From: Daniel F. Dickinson Date: Sun, 5 Jul 2026 11:42:46 +0000 (-0400) Subject: nut: enable configuring more SSL-related options X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=79db1ee5737efc35c7aec2ab27dde761bb3c03cc;p=openwrt-packages.git nut: enable configuring more SSL-related options Expose the configuration knobs as UCI config for more SSL options. Signed-off-by: Daniel F. Dickinson --- diff --git a/net/nut/Makefile b/net/nut/Makefile index 6cbf2f316..dfa31198e 100644 --- a/net/nut/Makefile +++ b/net/nut/Makefile @@ -123,10 +123,15 @@ define Package/nut-common/install $(INSTALL_DIR) $(1)/etc/nut $(INSTALL_DIR) $(1)/usr/lib $(INSTALL_DIR) $(1)/lib/functions/nut + $(INSTALL_DIR) $(1)/usr/share/nut $(INSTALL_DATA) ./files/nut-common.sh.functions $(1)/lib/functions/nut/nut-common.sh $(INSTALL_DATA) ./files/nut-service.sh.functions $(1)/lib/functions/nut/nut-service.sh $(CP) $(PKG_INSTALL_DIR)/usr/lib/libupsclient.so* $(1)/usr/lib/ ln -sf /var/etc/nut/nut.conf $(1)/etc/nut/nut.conf + $(if $(CONFIG_NUT_SSL),printf "%s" "openssl" >$(PKG_BUILD_DIR)/ssl_backend) + $(if $(CONFIG_NUT_SSL_NSS),printf "%s" "nss" >$(PKG_BUILD_DIR)/ssl_backend) + $(if $(CONFIG_NUT_SSL)$(CONFIG_NUT_SSL_NSS),,printf "%s" "none" >$(PKG_BUILD_DIR)/ssl_backend) + $(INSTALL_DATA) $(PKG_BUILD_DIR)/ssl_backend $(1)/usr/share/nut/ssl_backend endef define Package/nut-server diff --git a/net/nut/files/nut-monitor-config.sh.functions b/net/nut/files/nut-monitor-config.sh.functions index 35f305b21..1b80e36f4 100644 --- a/net/nut/files/nut-monitor-config.sh.functions +++ b/net/nut/files/nut-monitor-config.sh.functions @@ -112,10 +112,17 @@ upsmon_conf_get_write() { nut_upsmon_conf() { local config_file="$1" local cfg="upsmon" - local val defaultnotify nut_option uci_option conf_ret + local val defaultnotify nut_option uci_option conf_ret ssl_backend local event_notify_flags_not_found upsmon_bool_options nut_bool upsmon_bool_options=" $NUT_UPSMON_BOOL_OPTIONS " + ssl_backend="$(cat /usr/share/nut/ssl_backend)" + + [ -n "$ssl_backend" ] || { + log_error_exit "Missing ssl_backend indicator. Bailing rather than running without SSL." "nut-monitor-config.sh" "nut-monitor-config" + return 1 + } + # Note that we use '-u $RUNAS' on the daemon command line in preference to # the RUN_AS_USER configuration in "$config_file" @@ -197,6 +204,44 @@ nut_upsmon_conf() { return 1 fi ;; + CERTPATH | CERTIDENT | CERTHOST) + # if not compiled with SSL (OpenSSL or NSS), then do not attempt to use + # SSL configuration + if [ "$ssl_backend" != "openssl" ] && [ "$ssl_backend" != "nss" ]; then + continue + fi + # If no certpath or certfile is specified, then SSL will not be used, even if + # other SSL config exists + upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "false" + conf_ret=$? + if [ "$conf_ret" -eq 1 ]; then + return 1 + fi + ;; + CERTVERIFY | FORCESSL) + # if not compiled with SSL (OpenSSL or NSS), then do not attempt to use + # SSL configuration + if [ "$ssl_backend" != "openssl" ] && [ "$ssl_backend" != "nss" ]; then + continue + fi + upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "true" + conf_ret=$? + if [ "$conf_ret" -eq 1 ]; then + return 1 + fi + ;; + CERTFILE) + # if not compiled with OpenSSL, then do not attempt to use CERTFILE (it is + # OpenSSL specific) + if [ "$ssl_backend" != "openssl" ]; then + continue + fi + upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "false" + conf_ret=$? + if [ "$conf_ret" -eq 1 ]; then + return 1 + fi + ;; *) if [ "${upsmon_bool_options/$nut_option/}" != "${upsmon_bool_options}" ]; then nut_bool="true" diff --git a/net/nut/files/nut-server-config.sh.functions b/net/nut/files/nut-server-config.sh.functions index 6bd38ceae..57978dd00 100644 --- a/net/nut/files/nut-server-config.sh.functions +++ b/net/nut/files/nut-server-config.sh.functions @@ -67,7 +67,8 @@ listen_address() { srv_config() { local srv="$1" local config_file="$2" - local maxage maxconn certfile + local ssl_backend + local maxage maxconn