Fix respect of x-real-ip / x-forwarded-for headers in context

[dosera]

According to the https://docs.gitea.io/en-us/fail2ban-setup gitea
respects the X-Real-IP forwarded proxy header and according to the implementation
prior to the commit below also X-Forwarded-For.

6433ba0 removes this logic,
see https://github.com/go-gitea/gitea/blob/b223d361955f8b722f7dd0b358b2e57e6f359edf/modules/context/context.go line 514.

This commit reverts the implementation and adds basic unit tests for it.

[techknowlogick]

Thanks for this PR :)

A note: this should only accept these headers if ctx.Req.RemoteAddr belongs to a trusted IP/range per some configuration value

[dosera]

Alright, so my assumption is correct that the fail2ban instructions in the docs can't work in a setup with reverse proxy?
Also what configuration are you referring to? Any hints on where to start?

A note: this should only accept these headers if ctx.Req.RemoteAddr belongs to a trusted IP/range per some configuration value

Why is that? Could you elaborate what the rational is here?

Also regarding the failing CI: When I do the import "code.gitea.io/gitea/modules/context" it works locally but fails in CI. If I remove this it fails locally and in CI. Might this be related to the go version? I am running with 1.16.5

[zeripath]

We already handle the X-Real-IP and X-Forwarded-For headers on the request in #14959

Have you set the REVERSE_PROXY_TRUSTED_PROXIES and REVERSE_PROXY_LIMIT correctly?

[dosera]

We already handle the X-Real-IP and X-Forwarded-For headers on the request in #14959

Have you set the REVERSE_PROXY_TRUSTED_PROXIES and REVERSE_PROXY_LIMIT correctly?

well maybe I shouldve just created an issue - I wanted to configure fail2ban as specified in the docs (in a nginx -> docker gitea setup) but this does not work as is described.
So I suppose REVERSE_PROXY_LIMIT defaults to 0?
Also mentioning this somewhere in the f2b docs would be very helpful.

Thanks for your input.

[zeripath]

Perhaps you could change this PR to make those changes instead.

[dosera]

Perhaps you could change this PR to make those changes instead.

Yes, just wanted to try it first. Works perfectly. See PR here