[gateway] log tls context in gateway logs

Author: patatoid

apps/boruta_gateway/lib/boruta_gateway/http_gateway.ex

@@ -606,7 +606,8 @@ defmodule BorutaGateway.HttpGateway do
         method: method,
         path: path,
         status: status,
-        remote_ip: state.remote_ip || remote_ip(state.socket)
+        remote_ip: state.remote_ip || remote_ip(state.socket),
+        tls: "http"
       }
     )
 
@@ -619,14 +620,20 @@ defmodule BorutaGateway.HttpGateway do
       },
       %{
         request_id: request_id,
-        upstream: upstream
+        upstream: upstream,
+        upstream_tls: upstream_tls(upstream)
       }
     )
   end
 
   defp upstream_time(%State{upstream_start: nil}, _stop), do: 0
   defp upstream_time(%State{upstream_start: upstream_start}, stop), do: stop - upstream_start
 
+  defp upstream_tls(%Upstream{scheme: "https", mtls_enabled: true}), do: "mtls"
+  defp upstream_tls(%Upstream{scheme: "https"}), do: "tls"
+  defp upstream_tls(%Upstream{}), do: "http"
+  defp upstream_tls(nil), do: nil
+
   defp transform_header(payload, upstream, nil) do
     transform_header(payload, upstream, false)
   end

apps/boruta_gateway/lib/boruta_gateway/https_gateway.ex

@@ -640,7 +640,8 @@ defmodule BorutaGateway.HttpsGateway do
         method: method,
         path: path,
         status: status,
-        remote_ip: state.remote_ip || remote_ip(state.socket)
+        remote_ip: state.remote_ip || remote_ip(state.socket),
+        tls: downstream_tls(state.socket)
       }
     )
 
@@ -653,14 +654,29 @@ defmodule BorutaGateway.HttpsGateway do
       },
       %{
         request_id: request_id,
-        upstream: upstream
+        upstream: upstream,
+        upstream_tls: upstream_tls(upstream)
       }
     )
   end
 
   defp upstream_time(%State{upstream_start: nil}, _stop), do: 0
   defp upstream_time(%State{upstream_start: upstream_start}, stop), do: stop - upstream_start
 
+  defp downstream_tls(nil), do: nil
+
+  defp downstream_tls(socket) do
+    case :ssl.peercert(socket) do
+      {:ok, _certificate} -> "mtls"
+      {:error, _reason} -> "tls"
+    end
+  end
+
+  defp upstream_tls(%Upstream{scheme: "https", mtls_enabled: true}), do: "mtls"
+  defp upstream_tls(%Upstream{scheme: "https"}), do: "tls"
+  defp upstream_tls(%Upstream{}), do: "http"
+  defp upstream_tls(nil), do: nil
+
   defp transform_header(payload, upstream, nil) do
     transform_header(payload, upstream, false)
   end

apps/boruta_gateway/lib/boruta_gateway/logger.ex

@@ -36,7 +36,7 @@ defmodule BorutaGateway.Logger do
           path: path,
           status: status,
           remote_ip: remote_ip
-        },
+        } = metadata,
         _config
       ) do
     request(%{
@@ -45,7 +45,8 @@ defmodule BorutaGateway.Logger do
       path: path,
       status: status,
       remote_ip: remote_ip,
-      duration: duration
+      duration: duration,
+      tls: Map.get(metadata, :tls)
     })
   end
 
@@ -59,7 +60,7 @@ defmodule BorutaGateway.Logger do
         %{
           request_id: request_id,
           upstream: upstream
-        },
+        } = metadata,
         _config
       ) do
     business(%{
@@ -68,7 +69,8 @@ defmodule BorutaGateway.Logger do
       upstream: upstream,
       request_time: request_time,
       gateway_time: gateway_time,
-      upstream_time: upstream_time
+      upstream_time: upstream_time,
+      upstream_tls: Map.get(metadata, :upstream_tls)
     })
   end
 
@@ -78,7 +80,8 @@ defmodule BorutaGateway.Logger do
          path: path,
          status: status,
          remote_ip: remote_ip,
-         duration: duration
+         duration: duration,
+         tls: tls
        }) do
     Logger.log(
       :info,
@@ -95,6 +98,7 @@ defmodule BorutaGateway.Logger do
           Integer.to_string(status),
           " from ",
           remote_ip,
+          log_attribute("tls", tls),
           " in ",
           duration(duration)
         ]
@@ -111,7 +115,8 @@ defmodule BorutaGateway.Logger do
          upstream: upstream,
          request_time: request_time,
          gateway_time: gateway_time,
-         upstream_time: upstream_time
+         upstream_time: upstream_time,
+         upstream_tls: upstream_tls
        }) do
     Logger.log(
       :info,
@@ -127,6 +132,7 @@ defmodule BorutaGateway.Logger do
           log_attribute("upstream_id", upstream && upstream.id),
           log_attribute("upstream_host", upstream && upstream.host),
           log_attribute("upstream_port", upstream && upstream.port),
+          log_attribute("upstream_tls", upstream_tls),
           log_attribute("request_time", request_time),
           log_attribute("gateway_time", gateway_time),
           log_attribute("upstream_time", upstream_time)

apps/boruta_gateway/test/boruta_gateway/logger_test.exs

@@ -24,14 +24,15 @@ defmodule BorutaGateway.LoggerTest do
               method: "GET",
               path: "/upstream",
               status: 200,
-              remote_ip: ~c"127.0.0.1"
+              remote_ip: ~c"127.0.0.1",
+              tls: "mtls"
             },
             :ok
           )
         end)
 
       assert log =~ "request_id=request-id"
-      assert log =~ "boruta_gateway GET /upstream - sent 200 from 127.0.0.1 in 1ms"
+      assert log =~ "boruta_gateway GET /upstream - sent 200 from 127.0.0.1 tls=mtls in 1ms"
     end
   end
 
@@ -48,7 +49,8 @@ defmodule BorutaGateway.LoggerTest do
             },
             %{
               request_id: "request-id",
-              upstream: %Upstream{id: "upstream-id", host: "example.com", port: 443}
+              upstream: %Upstream{id: "upstream-id", host: "example.com", port: 443},
+              upstream_tls: "mtls"
             },
             :ok
           )
@@ -59,6 +61,7 @@ defmodule BorutaGateway.LoggerTest do
       assert log =~ "upstream_id=upstream-id"
       assert log =~ "upstream_host=example.com"
       assert log =~ "upstream_port=443"
+      assert log =~ "upstream_tls=mtls"
       assert log =~ "request_time=1500"
       assert log =~ "gateway_time=500"
       assert log =~ "upstream_time=1000"