Add the ProtonVPN server networks and addresses to the IP lookup (closes #236)

Adds the VPN lists `protonvpn`, the servers' /24 networks, IPv4 only, and `protonvpn_entry`, the servers' IPv4 and IPv6 addresses. Each is downloaded once a day and shows in `flags.is_vpn` and `vpn_providers` with no other change.

Proton's `/vpn/logicals` answers 401 without a logged-in session, even with a current client's `x-pm-appversion`, so both come from the public ProtonVPN-IPs mirror. No request header is needed.

Judgement call: the mirror's /24 file as well as its exact addresses. Its README says traffic leaves from unpublished addresses in those networks. The cost is that neighbouring addresses are listed too.

Model: opus-5-5

README.md

@@ -285,8 +285,12 @@ address. Every entry has the same fields:
   empty list when it has none
 - `flags`: yes-or-no facts about the address:
     - `is_tor`: true when the address is on the `tor_exits` list
+    - `is_vpn`: true when the address is on any list of VPN servers (see IP
+      lists)
     - `is_bogon`: true when the address is reserved, so that no network should
       announce it on the internet
+- `vpn_providers`: the names of the lists of VPN servers the address is on, or
+  an empty list when it is on none
 - `ip_lists`: the public IP lists the address is on (see IP lists), or an empty
   list when it is on none
 
@@ -420,13 +424,35 @@ The lists:
   last 30 days. From
   [FireHOL](https://iplists.firehol.org/?ipset=firehol_level3), downloaded every
   3 hours.
+- `ivpn`: VPN servers run by IVPN. From
+  [IVPN](https://api.ivpn.net/v5/servers.json), downloaded once a day.
+- `mullvad`: VPN servers run by Mullvad. From
+  [Mullvad](https://api.mullvad.net/www/relays/all/), downloaded once a day.
+- `nordvpn`: VPN servers run by NordVPN. From
+  [NordVPN](https://api.nordvpn.com/v1/servers?limit=0&fields[servers.station]&fields[servers.ipv6_station]&fields[servers.hostname]),
+  downloaded once a day.
+- `pia`: VPN servers run by Private Internet Access. From
+  [Private Internet Access](https://serverlist.piaservers.net/vpninfo/servers/v6),
+  downloaded once a day.
+- `protonvpn`: the /24 networks that hold ProtonVPN servers. The whole /24 is
+  listed because the ProtonVPN-IPs README says traffic leaves from unpublished
+  addresses in it. From the public
+  [ProtonVPN-IPs](https://github.com/tn3w/ProtonVPN-IPs) mirror of Proton's
+  server list, downloaded once a day.
+- `protonvpn_entry`: the IPv4 and IPv6 addresses of ProtonVPN servers. From the
+  same [ProtonVPN-IPs](https://github.com/tn3w/ProtonVPN-IPs) mirror, downloaded
+  once a day.
 - `spamhaus_drop` and `spamhaus_dropv6`: IPv4 and IPv6 networks hijacked or
   leased by spammers or cyber criminals, according to Spamhaus. From
   [Spamhaus DROP](https://www.spamhaus.org/blocklists/do-not-route-or-peer/),
   downloaded once a day.
-- `tor_exits`: Tor exit nodes, where traffic from the Tor network leaves. From
-  the [Tor Project](https://check.torproject.org/torbulkexitlist), downloaded
+- `tor_exits`: the IPv4 and IPv6 addresses of Tor exit nodes, where traffic from
+  the Tor network leaves. From the Tor Project's
+  [Onionoo](https://metrics.torproject.org/onionoo.html) service, downloaded
   every hour.
+- `x4bnet` and `x4bnet_v6`: IPv4 and IPv6 networks of VPN services, according to
+  a community list that names no service. From
+  [X4BNet](https://github.com/X4BNet/lists_vpn), downloaded once a day.
 
 No list is downloaded more often than its publisher updates it or allows. Each
 can be downloaded whole without an account or a key.

TODO.md

@@ -53,6 +53,19 @@ problem the run finds.
 
 # Completed Steps
 
+- 2026-11-10: the IP lookup checks the `protonvpn` list of ProtonVPN's /24
+  networks, from a public mirror of Proton's server list (closes
+  https://git.eeqj.de/sneak/routewatch/issues/236).
+- 2026-11-10: the tests no longer fail when a busy host stalls for several
+  seconds. Most such waits are now 15 seconds. The test of the stream's idle
+  timeout runs on a fake clock (closes #240)
+- 2026-11-10: the IP lookup checks the public VPN server lists of Mullvad,
+  NordVPN, Private Internet Access and IVPN, and X4BNet's community list. Each
+  result has `flags.is_vpn` and `vpn_providers` (closes
+  https://git.eeqj.de/sneak/routewatch/issues/235).
+- 2026-11-10: `tor_exits` comes from Onionoo, so it holds IPv6 exits and
+  `is_tor` is true for them (closes
+  https://git.eeqj.de/sneak/routewatch/issues/234).
 - 2026-11-10: each result of the IP lookup has a `flags` object with `is_tor`
   and `is_bogon`. The public IP lists are named `ip_lists` in the answer,
   `internal/iplist` in the code and `iplists` in the state directory. A list

cmd/asinfo-gen/main_test.go

@@ -12,7 +12,7 @@ import (
 
 // parseTimeLimit is how long a test waits for parseCSV to return before it
 // fails.
-const parseTimeLimit = 2 * time.Second
+const parseTimeLimit = 15 * time.Second
 
 // TestParseCSVReadsTodaysLayout parses an as.csv with the country code column
 // that the source added after the description. It expects each AS with its

internal/database/database_internal_test.go

@@ -72,17 +72,34 @@ const (
 	// lockTestPrefix is the prefix the batch writes in the checkpoint tests
 	// store.
 	lockTestPrefix = "192.0.2.0/24"
+	// longBusyTimeoutMs is the busy timeout setLongBusyTimeout gives the
+	// writing connection. A checkpoint that waits for an open read takes this
+	// long.
+	longBusyTimeoutMs = 30000
 	// readerCheckpointLimit is how long a checkpoint, and a batch write
-	// waiting for it, may take while a reader is open: well under the busy
-	// timeout, which a checkpoint that waits for the reader takes.
-	readerCheckpointLimit = time.Second
+	// waiting for it, may take while a reader is open: well under
+	// longBusyTimeoutMs, with room for a stall on a busy host.
+	readerCheckpointLimit = 15 * time.Second
 	// truncateCheckpointLimit is how long a checkpoint of a WAL file over
 	// sqliteWALSizeLimitBytes may take to give up while a reader is open: its
-	// wait for the reader plus a second, well under the busy timeout.
+	// wait for the reader plus readerCheckpointLimit.
 	truncateCheckpointLimit = truncateBusyTimeoutMs*time.Millisecond +
-		time.Second
+		readerCheckpointLimit
 )
 
+// setLongBusyTimeout gives the writing connection of db longBusyTimeoutMs, so
+// that a checkpoint that waits for an open read takes far longer than a stall
+// on a busy host.
+func setLongBusyTimeout(ctx context.Context, t *testing.T, db *Database) {
+	t.Helper()
+
+	_, err := db.writer.ExecContext(ctx,
+		fmt.Sprintf("PRAGMA busy_timeout=%d", longBusyTimeoutMs))
+	if err != nil {
+		t.Fatalf("failed to set the busy timeout: %v", err)
+	}
+}
+
 // TestConnectionPoolPragmas holds several pooled connections open at once and
 // checks each one carries the per-connection settings from the DSN, plus the
 // process-wide heap limits, and sees the new file with auto_vacuum
@@ -579,6 +596,8 @@ func TestCheckpointDoesNotWaitForReader(t *testing.T) {
 	ctx := context.Background()
 	ts := time.Now().UTC()
 
+	setLongBusyTimeout(ctx, t, db)
+
 	err = db.UpdatePrefixesBatch(map[string]time.Time{"198.51.100.0/24": ts})
 	if err != nil {
 		t.Fatalf("failed to store the prefix the reader reads: %v", err)
@@ -690,6 +709,7 @@ func TestCheckpointEmptiesWALOnceNoReadIsOpen(t *testing.T) {
 	}
 
 	fillWALPastLimit(ctx, t, db)
+	setLongBusyTimeout(ctx, t, db)
 
 	started := time.Now()
 

internal/iplist/iplist.go

@@ -29,6 +29,33 @@ const (
 	// start with the network's first and last address. Lines that start
 	// with # are comments.
 	FormatDShield
+
+	// FormatOnionooJSON is one Onionoo details document. Its relays have
+	// addresses in two fields: exit_addresses, which has IPv4 only, and
+	// or_addresses, which has IPv4 and IPv6, each with a port.
+	FormatOnionooJSON
+
+	// FormatMullvadJSON is Mullvad's JSON list of relays. A relay's addresses
+	// are in ipv4_addr_in, ipv6_addr_in and ipv4_v2ray.
+	FormatMullvadJSON
+
+	// FormatNordVPNJSON is NordVPN's JSON list of servers. A server's
+	// addresses are in station and ipv6_station.
+	FormatNordVPNJSON
+
+	// FormatPIAJSON is Private Internet Access's JSON server list, then a
+	// blank line and a signature. Each region's servers has lists of servers
+	// by protocol, and each server has its address in ip.
+	FormatPIAJSON
+
+	// FormatIVPNJSON is IVPN's JSON server list. The hosts of its wireguard
+	// and openvpn gateways have their addresses in host and v2ray.
+	FormatIVPNJSON
+
+	// FormatProtonVPN has one address or network per line, with comment lines
+	// that start with #. Unlike FormatLines, a file with no addresses or
+	// networks fails.
+	FormatProtonVPN
 )
 
 // List is one public IP list.
@@ -48,6 +75,9 @@ type List struct {
 
 	// Format is how the list's file is written.
 	Format Format
+
+	// VPN says that the list holds servers of VPN services.
+	VPN bool
 }
 
 // Listing says that a list contains an address.
@@ -58,6 +88,10 @@ type Listing struct {
 	// Updated is when routewatch last downloaded the list, or last heard from
 	// its publisher that its copy was still current.
 	Updated time.Time `json:"updated"`
+
+	// VPN says that the list holds servers of VPN services. A lookup answer
+	// reports it through is_vpn and vpn_providers.
+	VPN bool `json:"-"`
 }
 
