eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add authorized pipe messages over Iroh

Browse source
This commit is contained in:
Eric Wendland 2026-05-20 13:57:14 +02:00
commit 78dbbf240b
11 changed files with 712 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

17
README.md
View file

@ -142,9 +142,11 @@ The bootstrap implementation provides:
- `geth ssh revocation import <path> [--format jsonl|openssh-krl-spec] [--subject <principal>]`
- `geth ssh revocation sync <node-id> [--bearer-secret <secret>]`
- SSH proxy authorization probe: `geth ssh proxy <node-id> [--bearer-secret <secret>]`
- pipe registry/connect commands:
`geth pipe listen <name> [--node <node-id>] [--bearer-secret <secret>]` and
`geth pipe connect <name> [--node <node-id>] [--bearer-secret <secret>]`
- pipe registry/message commands:
`geth pipe listen <name> [--node <node-id>] [--bearer-secret <secret>]`,
`geth pipe connect <name> [--node <node-id>] [--bearer-secret <secret>]`,
`geth pipe send <name> <message> [--node <node-id>] [--bearer-secret <secret>]`,
and `geth pipe recv <name> [--peek]`
`geth peer export/import/list` is for untrusted peer-card exchange. Peer cards
include the Iroh EndpointID plus currently known relay/direct addresses.
@ -198,12 +200,15 @@ requires `pubsub.subscribe` on `resource:pubsub:<topic>` before returning the
peer's current daemon-lifetime snapshot for that topic.
Remote pipe connect uses the same protected Iroh control path and requires
`pipe.connect` on `resource:pipe:<name>`. The current prototype records a remote
connection attempt and whether a listener exists; byte streaming and forwarding
are still future work.
connection attempt and whether a listener exists. `geth pipe send <name>
<message> --node <node-id>` uses the dedicated `/geth/pipe/1` Iroh ALPN to
write a byte message to an authorized peer listener, and `geth pipe recv <name>`
drains local daemon-lifetime messages.
Remote pipe listen uses the same protected path:
`geth pipe listen <name> --node <node-id>` requires `pipe.listen` on
`resource:pipe:<name>` before registering a daemon-lifetime listener on the
peer.
peer. Long-lived stdin/stdout streaming and socket forwarding are still future
work.
`geth ssh proxy <node-id>` also uses the protected Iroh control path. The remote
peer validates the caller's endpoint/card binding and requires
`ssh_proxy.connect` on `resource:ssh-proxy:local` before returning proxy