3bpz9DAKBggqhkjOPQQDAzB0MQswCQYDVQQGEwJQ
+TDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2Vy
+dGlmaWNhdGlvbiBBdXRob3JpdHkxGTAXBgNVBAMTEENlcnR1bSBFQy0zODQgQ0EwHhcNMTgwMzI2
+MDcyNDU0WhcNNDMwMzI2MDcyNDU0WjB0MQswCQYDVQQGEwJQTDEhMB8GA1UEChMYQXNzZWNvIERh
+dGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkx
+GTAXBgNVBAMTEENlcnR1bSBFQy0zODQgQ0EwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATEKI6rGFtq
+vm5kN2PkzeyrOvfMobgOgknXhimfoZTy42B4mIF4Bk3y7JoOV2CDn7TmFy8as10CW4kjPMIRBSqn
+iBMY81CE1700LCeJVf/OTOffph8oxPBUw7l8t1Ot68KjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD
+VR0OBBYEFI0GZnQkdjrzife81r1HfS+8EF9LMA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAwNo
+ADBlAjADVS2m5hjEfO/JUG7BJw+ch69u1RsIGL2SKcHvlJF40jocVYli5RsJHrpka/F2tNQCMQC0
+QoSZ/6vnnvuRlydd3LBbMHHOXjgaatkl5+r3YZJW+OraNsKHZZYuciUvf9/DE8k=
+-----END CERTIFICATE-----
+
+Certum Trusted Root CA
+======================
+-----BEGIN CERTIFICATE-----
+MIIFwDCCA6igAwIBAgIQHr9ZULjJgDdMBvfrVU+17TANBgkqhkiG9w0BAQ0FADB6MQswCQYDVQQG
+EwJQTDEhMB8GA1UEChMYQXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0g
+Q2VydGlmaWNhdGlvbiBBdXRob3JpdHkxHzAdBgNVBAMTFkNlcnR1bSBUcnVzdGVkIFJvb3QgQ0Ew
+HhcNMTgwMzE2MTIxMDEzWhcNNDMwMzE2MTIxMDEzWjB6MQswCQYDVQQGEwJQTDEhMB8GA1UEChMY
+QXNzZWNvIERhdGEgU3lzdGVtcyBTLkEuMScwJQYDVQQLEx5DZXJ0dW0gQ2VydGlmaWNhdGlvbiBB
+dXRob3JpdHkxHzAdBgNVBAMTFkNlcnR1bSBUcnVzdGVkIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEB
+AQUAA4ICDwAwggIKAoICAQDRLY67tzbqbTeRn06TpwXkKQMlzhyC93yZn0EGze2jusDbCSzBfN8p
+fktlL5On1AFrAygYo9idBcEq2EXxkd7fO9CAAozPOA/qp1x4EaTByIVcJdPTsuclzxFUl6s1wB52
+HO8AU5853BSlLCIls3Jy/I2z5T4IHhQqNwuIPMqw9MjCoa68wb4pZ1Xi/K1ZXP69VyywkI3C7Te2
+fJmItdUDmj0VDT06qKhF8JVOJVkdzZhpu9PMMsmN74H+rX2Ju7pgE8pllWeg8xn2A1bUatMn4qGt
+g/BKEiJ3HAVz4hlxQsDsdUaakFjgao4rpUYwBI4Zshfjvqm6f1bxJAPXsiEodg42MEx51UGamqi4
+NboMOvJEGyCI98Ul1z3G4z5D3Yf+xOr1Uz5MZf87Sst4WmsXXw3Hw09Omiqi7VdNIuJGmj8PkTQk
+fVXjjJU30xrwCSss0smNtA0Aq2cpKNgB9RkEth2+dv5yXMSFytKAQd8FqKPVhJBPC/PgP5sZ0jeJ
+P/J7UhyM9uH3PAeXjA6iWYEMspA90+NZRu0PqafegGtaqge2Gcu8V/OXIXoMsSt0Puvap2ctTMSY
+njYJdmZm/Bo/6khUHL4wvYBQv3y1zgD2DGHZ5yQD4OMBgQ692IU0iL2yNqh7XAjlRICMb/gv1SHK
+HRzQ+8S1h9E6Tsd2tTVItQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSM+xx1
+vALTn04uSNn5YFSqxLNP+jAOBgNVHQ8BAf8EBAMCAQYwDQYJKoZIhvcNAQENBQADggIBAEii1QAL
+LtA/vBzVtVRJHlpr9OTy4EA34MwUe7nJ+jW1dReTagVphZzNTxl4WxmB82M+w85bj/UvXgF2Ez8s
+ALnNllI5SW0ETsXpD4YN4fqzX4IS8TrOZgYkNCvozMrnadyHncI013nR03e4qllY/p0m+jiGPp2K
+h2RX5Rc64vmNueMzeMGQ2Ljdt4NR5MTMI9UGfOZR0800McD2RrsLrfw9EAUqO0qRJe6M1ISHgCq8
+CYyqOhNf6DR5UMEQGfnTKB7U0VEwKbOukGfWHwpjscWpxkIxYxeU72nLL/qMFH3EQxiJ2fAyQOaA
+4kZf5ePBAFmo+eggvIksDkc0C+pXwlM2/KfUrzHN/gLldfq5Jwn58/U7yn2fqSLLiMmq0Uc9Nneo
+WWRrJ8/vJ8HjJLWG965+Mk2weWjROeiQWMODvA8s1pfrzgzhIMfatz7DP78v3DSk+yshzWePS/Tj
+6tQ/50+6uaWTRRxmHyH6ZF5v4HaUMst19W7l9o/HuKTMqJZ9ZPskWkoDbGs4xugDQ5r3V7mzKWmT
+OPQD8rv7gmsHINFSH5pkAnuYZttcTVoP0ISVoDwUQwbKytu4QTbaakRnh6+v40URFWkIsr4WOZck
+bxJF0WddCajJFdr60qZfE2Efv4WstK2tBZQIgx51F9NxO5NQI1mg7TyRVJ12AMXDuDjb
+-----END CERTIFICATE-----
+
 `

internal/netxlite/dialer.go

@@ -12,17 +12,17 @@ type Dialer interface {
 	DialContext(ctx context.Context, network, address string) (net.Conn, error)
 }
 
