Merge 207728d into fe4e6fe

Author: jimklimov

UPGRADING.adoc

@@ -88,6 +88,9 @@ The new `-A filename` option defaults to trying to use a `nutauth.conf` file
   but not failing if one is not usable; any specific values can require use
   of such a file or to not even try reading one ('none' as the legacy default).
   See the updated manual pages for more details. [issues #3329, #3411]
++
+NOTE: In a future NUT release, the default `configure` script handling for the
+`--with-ssl-client-validation=auto` option may be changed from `no` to `yes`.
 
 - The `upsmon` and `upsstats.cgi` clients capable of connections to multiple
   NUT data servers, potentially in separately managed security realms, now

ci_build.sh

@@ -206,8 +206,8 @@
 # See 'docs/security.txt' or the Security chapter of NUT user manual
 # for more information on the SSL support in NUT.
 #
-# WARNING: Until https://github.com/networkupstools/nut/issues/3329 is solved,
-# not all stock NUT clients even have a way to present some certain certificate.
+# NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+# third-party NUT clients to even have a way to present some certain certificate.
 
 # =======================================================================
 # DISABLE_WEAK_SSL <Boolean>

conf/upsd.conf.sample

@@ -2915,7 +2915,7 @@ nut_ssl_lib=""
 NUT_ARG_WITH([ssl], [enable SSL support (either NSS or OpenSSL)], [auto])
 NUT_ARG_WITH([nss], [enable SSL support using Mozilla NSS], [auto])
 NUT_ARG_WITH([openssl], [enable SSL support using OpenSSL], [auto])
-NUT_ARG_WITH([ssl-client-validation], [enable SSL client certificate validation ability (currently requires NSS, beware issue #3329)], [auto])
+NUT_ARG_WITH([ssl-client-validation], [enable SSL client certificate validation ability], [auto])
 
 dnl Optionally reset/initialize the cache values shared by several backends
 dnl if the check methods below never ran for all active code paths (one or more):
@@ -3001,7 +3001,8 @@ AS_CASE([${nut_with_ssl_client_validation}],
     [yes|""], [nut_with_ssl_client_validation="yes"],
         dnl TOTHINK: reject if openssl/none build?
     [auto|*], [nut_with_ssl_client_validation="no"]
-        dnl Until #3329 is solved, auto==no
+        dnl Although #3329 is solved with NUT v2.8.5, for now keep auto==no
+        dnl TODO: Flip in a later release, e.g. v2.9.0?
 )
 NUT_REPORT_FEATURE([enable SSL client certificate validation],
 	[${nut_with_ssl_client_validation}], [],

configure.ac

@@ -803,9 +803,8 @@ Enable the `upsd` server-side ability to set up `CERTREQUEST` directive in
 `upsd.conf`, which lets the server reject clients which do not present a
 certificate.
 
-WARNING: Until link:https://github.com/networkupstools/nut/issues/3329[issue
-#3329] is solved, not all stock NUT clients may even have a way to present
-some certain certificate.
+NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+third-party NUT clients to even have a way to present some certain certificate.
 
 Read link:docs/security.txt[] for instructions on practical setup of SSL
 support.

docs/configure.txt

@@ -233,9 +233,8 @@ by default, see `docs/security.txt` in NUT sources), you can specify whether
 Up until NUT release v2.8.5 this was a no-op when built with OpenSSL.
 Now this feature is supported with both OpenSSL and NSS backends.
 +
-WARNING: Until link:https://github.com/networkupstools/nut/issues/3329[issue
-#3329] is solved, not all stock NUT clients may even have a way to present
-some certain certificate.
+NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+third-party NUT clients to even have a way to present some certain certificate.
 +
 Possible values are:
 +

docs/man/upsd.conf.txt

@@ -620,9 +620,8 @@ NOTE: If the client does not send *any* certificate, the connection is closed.
 Like CA certificates, you can add many "trusted" client and CA certificates
 in server's certificate databases.
 
