{"record":{"id":"12356f139bec9a5a","repo":"tailscale/tailscale","slug":"namedpipe-listen-w","errorCode":null,"errorMessage":"namedpipe.Listen: %w","messagePattern":"namedpipe\\.Listen: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"safesocket/pipe_windows.go","lineNumber":43,"sourceCode":"\treturn winio.DialPipeAccessImpLevel(ctx, path, windows.GENERIC_READ|windows.GENERIC_WRITE, winio.PipeImpLevelIdentification)\n}\n\n// windowsSDDL is the Security Descriptor set on the namedpipe.\n// It provides read/write access to all users and the local system.\n// It is a var for testing, do not change this value.\nvar windowsSDDL = \"O:BAG:BAD:PAI(A;OICI;GWGR;;;BU)(A;OICI;GWGR;;;SY)\"\n\nfunc listen(path string) (net.Listener, error) {\n\tlc, err := winio.ListenPipe(\n\t\tpath,\n\t\t&winio.PipeConfig{\n\t\t\tSecurityDescriptor: windowsSDDL,\n\t\t\tInputBufferSize:    256 * 1024,\n\t\t\tOutputBufferSize:   256 * 1024,\n\t\t},\n\t)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"namedpipe.Listen: %w\", err)\n\t}\n\treturn &winIOPipeListener{Listener: lc}, nil\n}\n\n// WindowsClientConn is an implementation of net.Conn that permits retrieval of\n// the Windows access token associated with the connection's client. The\n// embedded net.Conn must be a go-winio PipeConn.\ntype WindowsClientConn struct {\n\twinioPipeConn\n\ttokenOnce sync.Once\n\ttoken     windows.Token // or zero, if we couldn't obtain the client's token\n\ttokenErr  error\n}\n\n// winioPipeConn is a subset of the interface implemented by the go-winio's\n// unexported *win32pipe type, as returned by go-winio's ListenPipe\n// net.Listener's Accept method. This type is used in places where we really are\n// assuming that specific unexported type and its Fd method.","sourceCodeStart":25,"sourceCodeEnd":61,"githubUrl":"https://github.com/tailscale/tailscale/blob/6e0912f97994f927632b34ae9e63b53d6516a6ac/safesocket/pipe_windows.go#L25-L61","documentation":"Raised in the Windows safesocket listen when winio.ListenPipe cannot create the named pipe with the required security descriptor. Another tailscaled instance already owns the pipe name or the process lacks rights to create it.","triggerScenarios":"Thrown at safesocket/pipe_windows.go:43 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Listening on the Windows named pipe failed; check for an existing tailscaled instance holding the pipe and for permission issues."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"6e0912f97994f927632b34ae9e63b53d6516a6ac","analyzedAt":"2026-08-18T08:17:25.280Z","contentChangedAt":"2026-08-18T08:17:25.280Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}