nut: enable configuring more SSL-related options

Expose the configuration knobs as UCI config for more SSL options.

Signed-off-by: Daniel F. Dickinson <redacted>

diff --git a/net/nut/Makefile b/net/nut/Makefile
index 6cbf2f316da24b1a52e2b2edc6c5b4cbe382f024..dfa31198e008036b336fec66861bd5c84ccb2051 100644 (file)
--- a/net/nut/Makefile
+++ b/net/nut/Makefile
@@ -123,10 +123,15 @@ define Package/nut-common/install
        $(INSTALL_DIR) $(1)/etc/nut
        $(INSTALL_DIR) $(1)/usr/lib
        $(INSTALL_DIR) $(1)/lib/functions/nut
+       $(INSTALL_DIR) $(1)/usr/share/nut
        $(INSTALL_DATA) ./files/nut-common.sh.functions $(1)/lib/functions/nut/nut-common.sh
        $(INSTALL_DATA) ./files/nut-service.sh.functions $(1)/lib/functions/nut/nut-service.sh
        $(CP) $(PKG_INSTALL_DIR)/usr/lib/libupsclient.so* $(1)/usr/lib/
        ln -sf /var/etc/nut/nut.conf $(1)/etc/nut/nut.conf
+       $(if $(CONFIG_NUT_SSL),printf "%s" "openssl" >$(PKG_BUILD_DIR)/ssl_backend)
+       $(if $(CONFIG_NUT_SSL_NSS),printf "%s" "nss" >$(PKG_BUILD_DIR)/ssl_backend)
+       $(if $(CONFIG_NUT_SSL)$(CONFIG_NUT_SSL_NSS),,printf "%s" "none" >$(PKG_BUILD_DIR)/ssl_backend)
+       $(INSTALL_DATA) $(PKG_BUILD_DIR)/ssl_backend $(1)/usr/share/nut/ssl_backend
 endef
 
 define Package/nut-server

diff --git a/net/nut/files/nut-monitor-config.sh.functions b/net/nut/files/nut-monitor-config.sh.functions
index 35f305b21a6af64c411c1ac3315a6afc5a2bcf4e..1b80e36f414716d784eb0af2a1e84fd41da1f6f0 100644 (file)
--- a/net/nut/files/nut-monitor-config.sh.functions
+++ b/net/nut/files/nut-monitor-config.sh.functions
@@ -112,10 +112,17 @@ upsmon_conf_get_write() {
 nut_upsmon_conf() {
        local config_file="$1"
        local cfg="upsmon"
-       local val defaultnotify nut_option uci_option conf_ret
+       local val defaultnotify nut_option uci_option conf_ret ssl_backend
        local event_notify_flags_not_found upsmon_bool_options nut_bool
        upsmon_bool_options=" $NUT_UPSMON_BOOL_OPTIONS "
 
+       ssl_backend="$(cat /usr/share/nut/ssl_backend)"
+
+       [ -n "$ssl_backend" ] || {
+               log_error_exit "Missing ssl_backend indicator. Bailing rather than running without SSL." "nut-monitor-config.sh" "nut-monitor-config"
+               return 1
+       }
+
        # Note that we use '-u $RUNAS' on the daemon command line in preference to
        # the RUN_AS_USER configuration in "$config_file"
 
@@ -197,6 +204,44 @@ nut_upsmon_conf() {
                                return 1
                        fi
                        ;;
+               CERTPATH | CERTIDENT | CERTHOST)
+                       # if not compiled with SSL (OpenSSL or NSS), then do not attempt to use
+                       # SSL configuration
+                       if [ "$ssl_backend" != "openssl" ] && [ "$ssl_backend" != "nss" ]; then
+                               continue
+                       fi
+                       # If no certpath or certfile is specified, then SSL will not be used, even if
+                       # other SSL config exists
+                       upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "false"
+                       conf_ret=$?
+                       if [ "$conf_ret" -eq 1 ]; then
+                               return 1
+                       fi
+                       ;;
+               CERTVERIFY | FORCESSL)
+                       # if not compiled with SSL (OpenSSL or NSS), then do not attempt to use
+                       # SSL configuration
+                       if [ "$ssl_backend" != "openssl" ] && [ "$ssl_backend" != "nss" ]; then
+                               continue
+                       fi
+                       upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "true"
+                       conf_ret=$?
+                       if [ "$conf_ret" -eq 1 ]; then
+                               return 1
+                       fi
+                       ;;
+               CERTFILE)
+                       # if not compiled with OpenSSL, then do not attempt to use CERTFILE (it is
+                       # OpenSSL specific)
+                       if [ "$ssl_backend" != "openssl" ]; then
+                               continue
+                       fi
+                       upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "false"
+                       conf_ret=$?
+                       if [ "$conf_ret" -eq 1 ]; then
+                               return 1
+                       fi
+                       ;;
                *)
                        if [ "${upsmon_bool_options/$nut_option/}" != "${upsmon_bool_options}" ]; then
                                nut_bool="true"

diff --git a/net/nut/files/nut-server-config.sh.functions b/net/nut/files/nut-server-config.sh.functions
index 6bd38ceaee1ad94a323aadeda7dcef20a45c3b97..57978dd0061e7217f6516f45590395ea54bde7f6 100644 (file)
--- a/net/nut/files/nut-server-config.sh.functions
+++ b/net/nut/files/nut-server-config.sh.functions
@@ -67,7 +67,8 @@ listen_address() {
 srv_config() {
        local srv="$1"
        local config_file="$2"
-       local maxage maxconn certfile
+       local ssl_backend
+       local maxage maxconn val certfile
 
        config_get maxage "$srv" maxage
        [ -n "$maxage" ] && printf "MAXAGE %s\n" "$maxage" >>"$config_file"
@@ -77,9 +78,39 @@ srv_config() {
        config_get maxconn "$srv" maxconn
        [ -n "$maxconn" ] && printf "MAXCONN %s\n" "$maxconn" >>"$config_file"
 
-       # NOTE: certs only apply to SSL-enabled version
+       ssl_backend="$(cat /usr/share/nut/ssl_backend)"
+
+       [ -n "$ssl_backend" ] || {
+               log_error_exit "Missing ssl_backend indicator. Bailing rather than running without SSL." "nut-server-config.sh" "nut-server-config"
+               return 1
+       }
+
+       # NOTE: certfile only applies to OpenSSL-enabled version
        config_get certfile "$srv" certfile
-       [ -n "$certfile" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file"
+       [ -n "$certfile" ] && [ "$ssl_backend" = "openssl" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file"
+
+       # if not compiled with SSL (OpenSSL or NSS), then do not attempt to use
+       # SSL configuration
+       if [ "$ssl_backend" = "openssl" ] || [ "$ssl_backend" = "nss" ]; then
+               # If no certpath or certfile is specified, then SSL will not be used, even if
+               # other SSL config exists
+               config_get val "$srv" certpath
+               [ -n "$val" ] && printf "CERTPATH %s\n" "$val" >>"$config_file"
+
+               config_get val "$srv" certident
+               [ -n "$val" ] && printf "CERTIDENT %s\n" "$val" >>"$config_file"
+
+               config_get val "$srv" certrequest
+               [ -n "$val" ] && printf "CERTREQUEST %s\n" "$val" >>"$config_file"
+
+               config_get_bool val "$srv" disable_weak_ssl 0
+               printf "DISABLE_WEAK_SSL %s\n" "$val" >>"$config_file"
+       fi
+
+       config_get val "$srv" debug_min
+       [ -n "$val" ] && printf "DEBUG_MIN %s\n" "$val" >>"$config_file"
+
+       return 0
 }
 
 nut_user_instcmd() {
@@ -141,7 +172,7 @@ build_server_config() {
        config_foreach nut_user_add user "$USERS_C.new"
        config_foreach listen_address listen_address "$UPSD_C.new"
        if have_section_named "upsd" "upsd"; then
-               srv_config upsd "$UPSD_C.new"
+               srv_config upsd "$UPSD_C.new" || return 1
        else
                # If config 'nut_server' does not have a 'upsd' section, use a default
                # configuration

diff --git a/net/nut/files/nut_monitor b/net/nut/files/nut_monitor
index c27f709e17659b4ffa1fb46015bc338a1a22a599..4125e8830eebdf1f865811e6a148938a6b5b08fc 100644 (file)
--- a/net/nut/files/nut_monitor
+++ b/net/nut/files/nut_monitor
@@ -28,7 +28,16 @@
 #      option rbwarntime 43200 # replace battery warn time
 #      option alarmcritical 1
 #      option shutdownexit 0
-#      option certpath /path/to/ca/dir
+# NB: certificates only apply to SSL-enabled version
+# See https://github.com/networkupstools/nut/blob/master/docs/security.txt
+# openssl client certificate chain and private key
+#      option certfile /usr/local/etc/upsmon.pem
+# NSS or OpenSSL
+# For NSS path the directory with certificate and key databases
+# For OpenSSL path a file with one or more CA certificates
+#      option certpath /etc/nut/cert_db
+# Client certificate name and password to unlock the key for the certificate
+#      option certident '"certificate name" "database password"'
 #      option certverify 0
 #      option forcessl 0
 #      option debugmin 0

diff --git a/net/nut/files/nut_server b/net/nut/files/nut_server
index b45062b61abe75ea38ea471d0311626b145817a6..df711ec64f50fbd351d877cc5ccaa61ccb8c64e9 100644 (file)
--- a/net/nut/files/nut_server
+++ b/net/nut/files/nut_server
@@ -37,6 +37,18 @@
 #      option maxconn 1024
 #      option runas nut
 #      option interface_reload_delay 3000 # in milliseconds
+#      option triggerlist all # not configured by default
+#      option debug_min 0
 # NB: certificates only apply to SSL-enabled version
+# See https://github.com/networkupstools/nut/blob/master/docs/security.txt
+# openssl server certificate chain and private key
 #      option certfile /usr/local/etc/upsd.pem
-#      option triggerlist all # not configured by default
+# NSS or OpenSSL
+# For NSS path the directory with certificate and key databases
+# For OpenSSL path a file with one or more CA certificates
+#      option certpath /etc/nut/cert_db
+# Server certificate name and password to unlock the key for the certificate
+#      option certident '"certificate name" "database password"'
+# 0 - NO, 1 - REQUEST, 2 - REQUIRE (and verify)
+#      option certrequest 0
+#      option disable_weak_ssl 0