Introduce NUT "authconf" file support [#3329, #3411] by jimklimov · Pull Request #3435 · networkupstools/nut

jimklimov · 2026-05-11T20:16:52Z

Starting with a PoC from AI, slightly modified (20%?) in review, following the spec requested in the GitHub issue #3329, as a stepping stone for further work. Also address parts of issue #3411.

Closes: #3503

Let CI loose on this iteration that passes locally...

TODO:

Stacking of config files as proposed in Feature request: more NUT clients should be SSL-capable with proper certificate trust and all, and should have a common way to configure that #3329
Revise what data points we do want populated in upscli_authconf_t => added CERTHOST to the originally posted mix
libupsclient API (upscli_init variant?) to use upscli_authconf_t struct instances directly. Refactor older methods as wrappers to this one?
- Consider a method that parses our collection from upscli_get_authconf_list() to upscli_add_host_cert() and set up the one most applicable set of client identity data for that [user@host:port] combo => to be considered in NUT authconf: detect best client identity data for a connection #3493
Add config-file permissions check for sensitive data, like in other cases (upsd.users etc.)
Add a conf/... sample and docs/man/... page for nutauth.conf concept

UPDATE: During work on this, it was found that NSS CERTHOST support was actually broken, and only worked for certificates whose nicknames matched the host name, not the "My nut server" nickname as the example claimed for years. Fixed now.

UPDATE: During work on this, it was found that it may be troublesome for a single client to connect to multiple NUT data servers which would require different CA trust stores and/or client self-identification by certificates. To be investigated under #3494, not in scope here.

github-actions · 2026-05-11T20:17:13Z

A ZIP file with standard source tarball and another tarball with pre-built docs for commit 9688c11 is temporarily available: NUT-tarballs-PR-3435.zip.

AppVeyorBot · 2026-05-11T22:34:55Z

✅ Build nut 2.8.5.4693-master completed (commit 049a4d4c36 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4693-master.7z

AppVeyorBot · 2026-05-11T22:34:56Z

✅ Build nut 2.8.5.4693-master completed (commit 049a4d4c36 by @jimklimov)

AppVeyorBot · 2026-05-11T23:10:51Z

✅ Build nut 2.8.5.4694-master completed (commit c8f40b4384 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4694-master.7z

AppVeyorBot · 2026-05-12T00:12:39Z

✅ Build nut 2.8.5.4696-master completed (commit 25660e3752 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4696-master.7z

AppVeyorBot · 2026-05-12T00:12:40Z

✅ Build nut 2.8.5.4696-master completed (commit 25660e3752 by @jimklimov)

AppVeyorBot · 2026-05-12T03:43:17Z

✅ Build nut 2.8.5.4697-master completed (commit 9be8443368 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4697-master.7z

AppVeyorBot · 2026-05-12T07:59:15Z

❌ Build nut 2.8.5.4698-master failed (commit be4347c9c5 by @jimklimov)

artifacts (if any)

AppVeyorBot · 2026-05-12T07:59:16Z

❌ Build nut 2.8.5.4698-master failed (commit be4347c9c5 by @jimklimov)

AppVeyorBot · 2026-05-12T12:29:15Z

❌ Build nut 2.8.5.4699-master failed (commit 1d80027d90 by @jimklimov)

artifacts (if any)

AppVeyorBot · 2026-05-12T14:19:14Z

✅ Build nut 2.8.5.4700-master completed (commit 8a8a16fc63 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4700-master.7z

AppVeyorBot · 2026-05-12T14:19:15Z

✅ Build nut 2.8.5.4700-master completed (commit 8a8a16fc63 by @jimklimov)

AppVeyorBot · 2026-05-12T15:01:30Z

✅ Build nut 2.8.5.4701-master completed (commit 40e1ff94b4 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4701-master.7z

AppVeyorBot · 2026-05-12T16:03:03Z

❌ Build nut 2.8.5.4702-master failed (commit 34ad7de24e by @jimklimov)

artifacts (if any)

AppVeyorBot · 2026-05-12T16:03:04Z

❌ Build nut 2.8.5.4702-master failed (commit 34ad7de24e by @jimklimov)

…_NUT_CAPATH (nss vs openssl backend) [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

…_NUT_CERTHOST_NAME [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

AppVeyorBot · 2026-06-30T01:20:41Z

❌ Build nut 2.8.5.4902-master failed (commit c46fbb7cf6 by @jimklimov)

artifacts (if any)