 // listCopy is a list's last good copy in memory.
@@ -124,6 +158,7 @@ func (b *IPLists) Lookup(addr netip.Addr) []Listing {
 				Name:        list.Name,
 				Description: list.Description,
 				Updated:     c.updated,
+				VPN:         list.VPN,
 			})
 		}
 	}

internal/iplist/iplist_internal_test.go

@@ -11,6 +11,7 @@ import (
 	"net/netip"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"sync"
 	"testing"
@@ -28,6 +29,63 @@ const (
 	newListBody         = "# A test list\n" + newListedAddr + "\n"
 )
 
+// A small Onionoo details document: a relay with an exit address and IPv4 and
+// IPv6 relay addresses, one without exit addresses, and one with a list of
+// ports.
+const (
+	onionooExitAddr     = "192.0.2.10"
+	onionooIPv6ExitAddr = "2001:db8::1"
+	onionooBody         = `{"version":"8.0","relays":[
+		{"exit_addresses":["` + onionooExitAddr + `"],
+		 "or_addresses":["192.0.2.11:443","[` + onionooIPv6ExitAddr + `]:9001"]},
+		{"or_addresses":["192.0.2.20:443"]},
+		{"or_addresses":["192.0.2.30:80,443"]}
+	],"bridges":[]}`
+)
+
+// Small documents in the VPN services' formats. PIA's and IVPN's have no
+// public IPv6 addresses, and IVPN's holds addresses that are not its servers,
+// which must not be read.
+const (
+	mullvadBody = `[
+		{"hostname":"a-wg-001","ipv4_addr_in":"192.0.2.40","ipv6_addr_in":"2001:db8::40"},
+		{"hostname":"a-br-001","ipv4_addr_in":"192.0.2.41","ipv6_addr_in":null,
+		 "ipv4_v2ray":"192.0.2.42"}
+	]`
+	nordVPNBody = `[
+		{"hostname":"a1.example.com","station":"192.0.2.50","ipv6_station":""},
+		{"hostname":"a2.example.com","station":"192.0.2.51","ipv6_station":"2001:db8::51"}
+	]`
+	piaBody = `{"groups":{"wg":[{"name":"wireguard","ports":[1337]}]},"regions":[
+		{"id":"a","servers":{
+			"wg":[{"ip":"192.0.2.60","cn":"a1"}],
+			"ikev2":[{"ip":"192.0.2.61","cn":"a1"}]}},
+		{"id":"b","servers":{"meta":[{"ip":"192.0.2.62","cn":"b1","van":true}]}}
+	]}` + "\n\nc2lnbmF0dXJl\nbGluZSB0d28=\n"
+	ivpnBody = `{"wireguard":[{"gateway":"a.wg.example.com","hosts":[
+		{"hostname":"a1","host":"192.0.2.70","v2ray":"192.0.2.71",
+		 "ipv6":{"local_ip":"2001:db8::70/96"}}]}],
+	"openvpn":[{"gateway":"a.gw.example.com","hosts":[
+		{"hostname":"a1","host":"192.0.2.72"}]}],
+	"config":{"api":{"ips":["192.0.2.73"]}}}`
+)
+
+// protonVPNBody is a small file in the format of the ProtonVPN-IPs list.
+const protonVPNBody = "#\n# protonvpn_ip_ranges.txt\n" +
+	"# https://github.com/tn3w/ProtonVPN-IPs\n#\n" +
+	"# The /24 block of every advertised IPv4.\n#\n" +
+	"192.0.2.0/24\n198.51.100.0/24\n"
+
+// protonVPNEntryBody is a small file in the format of the ProtonVPN-IPs list
+// of server addresses.
+const protonVPNEntryBody = "#\n# protonvpn_entry_ips.txt\n" +
+	"# https://github.com/tn3w/ProtonVPN-IPs\n#\n" +
+	"# Entry IPs clients connect to, resolved from ProtonVPN hostnames.\n#\n" +
+	"192.0.2.80\n2001:db8::80\n"
+
+// errorPage is a file that is no list, as a publisher's error page is.
+const errorPage = "<!DOCTYPE html>\n<html></html>\n"
+
 // testETag is the ETag a publisher sends with a version of the test list.
 const testETag = `"v1"`
 
@@ -143,13 +201,7 @@ func lookup(t *testing.T, b *IPLists, addr string) []Listing {
 func TestLookupFindsListedAddresses(t *testing.T) {
 	t.Parallel()
 
-	tests := []struct {
-		name     string
-		format   Format
-		body     string
-		listed   []string
-		unlisted []string
-	}{
+	runLookupCases(t, []lookupCase{
 		{
 			name:     "single addresses",
 			format:   FormatLines,
@@ -181,9 +233,84 @@ func TestLookupFindsListedAddresses(t *testing.T) {
 			listed:   []string{"192.0.2.0", "192.0.2.77"},
 			unlisted: []string{"192.0.3.1", "2001:db8::1"},
 		},
-	}
+		{
+			name:   "Onionoo relays",
+			format: FormatOnionooJSON,
+			body:   onionooBody,
+			listed: []string{
+				onionooExitAddr, "192.0.2.11", "192.0.2.20", "192.0.2.30",
+				onionooIPv6ExitAddr,
+			},
+			unlisted: []string{"192.0.2.12", "2001:db8::2"},
+		},
+	})
+}
 
-	for _, tt := range tests {
+// TestLookupFindsVPNServers downloads a list in each VPN service's format and
+// looks up addresses on it and off it.
+func TestLookupFindsVPNServers(t *testing.T) {
+	t.Parallel()
+
+	runLookupCases(t, []lookupCase{
+		{
+			name:     "Mullvad relays",
+			format:   FormatMullvadJSON,
+			body:     mullvadBody,
+			listed:   []string{"192.0.2.40", "192.0.2.41", "192.0.2.42", "2001:db8::40"},
+			unlisted: []string{"192.0.2.43", "2001:db8::41"},
+		},
+		{
+			name:     "NordVPN servers",
+			format:   FormatNordVPNJSON,
+			body:     nordVPNBody,
+			listed:   []string{"192.0.2.50", "192.0.2.51", "2001:db8::51"},
+			unlisted: []string{"192.0.2.52", "2001:db8::50"},
+		},
+		{
+			name:     "PIA servers, with the signature after the JSON",
+			format:   FormatPIAJSON,
+			body:     piaBody,
+			listed:   []string{"192.0.2.60", "192.0.2.61", "192.0.2.62"},
+			unlisted: []string{"192.0.2.63", "2001:db8::60"},
+		},
+		{
+			name:     "IVPN hosts",
+			format:   FormatIVPNJSON,
+			body:     ivpnBody,
+			listed:   []string{"192.0.2.70", "192.0.2.71", "192.0.2.72"},
+			unlisted: []string{"192.0.2.73", "2001:db8::70"},
+		},
+		{
+			name:     "ProtonVPN networks",
+			format:   FormatProtonVPN,
+			body:     protonVPNBody,
+			listed:   []string{"192.0.2.0", "192.0.2.255", "198.51.100.7"},
+			unlisted: []string{"192.0.3.1", "2001:db8::90"},
+		},
+		{
+			name:     "ProtonVPN server addresses",
+			format:   FormatProtonVPN,
+			body:     protonVPNEntryBody,
+			listed:   []string{"192.0.2.80", "2001:db8::80"},
+			unlisted: []string{"192.0.2.81", "2001:db8::81"},
+		},
+	})
+}
+
+// lookupCase is a list file, the addresses it holds and some it does not.
+type lookupCase struct {
+	name     string
+	format   Format
+	body     string
+	listed   []string
+	unlisted []string
+}
+
+// runLookupCases downloads each case's list file and checks its addresses.
+func runLookupCases(t *testing.T, cases []lookupCase) {
+	t.Helper()
+
+	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
 
@@ -195,26 +322,34 @@ func TestLookupFindsListedAddresses(t *testing.T) {
 				t.Fatalf("download: %v", err)
 			}
 
-			for _, addr := range tt.listed {
-				listings := lookup(t, b, addr)
-				if len(listings) != 1 || listings[0].Name != testListName ||
-					listings[0].Description != testListDescription ||
-					listings[0].Updated.IsZero() {
-					t.Errorf("%s: listings %+v, want one for %s", addr,
-						listings, testListName)
-				}
-			}
-
-			for _, addr := range tt.unlisted {
-				listings := lookup(t, b, addr)
-				if listings == nil || len(listings) != 0 {
-					t.Errorf("%s: listings %#v, want an empty list", addr, listings)
-				}
-			}
+			checkLookups(t, b, tt.listed, tt.unlisted)
 		})
 	}
 }
 
+// checkLookups checks that each of listed has one listing that names the test
+// list, and each of unlisted has an empty list of listings.
+func checkLookups(t *testing.T, b *IPLists, listed, unlisted []string) {
+	t.Helper()
+
+	for _, addr := range listed {
+		listings := lookup(t, b, addr)
+		if len(listings) != 1 || listings[0].Name != testListName ||
+			listings[0].Description != testListDescription ||
+			listings[0].Updated.IsZero() {
+			t.Errorf("%s: listings %+v, want one for %s", addr,
+				listings, testListName)
+		}
+	}
+
+	for _, addr := range unlisted {
+		listings := lookup(t, b, addr)
+		if listings == nil || len(listings) != 0 {
+			t.Errorf("%s: listings %#v, want an empty list", addr, listings)
+		}
+	}
+}
+
 // TestFailedDownloadKeepsThePreviousCopy downloads a good version of a list,
 // then one that fails. The good copy stays in memory and on disk, and no
 // part of the failed download is left beside it.
@@ -227,7 +362,7 @@ func TestFailedDownloadKeepsThePreviousCopy(t *testing.T) {
 		body   string
 	}{
 		{"server error", http.StatusInternalServerError, "unavailable"},
-		{"not a list", http.StatusOK, "<!DOCTYPE html>\n<html></html>\n"},
+		{"not a list", http.StatusOK, errorPage},
 	}
 
 	for _, tt := range tests {
@@ -263,6 +398,192 @@ func TestFailedDownloadKeepsThePreviousCopy(t *testing.T) {
 	}
 }
 
