mirror of
https://github.com/openwrt/packages.git
synced 2026-10-14 16:27:22 +04:00
nut: enable configuring more SSL-related options
Expose the configuration knobs as UCI config for more SSL options. Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
This commit is contained in:
Daniel F. Dickinson authored and 
Alexandru Ardelean committed
1 parent
27e39ec97c
commit
79db1ee573
5 files changed
+110
-8
No files matched your search
@@ -123,10 +123,15 @@ define Package/nut-common/install
|
||||
$(INSTALL_DIR) $(1)/etc/nut
|
||||
$(INSTALL_DIR) $(1)/usr/lib
|
||||
$(INSTALL_DIR) $(1)/lib/functions/nut
|
||||
$(INSTALL_DIR) $(1)/usr/share/nut
|
||||
$(INSTALL_DATA) ./files/nut-common.sh.functions $(1)/lib/functions/nut/nut-common.sh
|
||||
$(INSTALL_DATA) ./files/nut-service.sh.functions $(1)/lib/functions/nut/nut-service.sh
|
||||
$(CP) $(PKG_INSTALL_DIR)/usr/lib/libupsclient.so* $(1)/usr/lib/
|
||||
ln -sf /var/etc/nut/nut.conf $(1)/etc/nut/nut.conf
|
||||
$(if $(CONFIG_NUT_SSL),printf "%s" "openssl" >$(PKG_BUILD_DIR)/ssl_backend)
|
||||
$(if $(CONFIG_NUT_SSL_NSS),printf "%s" "nss" >$(PKG_BUILD_DIR)/ssl_backend)
|
||||
$(if $(CONFIG_NUT_SSL)$(CONFIG_NUT_SSL_NSS),,printf "%s" "none" >$(PKG_BUILD_DIR)/ssl_backend)
|
||||
$(INSTALL_DATA) $(PKG_BUILD_DIR)/ssl_backend $(1)/usr/share/nut/ssl_backend
|
||||
endef
|
||||
|
||||
define Package/nut-server
|
||||
|
||||
@@ -112,10 +112,17 @@ upsmon_conf_get_write() {
|
||||
nut_upsmon_conf() {
|
||||
local config_file="$1"
|
||||
local cfg="upsmon"
|
||||
local val defaultnotify nut_option uci_option conf_ret
|
||||
local val defaultnotify nut_option uci_option conf_ret ssl_backend
|
||||
local event_notify_flags_not_found upsmon_bool_options nut_bool
|
||||
upsmon_bool_options=" $NUT_UPSMON_BOOL_OPTIONS "
|
||||
|
||||
ssl_backend="$(cat /usr/share/nut/ssl_backend)"
|
||||
|
||||
[ -n "$ssl_backend" ] || {
|
||||
log_error_exit "Missing ssl_backend indicator. Bailing rather than running without SSL." "nut-monitor-config.sh" "nut-monitor-config"
|
||||
return 1
|
||||
}
|
||||
|
||||
# Note that we use '-u $RUNAS' on the daemon command line in preference to
|
||||
# the RUN_AS_USER configuration in "$config_file"
|
||||
|
||||
@@ -197,6 +204,44 @@ nut_upsmon_conf() {
|
||||
return 1
|
||||
fi
|
||||
;;
|
||||
CERTPATH | CERTIDENT | CERTHOST)
|
||||
# if not compiled with SSL (OpenSSL or NSS), then do not attempt to use
|
||||
# SSL configuration
|
||||
if [ "$ssl_backend" != "openssl" ] && [ "$ssl_backend" != "nss" ]; then
|
||||
continue
|
||||
fi
|
||||
# If no certpath or certfile is specified, then SSL will not be used, even if
|
||||
# other SSL config exists
|
||||
upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "false"
|
||||
conf_ret=$?
|
||||
if [ "$conf_ret" -eq 1 ]; then
|
||||
return 1
|
||||
fi
|
||||
;;
|
||||
CERTVERIFY | FORCESSL)
|
||||
# if not compiled with SSL (OpenSSL or NSS), then do not attempt to use
|
||||
# SSL configuration
|
||||
if [ "$ssl_backend" != "openssl" ] && [ "$ssl_backend" != "nss" ]; then
|
||||
continue
|
||||
fi
|
||||
upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "true"
|
||||
conf_ret=$?
|
||||
if [ "$conf_ret" -eq 1 ]; then
|
||||
return 1
|
||||
fi
|
||||
;;
|
||||
CERTFILE)
|
||||
# if not compiled with OpenSSL, then do not attempt to use CERTFILE (it is
|
||||
# OpenSSL specific)
|
||||
if [ "$ssl_backend" != "openssl" ]; then
|
||||
continue
|
||||
fi
|
||||
upsmon_conf_get_write "$cfg" "$config_file" "$uci_option" "$nut_option" "false"
|
||||
conf_ret=$?
