Harden native route proxy cutover checks

Author: eldryoth

CHANGELOG.md

@@ -33,6 +33,14 @@ behavior when the change improves security or project direction.
   non-blocking candidate-detail rows in the evidence report.
 - Fail closed in the native route-proxy primitive for invalid request targets
   and unsafe rewritten paths.
+- Reject interior double-slash forward paths in the native route-proxy path so
+  stripped or rewritten targets cannot be misclassified as upstream failures or
+  forwarded with ambiguous path semantics.
+- Mark regex routes as native HTTP/1 compatibility blockers until the native
+  route proxy supports regex matchers, and validate candidate-row shape in the
+  native runtime cutover gate before ignoring candidate-detail rows.
+- Reject single-dot route path segments at config validation time so invalid
+  strip/rewrite prefixes fail at startup instead of at request time.
 - Keep Pingora dependency exceptions enforced by target version so the final
   deletion cannot drift past the documented release without CI failing.
 

crates/fluxheim-common/src/path_safety.rs

@@ -12,6 +12,9 @@ pub fn safe_forward_path(path: &str) -> bool {
     {
         return false;
     }
+    if path.len() > 1 && path.contains("//") {
+        return false;
+    }
 
     path.split('/').all(safe_forward_path_segment)
 }
@@ -97,6 +100,13 @@ mod tests {
         assert!(safe_forward_path("/.well-known/acme-challenge/token"));
     }
 
+    #[test]
+    fn rejects_empty_interior_segments() {
+        assert!(!safe_forward_path("//admin"));
+        assert!(!safe_forward_path("/public//admin"));
+        assert!(safe_forward_path("/"));
+    }
+
     #[test]
     fn rejects_remaining_percent_after_decode_budget() {
         assert!(!safe_forward_path("/%2525252e%2525252e/secret"));

crates/fluxheim-config/src/config_route.rs

@@ -469,7 +469,9 @@ pub fn validate_route_path(
         || value.contains('?')
         || value.contains('#')
         || value.chars().any(char::is_control)
-        || value.split('/').any(|segment| segment == "..")
+        || value
+            .split('/')
+            .any(|segment| matches!(segment, "." | ".."))
     {
         return Err(ConfigError::InvalidRouteMatcher {
             vhost: String::new(),

crates/fluxheim-config/src/config_tests.rs

@@ -12307,6 +12307,32 @@ fn rejects_invalid_vhost_routes() {
         })
     );
 
+    let config: Config = toml::from_str(
+        r#"
+            [[vhosts]]
+            name = "gateway"
+            hosts = ["gateway.example"]
+
+            [[vhosts.routes]]
+            name = "bad"
+            path_prefix = "/one/"
+            strip_prefix = "/one/"
+            rewrite_prefix = "/upstream/./"
+
+            [vhosts.routes.proxy]
+            upstreams = ["127.0.0.1:6012"]
+            "#,
+    )
+    .unwrap();
+
+    assert_eq!(
+        config.validate(),
+        Err(ConfigError::InvalidRouteRewritePrefix {
+            vhost: "gateway".to_owned(),
+            route: "bad".to_owned(),
+        })
+    );
+
     let config: Config = toml::from_str(
         r#"
             [server]

crates/fluxheim-server/src/native_http1_plan.rs

@@ -190,7 +190,8 @@ fn vhost_policy_supported(vhost: &VhostConfig) -> bool {
 }
 
 fn route_policy_supported(route: &RouteConfig) -> bool {
-    !access_policy_active(&route.access)
+    route.path_regex.is_none()
+        && !access_policy_active(&route.access)
         && !route.rate_limit.enabled
         && !route.concurrency.enabled
         && !route.grpc.enabled

crates/fluxheim-server/src/native_http1_plan_tests.rs

@@ -175,6 +175,63 @@ fn server_plan_rejects_native_http1_route_proxy_candidate_with_route_policy() {
     );
 }
 
+#[test]
+fn server_plan_rejects_native_http1_route_proxy_candidate_with_regex_route() {
+    let mut config = Config::default();
+    config.server.regex_enabled = true;
+    config.vhosts = vec![VhostConfig {
+        name: "native.test".to_owned(),
+        hosts: vec!["native.test".to_owned()],
+        max_request_body_bytes: None,
+        access: Default::default(),
+        rate_limit: Default::default(),
+        concurrency: Default::default(),
+        tls: Default::default(),
+        acme_challenge: Default::default(),
+        redirect: Default::default(),
+        proxy: fluxheim_config::ProxyConfig::disabled(),
+        cache: CacheConfig::default(),
+        compression: None,
+        headers: Default::default(),
+        php: Default::default(),
+        web: Default::default(),
+        routes: vec![RouteConfig {
+            name: "api".to_owned(),
+            path_exact: None,
+            path_prefix: None,
+            path_regex: Some("^/api/v[0-9]+/".to_owned()),
+            methods: Vec::new(),
+            fallback: false,
+            https_redirect_exempt: false,
+            strip_prefix: None,
+            rewrite_prefix: None,
+            rewrite_template: None,
+            max_request_body_bytes: None,
+            access: Default::default(),
+            rate_limit: Default::default(),
+            concurrency: Default::default(),
+            grpc: Default::default(),
+            redirect: None,
+            proxy: Some(fluxheim_config::ProxyConfig {
+                upstreams: vec!["127.0.0.1:3002".to_owned()],
+                ..Default::default()
+            }),
+            web: None,
+            php: None,
+            cache: None,
+            compression: None,
+            headers: Default::default(),
+        }],
+    }];
+
+    let plan = ServerPlan::from_config(&config).expect("valid server plan");
+
+    assert_eq!(
+        plan.native_http1_proxy_candidates()[0].unsupported_reason(),
+        Some(NativeHttp1ProxyConfigError::HttpPolicy)
+    );
+}
+
 #[test]
 fn server_plan_accepts_native_http1_route_proxy_candidate_with_prefix_rewrite() {
     let config = Config {

