eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add authorized Unix pipe forwarding

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 01:15:51 +02:00
commit 3d0da22eae
8 changed files with 491 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

5
README.md
View file

@ -148,6 +148,7 @@ The bootstrap implementation provides:
`geth pipe send <name> [message|--in <path>|--in -] [--node <node-id>] [--bearer-secret <secret>]`,
`geth pipe recv <name> [--peek]`, and
`geth pipe forward-tcp --listen 127.0.0.1:<port> --node <node-id> --target 127.0.0.1:<port>`
or `geth pipe forward-unix --listen /tmp/local.sock --node <node-id> --target /tmp/remote.sock`
`geth peer export/import/list` is for untrusted peer-card exchange. Peer cards
include the Iroh EndpointID plus currently known relay/direct addresses.
@ -216,6 +217,10 @@ stream to the peer. The remote daemon validates the signed endpoint/card binding
and requires `pipe.forward` on `resource:pipe-tcp:<target>` before connecting to
the remote loopback TCP target. This is loopback-only in the prototype to avoid
turning geth into an accidental open proxy.
`geth pipe forward-unix --listen <local-socket> --node <node-id> --target
<remote-socket>` uses the same `/geth/pipe/1` byte stream and requires
`pipe.forward` on `resource:pipe-unix:<target>` before connecting to the remote
Unix socket. Unix socket paths must be absolute.
`geth ssh proxy <node-id>` is usable as an OpenSSH `ProxyCommand`: the CLI opens
a local daemon stream, the daemon opens the dedicated `/geth/ssh-proxy/1` Iroh
ALPN, the remote daemon validates the caller's endpoint/card binding and