From 6c70872b4d5417217c518e43b3fbd6d030b13914 Mon Sep 17 00:00:00 2001
From: mdecimus <mauro@stalw.art>
Date: Mon, 8 Sep 2025 08:15:50 +0200
Subject: [PATCH] HTTP: Skip scanner fail2ban checks when the proxy client IP
 can't be parsed

---
 crates/http/src/request.rs | 39 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 20 deletions(-)

diff --git a/crates/http/src/request.rs b/crates/http/src/request.rs
index 70e00082..3ccd9a5c 100644
--- a/crates/http/src/request.rs
+++ b/crates/http/src/request.rs
@@ -814,26 +814,25 @@ async fn handle_session<T: SessionStream>(inner: Arc<Inner>, session: SessionDat
         .await
     {
         if http_err.is_parse() {
-            match inner
-                .build_server()
-                .is_scanner_fail2banned(session.remote_ip)
-                .await
-            {
-                Ok(true) => {
-                    trc::event!(
-                        Security(SecurityEvent::ScanBan),
-                        SpanId = session.session_id,
-                        RemoteIp = session.remote_ip,
-                        Reason = http_err.to_string(),
-                    );
-                    return;
-                }
-                Ok(false) => {}
-                Err(err) => {
-                    trc::error!(
-                        err.span_id(session.session_id)
-                            .details("Failed to check for fail2ban")
-                    );
+            let server = inner.build_server();
+            if !server.core.jmap.http_use_forwarded {
+                match server.is_scanner_fail2banned(session.remote_ip).await {
+                    Ok(true) => {
+                        trc::event!(
+                            Security(SecurityEvent::ScanBan),
+                            SpanId = session.session_id,
+                            RemoteIp = session.remote_ip,
+                            Reason = http_err.to_string(),
+                        );
+                        return;
+                    }
+                    Ok(false) => {}
+                    Err(err) => {
+                        trc::error!(
+                            err.span_id(session.session_id)
+                                .details("Failed to check for fail2ban")
+                        );
+                    }
                 }
             }
         }