Close runtime admission and cache isolation gaps

Author: eldryoth

CHANGELOG.md

@@ -46,19 +46,26 @@ behavior when the change improves security or project direction.
 - Enforce strict host routing in native HTTP/1 and HTTP/2, returning `400` for
   missing/invalid identity and `421` for unknown hosts.
 - Acquire bounded Wasm admission before blocking-work submission, honor
-  `queue_limit`, and replace per-invocation watchdog threads with one epoch
+  `queue_limit`, and replace per-invocation watchdog threads with one
   process-wide epoch ticker.
+- Replace custom Wasm waiter notification with Tokio semaphores, acquire narrow
+  policy permits before global capacity, and cap active/queued budgets at 256.
 - Add bounded pre-submission external-auth admission and preserve valid
   operator access during global invalid-credential throttling.
+- Add a process-wide 256-request external-auth ceiling across route-specific
+  service limits.
 - Bound persistent cache index/metadata parsing and keep decoded local cache
   encryption keys in `sanitization::SecretBytes<32>`.
+- Reject duplicate canonical storage-bin roots, verify persisted cache object
+  keys before serving, and record strict Host-routing rejections in metrics.
 - Pin publishing actions, security-tool installs, and container base images to
   immutable reviewed versions and digests.
 
 ### Fixed
 
 - Replace storage-bin request-path full-index rewrites and map-scanning LRU
-  selection with a coalescing persistence worker and ordered eviction index.
+  selection with one process-wide coalescing persistence worker and ordered
+  eviction index.
 
 ## 1.7.6 - 2026-07-09
 

README.md

@@ -73,7 +73,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | --- | --- | --- |
 | Proxy cache | ✅ | Vhost and route-scoped cache policies. |
 | Memory cache | ✅ | Bounded in-memory cache tier. |
-| Disk cache | ✅ | Filesystem and storage-bin disk backends with ordered eviction and coalesced durable index writes. |
+| Disk cache | ✅ | Filesystem and storage-bin disk backends with ordered eviction, one process-wide persistence worker, unique-root enforcement, and coalesced durable index writes. |
 | Tiered cache | ✅ | Memory plus disk storage plans. |
 | Encrypted disk cache | ✅ | Optional local-key and OpenBao transit encryption paths. |
 | Static-file cache | ✅ | Optional local static-file caching. |
@@ -107,7 +107,7 @@ Fluxheim is licensed under the European Union Public Licence 1.2.
 | HTTP/2 origins | ✅ | Upstream HTTP version controls and bounded HTTP/2 settings. |
 | gRPC pass-through | ✅ | Route-scoped HTTP/2 gRPC policy; no transcoding. |
 | WebSocket / HTTP upgrade | ✅ | `1.4.1`; explicit `proxy.websocket = true` on HTTP/1.1 upstream routes. |
-| External auth subrequests | ✅ | `1.4.1`; `[proxy.auth_request]` with bounded header/body forwarding and pre-submission in-flight admission. |
+| External auth subrequests | ✅ | `1.4.1`; `[proxy.auth_request]` with bounded header/body forwarding plus per-service and process-wide pre-submission admission. |
 | Traffic mirroring | ✅ | `1.4.1`; `traffic-mirror` feature with safe bodyless shadow requests. |
 | TCP stream proxying | ✅ | Optional `stream-proxy` feature with Fluxheim-owned L4 TCP listener/data-path and upstream TLS connector boundaries, source IP/CIDR allow/deny policy, hostname-upstream DNS-rebinding guards, weighted upstream selection, drain/backup policy, bounded idle/lifetime/byte/connect controls, route-local PROXY protocol receive/send, and stream upstream TLS/mTLS controls. |
 | UDP/GSLB beta boundary | Limited | `1.5.16`; separate `[udp]` config namespace and `udp-proxy` feature gate with beta DNS-style request/response forwarding, bounded response waits, oversized-response drops, drop-log rate limiting, and syslog one-way forwarding. Public DNS reflector hardening, QUIC pass-through, game proxying, production UDP support, and generic UDP/GSLB platform behavior are not included yet. |

crates/fluxheim-config/src/config_proxy_auth.rs

@@ -10,7 +10,7 @@ use crate::config_http::valid_http_endpoint_url;
 
 const MAX_AUTH_REQUEST_HEADERS: usize = 32;
 const MAX_AUTH_REQUEST_RESPONSE_BYTES: u64 = 1024 * 1024;
-const MAX_AUTH_REQUEST_IN_FLIGHT: usize = 100_000;
+const MAX_AUTH_REQUEST_IN_FLIGHT: usize = 256;
 