-// DefaultDialer is the Dialer we use by default.
+// defaultDialer is the Dialer we use by default.
-var DefaultDialer = &net.Dialer{
+var defaultDialer = &net.Dialer{
 	Timeout:   15 * time.Second,
 	KeepAlive: 15 * time.Second,
 }
 
-var _ Dialer = DefaultDialer
+var _ Dialer = defaultDialer
 
-// DialerResolver is a dialer that uses the configured Resolver to resolver a
+// dialerResolver is a dialer that uses the configured Resolver to resolver a
 // domain name to IP addresses, and the configured Dialer to connect.
-type DialerResolver struct {
+type dialerResolver struct {
 	// Dialer is the underlying Dialer.
 	Dialer Dialer
 
@@ -30,10 +30,10 @@ type DialerResolver struct {
 	Resolver Resolver
 }
 
-var _ Dialer = &DialerResolver{}
+var _ Dialer = &dialerResolver{}
 
 // DialContext implements Dialer.DialContext.
-func (d *DialerResolver) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+func (d *dialerResolver) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
 	onlyhost, onlyport, err := net.SplitHostPort(address)
 	if err != nil {
 		return nil, err
@@ -59,15 +59,15 @@ func (d *DialerResolver) DialContext(ctx context.Context, network, address strin
 }
 
 // lookupHost performs a domain name resolution.
-func (d *DialerResolver) lookupHost(ctx context.Context, hostname string) ([]string, error) {
+func (d *dialerResolver) lookupHost(ctx context.Context, hostname string) ([]string, error) {
 	if net.ParseIP(hostname) != nil {
 		return []string{hostname}, nil
 	}
 	return d.Resolver.LookupHost(ctx, hostname)
 }
 
-// DialerLogger is a Dialer with logging.
+// dialerLogger is a Dialer with logging.
-type DialerLogger struct {
+type dialerLogger struct {
 	// Dialer is the underlying dialer.
 	Dialer Dialer
 
@@ -75,10 +75,10 @@ type DialerLogger struct {
 	Logger Logger
 }
 
-var _ Dialer = &DialerLogger{}
+var _ Dialer = &dialerLogger{}
 
 // DialContext implements Dialer.DialContext
-func (d *DialerLogger) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
+func (d *dialerLogger) DialContext(ctx context.Context, network, address string) (net.Conn, error) {
 	d.Logger.Debugf("dial %s/%s...", address, network)
 	start := time.Now()
 	conn, err := d.Dialer.DialContext(ctx, network, address)

internal/netxlite/dialer_test.go

@@ -10,11 +10,11 @@ import (
 	"time"
 
 	"github.com/apex/log"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestDialerResolverNoPort(t *testing.T) {
-	dialer := &DialerResolver{Dialer: &net.Dialer{}, Resolver: DefaultResolver}
+	dialer := &dialerResolver{Dialer: &net.Dialer{}, Resolver: DefaultResolver}
 	conn, err := dialer.DialContext(context.Background(), "tcp", "ooni.nu")
 	if err == nil || !strings.HasSuffix(err.Error(), "missing port in address") {
 		t.Fatal("not the error we expected", err)
@@ -25,7 +25,7 @@ func TestDialerResolverNoPort(t *testing.T) {
 }
 
 func TestDialerResolverLookupHostAddress(t *testing.T) {
-	dialer := &DialerResolver{Dialer: new(net.Dialer), Resolver: &netxmocks.Resolver{
+	dialer := &dialerResolver{Dialer: new(net.Dialer), Resolver: &mocks.Resolver{
 		MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 			return nil, errors.New("we should not call this function")
 		},
@@ -41,7 +41,7 @@ func TestDialerResolverLookupHostAddress(t *testing.T) {
 
 func TestDialerResolverLookupHostFailure(t *testing.T) {
 	expected := errors.New("mocked error")
-	dialer := &DialerResolver{Dialer: new(net.Dialer), Resolver: &netxmocks.Resolver{
+	dialer := &dialerResolver{Dialer: new(net.Dialer), Resolver: &mocks.Resolver{
 		MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 			return nil, expected
 		},
@@ -57,7 +57,7 @@ func TestDialerResolverLookupHostFailure(t *testing.T) {
 }
 
 func TestDialerResolverDialForSingleIPFails(t *testing.T) {
-	dialer := &DialerResolver{Dialer: &netxmocks.Dialer{
+	dialer := &dialerResolver{Dialer: &mocks.Dialer{
 		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 			return nil, io.EOF
 		},
@@ -72,12 +72,12 @@ func TestDialerResolverDialForSingleIPFails(t *testing.T) {
 }
 
 func TestDialerResolverDialForManyIPFails(t *testing.T) {
-	dialer := &DialerResolver{
+	dialer := &dialerResolver{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 				return nil, io.EOF
 			},
-		}, Resolver: &netxmocks.Resolver{
+		}, Resolver: &mocks.Resolver{
 			MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 				return []string{"1.1.1.1", "8.8.8.8"}, nil
 			},
@@ -92,15 +92,15 @@ func TestDialerResolverDialForManyIPFails(t *testing.T) {
 }
 
