dguerri / k8s-ssh-gateway-controller / 26247136912

88%

push

github

fix(tcp): enforce the listener port assigned by the SSH server

TCP listeners pinning a specific port silently accepted whatever port
the SSH server returned, because the URI verification short-circuited
whenever RemoteHost was "localhost" (the default when no hostname is
set in the listener spec).

Add an EnforcePort flag to ForwardingConfig, set it for TCP listeners
with port > 0, and require the assigned tcp:// URI to use that exact
port. On mismatch (or verification timeout), the forwarding is
cancelled and the route reconciler retries with backoff — same retry
pattern HTTP hostnames already use. HTTP/HTTPS behavior is unchanged.

38 of 42 new or added lines in 2 files covered. (90.48%)

1604 of 1908 relevant lines covered (84.07%)

6.9 hits per line