Improve HTTP service IP and host validation error messages (#33450)

Co-authored-by: Nick Misasi <nick.misasi@mattermost.com>

server/public/shared/httpservice/httpservice.go

@@ -4,6 +4,7 @@
 package httpservice
 
 import (
+	"fmt"
 	"net"
 	"net/http"
 	"slices"
@@ -84,31 +85,31 @@ func (h *HTTPServiceImpl) MakeTransport(trustURLs bool) *MattermostTransport {
 		return slices.Contains(strings.FieldsFunc(*h.configService.Config().ServiceSettings.AllowedUntrustedInternalConnections, splitFields), host)
 	}
 
-	allowIP := func(ip net.IP) bool {
+	allowIP := func(ip net.IP) error {
 		reservedIP := IsReservedIP(ip)
-		ownIP, err := IsOwnIP(ip)
 
-		// If there is an error getting the self-assigned IPs, default to the secure option
+		ownIP, err := IsOwnIP(ip)
 		if err != nil {
-			return false
+			// If there is an error getting the self-assigned IPs, default to the secure option
+			return fmt.Errorf("unable to determine if IP is own IP: %w", err)
 		}
 
 		// If it's not a reserved IP and it's not self-assigned IP, accept the IP
 		if !reservedIP && !ownIP {
-			return true
-		}
-
-		if h.configService.Config().ServiceSettings.AllowedUntrustedInternalConnections == nil {
-			return false
+			return nil
 		}
 
 		// In the case it's the self-assigned IP, enforce that it needs to be explicitly added to the AllowedUntrustedInternalConnections
-		for _, allowed := range strings.FieldsFunc(*h.configService.Config().ServiceSettings.AllowedUntrustedInternalConnections, splitFields) {
+		for _, allowed := range strings.FieldsFunc(model.SafeDereference(h.configService.Config().ServiceSettings.AllowedUntrustedInternalConnections), splitFields) {
 			if _, ipRange, err := net.ParseCIDR(allowed); err == nil && ipRange.Contains(ip) {
-				return true
+				return nil
 			}
 		}
-		return false
+
+		if reservedIP {
+			return fmt.Errorf("IP %s is in a reserved range and not in AllowedUntrustedInternalConnections", ip)
+		}
+		return fmt.Errorf("IP %s is a self-assigned IP and not in AllowedUntrustedInternalConnections", ip)
 	}
 
 	return NewTransport(insecure, allowHost, allowIP)