Merge pull request #1278 from sah-anshu/whitelisted_ip

Whitelisted ip

Author: farirat

jasmin/protocols/cli/statsm.py

@@ -28,7 +28,20 @@ def user(self, arg, opts):
         user = self.pb['router'].getUser(opts.user)
         # SMPP Server stats
         for k, v in user.getCnxStatus().smpps.items():
-            if isinstance(v, dict):
+            if k == 'bound_peer_ips':
+                # Render the live peer list as a human-readable multi-line
+                # string: one entry per bound connection.
+                if not v:
+                    v = '-'
+                else:
+                    lines = []
+                    for e in v:
+                        lines.append('%s (%s @ %s)' % (
+                            e.get('peer', '?'),
+                            e.get('bind_type', '?'),
+                            formatDateTime(e.get('bound_at', 0))))
+                    v = '; '.join(lines)
+            elif isinstance(v, dict):
                 v = json.dumps(v)
 
             row = []
@@ -60,7 +73,8 @@ def user(self, arg, opts):
             tabulate(table, headers, tablefmt="plain", numalign="left").encode('ascii'))
 
     def users(self, arg, opts):
-        headers = ["#User id", "SMPP Bound connections", "SMPP L.A.", "HTTP requests counter", "HTTP L.A."]
+        headers = ["#User id", "SMPP Bound connections", "SMPP Peer IPs",
+                   "SMPP L.A.", "HTTP requests counter", "HTTP L.A."]
 
         table = []
         users = pickle.loads(self.pb['router'].perspective_user_get_all(None))
@@ -70,6 +84,14 @@ def users(self, arg, opts):
             row.append(user.getCnxStatus().smpps['bound_connections_count']['bind_receiver'] +
                        user.getCnxStatus().smpps['bound_connections_count']['bind_transmitter'] +
                        user.getCnxStatus().smpps['bound_connections_count']['bind_transceiver'])
+            # Distinct peer IPs currently holding a bind (comma-separated)
+            peers = user.getCnxStatus().smpps.get('bound_peer_ips', []) or []
+            seen = []
+            for e in peers:
+                p = e.get('peer')
+                if p and p not in seen:
+                    seen.append(p)
+            row.append(','.join(seen) if seen else '-')
             row.append(formatDateTime(user.getCnxStatus().smpps['last_activity_at']))
             row.append(user.getCnxStatus().httpapi['connects_count'])
             row.append(formatDateTime(user.getCnxStatus().httpapi['last_activity_at']))

jasmin/protocols/cli/usersm.py

@@ -34,7 +34,7 @@
 
 SmppsCredentialKeyMap = {'class': 'SmppsCredential',
                          'keyMapValue': 'smpps_credential',
-                         'Authorization': {'bind': 'bind'},
+                         'Authorization': {'bind': 'bind', 'ip': 'ip'},
                          'Quota': {'max_bindings': 'max_bindings'}}
 
 # A config map between console-configuration keys and User keys.
@@ -91,7 +91,12 @@ def castToBuiltCorrectCredType(cred, section, key, value, update=False):
         getattr(_o, 'set%s' % section)(key, value)
     elif cred == 'SmppsCredential':
         if section == 'Authorization':
-            if value.lower() in TrueBoolCastMap:
+            # The `ip` authorization is a CIDR/IP whitelist string — keep it
+            # as-is. Only `bind` (and similar future boolean authorizations)
+            # get coerced from the human "yes/no" form.
+            if key == 'ip':
+                value = value.strip()
+            elif value.lower() in TrueBoolCastMap:
                 value = True
             elif value.lower() in FalseBoolCastMap:
                 value = False

jasmin/protocols/smpp/factory.py

@@ -635,12 +635,46 @@ def addBinding(self, connection):
         _SMPPBindManager.addBinding(self, connection)
 
         # Update CnxStatus
-        self.user.getCnxStatus().smpps['bind_count'] += 1
-        self.user.getCnxStatus().smpps['bound_connections_count'][connection.bind_type.name] += 1
+        cnx_smpps = self.user.getCnxStatus().smpps
+        cnx_smpps['bind_count'] += 1
+        cnx_smpps['bound_connections_count'][connection.bind_type.name] += 1
+
+        # Record live peer IP so `stats user <uid>` can show who is bound right now
+        try:
+            peer_host = connection.transport.getPeer().host
+        except Exception:
+            peer_host = 'unknown'
+        cnx_smpps.setdefault('bound_peer_ips', []).append({
+            'session_id': getattr(connection, 'session_id', None),
+            'peer': peer_host,
+            'bind_type': connection.bind_type.name,
+            'bound_at': datetime.now(),
+        })
 
     def removeBinding(self, connection):
         _SMPPBindManager.removeBinding(self, connection)
 