-WARNING: Until link:https://github.com/networkupstools/nut/issues/3329[issue
-#3329] is solved, not all stock NUT clients may even have a way to present
-some certain certificate.
+NOTE: You may have to use linkman:nutauth.conf[5] for stock and modernized
+third-party NUT clients to even have a way to present some certain certificate.
 
 upsmon (required): upsd authentication
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

docs/security.txt

@@ -317,7 +317,9 @@ static int parse_upsd_conf_args(size_t numargs, char **arg)
 # ifdef WITH_CLIENT_CERTIFICATE_VALIDATION
 	/* CERTREQUEST (0 | 1 | 2) */
 	if (!strcmp(arg[0], "CERTREQUEST")) {
-		if (starts_with_digit && str_to_int(arg[1], &n, 10)) {
+		if (starts_with_digit && str_to_int(arg[1], &n, 10)
+		&&  n >= NETSSL_CERTREQ_MIN && n <= NETSSL_CERTREQ_MAX
+		) {
 			certrequest = n;
 			return 1;
 		}

server/conf.c

@@ -45,6 +45,10 @@ extern int	certrequest;
 /* Required (cnx failed if no certificate or invalid CA chain) */
 #define NETSSL_CERTREQ_REQUIRE	2
 
+/* For range-checks */
+#define NETSSL_CERTREQ_MIN	NETSSL_CERTREQ_NO
+#define NETSSL_CERTREQ_MAX	NETSSL_CERTREQ_REQUIRE
+
 /* Similar to upscli_ssl_caps_descr() for client library,
  * but with more bells and whistles */
 const char *net_ssl_caps_descr(void);

server/netssl.h

@@ -104,6 +104,7 @@ static void check_value(const char *option, const char *value, int accepted, uin
 	maxage = tracking_delay = 17;
 	maxconn = 17;
 #ifdef WITH_CLIENT_CERTIFICATE_VALIDATION
+	/* valid assignments are 0,1,2; if invalid remain what it was */
 	certrequest = 2;
 #endif
 	args[0] = xstrdup(option);
@@ -182,13 +183,16 @@ int main(void)
 	printf("Widths: int=%" PRIuSIZE ", long=%" PRIuSIZE ", nfds_t=%" PRIuSIZE "\n",
 		sizeof(int), sizeof(long), sizeof(nfds_t));
 	for (i = 0; i < sizeof(options) / sizeof(options[0]); i++) {
+		limit = !strcmp(options[i], "CERTREQUEST") ? NETSSL_CERTREQ_MAX : 0;
 		previous = !strcmp(options[i], "CERTREQUEST") ? 2 : 17;
+#define EXPSET(x, y) (limit == 0 || limit >= x ? y : 0)
+#define EXPLIM(x) (limit == 0 || limit >= x ? x : previous)
 		check_value(options[i], "0", 1, 0);
-		check_value(options[i], "1", 1, 1);
-		check_value(options[i], "2", 1, 2);
-		check_value(options[i], "00015", 1, 15);
-		check_value(options[i], "32 \t", 1, 32);
-		check_value(options[i], "3600", 1, 3600);
+		check_value(options[i], "1", EXPSET(1, 1), EXPLIM(1));
+		check_value(options[i], "2", EXPSET(2, 1), EXPLIM(2));
+		check_value(options[i], "00015", EXPSET(15, 1), EXPLIM(15));
+		check_value(options[i], "32 \t", EXPSET(32, 1), EXPLIM(32));
+		check_value(options[i], "3600", EXPSET(3600, 1), EXPLIM(3600));
 		for (j = 0; j < sizeof(invalid) / sizeof(invalid[0]); j++)
 			check_value(options[i], invalid[j], 0, previous);
 
@@ -197,6 +201,9 @@ int main(void)
 			limit = (uintmax_t)((nfds_t)-1);
 			if (limit > (uintmax_t)LONG_MAX) limit = (uintmax_t)LONG_MAX;
 		}
+		else if (!strcmp(options[i], "CERTREQUEST")) {
+			limit = (uintmax_t)(NETSSL_CERTREQ_MAX);
+		}
 		snprintf(number, sizeof(number), "%" PRIuMAX, limit - 1);
 		check_value(options[i], number, 1, limit - 1);
 		snprintf(number, sizeof(number), "%" PRIuMAX, limit);
@@ -212,7 +219,8 @@ int main(void)
 	check_value("CERTREQUEST", "REQUIRE", 1, 2);
 	check_value("CERTREQUEST", "require", 0, 2);
 	/* ssl_init still owns the 0..2 domain check and its fatal error policy. */
-	check_value("CERTREQUEST", "3", 1, 3);
+	/*check_value("CERTREQUEST", "3", 1, 3);*/
+	check_value("CERTREQUEST", "3", 0, 2);
 #endif
 
 	f = fopen(config_file, "w");