fix: send raw QUIC stream codes as is in iroh and quinn

[kixelated]

A raw QUIC session (Session::raw) in web-transport-iroh and web-transport-quinn mapped RESET_STREAM and STOP_SENDING codes through the HTTP/3 WebTransport code space. A plain QUIC peer saw CANCELLED (1) as 0x52e4a40fa8dc, and its own small codes read back as InvalidReset / InvalidStopped. moq hit this against moxygen over raw QUIC (moq-dev/moq#4602). The same fix for web-transport-moq is moq-dev/noq#27.

• Each stream knows whether its session is raw. Raw sessions send reset and stop codes as is, and read a peer's code as is when it fits in a u32.
• A code in the HTTP/3 WebTransport range still decodes on a raw session. Older raw peers send that form, and no u32 reaches that range, so it cannot be mistaken for a raw code.
• HTTP/3 sessions are unchanged.

Impact

• Public API: none. The public From<ReadError> / From<WriteError> impls keep their HTTP/3 decoding; the streams decode through the session instead.
• Wire (raw QUIC only): stream codes become the application's own values. A fixed peer reads an older peer's mapped codes. An older peer reads a fixed peer's plain codes as InvalidReset / InvalidStopped.

Tests

web-transport-iroh tests::raw_stream_codes and web-transport-quinn tests/raw.rs::raw_session_stream_codes_are_not_mapped drive a raw session against a plain connection: reset and stop in each direction arrive verbatim, and a legacy HTTP/3-mapped code from the plain peer still decodes. Both fail without the fix.

Not changed here

• web-transport-noq and web-transport-quiche have raw sessions with the same mapping. moq does not use them; left for a follow-up.
• web-transport-iroh and web-transport-quinn still decode a raw peer's ApplicationClosed code only through the HTTP/3 space, so a raw close code is not reported by session_error(). fix(web-transport-moq): report a raw QUIC peer's close code noq#11 fixed that for web-transport-moq.

🤖 Generated with Claude Code

(Written by Claude Opus 5.5)

[kixelated]

The maintainer accepted the raw QUIC wire change for moq's dev branch, with no 0.7.x backport. Decision and release order: moq-dev/moq#4614 (comment)

(Written by Claude Opus 5.5)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-01T23:38:36.650897Z	59fc7d7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[kixelated]

Automated review by review (OpenAI)

Reviewed 59fc7d7 after ready-for-review. No actionable defects found in the introduced changes.

Direction: keeping the code-space choice on each stream is a small, appropriate fix. Raw and HTTP/3 open/accept paths propagate it consistently, including Quinn's poll API; the wrapped read/write errors and reset/stop operations use it without changing the public conversion impls. Accepting legacy mapped codes is unambiguous because that range is above every u32. No additional abstraction appears necessary.

The older-peer receive incompatibility is explicitly accepted in the linked release decision. The other backends and raw connection-close decoding remain documented follow-ups, not fixes supplied by this PR.

Verification: inspected all ten changed files and surrounding stream/session/error paths; checked mapping boundaries at 0, 29/30/31 and u32::MAX. GitHub CI for this exact SHA passed both just check and just test. I did not rerun Rust tests locally because this review environment has no Rust/Nix toolchain, and did not independently run cross-version interop.

(Written by review (OpenAI))

[kixelated]

No findings.

What I checked:

• Send paths: reset (iroh/quinn send.rs) and stop (recv.rs) both go through encode_stream_code. Raw sends code.into() (u32 to VarInt is infallible); HTTP/3 keeps the error_to_http3 + unwrap it had before.
• Receive paths: all Reset/Stopped decoding goes through decode_stream_code: read, read_exact, read_chunk(s), read_to_end, received_reset, write*, stopped, quinn poll_read, quinn poll_write, and quinn poll_closed, which captures raw before the retained future. The only error_from_http3 calls left are the public From impls (no longer used by the streams), close-code paths (out of scope, as the PR says), and ffi's connection-close decode. The AsyncRead/AsyncWrite impls pass quinn's io::Error through unmapped, the same as before.
• Raw flag at every constructor: iroh uses h3.is_none() on open and true in the raw accept branches. quinn uses session_id.is_none() (only Session::raw sets None), including the poll-trait open_*_owned and poll_accept_* paths. Both crates' H3 accept loops pass false. HTTP/3 behaviour is unchanged.
• Overflow/ambiguity: ERROR_FIRST (0x52e4a40fa8db) is above u32::MAX, so a raw u32 code never decodes as a legacy mapped code. A raw peer code above u32 still becomes InvalidReset/InvalidStopped, which is the right use of those variants. In quinn, a known session error still replaces them, as before.
• iroh/quinn parity: the two diffs mirror each other. iroh has no poll-trait stream impls, so it has nothing to add there.
• Tests: both new tests pass at 59fc7d7. With src/ reverted to the parent and the tests kept, raw_session_stream_codes_are_not_mapped fails at tests/raw.rs:259 and tests::raw_stream_codes fails at tests.rs:468. Both tests cover only the uni path. Bi and the poll-trait open/accept paths are fine by inspection but not exercised.

Impact: there is no public API change; only pub(crate) helpers and constructor arguments were added. The wire change is raw QUIC only and is one-way compatible, as described: an unfixed raw peer (for example an older moq relay on quinn) reads a fixed peer's resets and stops as InvalidReset/InvalidStopped. The decision to make is whether a release note should call that out for mixed-version moq deployments.

(Written by Claude Opus 5.5)

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a7cd47a1-a058-44c6-99c9-a0d71966f476

📥 Commits

Reviewing files that changed from the base of the PR and between b0e36a7 and 59fc7d7.

📒 Files selected for processing (10)

• rs/web-transport-iroh/src/error.rs
• rs/web-transport-iroh/src/recv.rs
• rs/web-transport-iroh/src/send.rs
• rs/web-transport-iroh/src/session.rs
• rs/web-transport-iroh/src/tests.rs
• rs/web-transport-quinn/src/error.rs
• rs/web-transport-quinn/src/recv.rs
• rs/web-transport-quinn/src/send.rs
• rs/web-transport-quinn/src/session.rs
• rs/web-transport-quinn/tests/raw.rs

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 0 remain after this review.

---

Walkthrough

The Iroh and Quinn transports now track whether each stream belongs to a raw QUIC or HTTP/3 session. Stream reset and stop codes use the corresponding encoding. Receive and write errors decode codes according to the stream mode, while raw-mode decoding also recognizes legacy HTTP/3-mapped codes. Tests cover unchanged raw codes and legacy mapped codes.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 59fc7

The change consistently separates raw QUIC stream codes from HTTP/3 mapping while retaining legacy decoding compatibility. No actionable merge-blocking risk is established; merge after normal checks pass.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 59fc7

The change is limited to stream error-code handling on existing QUIC sessions. No new privilege or trust-boundary bypass was identified. Mixed-version peers can interpret the newly emitted codes differently, so compatibility remains the principal design risk.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The supported attacker-controlled input is a connected peer’s reset or stop code, which becomes a stream termination result in the affected transports. Effects on downstream application policy, or exposure across tenants and services, were not established by the supplied evidence.

Trust Boundaries and Controls

• inferred — A peer’s numeric error code does not choose raw mode. Mode comes from the owning session, and HTTP/3 acceptance still classifies streams before constructing non-raw wrappers. The inspected changes do not introduce a mode-selection or framing bypass.

Resilience and Maintainability Implications

• observed — Quinn wrappers continue sharing the session’s OnceLock error state. Connection-loss handling still prefers that stored error, while reset and stop events use mode-aware stream-code decoding. Provider cleanup after failed header initialization remains delegated to existing behavior rather than being redesigned here.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 75.44% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 57 functions across 10 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely identifies the main change: raw QUIC stream codes are sent without HTTP/3 mapping in iroh and quinn.
Description check	✅ Passed	The description directly explains the raw QUIC code-mapping issue, the implementation, compatibility behavior, tests, impact, and scope.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}