mirror of
https://github.com/rustfs/rustfs.git
synced 2026-08-17 02:15:28 +00:00
唐小鸭
aa9f77f0f2
refresh_safety_window_secs is operator-supplied and unbounded, so a window like u64::MAX passed validation and then reached `Instant::now() + safety_window` in VaultCredentialProvider::current. After a lease-bearing login the first request panicked with "overflow when adding duration to instant" — reachable from the admin configure API for every login-based auth method. Use checked arithmetic and collapse an unrepresentable window to "refuse": such a window means every token is always inside it, so that is both the fail-closed answer and the one the arithmetic was reaching for. The comparison moves into one helper because current() and record_credential_gauges() must apply the same gate, which their doc comments already require. The other operand had the same defect: expires_at and renew_at add a TTL built from the lease_duration the Vault server sent, an unvalidated u64 off the wire. An unrepresentable TTL now collapses to None, which is indistinguishable from the no-expiry case Vault already produces for zero-lease tokens; the token stays in use and Vault still validates it on every call. Leaving that side unchecked would have kept the same panic reachable through the lease instead of the window.