Harden stream proxy timeouts and TLS handling

Author: eldryoth

CHANGELOG.md

@@ -24,6 +24,9 @@ behavior when the change improves security or project direction.
   PROXY protocol v1 receive from trusted sources.
 - Add stream unit coverage for wall-clock lifetime caps and upstream PROXY
   protocol v2 framing.
+- Bound stream upstream TLS DNS resolution under `connect_timeout_secs`, add
+  stream write/shutdown deadlines, avoid derived IP-literal SNI, and zeroize
+  temporary upstream mTLS private-key buffers after parsing.
 
 ## 1.4.6 - 2026-05-30
 

release-notes/RELEASE_NOTES_1.4.7.md

@@ -20,6 +20,9 @@ stream proxy foundation.
   from trusted sources.
 - Stream unit coverage for wall-clock lifetime caps and upstream PROXY
   protocol v2 framing.
+- Stream hardening for TLS DNS timeout coverage, stalled write/shutdown
+  deadlines, RFC 6066-safe SNI derivation, and temporary upstream mTLS
+  private-key zeroization after parsing.
 
 ## Planned Scope
 

src/stream_proxy.rs

@@ -555,6 +555,7 @@ async fn proxy_connected_stream_connection(
         options.upstream_proxy_protocol,
         source,
         destination,
+        options.idle_timeout,
     )
     .await?;
 
@@ -658,15 +659,19 @@ async fn copy_bidirectional_with_limits(
                     idle_timeout,
                 ).await?;
                 if bytes == 0 {
-                    upstream_writer.shutdown().await?;
+                    shutdown_with_idle_timeout(&mut upstream_writer, idle_timeout).await?;
                     Ok::<_, io::Error>(StreamCopyEvent::DownstreamEof)
                 } else {
                     let next = checked_stream_byte_count(
                         downstream_to_upstream,
                         bytes as u64,
                         max_connection_bytes,
                     )?;
-                    upstream_writer.write_all(&downstream_buffer[..bytes]).await?;
+                    write_with_idle_timeout(
+                        &mut upstream_writer,
+                        &downstream_buffer[..bytes],
+                        idle_timeout,
+                    ).await?;
                     Ok::<_, io::Error>(StreamCopyEvent::DownstreamTotal(next))
                 }
             }, if !downstream_eof => result,
@@ -677,15 +682,19 @@ async fn copy_bidirectional_with_limits(
                     idle_timeout,
                 ).await?;
                 if bytes == 0 {
-                    downstream_writer.shutdown().await?;
+                    shutdown_with_idle_timeout(&mut downstream_writer, idle_timeout).await?;
                     Ok::<_, io::Error>(StreamCopyEvent::UpstreamEof)
                 } else {
                     let next = checked_stream_byte_count(
                         upstream_to_downstream,
                         bytes as u64,
                         max_connection_bytes,
                     )?;
-                    downstream_writer.write_all(&upstream_buffer[..bytes]).await?;
+                    write_with_idle_timeout(
+                        &mut downstream_writer,
+                        &upstream_buffer[..bytes],
+                        idle_timeout,
+                    ).await?;
                     Ok::<_, io::Error>(StreamCopyEvent::UpstreamTotal(next))
                 }
             }, if !upstream_eof => result,
@@ -719,6 +728,36 @@ where
     }
 }
 
+async fn write_with_idle_timeout<W>(
+    writer: &mut W,
+    buffer: &[u8],
+    idle_timeout: Duration,
+) -> io::Result<()>
+where
+    W: tokio::io::AsyncWrite + Unpin,
+{
+    match tokio::time::timeout(idle_timeout, writer.write_all(buffer)).await {
+        Ok(result) => result,
+        Err(_) => Err(io::Error::new(
+            io::ErrorKind::TimedOut,
+            "stream write timeout elapsed",
+        )),
+    }
+}
+
+async fn shutdown_with_idle_timeout<W>(writer: &mut W, idle_timeout: Duration) -> io::Result<()>
+where
+    W: tokio::io::AsyncWrite + Unpin,
+{
+    match tokio::time::timeout(idle_timeout, writer.shutdown()).await {
+        Ok(result) => result,
+        Err(_) => Err(io::Error::new(
+            io::ErrorKind::TimedOut,
+            "stream shutdown timeout elapsed",
+        )),
+    }
+}
+
 fn checked_stream_byte_count(
     current: u64,
     additional: u64,
@@ -793,42 +832,44 @@ async fn connect_tls_upstream(
         feature = "tls-s2n"
     ))]
     {
-        let socket_addr = resolve_upstream_socket_addr(upstream_authority).await?;
-        let sni = options
-            .upstream_sni
-            .as_deref()
-            .map(str::to_owned)
-            .or_else(|| upstream_host(upstream_authority))
-            .unwrap_or_default();
-        let mut peer = HttpPeer::new(socket_addr, true, sni);
-        peer.options.connection_timeout = Some(options.connect_timeout);
-        peer.options.total_connection_timeout = Some(options.connect_timeout);
-        peer.options.verify_cert = options.upstream_verify_cert;
-        peer.options.verify_hostname = options.upstream_verify_hostname;
-        peer.options.alternative_cn = options
-            .upstream_alternative_cn
-            .as_deref()
-            .map(str::to_owned);
-        #[cfg(any(
-            feature = "tls-rustls-backend",
-            feature = "tls-openssl",
-            feature = "tls-boringssl"
-        ))]
-        {
-            peer.options.ca = options.upstream_tls_material.ca.clone();
-            peer.client_cert_key = options.upstream_tls_material.client_cert_key.clone();
-        }
-        let Some(connector) = &options.connector else {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "stream upstream TLS connector is not initialized",
-            ));
+        let connect = async {
+            let socket_addr = resolve_upstream_socket_addr(upstream_authority).await?;
+            let sni = stream_upstream_tls_sni(options.upstream_sni.as_deref(), upstream_authority);
+            let mut peer = HttpPeer::new(socket_addr, true, sni);
+            peer.options.connection_timeout = Some(options.connect_timeout);
+            peer.options.total_connection_timeout = Some(options.connect_timeout);
+            peer.options.verify_cert = options.upstream_verify_cert;
+            peer.options.verify_hostname = options.upstream_verify_hostname;
+            peer.options.alternative_cn = options
+                .upstream_alternative_cn
+                .as_deref()
+                .map(str::to_owned);
+            #[cfg(any(
+                feature = "tls-rustls-backend",
+                feature = "tls-openssl",
+                feature = "tls-boringssl"
+            ))]
+            {
+                peer.options.ca = options.upstream_tls_material.ca.clone();
+                peer.client_cert_key = options.upstream_tls_material.client_cert_key.clone();
+            }
+            let Some(connector) = &options.connector else {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidInput,
+                    "stream upstream TLS connector is not initialized",
+                ));
+            };
+            connector
+                .get_stream(&peer)
+                .await
+                .map(|(stream, _reused)| stream)
+                .map_err(|error| {
+                    io::Error::other(format!("stream upstream TLS connect failed: {error}"))
+                })
         };
-        match tokio::time::timeout(options.connect_timeout, connector.get_stream(&peer)).await {
-            Ok(Ok((stream, _reused))) => Ok(stream),
-            Ok(Err(error)) => Err(io::Error::other(format!(
-                "stream upstream TLS connect failed: {error}"
-            ))),
+
+        match tokio::time::timeout(options.connect_timeout, connect).await {
+            Ok(result) => result,
             Err(_) => Err(io::Error::new(
                 io::ErrorKind::TimedOut,
                 "stream upstream TLS connect timeout elapsed",
@@ -849,6 +890,22 @@ async fn connect_tls_upstream(
     }
 }
 
