Harden Fluxheim 1.7.7 release validation

Author: eldryoth

.gitignore

@@ -53,6 +53,7 @@ temp/
 *.zst
 *.img
 *.qcow2
+/*.rpm
 
 # Editor and OS noise
 .DS_Store

CHANGELOG.md

@@ -23,6 +23,9 @@ behavior when the change improves security or project direction.
 
 ### Changed
 
+- Select an installed GCC 13/12/11 compiler pair automatically for
+  release-mode rustls/AWS-LC FIPS validation when the system default compiler
+  is outside the supported range.
 - Update direct dependency baselines to `base64-ng 1.3.7`, `bytes 1.12.1`,
   `regex 1.13.0`, `sanitization 1.2.4`, and test-only `wat 1.253.0`.
 - Update the workspace MSRV, pinned toolchain, and container builders to Rust
@@ -43,6 +46,8 @@ behavior when the change improves security or project direction.
 - Restore `fuzz/` as an intentionally standalone cargo-fuzz workspace, remove
   its obsolete Pingora patch, refresh its dependency lockfile, and make the
   fuzz validation gate compile every target automatically.
+- Run filesystem-sensitive smoke fixtures below private repository-owned roots
+  and use compact paths for Unix-socket integration tests.
 
 ### Security
 
@@ -69,8 +74,13 @@ behavior when the change improves security or project direction.
   encryption keys in `sanitization::SecretBytes<32>`.
 - Reject duplicate canonical storage-bin roots, verify persisted cache object
   keys before serving, and record strict Host-routing rejections in metrics.
-- Route cache inspection through registered live allocators and hold an
-  exclusive filesystem lease for every active storage-bin root.
+- Route storage-bin cache inspection through registered live allocators and
+  hold an exclusive filesystem lease for every active storage-bin root, while
+  retaining standalone filesystem-backend CLI inspection.
+- Shorten generated managed PHP-FPM socket names and validate the complete Unix
+  socket address before spawn instead of permitting PHP-FPM path truncation.
+- Map native HTTP/1 request-head limit and syntax failures to explicit `431`,
+  `414`, and `400` responses before closing the connection.
 - Bound aggregate request-driven blocking work across Wasm, auth, mirrors,
   disk cache, and ACME at 256 beneath an explicit 384-thread Tokio blocking
   pool, preserving operational headroom.

crates/fluxheim-php-fpm/Cargo.toml

@@ -14,7 +14,7 @@ fluxheim-protocol = { path = "../fluxheim-protocol" }
 getrandom = "0.4.3"
 log = "0.4.33"
 percent-encoding = "2.3.2"
-rustix = { version = "1.1.4", features = ["fs", "process"] }
+rustix = { version = "1.1.4", features = ["fs", "net", "process"] }
 tokio = { version = "1.52.3", default-features = false, features = ["fs", "io-util", "net", "rt", "time"] }
 zeroize = "1.9.0"
 

crates/fluxheim-php-fpm/src/managed_config.rs

@@ -41,27 +41,12 @@ fn managed_php_fpm_instance_random() -> io::Result<u64> {
 }
 
 pub(crate) fn managed_php_fpm_instance_name_from_parts(
-    metric_pool: &str,
+    _metric_pool: &str,
     pid: u32,
     counter: usize,
     random: u64,
 ) -> io::Result<String> {
-    let sanitized = metric_pool
-        .bytes()
-        .map(|byte| match byte {
-            b'a'..=b'z' | b'A'..=b'Z' | b'0'..=b'9' | b'-' | b'_' => byte as char,
-            _ => '-',
-        })
-        .take(48)
-        .collect::<String>();
-    let sanitized = if sanitized.is_empty() {
-        "php".to_owned()
-    } else {
-        sanitized
-    };
-    Ok(format!(
-        "fluxheim-php-fpm-{sanitized}-{pid}-{counter}-{random:016x}"
-    ))
+    Ok(format!("fh-fpm-{pid:x}-{counter:x}-{random:016x}"))
 }
 
 pub fn managed_php_fpm_config(

crates/fluxheim-php-fpm/src/managed_process.rs

@@ -156,6 +156,15 @@ impl ManagedPhpFpmProcess {
         })?;
         let name = managed_php_fpm_instance_name(metric_pool)?;
         let socket = socket_dir.join(format!("{name}.sock"));
+        rustix::net::SocketAddrUnix::new(&socket).map_err(|error| {
+            io::Error::new(
+                io::ErrorKind::InvalidInput,
+                format!(
+                    "{scope}: managed php-fpm socket path {} is not supported: {error}",
+                    socket.display()
+                ),
+            )
+        })?;
         let config_path = socket_dir.join(format!("{name}.conf"));
         let pid_path = socket_dir.join(format!("{name}.pid"));
         let error_log = socket_dir.join(format!("{name}.log"));

crates/fluxheim-php-fpm/src/tests_io_policy.rs

@@ -169,20 +169,19 @@ fn managed_php_fpm_restart_backoff_is_bounded() {
 }
 
 #[test]
-fn managed_php_fpm_instance_names_are_sanitized_and_bounded() {
+fn managed_php_fpm_instance_names_are_compact_and_bounded() {
     assert_eq!(
         managed_php_fpm_instance_name_from_parts("pool/main:php", 42, 7, 0xfeed).unwrap(),
-        "fluxheim-php-fpm-pool-main-php-42-7-000000000000feed"
+        "fh-fpm-2a-7-000000000000feed"
     );
     assert_eq!(
         managed_php_fpm_instance_name_from_parts("", 42, 7, 0xfeed).unwrap(),
-        "fluxheim-php-fpm-php-42-7-000000000000feed"
+        "fh-fpm-2a-7-000000000000feed"
     );
 
     let long_name =
         managed_php_fpm_instance_name_from_parts(&"a".repeat(96), 42, 7, 0xfeed).unwrap();
-    assert!(long_name.contains(&"a".repeat(48)));
-    assert!(!long_name.contains(&"a".repeat(49)));
+    assert!(long_name.len() <= 48);
 }
 
 #[test]

crates/fluxheim-server/src/native_http1.rs

@@ -177,7 +177,7 @@ where
     let mut buffer = Vec::with_capacity(READ_CHUNK_BYTES);
 
     loop {
-        let Some(head_len) = timeout(
+        let head_result = timeout(
             policy.request_head_timeout(),
             read_until_head(&mut stream, &mut buffer, limits),
         )
@@ -187,8 +187,15 @@ where
                 std::io::ErrorKind::TimedOut,
                 "request head timeout",
             ))
-        })??
-        else {
+        })?;
+        let Some(head_len) = (match head_result {
+            Ok(head_len) => head_len,
+            Err(NativeHttp1Error::Parse(error)) => {
+                write_request_head_error(&mut stream, &error).await?;
+                return Ok(());
+            }
+            Err(error) => return Err(error),
+        }) else {
             return Ok(());
         };
         let (close_after_response, body_framing, request) = {
@@ -338,6 +345,30 @@ where
     .await
 }
 
+async fn write_request_head_error<S>(
+    stream: &mut S,
+    error: &Http1ParseError,
+) -> Result<(), NativeHttp1Error>
+where
+    S: AsyncWrite + Unpin,
+{
+    let response = match error {
+        Http1ParseError::HeaderCountExceeded
+        | Http1ParseError::HeaderLineTooLong
+        | Http1ParseError::HeadTooLarge => NativeHttp1Response::new(
+            431,
+            "Request Header Fields Too Large",
+            b"request header fields too large\n",
+        ),
+        Http1ParseError::StartLineTooLong => {
+            NativeHttp1Response::new(414, "URI Too Long", b"uri too long\n")
+        }
+        _ => NativeHttp1Response::new(400, "Bad Request", b"bad request\n"),
+    }
+    .close_connection();
+    write_response(stream, response, true).await
+}
+
 async fn read_until_head<S>(
     stream: &mut S,
     buffer: &mut Vec<u8>,

crates/fluxheim-server/src/native_http1_body_policy_tests.rs

@@ -135,17 +135,12 @@ async fn rejects_header_bytes_over_global_limit() {
         )
         .await
         .unwrap();
-    let mut response = [0u8; 1];
-    let read = stream.read(&mut response).await.unwrap();
+    let response = read_response(&mut stream).await;
     let result = result_rx.await.unwrap();
 
