Filter chain match by `sourcePrefixRanges` is not working correctly with CIDR `0.0.0.0/0`

*Title*: Filter chain match by `sourcePrefixRanges` is not working correctly with CIDR `0.0.0.0/0`

*Description*:
> In our LDS configuration, we are configuring 2 different filter chains. Both filter chains have the same configuration and log the Filter Chain Name field, which allows us to see which filter chain is being applied.
> - The first one has no FilterChainMatch and applies by default.
> - The second one has a FilterChainMatch for `sourcePrefixRanges`.

---

> If we configure the second FilterChainMatch with the range `sourcePrefixRanges` `127.0.0.0/24`, it works correctly:
> - If Source IP is `127.0.0.1`, it applies the second filter chain:
> ```
> {"downstreamIp":"127.0.0.1","filterChain":"filter_chain_with_match"}
> {"downstreamIp":"127.0.0.1","filterChain":"filter_chain_with_match"}
> ```
> - If Source IP is not on `127.0.0.0/24` range (`10.97.145.78`), it applies the first filter chain:
> ```
> {"downstreamIp":"10.97.145.78","filterChain":"default"}
> {"downstreamIp":"10.97.145.78","filterChain":"default"}
> ```
---

> If we configure the second FilterChainMatch with the range `sourcePrefixRanges` `0.0.0.0/0`, it should always apply the second filter chain, regardless of the source IP, but it does not work correctly. Each time we start Envoy with the same LDS config, either the first or the second one is being applied randomly:
> ```
> {"downstreamIp":"10.97.145.78","filterChain":"default"}
> {"downstreamIp":"127.0.0.1","filterChain":"default"}
> ```
> ```
> {"downstreamIp":"10.97.145.78","filterChain":"filter_chain_with_match"}
> {"downstreamIp":"127.0.0.1","filterChain":"filter_chain_with_match"}
> ```

---

*Config that works with `127.0.0.0/24`*:

```
resources:
- name: listener_http
address:
socketAddress:
address: 0.0.0.0
portValue: 8081
filterChains:
- name: default
filters:
- name: envoy.filters.network.http_connection_manager
typedConfig:
statPrefix: ingress_http
routeConfig:
name: local_route
virtualHosts:
- name: local_service
domains:
- '*'
routes:
- match:
prefix: /
route:
cluster: service_upstream
timeout: 60s
httpFilters:
- name: envoy.filters.http.router
typedConfig:
'@type': >-
type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
accessLog:
- name: envoy.access_loggers.stdout
typedConfig:
logFormat:
jsonFormat:
downstreamIp: '%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%'
filterChain: default
contentType: json_format
'@type': >-
type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
'@type': >-
type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
- name: filter_chain_with_match
filterChainMatch:
sourcePrefixRanges:
- addressPrefix: 127.0.0.0
prefixLen: 24
filters:
- name: envoy.filters.network.http_connection_manager
typedConfig:
statPrefix: ingress_http
routeConfig:
name: local_route
virtualHosts:
- name: local_service
domains:
- '*'
routes:
- match:
prefix: /
route:
cluster: service_upstream
timeout: 60s
httpFilters:
- name: envoy.filters.http.router
typedConfig:
'@type': >-
type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
accessLog:
- name: envoy.access_loggers.stdout
typedConfig:
logFormat:
jsonFormat:
downstreamIp: '%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%'
filterChain: filter_chain_with_match
contentType: json_format
'@type': >-
type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
'@type': >-
type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
'@type': type.googleapis.com/envoy.config.listener.v3.Listener
```

*Config that NOT works with `0.0.0.0/0`*:

```
resources:
- name: listener_http
address:
socketAddress:
address: 0.0.0.0
portValue: 8081
filterChains:
- name: default
filters:
- name: envoy.filters.network.http_connection_manager
typedConfig:
statPrefix: ingress_http
routeConfig:
name: local_route
virtualHosts:
- name: local_service
domains:
- '*'
routes:
- match:
prefix: /
route:
cluster: service_upstream
timeout: 60s
httpFilters:
- name: envoy.filters.http.router
typedConfig:
'@type': >-
type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
accessLog:
- name: envoy.access_loggers.stdout
typedConfig:
logFormat:
jsonFormat:
downstreamIp: '%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%'
filterChain: default
contentType: json_format
'@type': >-
type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
'@type': >-
type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
- name: filter_chain_with_match
filterChainMatch:
sourcePrefixRanges:
- addressPrefix: 0.0.0.0
prefixLen: 0
filters:
- name: envoy.filters.network.http_connection_manager
typedConfig:
statPrefix: ingress_http
routeConfig:
name: local_route
virtualHosts:
- name: local_service
domains:
- '*'
routes:
- match:
prefix: /
route:
cluster: service_upstream
timeout: 60s
httpFilters:
- name: envoy.filters.http.router
typedConfig:
'@type': >-
type.googleapis.com/envoy.extensions.filters.http.router.v3.Router
accessLog:
- name: envoy.access_loggers.stdout
typedConfig:
logFormat:
jsonFormat:
downstreamIp: '%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%'
filterChain: filter_chain_with_match
contentType: json_format
'@type': >-
type.googleapis.com/envoy.extensions.access_loggers.stream.v3.StdoutAccessLog
'@type': >-
type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
'@type': type.googleapis.com/envoy.config.listener.v3.Listener
```