chore: merge probe-engine into probe-cli (#201)

This is how I did it:

1. `git clone https://github.com/ooni/probe-engine internal/engine`

2. ```
(cd internal/engine && git describe --tags)
v0.23.0
```

3. `nvim go.mod` (merging `go.mod` with `internal/engine/go.mod`

4. `rm -rf internal/.git internal/engine/go.{mod,sum}`

5. `git add internal/engine`

6. `find . -type f -name \*.go -exec sed -i 's@/ooni/probe-engine@/ooni/probe-cli/v3/internal/engine@g' {} \;`

7. `go build ./...` (passes)

8. `go test -race ./...` (temporary failure on RiseupVPN)

9. `go mod tidy`

10. this commit message

Once this piece of work is done, we can build a new version of `ooniprobe` that
is using `internal/engine` directly. We need to do more work to ensure all the
other functionality in `probe-engine` (e.g. making mobile packages) are still WAI.

Part of https://github.com/ooni/probe/issues/1335

internal/engine/legacy/netx/oldhttptransport/bodytracer.go

@@ -0,0 +1,82 @@
+package oldhttptransport
+
+import (
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/transactionid"
+)
+
+// BodyTracer performs single HTTP transactions and emits
+// measurement events as they happen.
+type BodyTracer struct {
+	Transport http.RoundTripper
+}
+
+// NewBodyTracer creates a new Transport.
+func NewBodyTracer(roundTripper http.RoundTripper) *BodyTracer {
+	return &BodyTracer{Transport: roundTripper}
+}
+
+// RoundTrip executes a single HTTP transaction, returning
+// a Response for the provided Request.
+func (t *BodyTracer) RoundTrip(req *http.Request) (resp *http.Response, err error) {
+	resp, err = t.Transport.RoundTrip(req)
+	if err != nil {
+		return
+	}
+	// "The http Client and Transport guarantee that Body is always
+	//  non-nil, even on responses without a body or responses with
+	//  a zero-length body." (from the docs)
+	resp.Body = &bodyWrapper{
+		ReadCloser: resp.Body,
+		root:       modelx.ContextMeasurementRootOrDefault(req.Context()),
+		tid:        transactionid.ContextTransactionID(req.Context()),
+	}
+	return
+}
+
+// CloseIdleConnections closes the idle connections.
+func (t *BodyTracer) CloseIdleConnections() {
+	// Adapted from net/http code
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+	if tr, ok := t.Transport.(closeIdler); ok {
+		tr.CloseIdleConnections()
+	}
+}
+
+type bodyWrapper struct {
+	io.ReadCloser
+	root *modelx.MeasurementRoot
+	tid  int64
+}
+
+func (bw *bodyWrapper) Read(b []byte) (n int, err error) {
+	n, err = bw.ReadCloser.Read(b)
+	bw.root.Handler.OnMeasurement(modelx.Measurement{
+		HTTPResponseBodyPart: &modelx.HTTPResponseBodyPartEvent{
+			// "Read reads up to len(p) bytes into p. It returns the number of
+			// bytes read (0 <= n <= len(p)) and any error encountered."
+			Data:                   b[:n],
+			Error:                  err,
+			DurationSinceBeginning: time.Now().Sub(bw.root.Beginning),
+			TransactionID:          bw.tid,
+		},
+	})
+	return
+}
+
+func (bw *bodyWrapper) Close() (err error) {
+	err = bw.ReadCloser.Close()
+	bw.root.Handler.OnMeasurement(modelx.Measurement{
+		HTTPResponseDone: &modelx.HTTPResponseDoneEvent{
+			DurationSinceBeginning: time.Now().Sub(bw.root.Beginning),
+			TransactionID:          bw.tid,
+		},
+	})
+	return
+}

internal/engine/legacy/netx/oldhttptransport/bodytracer_test.go

@@ -0,0 +1,39 @@
+package oldhttptransport
+
+import (
+	"io/ioutil"
+	"net/http"
+	"testing"
+)
+
+func TestBodyTracerSuccess(t *testing.T) {
+	client := &http.Client{
+		Transport: NewBodyTracer(http.DefaultTransport),
+	}
+	resp, err := client.Get("https://www.google.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client.CloseIdleConnections()
+}
+
+func TestBodyTracerFailure(t *testing.T) {
+	client := &http.Client{
+		Transport: NewBodyTracer(http.DefaultTransport),
+	}
+	// This fails the request because we attempt to speak cleartext HTTP with
+	// a server that instead is expecting TLS.
