change(core): keep the original X-Forwarded-* on the ctx, not on ctx.var

`api_ctx.var` proxies NGINX variables: `__index` resolves a name against
`ngx.var`, `__newindex` writes through to the real variable for the whitelisted
names. `original_x_forwarded_*` is none of those -- it is a plain Lua value that
#12551 parked in that namespace.

Three consequences, none of them intended:

- It looks like a variable it is not. `$original_x_forwarded_proto` is empty in
  `log_format` and in `proxy_set_header`, which is where recording what a client
  claimed would actually be useful, yet `ctx.var.original_x_forwarded_proto`
  reads back fine from Lua.
- It shares a namespace with real variable names, so a future NGINX variable of
  the same name would be silently shadowed by the cached entry.
- Reading one that was never written walks the whole `__index` chain -- the
  `uri_param_` / `http_` / `graphql_` / `post_arg.` prefix tests, the dotted-path
  branch, the `apisix_var_names` lookup -- and ends in an `ngx.var` lookup for a
  name NGINX has never heard of. Measured at 53 ns against 0 for a plain table
  read.

So they become `api_ctx.original_x_forwarded_*`. Nothing in this repo reads them
under either name -- they have been write-only since they were added -- so this
changes no behaviour that anything observes. A plugin outside the tree reading
the old name now gets nil rather than a value, which is the same thing it
already got on every trusted request.

TEST 22 gives the field its first coverage: a forged `X-Forwarded-Proto: https`
is rewritten to `http` while the plugin can still see the original.

Author: AlinsRan

apisix/init.lua

@@ -740,12 +740,18 @@ local function handle_x_forwarded_headers(api_ctx)
         return
     end
 
-    -- store the original x-forwarded-* headers
-    -- to allow future use by other plugins or processes
-    api_ctx.var.original_x_forwarded_proto = xf_proto
-    api_ctx.var.original_x_forwarded_host = xf_host
-    api_ctx.var.original_x_forwarded_port = xf_port
-    api_ctx.var.original_x_forwarded_for = xf_for
+    -- keep what the client claimed, for plugins that want to see it after the
+    -- rewrite. These are plain `api_ctx` fields, not `api_ctx.var` entries:
+    -- `var` proxies NGINX variables, and these are not NGINX variables -- they
+    -- cannot appear in `log_format` or `proxy_set_header`, so putting them there
+    -- only makes them look like something they are not, shares a namespace with
+    -- real variable names, and makes reading an unset one walk the whole
+    -- `__index` chain down to an `ngx.var` lookup for a name NGINX has never
+    -- heard of (53 ns, against a plain table read).
+    api_ctx.original_x_forwarded_proto = xf_proto
+    api_ctx.original_x_forwarded_host = xf_host
+    api_ctx.original_x_forwarded_port = xf_port
+    api_ctx.original_x_forwarded_for = xf_for
 
     -- the replacement values
     -- ref: ngx_tpl.lua#L831-L840

t/core/trusted-addresses.t

@@ -802,3 +802,37 @@ routes:
 GET /old_uri
 --- response_body_like eval
 qr/\nx-forwarded-host: localhost\nx-forwarded-port: 1984\nx-forwarded-proto: http\n/
+
+
+
+=== TEST 22: the original client-supplied values are kept on the ctx for plugins
+--- yaml_config
+apisix:
+    node_listen: 1984
+    enable_admin: false
+deployment:
+    role: data_plane
+    role_data_plane:
+        config_provider: yaml
+--- apisix_yaml
+routes:
+  -
+    id: 1
+    uri: /old_uri
+    plugins:
+        serverless-pre-function:
+            phase: rewrite
+            functions:
+              - return function(conf, ctx) ngx.log(ngx.WARN, "original xfp=", tostring(ctx.original_x_forwarded_proto), " xff=", tostring(ctx.original_x_forwarded_for), " current xfp=", tostring(ctx.var.http_x_forwarded_proto)) end
+    upstream:
+        nodes:
+            "127.0.0.1:1980": 1
+        type: roundrobin
+#END
+--- request
+GET /old_uri
+--- more_headers
+X-Forwarded-Proto: https
+X-Forwarded-For: 1.2.3.4
+--- error_log
+original xfp=https xff=1.2.3.4 current xfp=http