[confignet] Allow setting security descriptors for npipes

.chloggen/confignet-npipe-security-descriptor.yaml

@@ -0,0 +1,25 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. receiver/otlp)
+component: pkg/config/confignet
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Add `dialer.security_descriptor` to set an SDDL security descriptor on Windows named pipe (npipe) listeners
+
+# One or more tracking issues or pull requests related to the change
+issues: [15211]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [user, api]

.github/workflows/utils/cspell.json

@@ -180,6 +180,7 @@
       "cumulativetodelta",
       "cumulativetodeltaprocessor",
       "customname",
+      "DACL",
       "custompkg",
       "dataloss",
       "datapoints",
@@ -457,6 +458,7 @@
       "scrapererror",
       "scraperhelper",
       "scrapertest",
+      "SDDL",
       "semconv",
       "servicetelemetry",
       "servicetest",

config/confignet/README.md

@@ -16,6 +16,14 @@ leverage network configuration to set connection and transport information.
   "npipe" (Windows named pipes, Windows-only).
 - `dialer`: Dialer configuration
   - `timeout`: Dialer timeout is the maximum amount of time a dial will wait for a connect to complete. The default is no timeout.
+- `npipe`: Windows named pipe configuration (ignored for all other transport types)
+  - `security_descriptor`: A [Security Descriptor Definition Language (SDDL)](https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language)
+    string applied to the named pipe when a listener is created. When empty,
+    Windows applies its [default named pipe DACL](https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights),
+    which is roughly equivalent to
+    `D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x12019b;;;WD)(A;;0x12019b;;;AN)` — full
+    control for `LocalSystem` (`SY`) and `Administrators` (`BA`), and read plus
+    limited write for `Everyone` (`WD`) and `Anonymous Logon` (`AN`).
 
 Note that for TCP receivers only the `endpoint` configuration setting is
 required.

config/confignet/config.schema.yaml

@@ -6,6 +6,9 @@ $defs:
       dialer:
         description: DialerConfig contains options for connecting to an address.
         $ref: dialer_config
+      npipe:
+        description: NpipeConfig contains options specific to the "npipe" transport (Windows named pipes). Settings in this section are ignored for all other transport types.
+        $ref: npipe_config
       endpoint:
         description: Endpoint configures the address for this network connection. For TCP and UDP networks, the address has the form "host:port". The host must be a literal IP address, or a host name that can be resolved to IP addresses. The port must be a literal port number or a service name. If the host is a literal IPv6 address it must be enclosed in square brackets, as in "[2001:db8::1]:80" or "[fe80::1%zone]:80". The zone specifies the scope of the literal IPv6 address as defined in RFC 4007.
         type: string
@@ -21,6 +24,13 @@ $defs:
         type: string
         x-customType: time.Duration
         format: duration
+  npipe_config:
+    description: NpipeConfig contains options specific to Windows named pipe transport. Settings in this section are ignored for all other transport types.
+    type: object
+    properties:
+      security_descriptor:
+        description: SecurityDescriptor is a Security Descriptor Definition Language (SDDL) string applied to the named pipe when a listener is created. When empty, Windows applies its default named pipe DACL, which is roughly equivalent to "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x12019b;;;WD)(A;;0x12019b;;;AN)" — full control for LocalSystem (SY) and Administrators (BA), and read plus limited write for Everyone (WD) and Anonymous Logon (AN). See https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights and https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
+        type: string
   tcp_addr_config:
     description: TCPAddrConfig represents a TCP endpoint address.
     type: object

config/confignet/confignet.go

@@ -72,6 +72,27 @@ func NewDefaultDialerConfig() DialerConfig {
 	return DialerConfig{}
 }
 