val certfile config_get maxage "$srv" maxage [ -n "$maxage" ] && printf "MAXAGE %s\n" "$maxage" >>"$config_file" @@ -77,9 +78,39 @@ srv_config() { config_get maxconn "$srv" maxconn [ -n "$maxconn" ] && printf "MAXCONN %s\n" "$maxconn" >>"$config_file" - # NOTE: certs only apply to SSL-enabled version + ssl_backend="$(cat /usr/share/nut/ssl_backend)" + + [ -n "$ssl_backend" ] || { + log_error_exit "Missing ssl_backend indicator. Bailing rather than running without SSL." "nut-server-config.sh" "nut-server-config" + return 1 + } + + # NOTE: certfile only applies to OpenSSL-enabled version config_get certfile "$srv" certfile - [ -n "$certfile" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file" + [ -n "$certfile" ] && [ "$ssl_backend" = "openssl" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file" + + # if not compiled with SSL (OpenSSL or NSS), then do not attempt to use + # SSL configuration + if [ "$ssl_backend" = "openssl" ] || [ "$ssl_backend" = "nss" ]; then + # If no certpath or certfile is specified, then SSL will not be used, even if + # other SSL config exists + config_get val "$srv" certpath + [ -n "$val" ] && printf "CERTPATH %s\n" "$val" >>"$config_file" + + config_get val "$srv" certident + [ -n "$val" ] && printf "CERTIDENT %s\n" "$val" >>"$config_file" + + config_get val "$srv" certrequest + [ -n "$val" ] && printf "CERTREQUEST %s\n" "$val" >>"$config_file" + + config_get_bool val "$srv" disable_weak_ssl 0 + printf "DISABLE_WEAK_SSL %s\n" "$val" >>"$config_file" + fi + + config_get val "$srv" debug_min + [ -n "$val" ] && printf "DEBUG_MIN %s\n" "$val" >>"$config_file" + + return 0 } nut_user_instcmd() { @@ -141,7 +172,7 @@ build_server_config() { config_foreach nut_user_add user "$USERS_C.new" config_foreach listen_address listen_address "$UPSD_C.new" if have_section_named "upsd" "upsd"; then - srv_config upsd "$UPSD_C.new" + srv_config upsd "$UPSD_C.new" || return 1 else # If config 'nut_server' does not have a 'upsd' section, use a default # configuration diff --git a/net/nut/files/nut_monitor b/net/nut/files/nut_monitor index c27f709e1..4125e8830 100644 --- a/net/nut/files/nut_monitor +++ b/net/nut/files/nut_monitor @@ -28,7 +28,16 @@ # option rbwarntime 43200 # replace battery warn time # option alarmcritical 1 # option shutdownexit 0 -# option certpath /path/to/ca/dir +# NB: certificates only apply to SSL-enabled version +# See https://github.com/networkupstools/nut/blob/master/docs/security.txt +# openssl client certificate chain and private key +# option certfile /usr/local/etc/upsmon.pem +# NSS or OpenSSL +# For NSS path the directory with certificate and key databases +# For OpenSSL path a file with one or more CA certificates +# option certpath /etc/nut/cert_db +# Client certificate name and password to unlock the key for the certificate +# option certident '"certificate name" "database password"' # option certverify 0 # option forcessl 0 # option debugmin 0 diff --git a/net/nut/files/nut_server b/net/nut/files/nut_server index b45062b61..df711ec64 100644 --- a/net/nut/files/nut_server +++ b/net/nut/files/nut_server @@ -37,6 +37,18 @@ # option maxconn 1024 # option runas nut # option interface_reload_delay 3000 # in milliseconds +# option triggerlist all # not configured by default +# option debug_min 0 # NB: certificates only apply to SSL-enabled version +# See https://github.com/networkupstools/nut/blob/master/docs/security.txt +# openssl server certificate chain and private key # option certfile /usr/local/etc/upsd.pem -# option triggerlist all # not configured by default +# NSS or OpenSSL +# For NSS path the directory with certificate and key databases +# For OpenSSL path a file with one or more CA certificates +# option certpath /etc/nut/cert_db +# Server certificate name and password to unlock the key for the certificate +# option certident '"certificate name" "database password"' +# 0 - NO, 1 - REQUEST, 2 - REQUIRE (and verify) +# option certrequest 0 +# option disable_weak_ssl 0