Add source IP support in REST auth

Cargo.toml

@@ -37,7 +37,7 @@ http = "0.2.9"
 hyper = { version = "0.14.27", features = ["server", "http1"] }
 hyper-rustls = "0.23.2"
 lazy_static = "1.4.0"
-libunftp = "0.19.0"
+libunftp = "0.19.1"
 prometheus = { version = "0.13.3", features = ["process"] }
 serde = { version = "1.0.188", features = ["derive"] }
 serde_json = "1.0.107"
@@ -46,10 +46,10 @@ slog-async = "2.8.0"
 slog-term = "2.9.0"
 thiserror = "1.0.48"
 tokio = { version = "1.32.0", features = ["signal", "rt-multi-thread"] }
-unftp-sbe-fs = "0.2.3"
-unftp-sbe-gcs = { version = "0.2.4", optional = true }
-unftp-auth-rest = { version = "0.2.3", optional = true }
-unftp-auth-jsonfile = { version = "0.3.2", optional = true }
+unftp-sbe-fs = "0.2.4"
+unftp-sbe-gcs = { version = "0.2.5", optional = true }
+unftp-auth-rest = { version = "0.2.4", optional = true }
+unftp-auth-jsonfile = { version = "0.3.3", optional = true }
 unftp-sbe-rooter = "0.2.0"
 unftp-sbe-restrict = "0.1.1"
 

RELEASE-CHECKLIST.md

@@ -21,5 +21,5 @@
   > slog-redis-v0.1.2
 * Wait for the Github Actions pipeline to finish. You should see all artifacts in the release page.
 * Build and push the docker containers
-* Publish the docs site unftp.rs by running `make site`
+* Publish the docs site unftp.rs by running `make site`.
 * Notify the Telegram channel.

crates/redislog/src/lib.rs

@@ -94,7 +94,7 @@ pub struct Builder {
     connection_pool_size: u32,
 }
 
-/// Errors returned by the [`Builder`](crate::Builder) and the [`Logger`](crate::Logger)
+/// Errors returned by the [`Builder`] and the [`Logger`]
 #[derive(Debug)]
 pub enum Error {
     ConnectionPoolErr(r2d2::Error),

docs/server/rest.md

@@ -0,0 +1,43 @@
+---
+title: REST auth
+---
+
+There are multiple ways to externalize authentication, rather than [local JSON authentication](/server/jsonconfig).
+This page explains how to use the REST authenticator.
+With the REST method, you provide your own HTTP endpoint.
+You can use any method like GET or POST, and you can customize unFTP to support your API.
+
+## Set up
+
+Example:
+
+```sh
+unftp \
+    --auth-type rest \
+    --auth-rest-method POST \
+    --auth-rest-url http://localhost:5000/v1/ftp-auth \
+    --auth-rest-body '{"username":"{USER}","password":"{PASS}"}' \
+    --auth-rest-selector /status \
+    --auth-rest-regex successful
+```
+
+Let's say, a user `alice` logs in on the unFTP server.
+With the above configuration unFTP will build an HTTP POST authentication request for http://localhost:5000/v1/ftp-auth
+It will replace the placeholders `{USER}`, and `{PASS}` with the given FTP username and password:
+
+```json
+{"username":"alice","password":"abc1234"}
+```
+
+And, if the login was successful, the server should respond with something like:
+
+```json
+{"message":"User logged in.","status":"successful"}
+```
+
+The REST authenticator uses the `/status` JSON pointer, and matches it to `"successful"`.
+
+Aside from the placeholders `{USER}` and `{PASS}` you can use `{IP}`.
+That will add the source IP address of the connected client.
+That is in case if you want to perform client-IP whitelisting, next to regular username and password.
+

doctave.yaml

@@ -16,6 +16,7 @@ navigation:
       - path: docs/server/ftps.md
       - path: docs/server/gcs.md
       - path: docs/server/jsonconfig.md
+      - path: docs/server/rest.md
       - path: docs/server/pubsub.md
       - path: docs/server/anti-brute.md
       - path: docs/server/proxy-protocol.md

