fix(agent): harden package broker pipe against connection floods

[Vladyslav Nikonov (vnikonov-devolutions)]

Hardens the package broker named pipe server against cheap denial-of-service via connection floods.
Previously, every incoming connection triggered unauthenticated identity lookups (process open, executable path, account name resolution) before any signature validation, and connections were served without any concurrency limit.

Now the broker caps the number of concurrently served pipe connections, performs client identity capture off the accept loop so a slow lookup cannot stall other connections, and defers account-name resolution (which may reach a domain controller) until it is actually needed for an error message.
This bounds the work an unauthenticated flood can trigger and keeps the broker responsive for legitimate clients.

Issue: DGW-413

[Vladyslav Nikonov (vnikonov-devolutions)]

Implementation notes (follow-up to #1847 (review)):

• Connection cap: a \ okio::sync::Semaphore\ with 16 permits bounds concurrently served connections. A permit is acquired before a new pipe instance is created, so while all slots are taken no instance is listening and further clients fail fast (natural backpressure) instead of queuing unbounded work/tasks.
• Identity capture moved off the accept loop: \PipeClient::from_connected_pipe\ now runs inside the spawned per-connection task, so a slow lookup can no longer stall accepting other connections.
• **Removed connect-time \LookupAccountSid**: this was the most expensive unauthenticated call (may hit a domain controller for domain SIDs) and its result was only used in the \�ffective_user\ mismatch error message. Connect-time work is now limited to fast local syscalls (\GetNamedPipeClientProcessId, \OpenProcess, exe path, token user SID). The account name is resolved lazily on the rare mismatch error path, with a <unresolved>\ fallback.
• SID-based \�ffective_user\ validation is unchanged; only the diagnostic name lookup moved.
• Tests: existing \�roker::auth\ unit tests updated for the simplified \PipeClient\ shape (SID only, no cached domain/name); all pass, clippy clean.

[github-actions]

Let maintainers know that an action is required on their side

• Add the label release-required Please cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module) when you request a maintainer to cut a new release (Devolutions Gateway, Devolutions Agent, Jetsocat, PowerShell module)

• Add the label release-blocker Follow-up is required before cutting a new release if a follow-up is required before cutting a new release

• Add the label publish-required Please publish libraries (`Devolutions.Gateway.Utils`, OpenAPI clients, etc) when you request a maintainer to publish libraries (Devolutions.Gateway.Utils, OpenAPI clients, etc.)

• Add the label publish-blocker Follow-up is required before publishing libraries if a follow-up is required before publishing libraries

[Copilot]

Pull request overview

Hardens the Windows package broker named-pipe server against connection-flood denial of service.

Changes:

• Caps concurrent pipe connections at 16.
• Moves identity capture outside the accept loop.
• Defers client account-name resolution until needed.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
devolutions-agent/src/broker/pipe.rs	Adds connection limiting and asynchronous handling.
devolutions-agent/src/broker/auth.rs	Stores client SID and resolves account names lazily.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Benoît Cortier (CBenoit)]

Review complete: no substantiated findings.

The protocol/API analysis found no applicable Open Specifications requirements. The skeptical concerns were not confirmed because each pipe connection serves one HTTP request and the new semaphore bounds remaining unauthenticated work to 16 concurrent connections.