[kixelated]

Problem

A Unix listener checked its configured UID/GID/PID allowlist only after QMux's in-band handshake. A refused local user could reach the negotiation parser despite failing the credential gate.

Approach

Check kernel peer credentials in the private pending Unix handshake before calling qmux::uds::accept. Keep the same allowlist matcher, independent connection tasks, and handshake deadline. The current consumer is the server's configured Unix listener.

Impact

• Public API: none. The low-level public Listener::accept retains its existing behavior; the server passes its configured allowlist through a private method.
• Wire: none. Allowed peers negotiate the same ALPN. Refused peers close before any QMux read or write.
• No dependency, socket mode, or configuration changes.

Validation

• Reproduced before fixing with a real local socket: refused UID received one QMux preface byte (64).
• The four real Unix server tests pass: refused silent peer receives no negotiation bytes, allowed peer negotiates moq-lite-06, stalled handshake concurrency, shutdown, and configured publisher path. No sleeps, new timeout, host user changes, or mocked credentials.
• just fix stops at the unchanged rs/moq-mux/benches/catalog.rs:226 reference to nonexistent hang::catalog::MAX_RENDITIONS. Only the two changed source files were then formatted; git diff --check passes.
• Trusted final-head quest check: 618 documents pass.
• Clean committed-head nix develop --command just ci passes on e21ded1cc0c5a85d28f362e5e3c821df996ec0cb in 274 seconds, including strict Rust feature extremes, transport boundary checks, 5,341 Rust tests (85 skipped), and repository tooling. The new refusal test passes in that full run. No runner-image/UID-map check was selected for this diff.

Alternatives

Keeping the check after transport negotiation leaves the parser reachable. Moving it to the existing private socket-to-handshake boundary avoids a new public allowlist API.

Follow-ups

The benchmark compile error also blocks moq-dev/moq#6902 and moq-dev/moq#6898. An open-PR search found no dedicated repair. Repair it independently; it is outside the UDS boundary change. The required clean-head just ci passes, and the changed source formatting is verified.

(Written by GPT-6)

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 19 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9f5c0f88-c98f-4e61-9810-91468fa12f5f

Commits

Reviewing files that changed from the base of the PR and between 83d97be and e21ded1.

Files selected for processing: 4

• quest/m1/cut-audit/README.md
• quest/m1/cut-audit/uds-allowlist-first.md
• rs/moq-tokio/src/server.rs
• rs/moq-tokio/src/unix.rs

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T03:44:46.216803Z	e21ded1	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)

Reviewed commit: e21ded1

No actionable bugs found in the changed code and relevant surrounding paths. Moving the existing kernel-credential allowlist check ahead of qmux::uds::accept closes the intended parser-exposure gap without changing the public API or allowed-peer negotiation. The private pending-handshake boundary is a straightforward solution; independent tasks, deadlines, drain handling, and credential-matching semantics remain intact. The new real-socket test covers both refusal before negotiation bytes and successful allowed-peer ALPN negotiation.

Verification limits: source review through GitHub only; I did not run tests or independently reproduce the PR's reported CI results.

[kixelated]

Merge summary for e21ded1:

• The allowlist check now runs inside the pending Unix handshake, after peer_cred() and before qmux::uds::accept, so a refused peer's socket is dropped before qmux reads or writes a byte. The check still runs in the per-connection task under the handshake deadline and drain gate, so a refused peer can't block the accept loop.
• unix_allowlist_precedes_negotiation covers the ordering. A refused silent peer must see EOF/reset, which fails if the server sends the qmux preface first. The allowed peer must still negotiate moq-lite-06.
• Local nix develop --command just check on this head: all lanes passed, including the full Rust workspace (5,341 tests, moq-tokio included). The trusted quest check passes.
• Not changed: a refusal logs twice, once as the "rejected by allow list" warn with uid/gid/pid and again as the loop's generic "unix qmux handshake failed". This is cosmetic. Public Listener::accept still takes no allowlist, and the PR keeps that deliberately to avoid adding public API.
• Interop not run: there is no wire or handshake change for allowed peers.

(Written by Claude Opus 5.5)