src/args.rs

@@ -373,7 +373,7 @@ pub(crate) fn clap_app(tmp_dir: &str) -> clap::Command {
             Arg::new(AUTH_REST_URL)
                 .long("auth-rest-url")
                 .value_name("URL")
-                .help("Define REST endpoint. {USER} and {PASS} are replaced by provided credentials.")
+                .help("Define REST endpoint. {USER}, {PASS} and/or {IP} are replaced by provided credentials and source IP respectively.")
                 .env("UNFTP_AUTH_REST_URL")
                 .takes_value(true),
         )
@@ -389,9 +389,9 @@ pub(crate) fn clap_app(tmp_dir: &str) -> clap::Command {
         .arg(
             Arg::new(AUTH_REST_BODY)
                 .long("auth-rest-body")
-                .value_name("URL")
-                .help("If HTTP method contains body, it can be specified here. {USER} and {PASS} \
-                are replaced by provided credentials.")
+                .value_name("TEMPLATE")
+                .help("If HTTP method contains body, it can be specified here. {USER}, {PASS} and/or {IP}\
+                are replaced by provided credentials and source IP respectively.")
                 .env("UNFTP_AUTH_REST_BODY")
                 .takes_value(true),
         )

src/infra/pubsub.rs

@@ -16,7 +16,7 @@ use std::sync::Arc;
 //  - API Docs for publishing: https://cloud.google.com/pubsub/docs/reference/rest/v1/projects.topics/publish
 //
 
-/// An [EventDispatcher](crate::domain::EventDispatcher) that dispatches to Google Pub/sub
+/// An [EventDispatcher] that dispatches to Google Pub/sub
 #[derive(Debug)]
 pub struct PubsubEventDispatcher {
     log: Arc<slog::Logger>,

src/main.rs

@@ -136,7 +136,6 @@ fn make_pam_auth(m: &clap::ArgMatches) -> Result<LookupAuthenticator, String> {
     }
 }
 
-// FIXME: add user support
 fn make_rest_auth(m: &clap::ArgMatches) -> Result<LookupAuthenticator, String> {
     #[cfg(not(feature = "rest_auth"))]
     {
@@ -161,23 +160,33 @@ fn make_rest_auth(m: &clap::ArgMatches) -> Result<LookupAuthenticator, String> {
                     );
                 }
 
-                let authenticator: unftp_auth_rest::RestAuthenticator =
-                    match unftp_auth_rest::Builder::new()
-                        .with_username_placeholder("{USER}".to_string())
-                        .with_password_placeholder("{PASS}".to_string())
-                        .with_url(String::from(url))
-                        .with_method(
-                            hyper::Method::from_str(method)
-                                .map_err(|e| format!("error creating REST auth: {}", e))?,
-                        )
-                        .with_body(String::from(m.value_of(args::AUTH_REST_BODY).unwrap_or("")))
-                        .with_selector(String::from(selector))
-                        .with_regex(String::from(regex))
-                        .build()
-                    {
-                        Ok(res) => res,
-                        Err(e) => return Err(format!("Unable to create RestAuthenticator: {}", e)),
-                    };
+                let body = String::from(m.value_of(args::AUTH_REST_BODY).unwrap_or(""));
+                let mut builder = unftp_auth_rest::Builder::new()
+                    .with_url(String::from(url))
+                    .with_method(
+                        hyper::Method::from_str(method)
+                            .map_err(|e| format!("error creating REST auth: {}", e))?,
+                    )
+                    .with_body(String::from(m.value_of(args::AUTH_REST_BODY).unwrap_or("")))
+                    .with_selector(String::from(selector))
+                    .with_regex(String::from(regex));
+
+                if url.contains("{USER}") || body.contains("{USER}") {
+                    builder = builder.with_username_placeholder("{USER}".to_string());
+                }
+
+                if url.contains("{PASS}") || body.contains("{PASS}") {
+                    builder = builder.with_password_placeholder("{PASS}".to_string());
+                }
+
+                if url.contains("{IP}") || body.contains("{IP}") {
+                    builder = builder.with_source_ip_placeholder("{IP}".to_string());
+                }
+
+                let authenticator: unftp_auth_rest::RestAuthenticator = match builder.build() {
+                    Ok(res) => res,
+                    Err(e) => return Err(format!("Unable to create RestAuthenticator: {}", e)),
+                };
 
                 Ok(LookupAuthenticator::new(authenticator))
             }