+// TestFileThatIsNotAnOnionooDocumentKeepsThePreviousCopy downloads a good
+// Onionoo document, then files that are not one. Each fails the parse, and
+// the good copy stays.
+func TestFileThatIsNotAnOnionooDocumentKeepsThePreviousCopy(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name string
+		body string
+	}{
+		{"not JSON", errorPage},
+		{"other JSON", `{"status":"ok","data":{"relays_count":1}}`},
+		{"JSON array", `[{"or_addresses":["192.0.2.1:443"]}]`},
+		{"no relays", `{"relays":[],"bridges":[]}`},
+		{"relays without addresses", `{"relays":[{"nickname":"example"}]}`},
+		{"relay address without a port", `{"relays":[{"or_addresses":["192.0.2.1"]}]}`},
+		{"exit address that is not one", `{"relays":[{"exit_addresses":["example"]}]}`},
+		{"text after the document", `{"relays":[{"or_addresses":["192.0.2.1:1"]}]} x`},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			dir := t.TempDir()
+			p, url := newPublisher(t, onionooBody)
+			b := newTestIPLists(dir, testList(url, FormatOnionooJSON))
+
+			err := b.download(t.Context(), b.lists[0])
+			if err != nil {
+				t.Fatalf("first download: %v", err)
+			}
+
+			p.answer(http.StatusOK, tt.body)
+
+			err = b.download(t.Context(), b.lists[0])
+			if err == nil {
+				t.Fatal("second download returned no error")
+			}
+
+			if len(lookup(t, b, onionooExitAddr)) != 1 {
+				t.Errorf("%s is no longer listed", onionooExitAddr)
+			}
+
+			onDisk, err := fs.ReadFile(os.DirFS(dir), testListName)
+			if err != nil || string(onDisk) != onionooBody {
+				t.Errorf("copy on disk %q (%v), want the good version", onDisk, err)
+			}
+		})
+	}
+}
+
+// TestWrongVPNDocumentFailsToParse parses documents that are not a VPN
+// service's list. Each fails, so none can replace a good copy.
+func TestWrongVPNDocumentFailsToParse(t *testing.T) {
+	t.Parallel()
+
+	formats := []struct {
+		name       string
+		format     Format
+		good       string
+		empty      string
+		badAddress string
+	}{
+		{
+			"Mullvad", FormatMullvadJSON, mullvadBody,
+			`[{"hostname":"a"}]`, `[{"ipv4_addr_in":"example"}]`,
+		},
+		{
+			"NordVPN", FormatNordVPNJSON, nordVPNBody,
+			`[{"hostname":"a","station":"","ipv6_station":""}]`,
+			`[{"station":"example"}]`,
+		},
+		{
+			"PIA", FormatPIAJSON, piaBody,
+			`{"regions":[{"id":"a","servers":{}}]}`,
+			`{"regions":[{"servers":{"wg":[{"ip":"example"}]}}]}`,
+		},
+		{
+			"IVPN", FormatIVPNJSON, ivpnBody,
+			`{"wireguard":[{"hosts":[]}],"openvpn":[]}`,
+			`{"wireguard":[{"hosts":[{"host":"example"}]}]}`,
+		},
+	}
+
+	for _, f := range formats {
+		bodies := map[string]string{
+			"not JSON":      errorPage,
+			"other JSON":    `{"status":"ok","data":{"count":1}}`,
+			"no addresses":  f.empty,
+			"bad address":   f.badAddress,
+			"cut off":       f.good[:len(f.good)/2],
+			"an empty file": "",
+		}
+
+		for name, body := range bodies {
+			t.Run(f.name+" "+name, func(t *testing.T) {
+				t.Parallel()
+
+				addresses, err := parse(strings.NewReader(body), f.format)
+				if err == nil {
+					t.Errorf("parse returned %v and no error", addresses.Ranges())
+				}
+			})
+		}
+	}
+}
+
+// TestWrongProtonVPNDocumentFailsToParse parses documents that are not a
+// ProtonVPN-IPs list. Each fails, so none can replace a good copy.
+func TestWrongProtonVPNDocumentFailsToParse(t *testing.T) {
+	t.Parallel()
+
+	bodies := map[string]string{
+		"error page":    errorPage,
+		"JSON":          `{"status":"ok"}`,
+		"comments only": "#\n# protonvpn_ip_ranges.txt\n#\n",
+		"bad network":   "192.0.2.0/24\nexample\n",
+		"an empty file": "",
+	}
+
+	for name, body := range bodies {
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+
+			addresses, err := parse(strings.NewReader(body), FormatProtonVPN)
+			if err == nil {
+				t.Errorf("parse returned %v and no error", addresses.Ranges())
+			}
+		})
+	}
+}
+
+// TestLookupMarksVPNLists looks up an address on a VPN list and on another
+// list. Only the VPN list's listing says it is one.
+func TestLookupMarksVPNLists(t *testing.T) {
+	t.Parallel()
+
+	_, url := newPublisher(t, goodListBody)
+	vpnList := testList(url, FormatLines)
+	vpnList.Name = "test_vpn_list"
+	vpnList.VPN = true
+	otherList := testList(url, FormatLines)
+
+	b := New(Params{
+		Dir:    t.TempDir(),
+		Lists:  []List{vpnList, otherList},
+		Logger: slog.New(slog.DiscardHandler),
+	})
+
+	for _, list := range b.lists {
+		err := b.download(t.Context(), list)
+		if err != nil {
+			t.Fatalf("download of %s: %v", list.Name, err)
+		}
+	}
+
+	listings := lookup(t, b, listedAddr)
+	if len(listings) != 2 || !listings[0].VPN || listings[1].VPN {
+		t.Errorf("listings %+v, want the first of two marked as a VPN list",
+			listings)
+	}
+}
+
+// TestPublicListsMarkTheVPNLists checks which public lists are VPN lists,
+// since their names are what vpn_providers reports.
+func TestPublicListsMarkTheVPNLists(t *testing.T) {
+	t.Parallel()
+
+	var got []string
+
+	for _, list := range Lists() {
+		if list.VPN {
+			got = append(got, list.Name)
+		}
+	}
+
+	want := []string{
+		"ivpn", "mullvad", "nordvpn", "pia", "protonvpn", "protonvpn_entry",
+		"x4bnet", "x4bnet_v6",
+	}
+	if !slices.Equal(got, want) {
+		t.Errorf("VPN lists %v, want %v", got, want)
+	}
+}
+
 // checkGoodCopyOnDisk checks that dir holds the good version of the test list
 // and no part of a failed download.
 func checkGoodCopyOnDisk(t *testing.T, dir string) {
@@ -380,9 +701,13 @@ func TestRestartLoadsCopiesFromDisk(t *testing.T) {
 	second.Start(t.Context())
 	second.Stop(t.Context())
 
+	// The download takes its time after writing the file, and the restart
+	// reads the file's time. A busy host can put seconds between the two.
+	const maxUpdatedDifference = 15 * time.Second
+
 	listings := lookup(t, second, listedAddr)
 	if len(listings) != 1 ||
-		listings[0].Updated.Sub(downloaded).Abs() > time.Second {
+		listings[0].Updated.Sub(downloaded).Abs() > maxUpdatedDifference {
 		t.Errorf("after the restart, listings %+v, want one updated at %s",
 			listings, downloaded)
 	}
@@ -555,6 +880,33 @@ func TestStopCancelsADownloadInProgress(t *testing.T) {
 	}
 }
 
+// TestTorExitsListHoldsIPv6Exits downloads an Onionoo document as the public
+// Tor exit list, which is what an IPv6 address's is_tor answer comes from.
+func TestTorExitsListHoldsIPv6Exits(t *testing.T) {
+	t.Parallel()
+
+	index := slices.IndexFunc(Lists(), func(list List) bool {
+		return list.Name == TorExitsList
+	})
+	if index < 0 {
+		t.Fatalf("no list named %s", TorExitsList)
+	}
+
+	list := Lists()[index]
+	_, list.URL = newPublisher(t, onionooBody)
+	b := newTestIPLists(t.TempDir(), list)
+
+	err := b.download(t.Context(), list)
+	if err != nil {
+		t.Fatalf("download: %v", err)
+	}
+
+	listings := lookup(t, b, onionooIPv6ExitAddr)
+	if len(listings) != 1 || listings[0].Name != TorExitsList {
+		t.Errorf("listings %+v, want one for %s", listings, TorExitsList)
+	}
+}
+
 // TestPublicListsAreComplete checks that every public list has what a
 // download and a lookup answer need, and a unique name.
 func TestPublicListsAreComplete(t *testing.T) {

internal/iplist/lists.go

@@ -1,6 +1,9 @@
 package iplist
 
-import "time"
+import (
+	"slices"
+	"time"
+)
 
 // TorExitsList is the name of the list of Tor exit nodes.
 const TorExitsList = "tor_exits"
@@ -28,15 +31,24 @@ const (
 	// https://www.spamhaus.org/blocklists/do-not-route-or-peer/
 	spamhausDROPInterval = 24 * time.Hour
 
-	// Tor publishes a new exit list every hour and sets no download limit:
-	// https://collector.torproject.org/recent/exit-lists/
+	// Onionoo's relay data follows Tor's hourly network consensus, and
+	// Onionoo sets no download limit:
+	// https://metrics.torproject.org/onionoo.html
 	torExitsInterval = time.Hour
+
+	// A VPN service's servers change slowly, so once a day is enough.
+	vpnListInterval = 24 * time.Hour
 )
 
