corrige detecção de endereços

internal/network/network.go

@@ -2,6 +2,7 @@
 package network
 
 import (
+	"context"
 	"fmt"
 	"io"
 	"net"
@@ -83,14 +84,21 @@ func isUsable(ip net.IP) bool {
 
 func fromPublicServices() Addresses {
 	return Addresses{
-		IPv4: queryFirst(PublicIPv4Services, false),
-		IPv6: queryFirst(PublicIPv6Services, true),
+		IPv4: queryFirst(PublicIPv4Services, "tcp4", false),
+		IPv6: queryFirst(PublicIPv6Services, "tcp6", true),
 	}
 }
 
-func queryFirst(services []string, wantIPv6 bool) net.IP {
+// queryFirst tries each service in order over a connection forced to the
+// given network ("tcp4" or "tcp6"). Forcing the dial family avoids relying
+// on the target hostname having only an A or only an AAAA record: some of
+// these services answer on both families, and letting the OS pick (e.g. via
+// Happy Eyeballs) could silently return the wrong address family. The
+// resulting address family is still double-checked as a second safeguard.
+func queryFirst(services []string, network string, wantIPv6 bool) net.IP {
+	client := httpClientForNetwork(network)
 	for _, url := range services {
-		ip, err := queryOne(url)
+		ip, err := queryOne(client, url)
 		if err != nil {
 			continue
 		}
@@ -103,8 +111,19 @@ func queryFirst(services []string, wantIPv6 bool) net.IP {
 	return nil
 }
 
-func queryOne(url string) (net.IP, error) {
-	client := http.Client{Timeout: httpTimeout}
+func httpClientForNetwork(network string) *http.Client {
+	dialer := net.Dialer{Timeout: httpTimeout}
+	return &http.Client{
+		Timeout: httpTimeout,
+		Transport: &http.Transport{
+			DialContext: func(ctx context.Context, _, addr string) (net.Conn, error) {
+				return dialer.DialContext(ctx, network, addr)
+			},
+		},
+	}
+}
+
+func queryOne(client *http.Client, url string) (net.IP, error) {
 	resp, err := client.Get(url)
 	if err != nil {
 		return nil, err