fix(dialer): enforce IP block list before socket creation

[yeikel]

What are you trying to accomplish?

The blocked-IP check in safeControl runs after the OS creates the socket. On systems where a network family is unsupported (e.g. IPv6 disabled), socket creation fails first with "address family not supported by protocol" safeControl is never reached, so ErrForbiddenRequest is never returned and handleForbidden can't produce a 403.

Fix by checking resolved IPs against the block list inside DialContext, before net.Dialer.DialContext is called. safeControl is kept as a defence-in-depth fallback for any path that bypasses DialContext.

Fixes TestIPRestrictions/http://[::1]/ on CI runners without IPv6.

Anything you want to highlight for special attention from reviewers?

This only happens on self hosted runners that do not support IPv6 so it is difficult to provide a reproducer or test here

How will you know you've accomplished your goal?

Hosts without IPV6 support continue to work

Checklist

• I have run the complete test suite to ensure all tests and linters pass.
• I have thoroughly tested my code changes to ensure they work as expected, including adding additional tests for new functionality.
• I have written clear and descriptive commit messages.
• I have provided a detailed description of the changes in the pull request, including the problem it addresses, how it fixes the problem, and any relevant details about the implementation.
• I have ensured that the code is well-documented and easy to understand.

[Copilot]

Pull request overview

This PR updates the proxy’s custom internal/dialer.Dialer to enforce the blocked-IP list before attempting to create a socket, so requests to blocked addresses (notably ::1 on hosts without IPv6 support) reliably surface as ErrForbiddenRequest and can be converted into an HTTP 403 by the proxy’s forbidden handler.

Changes:

• Persist the blocked IP list on the Dialer instance.
• Add a pre-dial check in DialContext to compare resolved IPs against the blocked list before calling into net.Dialer.DialContext.

Show a summary per file

File	Description
internal/dialer/dialer.go	Adds blocked IP storage on the dialer and performs blocked-IP checks prior to dialing to ensure forbidden requests are detected even when socket creation would fail first.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 1

[yeikel]

I just noticed that there are some test failures but these failures are just related to dependabot/smoke-tests#277

[yeikel]

I re-generated the tests here dependabot/smoke-tests#522