CyberCoveLLC/threshold
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

In absence of ingress filter, use directly connected worker (#2757)

Browse Source 
* directly connected ingress filtering
This commit is contained in:
Irena Rindos authored and GitHub committed 2023-01-05 12:09:31 -05:00
1 parent 400f13a7e8
commit 9135cc7668
11 files changed
+50 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/daemon/controller/handler.go
+1
View File
@@ -197,6 +197,7 @@ func (c *Controller) registerGrpcServices(s *grpc.Server) error {
c.StaticHostRepoFn,
c.VaultCredentialRepoFn,
c.StaticCredentialRepoFn,
c.downstreamWorkers,
c.workerStatusGracePeriod)
if err != nil {
return fmt.Errorf("failed to create target handler service: %w", err)
internal/daemon/controller/handlers/targets/target_service.go
+5 -2
View File
@@ -113,6 +113,7 @@ type Service struct {
staticHostRepoFn common.StaticRepoFactory
vaultCredRepoFn common.VaultCredentialRepoFactory
staticCredRepoFn common.StaticCredentialRepoFactory
downstreams common.Downstreamers
kmsCache *kms.Kms
workerStatusGracePeriod *atomic.Int64
}
@@ -131,6 +132,7 @@ func NewService(
staticHostRepoFn common.StaticRepoFactory,
vaultCredRepoFn common.VaultCredentialRepoFactory,
staticCredRepoFn common.StaticCredentialRepoFactory,
downstreams common.Downstreamers,
workerStatusGracePeriod *atomic.Int64,
) (Service, error) {
const op = "targets.NewService"
@@ -167,6 +169,7 @@ func NewService(
staticHostRepoFn: staticHostRepoFn,
vaultCredRepoFn: vaultCredRepoFn,
staticCredRepoFn: staticCredRepoFn,
downstreams: downstreams,
kmsCache: kmsCache,
workerStatusGracePeriod: workerStatusGracePeriod,
}, nil
@@ -622,7 +625,7 @@ func (s Service) RemoveTargetCredentialSources(ctx context.Context, req *pbs.Rem
// If set, use the worker_filter or egress_worker_filter to filtere the selected workers
// and ensure we have workers available to service this request.
func AuthorizeSessionWithWorkerFilter(t target.Target, selectedWorkers []*server.Worker) ([]*server.Worker, error) {
func AuthorizeSessionWithWorkerFilter(_ context.Context, t target.Target, selectedWorkers []*server.Worker, _ common.Downstreamers) ([]*server.Worker, error) {
if len(selectedWorkers) > 0 {
var eval *bexpr.Evaluator
var err error
@@ -732,7 +735,7 @@ func (s Service) AuthorizeSession(ctx context.Context, req *pbs.AuthorizeSession
return nil, err
}
selectedWorkers, err = AuthorizeSessionWorkerFilterFn(t, selectedWorkers)
selectedWorkers, err = AuthorizeSessionWorkerFilterFn(ctx, t, selectedWorkers, s.downstreams)
if err != nil {
return nil, err
}
internal/daemon/controller/handlers/targets/target_service_test.go
+3 -2
View File
@@ -7,7 +7,6 @@ import (
"testing"
"github.com/hashicorp/boundary/internal/daemon/common"
"github.com/hashicorp/boundary/internal/db"
"github.com/hashicorp/boundary/internal/kms"
"github.com/hashicorp/boundary/internal/server"
@@ -40,6 +39,8 @@ func TestWorkerList_Addresses(t *testing.T) {
func TestWorkerList_EgressFilter(t *testing.T) {
t.Parallel()
ctx := context.Background()
SetupSuiteTargetFilters(t)
conn, _ := db.TestSetup(t, "postgres")
wrapper := db.TestWrapper(t)
kmsCache := kms.TestKms(t, conn, wrapper)
@@ -113,7 +114,7 @@ func TestWorkerList_EgressFilter(t *testing.T) {
if len(tc.filter) > 0 {
target.EgressWorkerFilter = tc.filter
}
out, err := AuthorizeSessionWithWorkerFilter(target, tc.in)
