HTTP_X_FORWARDED_FOR info not saved when using standard payment methods

[Silarn]

Preconditions

1. Magento 2.1.3 and probably earlier
2. PHP 7.0.14
3. Frontend servers using a load-balancer and cloudflare to forward traffic
4. Payment types other than PayPal which use the standard API methods to place the order after the payment step

Steps to reproduce

1. Use a load balancer or other forwarder which uses the X_FORWARDED_FOR headers to set IP information
2. Place an order which uses the /V1/carts/mine/payment-information or /V1/guest-carts/:cartId/payment-information endpoints to place orders
3. View the order information and notice no forwarded IP info has been saved

Expected result

1. The order should contain x_forwarded_for information

Actual result

1. This information is not present

I've tracked this down to two basic issues. One, the quote table does not have an x_forwarded_for column, which is likely the root issue. The reason that PayPal methods populate this data is because they use the session to load the quote. The session getQuote function automatically populates the remote_ip and x_forwarded_for data on the quote model. However, the standard API functions load the quote data from the database without instantiating this data.

Because the data for x_forwarded_for is not saved into the database (there is no column present), this information is not loaded or instantiated in this final order conversion step and thus fails to be written to the order table.

An ideal solution probably involves both adding the x_forwarded_for data to the quote table and instantiating this data in the getActive function in the QuoteRepository model (which is the method used to load the data when placing the order with the above endpoints).

[Silarn]

I'll also note that a 32 character length is nowhere near enough - particularly when ipv6 addresses are in play.

The remote_ip should be 45 and the x_forwarded_for could have multiple, comma-separated addresses so a length of 255 seems plausible.

[ishakhsuvarov]

@Silarn Thank you for reporting.
Closing as duplicate of #7227 to simplify tracking.