Merge pull request #3435 from jimklimov/issue-3329

Introduce NUT "authconf" file support [#3329, #3411]

Author: jimklimov

NEWS.adoc

@@ -58,6 +58,11 @@ https://github.com/networkupstools/nut/milestone/13
       attempts on timeout errors, simplifying error recovery. [PR #3414]
     * Increased default TCP response timeout to 2000 ms. [PR #3418]
 
+ - `dummy-ups` driver updates:
+   * Added `authconf` driver parameter for repeater mode to control
+     authentication configuration discovery. It accepts `default`, `none`,
+     or a specific authconf file path. [issue #3329]
+
  - `nutdrv_qx` driver updates:
     * Only claim a USB device as "supported" during discovery out of the box
       if `subdriver_command` was assigned (`1A86:7523` is used by CH340/341
@@ -174,6 +179,8 @@ https://github.com/networkupstools/nut/milestone/13
       allows to pass the `certfile` argument needed for OpenSSL builds. [#3331]
     * The `libupsclient` (C) and `libnutclient` (C++) API were updated to
       report the ability to check `CERTIDENT` information. [#3331]
+    * Introduced support for "authconf" files to store and convey NUT client
+      authentication details. [issue #3329]
 
  - Various clients:
     * Flush standard output and error buffers before handling clean exit
@@ -184,6 +191,29 @@ https://github.com/networkupstools/nut/milestone/13
     * Adjust scaling for small (single-digit) value ranges to avoid division
       by zero and not rendering anything. [issue #3469]
 
+ - `upsc`, `upscmd`, `upsrw` command-line client updates:
+    * Enabled support for `nutauth.conf` files to provide credentials and/or
+      SSL settings in the client which previously only did best-effort attempts
+      at secure communications without an individual certificate, and only
+      anonymously for reading. The new `-A filename` option defaults to trying
+      to use a `nutauth.conf` file (if found in one of the default locations)
+      but not failing if one is not usable; specific values can require use of
+      such a file (`default`) or to not even try reading one (`none`).
+      [issues #3329, #3411]
+
+ - `upslog` client/tool updates:
+    * Added support for best-effort use of `nutauth.conf` files from default
+      locations or via `-A` option, as described above. Since this client
+      can establish multiple connections, keep in mind that currently it
+      can only identify itself with some one (first seen) client certificate,
+      if `CERTIDENT` settings are used. Multiple `CERTHOST` directives for
+      specially trusted servers can be used. [#3329]
+
+ - `upsstats`, `upsset`, `upsimage` CGI client updates:
+    * Added support for best-effort use of `nutauth.conf` files from default
+      locations described above (no way to choose the location, other than
+      by web-server environment variables for CGI calls). [#3329]
+
  - `upsmon` client updates:
     * Introduced support for `CERTFILE` option, so the client can identify
       itself to the data server also in OpenSSL builds. [issue #3331]
@@ -229,6 +259,9 @@ https://github.com/networkupstools/nut/milestone/13
       much later (tell the sysadmin to increase `ulimit` or set up a more
       conservative `MAXCONN`). If there is a separate soft and hard limit,
       and `MAXCONN` exceeds the soft limit, try to raise the bar. [issue #3365]
+    * If SSL configuration was provided, but the server failed to apply some
+      aspect of that, it should now abort with an explanation (and not proceed
+      with insecure start-up like it could do before). [issue #3331, PR #3435]
 
  - Recipes, CI and helper script updates not classified above:
     * Introduced `ci_build.sh` settings and respective CI workflow settings
@@ -237,7 +270,9 @@ https://github.com/networkupstools/nut/milestone/13
       files. Both can be enabled by `export DO_USE_NUTCI_CACHE=yes` and would
       store data under a `${CI_CACHE_NUT_BASEDIR}` directory (defaults to
       `~/.cache/nut-ci`); more fine-tuning environment variables are provided.
-      [issues #3108, #3390, #1711, PR #3109]
+      Directory names are based on hashes of strings that identify the content,
+      which are size-limited to some 8 characters.
+      [issues #3108, #3390, #1711, #3526, PR #3109]
     * Rearranged the GHA job to prepare Dist and Docs Tarballs. [PR #3460]
     * Updated `scripts/Windows/dllldd.sh` helper script to better detect DLL
       names not exposed with dynamic linking metadata (e.g. some Mozilla NSS

UPGRADING.adoc

@@ -57,6 +57,23 @@ Changes from 2.8.5 to 2.8.6
   scriptlet, as far as specifying command arguments is concerned, but it also
   newly supports parsing multiple tokens as additional arguments. [PR #3499]
 
+- Potentially a breaking change for existing deployments with some flaw in
+  configuration of the `upsd` data server: If SSL configuration was provided,
+  but the server failed to apply some aspect of that, it should now abort
+  with an explanation (and not proceed with insecure start-up like it could
+  do before). [issue #3331, PR #3435]
+
+- Enabled support for `nutauth.conf` files to provide credentials and/or
+  SSL settings in clients which previously only did best-effort attempts at
+  secure communications without an individual certificate, and only anonymously
+  for reading like `upsc`.
++
+The new `-A filename` option defaults to trying to use a `nutauth.conf` file
+  (if found in one of the default locations) but not failing if one is not
+  usable; specific values can require use of such a file or to not even try
+  reading one ('none' as the legacy default). See the updated manual pages
+  for more details. [issues #3329, #3411]
+
 Changes from 2.8.4 to 2.8.5
 ---------------------------
 