-    assert_eq!(read, 0);
-    assert!(matches!(
-        result,
-        Err(NativeHttp1Error::Parse(
-            fluxheim_protocol::Http1ParseError::HeadTooLarge
-        ))
-    ));
+    assert!(response.starts_with("HTTP/1.1 431 Request Header Fields Too Large\r\n"));
+    assert!(response.ends_with("request header fields too large\n"));
+    assert!(result.is_ok());
 }
 
 #[tokio::test]

crates/fluxheim-server/src/native_http1_cache_inspect.rs

@@ -3,10 +3,10 @@ use std::time::Instant;
 use fluxheim_cache::{
     CacheObjectFreshnessState, VaryRequestHashField, collect_cache_tags, vary_request_hash_material,
 };
-use fluxheim_config::CacheConfig;
+use fluxheim_config::{CacheConfig, CacheDiskBackend};
 
 use super::native_http1_cache_purge::registered_native_disk_cache;
-use super::{NativeDiskCacheObjectMetadata, native_instant_to_unix_secs};
+use super::{NativeDiskCache, NativeDiskCacheObjectMetadata, native_instant_to_unix_secs};
 
 pub fn inspect_native_disk_cache_object(
     vhost: &str,
@@ -15,7 +15,12 @@ pub fn inspect_native_disk_cache_object(
     primary_key: &str,
     request_headers: &[(String, String)],
 ) -> Option<NativeDiskCacheObjectMetadata> {
-    let cache = registered_native_disk_cache(vhost, route)?;
+    let cache = registered_native_disk_cache(vhost, route).or_else(|| {
+        matches!(config.disk.backend, CacheDiskBackend::Filesystem)
+            .then(|| NativeDiskCache::from_config(config))
+            .flatten()
+            .map(std::sync::Arc::new)
+    })?;
     let entry = cache.get(primary_key, |fields| {
         native_inspection_vary_cache_key(primary_key, fields, request_headers)
     })?;

crates/fluxheim-server/src/native_http1_cache_tests.rs

@@ -321,6 +321,60 @@ fn live_cache_inspection_uses_registered_allocator_during_inserts() {
     assert_eq!(cache.stats().entries, 2);
 }
 
+#[test]
+fn filesystem_cache_inspection_rebuilds_index_without_live_allocator() {
+    let directory = tempfile::tempdir().unwrap();
+    let config = CacheConfig {
+        enabled: true,
+        max_object_bytes: ByteSize::from_bytes(1024),
+        disk: fluxheim_config::CacheDiskConfig {
+            enabled: true,
+            path: Some(directory.path().join("cache")),
+            max_size_bytes: ByteSize::from_bytes(4096),
+            ..Default::default()
+        },
+        ..Default::default()
+    };
+    let cache = NativeDiskCache::from_config(&config).unwrap();
+    cache
+        .store(
+            disk_cache_store_key("standalone"),
+            &disk_cache_entry(b"body"),
+        )
+        .unwrap();
+    drop(cache);
+
+    let metadata = super::inspect_native_disk_cache_object(
+        "standalone-inspection.test",
+        None,
+        &config,
+        "standalone",
+        &[],
+    )
+    .unwrap();
+
+    assert_eq!(metadata.body_bytes, 4);
+}
+
+#[test]
+fn storage_bin_inspection_does_not_construct_unregistered_allocator() {
+    let directory = tempfile::tempdir().unwrap();
+    let root = directory.path().join("cache");
+    let config = storage_bin_config(&root);
+
+    assert!(
+        super::inspect_native_disk_cache_object(
+            "unregistered-storage-bin.test",
+            None,
+            &config,
+            "missing",
+            &[],
+        )
+        .is_none()
+    );
+    assert!(!root.exists());
+}
+
 const STORAGE_BIN_LEASE_CHILD_ROOT: &str = "FLUXHEIM_STORAGE_BIN_LEASE_CHILD_ROOT";
 const STORAGE_BIN_LEASE_CHILD_MAX_BYTES: &str = "FLUXHEIM_STORAGE_BIN_LEASE_CHILD_MAX_BYTES";
 const STORAGE_BIN_LEASE_CHILD_CONFIRMED: &str = "fluxheim-storage-bin-lease-child-confirmed";