mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-31 17:28:12 +00:00
refactor(logging): standardize concurrency and trusted proxy events (#3417)
* refactor(logging): standardize concurrency and proxy events * chore(logging): extend guardrails for concurrency and proxies * feat(skill): add rustfs logging governance skill
This commit is contained in:
houseme
@@ -157,12 +157,30 @@ pub trait CloudMetadataFetcher: Send + Sync {
|
||||
|
||||
match self.fetch_network_cidrs().await {
|
||||
Ok(cidrs) => ranges.extend(cidrs),
|
||||
Err(e) => warn!("Failed to fetch network CIDRs from {}: {}", self.provider_name(), e),
|
||||
Err(e) => warn!(
|
||||
event = "trusted_proxies.cloud_fetch",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = self.provider_name(),
|
||||
dataset = "network_cidrs",
|
||||
result = "degraded",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata fetch degraded"
|
||||
),
|
||||
}
|
||||
|
||||
match self.fetch_public_ip_ranges().await {
|
||||
Ok(public_ranges) => ranges.extend(public_ranges),
|
||||
Err(e) => warn!("Failed to fetch public IP ranges from {}: {}", self.provider_name(), e),
|
||||
Err(e) => warn!(
|
||||
event = "trusted_proxies.cloud_fetch",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = self.provider_name(),
|
||||
dataset = "public_ip_ranges",
|
||||
result = "degraded",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata fetch degraded"
|
||||
),
|
||||
}
|
||||
|
||||
Ok(ranges)
|
||||
@@ -208,7 +226,13 @@ impl CloudDetector {
|
||||
/// Fetches trusted IP ranges for the detected cloud provider.
|
||||
pub async fn fetch_trusted_ranges(&self) -> Result<Vec<ipnetwork::IpNetwork>, AppError> {
|
||||
if !self.enabled {
|
||||
debug!("Cloud metadata fetching is disabled");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
state = "disabled",
|
||||
"trusted proxy cloud detection skipped"
|
||||
);
|
||||
return Ok(Vec::new());
|
||||
}
|
||||
|
||||
@@ -216,36 +240,87 @@ impl CloudDetector {
|
||||
|
||||
match provider {
|
||||
Some(CloudProvider::Aws) => {
|
||||
info!("Detected AWS environment, fetching metadata");
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = "aws",
|
||||
result = "detected",
|
||||
timeout_ms = self.timeout.as_millis(),
|
||||
"trusted proxy cloud provider detected"
|
||||
);
|
||||
let fetcher = crate::AwsMetadataFetcher::new(self.timeout);
|
||||
fetcher.fetch_trusted_proxy_ranges().await
|
||||
}
|
||||
Some(CloudProvider::Azure) => {
|
||||
info!("Detected Azure environment, fetching metadata");
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = "azure",
|
||||
result = "detected",
|
||||
timeout_ms = self.timeout.as_millis(),
|
||||
"trusted proxy cloud provider detected"
|
||||
);
|
||||
let fetcher = crate::AzureMetadataFetcher::new(self.timeout);
|
||||
fetcher.fetch_trusted_proxy_ranges().await
|
||||
}
|
||||
Some(CloudProvider::Gcp) => {
|
||||
info!("Detected GCP environment, fetching metadata");
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = "gcp",
|
||||
result = "detected",
|
||||
timeout_ms = self.timeout.as_millis(),
|
||||
"trusted proxy cloud provider detected"
|
||||
);
|
||||
let fetcher = crate::GcpMetadataFetcher::new(self.timeout);
|
||||
fetcher.fetch_trusted_proxy_ranges().await
|
||||
}
|
||||
Some(CloudProvider::Cloudflare) => {
|
||||
info!("Detected Cloudflare environment");
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = "cloudflare",
|
||||
result = "detected",
|
||||
"trusted proxy cloud provider detected"
|
||||
);
|
||||
let ranges = crate::CloudflareIpRanges::fetch().await?;
|
||||
Ok(ranges)
|
||||
}
|
||||
Some(CloudProvider::DigitalOcean) => {
|
||||
info!("Detected DigitalOcean environment");
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = "digitalocean",
|
||||
result = "detected",
|
||||
"trusted proxy cloud provider detected"
|
||||
);
|
||||
let ranges = crate::DigitalOceanIpRanges::fetch().await?;
|
||||
Ok(ranges)
|
||||
}
|
||||
Some(CloudProvider::Unknown(name)) => {
|
||||
warn!("Unknown cloud provider detected: {}", name);
|
||||
warn!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = %name,
|
||||
result = "unknown",
|
||||
"trusted proxy cloud provider unresolved"
|
||||
);
|
||||
Ok(Vec::new())
|
||||
}
|
||||
None => {
|
||||
debug!("No cloud provider detected");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
result = "none",
|
||||
"trusted proxy cloud provider not detected"
|
||||
);
|
||||
Ok(Vec::new())
|
||||
}
|
||||
}
|
||||
@@ -265,17 +340,40 @@ impl CloudDetector {
|
||||
|
||||
