Sanitize PHP spool read buffers

Author: eldryoth

CHANGELOG.md

@@ -30,7 +30,8 @@ behavior when the change improves security or project direction.
   and is unsuitable for untrusted plugins colocated with secret-dependent work.
 - Bound complete FastCGI request/response operations with one deadline, retain
   anonymous request-body spool descriptors with independent positional reader
-  offsets, and fix the managed child `PATH`.
+  offsets, protect memory and spool-read buffers with
+  `sanitization::SecretVec`, and fix the managed child `PATH`.
 - Bind managed PHP-FPM spawn to a trusted executable descriptor and terminate
   its complete dedicated process group during shutdown and watchdog recovery.
 

Cargo.lock

@@ -15,8 +15,8 @@ getrandom = "0.4.3"
 log = "0.4.33"
 percent-encoding = "2.3.2"
 rustix = { version = "1.1.4", features = ["fs", "net", "process"] }
+sanitization = { version = "1.2.4", features = ["alloc"] }
 tokio = { version = "1.52.3", default-features = false, features = ["fs", "io-util", "net", "rt", "time"] }
-zeroize = "1.9.0"
 
 [dev-dependencies]
 fluxheim-common = { path = "../fluxheim-common", features = ["test-support"] }

crates/fluxheim-php-fpm/Cargo.toml

@@ -5,19 +5,19 @@ use std::sync::Arc;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::task::{Context, Poll};
 
-use zeroize::Zeroizing;
+use sanitization::SecretVec;
 
 static PHP_REQUEST_BODY_SPOOL_COUNTER: AtomicUsize = AtomicUsize::new(0);
 const PHP_SPOOL_POSITIONAL_READ_BYTES: usize = 64 * 1024;
-type PhpSpoolReadTask = tokio::task::JoinHandle<io::Result<(Vec<u8>, usize)>>;
+type PhpSpoolReadTask = tokio::task::JoinHandle<io::Result<(SecretVec, usize)>>;
 
 pub struct PhpRequestBody {
     inner: Arc<PhpRequestBodyInner>,
     len: usize,
 }
 
 enum PhpRequestBodyInner {
-    Memory(Zeroizing<Vec<u8>>),
+    Memory(Arc<SecretVec>),
     Spool(PhpRequestBodySpool),
 }
 
@@ -29,19 +29,25 @@ struct PhpSpoolReader {
     file: Arc<std::fs::File>,
     offset: u64,
     pending: Option<PhpSpoolReadTask>,
-    ready: Vec<u8>,
+    ready: SecretVec,
     ready_start: usize,
+    ready_len: usize,
+}
+
+struct PhpMemoryReader {
+    body: Arc<SecretVec>,
+    offset: usize,
 }
 
 impl PhpRequestBody {
     pub fn memory(body: Vec<u8>) -> Self {
-        Self::memory_zeroizing(Zeroizing::new(body))
+        Self::memory_secret(SecretVec::from_vec(body))
     }
 
-    pub fn memory_zeroizing(body: Zeroizing<Vec<u8>>) -> Self {
+    pub fn memory_secret(body: SecretVec) -> Self {
         Self {
             len: body.len(),
-            inner: Arc::new(PhpRequestBodyInner::Memory(body)),
+            inner: Arc::new(PhpRequestBodyInner::Memory(Arc::new(body))),
         }
     }
 
@@ -67,20 +73,40 @@ impl PhpRequestBody {
         &self,
     ) -> io::Result<Box<dyn fastcgi_client::io::AsyncRead + Unpin + Send>> {
         match self.inner.as_ref() {
-            PhpRequestBodyInner::Memory(body) => {
-                Ok(Box::new(fastcgi_client::io::Cursor::new(body.clone())))
-            }
+            PhpRequestBodyInner::Memory(body) => Ok(Box::new(PhpMemoryReader {
+                body: Arc::clone(body),
+                offset: 0,
+            })),
             PhpRequestBodyInner::Spool(spool) => Ok(Box::new(PhpSpoolReader {
                 file: Arc::clone(&spool.file),
                 offset: 0,
                 pending: None,
-                ready: Vec::new(),
+                ready: SecretVec::empty(),
                 ready_start: 0,
+                ready_len: 0,
             })),
         }
     }
 }
 
