// NewPolicyStore creates a new PolicyStore that is backed // using a given view. It used used to durable store and manage named policy. func NewPolicyStore(view *BarrierView, system logical.SystemView) *PolicyStore { p := &PolicyStore{ view: view, } if !system.CachingDisabled() { cache, _ := lru.New2Q(policyCacheSize) p.lru = cache } return p }
// LeaseExtend returns an OperationFunc that can be used to simply extend the // lease of the auth/secret for the duration that was requested. // // backendIncrement is the backend's requested increment -- perhaps from a user // request, perhaps from a role/config value. If not set, uses the mount/system // value. // // backendMax is the backend's requested increment -- this can be more // restrictive than the mount/system value but not less. // // systemView is the system view from the calling backend, used to determine // and/or correct default/max times. func LeaseExtend(backendIncrement, backendMax time.Duration, systemView logical.SystemView) OperationFunc { return func(req *logical.Request, data *FieldData) (*logical.Response, error) { var leaseOpts *logical.LeaseOptions switch { case req.Auth != nil: leaseOpts = &req.Auth.LeaseOptions case req.Secret != nil: leaseOpts = &req.Secret.LeaseOptions default: return nil, fmt.Errorf("no lease options for request") } // Use the mount's configured max unless the backend specifies // something more restrictive (perhaps from a role configuration // parameter) max := systemView.MaxLeaseTTL() if backendMax > 0 && backendMax < max { max = backendMax } // Should never happen, but guard anyways if max < 0 { return nil, fmt.Errorf("max TTL is negative") } // We cannot go past this time maxValidTime := leaseOpts.IssueTime.UTC().Add(max) // Get the current time now := time.Now().UTC() // If we are past the max TTL, we shouldn't be in this function...but // fast path out if we are if maxValidTime.Before(now) { return nil, fmt.Errorf("past the max TTL, cannot renew") } // Basic max safety checks have passed, now let's figure out our // increment. We'll use the user-supplied value first, then backend-provided default if possible, or the // mount/system default if not. increment := leaseOpts.Increment if increment <= 0 { if backendIncrement > 0 { increment = backendIncrement } else { increment = systemView.DefaultLeaseTTL() } } // We are proposing a time of the current time plus the increment proposedExpiration := now.Add(increment) // If the proposed expiration is after the maximum TTL of the lease, // cap the increment to whatever is left if maxValidTime.Before(proposedExpiration) { increment = maxValidTime.Sub(now) } // Set the lease leaseOpts.TTL = increment return &logical.Response{Auth: req.Auth, Secret: req.Secret}, nil } }