Go

package securd

import (
	"context"
	"errors"
	"net"
	"os"
	"strings"
)

var ErrHeld = errors.New("securd: destination held or blocked for this agent role")

func blockAddrs() map[string]bool {
	m := map[string]bool{}
	for _, a := range strings.Split(os.Getenv("SECURD_BLOCK_ADDRS"), ",") {
		if a != "" {
			m[a] = true
		}
	}
	return m
}

// DialContext resolves first and refuses answers that point at the block page.
func DialContext(ctx context.Context, network, addr string) (net.Conn, error) {
	host, port, err := net.SplitHostPort(addr)
	if err != nil {
		return nil, err
	}
	ips, err := net.DefaultResolver.LookupIPAddr(ctx, host)
	if err != nil {
		return nil, ErrHeld
	}
	blocked := blockAddrs()
	for _, ip := range ips {
		if blocked[ip.String()] {
			return nil, ErrHeld
		}
	}
	var d net.Dialer
	return d.DialContext(ctx, network, net.JoinHostPort(ips[0].String(), port))
}

client := &http.Client{Transport: &http.Transport{DialContext: securd.DialContext}}
resp, err := client.Get("https://api.example.com/v1/items")
if errors.Is(err, securd.ErrHeld) {
	log.Printf("held: ask an operator to approve the host for this agent role")
	return
}