crates/fluxheim-server/src/native_http1_route_proxy_tests.rs

@@ -154,3 +154,16 @@ async fn native_route_proxy_rejects_unsafe_rewritten_path() {
     assert!(response.starts_with("HTTP/1.1 400 Bad Request\r\n"));
     assert!(response.ends_with("bad request\n"));
 }
+
+#[tokio::test]
+async fn native_route_proxy_rejects_double_slash_after_stripped_prefix() {
+    let upstream = upstream_expect_path("/never", "never").await;
+    let route = NativeHttp1RouteProxyRoute::prefix("/api", Vec::new(), proxy_for(upstream))
+        .with_strip_prefix("/api");
+    let proxy = route_proxy_listener(NativeHttp1RouteProxy::new(vec![route], None)).await;
+
+    let response = downstream_get(proxy, "/api//evil").await;
+
+    assert!(response.starts_with("HTTP/1.1 400 Bad Request\r\n"));
+    assert!(response.ends_with("bad request\n"));
+}

packaging/rpm/fluxheim.spec

@@ -158,6 +158,8 @@ fi
 - Add native HTTP/1 proxy candidate rows to runtime cutover evidence.
 - Add the first native HTTP/1 route-proxy execution primitive for exact,
   prefix, and fallback routes with prefix strip/rewrite support.
+- Harden native route-proxy path validation, regex-route cutover reporting,
+  candidate-row validation, and route path config validation.
 - Re-scope final Pingora dependency deletion to 1.6.28 after remaining native
   policy and rich proxy parity slices.
 - Update release metadata for 1.6.25.

release-notes/RELEASE_NOTES_1.6.25.md

@@ -31,6 +31,13 @@ for ordinary exact, prefix, and fallback proxy routes.
   while allowing candidate-detail rows for audit visibility.
 - Reject invalid native route-proxy request targets and unsafe rewritten paths
   before forwarding.
+- Reject ambiguous interior double-slash forward paths in the native
+  route-proxy strip/rewrite path.
+- Keep regex routes marked as compatibility-required until native regex route
+  matching is implemented.
+- Validate native HTTP/1 proxy candidate row shape in the runtime cutover gate
+  before ignoring those rows for blocker status.
+- Reject single-dot route path segments during config validation.
 - Keep the dependency exception gate active so documented Pingora removal
   targets remain enforced by CI.
 

scripts/validate-native-runtime-cutover.sh

@@ -105,7 +105,13 @@ awk -F '\t' '
     }
     /^native-runtime-adapter:/ { next }
     /^config tester: ok$/ { next }
-    $1 == "native-http1-proxy-candidate" { next }
+    $1 == "native-http1-proxy-candidate" {
+        if (NF != 4) {
+            print "native runtime cutover evidence: malformed native-http1-proxy-candidate row: " $0 > "/dev/stderr"
+            exit 2
+        }
+        next
+    }
     $1 == "blocker" { next }
     NF == 0 { next }
     NF != 3 {
@@ -139,7 +145,13 @@ awk -F '\t' '
     }
     /^native-runtime-adapter:/ { next }
     /^config tester: ok$/ { next }
-    $1 == "native-http1-proxy-candidate" { next }
+    $1 == "native-http1-proxy-candidate" {
+        if (NF != 4) {
+            print "native runtime cutover evidence: malformed native-http1-proxy-candidate row: " $0 > "/dev/stderr"
+            exit 2
+        }
+        next
+    }
     $1 == "blocker" { next }
     NF == 0 { next }
     NF != 3 {
@@ -169,7 +181,13 @@ awk -F '\t' '
 awk -F '\t' '
     /^native-runtime-adapter:/ { next }
     /^config tester: ok$/ { next }
-    $1 == "native-http1-proxy-candidate" { next }
+    $1 == "native-http1-proxy-candidate" {
+        if (NF != 4) {
+            print "native runtime cutover evidence: malformed native-http1-proxy-candidate row: " $0 > "/dev/stderr"
+            exit 2
+        }
+        next
+    }
     $1 == "blocker" { next }
     NF == 0 { next }
     NF != 3 {