Add authorized TCP pipe forwarding

crates/geth-pipe/src/lib.rs

@@ -1,5 +1,6 @@
 use geth_types::{PipeId, ResourceId, UnixMillis};
 use serde::{Deserialize, Serialize};
+use std::net::SocketAddr;
 
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
 pub struct PipeResource {
@@ -37,6 +38,10 @@ pub struct PipeMessage {
 pub enum PipeError {
     #[error("invalid pipe name or target: {0}")]
     InvalidName(String),
+    #[error("invalid TCP address: {0}")]
+    InvalidTcpAddress(String),
+    #[error("TCP forwarding addresses must be loopback addresses: {0}")]
+    NonLoopbackTcpAddress(String),
 }
 
 pub fn validate_pipe_name(name: &str) -> Result<(), PipeError> {
@@ -50,6 +55,26 @@ pub fn validate_pipe_name(name: &str) -> Result<(), PipeError> {
     Ok(())
 }
 
+pub fn validate_tcp_forward_listen_addr(addr: &str) -> Result<SocketAddr, PipeError> {
+    let addr = addr
+        .parse::<SocketAddr>()
+        .map_err(|_| PipeError::InvalidTcpAddress(addr.to_owned()))?;
+    if !addr.ip().is_loopback() {
+        return Err(PipeError::NonLoopbackTcpAddress(addr.to_string()));
+    }
+    Ok(addr)
+}
+
+pub fn validate_tcp_forward_target_addr(addr: &str) -> Result<SocketAddr, PipeError> {
+    let addr = addr
+        .parse::<SocketAddr>()
+        .map_err(|_| PipeError::InvalidTcpAddress(addr.to_owned()))?;
+    if !addr.ip().is_loopback() {
+        return Err(PipeError::NonLoopbackTcpAddress(addr.to_string()));
+    }
+    Ok(addr)
+}
+
 #[must_use]
 pub fn pipe_roadmap() -> &'static str {
     "future pipes are authorized Iroh bidirectional streams for stdin/stdout and forwarding"
@@ -73,4 +98,13 @@ mod tests {
         assert!(validate_pipe_name("inbox/main").is_err());
         assert!(validate_pipe_name("inbox main").is_err());
     }
+
+    #[test]
+    fn tcp_forward_addresses_must_be_explicit_loopback_socket_addrs() {
+        assert!(validate_tcp_forward_listen_addr("127.0.0.1:9000").is_ok());
+        assert!(validate_tcp_forward_target_addr("[::1]:22").is_ok());
+        assert!(validate_tcp_forward_listen_addr("localhost:9000").is_err());
+        assert!(validate_tcp_forward_target_addr("0.0.0.0:22").is_err());
+        assert!(validate_tcp_forward_target_addr("192.0.2.10:22").is_err());
+    }
 }