From: Daniel F. Dickinson <redacted>
Date: Thu, 2 Jul 2026 04:02:18 +0000 (-0400)
Subject: nut: enable SSL via NSS by default
X-Git-Url: http://git.99rst.org/?a=commitdiff_plain;h=cdb56f2b0a14415d4043c05c55aed53643df47c8;p=openwrt-packages.git

nut: enable SSL via NSS by default

Enable libnss (Mozilla NSS) for SSL, and make it the default.

Signed-off-by: Daniel F. Dickinson <redacted>
---

diff --git a/net/nut/Config.in b/net/nut/Config.in
index 28d40329b..884319c71 100644
--- a/net/nut/Config.in
+++ b/net/nut/Config.in
@@ -1,22 +1,32 @@
 	config NUT_SSL
-		depends on PACKAGE_nut
+		depends on PACKAGE_nut && !NUT_SSL_NSS
 		bool "Build with support for OpenSSL"
 		help
 			SSL allows sessions between upsd and clients to be encrypted and can
 			also be used to authenticate servers. This means that stealing port
 			3493 from upsd will no longer net you interesting passwords. SSL is
-			available via OpenSSL on OpenWRT (NSS doesn't seem to work). If you
-			are happy with using passwords to authenticate clients, you can save
-			some space and build NUT without SSL support.
+			available via OpenSSL on OpenWrt. If you are happy with using passwords
+			to authenticate clients, you can save some space and build NUT without
+			SSL support. Defaults to n due to licensing (NUT is GPL with no OpenSSL
+			exception).
 		default n
-	
+
+	config NUT_SSL_NSS
+		depends on PACKAGE_nut
+		bool "Build with support for NSS for SSL"
+		help
+			SSL allows sessions between upsd and clients to be encrypted and can
+			also be used to authenticate servers. This means that stealing port
+			3493 from upsd will no longer net you interesting passwords.
+		default y
+
 	config NUT_DRIVER_USB
 		depends on PACKAGE_nut
 		bool "Build with support for USB drivers"
 		help
 			If you have a UPS connected via USB, select this.
 		default y
-	
+
 	config NUT_DRIVER_SNMP
 		depends on PACKAGE_nut
 		bool "Build with support for SNMP drivers"
@@ -31,9 +41,9 @@
 			If you have a UPS connected via serial cable, select this.
 		default y
 
-        config NUT_DRIVER_NEON
-                depends on PACKAGE_nut
-                bool "Build with support for netxml drivers"
-                help
-                        If you have a UPS connected via netxml, select this.
-                default y
+	config NUT_DRIVER_NEON
+		depends on PACKAGE_nut
+		bool "Build with support for netxml drivers"
+		help
+			If you have a UPS connected via netxml, select this.
+		default y
diff --git a/net/nut/Makefile b/net/nut/Makefile
index aeb758451..1970bf434 100644
--- a/net/nut/Makefile
+++ b/net/nut/Makefile
@@ -27,6 +27,7 @@ PKG_CONFIG_DEPENDS:= \
 	CONFIG_NUT_DRIVER_USB \
 	CONFIG_NUT_DRIVER_SERIAL \
 	CONFIG_NUT_DRIVER_NEON \
+	CONFIG_NUT_SSL_NSS \
 	CONFIG_NUT_SSL \
 	CONFIG_PACKAGE_nut-web-cgi
 
@@ -105,7 +106,8 @@ define Package/nut-common
 		+NUT_DRIVER_SNMP:libnetsnmp \
 		+NUT_DRIVER_USB:libusb-compat \
 		+NUT_DRIVER_NEON:libneon \
-		+NUT_SSL:libopenssl
+		+NUT_SSL:libopenssl \
+		+NUT_SSL_NSS:libnss
 endef
 
 define Package/nut-common/description
@@ -152,9 +154,9 @@ endef
 
 define Package/nut-upsmon
   $(call Package/nut/Default)
-	TITLE+= (monitor)
-	DEPENDS:=nut +nut-common
-	USERID:=nutmon=114:nutmon=114
+  TITLE+= (monitor)
+  DEPENDS:=nut +nut-common
+  USERID:=nutmon=114:nutmon=114
 endef
 
 define Package/nut-upsmon/description
@@ -571,11 +573,16 @@ $(eval $(call DriverDescription,usb,nutdrv_atcl_usb,\
 $(eval $(call DriverDescription,usb,nutdrv_qx,\
 	Driver for Q* protocol serial and USB based UPS equipment))
 $(eval $(call DriverDescription,neon,netxml-ups,\
-        Driver for NetXML based UPS equipment))
+	Driver for NetXML based UPS equipment))
 
 CONFIGURE_VARS += \
 	ac_cv_path_AR=$(TARGET_AR)
 
+# as flagged by Qwen 3.6 27B, --without-ssl also disables NSS so only use it
+# to disable all SSL backends. This can be verified in the applicable
+# upstream code which disables _all_ ssl when --with-ssl=no or the equivalent
+# --without-ssl is used. See:
+# https://github.com/networkupstools/nut/blob/26177060be94a738bf2d612441af264c90ac37a9/configure.ac#L2930
 CONFIGURE_ARGS += \
 	--sysconfdir=/etc \
 	--with-confdir-suffix=/nut \
@@ -586,7 +593,7 @@ CONFIGURE_ARGS += \
 	--$(if $(CONFIG_NUT_DRIVER_SNMP),with,without)-snmp \
 	--$(if $(CONFIG_NUT_DRIVER_SERIAL),with,without)-serial \
 	--without-doc \
-        --$(if $(CONFIG_NUT_DRIVER_NEON),with,without)-neon \
+	--$(if $(CONFIG_NUT_DRIVER_NEON),with,without)-neon \
 	--without-powerman \
 	--without-wrap \
 	--with-hotplug-dir=/etc/hotplug \
@@ -594,7 +601,9 @@ CONFIGURE_ARGS += \
 	--without-ipmi \
 	--without-freeipmi \
 	--without-linux-i2c \
-	--$(if $(CONFIG_NUT_SSL),with,without)-ssl $(if $(CONFIG_NUT_SSL),--with-openssl) \
+	$(if $(CONFIG_NUT_SSL),--with-ssl=openssl) \
+	$(if $(CONFIG_NUT_SSL_NSS),--with-ssl=nss,--without-nss) \
+	$(if $(CONFIG_NUT_SSL),,$(if $(CONFIG_NUT_SSL_NSS),,--without-ssl)) \
 	--without-libltdl \
 	--enable-docs-changelog=no \
 	--without-macosx_ups \
diff --git a/net/nut/files/nut-server-config.sh.functions b/net/nut/files/nut-server-config.sh.functions
index f688e2e2f..6bd38ceae 100644
--- a/net/nut/files/nut-server-config.sh.functions
+++ b/net/nut/files/nut-server-config.sh.functions
@@ -77,7 +77,7 @@ srv_config() {
 	config_get maxconn "$srv" maxconn
 	[ -n "$maxconn" ] && printf "MAXCONN %s\n" "$maxconn" >>"$config_file"
 
-	#NOTE: certs only apply to SSL-enabled version
+	# NOTE: certs only apply to SSL-enabled version
 	config_get certfile "$srv" certfile
 	[ -n "$certfile" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file"
 }