fix(tunnelbroker): bound and validate tcp proxy fallback ports

[dnviti]

Motivation

• An unauthenticated POST /v1/tcp-proxies allowed an attacker-controlled targetPorts array with unbounded length, enabling repeated tunnel open attempts and potential DoS of the broker.
• The broker previously accepted any positive ports and iterated every candidate without a maximum or upper-range check, and the production compose can expose the broker to the network by default.
• Legitimate use only requires a configured port and at most one runtime fallback, so requests must be constrained and validated server-side.

Description

• Replace the permissive check in the create handler with isValidTargetPortRequest(...) and require that validation in HandleCreateTCPProxy.
• Harden targetPortCandidates(...) to cap runtime candidates to two total (primary + one fallback) and to ignore ports outside the 1..65535 range.
• Add isValidTargetPortRequest(...) which rejects requests that provide more than one fallback and ensures at least one valid candidate remains after normalization.
• Add and update unit tests in backend/internal/tunnelbroker/broker_streams_test.go to cover out-of-range filtering, candidate cap behavior, and request validation boundaries.

Testing

• Ran unit tests with go test ./backend/internal/tunnelbroker -count=1 and they completed successfully.
• New and updated tests in backend/internal/tunnelbroker pass as part of that run.

---

Codex Task

[Copilot]

Pull request overview

Adds server-side validation and bounding for TCP proxy target ports in the tunnel broker, mitigating a DoS vector where attacker-controlled targetPorts arrays could trigger unbounded tunnel open attempts.

Changes:

• Bound targetPortCandidates to at most 2 candidates and reject ports outside the 1..65535 range.
• Introduce isValidTargetPortRequest to reject requests with >1 fallback or no valid ports, and wire it into HandleCreateTCPProxy.
• Extend unit tests for out-of-range filtering, candidate cap, and request validation boundaries.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
backend/internal/tunnelbroker/broker_streams.go	Adds candidate cap, upper-range port check, and new request validator.
backend/internal/tunnelbroker/broker_handlers.go	Uses isValidTargetPortRequest in the create handler.
backend/internal/tunnelbroker/broker_streams_test.go	Adds tests for the new validation/cap behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d906cdf842

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Accept primary-plus-fallback targetPorts format

isValidTargetPortRequest now rejects any request where len(targetPorts) > 1, but current in-repo clients build targetPorts as append([]int{targetPort}, fallbackPorts...) (see backend/internal/gateways/tunnels_broker.go:102-103 and backend/internal/sshsessions/gateway.go:231-233). That means a normal request with one fallback produces a two-element array and is now rejected with HTTP 400, breaking proxy creation whenever a gateway uses a non-default configured port (the common TunnelLocalPortCandidates path that yields primary + configured fallback).

Useful? React with 👍 / 👎.