[Pkg-gnupg-commit] [gnupg2] 125/241: dirmngr: New option --nameserver.
Daniel Kahn Gillmor
dkg at fifthhorseman.net
Wed Dec 9 20:32:05 UTC 2015
This is an automated email from the git hooks/post-receive script.
dkg pushed a commit to branch master
in repository gnupg2.
commit a2cc1d57552ccac7b2f9a0c6423b171b2a168b2a
Author: Werner Koch <wk at gnupg.org>
Date: Thu Nov 12 13:20:18 2015 +0100
dirmngr: New option --nameserver.
* dirmngr/dirmngr.c (oNameServer): New.
(opts): Add --nameserver.
(parse_rereadable_options): Act upon oNameServer.
* dirmngr/dns-stuff.c (DEFAULT_NAMESERVER): New.
(tor_nameserver): New.
(set_dns_nameserver): New.
(my_adns_init): Make name server configurable.
Signed-off-by: Werner Koch <wk at gnupg.org>
---
dirmngr/dirmngr.c | 7 +++++++
dirmngr/dns-stuff.c | 29 +++++++++++++++++++++++++++--
dirmngr/dns-stuff.h | 6 ++++++
doc/dirmngr.texi | 16 +++++++++++++---
4 files changed, 53 insertions(+), 5 deletions(-)
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c
index d6c1670..8789d81 100644
--- a/dirmngr/dirmngr.c
+++ b/dirmngr/dirmngr.c
@@ -68,6 +68,7 @@
#endif
#include "../common/init.h"
#include "gc-opt-flags.h"
+#include "dns-stuff.h"
/* The plain Windows version uses the windows service system. For
example to start the service you may use "sc start dirmngr".
@@ -142,6 +143,7 @@ enum cmd_and_opt_values {
oIgnoreCertExtension,
oUseTor,
oKeyServer,
+ oNameServer,
aTest
};
@@ -214,6 +216,7 @@ static ARGPARSE_OPTS opts[] = {
ARGPARSE_s_i (oMaxReplies, "max-replies",
N_("|N|do not return more than N items in one query")),
+ ARGPARSE_s_s (oNameServer, "nameserver", "@"),
ARGPARSE_s_s (oKeyServer, "keyserver", "@"),
ARGPARSE_s_s (oHkpCaCert, "hkp-cacert",
N_("|FILE|use the CA certificates in FILE for HKP over TLS")),
@@ -623,6 +626,10 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread)
opt.keyserver = *pargs->r.ret_str? xtrystrdup (pargs->r.ret_str) : NULL;
break;
+ case oNameServer:
+ set_dns_nameserver (pargs->r.ret_str);
+ break;
+
default:
return 0; /* Not handled. */
}
diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c
index 6bf36a5..6f3ce39 100644
--- a/dirmngr/dns-stuff.c
+++ b/dirmngr/dns-stuff.c
@@ -82,9 +82,18 @@
/* ADNS has no support for CERT yet. */
#define my_adns_r_cert 37
+
+/* The default nameserver used with ADNS in Tor mode. */
+#define DEFAULT_NAMESERVER "8.8.8.8"
+
+
/* If set Tor mode shall be used. */
static int tor_mode;
+/* A string with the nameserver IP address used with Tor.
+ (40 should be sufficient for v6 but we add some extra for a scope.) */
+static char tor_nameserver[40+20];
+
/* A string to hold the credentials presented to Tor. */
#ifdef USE_ADNS
static char tor_credentials[50];
@@ -114,6 +123,19 @@ enable_dns_tormode (int new_circuit)
return gpg_error (GPG_ERR_NOT_IMPLEMENTED);
}
+
+/* Change the default IP address of the nameserver to IPADDR. The
+ address needs to be a numerical IP address and will be used for the
+ next DNS query. Note that this is only used in Tor mode. */
+void
+set_dns_nameserver (const char *ipaddr)
+{
+ strncpy (tor_nameserver, ipaddr? ipaddr : DEFAULT_NAMESERVER,
+ sizeof tor_nameserver -1);
+ tor_nameserver[sizeof tor_nameserver -1] = 0;
+}
+
+
/* Free an addressinfo linked list as returned by resolve_dns_name. */
void
free_dns_addrinfo (dns_addrinfo_t ai)
@@ -167,14 +189,17 @@ my_adns_init (adns_state *r_state)
{
char *cfgstr;
+ if (!*tor_nameserver)
+ set_dns_nameserver (NULL);
+
cfgstr = xtryasprintf ("nameserver %s\n"
"options adns_tormode adns_sockscred:%s",
- "8.8.8.8", tor_credentials);
+ tor_nameserver, tor_credentials);
if (!cfgstr)
err = gpg_error_from_syserror ();
else
{
- ret = adns_init_strcfg (r_state, adns_if_noerrprint, NULL, cfgstr);
+ ret = adns_init_strcfg (r_state, adns_if_debug /*adns_if_noerrprint*/, NULL, cfgstr);
if (ret)
err = gpg_error_from_errno (ret);
xfree (cfgstr);
diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h
index 69637d6..ee5132d 100644
--- a/dirmngr/dns-stuff.h
+++ b/dirmngr/dns-stuff.h
@@ -96,6 +96,12 @@ struct srventry
possibe. Return 0 on success. */
gpg_error_t enable_dns_tormode (int new_circuit);
+/* Change the default IP address of the nameserver to IPADDR. The
+ address needs to be a numerical IP address and will be used for the
+ next DNS query. Note that this is only used in Tor mode. */
+void set_dns_nameserver (const char *ipaddr);
+
+
void free_dns_addrinfo (dns_addrinfo_t ai);
/* Function similar to getaddrinfo. */
diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi
index 06da87e..e453e8a 100644
--- a/doc/dirmngr.texi
+++ b/doc/dirmngr.texi
@@ -244,11 +244,11 @@ this still leaks the DNS queries; e.g. to lookup the hosts in a
keyserver pool. Certain other features are disabled if this mode is
active.
- at item --keyserver @code{name}
+ at item --keyserver @var{name}
@opindex keyserver
-Use @code{name} as your keyserver. This is the server that @command{gpg}
+Use @var{name} as your keyserver. This is the server that @command{gpg}
communicates with to receive keys, send keys, and search for
-keys. The format of the @code{name} is a URI:
+keys. The format of the @var{name} is a URI:
`scheme:[//]keyservername[:port]' The scheme is the type of keyserver:
"hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP
keyservers, or "mailto" for the Graff email keyserver. Note that your
@@ -263,6 +263,16 @@ need to send keys to more than one server. The keyserver
@code{hkp://keys.gnupg.net} uses round robin DNS to give a different
keyserver each time you use it.
+
+ at item --nameserver @var{ipaddr}
+ at opindex nameserver
+In ``Tor mode'' Dirmngr uses a public resolver via Tor to resolve DNS
+names. If the default public resolver, which is @code{8.8.8.8}, shall
+not be used a different one can be given using this option. Note that
+a numerical IP address must be given (IPv6 or IPv4) and that no error
+checking is done for @var{ipaddr}. DNS queries in Tor mode do only
+work if GnuPG as been build with ADNS support.
+
@item --disable-ldap
@opindex disable-ldap
Entirely disables the use of LDAP.
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-gnupg/gnupg2.git
More information about the Pkg-gnupg-commit
mailing list