kdig: use @server as hostname for TLS with +tls-ca

diff --git a/doc/man/kdig.1in b/doc/man/kdig.1in
index 79cca07baa1420b287b556727eaeca9e6907c011..489a28e5119e1f6e13f2d2b1388180f1a7c5bfca 100644 (file)
--- a/doc/man/kdig.1in
+++ b/doc/man/kdig.1in
@@ -239,8 +239,8 @@ Use TLS with the Opportunistic privacy profile (\fI\%RFC 7858#section\-4.1\fP).
 Use TLS with a certificate validation. Certification authority certificates
 are loaded from the specified PEM file (default is system certificate storage
 if no argument is provided).
-Can be specified multiple times. Provide the +tls\-hostname option to activate
-strict authentication.
+Can be specified multiple times. If the +tls\-hostname option is not provided,
+the name of the target server (if specified) is used for strict authentication.
 .TP
 \fB+\fP[\fBno\fP]\fBtls\-pin\fP=\fIBASE64\fP
 Use TLS with the Out\-of\-Band key\-pinned privacy profile (\fI\%RFC 7858#section\-4.2\fP).

diff --git a/doc/man_kdig.rst b/doc/man_kdig.rst
index ef91f597dfb8bd417f98f008be09a748aed8c660..247a8888db9e6eb82101f37ba4b45ddda6bfe004 100644 (file)
--- a/doc/man_kdig.rst
+++ b/doc/man_kdig.rst
@@ -218,8 +218,8 @@ Options
   Use TLS with a certificate validation. Certification authority certificates
   are loaded from the specified PEM file (default is system certificate storage
   if no argument is provided).
-  Can be specified multiple times. Provide the +tls-hostname option to activate
-  strict authentication.
+  Can be specified multiple times. If the +tls-hostname option is not provided,
+  the name of the target server (if specified) is used for strict authentication.
 
 **+**\ [\ **no**\ ]\ **tls-pin**\ =\ *BASE64*
   Use TLS with the Out-of-Band key-pinned privacy profile (:rfc:`7858#section-4.2`).

diff --git a/src/utils/kdig/kdig_params.c b/src/utils/kdig/kdig_params.c
index 11f230d83e21300db66a45da95f67591b925916f..9e5883158c127990e3856a7b26f7c3c069dc50be 100644 (file)
--- a/src/utils/kdig/kdig_params.c
+++ b/src/utils/kdig/kdig_params.c
@@ -1744,6 +1744,12 @@ static void complete_servers(query_t *query, const query_t *conf)
                                        return;
                                }
                        }
+
+                       // Use server name as hostname for TLS if necessary.
+                       if (query->tls.enable && query->tls.hostname == NULL &&
+                           (query->tls.system_ca || !EMPTY_LIST(query->tls.ca_files))) {
+                               query->tls.hostname = strdup(s->name);
+                       }
                }
        // Use servers from config if any.
        } else if (list_size(&conf->servers) > 0) {
@@ -1763,6 +1769,12 @@ static void complete_servers(query_t *query, const query_t *conf)
                                return;
                        }
                        add_tail(&query->servers, (node_t *)server);
+
+                       // Use server name as hostname for TLS if necessary.
+                       if (query->tls.enable && query->tls.hostname == NULL &&
+                           (query->tls.system_ca || !EMPTY_LIST(query->tls.ca_files))) {
+                               query->tls.hostname = strdup(s->name);
+                       }
                }
        // Use system specific.
        } else {