 #[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize)]
 #[serde(deny_unknown_fields)]
@@ -154,7 +154,7 @@ impl AuthRequestConfig {
         if self.max_in_flight == 0 || self.max_in_flight > MAX_AUTH_REQUEST_IN_FLIGHT {
             return Err(ConfigError::InvalidProxyUpstreamPolicy {
                 field: scope,
-                reason: "max_in_flight must be between 1 and 100000",
+                reason: "max_in_flight must be between 1 and 256",
             });
         }
         Ok(())

crates/fluxheim-config/src/config_tests_proxy_transport.rs

@@ -70,7 +70,27 @@ fn rejects_invalid_proxy_upstream_policy() {
         saturated_auth_request.validate(),
         Err(ConfigError::InvalidProxyUpstreamPolicy {
             field: "proxy.auth_request",
-            reason: "max_in_flight must be between 1 and 100000",
+            reason: "max_in_flight must be between 1 and 256",
+        })
+    );
+
+    let oversized_auth_request: Config = toml::from_str(
+        r#"
+            [proxy]
+            upstream = "127.0.0.1:3001"
+
+            [proxy.auth_request]
+            enabled = true
+            url = "http://127.0.0.1:4180/auth"
+            max_in_flight = 257
+            "#,
+    )
+    .unwrap();
+    assert_eq!(
+        oversized_auth_request.validate(),
+        Err(ConfigError::InvalidProxyUpstreamPolicy {
+            field: "proxy.auth_request",
+            reason: "max_in_flight must be between 1 and 256",
         })
     );
 

crates/fluxheim-config/src/config_tests_wasm.rs

@@ -593,6 +593,73 @@ fn wasm_registry_rejects_invalid_total_admission_budget() {
     ));
 }
 
+#[cfg(feature = "wasm")]
+#[test]
+fn wasm_registry_rejects_execution_budgets_above_runtime_ceiling() {
+    let config: Config = toml::from_str(
+        r#"
+        [server]
+        listen = ["127.0.0.1:8080"]
+        default_vhost = "app"
+
+        [wasm]
+        enabled = true
+        plugin_roots = ["/srv/fluxheim/plugins"]
+        max_total_concurrent_executions = 257
+
+        [[wasm.plugins]]
+        name = "headers"
+        path = "/srv/fluxheim/plugins/headers.wasm"
+        phases = ["request-headers"]
+
+        [[vhosts]]
+        name = "app"
+        hosts = ["app.test"]
+        "#,
+    )
+    .unwrap();
+
+    assert!(matches!(
+        config.validate(),
+        Err(ConfigError::InvalidWasmPolicy {
+            field: "max_total_concurrent_executions",
+            ..
+        })
+    ));
+
+    let queued: Config = toml::from_str(
+        r#"
+        [server]
+        listen = ["127.0.0.1:8080"]
+        default_vhost = "app"
+
+        [wasm]
+        enabled = true
+        plugin_roots = ["/srv/fluxheim/plugins"]
+
+        [wasm.default_admission]
+        queue_limit = 257
+
+        [[wasm.plugins]]
+        name = "headers"
+        path = "/srv/fluxheim/plugins/headers.wasm"
+        phases = ["request-headers"]
+
+        [[vhosts]]
+        name = "app"
+        hosts = ["app.test"]
+        "#,
+    )
+    .unwrap();
+    assert!(matches!(
+        queued.validate(),
+        Err(ConfigError::InvalidWasmPolicy {
+            field: "queue_limit",
+            ..
+        })
+    ));
+}
+
 #[cfg(feature = "wasm")]
 #[test]
 fn wasm_registry_rejects_invalid_total_cache_admission_budget() {

crates/fluxheim-config/src/config_wasm.rs

@@ -12,8 +12,8 @@ pub const MAX_WASM_PLUGINS: usize = 128;
 pub const MAX_WASM_ATTACHMENTS: usize = 64;
 pub const MAX_WASM_PLUGIN_NAME_BYTES: usize = 64;
 pub const MAX_WASM_PLUGIN_PHASES: usize = 16;
-pub const MAX_WASM_MAX_CONCURRENT_EXECUTIONS: u32 = 100_000;
-pub const MAX_WASM_QUEUE_LIMIT: u32 = 100_000;
+pub const MAX_WASM_MAX_CONCURRENT_EXECUTIONS: u32 = 256;
+pub const MAX_WASM_QUEUE_LIMIT: u32 = 256;
 pub const MAX_WASM_ATTACHMENT_PRIORITY: u32 = 1_000_000;
 
 const DEFAULT_WASM_MAX_MODULE_BYTES: u64 = 1_048_576;

crates/fluxheim-server/src/lib.rs

@@ -272,6 +272,10 @@ mod native_http1_client_proxy_protocol_tests;
 #[path = "native_http1_host_router_tests.rs"]
 mod native_http1_host_router_tests;
 