 func TestDialerResolverDialForManyIPSuccess(t *testing.T) {
-	dialer := &DialerResolver{Dialer: &netxmocks.Dialer{
+	dialer := &dialerResolver{Dialer: &mocks.Dialer{
 		MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
-			return &netxmocks.Conn{
+			return &mocks.Conn{
 				MockClose: func() error {
 					return nil
 				},
 			}, nil
 		},
-	}, Resolver: &netxmocks.Resolver{
+	}, Resolver: &mocks.Resolver{
 		MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 			return []string{"1.1.1.1", "8.8.8.8"}, nil
 		},
@@ -116,10 +116,10 @@ func TestDialerResolverDialForManyIPSuccess(t *testing.T) {
 }
 
 func TestDialerLoggerSuccess(t *testing.T) {
-	d := &DialerLogger{
+	d := &dialerLogger{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
-				return &netxmocks.Conn{
+				return &mocks.Conn{
 					MockClose: func() error {
 						return nil
 					},
@@ -139,8 +139,8 @@ func TestDialerLoggerSuccess(t *testing.T) {
 }
 
 func TestDialerLoggerFailure(t *testing.T) {
-	d := &DialerLogger{
+	d := &dialerLogger{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
 				return nil, io.EOF
 			},
@@ -158,7 +158,7 @@ func TestDialerLoggerFailure(t *testing.T) {
 
 func TestDefaultDialerHasTimeout(t *testing.T) {
 	expected := 15 * time.Second
-	if DefaultDialer.Timeout != expected {
+	if defaultDialer.Timeout != expected {
 		t.Fatal("unexpected timeout value")
 	}
 }

internal/netxlite/http.go

@@ -17,8 +17,8 @@ type HTTPTransport interface {
 	CloseIdleConnections()
 }
 
-// HTTPTransportLogger is an HTTPTransport with logging.
+// httpTransportLogger is an HTTPTransport with logging.
-type HTTPTransportLogger struct {
+type httpTransportLogger struct {
 	// HTTPTransport is the underlying HTTP transport.
 	HTTPTransport HTTPTransport
 
@@ -26,10 +26,10 @@ type HTTPTransportLogger struct {
 	Logger Logger
 }
 
-var _ HTTPTransport = &HTTPTransportLogger{}
+var _ HTTPTransport = &httpTransportLogger{}
 
 // RoundTrip implements HTTPTransport.RoundTrip.
-func (txp *HTTPTransportLogger) RoundTrip(req *http.Request) (*http.Response, error) {
+func (txp *httpTransportLogger) RoundTrip(req *http.Request) (*http.Response, error) {
 	host := req.Host
 	if host == "" {
 		host = req.URL.Host
@@ -39,7 +39,7 @@ func (txp *HTTPTransportLogger) RoundTrip(req *http.Request) (*http.Response, er
 }
 
 // logTrip is an HTTP round trip with logging.
-func (txp *HTTPTransportLogger) logTrip(req *http.Request) (*http.Response, error) {
+func (txp *httpTransportLogger) logTrip(req *http.Request) (*http.Response, error) {
 	txp.Logger.Debugf("> %s %s", req.Method, req.URL.String())
 	for key, values := range req.Header {
 		for _, value := range values {
@@ -63,7 +63,7 @@ func (txp *HTTPTransportLogger) logTrip(req *http.Request) (*http.Response, erro
 }
 
 // CloseIdleConnections implement HTTPTransport.CloseIdleConnections.
-func (txp *HTTPTransportLogger) CloseIdleConnections() {
+func (txp *httpTransportLogger) CloseIdleConnections() {
 	txp.HTTPTransport.CloseIdleConnections()
 }
 

internal/netxlite/http3_test.go

@@ -8,9 +8,9 @@ import (
 )
 
 func TestHTTP3TransportWorks(t *testing.T) {
-	d := &QUICDialerResolver{
+	d := &quicDialerResolver{
-		Dialer: &QUICDialerQUICGo{
+		Dialer: &quicDialerQUICGo{
-			QUICListener: &QUICListenerStdlib{},
+			QUICListener: &quicListenerStdlib{},
 		},
 		Resolver: &net.Resolver{},
 	}

internal/netxlite/http_test.go

@@ -13,14 +13,14 @@ import (
 
 	"github.com/apex/log"
 	"github.com/ooni/probe-cli/v3/internal/atomicx"
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestHTTPTransportLoggerFailure(t *testing.T) {
-	txp := &HTTPTransportLogger{
+	txp := &httpTransportLogger{
 		Logger: log.Log,
-		HTTPTransport: &netxmocks.HTTPTransport{
+		HTTPTransport: &mocks.HTTPTransport{
 			MockRoundTrip: func(req *http.Request) (*http.Response, error) {
 				return nil, io.EOF
 			},
@@ -38,9 +38,9 @@ func TestHTTPTransportLoggerFailure(t *testing.T) {
 
 func TestHTTPTransportLoggerFailureWithNoHostHeader(t *testing.T) {
 	foundHost := &atomicx.Int64{}
-	txp := &HTTPTransportLogger{
+	txp := &httpTransportLogger{
 		Logger: log.Log,
-		HTTPTransport: &netxmocks.HTTPTransport{
+		HTTPTransport: &mocks.HTTPTransport{
 			MockRoundTrip: func(req *http.Request) (*http.Response, error) {
 				if req.Header.Get("Host") == "www.google.com" {
 					foundHost.Add(1)
@@ -70,9 +70,9 @@ func TestHTTPTransportLoggerFailureWithNoHostHeader(t *testing.T) {
 }
 
 func TestHTTPTransportLoggerSuccess(t *testing.T) {
-	txp := &HTTPTransportLogger{
+	txp := &httpTransportLogger{
 		Logger: log.Log,
-		HTTPTransport: &netxmocks.HTTPTransport{
+		HTTPTransport: &mocks.HTTPTransport{
 			MockRoundTrip: func(req *http.Request) (*http.Response, error) {
 				return &http.Response{
 					Body: io.NopCloser(strings.NewReader("")),
@@ -95,8 +95,8 @@ func TestHTTPTransportLoggerSuccess(t *testing.T) {
 
