romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-08-26 02:23:31 +03:00
Code Issues Projects Releases Packages Wiki Activity

TLS: drop support for TLS-SRP

Browse source 
The options will simply do nothing.

Closes #21965
This commit is contained in:
Daniel Stenberg 2026-07-04 12:19:47 +02:00
parent d169ad68fa
commit 69ac867f98
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
63 changed files with 133 additions and 932 deletions
Download patch file Download diff file Expand all files Collapse all files

9
lib/curl_config-cmake.h.in
View file

@ -770,15 +770,6 @@ ${SIZEOF_TIME_T_CODE}
/* to enable Apple OS-native certificate verification */
#cmakedefine USE_APPLE_SECTRUST 1
/* Define to 1 if OpenSSL has the SSL_CTX_set_srp_username function. */
#cmakedefine HAVE_OPENSSL_SRP 1
/* Define to 1 if GnuTLS has the gnutls_srp_verifier function. */
#cmakedefine HAVE_GNUTLS_SRP 1
/* Define to 1 to enable TLS-SRP support. */
#cmakedefine USE_TLS_SRP 1
/* Define to 1 to query for HTTPSRR when using DoH */
#cmakedefine USE_HTTPSRR 1

2
lib/curl_setup.h
View file

@ -1577,7 +1577,7 @@ typedef struct sockaddr_un {
#ifdef USE_OPENSSL
/* OpenSSL 3 marks these functions deprecated but we have no replacements (yet)
so tell the compiler to not warn for them:
- DES_* (for NTLM), SSL_CTX_set_srp_* (for TLS-SRP)
- DES_* (for NTLM)
- EVP_PKEY_get1_RSA, MD5_*, RSA_flags, RSA_free (auto-skipped for OpenSSL
built with no-deprecated) */
# define OPENSSL_SUPPRESS_DEPRECATED

15
lib/setopt.c
View file

@ -2404,26 +2404,13 @@ static CURLcode setopt_cptr_misc(struct Curl_easy *data, CURLoption option,
s->rtp_out = ptr;
break;
#endif /* !CURL_DISABLE_RTSP */
#ifdef USE_TLS_SRP
case CURLOPT_TLSAUTH_USERNAME:
return Curl_setstropt(&s->str[STRING_TLSAUTH_USERNAME], ptr);
case CURLOPT_TLSAUTH_PASSWORD:
return Curl_setstropt(&s->str[STRING_TLSAUTH_PASSWORD], ptr);
case CURLOPT_TLSAUTH_TYPE:
if(ptr && !curl_strequal(ptr, "SRP"))
result = CURLE_BAD_FUNCTION_ARGUMENT;
break;
#ifndef CURL_DISABLE_PROXY
case CURLOPT_PROXY_TLSAUTH_USERNAME:
return Curl_setstropt(&s->str[STRING_TLSAUTH_USERNAME_PROXY], ptr);
case CURLOPT_PROXY_TLSAUTH_PASSWORD:
return Curl_setstropt(&s->str[STRING_TLSAUTH_PASSWORD_PROXY], ptr);
case CURLOPT_PROXY_TLSAUTH_TYPE:
if(ptr && !curl_strequal(ptr, "SRP"))
result = CURLE_BAD_FUNCTION_ARGUMENT;
break;
#endif
#endif
return CURLE_NOT_BUILT_IN;
#ifndef CURL_DISABLE_HSTS
case CURLOPT_HSTSREADDATA:
s->hsts_read_userp = ptr;

8
lib/urldata.h
View file

@ -835,14 +835,6 @@ enum dupstring {
#ifndef CURL_DISABLE_SMTP
STRING_MAIL_FROM,
STRING_MAIL_AUTH,
#endif
#ifdef USE_TLS_SRP
STRING_TLSAUTH_USERNAME, /* TLS auth <username> */
STRING_TLSAUTH_PASSWORD, /* TLS auth <password> */
#ifndef CURL_DISABLE_PROXY
STRING_TLSAUTH_USERNAME_PROXY, /* TLS auth <username> */
STRING_TLSAUTH_PASSWORD_PROXY, /* TLS auth <password> */
#endif
#endif
STRING_BEARER, /* <bearer>, if used */
#ifdef USE_UNIX_SOCKETS

3
lib/version.c
View file

@ -521,9 +521,6 @@ static const struct feat features_table[] = {
#ifdef GLOBAL_INIT_IS_THREADSAFE
FEATURE("threadsafe", NULL, CURL_VERSION_THREADSAFE),
#endif
#ifdef USE_TLS_SRP
FEATURE("TLS-SRP", NULL, CURL_VERSION_TLSAUTH_SRP),
#endif
#if defined(_WIN32) && defined(UNICODE) && defined(_UNICODE)
FEATURE("Unicode", NULL, CURL_VERSION_UNICODE),
#endif

93
lib/vtls/gtls.c
View file

@ -313,10 +313,6 @@ static gnutls_x509_crt_fmt_t gnutls_do_file_type(const char *type)
#define GNUTLS_CIPHERS "NORMAL:%PROFILE_MEDIUM:-ARCFOUR-128:" \
"-CTYPE-ALL:+CTYPE-X509"
/* If GnuTLS was compiled without support for SRP it errors out if SRP is
requested in the priority string, so treat it specially
*/
#define GNUTLS_SRP "+SRP"
#define QUIC_PRIORITY \
"NORMAL:%PROFILE_MEDIUM:-VERS-ALL:+VERS-TLS1.3:-CIPHER-ALL:+AES-128-GCM:" \
@ -846,19 +842,6 @@ static CURLcode gtls_set_priority(struct Curl_cfilter *cf,
curlx_dyn_init(&buf, 4096);
#ifdef USE_GNUTLS_SRP
if(conn_config->username) {
/* Only add SRP to the cipher list if SRP is requested. Otherwise
* GnuTLS disables TLS 1.3 support. */
result = curlx_dyn_add(&buf, priority);
if(!result)
result = curlx_dyn_add(&buf, ":" GNUTLS_SRP);
if(result)
goto out;
priority = curlx_dyn_ptr(&buf);
}
#endif
if(conn_config->cipher_list) {
if((conn_config->cipher_list[0] == '+') ||
(conn_config->cipher_list[0] == '-') ||
@ -915,33 +898,6 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
if(result)
return result;
#ifdef USE_GNUTLS_SRP
if(config->username && Curl_auth_allowed_to_host(data)) {
infof(data, "Using TLS-SRP username: %s", config->username);
rc = gnutls_srp_allocate_client_credentials(&gtls->srp_client_cred);
if(rc == GNUTLS_E_UNIMPLEMENTED_FEATURE) {
failf(data, "GnuTLS: TLS-SRP support not built in: %s",
gnutls_strerror(rc));
return CURLE_NOT_BUILT_IN;
}
else if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_srp_allocate_client_cred() failed: %s",
gnutls_strerror(rc));
return CURLE_OUT_OF_MEMORY;
}
rc = gnutls_srp_set_client_credentials(gtls->srp_client_cred,
config->username,
config->password);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_srp_set_client_cred() failed: %s",
gnutls_strerror(rc));
return CURLE_BAD_FUNCTION_ARGUMENT;
}
}
#endif
ssl_config->certverifyresult = 0;
/* Initialize TLS session as a client */
@ -1056,25 +1012,11 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
}
}
#ifdef USE_GNUTLS_SRP
/* put the credentials to the current session */
if(config->username) {
rc = gnutls_credentials_set(gtls->session, GNUTLS_CRD_SRP,
gtls->srp_client_cred);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_credentials_set() failed: %s", gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR;
}
}
else
#endif
{
rc = gnutls_credentials_set(gtls->session, GNUTLS_CRD_CERTIFICATE,
gtls->shared_creds->creds);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_credentials_set() failed: %s", gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR;
}
rc = gnutls_credentials_set(gtls->session, GNUTLS_CRD_CERTIFICATE,
gtls->shared_creds->creds);
if(rc != GNUTLS_E_SUCCESS) {
failf(data, "gnutls_credentials_set() failed: %s", gnutls_strerror(rc));
return CURLE_SSL_CONNECT_ERROR;
}
if(config->verifystatus) {
@ -1728,21 +1670,10 @@ CURLcode Curl_gtls_verifyserver(struct Curl_cfilter *cf,
if(config->verifypeer ||
config->verifyhost ||
config->issuercert) {
#ifdef USE_GNUTLS_SRP
if(ssl_config->primary.username && !config->verifypeer &&
gnutls_cipher_get(session)) {
/* no peer cert, but auth is ok if we have SRP user and cipher and no
peer verify */
}
else {
#endif
failf(data, "failed to get server cert");
*certverifyresult = GNUTLS_E_NO_CERTIFICATE_FOUND;
result = CURLE_PEER_FAILED_VERIFICATION;
goto out;
#ifdef USE_GNUTLS_SRP
}
#endif
failf(data, "failed to get server cert");
*certverifyresult = GNUTLS_E_NO_CERTIFICATE_FOUND;
result = CURLE_PEER_FAILED_VERIFICATION;
goto out;
}
infof(data, " common name: WARNING could not obtain");
}
@ -2275,12 +2206,6 @@ static void gtls_close(struct Curl_cfilter *cf,
if(backend->gtls.shared_creds) {
Curl_gtls_shared_creds_free(&backend->gtls.shared_creds);
}
#ifdef USE_GNUTLS_SRP
if(backend->gtls.srp_client_cred) {
gnutls_srp_free_client_credentials(backend->gtls.srp_client_cred);
backend->gtls.srp_client_cred = NULL;
}
#endif
}
static CURLcode gtls_recv(struct Curl_cfilter *cf,