 // Lists returns the public IP lists routewatch downloads. Each can be
 // downloaded whole without an account or a key. Spamhaus merged its EDROP
 // list into DROP, so DROP covers both.
 func Lists() []List {
+	return slices.Concat(nonVPNLists(), vpnLists())
+}
+
+// nonVPNLists returns the public lists that are not lists of VPN servers.
+func nonVPNLists() []List {
 	return []List{
 		{
 			Name: "dshield",
@@ -88,9 +100,95 @@ func Lists() []List {
 		{
 			Name:        TorExitsList,
 			Description: "A Tor exit node, where traffic from the Tor network leaves",
-			URL:         "https://check.torproject.org/torbulkexitlist",
-			Interval:    torExitsInterval,
-			Format:      FormatLines,
+			URL: "https://onionoo.torproject.org/details?" +
+				"flag=Exit&running=true&fields=exit_addresses,or_addresses",
+			Interval: torExitsInterval,
+			Format:   FormatOnionooJSON,
+		},
+	}
+}
+
+// vpnLists returns the public lists of VPN servers. Their names are what
+// vpn_providers reports.
+func vpnLists() []List {
+	return []List{
+		{
+			Name:        "ivpn",
+			Description: "A server of the IVPN service",
+			URL:         "https://api.ivpn.net/v5/servers.json",
+			Interval:    vpnListInterval,
+			Format:      FormatIVPNJSON,
+			VPN:         true,
+		},
+		{
+			Name:        "mullvad",
+			Description: "A server of the Mullvad VPN service",
+			URL:         "https://api.mullvad.net/www/relays/all/",
+			Interval:    vpnListInterval,
+			Format:      FormatMullvadJSON,
+			VPN:         true,
+		},
+		{
+			Name:        "nordvpn",
+			Description: "A server of the NordVPN service",
+			URL: "https://api.nordvpn.com/v1/servers?limit=0" +
+				"&fields[servers.station]&fields[servers.ipv6_station]" +
+				"&fields[servers.hostname]",
+			Interval: vpnListInterval,
+			Format:   FormatNordVPNJSON,
+			VPN:      true,
+		},
+		{
+			Name:        "pia",
+			Description: "A server of the Private Internet Access VPN service",
+			URL:         "https://serverlist.piaservers.net/vpninfo/servers/v6",
+			Interval:    vpnListInterval,
+			Format:      FormatPIAJSON,
+			VPN:         true,
+		},
+		{
+			// Proton's own server list needs a logged-in session, so this is
+			// the public ProtonVPN-IPs mirror of it. Proton publishes only
+			// the addresses clients connect to. The mirror's README says
+			// traffic leaves from others in the same /24, so this file of
+			// /24 networks is the one it says to use for detecting exits.
+			Name: "protonvpn",
+			Description: "In a /24 network that holds a server of the " +
+				"ProtonVPN service",
+			URL: "https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/" +
+				"protonvpn_ip_ranges.txt",
+			Interval: vpnListInterval,
+			Format:   FormatProtonVPN,
+			VPN:      true,
+		},
+		{
+			Name:        "protonvpn_entry",
+			Description: "A server of the ProtonVPN service",
+			URL: "https://raw.githubusercontent.com/tn3w/ProtonVPN-IPs/master/" +
+				"protonvpn_entry_ips.txt",
+			Interval: vpnListInterval,
+			Format:   FormatProtonVPN,
+			VPN:      true,
+		},
+		{
+			Name: "x4bnet",
+			Description: "In an IPv4 network of a VPN service, according to " +
+				"X4BNet's community list",
+			URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
+				"output/vpn/ipv4.txt",
+			Interval: vpnListInterval,
+			Format:   FormatLines,
+			VPN:      true,
+		},
+		{
+			Name: "x4bnet_v6",
+			Description: "In an IPv6 network of a VPN service, according to " +
+				"X4BNet's community list",
+			URL: "https://raw.githubusercontent.com/X4BNet/lists_vpn/main/" +
+				"output/vpn/ipv6.txt",
+			Interval: vpnListInterval,
+			Format:   FormatLines,
+			VPN:      true,
 		},
 	}
 }

internal/iplist/parse.go

@@ -6,7 +6,9 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"net"
 	"net/netip"
+	"slices"
 	"strings"
 
 	"go4.org/netipx"
@@ -32,12 +34,42 @@ var (
 	errUnknownFormat = errors.New("unknown list format")
 	errNoNetwork     = errors.New("no network on the line")
 	errBadRange      = errors.New("first and last address make no range")
+	errNoAddresses   = errors.New("no addresses in the document")
 )
 
 // parse reads a list file written in format and returns the addresses it
-// holds. A line it cannot read fails the whole file, so a file that is not
+// holds. Anything it cannot read fails the whole file, so a file that is not
 // the list, such as an error page, never replaces a good copy.
 func parse(r io.Reader, format Format) (*netipx.IPSet, error) {
+	switch format {
+	case FormatLines:
+		return parseLines(r, addAddressOrNetwork)
+	case FormatSpamhausJSON:
+		return parseLines(r, addSpamhausNetwork)
+	case FormatDShield:
+		return parseLines(r, addDShieldNetwork)
+	case FormatOnionooJSON:
+		return parseOnionoo(r)
+	case FormatMullvadJSON:
+		return parseMullvad(r)
+	case FormatNordVPNJSON:
+		return parseNordVPN(r)
+	case FormatPIAJSON:
+		return parsePIA(r)
+	case FormatIVPNJSON:
+		return parseIVPN(r)
+	case FormatProtonVPN:
+		return parseProtonVPN(r)
+	default:
+		return nil, errUnknownFormat
+	}
+}
+
+// parseLines reads a list file line by line, skipping blank lines and
+// comments, and calls addLine with each other line.
+func parseLines(
+	r io.Reader, addLine func(*netipx.IPSetBuilder, string) error,
+) (*netipx.IPSet, error) {
 	var builder netipx.IPSetBuilder
 
 	scanner := bufio.NewScanner(r)
@@ -48,7 +80,7 @@ func parse(r io.Reader, format Format) (*netipx.IPSet, error) {
 			continue
 		}
 
-		err := addLine(&builder, line, format)
+		err := addLine(&builder, line)
 		if err != nil {
 			return nil, fmt.Errorf("line %d: %w", lineNumber, err)
 		}
@@ -62,20 +94,6 @@ func parse(r io.Reader, format Format) (*netipx.IPSet, error) {
 	return builder.IPSet()
 }
 
-// addLine adds the address or network on one line of a list file to builder.
-func addLine(builder *netipx.IPSetBuilder, line string, format Format) error {
-	switch format {
-	case FormatLines:
-		return addAddressOrNetwork(builder, line)
-	case FormatSpamhausJSON:
-		return addSpamhausNetwork(builder, line)
-	case FormatDShield:
-		return addDShieldNetwork(builder, line)
-	default:
-		return errUnknownFormat
-	}
-}
-
 // addAddressOrNetwork adds an address, such as 192.0.2.1, or a network, such
 // as 192.0.2.0/24, to builder.
 func addAddressOrNetwork(builder *netipx.IPSetBuilder, text string) error {
@@ -156,3 +174,237 @@ func addDShieldNetwork(builder *netipx.IPSetBuilder, line string) error {
 
 	return nil
 }
+
+// parseOnionoo returns every address in the exit_addresses and or_addresses
+// fields of the relays in an Onionoo details document. A document with no
+// addresses fails, because the Tor network always has relays.
+func parseOnionoo(r io.Reader) (*netipx.IPSet, error) {
+	//nolint:tagliatelle // Onionoo's own field names
+	var details struct {
+		Relays []struct {
+			ExitAddresses []string `json:"exit_addresses"`
+			ORAddresses   []string `json:"or_addresses"`
+		} `json:"relays"`
+	}
+
+	err := readJSON(r, &details)
+	if err != nil {
+		return nil, err
+	}
+
+	var builder netipx.IPSetBuilder
+
+	for _, relay := range details.Relays {
+		for _, text := range relay.ExitAddresses {
+			err = addAddress(&builder, text)
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		for _, text := range relay.ORAddresses {
+			err = addAddressWithPort(&builder, text)
+			if err != nil {
+				return nil, err
+			}
+		}
+	}
+
+	addresses, err := builder.IPSet()
+	if err != nil {
+		return nil, err
+	}
+
+	if len(addresses.Ranges()) == 0 {
+		return nil, errNoAddresses
+	}
+
+	return addresses, nil
+}
+
+// parseMullvad returns the addresses of the relays in a Mullvad document. A
+// relay with no IPv6 address has null for it, and only bridges have
+// ipv4_v2ray.
+func parseMullvad(r io.Reader) (*netipx.IPSet, error) {
+	//nolint:tagliatelle // Mullvad's own field names
+	var relays []struct {
+		IPv4      string `json:"ipv4_addr_in"`
+		IPv6      string `json:"ipv6_addr_in"`
+		IPv4V2Ray string `json:"ipv4_v2ray"`
+	}
+
+	err := readJSON(r, &relays)
+	if err != nil {
+		return nil, err
+	}
+
+	var texts []string
+
+	for _, relay := range relays {
+		texts = append(texts, relay.IPv4, relay.IPv6, relay.IPv4V2Ray)
+	}
+
+	return addressSet(texts)
+}
+
+// parseNordVPN returns the addresses of the servers in a NordVPN document. A
+// server with no IPv6 address has an empty ipv6_station.
+func parseNordVPN(r io.Reader) (*netipx.IPSet, error) {
+	//nolint:tagliatelle // NordVPN's own field names
+	var servers []struct {
+		Station     string `json:"station"`
+		IPv6Station string `json:"ipv6_station"`
+	}
+
+	err := readJSON(r, &servers)
+	if err != nil {
+		return nil, err
+	}
+
+	var texts []string
+
+	for _, server := range servers {
+		texts = append(texts, server.Station, server.IPv6Station)
+	}
+
+	return addressSet(texts)
+}
+
+// parsePIA returns the addresses of the servers in a Private Internet Access
+// document. json.Decoder stops at the end of the JSON, so the signature after
+// it is not read.
+func parsePIA(r io.Reader) (*netipx.IPSet, error) {
+	var list struct {
+		Regions []struct {
+			Servers map[string][]struct {
+				IP string `json:"ip"`
+			} `json:"servers"`
+		} `json:"regions"`
+	}
+
+	err := json.NewDecoder(r).Decode(&list)
+	if err != nil {
+		return nil, err
+	}
+
+	var texts []string
+
+	for _, region := range list.Regions {
+		for _, servers := range region.Servers {
+			for _, server := range servers {
+				texts = append(texts, server.IP)
+			}
+		}
+	}
+
+	return addressSet(texts)
+}
+
+// parseIVPN returns the addresses of the hosts in an IVPN document. A host's
+// ipv6 object holds only an address inside the VPN, so it is not read.
+func parseIVPN(r io.Reader) (*netipx.IPSet, error) {
+	type gateway struct {
+		Hosts []struct {
+			Host  string `json:"host"`
+			V2Ray string `json:"v2ray"`
+		} `json:"hosts"`
+	}
+
+	var list struct {
+		WireGuard []gateway `json:"wireguard"`
+		OpenVPN   []gateway `json:"openvpn"`
+	}
+
+	err := readJSON(r, &list)
+	if err != nil {
+		return nil, err
+	}
+
+	var texts []string
+
+	for _, gw := range slices.Concat(list.WireGuard, list.OpenVPN) {
+		for _, host := range gw.Hosts {
+			texts = append(texts, host.Host, host.V2Ray)
+		}
+	}
+
+	return addressSet(texts)
+}
+
+// parseProtonVPN returns the addresses or networks in a ProtonVPN-IPs list. A
+// file with no addresses or networks fails, because the service always has
+// servers.
+func parseProtonVPN(r io.Reader) (*netipx.IPSet, error) {
+	addresses, err := parseLines(r, addAddressOrNetwork)
+	if err != nil {
+		return nil, err
+	}
+
+	if len(addresses.Ranges()) == 0 {
+		return nil, errNoAddresses
+	}
+
+	return addresses, nil
+}
+
+// readJSON reads r to its end and decodes it, as one JSON document, into v.
+func readJSON(r io.Reader, v any) error {
+	data, err := io.ReadAll(r)
+	if err != nil {
+		return err
+	}
+
+	return json.Unmarshal(data, v)
+}
+
+// addressSet returns the set of the addresses in texts, skipping empty ones.
+// A list with no addresses fails, because every VPN service has servers.
+func addressSet(texts []string) (*netipx.IPSet, error) {
+	var builder netipx.IPSetBuilder
+
+	for _, text := range texts {
+		if text == "" {
+			continue
+		}
+
+		err := addAddress(&builder, text)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	addresses, err := builder.IPSet()
+	if err != nil {
+		return nil, err
+	}
+
+	if len(addresses.Ranges()) == 0 {
+		return nil, errNoAddresses
+	}
+
+	return addresses, nil
+}
+
+// addAddress adds an address, such as 192.0.2.1, to builder.
+func addAddress(builder *netipx.IPSetBuilder, text string) error {
+	addr, err := netip.ParseAddr(text)
+	if err != nil {
+		return err
+	}
+
+	builder.Add(addr)
+
+	return nil
+}
+
+// addAddressWithPort adds the address of text, such as 192.0.2.1:443 or
+// [2001:db8::1]:443, to builder. Onionoo allows a list of ports after the
+// address, so the part after the address is not read.
+func addAddressWithPort(builder *netipx.IPSetBuilder, text string) error {
+	host, _, err := net.SplitHostPort(text)
+	if err != nil {
+		return err
+	}
+
+	return addAddress(builder, host)
+}

