mirror of
https://github.com/curl/curl.git
synced 2026-08-25 00:03:33 +03:00
TLS: drop support for TLS-SRP
The options will simply do nothing. Closes #21965
This commit is contained in:
Daniel Stenberg
parent
d169ad68fa
commit
69ac867f98
63 changed files with 133 additions and 932 deletions
|
|
@ -224,9 +224,8 @@ the following way:
|
|||
|
||||
* When the set string starts with '+', '-' or '!' it is *appended* to the
|
||||
priority string libcurl itself generates (separated by ':'). This initial
|
||||
priority depends other settings such as CURLOPT_SSLVERSION(3),
|
||||
CURLOPT_TLSAUTH_USERNAME(3) (for SRP) or if HTTP/3 (QUIC)
|
||||
is being negotiated.
|
||||
priority depends other settings such as CURLOPT_SSLVERSION(3) or if HTTP/3
|
||||
(QUIC) is being negotiated.
|
||||
* Otherwise, the set string fully *replaces* the libcurl generated one. While
|
||||
giving full control to the application, the set priority needs to
|
||||
provide for everything the transfer may need to negotiate. Example: if
|
||||
|
|
|
|||
|
|
@ -12,14 +12,6 @@ email the
|
|||
as soon as possible and explain to us why this is a problem for you and
|
||||
how your use case cannot be satisfied properly using a workaround.
|
||||
|
||||
## TLS-SRP Authentication
|
||||
|
||||
Transport Layer Security Secure Remote Password is a TLS feature that does not
|
||||
work with TLS 1.3 or QUIC and is virtually unused by curl users and in
|
||||
general.
|
||||
|
||||
TLS-SRP support gets removed in August 2026.
|
||||
|
||||
## drop SMB support
|
||||
|
||||
The SMB protocol has weak security and is rarely used these days.
|
||||
|
|
@ -83,3 +75,4 @@ Local crypto gets removed in October 2026.
|
|||
- SMB (became opt-in in 8.20.0)
|
||||
- NTLM (became opt-in in 8.20.0)
|
||||
- c-ares < 1.16.0 (removed in 8.20.0)
|
||||
- TLS-SRP (removed in 8.22.0)
|
||||
|
|
|
|||
|
|
@ -299,7 +299,6 @@ target_link_libraries(my_target PRIVATE CURL::libcurl)
|
|||
- `CURL_DISABLE_SHUFFLE_DNS`: Disable shuffle DNS feature. Default: `OFF`
|
||||
- `CURL_DISABLE_SMTP`: Disable SMTP. Default: `OFF`
|
||||
- `CURL_DISABLE_SOCKETPAIR`: Disable use of socketpair for curl_multi_poll(). Default: `OFF`
|
||||
- `CURL_DISABLE_SRP`: Disable TLS-SRP support. Default: `OFF`
|
||||
- `CURL_DISABLE_TELNET`: Disable Telnet. Default: `OFF`
|
||||
- `CURL_DISABLE_TFTP`: Disable TFTP. Default: `OFF`
|
||||
- `CURL_DISABLE_TYPECHECK`: Disable curl_easy_setopt()/curl_easy_getinfo() type checking. Default: `OFF`
|
||||
|
|
@ -516,11 +515,9 @@ the parent project, ideally in the "extra" find package redirect file:
|
|||
Available variables:
|
||||
|
||||
- `HAVE_DES_ECB_ENCRYPT`: `DES_ecb_encrypt` present in OpenSSL (or fork).
|
||||
- `HAVE_GNUTLS_SRP`: `gnutls_srp_verifier` present in GnuTLS.
|
||||
- `HAVE_LDAP_INIT_FD`: `ldap_init_fd` present in LDAP library.
|
||||
- `HAVE_LDAP_URL_PARSE`: `ldap_url_parse` present in LDAP library.
|
||||
- `HAVE_MBEDTLS_DES_CRYPT_ECB`: `mbedtls_des_crypt_ecb` present in mbedTLS <4.
|
||||
- `HAVE_OPENSSL_SRP`: `SSL_CTX_set_srp_username` present in OpenSSL (or fork).