+#[cfg(any(
+    feature = "tls-rustls-backend",
+    feature = "tls-openssl",
+    feature = "tls-boringssl",
+    feature = "tls-s2n"
+))]
+fn stream_upstream_tls_sni(configured: Option<&str>, upstream_authority: &str) -> String {
+    configured
+        .map(str::to_owned)
+        .or_else(|| {
+            let host = upstream_host(upstream_authority)?;
+            host.parse::<IpAddr>().is_err().then_some(host)
+        })
+        .unwrap_or_default()
+}
+
 async fn connect_upstream_inner(upstream_authority: &str) -> io::Result<tokio::net::TcpStream> {
     let socket_addr = resolve_upstream_socket_addr(upstream_authority).await?;
     tokio::net::TcpStream::connect(socket_addr).await
@@ -873,6 +930,7 @@ async fn write_upstream_proxy_protocol(
     protocol: UpstreamProxyProtocol,
     source: Option<SocketAddr>,
     destination: Option<SocketAddr>,
+    idle_timeout: Duration,
 ) -> io::Result<()> {
     let header = match protocol {
         UpstreamProxyProtocol::Off => return Ok(()),
@@ -883,7 +941,7 @@ async fn write_upstream_proxy_protocol(
             crate::proxy_protocol::proxy_protocol_v2_header(source, destination)
         }
     };
-    upstream.write_all(&header).await
+    write_with_idle_timeout(upstream, &header, idle_timeout).await
 }
 
 fn downstream_peer_addr(downstream: &Stream) -> Option<SocketAddr> {

src/upstream_tls.rs

@@ -17,6 +17,12 @@ use std::sync::Arc;
     feature = "tls-boringssl"
 ))]
 use crate::config::ProxyConfig;
+#[cfg(any(
+    feature = "tls-rustls-backend",
+    feature = "tls-openssl",
+    feature = "tls-boringssl"
+))]
+use zeroize::Zeroizing;
 
 #[cfg(any(
     feature = "tls-rustls-backend",
@@ -267,7 +273,7 @@ fn load_upstream_client_cert_key(
     key_path: &std::path::Path,
 ) -> io::Result<Arc<pingora::utils::tls::CertKey>> {
     let cert_contents = read_upstream_tls_file(cert_path)?;
-    let key_contents = read_upstream_tls_file(key_path)?;
+    let key_contents = Zeroizing::new(read_upstream_tls_file(key_path)?);
 
     use rustls::pki_types::{CertificateDer, PrivateKeyDer, pem::PemObject};
 
@@ -302,12 +308,13 @@ fn load_upstream_client_cert_key(
         )
     })?;
 
+    let key_der = Zeroizing::new(key.secret_der().to_vec());
     let cert_key = pingora::utils::tls::CertKey::try_new(
         certs
             .into_iter()
             .map(|cert| cert.as_ref().to_vec())
             .collect(),
-        key.secret_der().to_vec(),
+        key_der.to_vec(),
     )
     .map_err(|error| {
         io::Error::new(
@@ -330,7 +337,7 @@ fn load_upstream_client_cert_key(
     key_path: &std::path::Path,
 ) -> io::Result<Arc<pingora::utils::tls::CertKey>> {
     let cert_contents = read_upstream_tls_file(cert_path)?;
-    let key_contents = read_upstream_tls_file(key_path)?;
+    let key_contents = Zeroizing::new(read_upstream_tls_file(key_path)?);
     let certs = pingora::tls::x509::X509::stack_from_pem(&cert_contents).map_err(|error| {
         io::Error::new(
             io::ErrorKind::InvalidData,