@routr/connect 2.15.3 → 2.15.4

package/dist/access.js

@@ -31,6 +31,7 @@ exports.checkAccessFromPSTN = exports.checkAgentOrPeerAccess = exports.checkAcce
 const logger_1 = require("@fonoster/logger");
 const common_1 = require("@routr/common");
 const types_1 = require("./types");
+const utils_1 = require("./utils");
 const logger = (0, logger_1.getLogger)({ service: "connect", filePath: __filename });
 const checkAccess = (accessRequest) => __awaiter(void 0, void 0, void 0, function* () {
     const { apiClient, request, caller, callee, routingDirection } = accessRequest;
@@ -80,11 +81,16 @@ const checkAccessFromPSTN = (apiClient, request, callee) => __awaiter(void 0, vo
         return common_1.CommonResponse.createForbiddenResponse();
     }
     // Verify that the IP is allowlist which means getting the access control list for the trunk
+    // The source is the top Via's "received" value (set by the SIP stack when the
+    // packet came from another address), not request.sender.host, which is copied
+    // from the Via host and can be forged.
     if (trunk.accessControlList) {
         try {
-            const allow = trunk.accessControlList.allow.filter((net) => {
-                return common_1.IpUtils.hasIp(net, request.sender.host);
-            })[0];
+            const source = (0, utils_1.getSourceAddress)(request);
+            const allow = source &&
+                trunk.accessControlList.allow.filter((net) => {
+                    return common_1.IpUtils.hasIp(net, source);
+                })[0];
             if (!allow) {
                 return common_1.CommonResponse.createUnauthorizedResponseWithoutChallenge();
             }

package/dist/envs.d.ts

@@ -4,3 +4,7 @@ export declare const API_ADDR: string;
 export declare const CONNECT_VERIFIER_ADDR: string;
 export declare const CONNECT_VERIFIER_PUBLIC_KEY_PATH: string;
 export declare const CONNECT_VERIFIER_OPTIONS: any;
+export declare const DEFAULT_UNTRUSTED_HEADERS_TO_STRIP: string[];
+export declare const UNTRUSTED_HEADERS_TO_STRIP: string[];
+export declare const TRUSTED_EDGEPORTS: string[];
+export declare const TRUSTED_EDGEPORT_ADDRESSES: string[];

package/dist/envs.js

@@ -1,7 +1,7 @@
 "use strict";
 var _a;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CONNECT_VERIFIER_OPTIONS = exports.CONNECT_VERIFIER_PUBLIC_KEY_PATH = exports.CONNECT_VERIFIER_ADDR = exports.API_ADDR = exports.LOCATION_ADDR = exports.BIND_ADDR = void 0;
+exports.TRUSTED_EDGEPORT_ADDRESSES = exports.TRUSTED_EDGEPORTS = exports.UNTRUSTED_HEADERS_TO_STRIP = exports.DEFAULT_UNTRUSTED_HEADERS_TO_STRIP = exports.CONNECT_VERIFIER_OPTIONS = exports.CONNECT_VERIFIER_PUBLIC_KEY_PATH = exports.CONNECT_VERIFIER_ADDR = exports.API_ADDR = exports.LOCATION_ADDR = exports.BIND_ADDR = void 0;
 /*
  * Copyright (C) 2026 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/routr
@@ -30,3 +30,39 @@ exports.CONNECT_VERIFIER_PUBLIC_KEY_PATH = process.env.CONNECT_VERIFIER_PUBLIC_K
 exports.CONNECT_VERIFIER_OPTIONS = process.env.CONNECT_VERIFIER_OPTIONS
     ? JSON.parse(process.env.CONNECT_VERIFIER_OPTIONS)
     : { expiresIn: "1h", algorithm: ["RS256"] };
+// Platform headers a caller must never be able to set. They are removed from
+// requests that come from untrusted sources (e.g., the PSTN or a client using a
+// Connect Token) before Routr adds its own. Override with a comma-separated list;
+// set it to an empty string to disable stripping.
+exports.DEFAULT_UNTRUSTED_HEADERS_TO_STRIP = [
+    "X-App-Ref",
+    "X-Call-Ref",
+    "X-Call-Direction",
+    "X-DOD-Number",
+    "X-DOD-Privacy",
+    "X-Access-Key-Id",
+    "X-Is-Api-Originated-Type",
+    "X-Edgeport-Ref",
+    "X-Gateway-Auth",
+    "X-Request-Uri",
+    "X-Session-Count"
+];
+exports.UNTRUSTED_HEADERS_TO_STRIP = process.env.UNTRUSTED_HEADERS_TO_STRIP !== undefined
+    ? process.env.UNTRUSTED_HEADERS_TO_STRIP.split(",")
+        .map((h) => h.trim())
+        .filter((h) => h.length > 0)
+    : exports.DEFAULT_UNTRUSTED_HEADERS_TO_STRIP;
+const parseList = (value) => (value !== null && value !== void 0 ? value : "")
+    .split(",")
+    .map((v) => v.trim())
+    .filter((v) => v.length > 0);
+// Peer EdgePorts allowed to forward requests with X-Edgeport-Ref. Such a request
+// skips routing and access checks (its route is rebuilt from the message), so it
+// is only honored when the packet comes from an address in
+// TRUSTED_EDGEPORT_ADDRESSES (IPs or CIDRs, matched against the top Via's
+// "received" value, or its host when "received" is absent). TRUSTED_EDGEPORTS
+// optionally narrows which X-Edgeport-Ref values are accepted. The defaults trust
+// no peer EdgePort, which is right for single-EdgePort deployments: the header is
+// removed and the request is routed normally.
+exports.TRUSTED_EDGEPORTS = parseList(process.env.TRUSTED_EDGEPORTS);
+exports.TRUSTED_EDGEPORT_ADDRESSES = parseList(process.env.TRUSTED_EDGEPORT_ADDRESSES);

package/dist/handlers/request.d.ts

@@ -1,4 +1,5 @@
 import { MessageRequest, Response } from "@routr/processor";
 import { ILocationService } from "@routr/location";
 import { CommonConnect as CC } from "@routr/common";
-export declare const handleRequest: (location: ILocationService, apiClient?: CC.APIClient) => (request: MessageRequest, res: Response) => Promise<void>;
+import { EdgePortTrust } from "../utils";
+export declare const handleRequest: (location: ILocationService, apiClient?: CC.APIClient, edgePortTrust?: EdgePortTrust) => (request: MessageRequest, res: Response) => Promise<void>;

package/dist/handlers/request.js

@@ -70,12 +70,33 @@ const location_1 = require("@routr/location");
 const common_1 = require("@routr/common");
 const logger_1 = require("@fonoster/logger");
 const types_1 = require("./../types");
+const utils_1 = require("../utils");
+const envs_1 = require("../envs");
 const logger = (0, logger_1.getLogger)({ service: "connect", filePath: __filename });
 const enforceE164 = processor_1.Alterations.enforceE164(common_1.Environment.ENFORCE_E164, common_1.Environment.ENFORCE_E164_WITH_MOBILE_PREFIX);
-const handleRequest = (location, apiClient) => (request, res) => __awaiter(void 0, void 0, void 0, function* () {
+const defaultEdgePortTrust = {
+    refs: envs_1.TRUSTED_EDGEPORTS,
+    addresses: envs_1.TRUSTED_EDGEPORT_ADDRESSES
+};
+const handleRequest = (location, apiClient, edgePortTrust = defaultEdgePortTrust) => (request, res) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
     try {
-        const req = common_1.Environment.ENFORCE_E164 ? enforceE164(request) : request;
+        let req = common_1.Environment.ENFORCE_E164 ? enforceE164(request) : request;
         let route;
+        // X-Edgeport-Ref marks a request forwarded by a peer EdgePort, whose route
+        // is rebuilt from the message without routing or access checks. Honor it
+        // only from a trusted peer EdgePort. Anyone else could use it to relay calls
+        // through Routr (toll fraud), so remove it and route the request normally.
+        const fromTrustedEdgePort = (0, utils_1.isFromTrustedEdgePort)(req, edgePortTrust);
+        if (!fromTrustedEdgePort &&
+            processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.EDGEPORT_REF)) {
+            logger.warn("ignoring X-Edgeport-Ref from an untrusted source", {
+                ref: req.ref,
+                edgePortRef: req.edgePortRef,
+                via: (_a = req.message.via) === null || _a === void 0 ? void 0 : _a[0]
+            });
+            req = processor_1.Alterations.removeXEdgePortRef(req);
+        }
         // A CANCEL must follow the exact path its INVITE took (RFC 3261 §9.1) — it is
         // never a new call to route. edgeport already forwards it correctly, straight
         // from the INVITE's own client transaction (GRPCSipListener#sendCancel), which
@@ -87,8 +108,7 @@ const handleRequest = (location, apiClient) => (request, res) => __awaiter(void
         // reaches edgeport's already-correct CANCEL handling. The result: the CANCEL is
         // silently dropped, the call keeps ringing, and if the callee answers a moment
         // later they connect into a line the caller has already abandoned.
-        if (processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.EDGEPORT_REF) ||
-            req.method === common_1.CommonTypes.Method.CANCEL) {
+        if (fromTrustedEdgePort || req.method === common_1.CommonTypes.Method.CANCEL) {
             route = location_1.Helper.createRouteFromLastMessage(req);
         }
         else {
@@ -105,6 +125,9 @@ const handleRequest = (location, apiClient) => (request, res) => __awaiter(void
             else if (!routerResult.route) {
                 return res.sendTemporarilyUnavailable();
             }
+            // Remove platform headers a caller from an untrusted source (e.g., the
+            // PSTN) could have spoofed. Routr re-adds its own values afterwards.
+            req = processor_1.Alterations.removeHeaders((0, utils_1.getUntrustedHeadersToStrip)(direction, !!(0, utils_1.hasXConnectObjectHeader)(req), envs_1.UNTRUSTED_HEADERS_TO_STRIP))(req);
             const p = {
                 name: common_1.CommonTypes.ExtraHeader.CALL_DIRECTION,
                 value: direction,

package/dist/router.js

@@ -280,6 +280,7 @@ function agentToPeer(location, callee, req) {
 // eslint-disable-next-line require-jsdoc
 function peerToPSTN(apiClient, req) {
     return __awaiter(this, void 0, void 0, function* () {
+        var _a;
         const numberTel = processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.DOD_NUMBER);
         const privacy = processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.DOD_PRIVACY);
         if (!numberTel) {
@@ -289,6 +290,16 @@ function peerToPSTN(apiClient, req) {
         if (!number) {
             return common_1.CommonResponse.createNotFoundResponse(`No Number found for tel:${numberTel}`);
         }
+        // A Number bound to an access key (e.g., a Fonoster workspace) may only be
+        // used by a request that carries the same X-Access-Key-Id
+        const numberAccessKeyId = (_a = number.extended) === null || _a === void 0 ? void 0 : _a.accessKeyId;
+        if (numberAccessKeyId &&
+            numberAccessKeyId !== processor_1.Extensions.getHeaderValue(req, common_1.CommonTypes.ExtraHeader.ACCESS_KEY_ID)) {
+            logger.verbose("rejected peer-to-pstn request: access key mismatch", {
+                numberRef: number.ref
+            });
+            return common_1.CommonResponse.createForbiddenResponse();
+        }
         if (!number.trunk) {
             // TODO: Create custom error
             throw new Error(`no trunk associated with Number ref: ${number.ref}`);

