eric/geth
Watch
1
0
Fork
You've already forked geth
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement opt-in overlay TUN runtime

Browse source
This commit is contained in:
Eric Wendland 2026-05-23 02:08:51 +02:00
commit d9728a326d
15 changed files with 2315 additions and 84 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/roadmap.md
View file

@ -584,19 +584,34 @@ Goal: add authorized stream-oriented management workflows over Iroh.
`overlay.join`, `overlay.route`, and `overlay.admin`.
- `[x]` Add CLI/control commands for `geth overlay status`, `plan`, `join`,
and `leave`.
- `[x]` Prototype commands make clear that no TUN/Wintun interface is created
and no packets are routed yet.
- `[x]` Prototype commands make clear that host networking changes require
explicit `overlay up`.
- `[x]` Tests cover overlay validation and control serialization.
- `[ ]` Persist overlay network configuration and membership state as
- `[x]` Persist overlay network configuration and membership state as
resource metadata.
- `[ ]` Implement resource-authorized overlay join using resource secrets
- `[x]` Implement resource-authorized overlay join using resource secrets
without granting node identity.
- `[ ]` Add platform-specific, opt-in TUN/Wintun interface management with
- `[x]` Store only a secret fingerprint in overlay membership state.
- `[x]` Tests cover persisted overlay join/status/leave and bearer-token
enforcement for `overlay.join`.
- `[x]` Add platform-specific, opt-in TUN/Wintun interface plans with
generated-definition tests and no privileged test requirements.
- `[ ]` Route IPv4 packets over `/geth/overlay/1` using the shared daemon
- `[x]` Route IPv4 packets over `/geth/overlay/1` using the shared daemon
Iroh endpoint.
- `[x]` Validate overlay packet routing with two-node Iroh tests and
`overlay.route` authorization checks.
- `[x]` Add candidate peer listing from untrusted peer-card metadata.
- `[x]` Implement actual TUN/Wintun-style activation as an explicit user
opt-in through `geth overlay up/down`.
- `[x]` Runtime reads validated IPv4 packets from the TUN device, routes them
to imported peer cards by deterministic overlay IP, and injects authorized
remote packets back into the device.
- `[x]` Runtime activation surfaces privilege/setup errors clearly instead of
silently falling back to a non-overlay transport.
- `[ ]` Add live peer/IP coordination over trusted resource metadata and
untrusted discovery candidates.
- `[ ]` Add packaged Windows Wintun deployment and macOS entitlement guidance
for release builds.
- `[~]` Unix socket forwarding where supported.
Acceptance criteria: