Introduce NUT "authconf" file support [#3329, #3411]#3435
Conversation
jimklimov
added
enhancement
SSL/NSS
|
A ZIP file with standard source tarball and another tarball with pre-built docs for commit 33afb88 is temporarily available: NUT-tarballs-PR-3435.zip. |
|
✅ Build nut 2.8.5.4693-master completed (commit 049a4d4c36 by @jimklimov)
|
|
✅ Build nut 2.8.5.4693-master completed (commit 049a4d4c36 by @jimklimov) |
|
✅ Build nut 2.8.5.4694-master completed (commit c8f40b4384 by @jimklimov)
|
|
✅ Build nut 2.8.5.4696-master completed (commit 25660e3752 by @jimklimov)
|
|
✅ Build nut 2.8.5.4696-master completed (commit 25660e3752 by @jimklimov) |
|
✅ Build nut 2.8.5.4697-master completed (commit 9be8443368 by @jimklimov)
|
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
❌ Build nut 2.8.5.4698-master failed (commit be4347c9c5 by @jimklimov) |
jimklimov
force-pushed
the
issue-3329
branch
2 times, most recently
from
73a7249 to
ed6f549
Compare
|
✅ Build nut 2.8.5.4700-master completed (commit 8a8a16fc63 by @jimklimov)
|
|
✅ Build nut 2.8.5.4700-master completed (commit 8a8a16fc63 by @jimklimov) |
|
✅ Build nut 2.8.5.4701-master completed (commit 40e1ff94b4 by @jimklimov)
|
|
❌ Build nut 2.8.5.4702-master failed (commit 34ad7de24e by @jimklimov) |
|
❌ Build nut 2.8.5.4839-master failed (commit 7e0076e743 by @jimklimov) |
jimklimov
changed the title
Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
… SO_MAJOR_LIB* version hassle Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…_scan_ip_range_nut_authconf() and nutscan_scan_nut_authconf() with nutscan_nut_authconf_t argument [networkupstools#3329] Make old methods wrappers of the new ones, so existing libnutscan clients continue working as they were (no breaking ABI change, just new methods). Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…present in libupsclient build we try to use [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…etect desired timeout like other NUT clients do [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…etect and load NUT auth conf file like other clients do [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…t_timeout [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…ed list manipulation, and methods to remove items from list [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…scanning "old nut" servers [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…if positive [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…onf_update_conn_flags() [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…thout SSL [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…t-ness of freed strings [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
…for SSL-capable builds [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>
|
At this point the PR should be roughly feature-complete for the C library and in-tree clients, including Testing would be most welcome, there are probably edge cases (especially for clients that handle numerous connections, even if they do not try to put on different hats for different servers per #3494) not yet encountered. Other language bindings to follow in a separate PR, probably - still cooking. |
|
❌ Build nut 2.8.5.4860-master failed (commit c8a394b442 by @jimklimov) |
|
❌ Build nut 2.8.5.4864-master failed (commit 7b4951cfbd by @jimklimov) |
3 participants
Starting with a PoC from AI, slightly modified (20%?) in review, following the spec requested in the GitHub issue #3329, as a stepping stone for further work. Also address parts of issue #3411.
Let CI loose on this iteration that passes locally...
TODO:
upscli_authconf_t=> added CERTHOST to the originally posted mixupscli_initvariant?) to useupscli_authconf_tstruct instances directly. Refactor older methods as wrappers to this one?upscli_get_authconf_list()toupscli_add_host_cert()and set up the one most applicable set of client identity data for that[user@host:port]combo => to be considered in NUT authconf: detect best client identity data for a connection #3493upsd.usersetc.)conf/...sample anddocs/man/...page fornutauth.confconceptUPDATE: During work on this, it was found that NSS
CERTHOSTsupport was actually broken, and only worked for certificates whose nicknames matched the host name, not the "My nut server" nickname as the example claimed for years. Fixed now.UPDATE: During work on this, it was found that it may be troublesome for a single client to connect to multiple NUT data servers which would require different CA trust stores and/or client self-identification by certificates. To be investigated under #3494, not in scope here.