{"record":{"id":"5842271b39ec4ae6","repo":"cloudflare/pingora","slug":"non-pathname-unix-sockets-not-supported-as-peer-584227","errorCode":null,"errorMessage":"non-pathname unix sockets not supported as peer","messagePattern":"non-pathname unix sockets not supported as peer","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pingora-core/src/protocols/mod.rs","lineNumber":300,"sourceCode":"use log::{debug, error};\n#[cfg(unix)]\nuse nix::sys::socket::{getpeername, SockaddrStorage, UnixAddr};\n#[cfg(unix)]\nuse std::os::unix::prelude::AsRawFd;\n#[cfg(windows)]\nuse std::os::windows::io::AsRawSocket;\nuse std::{net::SocketAddr as InetSocketAddr, path::Path};\n\nuse crate::protocols::tls::TlsRef;\n\n#[cfg(unix)]\nimpl ConnFdReusable for SocketAddr {\n    fn check_fd_match<V: AsRawFd>(&self, fd: V) -> bool {\n        match self {\n            SocketAddr::Inet(addr) => addr.check_fd_match(fd),\n            SocketAddr::Unix(addr) => addr\n                .as_pathname()\n                .expect(\"non-pathname unix sockets not supported as peer\")\n                .check_fd_match(fd),\n        }\n    }\n}\n\n#[cfg(windows)]\nimpl ConnSockReusable for SocketAddr {\n    fn check_sock_match<V: AsRawSocket>(&self, sock: V) -> bool {\n        match self {\n            SocketAddr::Inet(addr) => addr.check_sock_match(sock),\n        }\n    }\n}\n\n#[cfg(unix)]\nimpl ConnFdReusable for Path {\n    fn check_fd_match<V: AsRawFd>(&self, fd: V) -> bool {\n        let fd = fd.as_raw_fd();","sourceCodeStart":282,"sourceCodeEnd":318,"githubUrl":"https://github.com/cloudflare/pingora/blob/0046038bd402bc82912da862dadf9a479f31e9f1/pingora-core/src/protocols/mod.rs#L282-L318","documentation":"check_fd_match() validates that a pooled connection's file descriptor still points at the expected peer before reuse (called from HttpPeer::connection_reused/verify in pingora-core/src/upstreams/peer.rs). For Unix-domain peers pingora only supports pathname-bound sockets: it calls as_pathname() and expects Some(path). Abstract sockets (Linux '@name' addresses) and unnamed sockets return None, so the reuse check panics instead of returning false.","triggerScenarios":"An upstream/peer configured with a Unix SocketAddr that is abstract (path starting with a NUL byte) or unnamed, which then goes through connection-reuse validation via check_fd_match. The panic fires late — during pooled-connection reuse checks, not at connect time.","commonSituations":"Pointing an upstream at an abstract-namespace unix socket (used by some daemons to avoid filesystem cleanup); migrating an upstream from a path socket to an abstract socket; peers whose address comes from getpeername() on an abstract socket.","solutions":["Bind the upstream socket to a real filesystem path (pathname unix socket) — abstract sockets are explicitly unsupported for this check","If the peer must stay abstract, disable connection reuse for that upstream so check_fd_match is never called","Propose or patch pingora to return false (no match, no reuse) for non-pathname peers instead of expecting Some — failing the reuse check closed is safe"],"exampleFix":"// before: abstract-namespace peer (leading NUL / '@' form) — panics on reuse check\nlet peer = HttpPeer::new(SocketAddr::Unix(PathBuf::from(\"\\0svc.sock\")), true);\n\n// after: pathname-bound unix socket, supported by pingora's fd-reuse check\nlet peer = HttpPeer::new(SocketAddr::Unix(PathBuf::from(\"/run/svc/svc.sock\")), true);","handlingStrategy":"validation","validationCode":"use std::os::unix::net::SocketAddr;\n\n// Run before configuring the upstream peer\nfn is_supported_unix_peer(addr: &SocketAddr) -> bool {\n    match addr {\n        SocketAddr::Unix(u) => u.as_pathname().is_some(), // pathname-bound only\n        SocketAddr::Inet(_) => true,\n    }\n}\n\nassert!(is_supported_unix_peer(&unix_peer_addr),\n    \"abstract/unnamed unix sockets are unsupported as pingora peers\");","typeGuard":"fn is_pathname_unix(addr: &std::os::unix::net::SocketAddr) -> bool {\n    matches!(addr, std::os::unix::net::SocketAddr::Unix(_))\n        && addr.as_pathname().is_some() // false for abstract ('@name') and unnamed sockets\n}","tryCatchPattern":null,"preventionTips":["Use only pathname-bound unix sockets as pingora upstream peers","Test abstract-socket upstreams explicitly — this expect fires during reuse checks, late after connect","Grep peer configuration for NUL-prefixed or '@' unix addresses before deploy"],"tags":["rust","pingora","unix-socket","abstract-socket","connection-reuse","panic"],"backgroundTag":"abstract-unix-socket-unsupported","analyzedSha":"0046038bd402bc82912da862dadf9a479f31e9f1","analyzedAt":"2026-08-16T21:33:22.341Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}