fix(auth): bound OIDC CA bundle reads

Signed-off-by: Gordon Sim <gsim@redhat.com>

Author: grs

.agents/skills/helm-dev-environment/SKILL.md

@@ -342,6 +342,8 @@ development certificate and trust anchor; redeploy the gateway afterward so it r
 the mounted CA bundle. The chart renders the mount path as
 `[openshell.gateway.oidc] ca_bundle`; the gateway adds that issuer CA to native roots
 for OIDC discovery and JWKS requests without changing trust for other HTTPS clients.
+The mounted bundle must be a regular file no larger than 1 MiB; the gateway rejects
+other file types and oversized bundles during startup.
 
 Then activate OIDC in the OpenShell Helm chart:
 1. Uncomment `#- ci/values-keycloak.yaml` in `skaffold.yaml`

architecture/gateway.md

@@ -291,7 +291,7 @@ Supported auth modes:
 | Plaintext | Local development or a trusted reverse proxy boundary. |
 | Unauthenticated local users | Trusted Kubernetes dev or fully trusted proxy deployments only. |
 | Cloudflare JWT | Edge-authenticated deployments where Cloudflare Access supplies identity. |
-| OIDC | Bearer-token auth for users, with browser or device-code PKCE and client credentials login. Discovery and JWKS retrieval require HTTPS, reject redirects, and pin JWKS to the issuer origin or an explicit origin allowlist. An optional private issuer CA augments native roots for the OIDC client only. JWKS validation accepts RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and EdDSA (Ed25519) signing keys. |
+| OIDC | Bearer-token auth for users, with browser or device-code PKCE and client credentials login. Discovery and JWKS retrieval require HTTPS, reject redirects, and pin JWKS to the issuer origin or an explicit origin allowlist. An optional private issuer CA augments native roots for the OIDC client only; its bundle must be a regular file no larger than 1 MiB. JWKS validation accepts RS256, RS384, RS512, PS256, PS384, PS512, ES256, ES384, and EdDSA (Ed25519) signing keys. |
 
 The CLI persists the scopes requested during OIDC login in gateway metadata and
 reuses them when refreshing an access token. This preserves the intended API

crates/openshell-core/src/config.rs

@@ -334,9 +334,9 @@ pub struct OidcConfig {
     /// OIDC issuer URL (e.g., `https://idp.example.com/realms/openshell`).
     pub issuer: String,
 
-    /// Optional PEM CA bundle for an issuer signed by a private CA. These
-    /// certificates augment the platform trust roots for OIDC discovery and
-    /// JWKS requests only.
+    /// Optional PEM CA bundle for an issuer signed by a private CA. It must be
+    /// a regular file no larger than 1 MiB. These certificates augment the
+    /// platform trust roots for OIDC discovery and JWKS requests only.
     #[serde(default)]
     pub ca_bundle: Option<PathBuf>,
 