+#[cfg(test)]
+#[path = "native_http1_host_router_cache_tests.rs"]
+mod native_http1_host_router_cache_tests;
+
 #[cfg(test)]
 #[path = "native_http1_proxy_tests.rs"]
 mod native_http1_proxy_tests;

crates/fluxheim-server/src/native_http1_cache.rs

@@ -31,6 +31,7 @@ mod native_http1_cache_state;
 mod native_http1_cache_storage_bin;
 
 pub(crate) use native_http1_cache_backend::NativeDiskCacheStoreKey;
+pub(crate) use native_http1_cache_backend::prepare_native_storage_bin_layout;
 use native_http1_cache_backend::{
     NativeDiskCacheBackend, NativeDiskCacheLocation, NativeDiskCacheRecord, NativeDiskCacheState,
 };
@@ -61,6 +62,7 @@ pub use native_http1_cache_purge::{
 };
 use native_http1_cache_state::native_disk_cache_mutation_locks;
 use native_http1_cache_storage_bin::NativeStorageBinIndexFlush;
+pub(crate) use native_http1_cache_storage_bin::ensure_native_storage_bin_index_service;
 
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub struct NativeDiskCacheObjectMetadata {
@@ -151,7 +153,11 @@ impl NativeDiskCache {
                 cache.root.display()
             );
         }
-        cache.index_flush = NativeStorageBinIndexFlush::start(&cache.backend, &cache.state);
+        cache.index_flush = NativeStorageBinIndexFlush::start(&cache.backend, &cache.state)
+            .inspect_err(|error| {
+                log::error!(target: "fluxheim::native_http1", "cache index service: {error}");
+            })
+            .ok()?;
         cache.persist_storage_bin_index();
         Some(cache)
     }
@@ -366,6 +372,14 @@ impl NativeDiskCache {
                 return None;
             }
         };
+        if object.combined_key.as_deref() != Some(combined_key) {
+            log::error!(
+                target: "fluxheim::security",
+                "native disk cache object identity mismatch; discarding requested cache record"
+            );
+            self.remove_combined(combined_key);
+            return None;
+        }
         let entry = match native_memory_entry_from_disk_object(&object) {
             Some(entry) => entry,
             None => {

crates/fluxheim-server/src/native_http1_cache_backend.rs

@@ -115,29 +115,8 @@ impl NativeDiskCacheBackend {
                 Ok((root, Self::Filesystem))
             }
             CacheDiskBackend::StorageBin => {
-                let plan = DiskTierPlan {
-                    backend: CacheDiskBackend::StorageBin,
-                    path: path.clone(),
-                    max_size_bytes: config.disk.max_size_bytes,
-                    max_object_bytes: config.max_object_bytes,
-                    cache_tag_headers: Vec::new(),
-                    storage_bin: config.disk.storage_bin.clone(),
-                    encryption: config.disk.encryption.clone(),
-                };
-                let mut layout = StorageBinLayoutPlan::from_disk_plan(&plan).ok_or_else(|| {
-                    std::io::Error::new(
-                        std::io::ErrorKind::InvalidInput,
-                        "native storage-bin cache requires a storage-bin disk plan",
-                    )
-                })?;
-                prepare_storage_bin_layout(&layout)?;
-                let root = layout.root.canonicalize()?;
-                layout = StorageBinLayoutPlan {
-                    root: root.clone(),
-                    manifest_path: root.join(STORAGE_BIN_MANIFEST_FILENAME),
-                    data_dir: root.join(STORAGE_BIN_DATA_DIR),
-                    ..layout
-                };
+                let layout = prepare_native_storage_bin_layout(config)?;
+                let root = layout.root.clone();
                 let free_map = StorageBinFreeMap::new(&layout);
                 let files = StorageBinFileSet::new(layout.clone());
                 Ok((
@@ -152,3 +131,38 @@ impl NativeDiskCacheBackend {
         }
     }
 }
+
+pub(crate) fn prepare_native_storage_bin_layout(
+    config: &CacheConfig,
+) -> std::io::Result<StorageBinLayoutPlan> {
+    let path = config.disk.path.as_ref().ok_or_else(|| {
+        std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            "native storage-bin cache requires cache.disk.path",
+        )
+    })?;
+    let plan = DiskTierPlan {
+        backend: CacheDiskBackend::StorageBin,
+        path: path.clone(),
+        max_size_bytes: config.disk.max_size_bytes,
+        max_object_bytes: config.max_object_bytes,
+        cache_tag_headers: Vec::new(),
+        storage_bin: config.disk.storage_bin.clone(),
+        encryption: config.disk.encryption.clone(),
+    };
+    let mut layout = StorageBinLayoutPlan::from_disk_plan(&plan).ok_or_else(|| {
+        std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            "native storage-bin cache requires a storage-bin disk plan",
+        )
+    })?;
+    prepare_storage_bin_layout(&layout)?;
+    let root = layout.root.canonicalize()?;
+    layout = StorageBinLayoutPlan {
+        root: root.clone(),
+        manifest_path: root.join(STORAGE_BIN_MANIFEST_FILENAME),
+        data_dir: root.join(STORAGE_BIN_DATA_DIR),
+        ..layout
+    };
+    Ok(layout)
+}