Add authorized TCP pipe forwarding

crates/geth-control/src/lib.rs

@@ -302,6 +302,17 @@ pub enum ControlRequest {
         node: Option<String>,
         bearer_secret: Option<String>,
     },
+    PipeTcpForward {
+        node: String,
+        listen_addr: String,
+        target_addr: String,
+        bearer_secret: Option<String>,
+    },
+    PipeTcpStream {
+        node: String,
+        target_addr: String,
+        bearer_secret: Option<String>,
+    },
     PipeSend {
         target: String,
         data_base64: String,
@@ -1033,6 +1044,12 @@ pub enum PipeWireRequest {
         nonce: String,
         bearer_proof: Option<BearerProof>,
     },
+    TcpConnect {
+        peer_card: PeerCard,
+        target_addr: String,
+        nonce: String,
+        bearer_proof: Option<BearerProof>,
+    },
 }
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
@@ -1051,6 +1068,18 @@ pub enum PipeWireResponse {
         nonce: String,
         note: String,
     },
+    Connected {
+        node_id: String,
+        agent_id: String,
+        endpoint_id: String,
+        remote_endpoint_id: String,
+        connection: Option<PipeConnection>,
+        allowed: bool,
+        reason: String,
+        evaluated_ops: usize,
+        nonce: String,
+        note: String,
+    },
     Error {
         message: String,
     },
@@ -2037,6 +2066,58 @@ mod tests {
             response
         );
 
+        let request = PipeWireRequest::TcpConnect {
+            peer_card: PeerCard {
+                node_id: "node:caller".into(),
+                agent_id: "agent:caller".into(),
+                endpoints: Vec::new(),
+                issued_at: geth_types::UnixMillis(1),
+                signature: geth_discovery::SignatureMetadata {
+                    namespace: "geth.peer-card.v1@geth.local".to_owned(),
+                    signer: "agent:caller".to_owned(),
+                    public_key: "key".to_owned(),
+                    signature: "sig".to_owned(),
+                },
+            },
+            target_addr: "127.0.0.1:22".to_owned(),
+            nonce: "nonce".to_owned(),
+            bearer_proof: Some(BearerProof {
+                secret: "bearer:test".into(),
+                resource: "resource:pipe-tcp:127.0.0.1:22".into(),
+                capabilities: vec!["pipe.forward".into()],
+                nonce: "nonce".to_owned(),
+                response: "response".to_owned(),
+            }),
+        };
+        assert_eq!(
+            decode_pipe_wire_request(&encode_pipe_wire_request(&request).expect("encode"))
+                .expect("decode"),
+            request
+        );
+
+        let response = PipeWireResponse::Connected {
+            node_id: "node:peer".to_owned(),
+            agent_id: "agent:peer".to_owned(),
+            endpoint_id: "endpoint:peer".to_owned(),
+            remote_endpoint_id: "endpoint:caller".to_owned(),
+            connection: Some(PipeConnection {
+                target: "127.0.0.1:22".to_owned(),
+                connected_at: geth_types::UnixMillis(1),
+                local_listener_found: true,
+                note: "tcp".to_owned(),
+            }),
+            allowed: true,
+            reason: "direct grant".to_owned(),
+            evaluated_ops: 1,
+            nonce: "nonce".to_owned(),
+            note: "pipe tcp".to_owned(),
+        };
+        assert_eq!(
+            decode_pipe_wire_response(&encode_pipe_wire_response(&response).expect("encode"))
+                .expect("decode"),
+            response
+        );
+
         let response = PeerControlResponse::SshProxyConnected {
             node_id: "node:peer".to_owned(),
             agent_id: "agent:peer".to_owned(),