+	resp, err := client.Get("http://www.google.com:443")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	if resp != nil {
+		t.Fatal("expected a nil response here")
+	}
+	client.CloseIdleConnections()
+}

internal/engine/legacy/netx/oldhttptransport/httptransport.go

@@ -0,0 +1,43 @@
+// Package oldhttptransport contains HTTP transport extensions. Here we
+// define a http.Transport that emits events.
+package oldhttptransport
+
+import (
+	"net/http"
+)
+
+// Transport performs single HTTP transactions and emits
+// measurement events as they happen.
+type Transport struct {
+	roundTripper http.RoundTripper
+}
+
+// New creates a new Transport.
+func New(roundTripper http.RoundTripper) *Transport {
+	return &Transport{
+		roundTripper: NewTransactioner(NewBodyTracer(
+			NewTraceTripper(roundTripper))),
+	}
+}
+
+// RoundTrip executes a single HTTP transaction, returning
+// a Response for the provided Request.
+func (t *Transport) RoundTrip(req *http.Request) (resp *http.Response, err error) {
+	// Make sure we're not sending Go's default User-Agent
+	// if the user has configured no user agent
+	if req.Header.Get("User-Agent") == "" {
+		req.Header["User-Agent"] = nil
+	}
+	return t.roundTripper.RoundTrip(req)
+}
+
+// CloseIdleConnections closes the idle connections.
+func (t *Transport) CloseIdleConnections() {
+	// Adapted from net/http code
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+	if tr, ok := t.roundTripper.(closeIdler); ok {
+		tr.CloseIdleConnections()
+	}
+}

internal/engine/legacy/netx/oldhttptransport/httptransport_test.go

@@ -0,0 +1,39 @@
+package oldhttptransport
+
+import (
+	"io/ioutil"
+	"net/http"
+	"testing"
+)
+
+func TestGood(t *testing.T) {
+	client := &http.Client{
+		Transport: New(http.DefaultTransport),
+	}
+	resp, err := client.Get("https://www.google.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client.CloseIdleConnections()
+}
+
+func TestFailure(t *testing.T) {
+	client := &http.Client{
+		Transport: New(http.DefaultTransport),
+	}
+	// This fails the request because we attempt to speak cleartext HTTP with
+	// a server that instead is expecting TLS.
+	resp, err := client.Get("http://www.google.com:443")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	if resp != nil {
+		t.Fatal("expected a nil response here")
+	}
+	client.CloseIdleConnections()
+}

internal/engine/legacy/netx/oldhttptransport/tracetripper.go

@@ -0,0 +1,274 @@
+package oldhttptransport
+
+import (
+	"bytes"
+	"crypto/tls"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptrace"
+	"sync"
+	"time"
+
+	"github.com/ooni/probe-cli/v3/internal/engine/atomicx"
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/connid"
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/dialid"
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/transactionid"
+	"github.com/ooni/probe-cli/v3/internal/engine/netx/errorx"
+)
+
+// TraceTripper performs single HTTP transactions.
+type TraceTripper struct {
+	readAllErrs  *atomicx.Int64
+	readAll      func(r io.Reader) ([]byte, error)
+	roundTripper http.RoundTripper
+}
+
+// NewTraceTripper creates a new Transport.
+func NewTraceTripper(roundTripper http.RoundTripper) *TraceTripper {
+	return &TraceTripper{
+		readAllErrs:  atomicx.NewInt64(),
+		readAll:      ioutil.ReadAll,
+		roundTripper: roundTripper,
+	}
+}
+
+type readCloseWrapper struct {
+	closer io.Closer
+	reader io.Reader
+}
+
+func newReadCloseWrapper(
+	reader io.Reader, closer io.ReadCloser,
+) *readCloseWrapper {
+	return &readCloseWrapper{
+		closer: closer,
+		reader: reader,
+	}
+}
+
+func (c *readCloseWrapper) Read(p []byte) (int, error) {
+	return c.reader.Read(p)
+}
+
+func (c *readCloseWrapper) Close() error {
+	return c.closer.Close()
+}
+
+func readSnap(
+	source *io.ReadCloser, limit int64,
+	readAll func(r io.Reader) ([]byte, error),
+) (data []byte, err error) {
+	data, err = readAll(io.LimitReader(*source, limit))
+	if err == nil {
+		*source = newReadCloseWrapper(
+			io.MultiReader(bytes.NewReader(data), *source),
+			*source,
+		)
+	}
+	return
+}
+
+// RoundTrip executes a single HTTP transaction, returning
+// a Response for the provided Request.
+func (t *TraceTripper) RoundTrip(req *http.Request) (*http.Response, error) {
+	root := modelx.ContextMeasurementRootOrDefault(req.Context())
+
+	tid := transactionid.ContextTransactionID(req.Context())
+	root.Handler.OnMeasurement(modelx.Measurement{
+		HTTPRoundTripStart: &modelx.HTTPRoundTripStartEvent{
+			DialID:                 dialid.ContextDialID(req.Context()),
+			DurationSinceBeginning: time.Now().Sub(root.Beginning),
+			Method:                 req.Method,
+			TransactionID:          tid,
+			URL:                    req.URL.String(),
+		},
+	})
+
+	var (
+		err              error
+		majorOp          = errorx.HTTPRoundTripOperation
+		majorOpMu        sync.Mutex
+		requestBody      []byte
+		requestHeaders   = http.Header{}
+		requestHeadersMu sync.Mutex
+		snapSize         = modelx.ComputeBodySnapSize(root.MaxBodySnapSize)
+	)
+
+	// Save a snapshot of the request body
+	if req.Body != nil {
+		requestBody, err = readSnap(&req.Body, snapSize, t.readAll)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	// Prepare a tracer for delivering events
+	tracer := &httptrace.ClientTrace{
+		TLSHandshakeStart: func() {
+			majorOpMu.Lock()
+			majorOp = errorx.TLSHandshakeOperation
+			majorOpMu.Unlock()
+			// Event emitted by net/http when DialTLS is not
+			// configured in the http.Transport
+			root.Handler.OnMeasurement(modelx.Measurement{
+				TLSHandshakeStart: &modelx.TLSHandshakeStartEvent{
+					DurationSinceBeginning: time.Now().Sub(root.Beginning),
+					TransactionID:          tid,
+				},
+			})
+		},
+		TLSHandshakeDone: func(state tls.ConnectionState, err error) {
+			// Wrapping the error even if we're not returning it because it may
+			// less confusing to users to see the wrapped name
+			err = errorx.SafeErrWrapperBuilder{
+				Error:         err,
+				Operation:     errorx.TLSHandshakeOperation,
+				TransactionID: tid,
+			}.MaybeBuild()
+			durationSinceBeginning := time.Now().Sub(root.Beginning)
+			// Event emitted by net/http when DialTLS is not
+			// configured in the http.Transport
+			root.Handler.OnMeasurement(modelx.Measurement{
+				TLSHandshakeDone: &modelx.TLSHandshakeDoneEvent{
+					ConnectionState:        modelx.NewTLSConnectionState(state),
+					Error:                  err,
+					DurationSinceBeginning: durationSinceBeginning,
+					TransactionID:          tid,
+				},
+			})
+		},
+		GotConn: func(info httptrace.GotConnInfo) {
+			majorOpMu.Lock()
+			majorOp = errorx.HTTPRoundTripOperation
+			majorOpMu.Unlock()
+			root.Handler.OnMeasurement(modelx.Measurement{
+				HTTPConnectionReady: &modelx.HTTPConnectionReadyEvent{
+					ConnID: connid.Compute(
+						info.Conn.LocalAddr().Network(),
+						info.Conn.LocalAddr().String(),
+					),
+					DurationSinceBeginning: time.Now().Sub(root.Beginning),
+					TransactionID:          tid,
+				},
+			})
+		},
+		WroteHeaderField: func(key string, values []string) {
+			requestHeadersMu.Lock()
+			// Important: do not set directly into the headers map using
+			// the [] operator because net/http expects to be able to
+			// perform normalization of header names!
+			for _, value := range values {
+				requestHeaders.Add(key, value)
+			}
+			requestHeadersMu.Unlock()
+			root.Handler.OnMeasurement(modelx.Measurement{
+				HTTPRequestHeader: &modelx.HTTPRequestHeaderEvent{
+					DurationSinceBeginning: time.Now().Sub(root.Beginning),
+					Key:                    key,
+					TransactionID:          tid,
+					Value:                  values,
+				},
+			})
+		},
+		WroteHeaders: func() {
+			root.Handler.OnMeasurement(modelx.Measurement{
+				HTTPRequestHeadersDone: &modelx.HTTPRequestHeadersDoneEvent{
+					DurationSinceBeginning: time.Now().Sub(root.Beginning),
+					Headers:                requestHeaders, // [*]
+					Method:                 req.Method,     // [*]
+					TransactionID:          tid,
+					URL:                    req.URL, // [*]
+				},
+			})
+		},
+		WroteRequest: func(info httptrace.WroteRequestInfo) {
+			// Wrapping the error even if we're not returning it because it may
+			// less confusing to users to see the wrapped name
+			err := errorx.SafeErrWrapperBuilder{
+				Error:         info.Err,
+				Operation:     errorx.HTTPRoundTripOperation,
+				TransactionID: tid,
+			}.MaybeBuild()
+			root.Handler.OnMeasurement(modelx.Measurement{
+				HTTPRequestDone: &modelx.HTTPRequestDoneEvent{
+					DurationSinceBeginning: time.Now().Sub(root.Beginning),
+					Error:                  err,
+					TransactionID:          tid,
+				},
+			})
+		},
+		GotFirstResponseByte: func() {
+			root.Handler.OnMeasurement(modelx.Measurement{
+				HTTPResponseStart: &modelx.HTTPResponseStartEvent{
+					DurationSinceBeginning: time.Now().Sub(root.Beginning),
+					TransactionID:          tid,
+				},
+			})
+		},
+	}
+
+	// If we don't have already a tracer this is a toplevel request, so just
+	// set the tracer. Otherwise, we're doing DoH. We cannot set anothert trace
+	// because they'd be merged. Instead, replace the existing trace content
+	// with the new trace and then remember to reset it.
+	origtracer := httptrace.ContextClientTrace(req.Context())
+	if origtracer != nil {
+		bkp := *origtracer
+		*origtracer = *tracer
+		defer func() {
+			*origtracer = bkp
+		}()
+	} else {
+		req = req.WithContext(httptrace.WithClientTrace(req.Context(), tracer))
+	}
+
+	resp, err := t.roundTripper.RoundTrip(req)
+	err = errorx.SafeErrWrapperBuilder{
+		Error:         err,
+		Operation:     majorOp,
+		TransactionID: tid,
+	}.MaybeBuild()
+	// [*] Require less event joining work by providing info that
+	// makes this event alone actionable for OONI
+	event := &modelx.HTTPRoundTripDoneEvent{
+		DurationSinceBeginning: time.Now().Sub(root.Beginning),
+		Error:                  err,
+		RequestBodySnap:        requestBody,
+		RequestHeaders:         requestHeaders,   // [*]
+		RequestMethod:          req.Method,       // [*]
+		RequestURL:             req.URL.String(), // [*]
+		MaxBodySnapSize:        snapSize,
+		TransactionID:          tid,
+	}
+	if resp != nil {
+		event.ResponseHeaders = resp.Header
+		event.ResponseStatusCode = int64(resp.StatusCode)
+		event.ResponseProto = resp.Proto
+		// Save a snapshot of the response body
+		var data []byte
+		data, err = readSnap(&resp.Body, snapSize, t.readAll)
+		if err != nil {
+			t.readAllErrs.Add(1)
+			resp = nil // this is how net/http likes it
+		} else {
+			event.ResponseBodySnap = data
+		}
+	}
+	root.Handler.OnMeasurement(modelx.Measurement{
+		HTTPRoundTripDone: event,
+	})
+	return resp, err
+}
+
+// CloseIdleConnections closes the idle connections.
+func (t *TraceTripper) CloseIdleConnections() {
+	// Adapted from net/http code
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+	if tr, ok := t.roundTripper.(closeIdler); ok {
+		tr.CloseIdleConnections()
+	}
+}

internal/engine/legacy/netx/oldhttptransport/tracetripper_test.go

@@ -0,0 +1,272 @@
+package oldhttptransport
+
+import (
+	"bytes"
+	"context"
+	"errors"
+	"io"
+	"io/ioutil"
+	"net/http"
+	"net/http/httptrace"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/miekg/dns"
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/modelx"
+)
+
+func TestTraceTripperSuccess(t *testing.T) {
+	client := &http.Client{
+		Transport: NewTraceTripper(http.DefaultTransport),
+	}
+	resp, err := client.Get("https://www.google.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client.CloseIdleConnections()
+}
+
+type roundTripHandler struct {
+	roundTrips []*modelx.HTTPRoundTripDoneEvent
+	mu         sync.Mutex
+}
+
+func (h *roundTripHandler) OnMeasurement(m modelx.Measurement) {
+	if m.HTTPRoundTripDone != nil {
+		h.mu.Lock()
+		defer h.mu.Unlock()
+		h.roundTrips = append(h.roundTrips, m.HTTPRoundTripDone)
+	}
+}
+
+func TestTraceTripperReadAllFailure(t *testing.T) {
+	transport := NewTraceTripper(http.DefaultTransport)
+	transport.readAll = func(r io.Reader) ([]byte, error) {
+		return nil, io.EOF
+	}
+	client := &http.Client{Transport: transport}
+	resp, err := client.Get("https://google.com")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	if !errors.Is(err, io.EOF) {
+		t.Fatal("not the error we expected")
+	}
+	if resp != nil {
+		t.Fatal("expected nil response here")
+	}
+	if transport.readAllErrs.Load() <= 0 {
+		t.Fatal("not the error we expected")
+	}
+	client.CloseIdleConnections()
+}
+
+func TestTraceTripperFailure(t *testing.T) {
+	client := &http.Client{
+		Transport: NewTraceTripper(http.DefaultTransport),
+	}
+	// This fails the request because we attempt to speak cleartext HTTP with
+	// a server that instead is expecting TLS.
+	resp, err := client.Get("http://www.google.com:443")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	if resp != nil {
+		t.Fatal("expected a nil response here")
+	}
+	client.CloseIdleConnections()
+}
+
+func TestTraceTripperWithClientTrace(t *testing.T) {
+	client := &http.Client{
+		Transport: NewTraceTripper(http.DefaultTransport),
+	}
+	req, err := http.NewRequest("GET", "https://www.kernel.org/", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req = req.WithContext(
+		httptrace.WithClientTrace(req.Context(), new(httptrace.ClientTrace)),
+	)
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp == nil {
+		t.Fatal("expected a good response here")
+	}
+	resp.Body.Close()
+	client.CloseIdleConnections()
+}
+
+func TestTraceTripperWithCorrectSnaps(t *testing.T) {
+	// Prepare a DNS query for dns.google.com A, for which we
+	// know the answer in terms of well know IP addresses
+	query := new(dns.Msg)
+	query.Id = dns.Id()
+	query.RecursionDesired = true
+	query.Question = make([]dns.Question, 1)
+	query.Question[0] = dns.Question{
+		Name:   dns.Fqdn("dns.google.com"),
+		Qtype:  dns.TypeA,
+		Qclass: dns.ClassINET,
+	}
+	queryData, err := query.Pack()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Prepare a new transport with limited snapshot size and
+	// use such transport to configure an ordinary client
+	transport := NewTraceTripper(http.DefaultTransport)
+	const snapSize = 15
+	client := &http.Client{Transport: transport}
+
+	// Prepare a new request for Cloudflare DNS, register
+	// a handler, issue the request, fetch the response.