for provider in providers {
|
||||
let provider_name = provider.provider_name();
|
||||
debug!("Trying to fetch metadata from {}", provider_name);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = provider_name,
|
||||
result = "attempt",
|
||||
"trusted proxy cloud provider fetch attempted"
|
||||
);
|
||||
|
||||
match provider.fetch_trusted_proxy_ranges().await {
|
||||
Ok(ranges) => {
|
||||
if !ranges.is_empty() {
|
||||
info!("Fetched {} IP ranges from {}", ranges.len(), provider_name);
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = provider_name,
|
||||
result = "loaded",
|
||||
range_count = ranges.len(),
|
||||
"trusted proxy cloud provider ranges loaded"
|
||||
);
|
||||
return Ok(ranges);
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to fetch metadata from {}: {}", provider_name, e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_detect",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_detector",
|
||||
provider = provider_name,
|
||||
result = "failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud provider fetch failed"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -67,12 +67,30 @@ impl AwsMetadataFetcher {
|
||||
.map_err(|e| AppError::cloud(format!("Failed to read IMDSv2 token: {}", e)))?;
|
||||
Ok(token)
|
||||
} else {
|
||||
debug!("IMDSv2 token request failed with status: {}", response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "aws_metadata",
|
||||
provider = "aws",
|
||||
operation = "imdsv2_token",
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Err(AppError::cloud("Failed to obtain IMDSv2 token"))
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("IMDSv2 token request failed: {}", e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "aws_metadata",
|
||||
provider = "aws",
|
||||
operation = "imdsv2_token",
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Err(AppError::cloud(format!("IMDSv2 request failed: {}", e)))
|
||||
}
|
||||
}
|
||||
@@ -97,7 +115,17 @@ impl CloudMetadataFetcher for AwsMetadataFetcher {
|
||||
|
||||
match networks {
|
||||
Ok(networks) => {
|
||||
debug!("Using default AWS VPC network ranges");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "aws_metadata",
|
||||
provider = "aws",
|
||||
operation = "network_cidrs",
|
||||
result = "fallback",
|
||||
source = "default_ranges",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Ok(networks)
|
||||
}
|
||||
Err(e) => Err(AppError::cloud(format!("Failed to parse default AWS ranges: {}", e))),
|
||||
@@ -137,15 +165,43 @@ impl CloudMetadataFetcher for AwsMetadataFetcher {
|
||||
}
|
||||
}
|
||||
|
||||
info!("Successfully fetched {} AWS public IP ranges", networks.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "aws_metadata",
|
||||
provider = "aws",
|
||||
operation = "public_ip_ranges",
|
||||
result = "loaded",
|
||||
source = "api",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata loaded"
|
||||
);
|
||||
Ok(networks)
|
||||
} else {
|
||||
debug!("Failed to fetch AWS IP ranges: HTTP {}", response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "aws_metadata",
|
||||
provider = "aws",
|
||||
operation = "public_ip_ranges",
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Ok(Vec::new())
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to fetch AWS IP ranges: {}", e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "aws_metadata",
|
||||
provider = "aws",
|
||||
operation = "public_ip_ranges",
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Ok(Vec::new())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -46,7 +46,15 @@ impl AzureMetadataFetcher {
|
||||
async fn get_metadata(&self, path: &str) -> Result<String, AppError> {
|
||||
let url = format!("{}/metadata/{}?api-version=2021-05-01", self.metadata_endpoint, path);
|
||||
|
||||
debug!("Fetching Azure metadata from: {}", url);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "metadata_request",
|
||||
path = %path,
|
||||
"trusted proxy cloud metadata request started"
|
||||
);
|
||||
|
||||
match self.client.get(&url).header("Metadata", "true").send().await {
|
||||
Ok(response) => {
|
||||
@@ -57,12 +65,32 @@ impl AzureMetadataFetcher {
|
||||
.map_err(|e| AppError::cloud(format!("Failed to read Azure metadata response: {}", e)))?;
|
||||
Ok(text)
|
||||
} else {
|
||||
debug!("Azure metadata request failed with status: {}", response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "metadata_request",
|
||||
path = %path,
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Err(AppError::cloud(format!("Azure metadata API returned status: {}", response.status())))
