logging: ip_mask logs <nil> for IPv6 clients when only an IPv4 mask is set #8240

Issue Details

With the ip_mask log filter, an address whose family has no CIDR configured is logged as <nil>. A config that only sets an IPv4 size, which looks complete, loses every IPv6 client:

{
	auto_https off
}
http://:8080 {
	log {
		output file access.log
		format filter {
			wrap json
			fields {
				request>remote_ip ip_mask 16
				request>client_ip ip_mask {
					ipv4 24
				}
			}
		}
	}
	respond "ok"
}

$ curl -g 'http://[::1]:8080/'
$ jq -c '.request | [.remote_ip, .client_ip]' access.log
["<nil>","<nil>"]

An out-of-range size is accepted without an error and has the same effect: ip_mask 33 passes caddy validate and then logs <nil> for every IPv4 address.

Version: v2.11.7 (release binary) and master at 0584875.

Cause: in modules/logging/filters.go, IPMaskFilter.Provision maps an unset (0) size to a nil mask, and net.CIDRMask also returns nil for a size outside 0-32 / 0-128. mask() then calls ip.Mask(nil), which returns nil, and its String() is <nil>.

The out-of-range case looks like a plain config error, so I have a small patch with a test that rejects it at provision time.

For the unset family I'm not sure what you want: leave the address unchanged (an unconfigured family is not masked), or mask all of it (:: / 0.0.0.0) so nothing that is hidden today gets logged. Happy to add either to the patch.

Assistance Disclosure

AI used

If AI was used, describe the extent to which it was used.

AI used (Claude Code).