Use X-Forwarded-For header on trusted proxies

If the controller is behind a proxy then the socket.remoteAddress will
be that of the proxy instead of the end client that connected.  In this
case the X-Forwarded-For header will contain the address of the end
client, but this should only be relied upon if the party connecting is a
trusted proxy, otherwise a malicious user could spoof the IP address
that is logged by providing a forged X-Forwarded-For header.

Implement a trusted proxy list consisting of a configured list of IP
addresses and/or CIDR blocks and use the last address[1] in the
X-Forwarded-For header if the remoteAddress address of the connecting
party is in the trusted proxy list.

[1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For

test/controller/WsServer.js

@@ -0,0 +1,73 @@
+"use strict";
+const assert = require("assert").strict;
+const { Controller, WsServer } = require("@clusterio/controller");
+const { ControllerConfig } = require("@clusterio/lib");
+
+describe("controller/src/WsServer", function() {
+	describe("class WsServer", function() {
+		/** @type {WsServer} */
+		let wsServer;
+		before(function() {
+			let config = new ControllerConfig("controller");
+			config.set("controller.trusted_proxies", "127.0.0.0/8, ::1");
+			let controller = new Controller({}, [], "", config);
+			wsServer = controller.wsServer;
+		});
+		describe(".remoteAddr()", function() {
+			it("should resolve X-Forward-For header for trusted proxies", function() {
+				const ipv4 = wsServer.remoteAddr({
+					socket: {
+						remoteAddress: "127.0.0.1",
+						remoteFamily: "IPv4",
+					},
+					headers: { "x-forwarded-for": "1.2.3.4" },
+				});
+				assert.equal(ipv4, "1.2.3.4");
+				const ipv6 = wsServer.remoteAddr({
+					socket: {
+						remoteAddress: "::1",
+						remoteFamily: "IPv6",
+					},
+					headers: { "x-forwarded-for": "2000::1" },
+				});
+				assert.equal(ipv6, "2000::1");
+			});
+			it("should pick the last address in X-Forward-For header for trusted proxies", function() {
+				const ipv4 = wsServer.remoteAddr({
+					socket: {
+						remoteAddress: "127.0.0.1",
+						remoteFamily: "IPv4",
+					},
+					headers: { "x-forwarded-for": "1.0.0.0, 2.0.0.0, 1.2.3.4" },
+				});
+				assert.equal(ipv4, "1.2.3.4");
+				const ipv6 = wsServer.remoteAddr({
+					socket: {
+						remoteAddress: "::1",
+						remoteFamily: "IPv6",
+					},
+					headers: { "x-forwarded-for": "2001::, 2002::, 2000::1" },
+				});
+				assert.equal(ipv6, "2000::1");
+			});
+			it("should not resolve X-Forward-For header for untrusted proxies", function() {
+				const ipv4 = wsServer.remoteAddr({
+					socket: {
+						remoteAddress: "1.2.3.4",
+						remoteFamily: "IPv4",
+					},
+					headers: { "x-forwarded-for": "127.0.0.1" },
+				});
+				assert.equal(ipv4, "1.2.3.4");
+				const ipv6 = wsServer.remoteAddr({
+					socket: {
+						remoteAddress: "2000::1",
+						remoteFamily: "IPv6",
+					},
+					headers: { "x-forwarded-for": "::1" },
+				});
+				assert.equal(ipv6, "2000::1");
+			});
+		});
+	});
+});