code: func (f *fetcher) fetchFromHost(ip net.IP, url, contentType string) ([]byte, error) {
  	// TODO(angusc): connection timeout?
  	tcpAddr := &net.TCPAddr{IP: ip, Port: f.port}
  	tcpConn, err := net.DialTCP("tcp", nil, tcpAddr)
  	if err != nil {
  		return nil, err
  	}
  	defer tcpConn.Close()
  	tcpConn.SetDeadline(time.Now().Add(f.timeout))
  	dialer := func(net string, addr string) (net.Conn, error) {
  		return tcpConn, nil
  	}
  
  	client := &http.Client{
  		CheckRedirect: func(req *http.Request, via []*http.Request) error {
  			return errors.New("HTTP redirect prohibited")
  		},
  		Transport: &http.Transport{
  			Dial:              dialer,
  			DisableKeepAlives: true,
  			TLSClientConfig: &tls.Config{
  				RootCAs: f.certs,
  			},
  		},
  	}
  
  	req, err := http.NewRequest("GET", url, nil)
  	if err != nil {
  		return nil, err
  	}
  	req.Header.Add("Connection", "close")
  
  	resp, err := client.Do(req)
  	if err != nil {
  		return nil, err
  	}
  	defer resp.Body.Close()
  	if resp.StatusCode != http.StatusOK {
  		return nil, fmt.Errorf("received HTTP status %s", resp.Status)
  	}
  	if ct := resp.Header.Get("Content-Type"); ct != contentType {
  		return nil, fmt.Errorf("unexpected Content-Type: %q", ct)
  	}
  	return ioutil.ReadAll(resp.Body)
  }
docs: // fetchFromHost attempts to fetch the specified URL from a specific host.