crates/openshell-core/src/driver_utils.rs

@@ -389,7 +389,7 @@ pub const MAX_UPSTREAM_PROXY_CREDENTIAL_BYTES: u64 = 4096;
 /// cannot be opened or stat'd, is not a regular file, or exceeds the size
 /// bound.
 pub fn read_upstream_proxy_credential_file(path: &str) -> Result<String, String> {
-    read_regular_file_bounded(path, MAX_UPSTREAM_PROXY_CREDENTIAL_BYTES).map_err(|err| match err {
+    read_regular_utf8_file_bounded(Path::new(path), MAX_UPSTREAM_PROXY_CREDENTIAL_BYTES).map_err(|err| match err {
         BoundedReadError::Open(e) => format!("failed to open proxy auth file '{path}': {e}"),
         BoundedReadError::Stat(e) => format!("failed to stat proxy auth file '{path}': {e}"),
         BoundedReadError::NotRegular => format!("proxy auth file '{path}' is not a regular file"),
@@ -430,19 +430,18 @@ pub const MAX_UPSTREAM_PROXY_CA_BUNDLE_BYTES: u64 = 1024 * 1024;
 /// cannot be read, is not a regular file, exceeds the size bound, or holds no
 /// usable certificate.
 pub fn read_upstream_proxy_ca_bundle_file(path: &str, label: &str) -> Result<String, String> {
-    let pem = read_regular_file_bounded(path, MAX_UPSTREAM_PROXY_CA_BUNDLE_BYTES).map_err(
-        |err| match err {
-            BoundedReadError::Open(e) | BoundedReadError::Stat(e) | BoundedReadError::Read(e) => {
-                format!("{label} '{path}' could not be read: {e}")
-            }
-            BoundedReadError::NotRegular => {
-                format!("{label} '{path}' is not a regular file")
-            }
-            BoundedReadError::TooLarge => format!(
-                "{label} '{path}' exceeds the {MAX_UPSTREAM_PROXY_CA_BUNDLE_BYTES}-byte limit"
-            ),
-        },
-    )?;
+    let pem = read_regular_utf8_file_bounded(Path::new(path), MAX_UPSTREAM_PROXY_CA_BUNDLE_BYTES)
+        .map_err(|err| match err {
+        BoundedReadError::Open(e) | BoundedReadError::Stat(e) | BoundedReadError::Read(e) => {
+            format!("{label} '{path}' could not be read: {e}")
+        }
+        BoundedReadError::NotRegular => {
+            format!("{label} '{path}' is not a regular file")
+        }
+        BoundedReadError::TooLarge => {
+            format!("{label} '{path}' exceeds the {MAX_UPSTREAM_PROXY_CA_BUNDLE_BYTES}-byte limit")
+        }
+    })?;
     validate_upstream_proxy_ca_bundle_pem(&pem, path, label)?;
     Ok(pem)
 }
@@ -491,21 +490,30 @@ pub fn validate_upstream_proxy_ca_bundle_pem(
 
 /// Failure modes of [`read_regular_file_bounded`], so each caller can phrase
 /// them in terms of the operator setting it is reading.
-enum BoundedReadError {
+#[derive(Debug)]
+pub enum BoundedReadError {
     Open(std::io::Error),
     Stat(std::io::Error),
     NotRegular,
     TooLarge,
     Read(std::io::Error),
 }
 
-/// Read a regular file into a `String`, rejecting anything larger than
+/// Read a regular file into memory, rejecting anything larger than
 /// `max_bytes` and anything that is not a regular file.
 ///
-/// Backs the operator-supplied proxy file readers, which must never let a
-/// hostile or misconfigured path (`/dev/zero`, a FIFO, a directory, a huge
-/// file) exhaust memory or block the caller.
-fn read_regular_file_bounded(path: &str, max_bytes: u64) -> Result<String, BoundedReadError> {
+/// The file is opened nonblocking on Unix so a FIFO with no writer cannot hang
+/// the caller. The size is checked both before and during the read so a file
+/// that grows after it is opened cannot bypass the bound.
+///
+/// This is a blocking read. Async callers should run it with
+/// `tokio::task::spawn_blocking`.
+///
+/// # Errors
+///
+/// Returns the operation that failed, or a dedicated error when the path is
+/// not a regular file or exceeds `max_bytes`.
+pub fn read_regular_file_bounded(path: &Path, max_bytes: u64) -> Result<Vec<u8>, BoundedReadError> {
     use std::io::Read as _;
 
     // Windows rejects opening a directory before a file handle is available,
@@ -544,16 +552,23 @@ fn read_regular_file_bounded(path: &str, max_bytes: u64) -> Result<String, Bound
         return Err(BoundedReadError::TooLarge);
     }
     // Bound the read even if the file grows between stat and read.
-    let mut buf = String::new();
-    file.take(max_bytes + 1)
-        .read_to_string(&mut buf)
+    let mut buf = Vec::new();
+    file.take(max_bytes.saturating_add(1))
+        .read_to_end(&mut buf)
         .map_err(BoundedReadError::Read)?;
     if buf.len() as u64 > max_bytes {
         return Err(BoundedReadError::TooLarge);
     }
     Ok(buf)
 }
 
+fn read_regular_utf8_file_bounded(path: &Path, max_bytes: u64) -> Result<String, BoundedReadError> {
+    let bytes = read_regular_file_bounded(path, max_bytes)?;
+    String::from_utf8(bytes).map_err(|error| {
+        BoundedReadError::Read(std::io::Error::new(std::io::ErrorKind::InvalidData, error))
+    })
+}
+
 /// Operator-supplied corporate upstream-proxy settings, as a borrowed view.
 ///
 /// Compute drivers store these keys under their own

crates/openshell-server/src/auth/oidc.rs

@@ -16,6 +16,7 @@ use super::principal::{Principal, UserPrincipal};
 use async_trait::async_trait;
 use jsonwebtoken::{Algorithm, DecodingKey, Validation, decode, decode_header};
 use openshell_core::OidcConfig;
+use openshell_core::driver_utils::{BoundedReadError, read_regular_file_bounded};
 use reqwest::Client;
 use serde::Deserialize;
 use std::collections::{HashMap, HashSet};
@@ -58,6 +59,10 @@ const KID_MISS_REFRESH_COOLDOWN: Duration = Duration::from_secs(1);
 const OIDC_DISCOVERY_MAX_BYTES: usize = 64 * 1024;
 const JWKS_MAX_BYTES: usize = 1024 * 1024;
 
+/// Hard upper bound for an operator-supplied OIDC CA bundle. This matches the
+/// Kubernetes `ConfigMap` size limit used to supply the bundle in Helm installs.
+const OIDC_CA_BUNDLE_MAX_BYTES: u64 = 1024 * 1024;
+
 /// Cached JWKS key set fetched from the OIDC issuer.
 ///
 /// A `refresh_mutex` ensures that only one refresh runs at a time,
@@ -583,12 +588,7 @@ impl JwksCache {
             .timeout(Duration::from_secs(10))
             .redirect(reqwest::redirect::Policy::none());
         if let Some(ca_bundle) = config.ca_bundle.as_deref() {
-            let pem = std::fs::read(ca_bundle).map_err(|error| {
-                format!(
-                    "failed to read OIDC CA bundle '{}': {error}",
-                    ca_bundle.display()
-                )
-            })?;
+            let pem = read_oidc_ca_bundle(ca_bundle).await?;
             let certificates = reqwest::Certificate::from_pem_bundle(&pem).map_err(|error| {
                 format!(
                     "failed to parse OIDC CA bundle '{}': {error}",
@@ -895,6 +895,30 @@ impl JwksCache {
     }
 }
 
+async fn read_oidc_ca_bundle(path: &std::path::Path) -> Result<Vec<u8>, String> {
+    let path = path.to_path_buf();
+    let display_path = path.display().to_string();
+    let task_display_path = display_path.clone();
+    tokio::task::spawn_blocking(move || {
+        read_regular_file_bounded(&path, OIDC_CA_BUNDLE_MAX_BYTES).map_err(|error| match error {
+            BoundedReadError::Open(error)
+            | BoundedReadError::Stat(error)
+            | BoundedReadError::Read(error) => {
+                format!("failed to read OIDC CA bundle '{task_display_path}': {error}")
+            }
+            BoundedReadError::NotRegular => {
+                format!("OIDC CA bundle '{task_display_path}' is not a regular file")
+            }
+            BoundedReadError::TooLarge => format!(
+                "OIDC CA bundle '{task_display_path}' exceeds the \
+                 {OIDC_CA_BUNDLE_MAX_BYTES}-byte limit"
+            ),
+        })
+    })
+    .await
+    .map_err(|error| format!("failed to read OIDC CA bundle '{display_path}': {error}"))?
+}
+
 /// Authenticator that validates `Authorization: Bearer <jwt>` headers against
 /// the configured OIDC issuer.
 ///
@@ -978,6 +1002,83 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn oidc_rejects_an_oversized_ca_bundle() {
+        let ca_bundle = tempfile::NamedTempFile::new().unwrap();
+        std::fs::write(
+            ca_bundle.path(),
+            vec![b'x'; usize::try_from(OIDC_CA_BUNDLE_MAX_BYTES + 1).unwrap()],
+        )
+        .unwrap();
+        let mut config = transport_test_config("https://issuer.example.com");
+        config.ca_bundle = Some(ca_bundle.path().to_path_buf());
+
+        let error = JwksCache::new(&config)
+            .await
+            .expect_err("an oversized CA bundle must fail before discovery");
+
+        assert!(
+            error.contains("OIDC CA bundle"),
+            "unexpected error: {error}"
+        );
+        assert!(error.contains("exceeds"), "unexpected error: {error}");
+        assert!(
+            error.contains(&OIDC_CA_BUNDLE_MAX_BYTES.to_string()),
+            "unexpected error: {error}"
+        );
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn oidc_rejects_a_fifo_ca_bundle_without_blocking() {
+        let dir = tempfile::tempdir().unwrap();
+        let fifo = dir.path().join("oidc-ca-fifo");
+        nix::unistd::mkfifo(&fifo, nix::sys::stat::Mode::S_IRUSR).unwrap();
+        let mut config = transport_test_config("https://issuer.example.com");
+        config.ca_bundle = Some(fifo);
+
+        let start = Instant::now();
+        let error = JwksCache::new(&config)
+            .await
+            .expect_err("a FIFO CA bundle must fail before discovery");
+
+        assert!(
+            error.contains("OIDC CA bundle"),
+            "unexpected error: {error}"
+        );
+        assert!(
+            error.contains("not a regular file"),
+            "unexpected error: {error}"
+        );
+        assert!(
+            start.elapsed() < Duration::from_secs(5),
+            "reading a FIFO must not block"
+        );
+    }
+
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn oidc_rejects_a_device_ca_bundle() {
+        if !std::path::Path::new("/dev/zero").exists() {
+            return;
+        }
+        let mut config = transport_test_config("https://issuer.example.com");
+        config.ca_bundle = Some("/dev/zero".into());
+
+        let error = JwksCache::new(&config)
+            .await
+            .expect_err("a device CA bundle must fail before discovery");
+
+        assert!(
+            error.contains("OIDC CA bundle"),
+            "unexpected error: {error}"
+        );
+        assert!(
+            error.contains("not a regular file"),
+            "unexpected error: {error}"
+        );
+    }
+
     #[tokio::test]
     async fn oidc_rejects_non_loopback_http_even_when_acknowledged() {
         let mut config = transport_test_config("http://192.0.2.1/issuer");

crates/openshell-server/src/cli.rs

@@ -163,7 +163,8 @@ struct RunArgs {
     oidc_issuer: Option<String>,
 
     /// Path to a PEM CA bundle for an OIDC issuer signed by a private CA.
-    /// The certificates augment platform trust roots for OIDC requests only.
+    /// Must be a regular file no larger than 1 MiB. The certificates augment
+    /// platform trust roots for OIDC requests only.
     #[arg(long, env = "OPENSHELL_OIDC_CA_BUNDLE")]
     oidc_ca_bundle: Option<PathBuf>,
 

docs/reference/gateway-config.mdx

@@ -265,7 +265,7 @@ Local Docker, Podman, and VM gateways can also set `[openshell.gateway.mtls_auth
 
 The client-certificate handshake policy is derived and has no `require_client_auth` TOML field. This preserves bearer-only OIDC clients and prevents a file setting from silently weakening CA-only gateways.
 
-`[openshell.gateway.oidc] ca_bundle` points to a certificate-only PEM bundle for an issuer signed by a private CA. The bundle augments platform trust roots for OIDC discovery and JWKS requests only; it does not replace native CA discovery or change trust for provider refresh, token exchange, telemetry, Vault, or other gateway HTTPS clients. Set the same value with `--oidc-ca-bundle` or `OPENSHELL_OIDC_CA_BUNDLE`. For Helm deployments, `server.oidc.caConfigMapName` mounts the ConfigMap's `ca.crt` key and renders this path automatically.
+`[openshell.gateway.oidc] ca_bundle` points to a certificate-only PEM bundle for an issuer signed by a private CA. The path must resolve to a regular file no larger than 1 MiB (1,048,576 bytes). The bundle augments platform trust roots for OIDC discovery and JWKS requests only; it does not replace native CA discovery or change trust for provider refresh, token exchange, telemetry, Vault, or other gateway HTTPS clients. Set the same value with `--oidc-ca-bundle` or `OPENSHELL_OIDC_CA_BUNDLE`. For Helm deployments, `server.oidc.caConfigMapName` mounts the ConfigMap's `ca.crt` key and renders this path automatically.
 