|
||||
- `HAVE_QUICHE_CONN_SET_QLOG_FD`: `quiche_conn_set_qlog_fd` present in quiche.
|
||||
- `HAVE_RUSTLS_SUPPORTED_HPKE`: `rustls_supported_hpke` present in Rustls
|
||||
(unused if Rustls is detected via `pkg-config`).
|
||||
|
|
|
|||
|
|
@ -634,7 +634,6 @@ disabling support for some features (run `./configure --help` to see them all):
|
|||
- `--disable-proxy` (HTTP and SOCKS proxies)
|
||||
- `--disable-socketpair` (socketpair for asynchronous name resolving)
|
||||
- `--disable-threaded-resolver` (threaded name resolver)
|
||||
- `--disable-tls-srp` (Secure Remote Password authentication for TLS)
|
||||
- `--disable-unix-sockets` (Unix sockets)
|
||||
- `--disable-verbose` (eliminates debugging strings and error code strings)
|
||||
- `--disable-versioned-symbols` (versioned symbols)
|
||||
|
|
|
|||
|
|
@ -17,6 +17,8 @@ Example:
|
|||
|
||||
# `--proxy-tlsauthtype`
|
||||
|
||||
Deprecated option. This has no functionality since 8.22.0.
|
||||
|
||||
Set TLS authentication type with HTTPS proxy. The only supported option is
|
||||
`SRP`, for TLS-SRP (RFC 5054). This option works only if the underlying
|
||||
libcurl is built with TLS-SRP support.
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ Example:
|
|||
|
||||
# `--proxy-tlspassword`
|
||||
|
||||
Deprecated option. This has no functionality since 8.22.0.
|
||||
|
||||
Set password to use with the TLS authentication method specified with
|
||||
--proxy-tlsauthtype when using HTTPS proxy. Requires that --proxy-tlsuser is
|
||||
set.
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ Example:
|
|||
|
||||
# `--proxy-tlsuser`
|
||||
|
||||
Deprecated option. This has no functionality since 8.22.0.
|
||||
|
||||
Set username for use for HTTPS proxy with the TLS authentication method
|
||||
specified with --proxy-tlsauthtype. Requires that --proxy-tlspassword also is
|
||||
set.
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ Example:
|
|||
|
||||
# `--tlsauthtype`
|
||||
|
||||
Deprecated option. This has no functionality since 8.22.0.
|
||||
|
||||
Set TLS authentication type. Currently, the only supported option is `SRP`,
|
||||
for TLS-SRP (RFC 5054). If --tlsuser and --tlspassword are specified but
|
||||
--tlsauthtype is not, then this option defaults to `SRP`. This option works
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ Example:
|
|||
|
||||
# `--tlspassword`
|
||||
|
||||
Deprecated option. This has no functionality since 8.22.0.
|
||||
|
||||
Set password to use with the TLS authentication method specified with
|
||||
--tlsauthtype. Requires that --tlsuser is set.
|
||||
|
||||
|
|
|
|||
|
|
@ -16,6 +16,8 @@ Example:
|
|||
|
||||
# `--tlsuser`
|
||||
|
||||
Deprecated option. This has no functionality since 8.22.0.
|
||||
|
||||
Set username for use with the TLS authentication method specified with
|
||||
--tlsauthtype. Requires that --tlspassword also is set.
|
||||
|
||||
|
|
|
|||
|
|
@ -121,9 +121,6 @@ This build supports TLS session export/import, like with the --ssl-sessions.
|
|||
## `SSPI`
|
||||
SSPI is supported.
|
||||
|
||||
## `TLS-SRP`
|
||||
SRP (Secure Remote Password) authentication is supported for TLS.
|
||||
|
||||
## `Unicode`
|
||||
Unicode support on Windows.
|
||||
|
||||
|
|
|
|||
|
|
@ -55,9 +55,7 @@ Examples:
|
|||
Different configurations produce different keys which is what curl needs when
|
||||
handling SSL session tickets.
|
||||
|
||||
One important thing: peer keys do not contain confidential information. If you
|
||||
configure a client certificate or SRP authentication with username/password,
|
||||
these are not part of the peer key.
