Identify SSL support in upsd and libupsclient, add NIT tests for OpenSSL and Mozilla NSS#3330

Open

jimklimov wants to merge 43 commits intonetworkupstools:masterfrom

jimklimov:nit-ssl

Commits on Mar 4, 2026

Introduce and use methods to query and report SSL support in libupsclient, its consumers, and upsd [#3328]
jimklimov
committed
clients/upsclient.c: also report NUT source version the library was built from [#3328]
jimklimov
committed
clients/upsclient.c: upscli_sslinit(): condense WITH_SSL/!WITH_SSL into one method body code [#3328]
jimklimov
committed
clients/upsclient.c, conf/upsmon.conf.sample.in, docs/man/upsmon.conf.txt: debug-log methods called which are no-op in current build and document keywords which would be no-op in some cases [#3328]
jimklimov
committed
drivers/main.h: upsdrv_callbacks: we now have in fact 16 not 9 pointers passed [#2800]
jimklimov
committed
drivers/main.h: upsdrv_callbacks: move magic to start of struct [#2800]
jimklimov
committed
drivers/main.h: upsdrv_callbacks: document the macros [#2800]
jimklimov
committed
m4/ax_c_pragmas.m4, drivers/main.c: handle "-Wmissing-braces" for upsdrv_callback_t init [#2800]
jimklimov
committed
tests/NIT/nit.sh: detect run-time behavior of WITH_SSL* in built clients and server programs [#3328, #1711]
jimklimov
committed
tests/NIT/nit.sh, NEWS.adoc: introduce generation of upsmon/upsd configs for SSL test cases [#3328, #1711]
jimklimov
committed
tests/NIT/nit.sh: SSL tests: check for presence of third-party tooling to manipulate the crypto credential stores [#3328, #1711]
jimklimov
committed
tests/NIT/nit.sh: generatecfg_upsd_add_SSL(), generatecfg_upsmon_add_SSL(): cross-link server/client capabilities to set expectations in configs [#3328, #1711]
jimklimov
committed
tests/NIT/nit.sh: populate OpenSSL and/or Mozilla NSS keystores if we can test those [#3328, #1711]
jimklimov
committed
tests/NIT/nit.sh: add server/client-side SSL configs for tests with upsd-client interaction [#3328, #1711]
jimklimov
committed
tests/NIT/nit.sh: fix running as a script from root or tests directory [#3294]
jimklimov
committed
tests/NIT/nit.sh: leave a commented stub for OpenSSL SSL_CERT_DIR hackery [#1711]
jimklimov
committed
configure.ac and docs: introduce --with-ssl-client-validation option [#3330, #3329]
jimklimov
committed
server/conf.c and docs: Extended processing of `CERTREQUEST` setting to handle numeric or specific string values, to match both ways of reading ambiguous documentation [#3330]
jimklimov
committed
docs/config-prereqs.txt: add packages for `openssl` and `certutil` where currently missing, to NIT-test SSL support on as many platforms as we can [#1711]
jimklimov
committed
server/upsd.c: mainloop(POSIX): log in more detail why we disconnect a socket [#1711]
jimklimov
committed
server/netssl.c: net_starttls(): reject clients without any cert if WITH_CLIENT_CERTIFICATE_VALIDATION earlier and more visibly [#3329]
jimklimov
committed
clients/upsc.c: revise failure logging [#1711]
jimklimov
committed
clients/upsclient.c: upscli_strerror(): revise failure logging with NSS [#1711, #3329]
jimklimov
committed
tests/NIT/nit.sh: adjust TESTCERT_PATH_* to WIN32 runs if needed [#1711]
jimklimov
committed
*/Makefile.am: revise libupsclient* dependencies to honour ENABLE_SHARED_PRIVATE_LIBS [#2800, #3328]
jimklimov
committed
appveyor.yml: enable possibility of NSS builds (and confirm OpenSSL) for Windows with Appveyor CI [#1711]
jimklimov
committed
clients/upsclient.{c,h}, docs: introduce upscli_set_debug_level() and a getter to fix shared-private-library builds [#2800, #1711]
jimklimov
committed
clients/upsmon.c: use `upscli_set_debug_level(nut_debug_level)` wherever we change nut_debug_level [#1711, #2800, #3330]
jimklimov
committed
clients/*.c, drivers/dummy-ups.c, tools/nut-scanner/scan_nut.c: fix libupsclient consumers to use upscli_set_debug_level() where available [#1711, #2800, #3330]
jimklimov
committed
tests/NIT/nit.sh: fix running OpenSSL tests on Windows [#1711]
jimklimov
committed
tests/NIT/nit.sh: add a way to run WITHOUT_SSL_TESTS on platforms known to currently fail them [#1711]
jimklimov
committed
tests/NIT/Makefile.am: default to run WITHOUT_SSL_TESTS for OpenSSL builds [#1711, #3331]
jimklimov
committed
docs/security.txt, docs/nut.dict: add a note on checking SSL support in run-time build of NUT [#3328]
jimklimov
committed
common/common-nut_version.c: add comments to clarify LIBNUTPRIVATE_UPS_VERSION vs UPS_VERSION [#2800]
jimklimov
committed
ci_build.sh, scripts/Windows/build-mingw-nut.sh, NEWS.adoc: introduce more generally useful support for NUT_SSL_VARIANTS [#1711]
jimklimov
committed
appveyor.yml: pass NUT_SSL_VARIANTS=nss to the builds, so we have some known-functional SSL support in the NUT for Windows pre-built tarballs [#3328, #1711]
jimklimov
committed
tests/NIT/nit.sh: disable NUT_QUIET_INIT_SSL when we actually test SSL [#1711]
jimklimov
committed
clients/upsclient.c: report in log if Certificate verification (by client) succeeded [#1711]
jimklimov
committed
tests/NIT/nit.sh: fix use of CERTPATH with OpenSSL tests [#1711]
jimklimov
committed
tests/NIT/Makefile.am: re-allow running OpenSSL tests by default [#1711]
jimklimov
committed
tests/NIT/Makefile.am: OpenSSL remains flaky on many platforms, work on actual code may be needed to rectify it after all [#3331, #1711]
jimklimov
committed
NEWS.adoc, UPGRADING.adoc: update document intro paragraphs
jimklimov
committed
clients/Makefile.am: fix dependency between upsclient.c and nut_version.h [#3328]
jimklimov
committed