[nicolas-grekas]

This is an alternative to #23657, following the discussion there.

curl_setopt($ch, CURLOPT_OPENSOCKETFUNCTION, function (CurlHandle $handle, string $address, int $port): bool {
    return false !== filter_var($address, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE);
});

The callback is called before connect(), so it can block requests to internal addresses. CURLOPT_PREREQFUNCTION can't do that because it's called once the connection is made.

This uses the libcurl option as suggested by @arnaud-lb, but the callback returns a bool instead of a socket. true lets libcurl create the socket, false makes libcurl try the next address. Returning a socket can be added later by widening the return type, and more arguments can be added at the end.

A UNIX socket is reported as its path with port 0, the same as CURLOPT_PREREQFUNCTION and CURLINFO_PRIMARY_IP do. There's no address family enum, since the address is enough to tell IPv4, IPv6 and UNIX sockets apart.

The commit is authored by @xavierleune since it reuses most of the code and tests of #23657.

/cc @bukka @TimWolla

[nicolas-grekas]

Let me close in favor of #25414, which now has the same signature.