Match blocked_networks against both forms of an address holding IPv4

isBlockedIP refuses an address when a blocked_networks entry contains
it as an IPv6 address or contains the IPv4 address it holds, for the
mapped (::ffff:0:0/96) and the IPv4-compatible (::/96) form alike, so
an IPv6 entry refuses everything it refused on next. ipv6AndIPv4Forms
gives the two forms. Go keeps a plain IPv4 address in the mapped form,
so an entry covering ::ffff:0:0/96, such as ::/0, now refuses every
IPv4 address too.

Model: opus-5-5

internal/httpfetcher/httpfetcher.go

@@ -599,26 +599,41 @@ func isPrivateIP(ip net.IP) bool {
 }
 
 // isBlockedIP reports whether ip is refused, either by the built-in
-// internal-range check or by one of the operator-supplied prefixes.
+// internal-range check or by one of the operator-supplied prefixes. An IPv6
+// address that holds an IPv4 address is refused when a prefix contains the
+// address as written or the IPv4 address it holds.
 func isBlockedIP(ip net.IP, blocked []netip.Prefix) bool {
 	if isPrivateIP(ip) {
 		return true
 	}
 
-	// An IPv4-compatible or IPv4-mapped IPv6 address is matched as the IPv4
-	// address it holds
-	addr, ok := netip.AddrFromSlice(ipv4CompatibleToIPv4(ip))
-	if !ok {
+	asIPv6, asIPv4 := ipv6AndIPv4Forms(ip)
+	if !asIPv6.IsValid() {
 		return true
 	}
 
-	addr = addr.Unmap()
-
 	return slices.ContainsFunc(blocked, func(prefix netip.Prefix) bool {
-		return prefix.Contains(addr)
+		return prefix.Contains(asIPv6) || prefix.Contains(asIPv4)
 	})
 }
 
+// ipv6AndIPv4Forms returns ip as an IPv6 address and, when it holds an IPv4
+// address in the IPv4-mapped form (::ffff:0:0/96) or the IPv4-compatible form
+// (::/96), that IPv4 address. Otherwise the IPv4 form is the zero netip.Addr,
+// which no prefix contains. Go keeps a plain IPv4 address in the mapped form,
+// so the IPv6 form of 203.0.113.5 is ::ffff:203.0.113.5. An ip that is not 4
+// or 16 bytes long gives two zero addresses.
+func ipv6AndIPv4Forms(ip net.IP) (netip.Addr, netip.Addr) {
+	asIPv6, ok := netip.AddrFromSlice(ip.To16())
+	if !ok {
+		return netip.Addr{}, netip.Addr{}
+	}
+
+	asIPv4, _ := netip.AddrFromSlice(ipv4CompatibleToIPv4(ip).To4())
+
+	return asIPv6, asIPv4
+}
+
 // ipv4CompatibleToIPv4 returns the IPv4 address that an IPv4-compatible IPv6
 // address (in ::/96, such as ::127.0.0.1) holds in its last four bytes, and
 // any other address unchanged.