 func TestHTTPTransportLoggerCloseIdleConnections(t *testing.T) {
 	calls := &atomicx.Int64{}
-	txp := &HTTPTransportLogger{
+	txp := &httpTransportLogger{
-		HTTPTransport: &netxmocks.HTTPTransport{
+		HTTPTransport: &mocks.HTTPTransport{
 			MockCloseIdleConnections: func() {
 				calls.Add(1)
 			},
@@ -110,11 +110,11 @@ func TestHTTPTransportLoggerCloseIdleConnections(t *testing.T) {
 }
 
 func TestHTTPTransportWorks(t *testing.T) {
-	d := &DialerResolver{
+	d := &dialerResolver{
-		Dialer:   DefaultDialer,
+		Dialer:   defaultDialer,
 		Resolver: &net.Resolver{},
 	}
-	th := &TLSHandshakerConfigurable{}
+	th := &tlsHandshakerConfigurable{}
 	txp := NewHTTPTransport(d, &tls.Config{}, th)
 	client := &http.Client{Transport: txp}
 	resp, err := client.Get("https://www.google.com/robots.txt")
@@ -127,8 +127,8 @@ func TestHTTPTransportWorks(t *testing.T) {
 
 func TestHTTPTransportWithFailingDialer(t *testing.T) {
 	expected := errors.New("mocked error")
-	d := &DialerResolver{
+	d := &dialerResolver{
-		Dialer: &netxmocks.Dialer{
+		Dialer: &mocks.Dialer{
 			MockDialContext: func(ctx context.Context,
 				network, address string) (net.Conn, error) {
 				return nil, expected
@@ -136,7 +136,7 @@ func TestHTTPTransportWithFailingDialer(t *testing.T) {
 		},
 		Resolver: &net.Resolver{},
 	}
-	th := &TLSHandshakerConfigurable{}
+	th := &tlsHandshakerConfigurable{}
 	txp := NewHTTPTransport(d, &tls.Config{}, th)
 	client := &http.Client{Transport: txp}
 	resp, err := client.Get("https://www.google.com/robots.txt")

internal/netxlite/internal/generator/main.go

@@ -19,7 +19,7 @@ import (
 	"text/template"
 	"time"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 var tmpl = template.Must(template.New("").Parse(`// Code generated by go generate; DO NOT EDIT.
@@ -28,7 +28,7 @@ var tmpl = template.Must(template.New("").Parse(`// Code generated by go generat
 
 package netxlite
 
-//{{ .GoGenerate }} go run ./generator/ "{{ .URL }}"
+//{{ .GoGenerate }} go run ./internal/generator/ "{{ .URL }}"
 
 const pemcerts string = ` + "`" + `
 {{ .Bundle }}

internal/netxlite/iox/example_test.go

@@ -6,7 +6,7 @@ import (
 	"log"
 	"strings"
 
-	"github.com/ooni/probe-cli/v3/internal/iox"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/iox"
 )
 
 func ExampleReadAllContext() {

internal/netxlite/iox/iox.go

@@ -33,19 +33,6 @@ func ReadAllContext(ctx context.Context, r io.Reader) ([]byte, error) {
 	}
 }
 
-// MockableReader allows to mock any io.Reader.
-type MockableReader struct {
-	MockRead func(b []byte) (int, error)
-}
-
-// MockableReader implements an io.Reader.
-var _ io.Reader = &MockableReader{}
-
-// Read implements io.Reader.Read.
-func (r *MockableReader) Read(b []byte) (int, error) {
-	return r.MockRead(b)
-}
-
 // CopyContext is like io.Copy but may terminate earlier
 // when the context expires. This function has the same
 // caveats of ReadAllContext regarding the temporary leaking

internal/netxlite/iox/iox_test.go

@@ -7,6 +7,8 @@ import (
 	"strings"
 	"testing"
 	"time"
+
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
 )
 
 func TestReadAllContextCommonCase(t *testing.T) {
@@ -23,7 +25,7 @@ func TestReadAllContextCommonCase(t *testing.T) {
 
 func TestReadAllContextWithError(t *testing.T) {
 	expected := errors.New("mocked error")
-	r := &MockableReader{
+	r := &mocks.Reader{
 		MockRead: func(b []byte) (int, error) {
 			return 0, expected
 		},
@@ -53,7 +55,7 @@ func TestReadAllContextWithCancelledContext(t *testing.T) {
 
 func TestReadAllContextWithErrorAndCancelledContext(t *testing.T) {
 	expected := errors.New("mocked error")
-	r := &MockableReader{
+	r := &mocks.Reader{
 		MockRead: func(b []byte) (int, error) {
 			time.Sleep(time.Millisecond)
 			return 0, expected
@@ -84,7 +86,7 @@ func TestCopyContextCommonCase(t *testing.T) {
 
 func TestCopyContextWithError(t *testing.T) {
 	expected := errors.New("mocked error")
-	r := &MockableReader{
+	r := &mocks.Reader{
 		MockRead: func(b []byte) (int, error) {
 			return 0, expected
 		},
@@ -114,7 +116,7 @@ func TestCopyContextWithCancelledContext(t *testing.T) {
 
 func TestCopyContextWithErrorAndCancelledContext(t *testing.T) {
 	expected := errors.New("mocked error")
-	r := &MockableReader{
+	r := &mocks.Reader{
 		MockRead: func(b []byte) (int, error) {
 			time.Sleep(time.Millisecond)
 			return 0, expected