11
lib/vtls/gtls.h
View file

@ -31,14 +31,6 @@
#include "curlx/timeval.h"
#ifdef HAVE_GNUTLS_SRP
/* the function exists */
#ifdef USE_TLS_SRP
/* the functionality is not disabled */
#define USE_GNUTLS_SRP
#endif
#endif
struct Curl_easy;
struct Curl_cfilter;
struct alpn_spec;
@ -64,9 +56,6 @@ void Curl_gtls_shared_creds_free(struct gtls_shared_creds **pcreds);
struct gtls_ctx {
gnutls_session_t session;
struct gtls_shared_creds *shared_creds;
#ifdef USE_GNUTLS_SRP
gnutls_srp_client_credentials_t srp_client_cred;
#endif
CURLcode io_result; /* result of last IO cfilter operation */
BIT(sent_shutdown);
};

25
lib/vtls/openssl.c
View file

@ -3935,31 +3935,6 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
}
#endif
#if defined(HAVE_OPENSSL_SRP) && defined(USE_TLS_SRP)
if(ssl_config->primary.username && Curl_auth_allowed_to_host(data)) {
char * const ssl_username = ssl_config->primary.username;
char * const ssl_password = ssl_config->primary.password;
infof(data, "Using TLS-SRP username: %s", ssl_username);
if(!SSL_CTX_set_srp_username(octx->ssl_ctx, ssl_username)) {
failf(data, "Unable to set SRP username");
return CURLE_BAD_FUNCTION_ARGUMENT;
}
if(!SSL_CTX_set_srp_password(octx->ssl_ctx, ssl_password)) {
failf(data, "failed setting SRP password");
return CURLE_BAD_FUNCTION_ARGUMENT;
}
if(!conn_config->cipher_list) {
infof(data, "Setting cipher list SRP");
if(!SSL_CTX_set_cipher_list(octx->ssl_ctx, "SRP")) {
failf(data, "failed setting SRP cipher list");
return CURLE_SSL_CIPHER;
}
}
}
#endif /* HAVE_OPENSSL_SRP && USE_TLS_SRP */
/* OpenSSL always tries to verify the peer. By setting the failure mode
* to NONE, we allow the connect to complete, regardless of the outcome.
* We then explicitly check the result and may try alternatives like

