VNet: Refuse conn if local port doesn't match app spec

api/types/app.go

@@ -17,8 +17,10 @@ limitations under the License.
 package types
 
 import (
+	"cmp"
 	"fmt"
 	"net/url"
+	"slices"
 	"strings"
 	"time"
 
@@ -537,3 +539,27 @@ func (a *AppIdentityCenter) GetPermissionSets() []*IdentityCenterPermissionSet {
 	}
 	return a.PermissionSets
 }
+
+// PortRanges is a list of port ranges.
+type PortRanges []*PortRange
+
+// Contains checks if targetPort is within any of the port ranges.
+func (p PortRanges) Contains(targetPort int) bool {
+	return slices.ContainsFunc(p, func(portRange *PortRange) bool {
+		return netutils.IsPortInRange(int(portRange.Port), int(portRange.EndPort), targetPort)
+	})
+}
+
+// Len returns the slice length.
+func (p PortRanges) Len() int { return len(p) }
+
+// Less compares port ranges by port and end port.
+func (p PortRanges) Less(i, j int) bool {
+	return cmp.Or(
+		cmp.Compare(p[i].Port, p[j].Port),
+		cmp.Compare(p[i].EndPort, p[j].EndPort),
+	) == -1
+}
+
+// Swap swaps two port ranges.
+func (p PortRanges) Swap(i, j int) { p[i], p[j] = p[j], p[i] }

api/types/app_test.go

@@ -18,6 +18,8 @@ package types
 
 import (
 	"fmt"
+	"sort"
+	"strconv"
 	"testing"
 
 	"github.com/gravitational/trace"
@@ -563,6 +565,51 @@ func TestNewAppV3(t *testing.T) {
 	}
 }
 
+func TestPortRangesContains(t *testing.T) {
+	portRanges := PortRanges([]*PortRange{
+		&PortRange{Port: 10, EndPort: 20},
+		&PortRange{Port: 42},
+	})
+
+	tests := []struct {
+		port int
+		want require.BoolAssertionFunc
+	}{
+		{port: 10, want: require.True},
+		{port: 20, want: require.True},
+		{port: 15, want: require.True},
+		{port: 42, want: require.True},
+		{port: 30, want: require.False},
+		{port: 0, want: require.False},
+	}
+
+	for _, tt := range tests {
+		t.Run(strconv.Itoa(tt.port), func(t *testing.T) {
+			tt.want(t, portRanges.Contains(tt.port))
+		})
+	}
+}
+
+func TestPortRangesSort(t *testing.T) {
+	portRanges := PortRanges([]*PortRange{
+		&PortRange{Port: 10, EndPort: 20},
+		&PortRange{Port: 10, EndPort: 15},
+		&PortRange{Port: 42, EndPort: 43},
+		&PortRange{Port: 42},
+		&PortRange{Port: 5},
+	})
+	sort.Sort(portRanges)
+
+	expected := PortRanges([]*PortRange{
+		&PortRange{Port: 5},
+		&PortRange{Port: 10, EndPort: 15},
+		&PortRange{Port: 10, EndPort: 20},
+		&PortRange{Port: 42},
+		&PortRange{Port: 42, EndPort: 43},
+	})
+	require.Equal(t, expected, portRanges)
+}
+
 func hasNoErr(t require.TestingT, err error, msgAndArgs ...interface{}) {
 	require.NoError(t, err, msgAndArgs...)
 }