[Server] Parse the rightmost address from forwarded header lists (#7586)

X-Forwarded-For carries a comma-separated list, and constructing a
QHostAddress from the raw header value returns a null address for it, so a
configured X-Forwarded-For or a multi-hop header never resolved and websocket
clients stayed on the proxy's address.

- Add parseForwardedAddress, returning the rightmost usable entry of a
  forwarded header list
- Use it for the websocket handshake instead of parsing the raw value
- Exempt loopback from per-address auth rate limits so a same-host proxy with a
  customized trusted_sources list cannot lock every user out
- Add forwarded_address_test

Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>

tests/forwarded_address_test.cpp

@@ -0,0 +1,37 @@
+#include "forwarded_address.h"
+
+#include "gtest/gtest.h"
+
+namespace
+{
+
+TEST(ForwardedAddressTest, ParsesSingleAddress)
+{
+    EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("203.0.113.7"));
+    EXPECT_EQ(QHostAddress("::1"), parseForwardedAddress("::1"));
+    EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("  203.0.113.7  "));
+}
+
+TEST(ForwardedAddressTest, UsesRightmostEntryOfAList)
+{
+    // nginx's $proxy_add_x_forwarded_for appends its own view of the client to
+    // whatever the client sent, so only the trailing entry is trustworthy.
+    EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("198.51.100.9, 203.0.113.7"));
+    EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("spoofed.invalid, 203.0.113.7"));
+    EXPECT_EQ(QHostAddress("203.0.113.7"), parseForwardedAddress("203.0.113.7, "));
+}
+
+TEST(ForwardedAddressTest, KeepsIpv4MappedEntries)
+{
+    EXPECT_EQ(QHostAddress("::ffff:203.0.113.7"), parseForwardedAddress("::ffff:203.0.113.7"));
+}
+
+TEST(ForwardedAddressTest, RejectsValuesWithoutAnAddress)
+{
+    EXPECT_TRUE(parseForwardedAddress("").isNull());
+    EXPECT_TRUE(parseForwardedAddress(",").isNull());
+    EXPECT_TRUE(parseForwardedAddress("unknown").isNull());
+    EXPECT_TRUE(parseForwardedAddress("garbage, more garbage").isNull());
+}
+
+} // namespace