logical/framework: more tests

logical/framework/lease.go

@@ -18,6 +18,17 @@ func LeaseExtend(max time.Duration) OperationFunc {
 			return nil, fmt.Errorf("no lease options for request")
 		}
 
+		// Protect against negative leases
+		if lease.LeaseIncrement < 0 {
+			return logical.ErrorResponse(
+				"increment must be greater than 0"), logical.ErrInvalidRequest
+		}
+
+		// If the lease is zero, then assume max
+		if lease.LeaseIncrement == 0 {
+			lease.LeaseIncrement = max
+		}
+
 		// Determine the requested lease
 		newLease := lease.IncrementedLease(lease.LeaseIncrement)
 

logical/framework/lease_test.go

@@ -14,6 +14,7 @@ func TestLeaseExtend(t *testing.T) {
 		Max     time.Duration
 		Request time.Duration
 		Result  time.Duration
+		Error   bool
 	}{
 		"valid request, good bounds": {
 			Max:     30 * time.Hour,
@@ -21,11 +22,25 @@ func TestLeaseExtend(t *testing.T) {
 			Result:  1 * time.Hour,
 		},
 
+		"request is zero": {
+			Max:     30 * time.Hour,
+			Request: 0,
+			Result:  30 * time.Hour,
+		},
+
 		"request is too long": {
 			Max:     3 * time.Hour,
 			Request: 7 * time.Hour,
 			Result:  3 * time.Hour,
 		},
+
+		// Don't think core will allow this, but let's protect against
+		// it at multiple layers anyways.
+		"request is negative": {
+			Max:     3 * time.Hour,
+			Request: -7 * time.Hour,
+			Error:   true,
+		},
 	}
 
 	for name, tc := range cases {
@@ -41,9 +56,12 @@ func TestLeaseExtend(t *testing.T) {
 
 		callback := LeaseExtend(tc.Max)
 		resp, err := callback(req, nil)
-		if err != nil {
+		if (err != nil) != tc.Error {
 			t.Fatalf("bad: %s\nerr: %s", name, err)
 		}
+		if tc.Error {
+			continue
+		}
 
 		// Round it to the nearest hour
 		lease := now.Add(resp.Auth.Lease).Round(time.Hour).Sub(now)