resolved: return NXDOMAIN for .onion domains

RFC 7686 mandates that name resolution APIs MUST respond to .onion
names with NXDOMAIN to prevent leaks to the resolving name server.
This intercepts .onion queries and synthesizes an NXDOMAIN response locally.

Fixes #42980

(cherry picked from commit d0cf688a62)
(cherry picked from commit 03a92ca415)

src/resolve/test-dns-synthesize.c

@@ -302,4 +302,25 @@ TEST(dns_synthesize_answer_address_local_dns_proxy) {
         ASSERT_TRUE(dns_answer_contains(answer, rr));
 }
 
+TEST(dns_synthesize_answer_onion) {
+        Manager manager = {};
+        int type;
+
+        FOREACH_ARGUMENT(type, DNS_TYPE_A, DNS_TYPE_TXT) {
+                _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL;
+                _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL;
+                _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL;
+
+                question = dns_question_new(1);
+                ASSERT_NOT_NULL(question);
+
+                key = dns_resource_key_new(DNS_CLASS_IN, type, "mysecret.onion");
+                ASSERT_NOT_NULL(key);
+                ASSERT_OK(dns_question_add(question, key, 0));
+
+                ASSERT_ERROR(dns_synthesize_answer(&manager, question, 0, &answer), ENXIO);
+                ASSERT_NULL(answer);
+        }
+}
+
 DEFINE_TEST_MAIN(LOG_DEBUG);

src/shared/dns-domain.c

@@ -1368,6 +1368,10 @@ bool dns_name_dont_resolve(const char *name) {
         if (dns_name_endswith(name, "invalid") > 0)
                 return true;
 
+        /* Never respond to the domains listed in RFC7686 */
+        if (dns_name_endswith(name, "onion") > 0)
+                return true;
+
         /* Never respond to some of the domains listed in RFC9476 */
         if (dns_name_endswith(name, "alt") > 0)
                 return true;

test/units/TEST-75-RESOLVED.sh

@@ -512,6 +512,7 @@ testcase_07_22229() {
         "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa"
         "hello.invalid"
         "hello.alt"
+        "hello.onion"
     )
 
     for name in "${FILTERED_NAMES[@]}"; do