internal/netxlite/legacy.go

@@ -37,3 +37,25 @@ func reduceErrors(errorslist []error) error {
 	// TODO(bassosimone): handle this case in a better way
 	return errorslist[0]
 }
+
+// These vars export internal names to legacy ooni/probe-cli code.
+var (
+	DefaultDialer        = defaultDialer
+	DefaultTLSHandshaker = defaultTLSHandshaker
+)
+
+// These types export internal names to legacy ooni/probe-cli code.
+type (
+	DialerResolver            = dialerResolver
+	DialerLogger              = dialerLogger
+	HTTPTransportLogger       = httpTransportLogger
+	QUICListenerStdlib        = quicListenerStdlib
+	QUICDialerQUICGo          = quicDialerQUICGo
+	QUICDialerResolver        = quicDialerResolver
+	QUICDialerLogger          = quicDialerLogger
+	ResolverSystem            = resolverSystem
+	ResolverLogger            = resolverLogger
+	ResolverIDNA              = resolverIDNA
+	TLSHandshakerConfigurable = tlsHandshakerConfigurable
+	TLSHandshakerLogger       = tlsHandshakerLogger
+)

internal/netxlite/mocks/conn.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"net"

internal/netxlite/mocks/conn_test.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"errors"

internal/netxlite/mocks/dialer.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"context"

internal/netxlite/mocks/dialer_test.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"context"

internal/netxlite/mocks/doc.go

@@ -0,0 +1,2 @@
+// Package mocks contains mocks for netx types.
+package mocks

internal/netxlite/mocks/http.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import "net/http"
 

internal/netxlite/mocks/http_test.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"errors"

internal/netxlite/mocks/quic.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"context"
@@ -8,7 +8,7 @@ import (
 	"time"
 
 	"github.com/lucas-clemente/quic-go"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 // QUICListener is a mockable netxlite.QUICListener.

internal/netxlite/mocks/quic_test.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"context"
@@ -12,7 +12,7 @@ import (
 
 	"github.com/google/go-cmp/cmp"
 	"github.com/lucas-clemente/quic-go"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 func TestQUICListenerListen(t *testing.T) {

internal/netxlite/mocks/reader.go

@@ -0,0 +1,16 @@
+package mocks
+
+import "io"
+
+// Reader allows to mock any io.Reader.
+type Reader struct {
+	MockRead func(b []byte) (int, error)
+}
+
+// MockableReader implements an io.Reader.
+var _ io.Reader = &Reader{}
+
+// Read implements io.Reader.Read.
+func (r *Reader) Read(b []byte) (int, error) {
+	return r.MockRead(b)
+}

internal/netxlite/mocks/reader_test.go

@@ -0,0 +1,23 @@
+package mocks
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestReaderRead(t *testing.T) {
+	expected := errors.New("mocked error")
+	r := &Reader{
+		MockRead: func(b []byte) (int, error) {
+			return 0, expected
+		},
+	}
+	b := make([]byte, 128)
+	count, err := r.Read(b)
+	if !errors.Is(err, expected) {
+		t.Fatal("unexpected error", err)
+	}
+	if count != 0 {
+		t.Fatal("unexpected count", count)
+	}
+}

internal/netxlite/mocks/resolver.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import "context"
 

internal/netxlite/mocks/resolver_test.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"context"

internal/netxlite/mocks/tlsconn.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import "crypto/tls"
 

internal/netxlite/mocks/tlsconn_test.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"crypto/tls"

internal/netxlite/mocks/tlshandshaker.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"context"

internal/netxlite/mocks/tlshandshaker_test.go

@@ -1,4 +1,4 @@
-package netxmocks
+package mocks
 
 import (
 	"context"

internal/netxlite/quic.go

@@ -8,7 +8,7 @@ import (
 	"strconv"
 
 	"github.com/lucas-clemente/quic-go"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 // QUICContextDialer is a dialer for QUIC using Context.
@@ -26,18 +26,18 @@ type QUICListener interface {
 	Listen(addr *net.UDPAddr) (quicx.UDPLikeConn, error)
 }
 
-// QUICListenerStdlib is a QUICListener using the standard library.
+// quicListenerStdlib is a QUICListener using the standard library.
-type QUICListenerStdlib struct{}
+type quicListenerStdlib struct{}
 
-var _ QUICListener = &QUICListenerStdlib{}
+var _ QUICListener = &quicListenerStdlib{}
 
 // Listen implements QUICListener.Listen.
-func (qls *QUICListenerStdlib) Listen(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
+func (qls *quicListenerStdlib) Listen(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
 	return net.ListenUDP("udp", addr)
 }
 
-// QUICDialerQUICGo dials using the lucas-clemente/quic-go library.
+// quicDialerQUICGo dials using the lucas-clemente/quic-go library.
-type QUICDialerQUICGo struct {
+type quicDialerQUICGo struct {
 	// QUICListener is the underlying QUICListener to use.
 	QUICListener QUICListener
 
@@ -47,7 +47,7 @@ type QUICDialerQUICGo struct {
 		quicConfig *quic.Config) (quic.EarlySession, error)
 }
 
-var _ QUICContextDialer = &QUICDialerQUICGo{}
+var _ QUICContextDialer = &quicDialerQUICGo{}
 
 // errInvalidIP indicates that a string is not a valid IP.
 var errInvalidIP = errors.New("netxlite: invalid IP")
@@ -60,7 +60,7 @@ var errInvalidIP = errors.New("netxlite: invalid IP")
 //
 // 2. if tlsConfig.NextProtos is empty _and_ the port is 443 or 8853,
 // then we configure, respectively, "h3" and "dq".
-func (d *QUICDialerQUICGo) DialContext(ctx context.Context, network string,
+func (d *quicDialerQUICGo) DialContext(ctx context.Context, network string,
 	address string, tlsConfig *tls.Config, quicConfig *quic.Config) (
 	quic.EarlySession, error) {
 	onlyhost, onlyport, err := net.SplitHostPort(address)
@@ -89,7 +89,7 @@ func (d *QUICDialerQUICGo) DialContext(ctx context.Context, network string,
 	return &quicSessionOwnsConn{EarlySession: sess, conn: pconn}, nil
 }
 
-func (d *QUICDialerQUICGo) dialEarlyContext(ctx context.Context,
+func (d *quicDialerQUICGo) dialEarlyContext(ctx context.Context,
 	pconn net.PacketConn, remoteAddr net.Addr, address string,
 	tlsConfig *tls.Config, quicConfig *quic.Config) (quic.EarlySession, error) {
 	if d.mockDialEarlyContext != nil {
@@ -102,7 +102,7 @@ func (d *QUICDialerQUICGo) dialEarlyContext(ctx context.Context,
 
 // maybeApplyTLSDefaults ensures that we're using our certificate pool, if
 // needed, and that we use a suitable ALPN, if needed, for h3 and dq.
-func (d *QUICDialerQUICGo) maybeApplyTLSDefaults(config *tls.Config, port int) *tls.Config {
+func (d *quicDialerQUICGo) maybeApplyTLSDefaults(config *tls.Config, port int) *tls.Config {
 	config = config.Clone()
 	if config.RootCAs == nil {
 		config.RootCAs = defaultCertPool
@@ -136,9 +136,9 @@ func (sess *quicSessionOwnsConn) CloseWithError(
 	return err
 }
 
-// QUICDialerResolver is a dialer that uses the configured Resolver
+// quicDialerResolver is a dialer that uses the configured Resolver
 // to resolve a domain name to IP addrs.
-type QUICDialerResolver struct {
+type quicDialerResolver struct {
 	// Dialer is the underlying QUIC dialer.
 	Dialer QUICContextDialer
 
@@ -146,14 +146,14 @@ type QUICDialerResolver struct {
 	Resolver Resolver
 }
 
-var _ QUICContextDialer = &QUICDialerResolver{}
+var _ QUICContextDialer = &quicDialerResolver{}
 
 // DialContext implements QUICContextDialer.DialContext. This function
 // will apply the following TLS defaults:
 //
 // 1. if tlsConfig.ServerName is empty, we will use the hostname
 // contained inside of the `address` endpoint.
-func (d *QUICDialerResolver) DialContext(
+func (d *quicDialerResolver) DialContext(
 	ctx context.Context, network, address string,
 	tlsConfig *tls.Config, quicConfig *quic.Config) (quic.EarlySession, error) {
 	onlyhost, onlyport, err := net.SplitHostPort(address)
@@ -183,7 +183,7 @@ func (d *QUICDialerResolver) DialContext(
 }
 
 // maybeApplyTLSDefaults sets the SNI if it's not already configured.
-func (d *QUICDialerResolver) maybeApplyTLSDefaults(config *tls.Config, host string) *tls.Config {
+func (d *quicDialerResolver) maybeApplyTLSDefaults(config *tls.Config, host string) *tls.Config {
 	config = config.Clone()
 	if config.ServerName == "" {
 		config.ServerName = host
@@ -192,15 +192,15 @@ func (d *QUICDialerResolver) maybeApplyTLSDefaults(config *tls.Config, host stri
 }
 
 // lookupHost performs a domain name resolution.
-func (d *QUICDialerResolver) lookupHost(ctx context.Context, hostname string) ([]string, error) {
+func (d *quicDialerResolver) lookupHost(ctx context.Context, hostname string) ([]string, error) {
 	if net.ParseIP(hostname) != nil {
 		return []string{hostname}, nil
 	}
 	return d.Resolver.LookupHost(ctx, hostname)
 }
 
-// QUICDialerLogger is a dialer with logging.
+// quicDialerLogger is a dialer with logging.
-type QUICDialerLogger struct {
+type quicDialerLogger struct {
 	// Dialer is the underlying QUIC dialer.
 	Dialer QUICContextDialer
 
@@ -208,10 +208,10 @@ type QUICDialerLogger struct {
 	Logger Logger
 }
 
-var _ QUICContextDialer = &QUICDialerLogger{}
+var _ QUICContextDialer = &quicDialerLogger{}
 
 // DialContext implements QUICContextDialer.DialContext.
-func (d *QUICDialerLogger) DialContext(
+func (d *quicDialerLogger) DialContext(
 	ctx context.Context, network, address string,
 	tlsConfig *tls.Config, quicConfig *quic.Config) (quic.EarlySession, error) {
 	d.Logger.Debugf("quic %s/%s...", address, network)

internal/netxlite/quic_test.go

@@ -11,16 +11,16 @@ import (
 	"github.com/apex/log"
 	"github.com/google/go-cmp/cmp"
 	"github.com/lucas-clemente/quic-go"
-	"github.com/ooni/probe-cli/v3/internal/netxmocks"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/mocks"
-	"github.com/ooni/probe-cli/v3/internal/quicx"
+	"github.com/ooni/probe-cli/v3/internal/netxlite/quicx"
 )
 
