feat/MS Teams IP check improvement (#117)

* added ip in cidr utilities

* middleware add ms teams cidr check

* use cidr-matcher lib

* removed redundant require

* moved cidr-matcher require to top of file

* moved express require to top of file

---------

Co-authored-by: ajukes <ajukes@callable.io>

lib/db-utils.js

@@ -45,7 +45,7 @@ AND vc.is_active = 1
 AND sg.inbound = 1 
 AND sg.voip_carrier_sid = vc.voip_carrier_sid`;
 
-const sqlAccountByRealm = 'SELECT * from accounts WHERE sip_realm = ?';
+const sqlAccountByRealm = 'SELECT * from accounts WHERE sip_realm = ? AND is_active = 1';
 const sqlAccountBySid = 'SELECT * from accounts WHERE account_sid = ?';
 const sqlApplicationBySid = 'SELECT * from applications WHERE application_sid = ?';
 
@@ -153,24 +153,41 @@ module.exports = (srf, logger) => {
        * Let's look for case #1 first...
        */
 
-      /* get all the carriers and gateways for the account owning this sip realm */
-      const [gwAcc] = await pp.query(sqlSelectAllCarriersForAccountByRealm, [uri.host]);
-      const [gwSP] = gwAcc.length ? [[]] : await pp.query(sqlSelectAllCarriersForSPByRealm, uri.host);
-      const gw = gwAcc.concat(gwSP);
-      const selected = gw.find(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
-      if (selected) {
-        const [a] = await pp.query(sqlAccountByRealm, [uri.host]);
-        if (0 === a.length) return failure;
-        return {
-          fromCarrier: true,
-          gateway: selected,
-          service_provider_sid: a[0].service_provider_sid,
-          account_sid: a[0].account_sid,
-          application_sid: selected.application_sid,
-          account: a[0]
-        };
+      /* does anyone own this sip realm? */
+      const [a] = await pp.query(sqlAccountByRealm, [uri.host]);
+      if (a.length) {
+        assert(a.length === 1);
+
+        /* yes they do */
+        logger.debug(`sip realm is associated with account_sid: ${a[0].account_sid}`);
+
+        /**
+         * We have one of two cases:
+         * (1a). The user configured his or her carrier to send to their sip realm, or
+         * (1b). The user is making a call from a sip device.
+         */
+
+        /* get all the carriers and gateways for the account owning this sip realm */
+        const [gwAcc] = await pp.query(sqlSelectAllCarriersForAccountByRealm, [uri.host]);
+        const [gwSP] = gwAcc.length ? [[]] : await pp.query(sqlSelectAllCarriersForSPByRealm, uri.host);
+        const gw = gwAcc
+          .concat(gwSP)
+          .sort((a, b) => b.netmask - a.netmask);
+        const selected = gw.find(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
+        if (selected) {
+          return {
+            fromCarrier: true,
+            gateway: selected,
+            service_provider_sid: a[0].service_provider_sid,
+            account_sid: a[0].account_sid,
+            application_sid: selected.application_sid,
+            account: a[0]
+          };
+        }
+        return failure;
       }
 
+
       /* no match, so let's look for case #2 */
       try {
         logger.info({
@@ -178,7 +195,9 @@ module.exports = (srf, logger) => {
           user: uri.user
         }, 'sip realm is not associated with an account, checking carriers');
         const [gw] = await pp.query(sqlSelectCarrierRequiringRegistration, [uri.host, uri.user]);
-        const matches = gw.filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
+        const matches = gw
+          .sort((a, b) => b.netmask - a.netmask)
+          .filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address));
         if (1 === matches.length) {
           // bingo
           //TODO: this assumes the carrier is associate to an account, not an SP
@@ -229,6 +248,7 @@ module.exports = (srf, logger) => {
       /* find all carrier entries that have an inbound gateway matching the source IP */
       const [gw] = await pp.query(sqlSelectAllGatewaysForSP);
       let matches = gw
+        .sort((a, b) => b.netmask - a.netmask)
         .filter(gatewayMatchesSourceAddress.bind(null, logger, req.source_address))
         .map((gw) => {
           return {

lib/middleware.js

@@ -1,7 +1,7 @@
 const debug = require('debug')('jambonz:sbc-inbound');
 const assert = require('assert');
 const parseUri = require('drachtio-srf').parseUri;
-const {nudgeCallCounts, roundTripTime} = require('./utils');
+const {nudgeCallCounts, roundTripTime, isMSTeamsCIDR} = require('./utils');
 const digestChallenge = require('@jambonz/digest-utils');
 const msProxyIps = process.env.MS_TEAMS_SIP_PROXY_IPS ?
   process.env.MS_TEAMS_SIP_PROXY_IPS.split(',').map((i) => i.trim()) :
@@ -155,7 +155,7 @@ module.exports = function(srf, logger) {
           ...req.locals
         };
       }
-      else if (msProxyIps.includes(req.source_address)) {
+      else if (msProxyIps.includes(req.source_address) || isMSTeamsCIDR(req.source_address)) {
         logger.info({source_address: req.source_address}, 'identifyAccount: incoming call from Microsoft Teams');
         const uri = parseUri(req.uri);
 

lib/utils.js

@@ -1,5 +1,8 @@
+const CIDRMatcher = require('cidr-matcher');
+const express = require('express');
 const rtpCharacteristics = require('../data/rtp-transcoding');
 const srtpCharacteristics = require('../data/srtp-transcoding');
+
 let idx = 0;
 
 const isWSS = (req) => {
@@ -96,7 +99,6 @@ const handleErrors = (logger, app, resolve, reject, e) => {
 
 
 const createHealthCheckApp = (port, logger) => {
-  const express = require('express');
   const app = express();
 
   app.use(express.urlencoded({ extended: true }));
@@ -178,6 +180,20 @@ const parseConnectionIp = (sdp) => {
   return arr ? arr[1] : null;
 };
 
+/**
+ * Checks if ip is one of MS Teams sip signalling ips
+ * https://learn.microsoft.com/en-us/azure/communication-services/concepts
+ * /telephony/direct-routing-infrastructure#sip-signaling-fqdns
+ * @param ip IP address, example 172.31.0.1
+ * */
+const isMSTeamsCIDR = (ip) => {
+  const cidrs = [
+    '52.112.0.0/14',
+    '52.120.0.0/14'
+  ];
+  const matcher = new CIDRMatcher(cidrs);
+  return matcher.contains(ip);
+};
 
 module.exports = {
   isWSS,
@@ -194,5 +210,6 @@ module.exports = {
   createHealthCheckApp,
   nudgeCallCounts,
   roundTripTime,
-  parseConnectionIp
+  parseConnectionIp,
+  isMSTeamsCIDR
 };