v0.22.0 several enhancements and fixes for security, network, doc, test, packaging

internal/core/const.go

@@ -1,9 +1,31 @@
 package core
 
 import (
+	"fmt"
+	"net/netip"
+	"strings"
 	"time"
 )
 
+// Network is what a listener on, or a dialer to, host uses: tcp4 for an IPv4
+// literal or "" (the IPv4 wildcard, as the default 0.0.0.0), tcp6 for an IPv6
+// literal, which Go binds IPv6-only, and tcp for a hostname, which resolves.
+func Network(host string) (string, error) {
+	addr, err := netip.ParseAddr(host)
+	switch {
+	case host == "" || err == nil && addr.Is4():
+		return "tcp4", nil
+	case err == nil && addr.Is4In6():
+		// tcp6 refuses it at bind or dial, long after the config loaded
+		return "", fmt.Errorf("%q is an IPv4-mapped address; write it as IPv4", host)
+	case err == nil:
+		return "tcp6", nil
+	case strings.ContainsAny(host, "[]:"):
+		return "", fmt.Errorf("%q is neither an address nor a hostname (write an IPv6 address without brackets or port)", host)
+	}
+	return "tcp", nil
+}
+
 const (
 	MaxLogEntryBytes = 1024 * 1024
 
@@ -30,4 +52,4 @@ const (
 	ReloadWatchDebounce = 500 * time.Millisecond
 
 	ReloadWatchTimeout = 30 * time.Second
-)
+)