|
||||
One important thing: peer keys do not contain confidential information.
|
||||
|
||||
Peer keys carry the hostnames you use curl for. They *do* leak the privacy of
|
||||
your communication. We recommend to *not* persist peer keys for this reason.
|
||||
|
|
@ -76,10 +74,9 @@ its own peer_key and calls into the cache. The cache then looks for a ticket
|
|||
with exactly this peer_key. Peer keys between proxy SSL filters and SSL
|
||||
filters talking through a tunnel differ, as they talk to different peers.
|
||||
|
||||
If the connection filter wants to use a client certificate or SRP
|
||||
authentication, the cache checks those as well. If the cache peer carries
|
||||
client cert or SRP auth, the connection filter must have those with the same
|
||||
values (and vice versa).
|
||||
If the connection filter wants to use a client certificate, the cache checks
|
||||
those as well. If the cache peer carries client certs, the connection filter
|
||||
must have those with the same values (and vice versa).
|
||||
|
||||
On a match, the connection filter gets the session ticket and feeds that to
|
||||
the TLS implementation which, on accepting it, tries to resume it for a
|
||||
|
|
|
|||
|
|
@ -867,15 +867,18 @@ Proxy TLS 1.3 cipher suites to use. See CURLOPT_PROXY_TLS13_CIPHERS(3)
|
|||
|
||||
## CURLOPT_PROXY_TLSAUTH_PASSWORD
|
||||
|
||||
Proxy TLS authentication password. See CURLOPT_PROXY_TLSAUTH_PASSWORD(3)
|
||||
**Deprecated option**. Proxy TLS authentication password. See
|
||||
CURLOPT_PROXY_TLSAUTH_PASSWORD(3)
|
||||
|
||||
## CURLOPT_PROXY_TLSAUTH_TYPE
|
||||
|
||||
Proxy TLS authentication methods. See CURLOPT_PROXY_TLSAUTH_TYPE(3)
|
||||
**Deprecated option**. Proxy TLS authentication methods. See
|
||||
CURLOPT_PROXY_TLSAUTH_TYPE(3)
|
||||
|
||||
## CURLOPT_PROXY_TLSAUTH_USERNAME
|
||||
|
||||
Proxy TLS authentication username. See CURLOPT_PROXY_TLSAUTH_USERNAME(3)
|
||||
**Deprecated option**. Proxy TLS authentication username. See
|
||||
CURLOPT_PROXY_TLSAUTH_USERNAME(3)
|
||||
|
||||
## CURLOPT_PROXY_TRANSFER_MODE
|
||||
|
||||
|
|
@ -1244,15 +1247,16 @@ TLS 1.3 cipher suites to use. See CURLOPT_TLS13_CIPHERS(3)
|
|||
|
||||
## CURLOPT_TLSAUTH_PASSWORD
|
||||
|
||||
TLS authentication password. See CURLOPT_TLSAUTH_PASSWORD(3)
|
||||
**Deprecated option**. TLS authentication password. See CURLOPT_TLSAUTH_PASSWORD(3)
|
||||
|
||||
## CURLOPT_TLSAUTH_TYPE
|
||||
|
||||
TLS authentication methods. See CURLOPT_TLSAUTH_TYPE(3)
|
||||
**Deprecated option**. TLS authentication methods. See CURLOPT_TLSAUTH_TYPE(3)
|
||||
|
||||
## CURLOPT_TLSAUTH_USERNAME
|
||||
|
||||
TLS authentication username. See CURLOPT_TLSAUTH_USERNAME(3)
|
||||
**Deprecated option**. TLS authentication username. See
|
||||
CURLOPT_TLSAUTH_USERNAME(3)
|
||||
|
||||
## CURLOPT_TRAILERDATA
|
||||
|
||||
|
|
|
|||
|
|
@ -60,8 +60,7 @@ persisted: either **session_key** or **shamc** and always **sdata**. All
|
|||
other parameters are informative, e.g. allow the callback to act only
|
||||
on specific session tickets.
|
||||
|
||||
Note that SSL sessions that involve a client certificate or SRP
|
||||
username/password are not exported.