+	req, err := http.NewRequest(
+		"POST", "https://cloudflare-dns.com/dns-query", bytes.NewReader(queryData),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Content-Type", "application/dns-message")
+	handler := &roundTripHandler{}
+	ctx := modelx.WithMeasurementRoot(
+		context.Background(), &modelx.MeasurementRoot{
+			Beginning:       time.Now(),
+			Handler:         handler,
+			MaxBodySnapSize: snapSize,
+		},
+	)
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if resp.StatusCode != 200 {
+		t.Fatal("HTTP request failed")
+	}
+
+	// Read the whole response body, parse it as valid DNS
+	// reply and verify we obtained what we expected
+	replyData, err := ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	reply := new(dns.Msg)
+	err = reply.Unpack(replyData)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if reply.Rcode != 0 {
+		t.Fatal("unexpected Rcode")
+	}
+	if len(reply.Answer) < 1 {
+		t.Fatal("no answers?!")
+	}
+	found8888, found8844, foundother := false, false, false
+	for _, answer := range reply.Answer {
+		if rra, ok := answer.(*dns.A); ok {
+			ip := rra.A.String()
+			if ip == "8.8.8.8" {
+				found8888 = true
+			} else if ip == "8.8.4.4" {
+				found8844 = true
+			} else {
+				foundother = true
+			}
+		}
+	}
+	if !found8888 || !found8844 || foundother {
+		t.Fatal("unexpected reply")
+	}
+
+	// Finally, make sure we have captured the correct
+	// snapshots for the request and response bodies
+	if len(handler.roundTrips) != 1 {
+		t.Fatal("more round trips than expected")
+	}
+	roundTrip := handler.roundTrips[0]
+	if len(roundTrip.RequestBodySnap) != snapSize {
+		t.Fatal("unexpected request body snap length")
+	}
+	if len(roundTrip.ResponseBodySnap) != snapSize {
+		t.Fatal("unexpected response body snap length")
+	}
+	if !bytes.Equal(roundTrip.RequestBodySnap, queryData[:snapSize]) {
+		t.Fatal("the request body snap is wrong")
+	}
+	if !bytes.Equal(roundTrip.ResponseBodySnap, replyData[:snapSize]) {
+		t.Fatal("the response body snap is wrong")
+	}
+}
+
+func TestTraceTripperWithReadAllFailingForBody(t *testing.T) {
+	// Prepare a DNS query for dns.google.com A, for which we
+	// know the answer in terms of well know IP addresses
+	query := new(dns.Msg)
+	query.Id = dns.Id()
+	query.RecursionDesired = true
+	query.Question = make([]dns.Question, 1)
+	query.Question[0] = dns.Question{
+		Name:   dns.Fqdn("dns.google.com"),
+		Qtype:  dns.TypeA,
+		Qclass: dns.ClassINET,
+	}
+	queryData, err := query.Pack()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	// Prepare a new transport with limited snapshot size and
+	// use such transport to configure an ordinary client
+	transport := NewTraceTripper(http.DefaultTransport)
+	errorMocked := errors.New("mocked error")
+	transport.readAll = func(r io.Reader) ([]byte, error) {
+		return nil, errorMocked
+	}
+	const snapSize = 15
+	client := &http.Client{Transport: transport}
+
+	// Prepare a new request for Cloudflare DNS, register
+	// a handler, issue the request, fetch the response.