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Azure metadata request failed: {}", e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "metadata_request",
|
||||
path = %path,
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Err(AppError::cloud(format!("Azure metadata request failed: {}", e)))
|
||||
}
|
||||
}
|
||||
@@ -91,7 +119,15 @@ impl AzureMetadataFetcher {
|
||||
address_prefixes: Vec<String>,
|
||||
}
|
||||
|
||||
debug!("Fetching Azure IP ranges from: {}", url);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "public_ip_ranges",
|
||||
source = %url,
|
||||
"trusted proxy cloud metadata request started"
|
||||
);
|
||||
|
||||
match self.client.get(url).timeout(Duration::from_secs(10)).send().await {
|
||||
Ok(response) => {
|
||||
@@ -114,15 +150,45 @@ impl AzureMetadataFetcher {
|
||||
}
|
||||
}
|
||||
|
||||
info!("Successfully fetched {} Azure public IP ranges", networks.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "public_ip_ranges",
|
||||
source = "api",
|
||||
result = "loaded",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata loaded"
|
||||
);
|
||||
Ok(networks)
|
||||
} else {
|
||||
debug!("Failed to fetch Azure IP ranges: HTTP {}", response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "public_ip_ranges",
|
||||
source = %url,
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Ok(Vec::new())
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to fetch Azure IP ranges: {}", e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "public_ip_ranges",
|
||||
source = %url,
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
// Fallback to hardcoded ranges if the download fails.
|
||||
Self::default_azure_ranges()
|
||||
}
|
||||
@@ -217,7 +283,17 @@ impl AzureMetadataFetcher {
|
||||
|
||||
match networks {
|
||||
Ok(networks) => {
|
||||
debug!("Using default Azure public IP ranges");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "public_ip_ranges",
|
||||
result = "fallback",
|
||||
source = "default_ranges",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Ok(networks)
|
||||
}
|
||||
Err(e) => Err(AppError::cloud(format!("Failed to parse default Azure ranges: {}", e))),
|
||||
@@ -265,15 +341,45 @@ impl CloudMetadataFetcher for AzureMetadataFetcher {
|
||||
}
|
||||
|
||||
if !cidrs.is_empty() {
|
||||
info!("Successfully fetched {} network CIDRs from Azure metadata", cidrs.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "network_cidrs",
|
||||
source = "metadata",
|
||||
result = "loaded",
|
||||
range_count = cidrs.len(),
|
||||
"trusted proxy cloud metadata loaded"
|
||||
);
|
||||
Ok(cidrs)
|
||||
} else {
|
||||
debug!("No network CIDRs found in Azure metadata, falling back to defaults");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "network_cidrs",
|
||||
source = "metadata",
|
||||
result = "fallback",
|
||||
reason = "empty_metadata",
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Self::default_azure_network_ranges()
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
warn!("Failed to fetch Azure network metadata: {}", e);
|
||||
warn!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "network_cidrs",
|
||||
source = "metadata",
|
||||
result = "fallback",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Self::default_azure_network_ranges()
|
||||
}
|
||||
}
|
||||
@@ -299,7 +405,17 @@ impl AzureMetadataFetcher {
|
||||
|
||||
match networks {
|
||||
Ok(networks) => {
|
||||
debug!("Using default Azure VNet network ranges");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "azure_metadata",
|
||||
provider = "azure",
|
||||
operation = "network_cidrs",
|
||||
result = "fallback",
|
||||
source = "default_ranges",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Ok(networks)
|
||||
}
|
||||
Err(e) => Err(AppError::cloud(format!("Failed to parse default Azure network ranges: {}", e))),
|
||||
|
||||
@@ -46,7 +46,15 @@ impl GcpMetadataFetcher {
|
||||
async fn get_metadata(&self, path: &str) -> Result<String, AppError> {
|
||||
let url = format!("{}/computeMetadata/v1/{}", self.metadata_endpoint, path);
|
||||
|
||||
debug!("Fetching GCP metadata from: {}", url);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "metadata_request",
|
||||
path = %path,
|
||||
"trusted proxy cloud metadata request started"
|
||||
);
|
||||
|
||||
match self.client.get(&url).header("Metadata-Flavor", "Google").send().await {
|
||||
Ok(response) => {
|
||||
@@ -57,12 +65,32 @@ impl GcpMetadataFetcher {
|
||||