package/dist/utils.d.ts

@@ -22,3 +22,42 @@ export declare const hasXConnectObjectHeader: (req: MessageRequest) => string;
 export declare const getVerifierImpl: () => {
     verify: (token: string) => Promise<import("@routr/common/dist/errors").ServiceUnavailableError | V.VerifyResponse>;
 };
+/**
+ * Returns the headers that must be removed from a request before it is forwarded.
+ *
+ * Requests from authenticated Agents and Peers are trusted and keep their headers.
+ * Requests from the PSTN, and requests authorized only by a Connect Token, are not:
+ * the platform headers in `headers` are removed so a caller can't spoof them.
+ * A client using a verified Connect Token keeps its X-App-Ref.
+ *
+ * @param {RoutingDirection} direction - The routing direction of the request
+ * @param {boolean} withConnectToken - Whether the request carried a verified X-Connect-Token
+ * @param {string[]} headers - The headers to strip from untrusted requests
+ * @return {string[]} The headers to remove
+ */
+export declare const getUntrustedHeadersToStrip: (direction: RoutingDirection, withConnectToken: boolean, headers: string[]) => string[];
+export interface EdgePortTrust {
+    refs: string[];
+    addresses: string[];
+}
+/**
+ * Returns the address the request came from: the top Via's "received" value,
+ * which the SIP stack sets when the packet's source differs from the Via host
+ * (RFC 3261 §18.2.1), or the Via host otherwise.
+ *
+ * @param {MessageRequest} request - The request
+ * @return {string | undefined} The source address
+ */
+export declare const getSourceAddress: (request: MessageRequest) => string | undefined;
+/**
+ * Tells whether a request carrying X-Edgeport-Ref was forwarded by a trusted peer
+ * EdgePort. Only such a request may take the last-message fast path, which skips
+ * routing and access checks. The header value alone proves nothing (anyone can
+ * set it), so the request's source address must be in `trust.addresses`; when
+ * `trust.refs` is not empty, the header value must also be one of them.
+ *
+ * @param {MessageRequest} request - The request
+ * @param {EdgePortTrust} trust - The trusted peer EdgePorts
+ * @return {boolean} true if the request comes from a trusted peer EdgePort
+ */
+export declare const isFromTrustedEdgePort: (request: MessageRequest, trust: EdgePortTrust) => boolean;

