dolonet
491a355a61
Require all detected IP families to match in SNI-DNS check
Previously the check returned OK if any resolved address matched
either the public IPv4 or IPv6. A matching AAAA could mask a
mismatched A record (and vice versa), which is a problem because
most client connectivity is still IPv4: a partial match would
silently pass the warning while DPI still blocks the proxy.
Now each detected IP family must appear in the DNS response; the
warning also reports per-family match status so operators can tell
which record is wrong.