+impl fastcgi_client::io::AsyncRead for PhpMemoryReader {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        _context: &mut Context<'_>,
+        buffer: &mut [u8],
+    ) -> Poll<io::Result<usize>> {
+        let this = self.get_mut();
+        let copied = this.body.with_secret(|body| {
+            let available = body.get(this.offset..).unwrap_or_default();
+            let copied = available.len().min(buffer.len());
+            buffer[..copied].copy_from_slice(&available[..copied]);
+            copied
+        });
+        this.offset = this.offset.saturating_add(copied);
+        Poll::Ready(Ok(copied))
+    }
+}
+
 impl fastcgi_client::io::AsyncRead for PhpSpoolReader {
     fn poll_read(
         self: Pin<&mut Self>,
@@ -94,14 +120,18 @@ impl fastcgi_client::io::AsyncRead for PhpSpoolReader {
             return Poll::Ready(Ok(0));
         }
         loop {
-            if this.ready_start < this.ready.len() {
-                let available = &this.ready[this.ready_start..];
-                let copied = available.len().min(buffer.len());
-                buffer[..copied].copy_from_slice(&available[..copied]);
+            if this.ready_start < this.ready_len {
+                let copied = this.ready.with_secret(|ready| {
+                    let available = &ready[this.ready_start..this.ready_len];
+                    let copied = available.len().min(buffer.len());
+                    buffer[..copied].copy_from_slice(&available[..copied]);
+                    copied
+                });
                 this.ready_start += copied;
-                if this.ready_start == this.ready.len() {
-                    this.ready.clear();
+                if this.ready_start == this.ready_len {
+                    this.ready.clear_secret();
                     this.ready_start = 0;
+                    this.ready_len = 0;
                 }
                 return Poll::Ready(Ok(copied));
             }
@@ -135,9 +165,10 @@ impl fastcgi_client::io::AsyncRead for PhpSpoolReader {
                 };
                 this.offset = next_offset;
                 this.ready = bytes;
-                this.ready.truncate(read_len);
                 this.ready_start = 0;
+                this.ready_len = read_len;
                 if read_len == 0 {
+                    this.ready.clear_secret();
                     return Poll::Ready(Ok(0));
                 }
                 continue;
@@ -149,8 +180,8 @@ impl fastcgi_client::io::AsyncRead for PhpSpoolReader {
             this.pending = Some(tokio::task::spawn_blocking(move || {
                 use std::os::unix::fs::FileExt as _;
 
-                let mut bytes = vec![0_u8; read_len];
-                let read = file.read_at(&mut bytes, offset)?;
+                let mut bytes = SecretVec::from_fn(read_len, |_| 0);
+                let read = bytes.with_secret_mut(|bytes| file.read_at(bytes, offset))?;
                 Ok((bytes, read))
             }));
         }

crates/fluxheim-php-fpm/src/request_body.rs

@@ -19,17 +19,36 @@ fn php_request_body_replays_memory_body() {
         .expect("test runtime");
     let body = PhpRequestBody::memory(b"body".to_vec());
 
-    let mut reader = runtime.block_on(body.reader()).expect("memory reader");
-    let mut replayed = Vec::new();
-    runtime
-        .block_on(fastcgi_client::io::AsyncReadExt::read_to_end(
-            &mut reader,
-            &mut replayed,
-        ))
-        .expect("read memory body");
+    let mut first = runtime
+        .block_on(body.reader())
+        .expect("first memory reader");
+    let mut second = runtime
+        .block_on(body.reader())
+        .expect("second memory reader");
+    let mut first_prefix = [0_u8; 2];
+    let mut first_rest = Vec::new();
+    let mut second_replay = Vec::new();
+    runtime.block_on(async {
+        use fastcgi_client::io::AsyncReadExt as _;
+
+        first
+            .read_exact(&mut first_prefix)
+            .await
+            .expect("first memory prefix");
+        second
+            .read_to_end(&mut second_replay)
+            .await
+            .expect("second memory replay");
+        first
+            .read_to_end(&mut first_rest)
+            .await
+            .expect("first memory remainder");
+    });
 
     assert_eq!(body.len(), 4);
-    assert_eq!(replayed, b"body");
+    assert_eq!(first_prefix, *b"bo");
+    assert_eq!(first_rest, b"dy");
+    assert_eq!(second_replay, b"body");
 }
 