|
||||
Note that SSL sessions that involve a client certificate are not exported.
|
||||
|
||||
# Export Function Parameter
|
||||
|
||||
|
|
|
|||
|
|
@ -47,6 +47,10 @@ previous ones. Set it to NULL to disable its use again.
|
|||
|
||||
NULL
|
||||
|
||||
# DEPRECATED
|
||||
|
||||
This option was deprecated in 8.22.0.
|
||||
|
||||
# %PROTOCOLS%
|
||||
|
||||
# EXAMPLE
|
||||
|
|
|
|||
|
|
@ -54,6 +54,10 @@ options.
|
|||
|
||||
blank
|
||||
|
||||
# DEPRECATED
|
||||
|
||||
This option was deprecated in 8.22.0.
|
||||
|
||||
# %PROTOCOLS%
|
||||
|
||||
# EXAMPLE
|
||||
|
|
|
|||
|
|
@ -47,6 +47,10 @@ previous ones. Set it to NULL to disable its use again.
|
|||
|
||||
NULL
|
||||
|
||||
# DEPRECATED
|
||||
|
||||
This option was deprecated in 8.22.0.
|
||||
|
||||
# %PROTOCOLS%
|
||||
|
||||
# EXAMPLE
|
||||
|
|
|
|||
|
|
@ -30,6 +30,8 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_PASSWORD, char *pwd);
|
|||
|
||||
# DESCRIPTION
|
||||
|
||||
Deprecated option. It serves no purpose anymore.
|
||||
|
||||
Pass a char pointer as parameter, which should point to the null-terminated
|
||||
password to use for the TLS authentication method specified with the
|
||||
CURLOPT_TLSAUTH_TYPE(3) option. Requires that the CURLOPT_TLSAUTH_USERNAME(3)
|
||||
|
|
@ -47,6 +49,10 @@ This feature relies on TLS-SRP which does not work with TLS 1.3.
|
|||
|
||||
NULL
|
||||
|
||||
# DEPRECATED
|
||||
|
||||
This option was deprecated in 8.22.0.
|
||||
|
||||
# %PROTOCOLS%
|
||||
|
||||
# EXAMPLE
|
||||
|
|
|
|||
|
|
@ -29,6 +29,8 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_TYPE, char *type);
|
|||
|
||||
# DESCRIPTION
|
||||
|
||||
Deprecated option. It serves no purpose anymore.
|
||||
|
||||
Pass a pointer to a null-terminated string as parameter. The string should be
|
||||
the method of the TLS authentication. Supported method is "SRP".
|
||||
|
||||
|
|
@ -51,6 +53,10 @@ TLS-SRP does not work with TLS 1.3.
|
|||
|
||||
blank
|
||||
|
||||
# DEPRECATED
|
||||
|
||||
This option was deprecated in 8.22.0.
|
||||
|
||||
# %PROTOCOLS%
|
||||
|
||||
# EXAMPLE
|
||||
|
|
|
|||
|
|
@ -29,6 +29,8 @@ CURLcode curl_easy_setopt(CURL *handle, CURLOPT_TLSAUTH_USERNAME, char *user);
|
|||
|
||||
# DESCRIPTION
|
||||
|
||||
Deprecated option. It serves no purpose anymore.
|
||||
|
||||
Pass a char pointer as parameter, which should point to the null-terminated
|
||||
username to use for the TLS authentication method specified with the
|
||||
CURLOPT_TLSAUTH_TYPE(3) option. Requires that the CURLOPT_TLSAUTH_PASSWORD(3)
|
||||
|
|
@ -46,6 +48,10 @@ This feature relies on TLS-SRP which does not work with TLS 1.3.
|
|||
|
||||
NULL
|
||||
|
||||
# DEPRECATED
|
||||
|
||||
This option was deprecated in 8.22.0.
