eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: complete host opening audit

Browse source
This commit is contained in:
Eric Wendland 2026-07-05 18:23:12 +02:00
commit 8e3b45db1b
2 changed files with 17 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

11
docs/architecture.md
View file

@ -155,6 +155,17 @@ fields so scripts can fail on unhealthy streams. Common daemon errors include a
`next:` recovery line for missing peer cards, missing grants, missing resources,
unavailable endpoints, and missing DB/KV/document registrations.
Host-opening paths are intentionally narrow. TCP pipe forwarding accepts only
explicit loopback socket addresses on both the local listener and remote target;
Unix pipe forwarding requires absolute paths without parent-directory
components; SSH proxying always connects the authorized remote stream to
`127.0.0.1:22`; and overlay interface creation happens only after the operator
runs `geth overlay up`. Host setup failures should be handled as local operator
or entitlement problems. For overlay platform recovery, see
`docs/overlay-platforms.md`; for missing peer cards, endpoint bindings, or
resource grants, use `geth peer import`, `geth node endpoint-add`, and
`geth auth grant`/`geth node grant` as indicated by `next:` error output.
## Resource Model
Everything meaningful is modeled as a resource. Resources have a kind, name,

12
docs/production-readiness-roadmap.md
View file

@ -176,13 +176,13 @@ Goal: finish the authorization and remote-input audit before deployment.
- `[x]` Oversized messages are rejected without state mutation.
- `[x]` Tests cover oversized payload denial for representative protocols.
- `[ ]` Audit host-opening paths.
- `[x]` Audit host-opening paths.
Acceptance criteria:
- `[ ]` TCP forwarding remains loopback-only unless a later ADR expands it.
- `[ ]` Unix forwarding rejects unsafe paths.
- `[ ]` SSH proxy connects only to the intended local SSH endpoint.
- `[ ]` Overlay TUN setup remains explicit opt-in.
- `[ ]` Docs state host access risks and recovery commands.
- `[x]` TCP forwarding remains loopback-only unless a later ADR expands it.
- `[x]` Unix forwarding rejects unsafe paths.
- `[x]` SSH proxy connects only to the intended local SSH endpoint.
- `[x]` Overlay TUN setup remains explicit opt-in.
- `[x]` Docs state host access risks and recovery commands.
## Phase 5: Production Cryptography Boundary