x/build: restrict outbound network access from builds by default

[bradfitz]

We should make sure our tests never do outbound network requests by default, or that we only hit endpoints that we control.

For instance, the longtest builder is often failing now on:

--- FAIL: TestScript (0.00s)
    --- FAIL: TestScript/mod_gopkg_unstable (54.35s)
        script_test.go:188: 
            > env GO111MODULE=on
            > cp go.mod.empty go.mod
            > go get -d gopkg.in/dummy.v2-unstable
....
            go: golang.org/x/net@v0.0.0-20180906233101-161cd47e91fd: git -c protocol.version=0 fetch --unshallow -f origin refs/heads/*:refs/heads/* refs/tags/*:refs/tags/* in $WORK/gopath/pkg/mod/cache/vcs/4a22365141bc4eea5d5ac4a1395e653f2669485db75ef119e7bbec8e19b12a21: exit status 128:
            	fatal: remote error: Access denied to IP 35.193.215.129

... because we're hitting some Gerrit quota issue it seems.

I'm going to firewall outbound port 443 and port 22 connections for now and set the GOPROXY to our existing private Athens service on GKE to fix the longtest issue above.

/cc @dmitshur @bcmills

[dmitshur]

We should make sure our tests never do outbound network requests by default, or that we only hit endpoints that we control.

I agree.

Package cmd/go tests doing go get of import paths we don't control came up previously at least in #27692. In #27692 (comment), I said:

It might also be worth rethinking whether the test should depend on your repo tags not changing.

And the commit message of CL 153460 that resolved it by @bcmills said:

I think we ought to make these tests hermetic

Edit: Another related open issue is #28856.

[gopherbot]

Change https://golang.org/cl/165637 mentions this issue: env, buildlet, dashboard: support outbound firewalls for Linux

[gopherbot]

Change https://golang.org/cl/165618 mentions this issue: net/http: failing test for new outbound firewall

[gopherbot]

Change https://golang.org/cl/165638 mentions this issue: dashboard: enable outbound firewall on a few more Linux-based builders

[gopherbot]

Change https://golang.org/cl/165777 mentions this issue: kubernetes/gke: skip API tests in short mode

[gopherbot]

Change https://golang.org/cl/167039 mentions this issue: dashboard: set GOPROXY=off for the "go" repo to catch more network usage

[bradfitz]

This is sufficiently done. We do it on enough builders now that we catch network usage.