From nobody@FreeBSD.org  Thu Jul 11 14:09:44 2013
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
	by hub.freebsd.org (Postfix) with ESMTP id E5F5AEE7
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 11 Jul 2013 14:09:44 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from oldred.freebsd.org (oldred.freebsd.org [8.8.178.121])
	by mx1.freebsd.org (Postfix) with ESMTP id D71F01F9B
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 11 Jul 2013 14:09:44 +0000 (UTC)
Received: from oldred.freebsd.org ([127.0.1.6])
	by oldred.freebsd.org (8.14.5/8.14.7) with ESMTP id r6BE9h0B032594
	for <freebsd-gnats-submit@FreeBSD.org>; Thu, 11 Jul 2013 14:09:43 GMT
	(envelope-from nobody@oldred.freebsd.org)
Received: (from nobody@localhost)
	by oldred.freebsd.org (8.14.5/8.14.5/Submit) id r6BE9hKc032593;
	Thu, 11 Jul 2013 14:09:43 GMT
	(envelope-from nobody)
Message-Id: <201307111409.r6BE9hKc032593@oldred.freebsd.org>
Date: Thu, 11 Jul 2013 14:09:43 GMT
From: Nicholas Wilson <nicholas@nicholaswilson.me.uk>
To: freebsd-gnats-submit@FreeBSD.org
Subject: LOCAL_PEERCRED support for PF_INET
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         180468
>Category:       kern
>Synopsis:       [request] LOCAL_PEERCRED support for PF_INET
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-net
>State:          suspended
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Thu Jul 11 14:10:00 UTC 2013
>Closed-Date:    
>Last-Modified:  Thu Jul 11 15:47:52 UTC 2013
>Originator:     Nicholas Wilson
>Release:        9.1-RELEASE
>Organization:
>Environment:
>Description:
It would be very nice if inet connections over loopback supported LOCAL_PEERCRED. On Solaris, when you make a connection over a loopback device, getpeerucred "just works" and gives you the pid and uid of the connecting process on the local system.

This could be used to easily enhance the security of programs like OpenSSH: the ssh-agent uses a domain socket with getpeereid to verify the identity of connecting users, but if I run "ssh -D localhost:9999 ..." it runs an inet listener that any user can connect to. Being able to use the same credentials check here would be handy and plug a gap in our API.
>How-To-Repeat:

>Fix:


>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->suspended 
State-Changed-By: linimon 
State-Changed-When: Thu Jul 11 15:47:12 UTC 2013 
State-Changed-Why:  
Feature request.  Mark as suspended awaiting someone to create patches. 


Responsible-Changed-From-To: freebsd-bugs->freebsd-net 
Responsible-Changed-By: linimon 
Responsible-Changed-When: Thu Jul 11 15:47:12 UTC 2013 
Responsible-Changed-Why:  

http://www.freebsd.org/cgi/query-pr.cgi?pr=180468 
>Unformatted:
