Only forward traffic to global unicast

[myleshorton]

This pull request refactors how local/private IP addresses are detected in the BlockLocal filter, simplifying the code and removing an external dependency. The main change is the replacement of the custom iptool library with Go's built-in IP address methods, resulting in cleaner and more maintainable code.

Dependency management:

• Removed github.com/getlantern/iptool as a direct dependency from the require block in go.mod.
• Update github.com/getlantern/netx as a direct dependency

Code simplification and refactoring:

• Removed the import of iptool from proxyfilters/blocklocal.go, as it is no longer needed.
• Removed initialization of the iptool object in the BlockLocal function.
• Replaced the use of ipt.IsPrivate(ipAddr) with Go's native !ipAddr.IP.IsGlobalUnicast() to check for non-global (local/private) IP addresses, simplifying the logic and leveraging standard library functionality.

[Copilot]

Pull Request Overview

This PR refactors the BlockLocal filter to use Go's native IP address methods instead of the external iptool library, simplifying the codebase and reducing dependencies. The change replaces custom IP privacy detection logic with the standard library's IsGlobalUnicast() method.

Key changes:

• Removed direct dependency on github.com/getlantern/iptool
• Replaced ipt.IsPrivate(ipAddr) with !ipAddr.IP.IsGlobalUnicast() for detecting local/private addresses
• Updated several indirect dependency versions in go.mod

Reviewed Changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 1 comment.

File	Description
proxyfilters/blocklocal.go	Removed iptool import and replaced IsPrivate() call with native IsGlobalUnicast() method
go.mod	Moved iptool from direct to indirect dependencies and updated version hashes for related packages

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[Copilot]

Using !IsGlobalUnicast() is not semantically equivalent to IsPrivate(). IsGlobalUnicast() returns false for unspecified addresses (0.0.0.0), loopback addresses, multicast addresses, and link-local addresses, but it also returns false for IPv4 broadcast addresses and other special-purpose addresses that may not be considered 'private' in the traditional RFC 1918 sense. This could inadvertently block legitimate traffic or allow traffic that should be blocked. Consider using IsPrivate() || IsLoopback() || IsLinkLocalUnicast() || IsLinkLocalMulticast() for more precise control.

Suggested change

	if !ipAddr.IP.IsGlobalUnicast() {
	if ipAddr.IP.IsPrivate() || ipAddr.IP.IsLoopback() || ipAddr.IP.IsLinkLocalUnicast() || ipAddr.IP.IsLinkLocalMulticast() {

[myleshorton]

I don't think we want to allow broadcast addresses either, or multicast. Seems like a potential for amplification attacks.

[Crosse]

I think we need IsPrivate() as well. tests

[myleshorton]

Oh very interesting. I didn't realize that some private addresses could also be considered global unicast -- I guess I always thought of the "global" part as public! Good catch.