Introduce NUT "authconf" file support [#3329, #3411]#3435
Conversation
jimklimov
added
enhancement
SSL/NSS
|
A ZIP file with standard source tarball and another tarball with pre-built docs for commit 9688c11 is temporarily available: NUT-tarballs-PR-3435.zip. |
|
✅ Build nut 2.8.5.4693-master completed (commit 049a4d4c36 by @jimklimov)
|
|
✅ Build nut 2.8.5.4693-master completed (commit 049a4d4c36 by @jimklimov) |
|
✅ Build nut 2.8.5.4694-master completed (commit c8f40b4384 by @jimklimov)
|
|
✅ Build nut 2.8.5.4696-master completed (commit 25660e3752 by @jimklimov)
|
|
✅ Build nut 2.8.5.4696-master completed (commit 25660e3752 by @jimklimov) |
|
✅ Build nut 2.8.5.4697-master completed (commit 9be8443368 by @jimklimov)
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
❌ Build nut 2.8.5.4698-master failed (commit be4347c9c5 by @jimklimov) |
jimklimov
force-pushed
the
issue-3329
branch
2 times, most recently
from
73a7249 to
ed6f549
Compare
|
✅ Build nut 2.8.5.4700-master completed (commit 8a8a16fc63 by @jimklimov)
|
|
✅ Build nut 2.8.5.4700-master completed (commit 8a8a16fc63 by @jimklimov) |
|
✅ Build nut 2.8.5.4701-master completed (commit 40e1ff94b4 by @jimklimov)
|
|
❌ Build nut 2.8.5.4702-master failed (commit 34ad7de24e by @jimklimov) |
…_NUT_CAPATH (nss vs openssl backend) [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…_NUT_CERTHOST_NAME [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
|
❌ Build nut 2.8.5.4902-master failed (commit c46fbb7cf6 by @jimklimov) |
…nt.pl, tests/cpputest-client.cpp: only set "NUT_SSL=True" from AuthConf NUT_FORCESSL if no value is passed as envvar [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…en if skipping other settings due to nutauth.conf [networkupstools#3329, networkupstools#1711] May neuter later in the method (e.g. perl lacking SSL module). Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…nt.py.in: avoid Python 3 formatting strings [networkupstools#3229, networkupstools#1711] There is no reason for module to not work for older OS installations. Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
… names after creation (fix IPv6 address handling) [networkupstools#3229, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…ly [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
… nutauth-openssl-perl-win.conf [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…tworkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
… a list, not vector [networkupstools#3329] Memory-safer to extend and manipulate. Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
|
✅ Build nut 2.8.5.4904-master completed (commit 81462e43ab by @jimklimov)
|
|
✅ Build nut 2.8.5.4904-master completed (commit 81462e43ab by @jimklimov) |
…TVERIFY also in nutauth.conf [networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov@gmail.com>
|
✅ Build nut 2.8.5.4905-master completed (commit b2bda9adb4 by @jimklimov)
|
…kupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
|
❌ Build nut 2.8.5.4906-master failed (commit e397a14e21 by @jimklimov) |
|
✅ Build nut 2.8.5.4907-master completed (commit e397a14e21 by @jimklimov)
|
|
✅ Build nut 2.8.5.4907-master completed (commit e397a14e21 by @jimklimov) |
…ackends [networkupstools#3331] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
|
✅ Build nut 2.8.5.4915-master completed (commit c6c0f87401 by @jimklimov)
|
3 participants
Starting with a PoC from AI, slightly modified (20%?) in review, following the spec requested in the GitHub issue #3329, as a stepping stone for further work. Also address parts of issue #3411.
Closes: #3503
Let CI loose on this iteration that passes locally...
TODO:
upscli_authconf_t=> added CERTHOST to the originally posted mixupscli_initvariant?) to useupscli_authconf_tstruct instances directly. Refactor older methods as wrappers to this one?upscli_get_authconf_list()toupscli_add_host_cert()and set up the one most applicable set of client identity data for that[user@host:port]combo => to be considered in NUT authconf: detect best client identity data for a connection #3493upsd.usersetc.)conf/...sample anddocs/man/...page fornutauth.confconceptUPDATE: During work on this, it was found that NSS
CERTHOSTsupport was actually broken, and only worked for certificates whose nicknames matched the host name, not the "My nut server" nickname as the example claimed for years. Fixed now.UPDATE: During work on this, it was found that it may be troublesome for a single client to connect to multiple NUT data servers which would require different CA trust stores and/or client self-identification by certificates. To be investigated under #3494, not in scope here.