| 152 | } |
| 153 | |
| 154 | func checkIP(ctx context.Context, resolver dns.Resolver, cfg List, ip net.IP) error { |
| 155 | ipv6 := true |
| 156 | if ipv4 := ip.To4(); ipv4 != nil { |
| 157 | ip = ipv4 |
| 158 | ipv6 = false |
| 159 | } |
| 160 | |
| 161 | if ipv6 && !cfg.ClientIPv6 { |
| 162 | return nil |
| 163 | } |
| 164 | if !ipv6 && !cfg.ClientIPv4 { |
| 165 | return nil |
| 166 | } |
| 167 | |
| 168 | query := queryString(ip) + "." + cfg.Zone |
| 169 | |
| 170 | addrs, err := resolver.LookupIPAddr(ctx, query) |
| 171 | if err != nil { |
| 172 | if dnsErr, ok := err.(*net.DNSError); ok && dnsErr.IsNotFound { |
| 173 | return nil |
| 174 | } |
| 175 | |
| 176 | return err |
| 177 | } |
| 178 | |
| 179 | var filteredAddrs []net.IPAddr |
| 180 | var score int |
| 181 | var customMessage string |
| 182 | |
| 183 | // If ResponseRules is configured, use new behavior |
| 184 | if len(cfg.ResponseRules) > 0 { |
| 185 | matchedScore, matchedMessages, matchedReasons, matched := matchResponseRules(addrs, cfg.ResponseRules) |
| 186 | if !matched { |
| 187 | return nil |
| 188 | } |
| 189 | score = matchedScore |
| 190 | |
| 191 | // Use first matched message if available |
| 192 | if len(matchedMessages) > 0 { |
| 193 | customMessage = matchedMessages[0] |
| 194 | } |
| 195 | |
| 196 | // Build filteredAddrs from matched reasons for TXT lookup fallback |
| 197 | for _, reason := range matchedReasons { |
| 198 | filteredAddrs = append(filteredAddrs, net.IPAddr{IP: net.ParseIP(reason)}) |
| 199 | } |
| 200 | } else { |
| 201 | // Legacy behavior: use flat Responses filter |
| 202 | filteredAddrs = make([]net.IPAddr, 0, len(addrs)) |
| 203 | addrsLoop: |
| 204 | for _, addr := range addrs { |
| 205 | // No responses whitelist configured - permit all. |
| 206 | if len(cfg.Responses) == 0 { |
| 207 | filteredAddrs = append(filteredAddrs, addr) |
| 208 | continue |
| 209 | } |
| 210 | |
| 211 | for _, respNet := range cfg.Responses { |