+// NpipeConfig contains options specific to Windows named pipe transport.
+type NpipeConfig struct {
+	// SecurityDescriptor is a Security Descriptor Definition Language (SDDL)
+	// string applied to the named pipe when a listener is created. When empty,
+	// Windows applies its default named pipe DACL, which is roughly equivalent
+	// to "D:P(A;;GA;;;SY)(A;;GA;;;BA)(A;;0x12019b;;;WD)(A;;0x12019b;;;AN)"
+	// — full control for LocalSystem (SY) and Administrators (BA), and read
+	// plus limited write for Everyone (WD) and Anonymous Logon (AN).
+	// See:
+	//   - https://learn.microsoft.com/en-us/windows/win32/ipc/named-pipe-security-and-access-rights
+	//   - https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
+	SecurityDescriptor string `mapstructure:"security_descriptor,omitempty"`
+	// prevent unkeyed literal initialization
+	_ struct{}
+}
+
+// NewDefaultNpipeConfig creates a new NpipeConfig with any default values set
+func NewDefaultNpipeConfig() NpipeConfig {
+	return NpipeConfig{}
+}
+
 // AddrConfig represents a network endpoint address.
 type AddrConfig struct {
 	// Endpoint configures the address for this network connection.
@@ -88,6 +109,10 @@ type AddrConfig struct {
 
 	// DialerConfig contains options for connecting to an address.
 	DialerConfig DialerConfig `mapstructure:"dialer,omitempty"`
+
+	// NpipeConfig contains options specific to the "npipe" transport (Windows named pipes).
+	// Settings in this section are ignored for all other transport types.
+	NpipeConfig NpipeConfig `mapstructure:"npipe,omitempty"`
 	// prevent unkeyed literal initialization
 	_ struct{}
 }
@@ -96,6 +121,7 @@ type AddrConfig struct {
 func NewDefaultAddrConfig() AddrConfig {
 	return AddrConfig{
 		DialerConfig: NewDefaultDialerConfig(),
+		NpipeConfig:  NewDefaultNpipeConfig(),
 	}
 }
 
@@ -111,7 +137,7 @@ func (na *AddrConfig) Dial(ctx context.Context) (net.Conn, error) {
 // Listen equivalent with net.ListenConfig's Listen for this address.
 func (na *AddrConfig) Listen(ctx context.Context) (net.Listener, error) {
 	if na.Transport == TransportTypeNpipe {
-		return listenNpipe(na.Endpoint)
+		return listenNpipe(na.Endpoint, na.NpipeConfig.SecurityDescriptor)
 	}
 	lc := net.ListenConfig{}
 	return lc.Listen(ctx, string(na.Transport), na.Endpoint)

config/confignet/npipe_others.go

@@ -18,6 +18,6 @@ func dialNpipe(_ context.Context, _ string, _ time.Duration) (net.Conn, error) {
 	return nil, errNpipeUnsupported
 }
 
-func listenNpipe(_ string) (net.Listener, error) {
+func listenNpipe(_, _ string) (net.Listener, error) {
 	return nil, errNpipeUnsupported
 }

config/confignet/npipe_windows.go

@@ -22,6 +22,10 @@ func dialNpipe(ctx context.Context, endpoint string, timeout time.Duration) (net
 	return winio.DialPipeContext(ctx, endpoint)
 }
 
-func listenNpipe(endpoint string) (net.Listener, error) {
-	return winio.ListenPipe(endpoint, nil)
+func listenNpipe(endpoint, securityDescriptor string) (net.Listener, error) {
+	var cfg *winio.PipeConfig
+	if securityDescriptor != "" {
+		cfg = &winio.PipeConfig{SecurityDescriptor: securityDescriptor}
+	}
+	return winio.ListenPipe(endpoint, cfg)
 }

config/confignet/npipe_windows_test.go

@@ -52,3 +52,33 @@ func TestNpipeListenAndDial(t *testing.T) {
 	assert.NoError(t, conn.Close())
 	<-done
 }
+
+func TestNpipeListenSecurityDescriptor(t *testing.T) {
+	tests := []struct {
+		name               string
+		securityDescriptor string
+		wantErr            bool
+	}{
+		{name: "default", securityDescriptor: "", wantErr: false},
+		{name: "owner local system, allow everyone read/write", securityDescriptor: "O:SYG:SYD:(A;;GRGW;;;WD)", wantErr: false},
+		{name: "invalid SDDL", securityDescriptor: "not-a-valid-sddl", wantErr: true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			nas := &AddrConfig{
+				Endpoint:  `\\.\pipe\otel-test-confignet-sd`,
+				Transport: TransportTypeNpipe,
+				NpipeConfig: NpipeConfig{
+					SecurityDescriptor: tt.securityDescriptor,
+				},
+			}
+			ln, err := nas.Listen(t.Context())
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			assert.NoError(t, ln.Close())
+		})
+	}
+}