package/dist/utils.js

@@ -45,7 +45,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getVerifierImpl = exports.hasXConnectObjectHeader = exports.getSipUri = exports.getTrunkURI = exports.createTrunkAuthentication = exports.createRemotePartyId = exports.createPAssertedIdentity = exports.getRoutingDirection = exports.findResource = exports.findNumberByTelUrl = exports.findDomain = exports.isKind = void 0;
+exports.isFromTrustedEdgePort = exports.getSourceAddress = exports.getUntrustedHeadersToStrip = exports.getVerifierImpl = exports.hasXConnectObjectHeader = exports.getSipUri = exports.getTrunkURI = exports.createTrunkAuthentication = exports.createRemotePartyId = exports.createPAssertedIdentity = exports.getRoutingDirection = exports.findResource = exports.findNumberByTelUrl = exports.findDomain = exports.isKind = void 0;
 /*
  * Copyright (C) 2026 by Fonoster Inc (https://fonoster.com)
  * http://github.com/fonoster/routr
@@ -223,3 +223,72 @@ const getVerifierImpl = () => {
     return null;
 };
 exports.getVerifierImpl = getVerifierImpl;
+/**
+ * Returns the headers that must be removed from a request before it is forwarded.
+ *
+ * Requests from authenticated Agents and Peers are trusted and keep their headers.
+ * Requests from the PSTN, and requests authorized only by a Connect Token, are not:
+ * the platform headers in `headers` are removed so a caller can't spoof them.
+ * A client using a verified Connect Token keeps its X-App-Ref.
+ *
+ * @param {RoutingDirection} direction - The routing direction of the request
+ * @param {boolean} withConnectToken - Whether the request carried a verified X-Connect-Token
+ * @param {string[]} headers - The headers to strip from untrusted requests
+ * @return {string[]} The headers to remove
+ */
+const getUntrustedHeadersToStrip = (direction, withConnectToken, headers) => {
+    if (withConnectToken) {
+        return headers.filter((h) => h.toLowerCase() !== common_1.CommonTypes.ExtraHeader.APP_REF.toLowerCase());
+    }
+    if (direction === types_1.RoutingDirection.FROM_PSTN ||
+        direction === types_1.RoutingDirection.UNKNOWN) {
+        return headers;
+    }
+    return [];
+};
+exports.getUntrustedHeadersToStrip = getUntrustedHeadersToStrip;
+/**
+ * Returns the address the request came from: the top Via's "received" value,
+ * which the SIP stack sets when the packet's source differs from the Via host
+ * (RFC 3261 §18.2.1), or the Via host otherwise.
+ *
+ * @param {MessageRequest} request - The request
+ * @return {string | undefined} The source address
+ */
+const getSourceAddress = (request) => {
+    var _a, _b;
+    const via = (_b = (_a = request.message) === null || _a === void 0 ? void 0 : _a.via) === null || _b === void 0 ? void 0 : _b[0];
+    return (via === null || via === void 0 ? void 0 : via.received) || (via === null || via === void 0 ? void 0 : via.host);
+};
+exports.getSourceAddress = getSourceAddress;
+/**
+ * Tells whether a request carrying X-Edgeport-Ref was forwarded by a trusted peer
+ * EdgePort. Only such a request may take the last-message fast path, which skips
+ * routing and access checks. The header value alone proves nothing (anyone can
+ * set it), so the request's source address must be in `trust.addresses`; when
+ * `trust.refs` is not empty, the header value must also be one of them.
+ *
+ * @param {MessageRequest} request - The request
+ * @param {EdgePortTrust} trust - The trusted peer EdgePorts
+ * @return {boolean} true if the request comes from a trusted peer EdgePort
+ */
+const isFromTrustedEdgePort = (request, trust) => {
+    const ref = processor_1.Extensions.getHeaderValue(request, common_1.CommonTypes.ExtraHeader.EDGEPORT_REF);
+    if (!ref || trust.addresses.length === 0)
+        return false;
+    if (trust.refs.length > 0 && !trust.refs.includes(ref))
+        return false;
+    const addr = (0, exports.getSourceAddress)(request);
+    if (!addr)
+        return false;
+    return trust.addresses.some((net) => {
+        try {
+            return common_1.IpUtils.hasIp(net, addr);
+        }
+        catch (e) {
+            // Invalid net, or a source that is not an IP address
+            return false;
+        }
+    });
+};
+exports.isFromTrustedEdgePort = isFromTrustedEdgePort;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@routr/connect",
-  "version": "2.15.3",
+  "version": "2.15.4",
   "description": "Default processor",
   "author": "Pedro Sanders <psanders@fonoster.com>",
   "homepage": "https://github.com/fonoster/routr#readme",
@@ -20,9 +20,9 @@
   },
   "dependencies": {
     "@fonoster/logger": "0.6.0",
-    "@routr/common": "^2.15.3",
-    "@routr/location": "^2.15.3",
-    "@routr/processor": "^2.15.3",
+    "@routr/common": "^2.15.4",
+    "@routr/location": "^2.15.4",
+    "@routr/processor": "^2.15.4",
     "jsonwebtoken": "^9.0.3"
   },
   "devDependencies": {
@@ -41,5 +41,5 @@
   "bugs": {
     "url": "https://github.com/fonoster/routr/issues"
   },
-  "gitHead": "30e73f1331f115b2dd9d02cdfdcf931dbeede36b"
+  "gitHead": "3d4a72191d5ac315429570e562d20fb5807cc942"
 }