Merge 470594b into fe4e6fe

Author: jimklimov

UPGRADING.adoc

@@ -88,6 +88,9 @@ The new `-A filename` option defaults to trying to use a `nutauth.conf` file
   but not failing if one is not usable; any specific values can require use
   of such a file or to not even try reading one ('none' as the legacy default).
   See the updated manual pages for more details. [issues #3329, #3411]
++
+NOTE: In a future NUT release, the default `configure` script handling for the
+`--with-ssl-client-validation=auto` option may be changed from `no` to `yes`.
 
 - The `upsmon` and `upsstats.cgi` clients capable of connections to multiple
   NUT data servers, potentially in separately managed security realms, now

ci_build.sh

@@ -206,8 +206,8 @@
 # See 'docs/security.txt' or the Security chapter of NUT user manual
 # for more information on the SSL support in NUT.
 #
-# WARNING: Until https://github.com/networkupstools/nut/issues/3329 is solved,
-# not all stock NUT clients even have a way to present some certain certificate.
+# NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+# third-party NUT clients to even have a way to present some certain certificate.
 
 # =======================================================================
 # DISABLE_WEAK_SSL <Boolean>

conf/upsd.conf.sample

@@ -2915,7 +2915,7 @@ nut_ssl_lib=""
 NUT_ARG_WITH([ssl], [enable SSL support (either NSS or OpenSSL)], [auto])
 NUT_ARG_WITH([nss], [enable SSL support using Mozilla NSS], [auto])
 NUT_ARG_WITH([openssl], [enable SSL support using OpenSSL], [auto])
-NUT_ARG_WITH([ssl-client-validation], [enable SSL client certificate validation ability (currently requires NSS, beware issue #3329)], [auto])
+NUT_ARG_WITH([ssl-client-validation], [enable SSL client certificate validation ability], [auto])
 
 dnl Optionally reset/initialize the cache values shared by several backends
 dnl if the check methods below never ran for all active code paths (one or more):
@@ -3001,7 +3001,8 @@ AS_CASE([${nut_with_ssl_client_validation}],
     [yes|""], [nut_with_ssl_client_validation="yes"],
         dnl TOTHINK: reject if openssl/none build?
     [auto|*], [nut_with_ssl_client_validation="no"]
-        dnl Until #3329 is solved, auto==no
+        dnl Although #3329 is solved with NUT v2.8.5, for now keep auto==no
+        dnl TODO: Flip in a later release, e.g. v2.9.0?
 )
 NUT_REPORT_FEATURE([enable SSL client certificate validation],
 	[${nut_with_ssl_client_validation}], [],

configure.ac

@@ -803,9 +803,8 @@ Enable the `upsd` server-side ability to set up `CERTREQUEST` directive in
 `upsd.conf`, which lets the server reject clients which do not present a
 certificate.
 
-WARNING: Until link:https://github.com/networkupstools/nut/issues/3329[issue
-#3329] is solved, not all stock NUT clients may even have a way to present
-some certain certificate.
+NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+third-party NUT clients to even have a way to present some certain certificate.
 
 Read link:docs/security.txt[] for instructions on practical setup of SSL
 support.

docs/configure.txt

@@ -233,9 +233,8 @@ by default, see `docs/security.txt` in NUT sources), you can specify whether
 Up until NUT release v2.8.5 this was a no-op when built with OpenSSL.
 Now this feature is supported with both OpenSSL and NSS backends.
 +
-WARNING: Until link:https://github.com/networkupstools/nut/issues/3329[issue
-#3329] is solved, not all stock NUT clients may even have a way to present
-some certain certificate.
+NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+third-party NUT clients to even have a way to present some certain certificate.
 +
 Possible values are:
 +

docs/man/upsd.conf.txt

@@ -620,9 +620,8 @@ NOTE: If the client does not send *any* certificate, the connection is closed.
 Like CA certificates, you can add many "trusted" client and CA certificates
 in server's certificate databases.
 
-WARNING: Until link:https://github.com/networkupstools/nut/issues/3329[issue
-#3329] is solved, not all stock NUT clients may even have a way to present
-some certain certificate.
+NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+third-party NUT clients to even have a way to present some certain certificate.
 
 upsmon (required): upsd authentication
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

docs/security.txt

@@ -317,7 +317,9 @@ static int parse_upsd_conf_args(size_t numargs, char **arg)
 # ifdef WITH_CLIENT_CERTIFICATE_VALIDATION
 	/* CERTREQUEST (0 | 1 | 2) */
 	if (!strcmp(arg[0], "CERTREQUEST")) {
-		if (starts_with_digit && str_to_int(arg[1], &n, 10)) {
+		if (starts_with_digit && str_to_int(arg[1], &n, 10)
+		&&  n >= NETSSL_CERTREQ_MIN && n <= NETSSL_CERTREQ_MAX
+		) {
 			certrequest = n;
 			return 1;
 		}

server/conf.c

@@ -45,6 +45,10 @@ extern int	certrequest;
 /* Required (cnx failed if no certificate or invalid CA chain) */
 #define NETSSL_CERTREQ_REQUIRE	2
 
+/* For range-checks */
+#define NETSSL_CERTREQ_MIN	NETSSL_CERTREQ_NO
+#define NETSSL_CERTREQ_MAX	NETSSL_CERTREQ_REQUIRE
+
 /* Similar to upscli_ssl_caps_descr() for client library,
  * but with more bells and whistles */
 const char *net_ssl_caps_descr(void);