diff options
Diffstat (limited to '')
| -rw-r--r-- | dirmngr/dirmngr.c | 7 | ||||
| -rw-r--r-- | dirmngr/dns-stuff.c | 29 | ||||
| -rw-r--r-- | dirmngr/dns-stuff.h | 6 | ||||
| -rw-r--r-- | doc/dirmngr.texi | 16 |
4 files changed, 53 insertions, 5 deletions
diff --git a/dirmngr/dirmngr.c b/dirmngr/dirmngr.c index d6c1670cd..8789d818e 100644 --- a/dirmngr/dirmngr.c +++ b/dirmngr/dirmngr.c @@ -68,6 +68,7 @@ #endif #include "../common/init.h" #include "gc-opt-flags.h" +#include "dns-stuff.h" /* The plain Windows version uses the windows service system. For example to start the service you may use "sc start dirmngr". @@ -142,6 +143,7 @@ enum cmd_and_opt_values { oIgnoreCertExtension, oUseTor, oKeyServer, + oNameServer, aTest }; @@ -214,6 +216,7 @@ static ARGPARSE_OPTS opts[] = { ARGPARSE_s_i (oMaxReplies, "max-replies", N_("|N|do not return more than N items in one query")), + ARGPARSE_s_s (oNameServer, "nameserver", "@"), ARGPARSE_s_s (oKeyServer, "keyserver", "@"), ARGPARSE_s_s (oHkpCaCert, "hkp-cacert", N_("|FILE|use the CA certificates in FILE for HKP over TLS")), @@ -623,6 +626,10 @@ parse_rereadable_options (ARGPARSE_ARGS *pargs, int reread) opt.keyserver = *pargs->r.ret_str? xtrystrdup (pargs->r.ret_str) : NULL; break; + case oNameServer: + set_dns_nameserver (pargs->r.ret_str); + break; + default: return 0; /* Not handled. */ } diff --git a/dirmngr/dns-stuff.c b/dirmngr/dns-stuff.c index 6bf36a553..6f3ce3912 100644 --- a/dirmngr/dns-stuff.c +++ b/dirmngr/dns-stuff.c @@ -82,9 +82,18 @@ /* ADNS has no support for CERT yet. */ #define my_adns_r_cert 37 + +/* The default nameserver used with ADNS in Tor mode. */ +#define DEFAULT_NAMESERVER "8.8.8.8" + + /* If set Tor mode shall be used. */ static int tor_mode; +/* A string with the nameserver IP address used with Tor. + (40 should be sufficient for v6 but we add some extra for a scope.) */ +static char tor_nameserver[40+20]; + /* A string to hold the credentials presented to Tor. */ #ifdef USE_ADNS static char tor_credentials[50]; @@ -114,6 +123,19 @@ enable_dns_tormode (int new_circuit) return gpg_error (GPG_ERR_NOT_IMPLEMENTED); } + +/* Change the default IP address of the nameserver to IPADDR. The + address needs to be a numerical IP address and will be used for the + next DNS query. Note that this is only used in Tor mode. */ +void +set_dns_nameserver (const char *ipaddr) +{ + strncpy (tor_nameserver, ipaddr? ipaddr : DEFAULT_NAMESERVER, + sizeof tor_nameserver -1); + tor_nameserver[sizeof tor_nameserver -1] = 0; +} + + /* Free an addressinfo linked list as returned by resolve_dns_name. */ void free_dns_addrinfo (dns_addrinfo_t ai) @@ -167,14 +189,17 @@ my_adns_init (adns_state *r_state) { char *cfgstr; + if (!*tor_nameserver) + set_dns_nameserver (NULL); + cfgstr = xtryasprintf ("nameserver %s\n" "options adns_tormode adns_sockscred:%s", - "8.8.8.8", tor_credentials); + tor_nameserver, tor_credentials); if (!cfgstr) err = gpg_error_from_syserror (); else { - ret = adns_init_strcfg (r_state, adns_if_noerrprint, NULL, cfgstr); + ret = adns_init_strcfg (r_state, adns_if_debug /*adns_if_noerrprint*/, NULL, cfgstr); if (ret) err = gpg_error_from_errno (ret); xfree (cfgstr); diff --git a/dirmngr/dns-stuff.h b/dirmngr/dns-stuff.h index 69637d61d..ee5132d61 100644 --- a/dirmngr/dns-stuff.h +++ b/dirmngr/dns-stuff.h @@ -96,6 +96,12 @@ struct srventry possibe. Return 0 on success. */ gpg_error_t enable_dns_tormode (int new_circuit); +/* Change the default IP address of the nameserver to IPADDR. The + address needs to be a numerical IP address and will be used for the + next DNS query. Note that this is only used in Tor mode. */ +void set_dns_nameserver (const char *ipaddr); + + void free_dns_addrinfo (dns_addrinfo_t ai); /* Function similar to getaddrinfo. */ diff --git a/doc/dirmngr.texi b/doc/dirmngr.texi index 06da87ed6..e453e8ae7 100644 --- a/doc/dirmngr.texi +++ b/doc/dirmngr.texi @@ -244,11 +244,11 @@ this still leaks the DNS queries; e.g. to lookup the hosts in a keyserver pool. Certain other features are disabled if this mode is active. -@item --keyserver @code{name} +@item --keyserver @var{name} @opindex keyserver -Use @code{name} as your keyserver. This is the server that @command{gpg} +Use @var{name} as your keyserver. This is the server that @command{gpg} communicates with to receive keys, send keys, and search for -keys. The format of the @code{name} is a URI: +keys. The format of the @var{name} is a URI: `scheme:[//]keyservername[:port]' The scheme is the type of keyserver: "hkp" for the HTTP (or compatible) keyservers, "ldap" for the LDAP keyservers, or "mailto" for the Graff email keyserver. Note that your @@ -263,6 +263,16 @@ need to send keys to more than one server. The keyserver @code{hkp://keys.gnupg.net} uses round robin DNS to give a different keyserver each time you use it. + +@item --nameserver @var{ipaddr} +@opindex nameserver +In ``Tor mode'' Dirmngr uses a public resolver via Tor to resolve DNS +names. If the default public resolver, which is @code{8.8.8.8}, shall +not be used a different one can be given using this option. Note that +a numerical IP address must be given (IPv6 or IPv4) and that no error +checking is done for @var{ipaddr}. DNS queries in Tor mode do only +work if GnuPG as been build with ADNS support. + @item --disable-ldap @opindex disable-ldap Entirely disables the use of LDAP. |