 `[openshell.gateway.tls]` supports optional SNI-based dual-certificate mode for deployments that need separate internal and external server certificates. Set `external_cert_path` and `external_key_path` to point at the external (e.g. ACME/publicly-trusted) certificate and key. List the hostnames that should be served with the external certificate in `external_server_names`. Connections whose TLS SNI hostname matches one of those names receive the external certificate; all other connections (including those with no SNI) receive the primary internal certificate from `cert_path`/`key_path`. Both fields must be set together — providing only one is a configuration error. On Kubernetes with the Helm chart, the external certificate is managed automatically when `certManager.serverIssuerRef.name` is set; the chart populates these fields from the cert-manager-issued external server certificate.
 

skills/debug-openshell-cluster/SKILL.md

@@ -910,7 +910,7 @@ credential failures.
 | Vault credential driver returns HTTP 403 / `Vault Kubernetes auth denied the configured role` on provider create | Vault's `auth/kubernetes` method or the gateway login role is not provisioned, or the role is not bound to the gateway service account and namespace | In Vault: `bao auth enable kubernetes` and `bao write auth/kubernetes/config kubernetes_host=... kubernetes_ca_cert=@...`; ensure the login role's `bound_service_account_names`/`bound_service_account_namespaces` match the gateway SA and namespace and its policy grants the credential paths |
 | CLI TLS error | Local mTLS bundle does not match server cert/CA | Check `~/.config/openshell/gateways/<name>/mtls/` |
 | Edge or OIDC gateway returns `Unauthenticated` | Stored login expired, audience/scopes mismatch, or gateway auth configuration changed | `openshell gateway info`, `openshell gateway login <name>`, gateway auth logs |
-| Gateway exits during OIDC initialization | Issuer is not HTTPS, discovery redirected, metadata used a non-JSON media type or exceeded its size limit, the configured `ca_bundle` is missing or invalid, or `jwks_uri` uses an untrusted origin | Use an HTTPS issuer; mount a private CA with `server.oidc.caConfigMapName` and confirm `[openshell.gateway.oidc] ca_bundle` names the mounted `ca.crt`; keep JWKS on the issuer origin or explicitly add its HTTPS origin to `server.oidc.jwksAllowedOrigins`. The issuer CA augments platform roots for OIDC only. Numeric-loopback HTTP is development-only and also requires `server.oidc.dangerouslyAllowInsecureHttp=true` |
+| Gateway exits during OIDC initialization | Issuer is not HTTPS, discovery redirected, metadata used a non-JSON media type or exceeded its size limit, the configured `ca_bundle` is missing, invalid, non-regular, or larger than 1 MiB, or `jwks_uri` uses an untrusted origin | Use an HTTPS issuer; mount a private CA with `server.oidc.caConfigMapName` and confirm `[openshell.gateway.oidc] ca_bundle` names the mounted regular-file `ca.crt` and is no larger than 1 MiB; keep JWKS on the issuer origin or explicitly add its HTTPS origin to `server.oidc.jwksAllowedOrigins`. The issuer CA augments platform roots for OIDC only. Numeric-loopback HTTP is development-only and also requires `server.oidc.dangerouslyAllowInsecureHttp=true` |
 | Gateway fails before serving health after enabling an interceptor | Interceptor endpoint unavailable or manifest/binding validation failed | Gateway and interceptor logs; interceptor socket; `binding_policy`, phases, and failure policy |
 | Authenticated interceptor or middleware rejects gateway calls | Private CA or hostname mismatch, expected audience or issuer mismatch, stale/unknown `kid`, or malformed extension token | `tls_ca_cert_path`, registration `audience`, service verifier config and logs; fetch well-known metadata only through the already-trusted gateway TLS endpoint |
 | Provider profiles disappear after enabling an interceptor catalog | `provider_profile_sources` selected only an authoritative interceptor or returned invalid/duplicate IDs | Inspect source list and interceptor `Describe`/catalog logs; include `user` when composition with imported profiles is intended |