Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fetch Google netblock from JSON on gstatic domain #6650

Conversation

modular-magician
Copy link
Collaborator

Release Note Template for Downstream PRs (will be copied)

netblock: fixed the google netblock ranges returned by the `google_netblock_ip_ranges` by targeting json on gstatic domain instead of reading SPF dns records (solution provided by network team)

We experienced the issue after seeing that some google domains are outside of the IPs provided by the SPF records.
For example :

ig datastudio.google.com
; <<>> DiG 9.10.6 <<>> datastudio.google.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 39814
;; flags: qr rd ra; QUERY: 1, ANSWER: 6, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4000
;; QUESTION SECTION:
;datastudio.google.com.		IN	A
;; ANSWER SECTION:
datastudio.google.com.	299	IN	A	142.250.31.101
datastudio.google.com.	299	IN	A	142.250.31.102
datastudio.google.com.	299	IN	A	142.250.31.138
datastudio.google.com.	299	IN	A	142.250.31.113
datastudio.google.com.	299	IN	A	142.250.31.100
datastudio.google.com.	299	IN	A	142.250.31.139
;; Query time: 96 msec
;; SERVER: 10.114.228.14#53(10.114.228.14)
;; WHEN: Fri Jun 12 11:33:54 CEST 2020
;; MSG SIZE  rcvd: 146

Currently the datasource return:

data.google_netblock_ip_ranges.netblock: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

cidr_blocks = [
  "35.190.247.0/24",
  "64.233.160.0/19",
  "66.102.0.0/20",
  "66.249.80.0/20",
  "72.14.192.0/18",
  "74.125.0.0/16",
  "108.177.8.0/21",
  "173.194.0.0/16",
  "209.85.128.0/17",
  "216.58.192.0/19",
  "216.239.32.0/19",
  "2001:4860:4000::/36",
  "2404:6800:4000::/36",
  "2607:f8b0:4000::/36",
  "2800:3f0:4000::/36",
  "2a00:1450:4000::/36",
  "2c0f:fb50:4000::/36",
  "172.217.0.0/19",
  "172.217.32.0/20",
  "172.217.128.0/19",
  "172.217.160.0/20",
  "172.217.192.0/19",
  "172.253.56.0/21",
  "172.253.112.0/20",
  "108.177.96.0/19",
  "35.191.0.0/16",
  "130.211.0.0/22",
]

With the changes proposed it return:

data.google_netblock_ip_ranges.netblock: Refreshing state...

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

Outputs:

cidr_blocks = [
  "8.8.4.0/24",
  "8.8.8.0/24",
  "8.34.208.0/20",
  "8.35.192.0/20",
  "23.236.48.0/20",
  "23.251.128.0/19",
  "34.64.0.0/10",
  "35.184.0.0/13",
  "35.192.0.0/14",
  "35.196.0.0/15",
  "35.198.0.0/16",
  "35.199.0.0/17",
  "35.199.128.0/18",
  "35.200.0.0/13",
  "35.208.0.0/12",
  "35.224.0.0/12",
  "35.240.0.0/13",
  "64.15.112.0/20",
  "64.233.160.0/19",
  "66.102.0.0/20",
  "66.249.64.0/19",
  "70.32.128.0/19",
  "72.14.192.0/18",
  "74.114.24.0/21",
  "74.125.0.0/16",
  "104.154.0.0/15",
  "104.196.0.0/14",
  "104.237.160.0/19",
  "107.167.160.0/19",
  "107.178.192.0/18",
  "108.59.80.0/20",
  "108.170.192.0/18",
  "108.177.0.0/17",
  "130.211.0.0/16",
  "136.112.0.0/12",
  "142.250.0.0/15",
  "146.148.0.0/17",
  "162.216.148.0/22",
  "162.222.176.0/21",
  "172.110.32.0/21",
  "172.217.0.0/16",
  "172.253.0.0/16",
  "173.194.0.0/16",
  "173.255.112.0/20",
  "192.158.28.0/22",
  "192.178.0.0/15",
  "199.36.154.0/23",
  "199.36.156.0/24",
  "199.192.112.0/22",
  "199.223.232.0/21",
  "207.223.160.0/20",
  "208.65.152.0/22",
  "208.68.108.0/22",
  "208.81.188.0/22",
  "208.117.224.0/19",
  "209.85.128.0/17",
  "216.58.192.0/19",
  "216.73.80.0/20",
  "216.239.32.0/19",
  "2001:4860::/32",
  "2404:6800::/32",
  "2404:f340::/32",
  "2600:1900::/28",
  "2607:f8b0::/32",
  "2620:11a:a000::/40",
  "2620:120:e000::/40",
  "2800:3f0::/32",
  "2a00:1450::/32",
  "2c0f:fb50::/32",
]

The solution has been provided by the GCP support (networking team).

Derived from GoogleCloudPlatform/magic-modules#3689

@modular-magician modular-magician merged commit d5f9b88 into hashicorp:master Jun 19, 2020
@ghost
Copy link

ghost commented Jul 20, 2020

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. If you feel I made an error 🤖 🙉 , please reach out to my human friends 👉 [email protected]. Thanks!

@ghost ghost locked and limited conversation to collaborators Jul 20, 2020
@modular-magician modular-magician deleted the downstream-pr-d3ef0dc3fe241972ab7f6a0a5b1d4e9b8362e1ed branch November 17, 2024 01:45
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant