From: Mark Karpilovskij <mark.karpilovskij@nic.cz>
Date: Thu, 1 Feb 2018 13:45:54 +0000 (+0100)
Subject: kdig: use @server as hostname for TLS with +tls-ca
X-Git-Tag: v2.7.0~225
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d8a313bfdaef499c893d6aedd826d014f3b87e55;p=thirdparty%2Fknot-dns.git

kdig: use @server as hostname for TLS with +tls-ca
---

diff --git a/doc/man/kdig.1in b/doc/man/kdig.1in
index 79cca07baa..489a28e511 100644
--- a/doc/man/kdig.1in
+++ b/doc/man/kdig.1in
@@ -239,8 +239,8 @@ Use TLS with the Opportunistic privacy profile (\fI\%RFC 7858#section\-4.1\fP).
 Use TLS with a certificate validation. Certification authority certificates
 are loaded from the specified PEM file (default is system certificate storage
 if no argument is provided).
-Can be specified multiple times. Provide the +tls\-hostname option to activate
-strict authentication.
+Can be specified multiple times. If the +tls\-hostname option is not provided,
+the name of the target server (if specified) is used for strict authentication.
 .TP
 \fB+\fP[\fBno\fP]\fBtls\-pin\fP=\fIBASE64\fP
 Use TLS with the Out\-of\-Band key\-pinned privacy profile (\fI\%RFC 7858#section\-4.2\fP).
diff --git a/doc/man_kdig.rst b/doc/man_kdig.rst
index ef91f597df..247a8888db 100644
--- a/doc/man_kdig.rst
+++ b/doc/man_kdig.rst
@@ -218,8 +218,8 @@ Options
   Use TLS with a certificate validation. Certification authority certificates
   are loaded from the specified PEM file (default is system certificate storage
   if no argument is provided).
-  Can be specified multiple times. Provide the +tls-hostname option to activate
-  strict authentication.
+  Can be specified multiple times. If the +tls-hostname option is not provided,
+  the name of the target server (if specified) is used for strict authentication.
 
 **+**\ [\ **no**\ ]\ **tls-pin**\ =\ *BASE64*
   Use TLS with the Out-of-Band key-pinned privacy profile (:rfc:`7858#section-4.2`).
diff --git a/src/utils/kdig/kdig_params.c b/src/utils/kdig/kdig_params.c
index 11f230d83e..9e5883158c 100644
--- a/src/utils/kdig/kdig_params.c
+++ b/src/utils/kdig/kdig_params.c
@@ -1744,6 +1744,12 @@ static void complete_servers(query_t *query, const query_t *conf)
 					return;
 				}
 			}
+
+			// Use server name as hostname for TLS if necessary.
+			if (query->tls.enable && query->tls.hostname == NULL &&
+			    (query->tls.system_ca || !EMPTY_LIST(query->tls.ca_files))) {
+				query->tls.hostname = strdup(s->name);
+			}
 		}
 	// Use servers from config if any.
 	} else if (list_size(&conf->servers) > 0) {
@@ -1763,6 +1769,12 @@ static void complete_servers(query_t *query, const query_t *conf)
 				return;
 			}
 			add_tail(&query->servers, (node_t *)server);
+
+			// Use server name as hostname for TLS if necessary.
+			if (query->tls.enable && query->tls.hostname == NULL &&
+			    (query->tls.system_ca || !EMPTY_LIST(query->tls.ca_files))) {
+				query->tls.hostname = strdup(s->name);
+			}
 		}
 	// Use system specific.
 	} else {