         # Update CnxStatus
-        self.user.getCnxStatus().smpps['unbind_count'] += 1
-        self.user.getCnxStatus().smpps['bound_connections_count'][connection.bind_type.name] -= 1
+        cnx_smpps = self.user.getCnxStatus().smpps
+        cnx_smpps['unbind_count'] += 1
+        cnx_smpps['bound_connections_count'][connection.bind_type.name] -= 1
+
+        # Drop the matching peer-IP entry (match by session_id; fall back to
+        # first entry with the same peer host if the session_id is absent)
+        sid = getattr(connection, 'session_id', None)
+        try:
+            peer_host = connection.transport.getPeer().host
+        except Exception:
+            peer_host = None
+        entries = cnx_smpps.get('bound_peer_ips', []) or []
+        if sid is not None:
+            cnx_smpps['bound_peer_ips'] = [e for e in entries if e.get('session_id') != sid]
+        elif peer_host is not None:
+            # No session_id — remove the first matching peer so we don't
+            # leak entries on unbind.
+            new_entries = list(entries)
+            for i, e in enumerate(new_entries):
+                if e.get('peer') == peer_host and e.get('bind_type') == connection.bind_type.name:
+                    new_entries.pop(i)
+                    break
+            cnx_smpps['bound_peer_ips'] = new_entries

jasmin/protocols/smpp/protocol.py

@@ -550,6 +550,25 @@ def doBindRequest(self, reqPDU, sessionState):
             self.sendErrorResponse(reqPDU, CommandStatus.ESME_RINVPASWD, username)
             return
 
+        # Per-user IP whitelist check. `smpps_credential.getAuthorization('ip')`
+        # returns a comma-separated list of IPv4/IPv6 CIDRs; default "0.0.0.0/0"
+        # allows anything (backwards compatible).
+        try:
+            from jasmin.tools.ipmatch import is_ip_allowed
+            peer_host = self.transport.getPeer().host
+            smpps_cred = getattr(auth_avatar, 'smpps_credential', None)
+            whitelist = smpps_cred.getAuthorization('ip') if smpps_cred is not None else None
+            if whitelist and not is_ip_allowed(peer_host, whitelist):
+                self.log.warning(
+                    'SMPP Bind rejected for username "%s" from %s: IP not in whitelist (%s)',
+                    username, peer_host, whitelist)
+                self.sendErrorResponse(reqPDU, CommandStatus.ESME_RBINDFAIL, username)
+                return
+        except Exception as e:
+            # Never deny on an internal check error — log and continue. The
+            # whitelist is a guard rail, not the primary auth.
+            self.log.error('IP whitelist check failed for username "%s": %s', username, e)
+
         # Check we're not already bound, and are open to being bound
         if self.sessionState != SMPPSessionStates.OPEN:
             self.log.warning('Duplicate SMPP bind request received from: %s', username)

jasmin/routing/jasminApi.py

@@ -164,14 +164,54 @@ def setQuota(self, key, value):
 class SmppsCredential(CredentialGeneric):
     """Credential set for SMPP Server connection"""
 
+    # Default IP whitelist matches everything (current behaviour — no regression
+    # when the attribute is absent on pickled users from older versions).
+    DEFAULT_IP_WHITELIST = '0.0.0.0/0'
+
     def __init__(self, default_authorizations=True):
         if not isinstance(default_authorizations, bool):
             default_authorizations = False
 
-        self.authorizations = {'bind': default_authorizations, }
+        # `bind`: boolean, same as before.
+        # `ip`  : comma-separated list of IPv4/IPv6 addresses or CIDRs. The
+        #         remote peer IP of each bind request must fall inside at
+        #         least one of these networks, or the bind is rejected.
+        #         Default is "any IPv4" so upgrading doesn't lock users out.
+        self.authorizations = {
+            'bind': default_authorizations,
+            'ip': self.DEFAULT_IP_WHITELIST,
+        }
 
