Merge pull request #3408 from jimklimov/issue-3331

Bring OpenSSL abilities up to be on par with NSS

Author: jimklimov

Makefile.am

@@ -209,6 +209,14 @@ all-fanout-maybe: .libs-dev-PATH @dotMAKE@
 	done ; \
 	export PATH ; \
 	export LD_LIBRARY_PATH ; \
+	if `uname -a` | grep -i darwin >/dev/null; then \
+		if [ -n "$${DYLD_FALLBACK_LIBRARY_PATH}" ] ; then \
+			DYLD_FALLBACK_LIBRARY_PATH="$${LD_LIBRARY_PATH}:$${DYLD_FALLBACK_LIBRARY_PATH}" ; \
+		else \
+			DYLD_FALLBACK_LIBRARY_PATH="$${LD_LIBRARY_PATH}" ; \
+		fi ; \
+		export DYLD_FALLBACK_LIBRARY_PATH ; \
+	fi ; \
 	' >> '$@'
 
 # We start with a pass to `make all` in `common` dir because our wild recipes

NEWS.adoc

@@ -72,6 +72,30 @@ https://github.com/networkupstools/nut/milestone/13
       query (for protocol version) to verify that handshake succeeded.
       This change impacted also the classic C `libupsclient` library.
       [issue #3387, PR #3402]
+    * Updated OpenSSL code paths in the `libupsclient` C library to support
+      features earlier only available with NSS builds, like specifying the
+      client certificate+key, optionally with password, and pinning expected
+      server certificates. For both backends such pinning should now honour
+      the 'certverify' setting of the `CERTHOST` entry (e.g. not abort the
+      connection attempt if that number is '0'). Also, the `-1` value is
+      now supported to mean "use global default setting". [issue #3331]
+    * Updated SSL support in the `upsd` data server to handle `CERTREQUEST`
+      (optional validation of clients identified by a certificate) also
+      when built with OpenSSL, optionally using the `CERTPATH` with a
+      collection of CA certificates (directory or a big PEM file).
+      Also support `CERTIDENT` to provide a private key password and ensure
+      that the certificate in `CERTFILE` has an expected subject name as an
+      exact string, or that its CN or SAN match the provided string as a
+      standard expression of host name (section 3.5 of RFC 1034) or IP address.
+      [issue #3331]
+    * The `libupsclient` API was extended with a `upscli_init2()` method which
+      allows to pass the `certfile` argument needed for OpenSSL builds. [#3331]
+    * The `libupsclient` (C) and `libnutclient` (C++) API were updated to
+      report the ability to check `CERTIDENT` information. [#3331]
+
+ - `upsmon` client updates:
+    * Introduced support for `CERTFILE` option, so the client can identify
+      itself to the data server also in OpenSSL builds. [issue #3331]
 
  - Introduced `ci_build.sh` settings and respective CI workflow settings
    to optionally re-use a `config.cache` file from older runs, and similar

UPGRADING.adoc

@@ -33,6 +33,13 @@ Changes from 2.8.5 to 2.8.6
 
 - PLANNED: Keep track of any further API clean-up?
 
+- Potentially a breaking change for C++ clients that rushed to use the new
+  SSL support options in `libnutclient`: for Mozilla NSS setup, the way to
+  provide an expected `CERTHOST` address was missing.  Now the API is fixed
+  in this regard, at the cost of adding arguments to methods introduced in
+  the previous release. [issue #3331, PR #3408]
+
+
 Changes from 2.8.4 to 2.8.5
 ---------------------------
 

appveyor.yml

@@ -35,7 +35,9 @@ environment:
 #  https://github.com/marketplace/actions/delete-pr-comments-during-subsequent-ci
 notifications:
   - provider: GitHubPullRequest
-    on_build_status_changed: true
+    on_build_success: true
+    on_build_failure: true
+    on_build_status_changed: false
     template: |
       {{#passed}}:white_check_mark:{{/passed}}{{#failed}}:x:{{/failed}} [Build {{&projectName}} {{buildVersion}} {{status}}]({{buildUrl}}) (commit {{commitUrl}} by @{{&commitAuthorUsername}})
       * [artifacts{{#failed}} (if any){{/failed}}]({{buildurl}}/artifacts)

clients/Makefile.am

@@ -219,6 +219,8 @@ endif WITH_SSL
 # for the run-time dynamic linker resolution? For now the shared-library
 # builds are "exotic", but it makes sense to deprecate this export in a
 # future release.
+### WARNING: Do not forget to update SO_MAJOR_LIBUPSCLIENT under scripts/obs,
+### especially when bumping "age" into loss of compatibility with old releases!
 libupsclient_la_LDFLAGS = -version-info 9:0:2
 libupsclient_la_LDFLAGS += -export-symbols-regex '^(upscli_|nut_debug_level)'
 #|s_upsdebug|fatalx|fatal_with_errno|xcalloc|xbasename|print_banner_once)'
@@ -292,7 +294,9 @@ libupsclient-version.h: libupsclient.la
 if HAVE_CXX11
 # libnutclient version information and build
 libnutclient_la_SOURCES = nutclient.h nutclient.cpp
-libnutclient_la_LDFLAGS = -version-info 4:0:2
+### WARNING: Do not forget to update SO_MAJOR_LIBNUTCLIENT under scripts/obs,
+### especially when bumping "age" into loss of compatibility with old releases!
+libnutclient_la_LDFLAGS = -version-info 4:0:0
 # Needed in not-standalone builds with -DHAVE_NUTCOMMON=1
 # which is defined for in-tree CXX builds above:
 if ENABLE_SHARED_PRIVATE_LIBS
@@ -319,6 +323,8 @@ endif !HAVE_CXX11
 if HAVE_CXX11
 # libnutclientstub version information and build
 libnutclientstub_la_SOURCES = nutclientmem.h nutclientmem.cpp
+### WARNING: Do not forget to update SO_MAJOR_LIBNUTCLIENTSTUB under scripts/obs,
+### especially when bumping "age" into loss of compatibility with old releases!
 libnutclientstub_la_LDFLAGS = -version-info 1:1:0
 libnutclientstub_la_LIBADD = libnutclient.la
 if HAVE_WINDOWS