From owner-freebsd-net@FreeBSD.ORG Sat Oct 18 02:00:39 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id EDE13EE3; Sat, 18 Oct 2014 02:00:39 +0000 (UTC) Received: from mail-wg0-x22c.google.com (mail-wg0-x22c.google.com [IPv6:2a00:1450:400c:c00::22c]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 6533ECBA; Sat, 18 Oct 2014 02:00:39 +0000 (UTC) Received: by mail-wg0-f44.google.com with SMTP id y10so1974540wgg.3 for ; Fri, 17 Oct 2014 19:00:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:sender:in-reply-to:references:date:message-id:subject :from:to:cc:content-type; bh=09FgOEsufLf/V7not3RW6aIJtGYMeseSUPSW7fRjh3c=; b=whCUIZrdNRE7TJCBxoJBc2gADxGkF/9owBfuo5MKZtu8clQPpwE+LlwewCGkQsvoU2 2w7/Wdne9AM6gXGCtNthhw6HL5sj8j/hQ5z1f1OO/z6/mx5dLin7UxbK6oqSoEQfsaQX FqOMizHt5qI8r7/hNVT8OD7whsjIFNa2e4R0tZp0IOR1GpQRHXePE7H8uhxC8Yljtr1O Nhnz4L1QKE2UGURsTumgJdc26aDUzIIznMv6dR3J4yrC++Atatc95DNXaAvP59pN4Prx boSlSpDG4hKMCZBpQZAiacSUNXLdtiedUdM38K/ekAVTzADGDyJ1y5Vq08ZUj42USPzw 4MVw== MIME-Version: 1.0 X-Received: by 10.181.27.197 with SMTP id ji5mr2893426wid.26.1413597637504; Fri, 17 Oct 2014 19:00:37 -0700 (PDT) Sender: adrian.chadd@gmail.com Received: by 10.216.106.136 with HTTP; Fri, 17 Oct 2014 19:00:37 -0700 (PDT) In-Reply-To: <20141018020227.68b9a335@braud-santoni.eu> References: <20141018020227.68b9a335@braud-santoni.eu> Date: Fri, 17 Oct 2014 19:00:37 -0700 X-Google-Sender-Auth: XOCvksg4FEqJEKZAJ2DxlJDB7fA Message-ID: Subject: Re: Adding IP_PEERCRED? From: Adrian Chadd To: Nicolas Braud-Santoni Content-Type: text/plain; charset=UTF-8 Cc: david@madore.org, FreeBSD Net , Baptiste Daroussin X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 18 Oct 2014 02:00:40 -0000 Sure! Put together a patch and let's review it. -a On 17 October 2014 17:02, Nicolas Braud-Santoni wrote: > Hello, > > I would like to enquire about the possibility of adding an IP_PEERCRED > socket option to ip(4) which would be similar to LOCAL_PEERCRED for > unix(4). > > Such a option, when requested via getsockopt(2) on a not-connectionless IP (v4 or v6) socket, would either > - return credentials of the remote side (as a xucred structure) in the > case of a loopback (non-cross-jail) socket; > - fail (with EINVAL?). > > > The intended use-case of such a functionnality would be for processes > to provide services only to a given user, instead of the local host, > while using IP sockets. > For instance, an SSH client could use this feature to provide port > forwards for a given user, instead of providing it to all users. > > While bapt@ thought at first glance that it might be a good idea, > neither of us know whether it would be reasonable to implement. > Any though on this? > > > Best, > > Nicolas > > PS: Credit for this idea should go to David Madore (in CC), who blogged > about it (in French): > http://www.madore.org/~david/weblog/d.2014-10-16.2234.html