From owner-freebsd-net@FreeBSD.ORG Sat Oct 18 00:02:43 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id E793B1FC; Sat, 18 Oct 2014 00:02:42 +0000 (UTC) Received: from mail-wg0-x230.google.com (mail-wg0-x230.google.com [IPv6:2a00:1450:400c:c00::230]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 598AF181; Sat, 18 Oct 2014 00:02:42 +0000 (UTC) Received: by mail-wg0-f48.google.com with SMTP id k14so1895192wgh.31 for ; Fri, 17 Oct 2014 17:02:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:date:to:cc:subject:message-id:mime-version:content-type; bh=YBLOKdX+tbxOuxY6H7z2/0gOI80qC7j0D0YO7O+kf2A=; b=yOqae6RZ9EezJNeOSGGbZ05+RcvjeG9LCMoXQoMwIEyxYA+e5JKxSDD62R3pdZjXoD Pms//YBR5jXBDSFl5BH/tJVS411O+r4m7ptXkS4NXSZxcRalHt8Mv/cwaLL+wNfrxDWm hfNvC5GkO9+MuQGZoi6Mf3UxXlsNraYGjlLvQBuD2XFCLoYZ7TG7lZthW5ht7C8hFXuN jLEYa/4j4Ghlo5QfBvrZR5tzcOzgOHpswiLuw37lnarHIENhzpMwCG2ghx9tmNHuLKpl vJe02mtea5zMtnkLBngs/vBotJL2i7EFBZHATtMFTVtWccLKHFwESkl2Q5TlfJtJ5L+f JZvg== X-Received: by 10.180.74.4 with SMTP id p4mr2444743wiv.20.1413590560261; Fri, 17 Oct 2014 17:02:40 -0700 (PDT) Received: from localhost (citronna.de. [62.210.205.189]) by mx.google.com with ESMTPSA id t16sm480849wjr.44.2014.10.17.17.02.37 for (version=SSLv3 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 17 Oct 2014 17:02:39 -0700 (PDT) Sender: Nicolas Braud-Santoni From: Nicolas Braud-Santoni X-Google-Original-From: Nicolas Braud-Santoni Date: Sat, 18 Oct 2014 02:02:27 +0200 To: freebsd-net@freebsd.org Subject: Adding IP_PEERCRED? Message-ID: <20141018020227.68b9a335@braud-santoni.eu> X-Mailer: Claws Mail 3.10.1 (GTK+ 2.24.24; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; boundary="Sig_/yK9yFxL/VONyD27aMUnHDyp"; protocol="application/pgp-signature" Cc: david@madore.org, bapt@freebsd.org X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Oct 2014 00:02:43 -0000 --Sig_/yK9yFxL/VONyD27aMUnHDyp Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: quoted-printable Hello, I would like to enquire about the possibility of adding an IP_PEERCRED socket option to ip(4) which would be similar to LOCAL_PEERCRED for unix(4). Such a option, when requested via getsockopt(2) on a not-connectionless IP = (v4 or v6) socket, would either - return credentials of the remote side (as a xucred structure) in the case of a loopback (non-cross-jail) socket; - fail (with EINVAL?). The intended use-case of such a functionnality would be for processes to provide services only to a given user, instead of the local host, while using IP sockets. For instance, an SSH client could use this feature to provide port forwards for a given user, instead of providing it to all users. While bapt@ thought at first glance that it might be a good idea, neither of us know whether it would be reasonable to implement. Any though on this? Best, Nicolas PS: Credit for this idea should go to David Madore (in CC), who blogged about it (in French): http://www.madore.org/~david/weblog/d.2014-10-16.2234.html --Sig_/yK9yFxL/VONyD27aMUnHDyp Content-Type: application/pgp-signature; name=signature.asc Content-Disposition: attachment; filename=signature.asc -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQIcBAEBCgAGBQJUQa4XAAoJEPv4tP2UoeSeuO4P/1yVB1fyF4tKgfZt1pND5xu/ ff8vN86uE7Bqj9d4heucZLSjbF3rmBXJpaqB1xSXW1LNuodsPMbyiV8NgMHzxhVP 7b+i/lejrAo9PdkB5X1MhbTJvaAZVaTwZIo6/oIAe8rZJykKeRP4Dt9eZ/TgHJ+2 Ol2VbmIenwrVwWG21ewLWX55DNPIh0gMWCIr0DDyNZnkFaObfS8fh3KQ6m+ftzEN 3qJ9nZSQF4YrRXoD4lbT9aI6HS5LbPzjFRFNkGhUpMwayEhaYEdZSaZl+3VzmYnd sU1Npm4FO06XBZBb0xCzlokNj+by0eBQ33/SyKuAZNYUggPeHxQM9O+6C4kcrbVN pZTVxFKh43sb3N8sVfzbxCudecPaXangAoBXvNouZxk7JSn66SNebxzVNC00pntk hZT+KhiCewCah6TKzDlBs3L3WsBmBvt+YL9cfNS12vDgbrsJlcREsLogmZNykZmN 6+B9v66Nmqp56rlG6HgthG4N+CSxjL7Jorwx/9kcmQMkvRFQYrKAXd97Y5QzHYfa FAZcCDMTA5/zK8XNmmX9JwfXpIc0hGJxfazQYbCQboBlQifKlQz2YUTXmadVM/AL mkg1ytDe0hGB1ySa2EmmqlLLCClCxN7nSXIAZfDiVV6WTIj6ixOshA2+OkN3t1rt pSLHeMbNTTY2KDYkaYnp =tZiO -----END PGP SIGNATURE----- --Sig_/yK9yFxL/VONyD27aMUnHDyp--