internal/server/handlers.go

@@ -781,6 +781,10 @@ type IPLookupResult struct {
 
 	Flags IPLookupFlags `json:"flags"`
 
+	// VPNProviders names the VPN lists the address is on. It is empty, never
+	// nil, when there are none.
+	VPNProviders []string `json:"vpn_providers"`
+
 	// IPLists has one entry for each IP list the address is on.
 	IPLists []iplist.Listing `json:"ip_lists"`
 }
@@ -793,6 +797,9 @@ type IPLookupFlags struct {
 	// IsTor says that the address is on the Tor exit list.
 	IsTor bool `json:"is_tor"`
 
+	// IsVPN says that the address is on a list of VPN servers.
+	IsVPN bool `json:"is_vpn"`
+
 	// IsBogon says that the address is reserved, as package bogon tells.
 	IsBogon bool `json:"is_bogon"`
 }
@@ -977,14 +984,30 @@ func (s *Server) ipLookupResult(ip string, ptrs []string, info IPInfo) IPLookupR
 	listings := s.ipListListings(ip)
 
 	return IPLookupResult{
-		IP:      ip,
-		PTR:     ptrs,
-		IPInfo:  info,
-		Flags:   ipLookupFlags(ip, listings),
-		IPLists: listings,
+		IP:           ip,
+		PTR:          ptrs,
+		IPInfo:       info,
+		Flags:        ipLookupFlags(ip, listings),
+		VPNProviders: vpnProviders(listings),
+		IPLists:      listings,
 	}
 }
 
+// vpnProviders returns the names of the VPN lists among listings. It returns
+// an empty list, never nil, so that an answer's vpn_providers is [] rather
+// than null.
+func vpnProviders(listings []iplist.Listing) []string {
+	names := []string{}
+
+	for _, listing := range listings {
+		if listing.VPN {
+			names = append(names, listing.Name)
+		}
+	}
+
+	return names
+}
+
 // ipListListings returns the IP lists that contain ip. It returns an empty
 // list, never nil, so that an answer's ip_lists is [] rather than null.
 func (s *Server) ipListListings(ip string) []iplist.Listing {
@@ -1002,6 +1025,9 @@ func ipLookupFlags(ip string, listings []iplist.Listing) IPLookupFlags {
 		IsTor: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
 			return l.Name == iplist.TorExitsList
 		}),
+		IsVPN: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
+			return l.VPN
+		}),
 		IsBogon: isBogon(ip),
 	}
 }

internal/server/handlers_internal_test.go

@@ -17,6 +17,7 @@ import (
 	"strings"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"git.eeqj.de/sneak/routewatch/internal/config"
@@ -173,6 +174,9 @@ type tableStats struct {
 // carried 203.0.113.0/24, the two with kept routes withdrew it, so its origin
 // keeps no route. The oldest and newest routes are those of the other two
 // prefixes.
+//
+// The requests run in a synctest bubble, whose clock is fake, so a stall on
+// the host does not use up the handlers' 4-second limit.
 func TestStatsHandlersAnswerFromMemory(t *testing.T) {
 	t.Parallel()
 
@@ -218,7 +222,11 @@ func TestStatsHandlersAnswerFromMemory(t *testing.T) {
 
 	for name, handler := range handlers {
 		rec := httptest.NewRecorder()
-		handler(rec, httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil))
+
+		synctest.Test(t, func(t *testing.T) {
+			handler(rec,
+				httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/", nil))
+		})
 
 		if rec.Code != http.StatusOK {
 			t.Errorf("%s: status %d, want %d; body %s",
@@ -253,15 +261,20 @@ func TestStatsHandlersAnswerFromMemory(t *testing.T) {
 // TestStatsAnswerCarriesChurnPerMinute checks that the stream object of the
 // /api/v1/stats answer holds route_churn_per_min as a whole number, and no
 // longer route_churn_per_sec, the moving average it replaces
-// (https://git.eeqj.de/sneak/routewatch/issues/160).
+// (https://git.eeqj.de/sneak/routewatch/issues/160). The request runs in a
+// synctest bubble, whose clock is fake, so a stall on the host does not use up
+// the handler's 4-second limit.
 func TestStatsAnswerCarriesChurnPerMinute(t *testing.T) {
 	t.Parallel()
 
 	s := newServerWithTestRoutes(t)
 
 	rec := httptest.NewRecorder()
-	s.handleStats()(rec,
-		httptest.NewRequestWithContext(t.Context(), http.MethodGet, statsPath, nil))
+
+	synctest.Test(t, func(t *testing.T) {
+		s.handleStats()(rec,
+			httptest.NewRequestWithContext(t.Context(), http.MethodGet, statsPath, nil))
+	})
 
 	if rec.Code != http.StatusOK {
 		t.Fatalf("status %d, want %d; body %s", rec.Code, http.StatusOK, rec.Body)
@@ -309,18 +322,26 @@ func (heldBackHandler) HeldBackCount() int                 { return heldBackMess
 
 // TestStatsAnswerGivesHowManyMessagesAHandlerHoldsBack registers a handler
 // that holds back messages. Its figures in /api/v1/stats, which the status
-// page shows, must give how many.
+// page shows, must give how many. The request runs in a synctest bubble, whose
+// clock is fake, so a stall on the host does not use up the handler's 4-second
+// limit.
 func TestStatsAnswerGivesHowManyMessagesAHandlerHoldsBack(t *testing.T) {
 	t.Parallel()
 
 	s := newServerWithTestRoutes(t)
 	s.streamer.RegisterHandler(heldBackHandler{})
 
+	var answer []byte
+
+	synctest.Test(t, func(t *testing.T) {
+		answer = get(t, s, statsPath).Body.Bytes()
+	})
+
 	var body struct {
 		Data StatsResponse `json:"data"`
 	}
 
-	err := json.Unmarshal(get(t, s, statsPath).Body.Bytes(), &body)
+	err := json.Unmarshal(answer, &body)
 	if err != nil {
 		t.Fatalf("decoding the answer: %v", err)
 	}
@@ -364,7 +385,9 @@ type unitStats struct {
 // names. They used to be strings with the unit in them, such as "1h18m34s" or
 // "1.1 GB" (https://git.eeqj.de/sneak/routewatch/issues/199). The stream has
 // never connected, so the uptime is 0. The memory use in /api/v1/stats is the
-// same number of bytes as its gc.heap_alloc_bytes.
+// same number of bytes as its gc.heap_alloc_bytes. The requests run in a
+// synctest bubble, whose clock is fake, so a stall on the host does not use up
+// the handlers' 4-second limit.
 func TestStatsAnswersGiveUnitsInFieldNames(t *testing.T) {
 	t.Parallel()
 
@@ -374,7 +397,11 @@ func TestStatsAnswersGiveUnitsInFieldNames(t *testing.T) {
 	s.SetASNFetcher(fixedIntervalASNFetcher{interval: fetchInterval})
 
 	for _, path := range []string{statusJSONPath, statsPath} {
-		answer := get(t, s, path).Body.Bytes()
+		var answer []byte
+
+		synctest.Test(t, func(t *testing.T) {
+			answer = get(t, s, path).Body.Bytes()
+		})
 
 		var body struct {
 			Data unitStats `json:"data"`
@@ -415,82 +442,89 @@ func TestStatsAnswersGiveUnitsInFieldNames(t *testing.T) {
 // connection_duration_seconds of /api/v1/stats is null while the stream is not
 // connected, and a whole number of seconds once it is. It used to be the
 // string "disconnected", or a Go duration such as "1h18m34s"
-// (https://git.eeqj.de/sneak/routewatch/issues/199).
+// (https://git.eeqj.de/sneak/routewatch/issues/199). The test runs in a
+// synctest bubble, whose clock is fake, so a stall on the host does not use up
+// the handler's 4-second limit.
 func TestStatsAnswerGivesConnectionDurationInSeconds(t *testing.T) {
 	t.Parallel()
 
 	s := newServerWithTestRoutes(t)
 
