Function real_ip_from_forwarded_for 

pub fn real_ip_from_forwarded_for(
    x_forwarded_for: Option<&str>,
    peer: IpAddr,
    trusted: &[IpNet],
) -> IpAddr

Returns the client IP from X-Forwarded-For, or the direct peer address when the peer is not a trusted proxy or the chain carries no trustworthy client.

The chain is walked from the right (the address closest to peer, which trusted proxies append on the left of their own hop) towards the left, skipping every address inside the trusted set. The first untrusted address is the client as attested by the trusted proxies; everything further to its left is client-supplied and must never win. Without this right-to-left walk a client behind one untrusted proxy could plant an arbitrary address.