Remove direct x/net dependency (#8697)

We don't need that for h2c anymore, and it was only used in a e2e test.
Still an indirect dependency, but oh well.

Signed-off-by: Anders Eknert <anders.eknert@apple.com>

go.mod

@@ -48,7 +48,6 @@ require (
 	go.opentelemetry.io/proto/otlp v1.10.0
 	go.uber.org/automaxprocs v1.6.0
 	go.yaml.in/yaml/v3 v3.0.4
-	golang.org/x/net v0.54.0
 	golang.org/x/sync v0.20.0
 	golang.org/x/text v0.37.0
 	golang.org/x/time v0.15.0
@@ -118,6 +117,7 @@ require (
 	go.yaml.in/yaml/v2 v2.4.4 // indirect
 	golang.org/x/crypto v0.51.0 // indirect
 	golang.org/x/mod v0.35.0 // indirect
+	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sys v0.44.0 // indirect
 	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect

go.sum

@@ -263,8 +263,8 @@ golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE=
 golang.org/x/net v0.18.0/go.mod h1:/czyP5RqHAH4odGYxBJ1qz0+CE5WZ+2j1YgoEo8F2jQ=
-golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
-golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA=
+golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=

v1/test/e2e/h2c/h2c_test.go

@@ -2,7 +2,6 @@ package h2c_test
 
 import (
 	"context"
-	"crypto/tls"
 	"flag"
 	"fmt"
 	"net"
@@ -10,8 +9,6 @@ import (
 	"os"
 	"testing"
 
-	"golang.org/x/net/http2"
-
 	"github.com/open-policy-agent/opa/v1/runtime"
 	"github.com/open-policy-agent/opa/v1/test/e2e"
 )
@@ -19,11 +16,15 @@ import (
 var (
 	testRuntime       *e2e.TestRuntime
 	testSocketPathH2C string
+
+	h2cOnly = new(http.Protocols)
 )
 
 func TestMain(m *testing.M) {
 	flag.Parse()
 
+	h2cOnly.SetUnencryptedHTTP2(true)
+
 	testSocketPathH2C = fmt.Sprintf("/tmp/opa-h2c-test-%d.sock", os.Getpid())
 	defer os.Remove(testSocketPathH2C)
 
@@ -42,15 +43,7 @@ func TestMain(m *testing.M) {
 }
 
 func TestH2CHTTPListeners(t *testing.T) {
-	client := http.Client{
-		Transport: &http2.Transport{
-			AllowHTTP: true,
-			DialTLS: func(network, addr string, _ *tls.Config) (net.Conn, error) {
-				return net.Dial(network, addr)
-			},
-		},
-	}
-
+	client := http.Client{Transport: &http.Transport{Protocols: h2cOnly}}
 	addrs := append(testRuntime.Runtime.Addrs(), testRuntime.Runtime.DiagnosticAddrs()...)
 
 	if expected, actual := 2, len(addrs); expected != actual {
@@ -61,10 +54,11 @@ func TestH2CHTTPListeners(t *testing.T) {
 		u := "http://" + addr + "/health"
 
 		resp, err := client.Get(u)
+		t.Cleanup(closeResponseBody(resp))
+
 		if err != nil {
 			t.Fatalf("failed to GET %s: %s", u, err)
 		}
-
 		if expected, actual := http.StatusOK, resp.StatusCode; expected != actual {
 			t.Errorf("resp status: expected %d, got %d", expected, actual)
 		}
@@ -78,21 +72,17 @@ func TestH2CHTTPListeners(t *testing.T) {
 
 func TestH2CUnixDomainSocket(t *testing.T) {
 	t.Run("HTTP2Client", func(t *testing.T) {
-		client := http.Client{
-			Transport: &http2.Transport{
-				AllowHTTP: true,
-				DialTLS: func(network, addr string, _ *tls.Config) (net.Conn, error) {
-					return net.Dial("unix", testSocketPathH2C)
-				},
-			},
-		}
+		client := http.Client{Transport: &http.Transport{
+			Protocols:   h2cOnly,
+			DialContext: unixSocketDialContext(testSocketPathH2C),
+		}}
 
 		resp, err := client.Get("http://localhost/health")
+		t.Cleanup(closeResponseBody(resp))
+
 		if err != nil {
 			t.Fatalf("failed to GET /health: %s", err)
 		}
-		defer resp.Body.Close()
-
 		if expected, actual := http.StatusOK, resp.StatusCode; expected != actual {
 			t.Errorf("resp status: expected %d, got %d", expected, actual)
 		}
@@ -102,20 +92,16 @@ func TestH2CUnixDomainSocket(t *testing.T) {
 	})
 
 	t.Run("HTTP1Client", func(t *testing.T) {
-		client := http.Client{
-			Transport: &http.Transport{
-				DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
-					return net.Dial("unix", testSocketPathH2C)
-				},
-			},
-		}
+		client := http.Client{Transport: &http.Transport{
+			DialContext: unixSocketDialContext(testSocketPathH2C),
+		}}
 
 		resp, err := client.Get("http://localhost/health")
+		t.Cleanup(closeResponseBody(resp))
+
 		if err != nil {
 			t.Fatalf("failed to GET /health: %s", err)
 		}
-		defer resp.Body.Close()
-
 		if expected, actual := http.StatusOK, resp.StatusCode; expected != actual {
 			t.Errorf("resp status: expected %d, got %d", expected, actual)
 		}
@@ -155,20 +141,16 @@ func TestH2CDisabledUnixDomainSocket(t *testing.T) {
 	}
 
 	t.Run("HTTP1Client", func(t *testing.T) {
-		client := http.Client{
-			Transport: &http.Transport{
-				DialContext: func(ctx context.Context, _, _ string) (net.Conn, error) {
-					return net.Dial("unix", socketPath)
-				},
-			},
-		}
+		client := http.Client{Transport: &http.Transport{
+			DialContext: unixSocketDialContext(socketPath),
+		}}
 
 		resp, err := client.Get("http://localhost/health")
+		t.Cleanup(closeResponseBody(resp))
+
 		if err != nil {
 			t.Fatalf("failed to GET /health: %s", err)
 		}
-		defer resp.Body.Close()
-
 		if expected, actual := http.StatusOK, resp.StatusCode; expected != actual {
 			t.Errorf("resp status: expected %d, got %d", expected, actual)
 		}
@@ -178,24 +160,30 @@ func TestH2CDisabledUnixDomainSocket(t *testing.T) {
 	})
 
 	t.Run("HTTP2ClientShouldFail", func(t *testing.T) {
-		client := http.Client{
-			Transport: &http2.Transport{
-				AllowHTTP: true,
-				DialTLS: func(network, addr string, _ *tls.Config) (net.Conn, error) {
-					return net.Dial("unix", socketPath)
-				},
-			},
-		}
+		client := http.Client{Transport: &http.Transport{
+			Protocols:   h2cOnly,
+			DialContext: unixSocketDialContext(socketPath),
+		}}
 
 		resp, err := client.Get("http://localhost/health")
-		if err != nil {
-			t.Logf("Expected failure for HTTP/2 client when h2c disabled: %s", err)
-			return
-		}
-		defer resp.Body.Close()
+		t.Cleanup(closeResponseBody(resp))
 
-		if resp.ProtoMajor == 2 {
-			t.Errorf("HTTP/2 should not be available when h2c is disabled")
+		if err == nil {
+			t.Fatalf("Expected failure for HTTP/2 client when h2c disabled: %s", err)
 		}
 	})
 }
+
+func unixSocketDialContext(socketPath string) func(context.Context, string, string) (net.Conn, error) {
+	return func(context.Context, string, string) (net.Conn, error) {
+		return net.Dial("unix", socketPath)
+	}
+}
+
+func closeResponseBody(resp *http.Response) func() {
+	return func() {
+		if resp != nil && resp.Body != nil {
+			resp.Body.Close()
+		}
+	}
+}