out, err := AuthorizeSessionWithWorkerFilter(ctx, target, tc.in, nil)
if tc.errContains != "" {
assert.Contains(err.Error(), tc.errContains)
assert.Nil(out)
internal/daemon/controller/handlers/targets/tcp/target_service_test.go
+8 -4
View File
@@ -105,7 +105,7 @@ func testService(t *testing.T, ctx context.Context, conn *db.DB, kms *kms.Kms, w
staticCredRepoFn := func() (*credstatic.Repository, error) {
return credstatic.NewRepository(context.Background(), rw, rw, kms)
}
return targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, statusGracePeriod)
return targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, nil, statusGracePeriod)
}
func TestGet(t *testing.T) {
@@ -2290,6 +2290,7 @@ func TestRemoveTargetCredentialSources(t *testing.T) {
func TestAuthorizeSession(t *testing.T) {
ctx := context.Background()
targets.SetupSuiteTargetFilters(t)
conn, _ := db.TestSetup(t, "postgres")
rw := db.New(conn)
wrapper := db.TestWrapper(t)
@@ -2469,7 +2470,7 @@ func TestAuthorizeSession(t *testing.T) {
statusGracePeriod := new(atomic.Int64)
statusGracePeriod.Store(int64(server.DefaultLiveness))
s, err := targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, statusGracePeriod)
s, err := targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, nil, statusGracePeriod)
require.NoError(t, err)
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
@@ -2584,6 +2585,8 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
wrapper := db.TestWrapper(t)
kms := kms.TestKms(t, conn, wrapper)
targets.SetupSuiteTargetFilters(t)
sche := scheduler.TestScheduler(t, conn, wrapper)
err := vault.RegisterJobs(context.Background(), sche, rw, rw, kms)
require.NoError(t, err)
@@ -2636,7 +2639,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
statusGracePeriod := new(atomic.Int64)
statusGracePeriod.Store(int64(server.DefaultLiveness))
s, err := targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, statusGracePeriod)
s, err := targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, nil, statusGracePeriod)
require.NoError(t, err)
hc := static.TestCatalogs(t, conn, proj.GetPublicId(), 1)[0]
@@ -3160,6 +3163,7 @@ func TestAuthorizeSessionTypedCredentials(t *testing.T) {
func TestAuthorizeSession_Errors(t *testing.T) {
ctx := context.Background()
targets.SetupSuiteTargetFilters(t)
conn, _ := db.TestSetup(t, "postgres")
rw := db.New(conn)
wrapper := db.TestWrapper(t)
@@ -3201,7 +3205,7 @@ func TestAuthorizeSession_Errors(t *testing.T) {
statusGracePeriod := new(atomic.Int64)
statusGracePeriod.Store(int64(server.DefaultLiveness))
s, err := targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, statusGracePeriod)
s, err := targets.NewService(ctx, kms, repoFn, iamRepoFn, serversRepoFn, sessionRepoFn, pluginHostRepoFn, staticHostRepoFn, vaultCredRepoFn, staticCredRepoFn, nil, statusGracePeriod)
require.NoError(t, err)
// Authorized user gets full permissions
internal/daemon/controller/handlers/targets/testing.go
+13
View File
@@ -0,0 +1,13 @@
package targets
import "testing"
// SetupSuiteTargetFilters is used to ensure that OSS tests run from the ENT repo use the OSS level of target filtering
func SetupSuiteTargetFilters(t *testing.T) {
oldFn := AuthorizeSessionWorkerFilterFn
AuthorizeSessionWorkerFilterFn = AuthorizeSessionWithWorkerFilter
t.Cleanup(func() {
AuthorizeSessionWorkerFilterFn = oldFn
})
}