 func TestQUICDialerQUICGoCannotSplitHostPort(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "www.google.com",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &QUICListenerStdlib{},
+		QUICListener: &quicListenerStdlib{},
 	}
 	ctx := context.Background()
 	sess, err := systemdialer.DialContext(
@@ -37,8 +37,8 @@ func TestQUICDialerQUICGoInvalidPort(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "www.google.com",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &QUICListenerStdlib{},
+		QUICListener: &quicListenerStdlib{},
 	}
 	ctx := context.Background()
 	sess, err := systemdialer.DialContext(
@@ -55,8 +55,8 @@ func TestQUICDialerQUICGoInvalidIP(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "www.google.com",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &QUICListenerStdlib{},
+		QUICListener: &quicListenerStdlib{},
 	}
 	ctx := context.Background()
 	sess, err := systemdialer.DialContext(
@@ -74,8 +74,8 @@ func TestQUICDialerQUICGoCannotListen(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "www.google.com",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &netxmocks.QUICListener{
+		QUICListener: &mocks.QUICListener{
 			MockListen: func(addr *net.UDPAddr) (quicx.UDPLikeConn, error) {
 				return nil, expected
 			},
@@ -96,8 +96,8 @@ func TestQUICDialerQUICGoCannotPerformHandshake(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "dns.google",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &QUICListenerStdlib{},
+		QUICListener: &quicListenerStdlib{},
 	}
 	ctx, cancel := context.WithCancel(context.Background())
 	cancel() // fail immediately
@@ -115,8 +115,8 @@ func TestQUICDialerQUICGoWorksAsIntended(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "dns.google",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &QUICListenerStdlib{},
+		QUICListener: &quicListenerStdlib{},
 	}
 	ctx := context.Background()
 	sess, err := systemdialer.DialContext(
@@ -136,8 +136,8 @@ func TestQUICDialerQUICGoTLSDefaultsForWeb(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "dns.google",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &QUICListenerStdlib{},
+		QUICListener: &quicListenerStdlib{},
 		mockDialEarlyContext: func(ctx context.Context, pconn net.PacketConn,
 			remoteAddr net.Addr, host string, tlsConfig *tls.Config,
 			quicConfig *quic.Config) (quic.EarlySession, error) {
@@ -177,8 +177,8 @@ func TestQUICDialerQUICGoTLSDefaultsForDoQ(t *testing.T) {
 	tlsConfig := &tls.Config{
 		ServerName: "dns.google",
 	}
-	systemdialer := QUICDialerQUICGo{
+	systemdialer := quicDialerQUICGo{
-		QUICListener: &QUICListenerStdlib{},
+		QUICListener: &quicListenerStdlib{},
 		mockDialEarlyContext: func(ctx context.Context, pconn net.PacketConn,
 			remoteAddr net.Addr, host string, tlsConfig *tls.Config,
 			quicConfig *quic.Config) (quic.EarlySession, error) {
@@ -214,9 +214,9 @@ func TestQUICDialerQUICGoTLSDefaultsForDoQ(t *testing.T) {
 
 func TestQUICDialerResolverSuccess(t *testing.T) {
 	tlsConfig := &tls.Config{}
-	dialer := &QUICDialerResolver{
+	dialer := &quicDialerResolver{
-		Resolver: &net.Resolver{}, Dialer: &QUICDialerQUICGo{
+		Resolver: &net.Resolver{}, Dialer: &quicDialerQUICGo{
-			QUICListener: &QUICListenerStdlib{},
+			QUICListener: &quicListenerStdlib{},
 		}}
 	sess, err := dialer.DialContext(
 		context.Background(), "udp", "www.google.com:443",
@@ -232,8 +232,8 @@ func TestQUICDialerResolverSuccess(t *testing.T) {
 
 func TestQUICDialerResolverNoPort(t *testing.T) {
 	tlsConfig := &tls.Config{}
-	dialer := &QUICDialerResolver{
+	dialer := &quicDialerResolver{
-		Resolver: new(net.Resolver), Dialer: &QUICDialerQUICGo{}}
+		Resolver: new(net.Resolver), Dialer: &quicDialerQUICGo{}}
 	sess, err := dialer.DialContext(
 		context.Background(), "udp", "www.google.com",
 		tlsConfig, &quic.Config{})
@@ -246,7 +246,7 @@ func TestQUICDialerResolverNoPort(t *testing.T) {
 }
 
 func TestQUICDialerResolverLookupHostAddress(t *testing.T) {
-	dialer := &QUICDialerResolver{Resolver: &netxmocks.Resolver{
+	dialer := &quicDialerResolver{Resolver: &mocks.Resolver{
 		MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 			// We should not arrive here and call this function but if we do then
 			// there is going to be an error that fails this test.
@@ -265,7 +265,7 @@ func TestQUICDialerResolverLookupHostAddress(t *testing.T) {
 func TestQUICDialerResolverLookupHostFailure(t *testing.T) {
 	tlsConfig := &tls.Config{}
 	expected := errors.New("mocked error")
-	dialer := &QUICDialerResolver{Resolver: &netxmocks.Resolver{
+	dialer := &quicDialerResolver{Resolver: &mocks.Resolver{
 		MockLookupHost: func(ctx context.Context, domain string) ([]string, error) {
 			return nil, expected
 		},
@@ -285,9 +285,9 @@ func TestQUICDialerResolverInvalidPort(t *testing.T) {
 	// This test allows us to check for the case where every attempt
 	// to establish a connection leads to a failure
 	tlsConf := &tls.Config{}
-	dialer := &QUICDialerResolver{
+	dialer := &quicDialerResolver{
-		Resolver: new(net.Resolver), Dialer: &QUICDialerQUICGo{
+		Resolver: new(net.Resolver), Dialer: &quicDialerQUICGo{
-			QUICListener: &QUICListenerStdlib{},
+			QUICListener: &quicListenerStdlib{},
 		}}
 	sess, err := dialer.DialContext(
 		context.Background(), "udp", "www.google.com:0",
@@ -308,8 +308,8 @@ func TestQUICDialerResolverApplyTLSDefaults(t *testing.T) {
 	expected := errors.New("mocked error")
 	var gotTLSConfig *tls.Config
 	tlsConfig := &tls.Config{}
-	dialer := &QUICDialerResolver{
+	dialer := &quicDialerResolver{
-		Resolver: new(net.Resolver), Dialer: &netxmocks.QUICContextDialer{
+		Resolver: new(net.Resolver), Dialer: &mocks.QUICContextDialer{
 			MockDialContext: func(ctx context.Context, network, address string,
 				tlsConfig *tls.Config, quicConfig *quic.Config) (quic.EarlySession, error) {
 				gotTLSConfig = tlsConfig
@@ -334,12 +334,12 @@ func TestQUICDialerResolverApplyTLSDefaults(t *testing.T) {
 }
 
