perf: add RPC auth profiling diagnostics (#5775)

perf: add rpc auth profiling diagnostics

Co-authored-by: heihutu <heihutu@gmail.com>
Co-authored-by: zhi22915 <qiuzgang@gmail.com>

rustfs/src/server/http.rs

@@ -1891,10 +1891,29 @@ fn check_auth(req: Request<()>) -> std::result::Result<Request<()>, Status> {
         allow_replay_scope_bootstrap,
     )
     .map_err(|e| {
+        let rpc_path = target.uri.path();
+        let rpc_service = rpc_path
+            .strip_prefix('/')
+            .and_then(|path| path.split_once('/'))
+            .map(|(service, _)| service)
+            .unwrap_or("unknown");
+        let peer_addr = req
+            .extensions()
+            .get::<RemoteAddr>()
+            .map(|addr| addr.0.to_string())
+            .unwrap_or_else(|| "unknown".to_string());
+        let failure_reason = storage::tonic_rpc_auth_failure_reason(&e);
         error!(
             event = EVENT_RPC_SIGNATURE_VERIFICATION_FAILED,
             component = LOG_COMPONENT_SERVER,
             subsystem = LOG_SUBSYSTEM_HTTP,
+            failure_reason,
+            rpc_path,
+            rpc_service,
+            rpc_method,
+            expected_audience = %audience,
+            peer_addr = %peer_addr,
+            replay_scope_bootstrap_allowed = allow_replay_scope_bootstrap,
             error = %e,
             "RPC signature verification failed"
         );

rustfs/src/storage/storage_api.rs

@@ -498,8 +498,8 @@ pub(crate) mod ecstore_rpc {
         KMS_SIGNAL_SUBSYSTEM, LocalPeerS3Client, PEER_RESTDRY_RUN, PEER_RESTSIGNAL, PEER_RESTSUB_SYS, PeerRestClient,
         PeerS3Client, SERVICE_SIGNAL_REFRESH_CONFIG, SERVICE_SIGNAL_RELOAD_DYNAMIC, TONIC_RPC_PREFIX,
         normalize_tonic_rpc_audience, sign_ns_scanner_capability, sign_tonic_rpc_response_proof, tonic_boot_epoch_challenge,
-        tonic_boot_epoch_response_headers, verify_rpc_signature, verify_tonic_canonical_body_digest,
-        verify_tonic_mutation_body_digest, verify_tonic_rpc_signature_with_bootstrap,
+        tonic_boot_epoch_response_headers, tonic_rpc_auth_failure_reason, verify_rpc_signature,
+        verify_tonic_canonical_body_digest, verify_tonic_mutation_body_digest, verify_tonic_rpc_signature_with_bootstrap,
     };
     #[cfg(test)]
     pub(crate) use rustfs_ecstore::api::rpc::{
@@ -1667,6 +1667,10 @@ pub(crate) fn verify_tonic_rpc_signature_with_bootstrap(
     ecstore_rpc::verify_tonic_rpc_signature_with_bootstrap(audience, path, headers, allow_replay_scope_bootstrap)
 }
 
+pub(crate) fn tonic_rpc_auth_failure_reason(error: &std::io::Error) -> &'static str {
+    ecstore_rpc::tonic_rpc_auth_failure_reason(error)
+}
+
 pub(crate) fn tonic_boot_epoch_challenge(headers: &http::HeaderMap) -> std::io::Result<Option<uuid::Uuid>> {
     ecstore_rpc::tonic_boot_epoch_challenge(headers)
 }

rustfs/src/storage_api.rs

@@ -116,7 +116,7 @@ pub(crate) mod server {
     pub(crate) mod http {
         pub(crate) use crate::storage::storage_api::{
             ServerContextSlot, TONIC_RPC_PREFIX, normalize_tonic_rpc_audience, tonic_boot_epoch_challenge,
-            tonic_boot_epoch_response_headers, verify_tonic_rpc_signature_with_bootstrap,
+            tonic_boot_epoch_response_headers, tonic_rpc_auth_failure_reason, verify_tonic_rpc_signature_with_bootstrap,
         };
 
         pub(crate) fn try_current_local_node_name() -> Option<String> {