Client address is the right-most untrusted X-Forwarded-For entry (closes #144)

From a peer in TRUSTED_PROXIES, clientIP took the left-most
X-Forwarded-For entry, which the client writes itself behind a proxy
that appends to the header, so a client could choose the address the
rate limit counts and the request log records. It now walks the entries
from the right past trusted proxies and takes the first that is not
one. An entry written as an address with a port is read as that
address; with only trusted entries, or one that is not an address at
all, it uses the peer. Every X-Forwarded-For header line is read.
X-Real-IP is read only when there is no X-Forwarded-For entry.
README.md Settings says which entry is taken.

Model: opus-5-5

internal/middleware/middleware_test.go

@@ -32,6 +32,9 @@ const (
 	forwardedIP = "203.0.113.7"
 	// realIP is the client address presented via X-Real-IP.
 	realIP = "203.0.113.9"
+	// appendedIP is the X-Forwarded-For entry a trusted proxy appended
+	// after the entries the client wrote.
+	appendedIP = "198.51.100.7"
 )
 
 func mustPrefixes(t *testing.T, cidrs ...string) []netip.Prefix {
@@ -90,8 +93,8 @@ func clientIPCases() []clientIPCase {
 		{
 			name:       "trusted proxy uses right-most of chain",
 			remoteAddr: loopbackPeer,
-			xff:        "203.0.113.9, 198.51.100.7",
-			want:       "198.51.100.7",
+			xff:        "203.0.113.9, " + appendedIP,
+			want:       appendedIP,
 		},
 		{
 			name:       "trusted proxy entries are skipped from the right",
@@ -105,24 +108,6 @@ func clientIPCases() []clientIPCase {
 			xff:        "10.0.0.5, 10.1.2.3",
 			want:       loopbackIP,
 		},
-		{
-			name:       "entry with a port is read as its address",
-			remoteAddr: loopbackPeer,
-			xff:        "203.0.113.9, 198.51.100.7:5000",
-			want:       "198.51.100.7",
-		},
-		{
-			name:       "ipv6 entry with a port is read as its address",
-			remoteAddr: loopbackPeer,
-			xff:        "203.0.113.9, [2001:db8::1]:443",
-			want:       "2001:db8::1",
-		},
-		{
-			name:       "trusted proxy entry with a port is skipped",
-			remoteAddr: loopbackPeer,
-			xff:        "203.0.113.9, 10.0.0.5:5000",
-			want:       "203.0.113.9",
-		},
 		{
 			name:       "entry that is not an address uses peer",
 			remoteAddr: loopbackPeer,
@@ -202,12 +187,36 @@ func TestClientIPReadsEveryForwardedForLine(t *testing.T) {
 
 	header := http.Header{}
 	header.Add("X-Forwarded-For", "203.0.113.9")
-	header.Add("X-Forwarded-For", "198.51.100.7")
+	header.Add("X-Forwarded-For", appendedIP)
 
 	got := middleware.ClientIP(loopbackPeer, header,
 		mustPrefixes(t, "127.0.0.1/32"))
-	if got != "198.51.100.7" {
-		t.Errorf("ClientIP() = %q, want %q", got, "198.51.100.7")
+	if got != appendedIP {
+		t.Errorf("ClientIP() = %q, want %q", got, appendedIP)
+	}
+}
+
+// TestClientIPReadsAddressWithPort checks that an X-Forwarded-For entry
+// written as an address with a port is read as that address, both for
+// the trust check and as the result.
+func TestClientIPReadsAddressWithPort(t *testing.T) {
+	t.Parallel()
+
+	trusted := mustPrefixes(t, "127.0.0.1/32", "10.0.0.0/8")
+
+	for xff, want := range map[string]string{
+		"203.0.113.9, " + appendedIP + ":5000": appendedIP,
+		"203.0.113.9, [2001:db8::1]:443":       "2001:db8::1",
+		"203.0.113.9, 10.0.0.5:5000":           "203.0.113.9",
+	} {
+		header := http.Header{}
+		header.Set("X-Forwarded-For", xff)
+
+		got := middleware.ClientIP(loopbackPeer, header, trusted)
+		if got != want {
+			t.Errorf("X-Forwarded-For %q: ClientIP() = %q, want %q",
+				xff, got, want)
+		}
 	}
 }