Remove abilility to configure curl's CA file, path, and SSL validation

ChangeLog.md

@@ -8,7 +8,10 @@ repository history](https://github.com/ddclient/ddclient/commits/master).
 ### Breaking changes
 
   * ddclient no longer runs as a daemon. Running via cron is recommended.
-  * ddclient now requires curl.
+  * ddclient now requires curl. The CA certificates path/file cannot be
+    configured in ddclient, and SSL validation cannot be insecure. If you
+    require any of these, configure ddclient to use a shell script that
+    calls curl.
   * ddclient no longer has built-in support for IP detection via routers and
     firewalls.
   * ddclient no longer ships any example files for init systems that use `/etc/init.d`.

ddclient.in

@@ -187,7 +187,6 @@ my %variables = (
         'timeout'             => setv(T_DELAY, 0, 0, interval('120s'),     interval('120s')),
         'retry'               => setv(T_BOOL,  0, 0, 0,                    undef),
         'force'               => setv(T_BOOL,  0, 0, 0,                    undef),
-        'ssl'                 => setv(T_BOOL,  0, 0, 0,                    undef),
         'syslog'              => setv(T_BOOL,  0, 0, 0,                    undef),
         'facility'            => setv(T_STRING,0, 0, 'daemon',             undef),
         'priority'            => setv(T_STRING,0, 0, 'notice',             undef),
@@ -204,8 +203,6 @@ my %variables = (
         'geturl'              => setv(T_STRING,0, 0, '',                   undef),
 
         'postscript'          => setv(T_POSTS, 0, 0, '',                   undef),
-        'ssl_ca_dir'          => setv(T_FILE,  0, 0, undef,                undef),
-        'ssl_ca_file'         => setv(T_FILE,  0, 0, undef,                undef),
     },
     'service-common-defaults' => {
         'server'              => setv(T_FQDNP, 1, 0, 'members.dyndns.org', undef),
@@ -221,7 +218,6 @@ my %variables = (
         'ifv6'                => setv(T_IF,    0, 0, 'default',            undef),
         'web'                 => setv(T_STRING,0, 0, 'dyndns',             undef),
         'web-skip'            => setv(T_STRING,0, 0, '',                   undef),
-        'web-ssl-validate'    => setv(T_BOOL,  0, 0, 1,                    undef),
         'webv4'               => setv(T_STRING,0, 0, 'googledomains',      undef),
         'webv4-skip'          => setv(T_STRING,1, 0, '',                   undef),
         'webv6'               => setv(T_STRING,0, 0, 'googledomains',      undef),
@@ -258,7 +254,6 @@ my %variables = (
         'login'               => setv(T_LOGIN, 0, 0, 0, 'unused',      undef),
     },
     'dnsexit2-common-defaults'       => {
-        'ssl'         => setv(T_BOOL,   0, 0, 1, undef),
         'server'      => setv(T_FQDNP,  1, 0, 'api.dnsexit.com', undef),
         'path'        => setv(T_STRING, 0, 1, '/dns/', undef),
         'record-type' => setv(T_STRING, 1, 0, 'A', undef),
@@ -776,9 +771,6 @@ my @opt = (
     ["options",           "=s", "-options <opt>=<val>[,<opt>=<val>,...]\n                        : optional per-service arguments (see below)"],
     "",
     ["ssl",               "!",  "-{no}ssl              : do updates over encrypted SSL connection"],
-    ["ssl_ca_dir",        "=s", "-ssl_ca_dir <dir>     : look in <dir> for certificates of trusted certificate authorities (default: auto-detect)"],
-    ["ssl_ca_file",       "=s", "-ssl_ca_file <file>   : look at <file> for certificates of trusted certificate authorities (default: auto-detect)"],
-    ["web-ssl-validate",  "!","-{no}web-ssl-validate   : Validate SSL certificate when retrieving IP address from web"],
     ["retry",             "!",  "-{no}retry            : retry failed updates"],
     ["force",             "!",  "-{no}force            : force an update even if the update may be unnecessary"],
     ["timeout",           "=i", "-timeout <max>        : when fetching a URL, wait at most <max> seconds for a response"],
@@ -2177,15 +2169,13 @@ sub geturl {
     my @header_lines = ();
 
     ## canonify proxy and url
-    $force_ssl = 1 if ($url =~ /^https:/);
+    $use_ssl = 1 if ($url =~ /^https:/);
     $proxy  =~ s%^https?://%%i if defined($proxy);
     $url    =~ s%^https?://%%i;
     $server = $url;
     $server =~ s%[?/].*%%;
     $url    =~ s%^[^?/]*/?%%;
 
-    $use_ssl = 1 if ($force_ssl || ($globals{'ssl'} && !($params{ignore_ssl_option} // 0)));
-
     $protocol = ($use_ssl ? "https" : "http");
 
     debug("proxy    = %s", $proxy // '<undefined>');
@@ -2201,9 +2191,6 @@ sub geturl {
     } else {
         push(@curlopt, "silent");
         push(@curlopt, "include"); ## Include HTTP response for compatibility
-        push(@curlopt, "insecure") if ($use_ssl && !($params{ssl_validate} // 1));
-        push(@curlopt, "cacert=\"".escape_curl_param(opt('ssl_ca_file')).'"') if defined(opt('ssl_ca_file'));
-        push(@curlopt, "capath=\"".escape_curl_param(opt('ssl_ca_dir')).'"') if defined(opt('ssl_ca_dir'));
         push(@curlopt, "ipv4") if ($ipversion == 4);
         push(@curlopt, "ipv6") if ($ipversion == 6);
         push(@curlopt, "user-agent=\"".escape_curl_param("${program}/${version}").'"');
@@ -2292,7 +2279,6 @@ sub get_ip {
             $reply = geturl(
                 proxy => opt('proxy', $h),
                 url => $url,
-                ssl_validate => opt('web-ssl-validate', $h),
             ) // '';
         }
 
@@ -2668,7 +2654,6 @@ sub get_ipv4 {
             $reply = geturl( proxy => opt('proxy', $h),
                 url => $url,
                 ipversion => 4, # when using a URL to find IPv4 address we should force use of IPv4
-                ssl_validate => opt('ssl-validate', $h),
             ) // '';
         }
 
@@ -2768,7 +2753,6 @@ sub get_ipv6 {
                 proxy => opt('proxy'),
                 url => $url,
                 ipversion => 6, # when using a URL to find IPv6 address we should force use of IPv6
-                ssl_validate => opt('ssl-validate', $h),
             ) // '';
         }
 
@@ -3912,9 +3896,7 @@ sub nic_domeneshop_update {
         verbose("UPDATE:", "Updating %s", $h);
 
         # Set the URL that we're going to to update
-        my $url;
-        $url  = $globals{'ssl'} ? "https://" : "http://";
-        $url .= "$config{$h}{'server'}$endpointPath?hostname=$h&myip=$ip";
+        my $url = "https://$config{$h}{'server'}$endpointPath?hostname=$h&myip=$ip";
 
         # Try to get URL
         my $reply = geturl(
@@ -6336,8 +6318,7 @@ sub nic_dnsmadeeasy_update {
         verbose("UPDATE:", "Updating %s", $h);
 
         # Set the URL that we're going to to update
-        my $url;
-        $url  = $globals{'ssl'} ? "https://" : "http://";
+        my $url = "https://";
         $url .= $config{$h}{'server'} . $config{$h}{'script'};
         $url .= "?username=$config{$h}{'login'}";
         $url .= "&password=$config{$h}{'password'}";