fix: acl check inbound trunk only

Author: yeoleobun

src/proxy/acl.rs

@@ -257,7 +257,7 @@ impl AclModule {
         if let Some(server) = &self.inner.server {
             let trunks = server.data_context.trunks_snapshot();
             for (name, trunk) in trunks.iter() {
-                if trunk.matches_inbound_ip(addr).await {
+                if trunk.matches_inbound_source_ip(addr).await {
                     return Some(TrunkContext {
                         id: trunk.id,
                         name: name.clone(),
@@ -277,7 +277,7 @@ impl AclModule {
             .collect();
 
         for (name, trunk) in trunks {
-            if trunk.matches_inbound_ip(addr).await {
+            if trunk.matches_inbound_source_ip(addr).await {
                 return Some(TrunkContext {
                     id: trunk.id,
                     name,
@@ -498,6 +498,7 @@ fn parse_rules(rules: Vec<String>) -> Vec<AclRule> {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::proxy::routing::TrunkDirection;
     use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
 
     fn create_test_config(rules: Vec<String>) -> Arc<ProxyConfig> {
@@ -524,6 +525,60 @@ mod tests {
         })
     }
 
+    #[tokio::test]
+    async fn trunk_context_ignores_outbound_dest_same_ip() {
+        let source_ip = IpAddr::V4(Ipv4Addr::new(43, 198, 217, 33));
+        let mut config = ProxyConfig::default();
+
+        config.trunks.insert(
+            "outbound-same-ip".to_string(),
+            TrunkConfig {
+                id: Some(147),
+                direction: Some(TrunkDirection::Outbound),
+                dest: "43.198.217.33:5396".to_string(),
+                ..Default::default()
+            },
+        );
+        config.trunks.insert(
+            "inbound-source".to_string(),
+            TrunkConfig {
+                id: Some(144),
+                direction: Some(TrunkDirection::Inbound),
+                inbound_hosts: vec!["43.198.217.33".to_string()],
+                ..Default::default()
+            },
+        );
+
+        let acl = AclModule::new(Arc::new(config));
+        let ctx = acl
+            .is_from_trunk_context(&source_ip)
+            .await
+            .expect("inbound trunk should match");
+
+        assert_eq!(ctx.id, Some(144));
+        assert_eq!(ctx.name, "inbound-source");
+    }
+
+    #[tokio::test]
+    async fn trunk_context_does_not_match_inbound_dest_only() {
+        let source_ip = IpAddr::V4(Ipv4Addr::new(43, 198, 217, 33));
+        let mut config = ProxyConfig::default();
+
+        config.trunks.insert(
+            "inbound-dest-only".to_string(),
+            TrunkConfig {
+                id: Some(144),
+                direction: Some(TrunkDirection::Inbound),
+                dest: "43.198.217.33:5060".to_string(),
+                ..Default::default()
+            },
+        );
+
+        let acl = AclModule::new(Arc::new(config));
+
+        assert!(acl.is_from_trunk_context(&source_ip).await.is_none());
+    }
+
     #[test]
     fn test_parse_network() {
         let (net, prefix) = parse_network("192.168.1.0/24").unwrap();

src/proxy/data.rs

@@ -16,13 +16,12 @@ use tracing::{info, warn};
 
 use crate::{
     addons::queue::services::utils as queue_utils,
-    call::DialDirection,
     config::{ProxyConfig, RecordingPolicy},
     models::{routing, sip_trunk},
     proxy::routing::matcher::RouteResourceLookup,
     proxy::routing::{
         CacPolicy, CallIdMode, ConfigOrigin, DestConfig, MatchConditions, MediaMode, RewriteRules,
-        RouteAction, RouteQueueConfig, RouteRule, TrunkConfig, VideoPolicy, candidate_matches_ip,
+        RouteAction, RouteQueueConfig, RouteRule, TrunkConfig, VideoPolicy,
     },
     proxy::trunk_registrar::TrunkRegistrar,
 };
@@ -214,17 +213,8 @@ impl ProxyDataContext {
         let trunks = self.trunks_snapshot();
         let mut matches = Vec::new();
         for (name, trunk) in trunks.iter() {
-            if let Some(trunk_direction) = trunk.direction
-                && !trunk_direction.allows(&DialDirection::Inbound)
-            {
-                continue;
-            }
-
-            for host in &trunk.inbound_hosts {
-                if candidate_matches_ip(host, addr).await {
-                    matches.push(name.clone());
-                    break;
-                }
+            if trunk.matches_inbound_source_ip(addr).await {
+                matches.push(name.clone());
             }
         }
         matches

src/proxy/routing/mod.rs

@@ -294,6 +294,22 @@ impl Default for TrunkConfig {
 }
 
 impl TrunkConfig {
+    pub async fn matches_inbound_source_ip(&self, addr: &IpAddr) -> bool {
+        if let Some(trunk_direction) = self.direction
+            && !trunk_direction.allows(&DialDirection::Inbound)
+        {
+            return false;
+        }
+
+        for host in &self.inbound_hosts {
+            if candidate_matches(host, addr).await {
+                return true;
+            }
+        }
+
+        false
+    }
+
     pub async fn matches_inbound_ip(&self, addr: &IpAddr) -> bool {
         for host in &self.inbound_hosts {
             if candidate_matches(host, addr).await {