-	connectionDuration := func() json.RawMessage {
-		answer := get(t, s, statsPath).Body.Bytes()
+	synctest.Test(t, func(t *testing.T) {
+		connectionDuration := func() json.RawMessage {
+			answer := get(t, s, statsPath).Body.Bytes()
 
-		var body struct {
-			Data map[string]json.RawMessage `json:"data"`
+			var body struct {
+				Data map[string]json.RawMessage `json:"data"`
+			}
+
+			err := json.Unmarshal(answer, &body)
+			if err != nil {
+				t.Fatalf("decoding the answer: %v; answer %s", err, answer)
+			}
+
+			duration, ok := body.Data["connection_duration_seconds"]
+			if !ok {
+				t.Fatalf("no connection_duration_seconds: %s", answer)
+			}
+
+			return duration
 		}
 
-		err := json.Unmarshal(answer, &body)
-		if err != nil {
-			t.Fatalf("decoding the answer: %v; answer %s", err, answer)
+		disconnected := connectionDuration()
+		if string(disconnected) != "null" {
+			t.Errorf("disconnected: connection_duration_seconds = %s, want null",
+				disconnected)
 		}
 
-		duration, ok := body.Data["connection_duration_seconds"]
-		if !ok {
-			t.Fatalf("no connection_duration_seconds: %s", answer)
+		s.streamer.GetMetricsTracker().SetConnected(true)
+
+		var seconds int64
+
+		connected := connectionDuration()
+
+		err := json.Unmarshal(connected, &seconds)
+		if err != nil || seconds != 0 {
+			t.Errorf("just connected: connection_duration_seconds = %s, want 0",
+				connected)
 		}
-
-		return duration
-	}
-
-	disconnected := connectionDuration()
-	if string(disconnected) != "null" {
-		t.Errorf("disconnected: connection_duration_seconds = %s, want null",
-			disconnected)
-	}
-
-	s.streamer.GetMetricsTracker().SetConnected(true)
-
-	var seconds int64
-
-	connected := connectionDuration()
-
-	err := json.Unmarshal(connected, &seconds)
-	if err != nil || seconds != 0 {
-		t.Errorf("just connected: connection_duration_seconds = %s, want 0",
-			connected)
-	}
+	})
 }
 
 // TestStreamDurationsCountSeconds checks that the uptime and the connection
 // duration of a stream that connected 90 seconds ago are both 90. A stream
 // that has never connected has an uptime of 0, and one that is not connected
-// has no connection duration.
+// has no connection duration. The test runs in a synctest bubble, whose clock
+// is fake, so a stall on the host does not add to the 90 seconds.
 func TestStreamDurationsCountSeconds(t *testing.T) {
 	t.Parallel()
 
-	const connectedFor = 90 * time.Second
+	synctest.Test(t, func(t *testing.T) {
+		const connectedFor = 90 * time.Second
 
-	connectedSince := time.Now().Add(-connectedFor)
-	want := int64(connectedFor / time.Second)
+		connectedSince := time.Now().Add(-connectedFor)
+		want := int64(connectedFor / time.Second)
 
-	if got := uptimeSeconds(connectedSince); got != want {
-		t.Errorf("uptimeSeconds = %d, want %d", got, want)
-	}
+		if got := uptimeSeconds(connectedSince); got != want {
+			t.Errorf("uptimeSeconds = %d, want %d", got, want)
+		}
 
-	if got := uptimeSeconds(time.Time{}); got != 0 {
-		t.Errorf("uptimeSeconds before any connection = %d, want 0", got)
-	}
+		if got := uptimeSeconds(time.Time{}); got != 0 {
+			t.Errorf("uptimeSeconds before any connection = %d, want 0", got)
+		}
 
-	switch got := connectionDurationSeconds(true, connectedSince); {
-	case got == nil:
-		t.Errorf("connectionDurationSeconds = nil, want %d", want)
-	case *got != want:
-		t.Errorf("connectionDurationSeconds = %d, want %d", *got, want)
-	}
+		switch got := connectionDurationSeconds(true, connectedSince); {
+		case got == nil:
+			t.Errorf("connectionDurationSeconds = nil, want %d", want)
+		case *got != want:
+			t.Errorf("connectionDurationSeconds = %d, want %d", *got, want)
+		}
 
-	if got := connectionDurationSeconds(false, connectedSince); got != nil {
-		t.Errorf("connectionDurationSeconds while not connected = %d, want nil",
-			*got)
-	}
+		if got := connectionDurationSeconds(false, connectedSince); got != nil {
+			t.Errorf("connectionDurationSeconds while not connected = %d, want nil",
+				*got)
+		}
+	})
 }
 
 // newTestTable returns a routing table that holds a route for testPrefixV4,
@@ -1134,7 +1168,9 @@ func (failingDB) GetPrefixFirstSeen(
 // with the driver's error text. It also sends a prefix that does not parse.
 // No answer may carry the driver's or the prefix parser's text. Before the fix
 // the answers sent it to the client
-// (https://git.eeqj.de/sneak/routewatch/issues/108).
+// (https://git.eeqj.de/sneak/routewatch/issues/108). The requests run in a
+// synctest bubble, whose clock is fake, so a stall on the host does not use up
+// the stats handlers' 4-second limit.
 func TestJSONRoutesDoNotSendErrorDetails(t *testing.T) {
 	t.Parallel()
 
@@ -1155,8 +1191,11 @@ func TestJSONRoutesDoNotSendErrorDetails(t *testing.T) {
 
 	for _, tt := range tests {
 		rec := httptest.NewRecorder()
-		s.router.ServeHTTP(rec, httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, tt.path, nil))
+
+		synctest.Test(t, func(t *testing.T) {
+			s.router.ServeHTTP(rec, httptest.NewRequestWithContext(
+				t.Context(), http.MethodGet, tt.path, nil))
+		})
 
 		if rec.Code != tt.wantCode {
 			t.Errorf("%s: status %d, want %d; body %s",
@@ -1397,8 +1436,11 @@ func TestIPLookupKeepsRouteWhenPTRLookupDoesNotAnswer(t *testing.T) {
 	s := newServerWithTestRoutes(t)
 	s.resolver = &fakeResolver{ptrNeverAnswers: true}
 
-	// The request's time limit passes after the PTR lookup's.
-	ctx, cancel := context.WithTimeout(t.Context(), 2*ptrLookupTimeout)
+	// The request's time limit passes well after the PTR lookup's, so that a
+	// stall on a busy host does not use up the difference.
+	const requestTimeLimit = ptrLookupTimeout + 15*time.Second
+
+	ctx, cancel := context.WithTimeout(t.Context(), requestTimeLimit)
 	defer cancel()
 
 	rec := httptest.NewRecorder()
@@ -1441,8 +1483,19 @@ const listedUnroutedAddr = "203.0.113.1"
 // torExitAddr is the address that fakeIPLists lists on the Tor exit list.
 const torExitAddr = "203.0.113.2"
 
-// fakeIPLists has two lists. The test list holds addrInTestPrefixV4 and
-// listedUnroutedAddr, and the Tor exit list holds torExitAddr.
+// The addresses that fakeIPLists lists on one and on two VPN lists, and the
+// names of those lists.
+const (
+	oneVPNListAddr  = "203.0.113.3"
+	twoVPNListsAddr = "203.0.113.4"
+	testVPNList     = "test_vpn"
+	otherTestVPN    = "other_test_vpn"
+)
+
+// fakeIPLists has four lists. The test list holds addrInTestPrefixV4,
+// listedUnroutedAddr and twoVPNListsAddr. The Tor exit list holds torExitAddr.
+// The test VPN list holds oneVPNListAddr and twoVPNListsAddr, and the other
+// test VPN list holds twoVPNListsAddr.
 type fakeIPLists struct{}
 
 func testListing() iplist.Listing {
@@ -1463,6 +1516,18 @@ func (fakeIPLists) Lookup(addr netip.Addr) []iplist.Listing {
 		return []iplist.Listing{{Name: iplist.TorExitsList}}
 	}
 
+	if addr == netip.MustParseAddr(oneVPNListAddr) {
+		return []iplist.Listing{{Name: testVPNList, VPN: true}}
+	}
+
+	if addr == netip.MustParseAddr(twoVPNListsAddr) {
+		return []iplist.Listing{
+			{Name: otherTestVPN, VPN: true},
+			testListing(),
+			{Name: testVPNList, VPN: true},
+		}
+	}
+
 	return []iplist.Listing{}
 }
 
@@ -1471,7 +1536,7 @@ func (fakeIPLists) ShortestInterval() time.Duration {
 }
 
 // TestIPLookupFlags looks up addresses with and without a route. Every result
-// has both flags, under the JSON keys the API documents.
+// has every flag, under the JSON keys the API documents.
 func TestIPLookupFlags(t *testing.T) {
 	t.Parallel()
 
@@ -1517,7 +1582,9 @@ func TestIPLookupFlags(t *testing.T) {
 				t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
 			}
 
-			want := map[string]bool{"is_tor": tt.tor, "is_bogon": tt.bogon}
+			want := map[string]bool{
+				"is_tor": tt.tor, "is_vpn": false, "is_bogon": tt.bogon,
+			}
 			if !maps.Equal(got, want) {
 				t.Errorf("%s: flags %v, want %v", path, got, want)
 			}
@@ -1525,6 +1592,61 @@ func TestIPLookupFlags(t *testing.T) {
 	}
 }
 
+// TestIPLookupReportsVPNProviders looks up addresses on no list, on a list
+// that is not a VPN list, on one VPN list and on two. is_vpn says whether any
+// VPN list holds the address, and vpn_providers names only those lists. An
+// address on none has [], not null.
+func TestIPLookupReportsVPNProviders(t *testing.T) {
+	t.Parallel()
+
+	s := newServerWithTestRoutes(t)
+	s.resolver = &fakeResolver{}
+	s.SetIPLists(fakeIPLists{})
+
+	tests := []struct {
+		name      string
+		addr      string
+		isVPN     string
+		providers string
+	}{
+		{"on no list", "1.1.1.1", "false", `[]`},
+		{"on a list that is not a VPN list", listedUnroutedAddr, "false", `[]`},
+		{"on one VPN list", oneVPNListAddr, "true", `["` + testVPNList + `"]`},
+		{
+			"on two VPN lists", twoVPNListsAddr, "true",
+			`["` + otherTestVPN + `","` + testVPNList + `"]`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			path := "/api/v1/ip/" + tt.addr
+
+			results := resultFields(t, get(t, s, path).Body.Bytes())
+			if len(results) != 1 {
+				t.Fatalf("%s: %d results, want 1", path, len(results))
+			}
+
+			var flags map[string]json.RawMessage
+
+			err := json.Unmarshal(results[0]["flags"], &flags)
+			if err != nil {
+				t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
+			}
+
+			if got := string(flags["is_vpn"]); got != tt.isVPN {
+				t.Errorf("%s: is_vpn %s, want %s", path, got, tt.isVPN)
+			}
+
+			if got := string(results[0]["vpn_providers"]); got != tt.providers {
+				t.Errorf("%s: vpn_providers %s, want %s", path, got, tt.providers)
+			}
+		})
+	}
+}
+
 // TestIPLookupReportsIPLists looks up two routed addresses, one of them on an
 // IP list. The listed address's result names the list, says what it means and
 // when it was updated. The other's result has an empty list.
@@ -2287,9 +2409,13 @@ func settledGoroutineCount() int {
 	return prev
 }
 