AppVeyorBot · 2026-06-30T01:20:41Z

❌ Build nut 2.8.5.4902-master failed (commit c46fbb7cf6 by @jimklimov)

AppVeyorBot · 2026-06-30T01:48:59Z

❌ Build nut 2.8.5.4903-master failed (commit a8c1fb5dd2 by @jimklimov)

artifacts (if any)

…nt.pl, tests/cpputest-client.cpp: only set "NUT_SSL=True" from AuthConf NUT_FORCESSL if no value is passed as envvar [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

…en if skipping other settings due to nutauth.conf [networkupstools#3329, networkupstools#1711] May neuter later in the method (e.g. perl lacking SSL module). Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

…nt.py.in: avoid Python 3 formatting strings [networkupstools#3229, networkupstools#1711] There is no reason for module to not work for older OS installations. Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

… names after creation (fix IPv6 address handling) [networkupstools#3229, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

…ly [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

… nutauth-openssl-perl-win.conf [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

…tworkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

… a list, not vector [networkupstools#3329] Memory-safer to extend and manipulate. Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

AppVeyorBot · 2026-06-30T13:46:52Z

✅ Build nut 2.8.5.4904-master completed (commit 81462e43ab by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4904-master.7z

AppVeyorBot · 2026-06-30T13:46:53Z

✅ Build nut 2.8.5.4904-master completed (commit 81462e43ab by @jimklimov)

…TVERIFY also in nutauth.conf [networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov@gmail.com>

AppVeyorBot · 2026-06-30T17:01:42Z

✅ Build nut 2.8.5.4905-master completed (commit b2bda9adb4 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4905-master.7z

…kupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

AppVeyorBot · 2026-06-30T19:07:11Z

❌ Build nut 2.8.5.4906-master failed (commit e397a14e21 by @jimklimov)

artifacts (if any)

AppVeyorBot · 2026-06-30T19:07:11Z

❌ Build nut 2.8.5.4906-master failed (commit e397a14e21 by @jimklimov)

AppVeyorBot · 2026-06-30T19:57:41Z

✅ Build nut 2.8.5.4907-master completed (commit e397a14e21 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4907-master.7z

AppVeyorBot · 2026-06-30T19:57:42Z

✅ Build nut 2.8.5.4907-master completed (commit e397a14e21 by @jimklimov)

…ackends [networkupstools#3331] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

-		memset(&(ups->openssl_cert_verify_data), 0, sizeof(ups->openssl_cert_verify_data));
+		if (ups->openssl_cert_verify_data != NULL
+		 && ups->openssl_cert_verify_data->hostname_allocated
+		 && ups->openssl_cert_verify_data->hostname


AppVeyorBot · 2026-07-10T07:25:09Z

✅ Build nut 2.8.5.4915-master completed (commit c6c0f87401 by @jimklimov)

artifacts
A 7-zip archive with built NUT for Windows debug binaries is temporarily available: NUT-for-Windows-x86_64-SNAPSHOT-2.8.5.4915-master.7z

jimklimov added this to the 2.8.6 milestone May 11, 2026

jimklimov added enhancement SSL/NSS Issues and PRs about SSL, TLS and other crypto-related matters AI For good or bad, machine tools are upon us. Humans are still the responsible ones. labels May 11, 2026

jimklimov force-pushed the issue-3329 branch from eecba0f to 7c25cb2 Compare May 11, 2026 20:21

jimklimov force-pushed the issue-3329 branch from 7c25cb2 to 19ec905 Compare May 11, 2026 23:34

jimklimov force-pushed the issue-3329 branch from 19ec905 to a6c2a53 Compare May 12, 2026 03:03

github-advanced-security AI found potential problems May 12, 2026

View reviewed changes

Comment thread clients/authconf.c Fixed

Comment thread clients/authconf.c Fixed

Comment thread tests/test_authconf.c Fixed

Comment thread tests/test_authconf.c Fixed

Comment thread tests/test_authconf.c Fixed

jimklimov force-pushed the issue-3329 branch from 971b433 to 8f973d9 Compare May 12, 2026 12:00

jimklimov force-pushed the issue-3329 branch from 8f973d9 to 7e4d524 Compare May 12, 2026 13:20

