eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add protected peer auth check

Browse source
This commit is contained in:
Eric Wendland 2026-05-18 17:01:50 +02:00
commit b0f208b05a
7 changed files with 347 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

12
docs/architecture.md
View file

@ -46,8 +46,11 @@ discovers Iroh node addressing. `geth peer export/import/list` supports manual
exchange of signed peer cards as untrusted candidates. Peer cards include the
Iroh EndpointID plus relay/direct address candidates when the daemon can observe
them. `geth peer ping <node-id>` dials an imported peer card over Iroh and
exchanges signed peer-card metadata. Automatic signed peer-card advertisement
over LAN discovery remains separate future work.
exchanges signed peer-card metadata. `geth peer auth-check <node-id>
<resource> <capability>` sends a protected Iroh control request that validates
the caller's signed peer card against the actual Iroh EndpointID before
evaluating resource-local capabilities. Automatic signed peer-card
advertisement over LAN discovery remains separate future work.
Peer cards are the discovery payload. A peer card carries node ID, agent ID,
endpoint candidates, timestamp, signing public key, and an Ed25519 signature
@ -55,7 +58,10 @@ over a canonical payload. Imported and ping-discovered peer cards are stored as
untrusted metadata in `peer_cards`; trust reduction is future work. `auth
explain` reports when a subject is only a discovered peer candidate and denies
access. The peer ping path authenticates the Iroh endpoint and peer-card
signature, but it does not authorize any resource module.
signature, but it does not authorize any resource module. Protected peer
control requests must also prove that the signed peer card binds the observed
Iroh EndpointID, then reduce resource auth ops; an EndpointID alone is not
accepted as a resource principal.
The daemon starts this endpoint during `geth daemon run` and keeps it alive for
the daemon lifetime. When endpoint startup succeeds, the Iroh EndpointID is

6
docs/roadmap.md
View file

@ -127,7 +127,7 @@ geth-to-geth connections without granting trust from discovery alone.
- No discovery result grants capabilities or trust.
- `auth explain` can distinguish "discovered" from "trusted".
- `[~]` Basic authenticated peer connection.
- `[x]` Basic authenticated peer connection.
Acceptance criteria:
- `[x]` `geth peer ping <node-id>` dials another node over Iroh using an
imported signed peer card.
@ -135,9 +135,9 @@ geth-to-geth connections without granting trust from discovery alone.
as a candidate only.
- `[x]` The ping response records negotiated ALPN and remote endpoint
identity.
- `[ ]` The remote side proves an agent/node binding before protected module
- `[x]` The remote side proves an agent/node binding before protected module
access.
- `[ ]` Protected module handlers reject requests that only know an
- `[x]` Protected module handlers reject requests that only know an
EndpointID and lack resource capabilities.
## Phase 2: Trust And Authorization