From 3b7168a789a9ca0bd11489dc2bb0cd8be3f35b66 Mon Sep 17 00:00:00 2001
From: mhx <mathieu@hanotaux.fr>
Date: Fri, 31 Jul 2026 19:18:02 +0200
Subject: [PATCH] :loud_sound: cidr: log the decisions dropped for an
 unparsable CIDR

SetCIDR and DeleteCIDR returned silently when NormalizeCIDR rejected the
value, so a range decision the plugin does not understand is not enforced
and nothing says why. Every other operation of the package logs, and this
one fails open, which is the direction worth shouting about.

Log at Error with the raw value and what the consequence is, so an
unexpected decision format shows up in the logs instead of looking like a
decision that was applied.
---
 pkg/cache/cache.go | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkg/cache/cache.go b/pkg/cache/cache.go
index a497f09..f1624d3 100644
--- a/pkg/cache/cache.go
+++ b/pkg/cache/cache.go
@@ -162,10 +162,12 @@ func (c *Client) Set(key string, value string, duration int64) {
 
 // DeleteCIDR removes a CIDR decision from the cache.
 func (c *Client) DeleteCIDR(cidr string) {
-	cidr = ip.NormalizeCIDR(cidr)
-	if cidr == "" {
+	normalized := ip.NormalizeCIDR(cidr)
+	if normalized == "" {
+		c.log.Error(fmt.Sprintf("cache:DeleteCIDR:invalidCIDR cidr:%v decision is left in cache", cidr))
 		return
 	}
+	cidr = normalized
 	c.cache.delete(cidrPrefix + cidr)
 	c.log.Debug(fmt.Sprintf("cache:DeleteCIDR cidr:%v", cidr))
 }
@@ -191,6 +193,7 @@ func (c *Client) SetCIDR(cidr, value string, duration int64) {
 	normalized := ip.NormalizeCIDR(cidr)
 	prefixLen := ip.CIDRPrefixLen(cidr)
 	if normalized == "" || prefixLen < 0 {
+		c.log.Error(fmt.Sprintf("cache:SetCIDR:invalidCIDR cidr:%v value:%v decision is not enforced", cidr, value))
 		return
 	}
 	// Publish the length first, or a concurrent lookup misses the decision.