nut: enable SSL via NSS by default

Enable libnss (Mozilla NSS) for SSL, and make it the default.

Signed-off-by: Daniel F. Dickinson <redacted>

diff --git a/net/nut/Config.in b/net/nut/Config.in
index 28d40329b25ede9b52c2271917058492ed4603de..884319c7187c0f7c3885d9afb7b8f66743098572 100644 (file)
--- a/net/nut/Config.in
+++ b/net/nut/Config.in
@@ -1,22 +1,32 @@
        config NUT_SSL
-               depends on PACKAGE_nut
+               depends on PACKAGE_nut && !NUT_SSL_NSS
                bool "Build with support for OpenSSL"
                help
                        SSL allows sessions between upsd and clients to be encrypted and can
                        also be used to authenticate servers. This means that stealing port
                        3493 from upsd will no longer net you interesting passwords. SSL is
-                       available via OpenSSL on OpenWRT (NSS doesn't seem to work). If you
-                       are happy with using passwords to authenticate clients, you can save
-                       some space and build NUT without SSL support.
+                       available via OpenSSL on OpenWrt. If you are happy with using passwords
+                       to authenticate clients, you can save some space and build NUT without
+                       SSL support. Defaults to n due to licensing (NUT is GPL with no OpenSSL
+                       exception).
                default n
-       
+
+       config NUT_SSL_NSS
+               depends on PACKAGE_nut
+               bool "Build with support for NSS for SSL"
+               help
+                       SSL allows sessions between upsd and clients to be encrypted and can
+                       also be used to authenticate servers. This means that stealing port
+                       3493 from upsd will no longer net you interesting passwords.
+               default y
+
        config NUT_DRIVER_USB
                depends on PACKAGE_nut
                bool "Build with support for USB drivers"
                help
                        If you have a UPS connected via USB, select this.
                default y
-       
+
        config NUT_DRIVER_SNMP
                depends on PACKAGE_nut
                bool "Build with support for SNMP drivers"
@@ -31,9 +41,9 @@
                        If you have a UPS connected via serial cable, select this.
                default y
 
-        config NUT_DRIVER_NEON
-                depends on PACKAGE_nut
-                bool "Build with support for netxml drivers"
-                help
-                        If you have a UPS connected via netxml, select this.
-                default y
+       config NUT_DRIVER_NEON
+               depends on PACKAGE_nut
+               bool "Build with support for netxml drivers"
+               help
+                       If you have a UPS connected via netxml, select this.
+               default y

diff --git a/net/nut/Makefile b/net/nut/Makefile
index aeb758451b0ec290ae34749fe0e2240524cc356c..1970bf434be1188709afd45e0f78239fc08198b8 100644 (file)
--- a/net/nut/Makefile
+++ b/net/nut/Makefile
@@ -27,6 +27,7 @@ PKG_CONFIG_DEPENDS:= \
        CONFIG_NUT_DRIVER_USB \
        CONFIG_NUT_DRIVER_SERIAL \
        CONFIG_NUT_DRIVER_NEON \
+       CONFIG_NUT_SSL_NSS \
        CONFIG_NUT_SSL \
        CONFIG_PACKAGE_nut-web-cgi
 
@@ -105,7 +106,8 @@ define Package/nut-common
                +NUT_DRIVER_SNMP:libnetsnmp \
                +NUT_DRIVER_USB:libusb-compat \
                +NUT_DRIVER_NEON:libneon \
-               +NUT_SSL:libopenssl
+               +NUT_SSL:libopenssl \
+               +NUT_SSL_NSS:libnss
 endef
 
 define Package/nut-common/description
@@ -152,9 +154,9 @@ endef
 
 define Package/nut-upsmon
   $(call Package/nut/Default)
-       TITLE+= (monitor)
-       DEPENDS:=nut +nut-common
-       USERID:=nutmon=114:nutmon=114
+  TITLE+= (monitor)
+  DEPENDS:=nut +nut-common
+  USERID:=nutmon=114:nutmon=114
 endef
 
 define Package/nut-upsmon/description
@@ -571,11 +573,16 @@ $(eval $(call DriverDescription,usb,nutdrv_atcl_usb,\
 $(eval $(call DriverDescription,usb,nutdrv_qx,\
        Driver for Q* protocol serial and USB based UPS equipment))
 $(eval $(call DriverDescription,neon,netxml-ups,\
-        Driver for NetXML based UPS equipment))
+       Driver for NetXML based UPS equipment))
 
 CONFIGURE_VARS += \
        ac_cv_path_AR=$(TARGET_AR)
 
+# as flagged by Qwen 3.6 27B, --without-ssl also disables NSS so only use it
+# to disable all SSL backends. This can be verified in the applicable
+# upstream code which disables _all_ ssl when --with-ssl=no or the equivalent
+# --without-ssl is used. See:
+# https://github.com/networkupstools/nut/blob/26177060be94a738bf2d612441af264c90ac37a9/configure.ac#L2930
 CONFIGURE_ARGS += \
        --sysconfdir=/etc \
        --with-confdir-suffix=/nut \
@@ -586,7 +593,7 @@ CONFIGURE_ARGS += \
        --$(if $(CONFIG_NUT_DRIVER_SNMP),with,without)-snmp \
        --$(if $(CONFIG_NUT_DRIVER_SERIAL),with,without)-serial \
        --without-doc \
-        --$(if $(CONFIG_NUT_DRIVER_NEON),with,without)-neon \
+       --$(if $(CONFIG_NUT_DRIVER_NEON),with,without)-neon \
        --without-powerman \
        --without-wrap \
        --with-hotplug-dir=/etc/hotplug \
@@ -594,7 +601,9 @@ CONFIGURE_ARGS += \
        --without-ipmi \
        --without-freeipmi \
        --without-linux-i2c \
-       --$(if $(CONFIG_NUT_SSL),with,without)-ssl $(if $(CONFIG_NUT_SSL),--with-openssl) \
+       $(if $(CONFIG_NUT_SSL),--with-ssl=openssl) \
+       $(if $(CONFIG_NUT_SSL_NSS),--with-ssl=nss,--without-nss) \
+       $(if $(CONFIG_NUT_SSL),,$(if $(CONFIG_NUT_SSL_NSS),,--without-ssl)) \
        --without-libltdl \
        --enable-docs-changelog=no \
        --without-macosx_ups \

diff --git a/net/nut/files/nut-server-config.sh.functions b/net/nut/files/nut-server-config.sh.functions
index f688e2e2fafbbc4adda8541d81ac73af9a8ba0e6..6bd38ceaee1ad94a323aadeda7dcef20a45c3b97 100644 (file)
--- a/net/nut/files/nut-server-config.sh.functions
+++ b/net/nut/files/nut-server-config.sh.functions
@@ -77,7 +77,7 @@ srv_config() {
        config_get maxconn "$srv" maxconn
        [ -n "$maxconn" ] && printf "MAXCONN %s\n" "$maxconn" >>"$config_file"
 
-       #NOTE: certs only apply to SSL-enabled version
+       # NOTE: certs only apply to SSL-enabled version
        config_get certfile "$srv" certfile
        [ -n "$certfile" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file"
 }