-// waitForGoroutines waits until the goroutine count drops to target or below.
+// waitForGoroutines waits up to 15 seconds for the goroutine count to drop to
+// target or below.
 func waitForGoroutines(target int) bool {
-	for range 100 {
+	const maxWait = 15 * time.Second
+
+	deadline := time.Now().Add(maxWait)
+	for time.Now().Before(deadline) {
 		if runtime.NumGoroutine() <= target {
 			return true
 		}

internal/server/home_internal_test.go

@@ -76,7 +76,9 @@ func asLink(asn int) string {
 }
 
 // TestHomePageCardsShowTheTableFigures fills a routing table and the asns
-// table, works out the cards, and checks that each card shows its figure.
+// table, works out the cards, and checks that each card shows its figure. The
+// cards are worked out in a synctest bubble, whose clock is fake, so a stall on
+// the host does not use up the 4-second limit on their database read.
 func TestHomePageCardsShowTheTableFigures(t *testing.T) {
 	t.Parallel()
 
@@ -95,7 +97,9 @@ func TestHomePageCardsShowTheTableFigures(t *testing.T) {
 		t.Fatalf("GetOrCreateASNBatch: %v", err)
 	}
 
-	s.refreshHomeCards(t.Context())
+	synctest.Test(t, func(t *testing.T) {
+		s.refreshHomeCards(t.Context())
+	})
 
 	page := get(t, s, "/").Body.String()
 
@@ -279,7 +283,7 @@ func TestKeepHomeCardsFreshWorksThemOutEveryInterval(t *testing.T) {
 
 	const (
 		interval = 10 * time.Millisecond
-		maxWait  = 5 * time.Second
+		maxWait  = 15 * time.Second
 	)
 
 	table := emptyTable()
@@ -321,7 +325,7 @@ func TestKeepHomeCardsFreshWorksThemOutEveryInterval(t *testing.T) {
 func TestStartedServerWorksOutTheCards(t *testing.T) {
 	t.Parallel()
 
-	const maxWait = 5 * time.Second
+	const maxWait = 15 * time.Second
 
 	s := newServerWithTable(t, newCardsTable())
 

internal/server/middleware_internal_test.go

@@ -14,6 +14,7 @@ import (
 	"regexp"
 	"strings"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"git.eeqj.de/sneak/routewatch/internal/config"
@@ -163,6 +164,10 @@ func TestJSONAnswersPutNoUnitInAString(t *testing.T) {
 // router and the middleware write. Before the fix a panic in a handler, and a
 // method /status.json or the health check does not take, answered with an
 // empty body (https://git.eeqj.de/sneak/routewatch/issues/201).
+//
+// The requests run in a synctest bubble, whose clock is fake, so a stall on
+// the host does not use up the 2-second limit of the health check or the
+// 4-second limit of the stats handlers.
 func TestJSONAnswersCarryMeta(t *testing.T) {
 	t.Parallel()
 
@@ -181,6 +186,10 @@ func TestJSONAnswersCarryMeta(t *testing.T) {
 	s.router.Get(panicsPath, JSONValidationMiddleware(http.HandlerFunc(
 		func(http.ResponseWriter, *http.Request) { panic(errDiskIO) })).ServeHTTP)
 
+	failing := New(failingDB{}, newTestTable(),
+		streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
+	failing.resolver = &fakeResolver{}
+
 	tests := []struct {
 		method   string
 		path     string
@@ -216,42 +225,40 @@ func TestJSONAnswersCarryMeta(t *testing.T) {
 		{http.MethodGet, panicsPath, http.StatusInternalServerError},
 	}
 
-	for _, tt := range tests {
-		checkAnswerCarriesMeta(t, s, httptest.NewRequestWithContext(
-			t.Context(), tt.method, tt.path, nil), tt.wantCode)
-	}
+	synctest.Test(t, func(t *testing.T) {
+		for _, tt := range tests {
+			checkAnswerCarriesMeta(t, s, httptest.NewRequestWithContext(
+				t.Context(), tt.method, tt.path, nil), tt.wantCode)
+		}
 
-	// A request whose time limit has already passed answers 504. The handlers
-	// write the answers of the first five routes, and the JSON check on the
-	// route writes the last.
-	pastTimeLimit, cancel := context.WithDeadline(t.Context(), time.Now())
-	defer cancel()
+		// A request whose time limit has already passed answers 504. The
+		// handlers write the answers of the first five routes, and the JSON
+		// check on the route writes the last.
+		pastTimeLimit, cancel := context.WithDeadline(t.Context(), time.Now())
+		defer cancel()
 
-	for _, path := range []string{
-		statusJSONPath, statsPath, "/ip/" + addrInTestPrefixV4,
-		"/api/v1/ip/" + addrInTestPrefixV4, asJSONPath, writesNothingPath,
-	} {
-		checkAnswerCarriesMeta(t, s, httptest.NewRequestWithContext(
-			pastTimeLimit, http.MethodGet, path, nil), http.StatusGatewayTimeout)
-	}
+		for _, path := range []string{
+			statusJSONPath, statsPath, "/ip/" + addrInTestPrefixV4,
+			"/api/v1/ip/" + addrInTestPrefixV4, asJSONPath, writesNothingPath,
+		} {
+			checkAnswerCarriesMeta(t, s, httptest.NewRequestWithContext(
+				pastTimeLimit, http.MethodGet, path, nil), http.StatusGatewayTimeout)
+		}
 
-	// With a store whose reads fail, the health check answers 503, and the
-	// handlers of the other routes 500.
-	failing := New(failingDB{}, newTestTable(),
-		streamer.New(logger.New(), metrics.New()), logger.New(), &config.Config{})
-	failing.resolver = &fakeResolver{}
-
-	checkAnswerCarriesMeta(t, failing, httptest.NewRequestWithContext(
-		t.Context(), http.MethodGet, healthCheckPath, nil),
-		http.StatusServiceUnavailable)
-
-	for _, path := range []string{
-		statusJSONPath, statsPath, asJSONPath,
-		"/api/v1/ip/" + addrInTestPrefixV4, "/ip/" + addrInTestPrefixV4,
-	} {
+		// With a store whose reads fail, the health check answers 503, and
+		// the handlers of the other routes 500.
 		checkAnswerCarriesMeta(t, failing, httptest.NewRequestWithContext(
-			t.Context(), http.MethodGet, path, nil), http.StatusInternalServerError)
-	}
+			t.Context(), http.MethodGet, healthCheckPath, nil),
+			http.StatusServiceUnavailable)
+
+		for _, path := range []string{
+			statusJSONPath, statsPath, asJSONPath,
+			"/api/v1/ip/" + addrInTestPrefixV4, "/ip/" + addrInTestPrefixV4,
+		} {
+			checkAnswerCarriesMeta(t, failing, httptest.NewRequestWithContext(
+				t.Context(), http.MethodGet, path, nil), http.StatusInternalServerError)
+		}
+	})
 }
 
 // checkAnswerCarriesMeta serves req through the server's router, and checks

internal/server/routes_internal_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"testing"
+	"testing/synctest"
 )
 
 // TestRoutesAnswerHEAD sends HEAD for a page and JSON routes through the
@@ -12,15 +13,23 @@ import (
 // lookup of the caller's own address, are in the list because chi's GetHead
 // does not reach them. Before the fix every route answered HEAD with 405
 // (https://git.eeqj.de/sneak/routewatch/issues/111).
+//
+// The requests run in a synctest bubble, whose clock is fake, so a stall on
+// the host does not use up the stats handlers' 4-second limit. The resolver
+// is fake because no time limit would cut off a real DNS lookup in a bubble.
 func TestRoutesAnswerHEAD(t *testing.T) {
 	t.Parallel()
 
 	s := newServerWithTestRoutes(t)
+	s.resolver = &fakeResolver{}
 
 	for _, path := range []string{"/", statusJSONPath, statsPath, "/ip", "/ip/"} {
 		rec := httptest.NewRecorder()
-		s.router.ServeHTTP(rec, httptest.NewRequestWithContext(
-			t.Context(), http.MethodHead, path, nil))
+
+		synctest.Test(t, func(t *testing.T) {
+			s.router.ServeHTTP(rec, httptest.NewRequestWithContext(
+				t.Context(), http.MethodHead, path, nil))
+		})
 
 		if rec.Code != http.StatusOK {
 			t.Errorf("HEAD %s: status %d, want %d; body %s",

internal/server/server_internal_test.go

@@ -22,10 +22,10 @@ func TestStopClosesTheConnectionOfARequestStillRunning(t *testing.T) {
 		stopDeadline = 100 * time.Millisecond
 		// waitTimeout is how long the test waits for the request to reach
 		// the handler, and then for the client to see its connection closed.
-		waitTimeout = 2 * time.Second
+		waitTimeout = 15 * time.Second
 		// readHeaderTimeout bounds the test server's read of the request
 		// header, as every http.Server must.
-		readHeaderTimeout = time.Second
+		readHeaderTimeout = waitTimeout
 	)
 
 	release := make(chan struct{})

internal/streamer/streamer_internal_test.go

@@ -14,6 +14,7 @@ import (
 	"strings"
 	"sync/atomic"
 	"testing"
+	"testing/synctest"
 	"time"
 
 	"git.eeqj.de/sneak/routewatch/internal/logger"
@@ -398,7 +399,7 @@ func TestStopQueuesTheHeldStateMessages(t *testing.T) {
 	const (
 		held    = 2
 		lines   = held + 1
-		maxWait = 5 * time.Second
+		maxWait = 15 * time.Second
 	)
 
 	srv := httptest.NewServer(http.HandlerFunc(
@@ -478,15 +479,15 @@ func TestStopQueuesTheHeldStateMessages(t *testing.T) {
 // TestStopReturnsByItsDeadline stops a streamer whose handler has a full queue
 // and a STATE message held for it, and a worker that stays busy until the test
 // ends, as one does whose handler waits for a database write. Stop must return
-// within its deadline plus a small margin instead of waiting for room on the
-// queue and for the worker, and log as not handed over the held message and
-// every message on the queue.
+// within its deadline plus a margin instead of waiting for room on the queue
+// and for the worker, and log as not handed over the held message and every
+// message on the queue.
 func TestStopReturnsByItsDeadline(t *testing.T) {
 	t.Parallel()
 
 	const (
 		deadline = 100 * time.Millisecond
-		margin   = 2 * time.Second
+		margin   = 15 * time.Second
 	)
 
 	var logs bytes.Buffer
@@ -577,7 +578,7 @@ func TestStopBeforeMessageReachesQueues(t *testing.T) {
 func TestReconnectWhenStreamEnds(t *testing.T) {
 	t.Parallel()
 
-	endResponse := func(http.ResponseWriter, *http.Request) {}
+	endResponse := pipeTransport{write: func(context.Context, io.Writer) {}}
 	checkReconnect(t, endResponse, streamIdleTimeout)
 }
 
@@ -589,9 +590,8 @@ func TestReconnectWhenStreamGoesIdle(t *testing.T) {
 
 	const idleTimeout = 50 * time.Millisecond
 
-	holdResponse := func(w http.ResponseWriter, r *http.Request) {
-		flush(w)
-		<-r.Context().Done()
+	holdResponse := pipeTransport{
+		write: func(ctx context.Context, _ io.Writer) { <-ctx.Done() },
 	}
 	checkReconnect(t, holdResponse, idleTimeout)
 }
@@ -604,16 +604,51 @@ func TestReconnectWhenServerNeverAnswers(t *testing.T) {
 
 	const idleTimeout = 50 * time.Millisecond
 
-	neverAnswer := func(_ http.ResponseWriter, r *http.Request) {
-		<-r.Context().Done()
-	}
+	neverAnswer := roundTripFunc(
+		func(req *http.Request) (*http.Response, error) {
+			<-req.Context().Done()
+
+			return nil, req.Context().Err()
+		},
+	)
 	checkReconnect(t, neverAnswer, idleTimeout)
 }
 
-// TestStreamNotDroppedWhileLinesArrive has the server send lines well within
-// the idle timeout for several times the timeout, then end the response. Each
-// line must start the idle timeout over, so the stream lasts until the server
-// ends it instead of being dropped as idle.
+// pipeTransport answers every request with a response whose body write fills.
+// The body fails when the request's context ends, as a connection's does.
+// write gets that context, so that it can end when the request does.
+type pipeTransport struct {
+	write func(context.Context, io.Writer)
+}
+
+func (p pipeTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	body, w := io.Pipe()
+
+	context.AfterFunc(req.Context(), func() {
+		_ = w.CloseWithError(req.Context().Err())
+	})
+
+	go func(ctx context.Context) {
+		p.write(ctx, w)
+
+		_ = w.Close()
+	}(req.Context())
+
+	return &http.Response{StatusCode: http.StatusOK, Body: body}, nil
+}
+
+// roundTripFunc makes a function an http.RoundTripper.
+type roundTripFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
+// TestStreamNotDroppedWhileLinesArrive has a response send lines well within
+// the idle timeout for several times the timeout, then end. Each line must
+// start the idle timeout over, so the stream lasts until the response ends
+// instead of being dropped as idle. It runs in a synctest bubble, whose clock
+// is fake, so a stall on the host does not use up the timeout.
 func TestStreamNotDroppedWhileLinesArrive(t *testing.T) {
 	t.Parallel()
 
@@ -623,26 +658,35 @@ func TestStreamNotDroppedWhileLinesArrive(t *testing.T) {
 		sendFor      = 5 * idleTimeout
 	)
 
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, _ *http.Request) {
+	// The streamer is made outside the bubble. Its metrics start a goroutine
+	// that never returns, and a bubble waits for each of its goroutines to
+	// return.
+	s := New(logger.New(), metrics.New())
+	s.idleTimeout = idleTimeout
+	s.client = &http.Client{Transport: pipeTransport{
+		write: func(ctx context.Context, w io.Writer) {
 			deadline := time.Now().Add(sendFor)
 			for time.Now().Before(deadline) {
 				_, _ = io.WriteString(w, updateLine)
 
-				flush(w)
-				time.Sleep(lineInterval)
+				// The wait ends with the stream. A bubble's clock stops when
+				// the test function returns, and a goroutine then still
+				// asleep panics the test binary.
+				select {
+				case <-ctx.Done():
+					return
+				case <-time.After(lineInterval):
+				}
 			}
-		}))
-	defer srv.Close()
+		},
+	}}
 
-	s := New(logger.New(), metrics.New())
-	s.url = srv.URL
-	s.idleTimeout = idleTimeout
-
-	err := s.stream(context.Background())
-	if !errors.Is(err, errStreamEnded) {
-		t.Fatalf("stream returned %v, want %v", err, errStreamEnded)
-	}
+	synctest.Test(t, func(t *testing.T) {
+		err := s.stream(context.Background())
+		if !errors.Is(err, errStreamEnded) {
+			t.Fatalf("stream returned %v, want %v", err, errStreamEnded)
+		}
+	})
 }
 
 // TestStreamReadsLongLine has the server send one UPDATE line of about
@@ -706,7 +750,7 @@ func TestHandlerStatsReadWhileMessagesAreDropped(t *testing.T) {
 	const (
 		lines       = 5
 		wantDropped = lines - 2
-		maxWait     = 5 * time.Second
+		maxWait     = 15 * time.Second
 	)
 
 	srv := httptest.NewServer(http.HandlerFunc(
@@ -820,61 +864,70 @@ func streamLines(t *testing.T, s *Streamer, lines string) {
 // line and then stays open. The streamer must come back for a second
 // response, must not be marked connected when it does, and must handle the
 // UPDATE in it.
+//
+// It runs in a synctest bubble, whose clock is fake, so a stall on the host
+// does not use up the idle timeout. The fake server gets the requests in the
+// order the streamer makes them, because no real connection carries them.
 func checkReconnect(
-	t *testing.T, firstResponse http.HandlerFunc, idleTimeout time.Duration,
+	t *testing.T, firstResponse http.RoundTripper, idleTimeout time.Duration,
 ) {
 	t.Helper()
 
-	const maxWait = 5 * time.Second
+	const maxWait = 15 * time.Second
 
+	// The tracker is made outside the bubble. It starts a goroutine that never
+	// returns, and a bubble waits for each of its goroutines to return.
 	tracker := metrics.New()
-	connectedAtReconnect := make(chan bool, 1)
 
-	var requests atomic.Int32
+	synctest.Test(t, func(t *testing.T) {
+		connectedAtReconnect := make(chan bool, 1)
+		laterResponse := pipeTransport{
+			write: func(ctx context.Context, w io.Writer) {
+				_, _ = io.WriteString(w, updateLine)
 
-	srv := httptest.NewServer(http.HandlerFunc(
-		func(w http.ResponseWriter, r *http.Request) {
-			if requests.Add(1) == 1 {
-				firstResponse(w, r)
+				<-ctx.Done()
+			},
+		}
 
-				return
-			}
+		var requests atomic.Int32
 
-			select {
-			case connectedAtReconnect <- tracker.IsConnected():
-			default:
-			}
+		s := New(logger.New(), tracker)
+		s.client = &http.Client{Transport: roundTripFunc(
+			func(req *http.Request) (*http.Response, error) {
+				if requests.Add(1) == 1 {
+					return firstResponse.RoundTrip(req)
+				}
 
-			_, _ = io.WriteString(w, updateLine)
+				select {
+				case connectedAtReconnect <- tracker.IsConnected():
+				default:
+				}
 
-			flush(w)
-			<-r.Context().Done()
-		}))
-	defer srv.Close()
+				return laterResponse.RoundTrip(req)
+			},
+		)}
+		s.idleTimeout = idleTimeout
+		s.minBackoff = time.Millisecond
+		handler := updateHandler{handled: make(chan struct{}, 1)}
+		s.RegisterHandler(handler)
 
-	s := New(logger.New(), tracker)
-	s.url = srv.URL
-	s.idleTimeout = idleTimeout
-	s.minBackoff = time.Millisecond
-	handler := updateHandler{handled: make(chan struct{}, 1)}
-	s.RegisterHandler(handler)
+		err := s.Start(t.Context())
+		if err != nil {
+			t.Fatalf("Start returned error: %v", err)
+		}
+		defer s.Stop(t.Context())
 
-	err := s.Start(t.Context())
-	if err != nil {
-		t.Fatalf("Start returned error: %v", err)
-	}
-	defer s.Stop(t.Context())
+		select {
+		case <-handler.handled:
+		case <-time.After(maxWait):
+			t.Fatalf("no message from a second response handled within %s", maxWait)
+		}
 
-	select {
-	case <-handler.handled:
-	case <-time.After(maxWait):
-		t.Fatalf("no message from a second response handled within %s", maxWait)
-	}
-
-	if <-connectedAtReconnect {
-		t.Error("streamer was still marked connected when it came back " +
-			"for a second response")
-	}
+		if <-connectedAtReconnect {
+			t.Error("streamer was still marked connected when it came back " +
+				"for a second response")
+		}
+	})
 }
 
 // settledGoroutineCount lets transient goroutines finish, then reports the
@@ -896,9 +949,13 @@ func settledGoroutineCount() int {
 	return prev
 }
 
-// waitForGoroutines waits until the goroutine count drops to target or below.
+// waitForGoroutines waits up to 15 seconds for the goroutine count to drop to
+// target or below.
 func waitForGoroutines(target int) bool {
-	for range 100 {
+	const maxWait = 15 * time.Second
+
+	deadline := time.Now().Add(maxWait)
+	for time.Now().Before(deadline) {
 		if runtime.NumGoroutine() <= target {
 			return true
 		}