 func TestQUICDialerLoggerSuccess(t *testing.T) {
-	d := &QUICDialerLogger{
+	d := &quicDialerLogger{
-		Dialer: &netxmocks.QUICContextDialer{
+		Dialer: &mocks.QUICContextDialer{
 			MockDialContext: func(ctx context.Context, network string,
 				address string, tlsConfig *tls.Config,
 				quicConfig *quic.Config) (quic.EarlySession, error) {
-				return &netxmocks.QUICEarlySession{
+				return &mocks.QUICEarlySession{
 					MockCloseWithError: func(
 						code quic.ApplicationErrorCode, reason string) error {
 						return nil
@@ -363,8 +363,8 @@ func TestQUICDialerLoggerSuccess(t *testing.T) {
 
 func TestQUICDialerLoggerFailure(t *testing.T) {
 	expected := errors.New("mocked error")
-	d := &QUICDialerLogger{
+	d := &quicDialerLogger{
-		Dialer: &netxmocks.QUICContextDialer{
+		Dialer: &mocks.QUICContextDialer{
 			MockDialContext: func(ctx context.Context, network string,
 				address string, tlsConfig *tls.Config,
 				quicConfig *quic.Config) (quic.EarlySession, error) {

internal/netxlite/quicx/quicx.go

@@ -3,7 +3,7 @@
 // This code introduces the UDPLikeConn, whose documentation explain
 // why we need to introduce this new type. We could not put this
 // code inside an existing package because it's used (as of 20 Aug 2021)
-// by the netxlite package as well as by the netxmocks package.
+// by the netxlite package as well as by the mocks package.
 package quicx
 
 import (

internal/netxlite/resolver.go

@@ -14,39 +14,39 @@ type Resolver interface {
 	LookupHost(ctx context.Context, hostname string) (addrs []string, err error)
 }
 
-// ResolverSystem is the system resolver.
+// resolverSystem is the system resolver.
-type ResolverSystem struct{}
+type resolverSystem struct{}
 
-var _ Resolver = &ResolverSystem{}
+var _ Resolver = &resolverSystem{}
 
 // LookupHost implements Resolver.LookupHost.
-func (r *ResolverSystem) LookupHost(ctx context.Context, hostname string) ([]string, error) {
+func (r *resolverSystem) LookupHost(ctx context.Context, hostname string) ([]string, error) {
 	return net.DefaultResolver.LookupHost(ctx, hostname)
 }
 
 // Network implements Resolver.Network.
-func (r *ResolverSystem) Network() string {
+func (r *resolverSystem) Network() string {
 	return "system"
 }
 
 // Address implements Resolver.Address.
-func (r *ResolverSystem) Address() string {
+func (r *resolverSystem) Address() string {
 	return ""
 }
 
 // DefaultResolver is the resolver we use by default.
-var DefaultResolver = &ResolverSystem{}
+var DefaultResolver = &resolverSystem{}
 
-// ResolverLogger is a resolver that emits events
+// resolverLogger is a resolver that emits events
-type ResolverLogger struct {
+type resolverLogger struct {
 	Resolver
 	Logger Logger
 }
 
-var _ Resolver = &ResolverLogger{}
+var _ Resolver = &resolverLogger{}
 
 // LookupHost returns the IP addresses of a host
-func (r *ResolverLogger) LookupHost(ctx context.Context, hostname string) ([]string, error) {
+func (r *resolverLogger) LookupHost(ctx context.Context, hostname string) ([]string, error) {
 	r.Logger.Debugf("resolve %s...", hostname)
 	start := time.Now()
 	addrs, err := r.Resolver.LookupHost(ctx, hostname)
@@ -64,7 +64,7 @@ type resolverNetworker interface {
 }
 
 // Network implements Resolver.Network.
-func (r *ResolverLogger) Network() string {
+func (r *resolverLogger) Network() string {
 	if rn, ok := r.Resolver.(resolverNetworker); ok {
 		return rn.Network()
 	}
@@ -76,22 +76,22 @@ type resolverAddresser interface {
 }
 
 // Address implements Resolver.Address.
-func (r *ResolverLogger) Address() string {
+func (r *resolverLogger) Address() string {
 	if ra, ok := r.Resolver.(resolverAddresser); ok {
 		return ra.Address()
 	}
 	return ""
 }
 
-// ResolverIDNA supports resolving Internationalized Domain Names.
+// resolverIDNA supports resolving Internationalized Domain Names.
 //
 // See RFC3492 for more information.
-type ResolverIDNA struct {
+type resolverIDNA struct {
 	Resolver
 }
 
 // LookupHost implements Resolver.LookupHost.
-func (r *ResolverIDNA) LookupHost(ctx context.Context, hostname string) ([]string, error) {
+func (r *resolverIDNA) LookupHost(ctx context.Context, hostname string) ([]string, error) {
 	host, err := idna.ToASCII(hostname)
 	if err != nil {
 		return nil, err
@@ -100,7 +100,7 @@ func (r *ResolverIDNA) LookupHost(ctx context.Context, hostname string) ([]strin
 }
 
 // Network implements Resolver.Network.
-func (r *ResolverIDNA) Network() string {
+func (r *resolverIDNA) Network() string {
 	if rn, ok := r.Resolver.(resolverNetworker); ok {
 		return rn.Network()
 	}
@@ -108,7 +108,7 @@ func (r *ResolverIDNA) Network() string {
 }
 
 // Address implements Resolver.Address.
-func (r *ResolverIDNA) Address() string {
+func (r *resolverIDNA) Address() string {
 	if ra, ok := r.Resolver.(resolverAddresser); ok {
 		return ra.Address()
 	}