kanywst opened a new pull request, #14125: URL: https://github.com/apache/apisix/pull/14125
### Description `ip-restriction` passes `remote_addr` to `matcher:match()` unchanged, and `resty.ipmatcher` only checks IPv6 rules for an IPv4-mapped address. When a trusted dual-stack proxy writes the client address as `::ffff:10.0.0.5`, a blacklist of `10.0.0.0/8` does not match it, and a whitelist that covers it rejects it. Changes: - `core.ip.match_addr(matcher, ip)` retries the match with the embedded IPv4 address when `ip` is IPv4-mapped (`::ffff:a.b.c.d`, any case, or the hex form `::ffff:a00:5`). - `ip-restriction` uses it for both the blacklist and the whitelist. - Tests in `t/plugin/ip-restriction.t` (TEST 36-41): mapped and hex-mapped addresses hit an IPv4 blacklist, a mapped address outside it passes, and a mapped address inside an IPv4 whitelist is allowed. Behavior change: a request whose client address is the IPv4-mapped form of an address in an IPv4 rule is now treated like the plain IPv4 address. #### Which issue(s) this PR fixes: Fixes # ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [x] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