github-advanced-security AI found potential problems May 12, 2026

View reviewed changes

Comment thread clients/authconf.c Dismissed

Comment thread clients/authconf.c Fixed

Comment thread clients/authconf.c Fixed

jimklimov force-pushed the issue-3329 branch 2 times, most recently from 73a7249 to ed6f549 Compare May 12, 2026 14:05

jimklimov force-pushed the issue-3329 branch from ed6f549 to 7eafbf5 Compare May 12, 2026 16:12

github-advanced-security AI found potential problems May 12, 2026

View reviewed changes

Comment thread clients/authconf.c Fixed

jimklimov added 2 commits June 30, 2026 02:56

tests/cpputest-client.cpp: setUp(): fix env_NUT_CERTSTORE_PATH vs env…

c641a1e

…_NUT_CAPATH (nss vs openssl backend) [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

tests/cpputest-client.cpp: setUp(): fix env_NUT_CERTHOST_ADDR and env…

8646e48

…_NUT_CERTHOST_NAME [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

jimklimov force-pushed the issue-3329 branch from 9d91b90 to 817082e Compare June 30, 2026 00:56

jimklimov added 9 commits June 30, 2026 09:33

tests/NIT/nit.sh: setenv_ssl_*(): pass NUT_SSL=true for SSL builds ev…

116f2ee

…en if skipping other settings due to nutauth.conf [networkupstools#3329, networkupstools#1711] May neuter later in the method (e.g. perl lacking SSL module). Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

scripts/python/module/PyNUT.py.in, scripts/python/module/test_nutclie…

77d7c04

…nt.py.in: avoid Python 3 formatting strings [networkupstools#3229, networkupstools#1711] There is no reason for module to not work for older OS installations. Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

scripts/python/module/PyNUT.py.in: do not strip brackets from section…

6cc6aa8

… names after creation (fix IPv6 address handling) [networkupstools#3229, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

scripts/python/module/PyNUT.py.in: AI added "import getpass" needless…

473880f

…ly [networkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

tools/gitlog2changelog.py.in: fix unicode TypeError with python 2.7

92109e7

Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

tests/NIT/nit.sh: setenv_ssl_perl(): fix up paths on Windows in a new…

95a5172

… nutauth-openssl-perl-win.conf [networkupstools#3329, networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

clients/nutclient.cpp: SSLConfig::addCertHost(): avoid duplicates [ne…

87bc606

…tworkupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

clients/nutclient.{cpp,h}: fix AuthConf::authconf_list to be actually…

0869fa3

… a list, not vector [networkupstools#3329] Memory-safer to extend and manipulate. Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

jimklimov force-pushed the issue-3329 branch from 817082e to 0869fa3 Compare June 30, 2026 12:51

tests/NIT/nit.sh: setenv_ssl_perl(): in case of darwin OS, neuter CER…

08a2882

…TVERIFY also in nutauth.conf [networkupstools#1711] Signed-off-by: Jim Klimov <jimklimov@gmail.com>

clients/authconf.h: do not require nut_stdint.h in public API [networ…

cc93c59

…kupstools#3329] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

This was referenced Jun 30, 2026

Add support for NUT auth conf files networkupstools/wmnut#30

Open

NUT authconf support missing in NUT-Monitor GUI client #3514

Open

clients/upsclient.{c,h}: keep UPSCONN_t size same for different SSL b…

9688c11

…ackends [networkupstools#3331] Signed-off-by: Jim Klimov <jimklimov+nut@gmail.com>

github-advanced-security AI found potential problems Jul 10, 2026

View reviewed changes

Comment thread clients/upsclient.c

memset(&(ups->openssl_cert_verify_data), 0, sizeof(ups->openssl_cert_verify_data));

if (ups->openssl_cert_verify_data != NULL

&& ups->openssl_cert_verify_data->hostname_allocated

&& ups->openssl_cert_verify_data->hostname

Uh oh!

Uh oh!

Conversation

jimklimov commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

AppVeyorBot commented May 11, 2026

Uh oh!

AppVeyorBot commented May 11, 2026

Uh oh!

AppVeyorBot commented May 11, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

AppVeyorBot commented May 12, 2026

Uh oh!

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jun 30, 2026

Uh oh!

AppVeyorBot commented Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jimklimov commented May 11, 2026 •

edited

Loading

github-actions Bot commented May 11, 2026 •

edited

Loading