eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add authorized TCP pipe forwarding

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 01:12:01 +02:00
commit 6bc2666993
8 changed files with 645 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

13
README.md
View file

@ -146,7 +146,8 @@ The bootstrap implementation provides:
`geth pipe listen <name> [--node <node-id>] [--bearer-secret <secret>]`,
`geth pipe connect <name> [--node <node-id>] [--bearer-secret <secret>]`,
`geth pipe send <name> [message|--in <path>|--in -] [--node <node-id>] [--bearer-secret <secret>]`,
and `geth pipe recv <name> [--peek]`
`geth pipe recv <name> [--peek]`, and
`geth pipe forward-tcp --listen 127.0.0.1:<port> --node <node-id> --target 127.0.0.1:<port>`
`geth peer export/import/list` is for untrusted peer-card exchange. Peer cards
include the Iroh EndpointID plus currently known relay/direct addresses.
@ -207,8 +208,14 @@ recv <name>` drains local daemon-lifetime messages.
Remote pipe listen uses the same protected path:
`geth pipe listen <name> --node <node-id>` requires `pipe.listen` on
`resource:pipe:<name>` before registering a daemon-lifetime listener on the
peer. Long-lived stdin/stdout streaming and socket forwarding are still future
work.
peer.
`geth pipe forward-tcp --listen 127.0.0.1:<local-port> --node <node-id> --target
127.0.0.1:<remote-port>` starts a local loopback TCP listener. Each accepted
connection asks the local daemon to open an authorized `/geth/pipe/1` byte
stream to the peer. The remote daemon validates the signed endpoint/card binding
and requires `pipe.forward` on `resource:pipe-tcp:<target>` before connecting to
the remote loopback TCP target. This is loopback-only in the prototype to avoid
turning geth into an accidental open proxy.
`geth ssh proxy <node-id>` is usable as an OpenSSH `ProxyCommand`: the CLI opens
a local daemon stream, the daemon opens the dedicated `/geth/ssh-proxy/1` Iroh
ALPN, the remote daemon validates the caller's endpoint/card binding and