eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add authorized remote pipe listen

Browse source
This commit is contained in:
Eric Wendland 2026-05-19 19:21:42 +02:00
commit 3382899628
8 changed files with 322 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -139,7 +139,8 @@ The bootstrap implementation provides:
- `geth ssh revocation import <path> [--format jsonl|openssh-krl-spec] [--subject <principal>]`
- `geth ssh revocation sync <node-id> [--bearer-secret <secret>]`
- SSH proxy authorization probe: `geth ssh proxy <node-id> [--bearer-secret <secret>]`
- pipe registry/connect commands: `geth pipe listen <name>` and
- pipe registry/connect commands:
`geth pipe listen <name> [--node <node-id>] [--bearer-secret <secret>]` and
`geth pipe connect <name> [--node <node-id>] [--bearer-secret <secret>]`
`geth peer export/import/list` is for untrusted peer-card exchange. Peer cards
@ -185,6 +186,10 @@ Remote pipe connect uses the same protected Iroh control path and requires
`pipe.connect` on `resource:pipe:<name>`. The current prototype records a remote
connection attempt and whether a listener exists; byte streaming and forwarding
are still future work.
Remote pipe listen uses the same protected path:
`geth pipe listen <name> --node <node-id>` requires `pipe.listen` on
`resource:pipe:<name>` before registering a daemon-lifetime listener on the
peer.
`geth ssh proxy <node-id>` also uses the protected Iroh control path. The remote
peer validates the caller's endpoint/card binding and requires
`ssh_proxy.connect` on `resource:ssh-proxy:local` before returning proxy