Function forwarded_client 

pub fn forwarded_client<'a>(
    peer: IpAddr,
    xff: impl DoubleEndedIterator<Item = &'a str>,
    trusted: &[IpNet],
) -> IpAddr

The client address of a request that arrived from peer carrying the X-Forwarded-For header instances xff (in order), given the proxies listed in trusted.

• peer not trusted: peer; the header is ignored entirely.
• Otherwise the instances are walked right to left (last instance first, each split on ,); entries inside trusted are skipped and the first entry outside it is the client. Entries left of the client are never looked at, so a client-supplied prefix cannot affect the result.
• A reached entry that is not a bare IPv4/IPv6 address or a [v6] literal (a port suffix, a hostname, an empty entry), more than MAX_TRUSTED_HOPS trusted entries, no header, or every entry trusted: UNKNOWN_FORWARDED. A trusted peer never gets its own address back, so nothing a request does can borrow the proxy’s identity.