sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-09-02 04:51:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add impersonateNamedPipeClient

Browse Source
This commit is contained in:
Theodor S. Midtlien
2026-07-23 16:00:45 +02:00
parent 27afbd7952
commit 5d9ef0123f
3 changed files with 25 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
client/cmd/service_pipe_windows.go
View File

@@ -5,9 +5,9 @@ package cmd
import (
"context"
"net"
"time"
"github.com/Microsoft/go-winio"
"golang.org/x/sys/windows"
"github.com/netbirdio/netbird/client/internal/ipcauth"
)
@@ -22,11 +22,14 @@ func listenNamedPipe(path string) (net.Listener, error) {
})
}
// dialNamedPipe connects to the daemon control named pipe.
// dialNamedPipe connects to the daemon control named pipe at SECURITY_IDENTIFICATION.
//
// winio's plain DialPipe connects at SECURITY_ANONYMOUS, under which the daemon
// cannot read the caller's token (ImpersonateNamedPipeClient fails / yields an
// anonymous token and the handshake is dropped). Identification lets the daemon
// *identify* the caller (read its SID/groups) without granting it the ability to
// act as the caller — the least privilege the daemon needs for authorization.
func dialNamedPipe(ctx context.Context, path string) (net.Conn, error) {
if deadline, ok := ctx.Deadline(); ok {
timeout := time.Until(deadline)
return winio.DialPipe(path, &timeout)
}
return winio.DialPipeContext(ctx, path)
access := uint32(windows.GENERIC_READ | windows.GENERIC_WRITE)
return winio.DialPipeAccessImpLevel(ctx, path, access, winio.PipeImpLevelIdentification)
}