chore(profiling): Use SECURITY_ANONYMOUS when connecting to named pipe server#2134
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit intoJun 18, 2026
Merged
Conversation
Contributor
Clippy Allow Annotation ReportComparing clippy allow annotations between branches:
Summary by Rule
Annotation Counts by File
Annotation Stats by Crate
About This ReportThis report tracks Clippy allow annotations for specific rules, showing how they've changed in this PR. Decreasing the number of these annotations generally improves code quality. |
🎉 All green!🧪 All tests passed 🎯 Code Coverage (details) 🔗 Commit SHA: ff4adde | Docs | Datadog PR Page | Give us feedback! |
Contributor
Artifact Size Benchmark Reportaarch64-alpine-linux-musl
aarch64-unknown-linux-gnu
libdatadog-x64-windows
libdatadog-x86-windows
x86_64-alpine-linux-musl
x86_64-unknown-linux-gnu
|
gyuheon0h
approved these changes
Jun 18, 2026
gh-worker-dd-devflow-36fce6
Bot
added
mergequeue-status: queued
mergequeue-status: in_progress
and removed
mergequeue-status: queued
labels
gh-worker-dd-mergequeue-cf854d
Bot
deleted the
gleocadie/fix-issue-named-pipe
branch
iunanua
added a commit
that referenced
this pull request
Jun 19, 2026
# Release proposal for libdd-remote-config and its dependencies This PR contains version bumps based on public API changes and commits since last release. ## libdd-common **Next version:** `5.0.0` **Semver bump:** `major` **Tag:** `libdd-common-v5.0.0` ### Commits - chore(profiling): Use SECURITY_ANONYMOUS when connecting to named pipe server (#2134) - fix: Fix http PathAndQuery Uri Parsing (#2122) - chore(common)!: replace native-certs with platform-verifier (#2078) - feat(data-pipeline)!: CSS Trace Filters (#1985) - fix(libdd-common): Add fallback logic for resolving Azure Functions instance name [SVLS-8931] (#2077) - test: fix timeouts on heavily contended scenarios (#2093) ## libdd-remote-config **Next version:** `1.0.0` **Semver bump:** `major` **Tag:** `libdd-remote-config-v1.0.0` **Warning:** this is an initial release. Please verify that the version and commits included are correct. --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: iunanua <18325288+iunanua@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Disables named-pipe client impersonation in libdatadog's Windows named-pipe transport by opening the pipe with
SECURITY_ANONYMOUS(the Rust/tokio equivalent of .NET'sTokenImpersonationLevel.Anonymous).Concretely,
libdd-common's hyper-based connector now setsClientOptions::security_qos_flags(SECURITY_ANONYMOUS)when opening a named pipe inConnStream::from_named_pipe_uri, instead of relying on tokio's default ofSECURITY_IDENTIFICATION.Motivation
This mirrors the dd-trace-dotnet change [Set
TokenImpersonationLevel.AnonymousinNamedPipeClient(#8676)] DataDog/dd-trace-dotnet#8676).A Windows named pipe exposes the connecting client's security token to the server end, which can use it to identify or even impersonate the client. In our usage the pipe is just a dumb byte transport to the Datadog Agent, so the server end never needs any information about, or the ability to act as, the connecting (potentially privileged) process. Opening with
Anonymousenforces least privilege and removes that capability, hardening against a malicious or pipe-squatting server reading the client's identity/privileges.Additional Notes
libdd-common) — fixed in this PR. Used by thelibdd-http-clienthyper backend.libdd-agent-client, and the defaultlibdd-http-clientbackend. reqwest currently hardcodesClientOptions::new().open(pipe)and exposes no API to set the QoS flags, so that path is not addressed here. A follow-up will upstream a security-flags option to reqwest and then consume it at those call sites.Identification(notImpersonation), so the server cannot act as the client today; it can only read the client's identity/privileges. This change is therefore a defense-in-depth / least-privilege hardening that aligns the Rust posture with the .NET fix, not a fix for an exploitable privilege escalation on the Rust side.ANONYMOUS_IMPERSONATION_QOSconstant was added inlibdd-common/src/connector/named_pipe.rsso the same value can be reused by the future reqwest call sites.How to test the change?
The change is Windows-only (
#[cfg(windows)]).from_named_pipe_uri_connects_with_anonymous_qoswas added inlibdd-common/src/connector/conn_stream.rs. It stands up a tokioServerOptionsnamed-pipe server and asserts the client connects successfully with the Anonymous QoS flags. On a Windows host: