Struct RealIpPlugin 

pub struct RealIpPlugin {
    source: String,
    trusted_addresses: Option<Vec<IpNet>>,
    recursive: bool,
}

Replaces context.request.remote_addr with the address carried by a configured variable, guarded by a trusted-proxy allowlist.

source: http_x_forwarded_for gets APISIX’s special X-Forwarded-For handling (last header value, comma-splitting, optional recursive walk); any other source is resolved through the standard variable resolver (crate::vars::resolve), e.g. http_x_real_ip or arg_realip.

Fields

source: String

Variable name the real address is read from.

trusted_addresses: Option<Vec<IpNet>>

Only rewrite when the direct peer matches one of these networks. None means “always rewrite” (mirrors APISIX, where the field is optional).

recursive: bool

X-Forwarded-For only: walk the list right-to-left, skipping trusted hops, instead of taking the last (rightmost) entry.

Implementations

impl RealIpPlugin

pub fn from_config(config: &HashMap<String, Value>) -> Result<Self, String>

Builds the plugin from node config.

Accepted keys:

• source (string, required): variable holding the real address, e.g. http_x_real_ip or http_x_forwarded_for (the latter gets comma-list handling). See crate::vars::resolve for the variable namespace.
• trusted_addresses (array of IPs/CIDRs, optional): the rewrite only applies when the direct peer address matches one of these. When omitted the rewrite always applies. An empty array or an invalid IP/CIDR is a config error.
• recursive (bool, default false): for http_x_forwarded_for with trusted_addresses, walk the list from the rightmost entry, skip trusted hops, and take the first untrusted address (falling back to the leftmost entry when every hop is trusted). When false, the last (rightmost) entry is used.

type: real-ip
config:
  source: http_x_forwarded_for
  trusted_addresses: ["127.0.0.0/24", "10.0.0.0/8"]
  recursive: true

fn is_trusted(&self, ip: IpAddr) -> bool

True when ip is inside one of the trusted networks. Always false when no trusted_addresses are configured (callers guard on that).

fn get_addr(&self, ctx: &Context) -> Option<String>

Extracts the candidate real address from the configured source, mirroring APISIX’s get_addr.

Trait Implementations

impl Plugin for RealIpPlugin

fn plugin_type(&self) -> &str

Unique identifier for the plugin type (e.g., “proxy-rewrite”, “upstream”).

fn execute<'life0, 'life1, 'async_trait>( &'life0 self, ctx: Context, _named_inputs: &'life1 HashMap<String, Value>, ) -> Pin<Box<dyn Future<Output = Result<PluginOutput, PluginExecutionError>> + Send + 'async_trait>>

where Self: 'async_trait, 'life0: 'async_trait, 'life1: 'async_trait,

Executes the plugin logic against the request/response context.