 #[test]

crates/fluxheim-php-fpm/src/tests_io_policy.rs

@@ -13,6 +13,7 @@ use std::time::Duration;
 use fluxheim_config::PhpConfig;
 use fluxheim_php_fpm::{PhpFpmPool, PhpRequestBody};
 use fluxheim_protocol::{Http1RequestTarget, Http1Version, http1_request_target};
+use sanitization::SecretVec;
 
 use crate::{NativeHttp1Request, NativeHttp1Response};
 
@@ -64,13 +65,13 @@ pub(crate) async fn native_php_request_body(
         ));
     }
     let Some(threshold) = php.request_body_spool_threshold_bytes else {
-        return Ok(fluxheim_php_fpm::PhpRequestBody::memory_zeroizing(
-            request.body.clone(),
+        return Ok(fluxheim_php_fpm::PhpRequestBody::memory_secret(
+            SecretVec::from_slice(&request.body),
         ));
     };
     if request.body.len() as u64 <= threshold.as_u64() {
-        return Ok(fluxheim_php_fpm::PhpRequestBody::memory_zeroizing(
-            request.body.clone(),
+        return Ok(fluxheim_php_fpm::PhpRequestBody::memory_secret(
+            SecretVec::from_slice(&request.body),
         ));
     }
     let Some(spool_dir) = php.request_body_spool_dir.as_deref() else {

crates/fluxheim-server/src/native_http1_php.rs

@@ -3509,8 +3509,11 @@ created spool entry is unlinked immediately and Fluxheim retains its open file
 descriptor for request and retry readers, preventing a crash from leaving a
 named plaintext upload behind. Overlapping readers use independent logical
 offsets with bounded positional disk reads, so one reader cannot reset or
-consume another reader's body position. This does not guarantee raw-media
-erasure; use encrypted storage or tmpfs when storage remanence is in scope. When
+consume another reader's body position. Fluxheim keeps memory bodies and each
+bounded positional-read buffer in `sanitization::SecretVec`, clears consumed
+buffers immediately, and clears their full allocation capacity on cancellation,
+error, or drop. This does not guarantee raw-media erasure; use encrypted storage
+or tmpfs when storage remanence is in scope. When
 `php.max_request_body_bytes` is set on the same PHP action, the spool threshold
 must be lower than that body limit. Existing spool paths must be directories,
 and existing directories must not be group/world writable. Fluxheim rechecks

docs/config-reference.md

@@ -337,8 +337,11 @@ for single-user/rootless deployments.
   named plaintext request body behind. Every request or retry reader maintains
   an independent logical offset and uses bounded positional reads through the
   blocking-I/O pool, so overlapping readers cannot reset or consume each
-  other's stream position. Use encrypted storage or tmpfs when raw storage
-  remanence is in scope.
+  other's stream position. In-memory request bodies and positional-read buffers
+  are held in `sanitization::SecretVec`; consumed buffers are cleared
+  immediately, and cancellation, errors, and drop clear their full allocation
+  capacity. Use encrypted storage or tmpfs when raw storage remanence is in
+  scope.
 - Custom FastCGI params in config. Implemented as `[vhosts.php.params]` and
   `[vhosts.routes.php.params]` with protected core CGI params.
 - Path mapping for separate Fluxheim/php-fpm container filesystem roots.

docs/php-runtime-support.md

@@ -51,6 +51,9 @@ general-purpose WASI application hosting.
   retaining a descriptor for retry replay. Give every reader an independent
   logical offset backed by bounded positional reads so overlapping readers
   cannot corrupt each other's request body stream.
+- Hold PHP memory bodies and bounded spool-read buffers in
+  `sanitization::SecretVec`, clear consumed spool buffers immediately, and
+  clear full buffer capacity on cancellation, error, or drop.
 - Replace inherited managed PHP-FPM `PATH` handling with a fixed allowlisted
   search path after clearing the child environment.