27
lib/vtls/vtls_config.c
View file

@ -133,10 +133,6 @@ void Curl_ssl_config_cleanup(struct ssl_primary_config *sslc)
curlx_safefree(sslc->key);
curlx_safefree(sslc->key_type);
curlx_safefree(sslc->key_passwd);
#ifdef USE_TLS_SRP
curlx_safefree(sslc->username);
curlx_safefree(sslc->password);
#endif
sslc->deep_copy = FALSE;
}
}
@ -160,10 +156,6 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
Curl_safecmp(c1->CAfile, c2->CAfile) &&
Curl_safecmp(c1->issuercert, c2->issuercert) &&
Curl_safecmp(c1->clientcert, c2->clientcert) &&
#ifdef USE_TLS_SRP
!Curl_timestrcmp(c1->username, c2->username) &&
!Curl_timestrcmp(c1->password, c2->password) &&
#endif
curl_strequal(c1->cipher_list, c2->cipher_list) &&
curl_strequal(c1->cipher_list13, c2->cipher_list13) &&
curl_strequal(c1->curves, c2->curves) &&
@ -219,18 +211,13 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
CLONE_STRING(curves);
CLONE_STRING(signature_algorithms);
CLONE_STRING(CRLfile);
/* SSL credentials: client certificate, SRP auth */
/* SSL credentials: client certificate */
CLONE_STRING(clientcert);
CLONE_STRING(cert_type);
CLONE_STRING(key);
CLONE_STRING(key_type);
CLONE_STRING(key_passwd);
CLONE_BLOB(key_blob);
#ifdef USE_TLS_SRP
CLONE_STRING(username);
CLONE_STRING(password);
#endif
return TRUE;
}
@ -307,10 +294,6 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD];
sslc->primary.clientcert = data->set.str[STRING_CERT];
sslc->primary.key_blob = data->set.blobs[BLOB_KEY];
#ifdef USE_TLS_SRP
sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME];
sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD];
#endif
}
else {
sslc->primary.pinned_key = NULL;
@ -321,10 +304,6 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
sslc->primary.key_passwd = NULL;
sslc->primary.clientcert = NULL;
sslc->primary.key_blob = NULL;
#ifdef USE_TLS_SRP
sslc->primary.username = NULL;
sslc->primary.password = NULL;
#endif
}
#ifndef CURL_DISABLE_PROXY
@ -370,10 +349,6 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
sslc->primary.key_passwd = data->set.str[STRING_KEY_PASSWD_PROXY];
sslc->primary.clientcert = data->set.str[STRING_CERT_PROXY];
sslc->primary.key_blob = data->set.blobs[BLOB_KEY_PROXY];
#ifdef USE_TLS_SRP
sslc->primary.username = data->set.str[STRING_TLSAUTH_USERNAME_PROXY];
sslc->primary.password = data->set.str[STRING_TLSAUTH_PASSWORD_PROXY];
#endif
#endif /* CURL_DISABLE_PROXY */
return CURLE_OK;

4
lib/vtls/vtls_config.h
View file

@ -47,10 +47,6 @@ struct ssl_primary_config {
struct curl_blob *ca_info_blob;
struct curl_blob *issuercert_blob;
struct curl_blob *key_blob;
#ifdef USE_TLS_SRP
char *username; /* TLS username (for, e.g., SRP) */
char *password; /* TLS password (for, e.g., SRP) */
#endif
char *curves; /* list of curves to use */
uint32_t version_max; /* max supported version the client wants to use */
uint8_t ssl_options; /* the CURLOPT_SSL_OPTIONS bitmask */

