[kanywst]

Description

ip-restriction passes remote_addr to matcher:match() unchanged, and resty.ipmatcher only checks IPv6 rules for an IPv4-mapped address. When a trusted dual-stack proxy writes the client address as ::ffff:10.0.0.5, a blacklist of 10.0.0.0/8 does not match it, and a whitelist that covers it rejects it.

Changes:

• core.ip.match_addr(matcher, ip) retries the match with the embedded IPv4 address when ip is IPv4-mapped (::ffff:a.b.c.d, any case, or the hex form ::ffff:a00:5).
• ip-restriction uses it for both the blacklist and the whitelist.
• Tests in t/plugin/ip-restriction.t (TEST 36-41): mapped and hex-mapped addresses hit an IPv4 blacklist, a mapped address outside it passes, and a mapped address inside an IPv4 whitelist is allowed.

Behavior change: a request whose client address is the IPv4-mapped form of an address in an IPv4 rule is now treated like the plain IPv4 address.

Which issue(s) this PR fixes:

Fixes #

Checklist

• I have explained the need for this PR and the problem it solves
• I have explained the changes or the new features added to this PR
• I have added tests corresponding to this change
• I have updated the documentation to reflect this change
• I have verified that this change is backward compatible (If not, please discuss on the APISIX mailing list first)