get real ip from web traffic

[FuhuXia]

We use the leftmost entries in the x_forwarded_for from cloudfront as the real ip and use it in our log analysis on NewRelic. It is not reliable since client can inject entries there and we see private ip as the leftmost XFF entry, such as this one for SSA.

x_forwarded_for:"172.27.226.194, 137.200.49.15, 64.252.66.8, 127.0.0.

We need to find a more reliable way to get real ips, such as CloudFront-Viewer-Address.

[FuhuXia]

these are the traffic with private ip as real_ip for the past month on current catalog.