Set TokenImpersonationLevel.Anonymous in NamedPipeClient#8676
Merged
Conversation
andrewlock
added
the
area:tracer
This comment has been minimized.
This comment has been minimized.
BenchmarksBenchmark execution time: 2026-06-04 09:02:43 Comparing candidate commit b43dc88 in PR branch Found 0 performance improvements and 1 performance regressions! Performance is the same for 71 metrics, 0 unstable metrics, 63 known flaky benchmarks, 63 flaky benchmarks without significant changes.
|
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (8676) and master. ✅ No regressions detected - check the details below Full Metrics ComparisonFakeDbCommand
HttpMessageHandler
Comparison explanationExecution-time benchmarks measure the whole time it takes to execute a program, and are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are highlighted in **red**. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). Duration chartsFakeDbCommand (.NET Framework 4.8)gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (74ms) : 70, 78
master - mean (75ms) : 72, 79
section Bailout
This PR (8676) - mean (77ms) : 75, 79
master - mean (78ms) : 76, 81
section CallTarget+Inlining+NGEN
This PR (8676) - mean (1,107ms) : 1044, 1169
master - mean (1,090ms) : 1049, 1131
FakeDbCommand (.NET Core 3.1)gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (114ms) : 108, 120
master - mean (115ms) : 110, 121
section Bailout
This PR (8676) - mean (115ms) : 112, 118
master - mean (114ms) : 111, 117
section CallTarget+Inlining+NGEN
This PR (8676) - mean (790ms) : 768, 813
master - mean (786ms) : 767, 806
FakeDbCommand (.NET 6)gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (101ms) : 98, 104
master - mean (104ms) : 99, 109
section Bailout
This PR (8676) - mean (106ms) : 100, 112
master - mean (102ms) : 100, 104
section CallTarget+Inlining+NGEN
This PR (8676) - mean (950ms) : 909, 990
master - mean (938ms) : 902, 975
FakeDbCommand (.NET 8)gantt
title Execution time (ms) FakeDbCommand (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (99ms) : 95, 102
master - mean (99ms) : 96, 101
section Bailout
This PR (8676) - mean (100ms) : 97, 102
master - mean (103ms) : 99, 108
section CallTarget+Inlining+NGEN
This PR (8676) - mean (825ms) : 786, 865
master - mean (821ms) : 779, 862
HttpMessageHandler (.NET Framework 4.8)gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (200ms) : 194, 205
master - mean (199ms) : 193, 205
section Bailout
This PR (8676) - mean (203ms) : 200, 207
master - mean (202ms) : 198, 206
section CallTarget+Inlining+NGEN
This PR (8676) - mean (1,196ms) : 1155, 1238
master - mean (1,197ms) : 1154, 1240
HttpMessageHandler (.NET Core 3.1)gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (286ms) : 281, 291
master - mean (289ms) : 281, 297
section Bailout
This PR (8676) - mean (286ms) : 282, 291
master - mean (289ms) : 282, 297
section CallTarget+Inlining+NGEN
This PR (8676) - mean (963ms) : 943, 982
master - mean (968ms) : 946, 989
HttpMessageHandler (.NET 6)gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (280ms) : 274, 286
master - mean (281ms) : 273, 289
section Bailout
This PR (8676) - mean (279ms) : 276, 282
master - mean (279ms) : 271, 286
section CallTarget+Inlining+NGEN
This PR (8676) - mean (1,166ms) : 1129, 1203
master - mean (1,159ms) : 1126, 1193
HttpMessageHandler (.NET 8)gantt
title Execution time (ms) HttpMessageHandler (.NET 8)
dateFormat x
axisFormat %Q
todayMarker off
section Baseline
This PR (8676) - mean (278ms) : 271, 285
master - mean (277ms) : 272, 282
section Bailout
This PR (8676) - mean (278ms) : 271, 285
master - mean (278ms) : 272, 283
section CallTarget+Inlining+NGEN
This PR (8676) - mean (1,044ms) : 1002, 1086
master - mean (1,042ms) : 997, 1087
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
lucaspimentel
approved these changes
Jun 8, 2026
zacharycmontoya
pushed a commit
that referenced
this pull request
Jun 16, 2026
## Summary of changes Disable impersonation in various usages of `NamedPipeClient` ## Reason for change "Impersonation" allows the server-end of the named pipe to "act" as the client's user. We don't need that capabillity - the named pipe is just a dumb transport pipe to replace TCP/IP, so we can disable impersonation. I looked into whether we could/should set `PipeOptions.CurrentUserOnly` as well, but we explicitly _can't_ do that, because the agent creating the pipe is likely running as a different user. ## Implementation details Update three places we create a `NamedPipeClient` - For trace transports - In the `dd-trace` tool for testing connectivity - In the vendored statsd-client code - Updated the Vendored code too, but didn't test that this _actually_ vendors correctly, as I don't remember whether it does 😅 ## Test coverage Meh, existing named pipe tests seem sufficient, and worst case we have the AAS reliability env to test real-world
gh-worker-dd-mergequeue-cf854d Bot
pushed a commit
to DataDog/libdatadog
that referenced
this pull request
Jun 18, 2026
…e server (#2134) # What does this PR do? Disables named-pipe client impersonation in libdatadog's Windows named-pipe transport by opening the pipe with `SECURITY_ANONYMOUS` (the Rust/tokio equivalent of .NET's `TokenImpersonationLevel.Anonymous`). Concretely, `libdd-common`'s hyper-based connector now sets `ClientOptions::security_qos_flags(SECURITY_ANONYMOUS)` when opening a named pipe in `ConnStream::from_named_pipe_uri`, instead of relying on tokio's default of `SECURITY_IDENTIFICATION`. # Motivation This mirrors the dd-trace-dotnet change [Set `TokenImpersonationLevel.Anonymous` in `NamedPipeClient` (#8676)] DataDog/dd-trace-dotnet#8676). A Windows named pipe exposes the connecting client's security token to the server end, which can use it to identify or even impersonate the client. In our usage the pipe is just a dumb byte transport to the Datadog Agent, so the server end never needs any information about, or the ability to act as, the connecting (potentially privileged) process. Opening with `Anonymous` enforces least privilege and removes that capability, hardening against a malicious or pipe-squatting server reading the client's identity/privileges. # Additional Notes - libdatadog opens named-pipe clients through two transport stacks: - **hyper connector** (`libdd-common`) — fixed in this PR. Used by the `libdd-http-client` hyper backend. - **reqwest** — the path used by the profiling exporter, `libdd-agent-client`, and the default `libdd-http-client` backend. reqwest currently hardcodes `ClientOptions::new().open(pipe)` and exposes no API to set the QoS flags, so that path is **not** addressed here. A follow-up will upstream a security-flags option to reqwest and then consume it at those call sites. - Severity note: tokio's default is already `Identification` (not `Impersonation`), so the server cannot *act* as the client today; it can only read the client's identity/privileges. This change is therefore a defense-in-depth / least-privilege hardening that aligns the Rust posture with the .NET fix, not a fix for an exploitable privilege escalation on the Rust side. - A shared `ANONYMOUS_IMPERSONATION_QOS` constant was added in `libdd-common/src/connector/named_pipe.rs` so the same value can be reused by the future reqwest call sites. # How to test the change? The change is Windows-only (`#[cfg(windows)]`). - Automated: a round-trip test `from_named_pipe_uri_connects_with_anonymous_qos` was added in `libdd-common/src/connector/conn_stream.rs`. It stands up a tokio `ServerOptions` named-pipe server and asserts the client connects successfully with the Anonymous QoS flags. On a Windows host: Co-authored-by: gregory.leocadie <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
Disable impersonation in various usages of
NamedPipeClientReason for change
"Impersonation" allows the server-end of the named pipe to "act" as the client's user. We don't need that capabillity - the named pipe is just a dumb transport pipe to replace TCP/IP, so we can disable impersonation.
I looked into whether we could/should set
PipeOptions.CurrentUserOnlyas well, but we explicitly can't do that, because the agent creating the pipe is likely running as a different user.Implementation details
Update three places we create a
NamedPipeClientdd-tracetool for testing connectivityTest coverage
Meh, existing named pipe tests seem sufficient, and worst case we have the AAS reliability env to test real-world