eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add authorized TCP pipe forwarding

Browse source
This commit is contained in:
Eric Wendland 2026-05-21 01:12:01 +02:00
commit 6bc2666993
8 changed files with 645 additions and 81 deletions
Download patch file Download diff file Expand all files Collapse all files

9
docs/architecture.md
View file

@ -213,8 +213,13 @@ uses the dedicated `/geth/pipe/1` ALPN to write a byte message to a peer
listener after the same endpoint/card and capability checks. `geth pipe recv
<name>` drains local daemon-lifetime messages. `geth pipe listen <name> --node
<node-id>` can also ask a peer to register a daemon-lifetime listener after
checking `pipe.listen` on the same resource. Long-lived stdin/stdout streams and
TCP/Unix forwarding are still future work.
checking `pipe.listen` on the same resource. `geth pipe forward-tcp --listen
127.0.0.1:<local-port> --node <node-id> --target 127.0.0.1:<remote-port>` runs a
local loopback listener and opens one authorized `/geth/pipe/1` byte stream per
accepted connection. The remote daemon validates endpoint/card binding and
requires `pipe.forward` on `resource:pipe-tcp:<target>` before connecting to the
remote loopback TCP target. TCP forwarding is loopback-only in the prototype;
Unix socket forwarding is still future work.
`geth-ssh-proxy` defines proxy target and connection metadata. `geth ssh proxy
<node>` is a streaming command intended for OpenSSH `ProxyCommand`: the CLI