ci_build.sh

@@ -1149,10 +1149,14 @@ do_autogen_get_CONFIGURE_SCRIPT() {
 }
 
 discover_somehash_filter() {
+    # First, constrain hash string lengths for shorter logs and path lookups.
+    # KEEP IN SYNC WITH tests/NIT/nit.sh SCRIPT!
+    cut_filter() { sed -e 's,^\(....\).*\(....\)$,\1\2,'; }
+
     for HASH_CMD in md5sum sha1sum sha256sum shasum cksum md5; do
         if (command -v "$HASH_CMD") >/dev/null 2>/dev/null ; then
             somehash_filter() {
-                "$HASH_CMD" | awk '{print $1}'
+                "$HASH_CMD" | awk '{print $1}' | cut_filter
             }
             return
         fi
@@ -1165,15 +1169,15 @@ discover_somehash_filter() {
             case "$OUT" in
             *stdin*)
                 somehash_filter() {
-                    openssl "$HASH_CMD" | awk '{print $NF}'
+                    openssl "$HASH_CMD" | awk '{print $NF}' | cut_filter
                 }
                 return
                 ;;
             esac
         done
     fi
 
-    # Worst-case: use data size?
+    # Worst-case: use data size? Do not cut_filter here!
     somehash_filter() {
         wc -c
     }
@@ -2817,7 +2821,7 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al
                     FAILED+=("TESTCOMBO=${TESTCOMBO}[configure]")
                     # TOTHINK: Do we want to try clean-up if we likely have no Makefile?
                     if [ "$CI_FAILFAST" = true ]; then
-                        echo "===== Aborting because CI_FAILFAST=$CI_FAILFAST" >&2
+                        echo "===== [Matrix] Error: Aborting because CI_FAILFAST=$CI_FAILFAST" >&2
                         break
                     fi
                     BUILDSTODO="`expr $BUILDSTODO - 1`" || [ "$BUILDSTODO" = "0" ] || break
@@ -2833,7 +2837,7 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al
                     RES_ALLERRORS=$?
                     FAILED+=("TESTCOMBO=${TESTCOMBO}[build]")
                     # Help find end of build (before cleanup noise) in logs:
-                    echo "=== FAILED 'TESTCOMBO=${TESTCOMBO}' build"
+                    echo "=== [Matrix] Error: FAILED 'TESTCOMBO=${TESTCOMBO}' build"
                     if [ "$CI_FAILFAST" = true ]; then
                         echo "===== Aborting because CI_FAILFAST=$CI_FAILFAST" >&2
                         break
@@ -2846,7 +2850,7 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al
                     RES_ALLERRORS=$?
                     FAILED+=("TESTCOMBO=${TESTCOMBO}[check]")
                     # Help find end of build (before cleanup noise) in logs:
-                    echo "=== FAILED 'TESTCOMBO=${TESTCOMBO}' check"
+                    echo "=== [Matrix] Error: FAILED 'TESTCOMBO=${TESTCOMBO}' check"
                     if [ "$CI_FAILFAST" = true ]; then
                         echo "===== Aborting because CI_FAILFAST=$CI_FAILFAST" >&2
                         break
@@ -2874,7 +2878,7 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al
                         RES_ALLERRORS=$?
                         FAILED+=("TESTCOMBO=${TESTCOMBO}[check-parallel-builds]")
                         # Help find end of build (before cleanup noise) in logs:
-                        echo "=== FAILED 'TESTCOMBO=${TESTCOMBO}' check-parallel-builds"
+                        echo "=== [Matrix] Error: FAILED 'TESTCOMBO=${TESTCOMBO}' check-parallel-builds"
                         if [ "$CI_FAILFAST" = true ]; then
                             echo "===== Aborting because CI_FAILFAST=$CI_FAILFAST" >&2
                             break
@@ -2948,7 +2952,7 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al
 
             if [ "$RES_ALLERRORS" != 0 ]; then
                 # Leading space is included in FAILED
-                echo "FAILED ${#FAILED[@]} build(s) with code ${RES_ALLERRORS}: ${FAILED[*]}" >&2
+                echo "[Matrix] Error: FAILED ${#FAILED[@]} build(s) with code ${RES_ALLERRORS}: ${FAILED[*]}" >&2
             else
                 echo "(and no build scenarios had failed)" >&2
             fi

clients/Makefile.am

@@ -110,7 +110,7 @@ endif HAVE_CXX11
 
 # Optionally deliverable as part of NUT public API:
 if WITH_DEV
- include_HEADERS = upsclient.h
+ include_HEADERS = upsclient.h authconf.h
 if HAVE_CXX11
  include_HEADERS += nutclient.h nutclientmem.h
 else !HAVE_CXX11
@@ -170,7 +170,7 @@ upsstats_cgi_LDADD = $(LDADD_CLIENT) $(top_builddir)/common/libcommonstrjson.la
 # but it needs nut_version.h made before the rest of build,
 # to include it into upsclient.c (without an explicit link,
 # this target is sometimes missed in parallel builds):
-libupsclient_la_SOURCES = upsclient.c upsclient.h
+libupsclient_la_SOURCES = upsclient.c upsclient.h authconf.c authconf.h
 
 # See comments for similar trick in common/Makefile.am for common-nut_version.c
 if BUILDING_IN_TREE
@@ -205,6 +205,7 @@ if WITH_SSL
 endif WITH_SSL
 
 # Below we set API versions of public libraries
+# This includes changes to method signatures and struct content/sizes!
 # http://www.gnu.org/software/libtool/manual/html_node/Updating-version-info.html
 # Note that changes here may have to be reflected in packaging (the shared
 # object .so names would differ)