+	req, err := http.NewRequest(
+		"POST", "https://cloudflare-dns.com/dns-query", bytes.NewReader(queryData),
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	req.Header.Set("Content-Type", "application/dns-message")
+	handler := &roundTripHandler{}
+	ctx := modelx.WithMeasurementRoot(
+		context.Background(), &modelx.MeasurementRoot{
+			Beginning:       time.Now(),
+			Handler:         handler,
+			MaxBodySnapSize: snapSize,
+		},
+	)
+	req = req.WithContext(ctx)
+	resp, err := client.Do(req)
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	if !errors.Is(err, errorMocked) {
+		t.Fatal("not the error we expected")
+	}
+	if resp != nil {
+		t.Fatal("expected nil response here")
+	}
+
+	// Finally, make sure we got something that makes sense
+	if len(handler.roundTrips) != 0 {
+		t.Fatal("more round trips than expected")
+	}
+}

internal/engine/legacy/netx/oldhttptransport/transactioner.go

@@ -0,0 +1,38 @@
+package oldhttptransport
+
+import (
+	"net/http"
+
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/transactionid"
+)
+
+// Transactioner performs single HTTP transactions.
+type Transactioner struct {
+	roundTripper http.RoundTripper
+}
+
+// NewTransactioner creates a new Transport.
+func NewTransactioner(roundTripper http.RoundTripper) *Transactioner {
+	return &Transactioner{
+		roundTripper: roundTripper,
+	}
+}
+
+// RoundTrip executes a single HTTP transaction, returning
+// a Response for the provided Request.
+func (t *Transactioner) RoundTrip(req *http.Request) (*http.Response, error) {
+	return t.roundTripper.RoundTrip(req.WithContext(
+		transactionid.WithTransactionID(req.Context()),
+	))
+}
+
+// CloseIdleConnections closes the idle connections.
+func (t *Transactioner) CloseIdleConnections() {
+	// Adapted from net/http code
+	type closeIdler interface {
+		CloseIdleConnections()
+	}
+	if tr, ok := t.roundTripper.(closeIdler); ok {
+		tr.CloseIdleConnections()
+	}
+}

internal/engine/legacy/netx/oldhttptransport/transactioner_test.go

@@ -0,0 +1,57 @@
+package oldhttptransport
+
+import (
+	"io/ioutil"
+	"net/http"
+	"testing"
+
+	"github.com/ooni/probe-cli/v3/internal/engine/legacy/netx/transactionid"
+)
+
+type transactionerCheckTransactionID struct {
+	roundTripper http.RoundTripper
+	t            *testing.T
+}
+
+func (t *transactionerCheckTransactionID) RoundTrip(req *http.Request) (*http.Response, error) {
+	ctx := req.Context()
+	if id := transactionid.ContextTransactionID(ctx); id == 0 {
+		t.t.Fatal("transaction ID not set")
+	}
+	return t.roundTripper.RoundTrip(req)
+}
+
+func TestTransactionerSuccess(t *testing.T) {
+	client := &http.Client{
+		Transport: NewTransactioner(&transactionerCheckTransactionID{
+			roundTripper: http.DefaultTransport,
+			t:            t,
+		}),
+	}
+	resp, err := client.Get("https://www.google.com")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	_, err = ioutil.ReadAll(resp.Body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	client.CloseIdleConnections()
+}
+
+func TestTransactionerFailure(t *testing.T) {
+	client := &http.Client{
+		Transport: NewTransactioner(http.DefaultTransport),
+	}
+	// This fails the request because we attempt to speak cleartext HTTP with
+	// a server that instead is expecting TLS.
+	resp, err := client.Get("http://www.google.com:443")
+	if err == nil {
+		t.Fatal("expected an error here")
+	}
+	if resp != nil {
+		t.Fatal("expected a nil response here")
+	}
+	client.CloseIdleConnections()
+}