Filter managed workers from egress workers when the host address is unsafe (#2899)

internal/daemon/controller/handlers/targets/target_service.go

@@ -622,9 +622,9 @@ func (s Service) RemoveTargetCredentialSources(ctx context.Context, req *pbs.Rem
 	return &pbs.RemoveTargetCredentialSourcesResponse{Item: item}, nil
 }
 
-// If set, use the worker_filter or egress_worker_filter to filtere the selected workers
+// If set, use the worker_filter or egress_worker_filter to filter the selected workers
 // and ensure we have workers available to service this request.
-func AuthorizeSessionWithWorkerFilter(_ context.Context, t target.Target, selectedWorkers wl.WorkerList, _ common.Downstreamers) (wl.WorkerList, error) {
+func AuthorizeSessionWithWorkerFilter(_ context.Context, t target.Target, selectedWorkers wl.WorkerList, _ string, _ common.Downstreamers) (wl.WorkerList, error) {
 	if len(selectedWorkers) > 0 {
 		var eval *bexpr.Evaluator
 		var err error
@@ -728,26 +728,6 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 		return nil, err
 	}
 
-	// First ensure we can actually service a request, that is, we have workers
-	// available (after any filtering). WorkerInfo only contains the address;
-	// worker IDs below is used to contain their IDs in the same order. This is
-	// used to fetch tags for filtering. But we avoid allocation unless we
-	// actually need it.
-	selectedWorkers, err := serversRepo.ListWorkers(ctx, []string{scope.Global.String()}, server.WithLiveness(time.Duration(s.workerStatusGracePeriod.Load())))
-	if err != nil {
-		return nil, err
-	}
-
-	selectedWorkers, err = AuthorizeSessionWorkerFilterFn(ctx, t, selectedWorkers, s.downstreams)
-	if err != nil {
-		return nil, err
-	}
-
-	// Randomize the workers
-	rand.Shuffle(len(selectedWorkers), func(i, j int) {
-		selectedWorkers[i], selectedWorkers[j] = selectedWorkers[j], selectedWorkers[i]
-	})
-
 	p := strconv.FormatUint(uint64(t.GetDefaultPort()), 10)
 	var h, hostId, hostSetId string
 
@@ -852,18 +832,22 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
 		Host:   net.JoinHostPort(h, p),
 	}
 
-	for _, extraFilter := range ExtraWorkerFilters {
-		selectedWorkers, err = extraFilter(ctx, selectedWorkers, h, p)
-		if err != nil {
-			return nil, errors.Wrap(ctx, err, op, errors.WithMsg("error executing extra worker filter"))
-		}
-		if len(selectedWorkers) == 0 {
-			return nil, handlers.ApiErrorWithCodeAndMessage(
-				codes.FailedPrecondition,
-				"No workers are available to handle this session, or all have been filtered.")
-		}
+	// Get workers and filter down to ones that can service this request
+	selectedWorkers, err := serversRepo.ListWorkers(ctx, []string{scope.Global.String()}, server.WithLiveness(time.Duration(s.workerStatusGracePeriod.Load())))
+	if err != nil {
+		return nil, err
 	}
 
+	selectedWorkers, err = AuthorizeSessionWorkerFilterFn(ctx, t, selectedWorkers, h, s.downstreams)
+	if err != nil {
+		return nil, err
+	}
+
+	// Randomize the workers
+	rand.Shuffle(len(selectedWorkers), func(i, j int) {
+		selectedWorkers[i], selectedWorkers[j] = selectedWorkers[j], selectedWorkers[i]
+	})
+
 	var vaultReqs []credential.Request
 	var staticIds []string
 	var dynCreds []*session.DynamicCredential

internal/daemon/controller/handlers/targets/target_service_test.go

@@ -114,7 +114,7 @@ func TestWorkerList_EgressFilter(t *testing.T) {
 			if len(tc.filter) > 0 {
 				target.EgressWorkerFilter = tc.filter
 			}
-			out, err := AuthorizeSessionWithWorkerFilter(ctx, target, tc.in, nil)
+			out, err := AuthorizeSessionWithWorkerFilter(ctx, target, tc.in, "", nil)
 			if tc.errContains != "" {
 				assert.Contains(err.Error(), tc.errContains)
 				assert.Nil(out)