45
lib/vtls/vtls_scache.c
View file

@ -51,8 +51,6 @@ struct Curl_ssl_scache_peer {
char *ssl_peer_key; /* id for peer + relevant TLS configuration */
char *clientcert;
char *key_passwd;
char *srp_username;
char *srp_password;
struct Curl_llist sessions;
void *sobj; /* object instance or NULL */
Curl_ssl_scache_obj_dtor *sobj_free; /* free `sobj` callback */
@ -321,13 +319,6 @@ static CURLcode ssl_peer_key_build(struct ssl_primary_config *ssl,
result = cf_ssl_peer_key_add_mtls(&buf, ssl, &is_local);
if(result)
goto out;
#ifdef USE_TLS_SRP
if(ssl->username || ssl->password) {
result = curlx_dyn_add(&buf, ":SRP-AUTH");
if(result)
goto out;
}
#endif
if(!tls_id || !tls_id[0]) {
result = CURLE_FAILED_INIT;
@ -516,10 +507,6 @@ static void cf_ssl_scache_clear_peer(struct Curl_ssl_scache_peer *peer)
peer->sobj_free = NULL;
curlx_safefree(peer->clientcert);
curlx_safefree(peer->key_passwd);
#ifdef USE_TLS_SRP
curlx_safefree(peer->srp_username);
curlx_safefree(peer->srp_password);
#endif
curlx_safefree(peer->ssl_peer_key);
peer->age = 0;
peer->hmac_set = FALSE;
@ -545,7 +532,6 @@ static void cf_ssl_cache_peer_update(struct Curl_ssl_scache_peer *peer)
* imported using only the salt+hmac
* - the peer key is global, e.g. carrying no relative paths */
peer->exportable = (!peer->clientcert && !peer->key_passwd &&
!peer->srp_username && !peer->srp_password &&
(!peer->ssl_peer_key ||
cf_ssl_peer_key_is_global(peer->ssl_peer_key)));
}
@ -554,8 +540,6 @@ static CURLcode cf_ssl_scache_peer_init(struct Curl_ssl_scache_peer *peer,
const char *ssl_peer_key,
const char *clientcert,
const char *key_passwd,
const char *srp_username,
const char *srp_password,
const unsigned char *salt,
const unsigned char *hmac)
{
@ -587,17 +571,6 @@ static CURLcode cf_ssl_scache_peer_init(struct Curl_ssl_scache_peer *peer,
if(!peer->key_passwd)
goto out;
}
if(srp_username) {
peer->srp_username = curlx_strdup(srp_username);
if(!peer->srp_username)
goto out;
}
if(srp_password) {
peer->srp_password = curlx_strdup(srp_password);
if(!peer->srp_password)
goto out;
}
cf_ssl_cache_peer_update(peer);
result = CURLE_OK;
out:
@ -730,21 +703,12 @@ static bool cf_ssl_scache_match_auth(struct Curl_ssl_scache_peer *peer,
if(!conn_config) {
if(peer->clientcert || peer->key_passwd)
return FALSE;
#ifdef USE_TLS_SRP
if(peer->srp_username || peer->srp_password)
return FALSE;
#endif
return TRUE;
}
else if(!Curl_safecmp(peer->clientcert, conn_config->clientcert))
return FALSE;
if(Curl_timestrcmp(peer->key_passwd, conn_config->key_passwd))
return FALSE;
#ifdef USE_TLS_SRP
if(Curl_timestrcmp(peer->srp_username, conn_config->username) ||
Curl_timestrcmp(peer->srp_password, conn_config->password))
return FALSE;
#endif
return TRUE;
}
@ -869,11 +833,6 @@ static CURLcode cf_ssl_add_peer(struct Curl_easy *data,
char buffer[64];
const char *ccert = conn_config ? conn_config->clientcert : NULL;
const char *kpasswd = conn_config ? conn_config->key_passwd : NULL;
const char *username = NULL, *password = NULL;
#ifdef USE_TLS_SRP
username = conn_config ? conn_config->username : NULL;
password = conn_config ? conn_config->password : NULL;
#endif
if(!ccert && conn_config && conn_config->cert_blob) {
/* when using a client cert blob, create a name for it */
curl_msnprintf(buffer, sizeof(buffer),
@ -881,7 +840,7 @@ static CURLcode cf_ssl_add_peer(struct Curl_easy *data,
ccert = buffer; /* data is strduped by cf_ssl_scache_peer_init */
}
result = cf_ssl_scache_peer_init(peer, ssl_peer_key, ccert, kpasswd,
username, password, NULL, NULL);
NULL, NULL);
if(result)
goto out;
/* all ready */
@ -1259,7 +1218,7 @@ CURLcode Curl_ssl_session_import(struct Curl_easy *data,
peer = cf_ssl_get_free_peer(scache);
if(peer) {
result = cf_ssl_scache_peer_init(peer, ssl_peer_key, NULL, NULL,
NULL, NULL, salt, hmac);
salt, hmac);
if(result)
goto out;
}