|
||||
|
||||
# %PROTOCOLS%
|
||||
|
||||
# EXAMPLE
|
||||
|
|
|
|||
|
|
@ -151,8 +151,8 @@ CURL_TIMECOND_IFMODSINCE 7.9.7
|
|||
CURL_TIMECOND_IFUNMODSINCE 7.9.7
|
||||
CURL_TIMECOND_LASTMOD 7.9.7
|
||||
CURL_TIMECOND_NONE 7.9.7
|
||||
CURL_TLSAUTH_NONE 7.21.4
|
||||
CURL_TLSAUTH_SRP 7.21.4
|
||||
CURL_TLSAUTH_NONE 7.21.4 8.22.0
|
||||
CURL_TLSAUTH_SRP 7.21.4 8.22.0
|
||||
CURL_TRAILERFUNC_ABORT 7.64.0
|
||||
CURL_TRAILERFUNC_OK 7.64.0
|
||||
CURL_UPKEEP_INTERVAL_DEFAULT 7.62.0
|
||||
|
|
@ -184,7 +184,7 @@ CURL_VERSION_SPNEGO 7.10.8
|
|||
CURL_VERSION_SSL 7.10
|
||||
CURL_VERSION_SSPI 7.13.2
|
||||
CURL_VERSION_THREADSAFE 7.84.0
|
||||
CURL_VERSION_TLSAUTH_SRP 7.21.4
|
||||
CURL_VERSION_TLSAUTH_SRP 7.21.4 8.22.0
|
||||
CURL_VERSION_UNICODE 7.72.0
|
||||
CURL_VERSION_UNIX_SOCKETS 7.40.0
|
||||
CURL_VERSION_ZSTD 7.72.0
|
||||
|
|
@ -791,9 +791,9 @@ CURLOPT_PROXY_SSLKEY_BLOB 7.71.0
|
|||
CURLOPT_PROXY_SSLKEYTYPE 7.52.0
|
||||
CURLOPT_PROXY_SSLVERSION 7.52.0
|
||||
CURLOPT_PROXY_TLS13_CIPHERS 7.61.0
|
||||
CURLOPT_PROXY_TLSAUTH_PASSWORD 7.52.0
|
||||
CURLOPT_PROXY_TLSAUTH_TYPE 7.52.0
|
||||
CURLOPT_PROXY_TLSAUTH_USERNAME 7.52.0
|
||||
CURLOPT_PROXY_TLSAUTH_PASSWORD 7.52.0 8.22.0
|
||||
CURLOPT_PROXY_TLSAUTH_TYPE 7.52.0 8.22.0
|
||||
CURLOPT_PROXY_TLSAUTH_USERNAME 7.52.0 8.22.0
|
||||
CURLOPT_PROXY_TRANSFER_MODE 7.18.0
|
||||
CURLOPT_PROXYAUTH 7.10.7
|
||||
CURLOPT_PROXYHEADER 7.37.0
|
||||
|
|
@ -901,9 +901,9 @@ CURLOPT_TIMEOUT_MS 7.16.2
|
|||
CURLOPT_TIMEVALUE 7.1
|
||||
CURLOPT_TIMEVALUE_LARGE 7.59.0
|
||||
CURLOPT_TLS13_CIPHERS 7.61.0
|
||||
CURLOPT_TLSAUTH_PASSWORD 7.21.4
|
||||
CURLOPT_TLSAUTH_TYPE 7.21.4
|
||||
CURLOPT_TLSAUTH_USERNAME 7.21.4
|
||||
CURLOPT_TLSAUTH_PASSWORD 7.21.4 8.22.0
|
||||
CURLOPT_TLSAUTH_TYPE 7.21.4 8.22.0
|
||||
CURLOPT_TLSAUTH_USERNAME 7.21.4 8.22.0
|
||||
CURLOPT_TRAILERDATA 7.64.0
|
||||
CURLOPT_TRAILERFUNCTION 7.64.0
|
||||
CURLOPT_TRANSFER_ENCODING 7.21.6
|
||||
|
|
|
|||
|
|
@ -445,8 +445,6 @@ What server(s) this test case requires/uses. Available servers:
|
|||
- `https`
|
||||
- `https-proxy`
|
||||
- `https-mtls`
|
||||
- `httptls+srp`
|
||||
- `httptls+srp-ipv6`
|
||||
- `http-unix`
|
||||
- `imap`
|
||||
- `mqtt`
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue