Pinned dials reuse the dialer cached for the host:port, and cached dials send the wrong SNI #579

fastdialer version:

v0.5.25 (main at 2e7cb56). v0.5.21 to v0.5.24 behave the same.

Current Behavior:

dial() looks up the cached DialWrap by network and address before it reads the ip pinned with ctx.Value(fastdialer.IP). After the first dial of a host:port:

• a dial pinned to another ip connects to the ip cached first;
• a dial pinned to an ip the network policy denies also connects to the cached ip instead of failing;
• an unpinned dial connects to the pinned ip instead of resolving the host.

nuclei -sa and httpx -pa pin each resolved ip this way, so every ip of a host:port is answered by the first one.

A dial through the cached dialer also takes the hostname from the address again with net.SplitHostPort:

• for a host:port:ip address the split fails, so no SNI is sent;
• for an IDN host it replaces the punycode name with the raw one, so the SNI is bücher.test instead of xn--bcher-kva.test, and the dialer history is stored under a key GetDialedIP never looks up.

Expected Behavior:

A pinned dial connects to its ip and goes through the network policy check, an unpinned dial resolves the host, and the SNI is the hostname in ASCII form.

Steps To Reproduce:

Listeners on 127.0.0.1, 127.0.0.2 and 127.0.0.3, port 18301, that write one, two and three; pinned.test resolving to 127.0.0.3 and bücher.test to 127.0.0.1 through /etc/hosts; a TLS server on 127.0.0.1:18443 that answers with the SNI it received.

fd, _ := fastdialer.NewDialer(fastdialer.DefaultOptions)
pin := func(ip string) context.Context {
	return context.WithValue(context.Background(), fastdialer.IP, ip)
}
fd.Dial(pin("127.0.0.1"), "tcp", "pinned.test:18301")                  // one
fd.Dial(pin("127.0.0.2"), "tcp", "pinned.test:18301")                  // one, expected two
fd.Dial(context.Background(), "tcp", "pinned.test:18301")              // one, expected three
fd.DialTLS(context.Background(), "tcp", "pinned.test:18443:127.0.0.1") // SNI "", expected pinned.test
fd.DialTLS(context.Background(), "tcp", "bücher.test:18443")           // SNI bücher.test, expected xn--bcher-kva.test

With Deny: []string{"127.0.0.2"}, the dial pinned to 127.0.0.2 returns one instead of an error.

Anything else:

The IP value pins every dial made with the context, not only the dial to the host it was set for. An HTTP client that follows a redirect to another host, or dials an HTTP proxy, with the request context connects to the pinned ip for those too: nuclei -sa and httpx -pa -fr send a redirect to another host to the pinned ip. A variant limited to one host, like curl --resolve, would let callers pin a host without that.