.map_err(|e| AppError::cloud(format!("Failed to read GCP metadata response: {}", e)))?;
|
||||
Ok(text)
|
||||
} else {
|
||||
debug!("GCP metadata request failed with status: {}", response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "metadata_request",
|
||||
path = %path,
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Err(AppError::cloud(format!("GCP metadata API returned status: {}", response.status())))
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("GCP metadata request failed: {}", e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "metadata_request",
|
||||
path = %path,
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Err(AppError::cloud(format!("GCP metadata request failed: {}", e)))
|
||||
}
|
||||
}
|
||||
@@ -123,7 +151,17 @@ impl CloudMetadataFetcher for GcpMetadataFetcher {
|
||||
.collect();
|
||||
|
||||
if interface_indices.is_empty() {
|
||||
warn!("No network interfaces found in GCP metadata");
|
||||
warn!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "network_cidrs",
|
||||
source = "metadata",
|
||||
result = "fallback",
|
||||
reason = "no_interfaces",
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
return Self::default_gcp_network_ranges();
|
||||
}
|
||||
|
||||
@@ -149,21 +187,61 @@ impl CloudMetadataFetcher for GcpMetadataFetcher {
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to get IP/mask for GCP interface {}: {}", index, e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "network_interface",
|
||||
interface_index = index,
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if cidrs.is_empty() {
|
||||
warn!("Could not determine network CIDRs from GCP metadata, falling back to defaults");
|
||||
warn!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "network_cidrs",
|
||||
source = "metadata",
|
||||
result = "fallback",
|
||||
reason = "empty_metadata",
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Self::default_gcp_network_ranges()
|
||||
} else {
|
||||
info!("Successfully fetched {} network CIDRs from GCP metadata", cidrs.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "network_cidrs",
|
||||
source = "metadata",
|
||||
result = "loaded",
|
||||
range_count = cidrs.len(),
|
||||
"trusted proxy cloud metadata loaded"
|
||||
);
|
||||
Ok(cidrs)
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
warn!("Failed to fetch GCP network metadata: {}", e);
|
||||
warn!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "network_cidrs",
|
||||
source = "metadata",
|
||||
result = "fallback",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Self::default_gcp_network_ranges()
|
||||
}
|
||||
}
|
||||
@@ -189,7 +267,15 @@ impl GcpMetadataFetcher {
|
||||
ipv4_prefix: Option<String>,
|
||||
}
|
||||
|
||||
debug!("Fetching GCP IP ranges from: {}", url);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "public_ip_ranges",
|
||||
source = %url,
|
||||
"trusted proxy cloud metadata request started"
|
||||
);
|
||||
|
||||
match self.client.get(url).timeout(Duration::from_secs(10)).send().await {
|
||||
Ok(response) => {
|
||||
@@ -209,15 +295,45 @@ impl GcpMetadataFetcher {
|
||||
}
|
||||
}
|
||||
|
||||
info!("Successfully fetched {} GCP public IP ranges", networks.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "public_ip_ranges",
|
||||
source = "api",
|
||||
result = "loaded",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata loaded"
|
||||
);
|
||||
Ok(networks)
|
||||
} else {
|
||||
debug!("Failed to fetch GCP IP ranges: HTTP {}", response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "public_ip_ranges",
|
||||
source = %url,
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Self::default_gcp_ip_ranges()
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to fetch GCP IP ranges: {}", e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "public_ip_ranges",
|
||||
source = %url,
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud metadata request failed"
|
||||
);
|
||||
Self::default_gcp_ip_ranges()
|
||||
}
|
||||
}
|
||||
@@ -280,7 +396,17 @@ impl GcpMetadataFetcher {
|
||||
|
||||
match networks {
|
||||
Ok(networks) => {
|
||||
debug!("Using default GCP public IP ranges");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "public_ip_ranges",
|
||||
result = "fallback",
|
||||
source = "default_ranges",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Ok(networks)
|
||||
}
|
||||
Err(e) => Err(AppError::cloud(format!("Failed to parse default GCP ranges: {}", e))),
|
||||
@@ -300,7 +426,17 @@ impl GcpMetadataFetcher {
|
||||
|
||||
match networks {
