Enforce two-day limit on lease requests

appengine/machine_provider/handlers_endpoints.py

 # Copyright 2015 The LUCI Authors. All rights reserved.
 # Use of this source code is governed under the Apache License, Version 2.0
 # that can be found in the LICENSE file.
 
 """Cloud endpoints for the Machine Provider API."""
 
 import hashlib
 import json
 import logging
 
@@ skipping 333 matching lines @@
     logging.info(
         'Received LeaseRequest:\nUser: %s\nRequest hash: %s\n%s',
         user,
         request_hash,
         request,
     )
     return self._lease(request, user, request_hash)
 
   def _lease(self, request, user, request_hash):
     """Handles an incoming LeaseRequest."""
+    # Arbitrary limit. Increase if necessary.
+    MAX_LEASE_DURATION = 60 * 60 * 24 * 2
+    now = utils.time_time()
+    max_lease_expiration_ts = now + MAX_LEASE_DURATION
+
     metrics.lease_requests_received.increment()
     if request.duration:
       if request.lease_expiration_ts:
         return rpc_messages.LeaseResponse(
             client_request_id=request.request_id,
             error=rpc_messages.LeaseRequestError.MUTUAL_EXCLUSION_ERROR,
         )
       if request.duration < 1:
         return rpc_messages.LeaseResponse(
             client_request_id=request.request_id,
             error=rpc_messages.LeaseRequestError.NONPOSITIVE_DEADLINE,
         )
+      if request.duration > MAX_LEASE_DURATION:
+        return rpc_messages.LeaseResponse(
+            client_request_id=request.request_id,
+            error=rpc_messages.LeaseRequestError.LEASE_TOO_LONG,
+        )
     elif request.lease_expiration_ts:
-      if request.lease_expiration_ts <= utils.time_time():
+      if request.lease_expiration_ts <= now:
         return rpc_messages.LeaseResponse(
             client_request_id=request.request_id,
             error=rpc_messages.LeaseRequestError.LEASE_EXPIRATION_TS_ERROR,
         )
+      if request.lease_expiration_ts > max_lease_expiration_ts:
+        return rpc_messages.LeaseResponse(
+            client_request_id=request.request_id,
+            error=rpc_messages.LeaseRequestError.LEASE_TOO_LONG,
+        )
     else:
       return rpc_messages.LeaseResponse(
           client_request_id=request.request_id,
           error=rpc_messages.LeaseRequestError.LEASE_LENGTH_UNSPECIFIED,
       )
     if request.pubsub_topic:
       if not pubsub.validate_topic(request.pubsub_topic):
         logging.warning(
             'Invalid topic for Cloud Pub/Sub: %s',
             request.pubsub_topic,
@@ skipping 185 matching lines @@
 def get_routes():
   return endpoints_webapp2.api_routes(config.ConfigApi)
 
 
 def create_endpoints_app():
   return endpoints.api_server([
       CatalogEndpoints,
       MachineProviderEndpoints,
       config.ConfigApi,
   ])