Merge 038297c into 276c0b7

jimklimov · web-flow · commit e63d4336c0f9 · 2025-03-20T01:04:43.000+01:00
diff --git a/NEWS.adoc b/NEWS.adoc
@@ -464,6 +464,8 @@ This requirement compromises usability of `make distcheck` on platforms without
    * `upsd_cleanup()` is now traced, to more easily see that the daemon is
      exiting (and/or start-up has aborted due to configuration or run-time
      issues). Warning about "world readable" files clarified. [#2417]
+   * Failure to `LISTEN` on an invalid host name (e.g. `localhost:3493` or
+     `1.2.3.4/24`) is now logged in a more actionable manner. [#2665]
 
  - nut-scanner:
    * the tool relies on dynamic loading of shared objects (library files)
diff --git a/docs/FAQ.txt b/docs/FAQ.txt
@@ -918,6 +918,52 @@ check if a custom build from Git (usually using the `master` branch
 of NUT https://github.com/networkupstools/nut/ repository) has your
 issue fixed by some kind soul already.
 
+== I can't connect with SSL using old NUT on an appliance
+
+Unfortunately, some vendors do not issue new firmwares often, and even more
+rarely do they significantly update any programs inside. It is not uncommon
+to see NUT versions over a decade old delivered with small NAS boxes, for
+example.
+
+This may impact not only NUT protocol compatibility, but also transport
+protocols such as SSL -- as cipher algorithms get outdated over time, and
+ones deemed insecure are no longer handled at all (by default).  This is
+not a problem limited to NUT: old SSH Key Exchange (kex) protocols or old
+HTTPS mechanisms also become hard or impossible to use eventually.
+
+On one hand, you can look into NUT configuration of `DISABLE_WEAK_SSL`.
+
+On another, you can modify configuration of the newer system to allow older
+algorithms as required by the older other system.
+
+For NUT built against OpenSSL, the change would be in `/etc/ssl/openssl.cnf`
+and similar to the diff block below:
+
+----
+--- a/etc/ssl/openssl.cnf
++++ b/etc/ssl/openssl.cnf
+@@ -52,13 +52,6 @@ tsa_policy3 = 1.2.3.4.5.7
+ 
+ [openssl_init]
+ providers = provider_sect
++ssl_conf = ssl_sect
++
++[ssl_sect]
++system_default = system_default_sect
++
++[system_default_sect]
++CipherString = DEFAULT@SECLEVEL=0
+ 
+ # List of providers to load
+ [provider_sect]
+----
+
+Of course, keep in mind that by doing this you degrade your security level.
+If better solutions are possible in your situation, prefer to follow them!
+
+Thanks to Kajetan Rzepecki for doing the research and posting the findings
+in https://github.com/networkupstools/nut/issues/1899
+
 == I built NUT from Git, and it complains about lots of missing files. What happened?
 
 If you are not actively developing a driver, can you use a snapshot instead?
diff --git a/docs/nut.dict b/docs/nut.dict
@@ -1,4 +1,4 @@
-personal_ws-1.1 en 3341 utf-8
+personal_ws-1.1 en 3347 utf-8
 AAC
 AAS
 ABI
@@ -205,6 +205,7 @@ Checksum
 Christoph
 Chu
 Cichowski
+CipherString
 CircleCI
 Claesson
 CodingStyle
@@ -566,6 +567,7 @@ KRTS
 KSTAR
 KTTS
 Kain
+Kajetan
 Kaminski
 Kanji
 Kazancev
@@ -1069,6 +1071,7 @@ RunAs
 RunUPSCommand
 RxD
 Ryabov
+Rzepecki
 SAI
 SASU
 SCM
@@ -1717,6 +1720,7 @@ cmdname
 cmdparam
 cmds
 cmdvartab
+cnf
 codebase
 codepath
 coldstarts
@@ -2217,6 +2221,7 @@ kVA
 kadets
 kaminski
 kde
+kex
 kext
 keychain
 keygen
@@ -3078,6 +3083,7 @@ tport
 tripplite
 tripplitesu
 troff
+tsa
 tsd
 tty
 ttyACM
diff --git a/server/upsd.c b/server/upsd.c
@@ -447,10 +447,10 @@ static void setuptcp(stype_t *server)
 
 	if ((v = getaddrinfo(server->addr, server->port, &hints, &res)) != 0) {
 		if (v == EAI_SYSTEM) {
-			fatal_with_errno(EXIT_FAILURE, "getaddrinfo");
+			fatal_with_errno(EXIT_FAILURE, "getaddrinfo('%s')", NUT_STRARG(server->addr));
 		}
 
-		fatalx(EXIT_FAILURE, "getaddrinfo: %s", gai_strerror(v));
+		fatalx(EXIT_FAILURE, "getaddrinfo('%s'): %s", NUT_STRARG(server->addr), gai_strerror(v));
 	}
 
 	for (ai = res; ai; ai = ai->ai_next) {

Original file line number	Diff line number	Diff line change
`@@ -447,10 +447,10 @@ static void setuptcp(stype_t *server)`
`447`	`447`
`448`	`448`	`if ((v = getaddrinfo(server->addr, server->port, &hints, &res)) != 0) {`
`449`	`449`	`if (v == EAI_SYSTEM) {`
`450`		`- fatal_with_errno(EXIT_FAILURE, "getaddrinfo");`
	`450`	`+ fatal_with_errno(EXIT_FAILURE, "getaddrinfo('%s')", NUT_STRARG(server->addr));`
`451`	`451`	`}`
`452`	`452`
`453`		`- fatalx(EXIT_FAILURE, "getaddrinfo: %s", gai_strerror(v));`
	`453`	`+ fatalx(EXIT_FAILURE, "getaddrinfo('%s'): %s", NUT_STRARG(server->addr), gai_strerror(v));`
`454`	`454`	`}`
`455`	`455`
`456`	`456`	`for (ai = res; ai; ai = ai->ai_next) {`