From 8e3b45db1b227dd72852f6f38e9277501b2a2fe0 Mon Sep 17 00:00:00 2001 From: Eric Wendland Date: Sun, 5 Jul 2026 18:23:12 +0200 Subject: [PATCH] docs: complete host opening audit --- docs/architecture.md | 11 +++++++++++ docs/production-readiness-roadmap.md | 12 ++++++------ 2 files changed, 17 insertions(+), 6 deletions(-) diff --git a/docs/architecture.md b/docs/architecture.md index c4fe1d2..789d97d 100644 --- a/docs/architecture.md +++ b/docs/architecture.md @@ -155,6 +155,17 @@ fields so scripts can fail on unhealthy streams. Common daemon errors include a `next:` recovery line for missing peer cards, missing grants, missing resources, unavailable endpoints, and missing DB/KV/document registrations. +Host-opening paths are intentionally narrow. TCP pipe forwarding accepts only +explicit loopback socket addresses on both the local listener and remote target; +Unix pipe forwarding requires absolute paths without parent-directory +components; SSH proxying always connects the authorized remote stream to +`127.0.0.1:22`; and overlay interface creation happens only after the operator +runs `geth overlay up`. Host setup failures should be handled as local operator +or entitlement problems. For overlay platform recovery, see +`docs/overlay-platforms.md`; for missing peer cards, endpoint bindings, or +resource grants, use `geth peer import`, `geth node endpoint-add`, and +`geth auth grant`/`geth node grant` as indicated by `next:` error output. + ## Resource Model Everything meaningful is modeled as a resource. Resources have a kind, name, diff --git a/docs/production-readiness-roadmap.md b/docs/production-readiness-roadmap.md index a92c647..c94a60f 100644 --- a/docs/production-readiness-roadmap.md +++ b/docs/production-readiness-roadmap.md @@ -176,13 +176,13 @@ Goal: finish the authorization and remote-input audit before deployment. - `[x]` Oversized messages are rejected without state mutation. - `[x]` Tests cover oversized payload denial for representative protocols. -- `[ ]` Audit host-opening paths. +- `[x]` Audit host-opening paths. Acceptance criteria: - - `[ ]` TCP forwarding remains loopback-only unless a later ADR expands it. - - `[ ]` Unix forwarding rejects unsafe paths. - - `[ ]` SSH proxy connects only to the intended local SSH endpoint. - - `[ ]` Overlay TUN setup remains explicit opt-in. - - `[ ]` Docs state host access risks and recovery commands. + - `[x]` TCP forwarding remains loopback-only unless a later ADR expands it. + - `[x]` Unix forwarding rejects unsafe paths. + - `[x]` SSH proxy connects only to the intended local SSH endpoint. + - `[x]` Overlay TUN setup remains explicit opt-in. + - `[x]` Docs state host access risks and recovery commands. ## Phase 5: Production Cryptography Boundary