|
||||
Ok(networks) => {
|
||||
debug!("Using default GCP VPC network ranges");
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_metadata",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "gcp_metadata",
|
||||
provider = "gcp",
|
||||
operation = "network_cidrs",
|
||||
result = "fallback",
|
||||
source = "default_ranges",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud metadata fallback applied"
|
||||
);
|
||||
Ok(networks)
|
||||
}
|
||||
Err(e) => Err(AppError::cloud(format!("Failed to parse default GCP network ranges: {}", e))),
|
||||
|
||||
@@ -60,7 +60,16 @@ impl CloudflareIpRanges {
|
||||
|
||||
match networks {
|
||||
Ok(networks) => {
|
||||
info!("Loaded {} static Cloudflare IP ranges", networks.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "cloudflare",
|
||||
source = "static",
|
||||
result = "loaded",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud ranges loaded"
|
||||
);
|
||||
Ok(networks)
|
||||
}
|
||||
Err(e) => Err(AppError::cloud(format!("Failed to parse static Cloudflare IP ranges: {}", e))),
|
||||
@@ -96,19 +105,55 @@ impl CloudflareIpRanges {
|
||||
|
||||
match ranges {
|
||||
Ok(mut networks) => {
|
||||
debug!("Fetched {} IP ranges from {}", networks.len(), url);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "cloudflare",
|
||||
source = %url,
|
||||
result = "loaded",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud ranges fetched"
|
||||
);
|
||||
all_ranges.append(&mut networks);
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to parse IP ranges from {}: {}", url, e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "cloudflare",
|
||||
source = %url,
|
||||
result = "parse_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud ranges parse failed"
|
||||
);
|
||||
}
|
||||
}
|
||||
} else {
|
||||
debug!("Failed to fetch IP ranges from {}: HTTP {}", url, response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "cloudflare",
|
||||
source = %url,
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud ranges fetch failed"
|
||||
);
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to fetch from {}: {}", url, e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "cloudflare",
|
||||
source = %url,
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud ranges fetch failed"
|
||||
);
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -117,7 +162,16 @@ impl CloudflareIpRanges {
|
||||
// Fallback to static list if API requests fail.
|
||||
Self::fetch().await
|
||||
} else {
|
||||
info!("Successfully fetched {} Cloudflare IP ranges from API", all_ranges.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "cloudflare",
|
||||
source = "api",
|
||||
result = "loaded",
|
||||
range_count = all_ranges.len(),
|
||||
"trusted proxy cloud ranges loaded"
|
||||
);
|
||||
Ok(all_ranges)
|
||||
}
|
||||
}
|
||||
@@ -151,7 +205,16 @@ impl DigitalOceanIpRanges {
|
||||
|
||||
match networks {
|
||||
Ok(networks) => {
|
||||
info!("Loaded {} static DigitalOcean IP ranges", networks.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "digitalocean",
|
||||
source = "static",
|
||||
result = "loaded",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud ranges loaded"
|
||||
);
|
||||
Ok(networks)
|
||||
}
|
||||
Err(e) => Err(AppError::cloud(format!("Failed to parse static DigitalOcean IP ranges: {}", e))),
|
||||
@@ -200,15 +263,42 @@ impl GoogleCloudIpRanges {
|
||||
}
|
||||
}
|
||||
|
||||
info!("Successfully fetched {} Google Cloud IP ranges from API", networks.len());
|
||||
info!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "gcp",
|
||||
source = "api",
|
||||
result = "loaded",
|
||||
range_count = networks.len(),
|
||||
"trusted proxy cloud ranges loaded"
|
||||
);
|
||||
Ok(networks)
|
||||
} else {
|
||||
debug!("Failed to fetch Google IP ranges: HTTP {}", response.status());
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "gcp",
|
||||
source = %url,
|
||||
result = "http_error",
|
||||
status = %response.status(),
|
||||
"trusted proxy cloud ranges fetch failed"
|
||||
);
|
||||
Ok(Vec::new())
|
||||
}
|
||||
}
|
||||
Err(e) => {
|
||||
debug!("Failed to fetch Google IP ranges: {}", e);
|
||||
debug!(
|
||||
event = "trusted_proxies.cloud_ranges",
|
||||
component = "trusted_proxies",
|
||||
subsystem = "cloud_ranges",
|
||||
provider = "gcp",
|
||||
source = %url,
|
||||
result = "request_failed",
|
||||
error = %e,
|
||||
"trusted proxy cloud ranges fetch failed"
|
||||
);
|
||||
Ok(Vec::new())
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user