Except for a few headers that are handled specially, CGI stores the value of Header-Name: in the environment variable HTTP_HEADER_NAME. So, X-Forwarded-For (if present in the request) should be found in $ENV{HTTP_X_FORWARDED_FOR}.
@cjm, thank you so much. Is there any rfc or protocol or standard defines, web server passes http header to cgi process in environment variables way with prefix HTTP_?