         self.quotas = {'max_bindings': None}
 
+    def setAuthorization(self, key, value):
+        """Per-key validation.  `bind` is a bool; `ip` is a CIDR/IP whitelist."""
+        if key == 'ip':
+            # Back-compat: SmppsCredential instances pickled before the `ip`
+            # authorization existed won't have it in their `authorizations`
+            # dict. Accept it here regardless so `user -u ... ip <cidr>` works
+            # on legacy users (the getAuthorization fallback mirrors this).
+            from jasmin.tools.ipmatch import validate_whitelist
+            ok, err = validate_whitelist(value)
+            if not ok:
+                raise jasminApiCredentialError(
+                    'Authorization ip is not a valid value (%r): %s' % (value, err))
+            # Bypass the base class because its validator insists on bool.
+            self.authorizations[key] = value
+            return
+
+        if key not in self.authorizations:
+            raise jasminApiCredentialError('%s is not a valid Authorization' % key)
+
+        # Anything else (e.g. 'bind') must be a bool — delegate to base.
+        CredentialGeneric.setAuthorization(self, key, value)
+
+    def getAuthorization(self, key):
+        """Back-compat: older pickled users may lack the `ip` key."""
+        if key == 'ip' and 'ip' not in self.authorizations:
+            return self.DEFAULT_IP_WHITELIST
+        return CredentialGeneric.getAuthorization(self, key)
+
     def setQuota(self, key, value):
         """Additional validation steps"""
         if key == 'max_bindings' and value is not None and (value < 0 or not isinstance(value, int)):
@@ -217,6 +257,12 @@ def __init__(self):
                 'bind_transceiver': 0,
                 'bind_transmitter': 0,
             },
+            # Live roster of bound peers. Each entry is a dict:
+            #   {'session_id': str, 'peer': '1.2.3.4', 'bind_type': 'bind_transceiver',
+            #    'bound_at': datetime}
+            # Populated by SMPPBindManager.addBinding and pruned by removeBinding.
+            # In-memory only (CnxStatus is not persisted).
+            'bound_peer_ips': [],
             'submit_sm_request_count': 0,
             'last_activity_at': 0,
             'qos_last_submit_sm_at': 0,

jasmin/tools/ipmatch.py

@@ -0,0 +1,84 @@
+"""IP whitelist matching using the stdlib `ipaddress` module.
+
+A *whitelist* is a string — a comma-separated list of IPv4/IPv6 addresses
+and/or CIDR networks. Whitespace around entries is tolerated. Examples::
+
+    '0.0.0.0/0'                       -> any IPv4 (default "allow all")
+    '::/0'                            -> any IPv6
+    '10.0.0.0/8'                      -> one /8 network
+    '10.0.0.0/8, 192.168.1.5'         -> network + single host
+    '10.0.0.0/8, 2001:db8::/32'       -> mixed v4+v6
+
+An empty or `None` whitelist is treated as "nothing allowed".
+
+The parser is tolerant and safe: any malformed entry is ignored (not
+raised). This is deliberate — a bad config row should not silently crash
+an authentication path. The caller can use :func:`validate_whitelist` at
+config-set time to surface errors to the operator.
+"""
+
+from __future__ import annotations
+
+import ipaddress
+from typing import Iterable
+
+
+def _split(whitelist: str | None) -> list[str]:
+    if not whitelist:
+        return []
+    return [p.strip() for p in str(whitelist).split(',') if p.strip()]
+
+
+def _parse_networks(whitelist: str | None) -> list:
+    """Return a list of `IPv4Network` / `IPv6Network` parsed from the
+    whitelist string. Malformed entries are skipped silently.
+    """
+    out = []
+    for entry in _split(whitelist):
+        try:
+            out.append(ipaddress.ip_network(entry, strict=False))
+        except (ValueError, TypeError):
+            continue
+    return out
+
+
+def validate_whitelist(whitelist: str | None) -> tuple[bool, str | None]:
+    """Validate a whitelist string. Returns ``(ok, error_message_or_None)``.
+
+    An empty string / None is treated as an error (set `0.0.0.0/0` explicitly
+    to allow everything). This helps the operator avoid accidentally locking
+    themselves out by clearing the field.
+    """
+    parts = _split(whitelist)
+    if not parts:
+        return False, 'whitelist is empty (use "0.0.0.0/0" to allow any IPv4)'
+    for entry in parts:
+        try:
+            ipaddress.ip_network(entry, strict=False)
+        except (ValueError, TypeError) as e:
+            return False, 'invalid entry %r: %s' % (entry, e)
+    return True, None
+
+
+def is_ip_allowed(ip: str | None, whitelist: str | None) -> bool:
+    """Return True if *ip* falls inside any network in *whitelist*.
+
+    *ip* may be an IPv4 or IPv6 address as a string (e.g. what
+    ``transport.getPeer().host`` gives you). An empty *ip* or empty
+    *whitelist* returns False.
+    """
+    if not ip or not whitelist:
+        return False
+    try:
+        addr = ipaddress.ip_address(ip)
+    except (ValueError, TypeError):
+        return False
+    for net in _parse_networks(whitelist):
+        try:
+            if addr.version != net.version:
+                continue
+            if addr in net:
+                return True
+        except (ValueError, TypeError):
+            continue
+    return False