|
||||
if [ "$conf_ret" -eq 1 ]; then
|
||||
return 1
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
if [ "${upsmon_bool_options/$nut_option/}" != "${upsmon_bool_options}" ]; then
|
||||
nut_bool="true"
|
||||
|
||||
@@ -67,7 +67,8 @@ listen_address() {
|
||||
srv_config() {
|
||||
local srv="$1"
|
||||
local config_file="$2"
|
||||
local maxage maxconn certfile
|
||||
local ssl_backend
|
||||
local maxage maxconn val certfile
|
||||
|
||||
config_get maxage "$srv" maxage
|
||||
[ -n "$maxage" ] && printf "MAXAGE %s\n" "$maxage" >>"$config_file"
|
||||
@@ -77,9 +78,39 @@ srv_config() {
|
||||
config_get maxconn "$srv" maxconn
|
||||
[ -n "$maxconn" ] && printf "MAXCONN %s\n" "$maxconn" >>"$config_file"
|
||||
|
||||
# NOTE: certs only apply to SSL-enabled version
|
||||
ssl_backend="$(cat /usr/share/nut/ssl_backend)"
|
||||
|
||||
[ -n "$ssl_backend" ] || {
|
||||
log_error_exit "Missing ssl_backend indicator. Bailing rather than running without SSL." "nut-server-config.sh" "nut-server-config"
|
||||
return 1
|
||||
}
|
||||
|
||||
# NOTE: certfile only applies to OpenSSL-enabled version
|
||||
config_get certfile "$srv" certfile
|
||||
[ -n "$certfile" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file"
|
||||
[ -n "$certfile" ] && [ "$ssl_backend" = "openssl" ] && printf "CERTFILE %s\n" "$certfile" >>"$config_file"
|
||||
|
||||
# if not compiled with SSL (OpenSSL or NSS), then do not attempt to use
|
||||
# SSL configuration
|
||||
if [ "$ssl_backend" = "openssl" ] || [ "$ssl_backend" = "nss" ]; then
|
||||
# If no certpath or certfile is specified, then SSL will not be used, even if
|
||||
# other SSL config exists
|
||||
config_get val "$srv" certpath
|
||||
[ -n "$val" ] && printf "CERTPATH %s\n" "$val" >>"$config_file"
|
||||
|
||||
config_get val "$srv" certident
|
||||
[ -n "$val" ] && printf "CERTIDENT %s\n" "$val" >>"$config_file"
|
||||
|
||||
config_get val "$srv" certrequest
|
||||
[ -n "$val" ] && printf "CERTREQUEST %s\n" "$val" >>"$config_file"
|
||||
|
||||
config_get_bool val "$srv" disable_weak_ssl 0
|
||||
printf "DISABLE_WEAK_SSL %s\n" "$val" >>"$config_file"
|
||||
fi
|
||||
|
||||
config_get val "$srv" debug_min
|
||||
[ -n "$val" ] && printf "DEBUG_MIN %s\n" "$val" >>"$config_file"
|
||||
|
||||
return 0
|
||||
}
|
||||
|
||||
nut_user_instcmd() {
|
||||
@@ -141,7 +172,7 @@ build_server_config() {
|
||||
config_foreach nut_user_add user "$USERS_C.new"
|
||||
config_foreach listen_address listen_address "$UPSD_C.new"
|
||||
if have_section_named "upsd" "upsd"; then
|
||||
srv_config upsd "$UPSD_C.new"
|
||||
srv_config upsd "$UPSD_C.new" || return 1
|
||||
else
|
||||
# If config 'nut_server' does not have a 'upsd' section, use a default
|
||||
# configuration
|
||||
|
||||
@@ -28,7 +28,16 @@
|
||||
# option rbwarntime 43200 # replace battery warn time
|
||||
# option alarmcritical 1
|
||||
# option shutdownexit 0
|
||||
# option certpath /path/to/ca/dir
|
||||
# NB: certificates only apply to SSL-enabled version
|
||||
# See https://github.com/networkupstools/nut/blob/master/docs/security.txt
|
||||
# openssl client certificate chain and private key
|
||||
# option certfile /usr/local/etc/upsmon.pem
|
||||
# NSS or OpenSSL
|
||||
# For NSS path the directory with certificate and key databases
|
||||
# For OpenSSL path a file with one or more CA certificates
|
||||
# option certpath /etc/nut/cert_db
|
||||
# Client certificate name and password to unlock the key for the certificate
|
||||
# option certident '"certificate name" "database password"'
|
||||
# option certverify 0
|
||||
# option forcessl 0
|
||||
# option debugmin 0
|
||||
|
||||
@@ -37,6 +37,18 @@
|
||||
# option maxconn 1024
|
||||
# option runas nut
|
||||
# option interface_reload_delay 3000 # in milliseconds
|
||||
# NB: certificates only apply to SSL-enabled version
|
||||
# option certfile /usr/local/etc/upsd.pem
|
||||
# option triggerlist all # not configured by default
|
||||
# option debug_min 0
|
||||
# NB: certificates only apply to SSL-enabled version
|
||||
# See https://github.com/networkupstools/nut/blob/master/docs/security.txt
|
||||
# openssl server certificate chain and private key
|
||||
# option certfile /usr/local/etc/upsd.pem
|
||||
# NSS or OpenSSL
|
||||
# For NSS path the directory with certificate and key databases
|
||||
# For OpenSSL path a file with one or more CA certificates
|
||||
# option certpath /etc/nut/cert_db
|
||||
# Server certificate name and password to unlock the key for the certificate
|
||||
# option certident '"certificate name" "database password"'
|
||||
# 0 - NO, 1 - REQUEST, 2 - REQUIRE (and verify)
|
||||
# option certrequest 0
|
||||
# option disable_weak_ssl 0
|
||||
Reference in new issue
Block a user