[
https://issues.apache.org/jira/browse/THRIFT-5388?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17313787#comment-17313787
]
Jens Geyer edited comment on THRIFT-5388 at 4/2/21, 5:08 PM:
-------------------------------------------------------------
In lack of a more detailed explanation from Steven, in the meantime and after
taking a closer look at all relevant APIs I identified two places that indeed
could need some improvements myself:
1. *CreateNamedPipe()* may optionally be hardened by adding
*[PIPE_REJECT_REMOTE_CLIENTS|https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea]*.
This needs to be a configurable option (I choose the CTORs to do this)
2. *CreateFile()* should always enforce *SECURITY_SQOS_PRESENT |
SECURITY_ANONYMOUS* flags [according to this
patch|https://github.com/dotnet/coreclr/pull/379/files]
The important part here is in between of the changed lines, not so much the
patch itself.
Patches for Delphi and netstd are already commited and/or under way.
was (Author: jensg):
In lack of a more detailed explanation from Steven, in the meantime and after
taking a closer look at all relevant APIs I identified two places that indeed
could need some improvements myself:
1. *CreateNamedPipe()*may optionally be hardened by adding
*[PIPE_REJECT_REMOTE_CLIENTS|https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createnamedpipea]*.
This needs to be a configurable option (I choose the CTORs to do this)
2. *CreateFile()* should always enforce *SECURITY_SQOS_PRESENT |
SECURITY_ANONYMOUS* flags [according to this
patch|https://github.com/dotnet/coreclr/pull/379/files]
The important part here is in between of the changed lines, not so much the
patch itself.
Patches for Delphi and netstd are already commited and/or under way.
> Named Pipes transport hardening
> -------------------------------
>
> Key: THRIFT-5388
> URL: https://issues.apache.org/jira/browse/THRIFT-5388
> Project: Thrift
> Issue Type: Bug
> Components: C++ - Library
> Reporter: Steven
> Priority: Major
>
> In current codes "lib\cpp\src\thrift\transport\TPipe.cpp", the flags to
> connect the named pipe is always FILE_FLAG_OVERLAPPED. It is not possible to
> set more security flags to avoid the named pipe server misuse the named pipe
> client's identify by
> [impersonatenamedpipeclient|https://docs.microsoft.com/en-us/windows/win32/api/namedpipeapi/nf-namedpipeapi-impersonatenamedpipeclient].
> Could we provide the API to set these flags? Thanks.
> Codes in "TPipe::open()" are listed below:
> DWORD flags = FILE_FLAG_OVERLAPPED;
> hPipe.reset(CreateFileA(pipename_.c_str(), GENERIC_READ | GENERIC_WRITE, 0,
> nullptr, OPEN_EXISTING, flags, nullptr));
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
