From 0403cfd4fda56448fe2f51508b2db85688946bce Mon Sep 17 00:00:00 2001 From: Ibrahim Issa Date: Mon, 3 Aug 2026 16:13:14 +0200 Subject: [PATCH] resolved: return NXDOMAIN for .onion domains RFC 7686 mandates that name resolution APIs MUST respond to .onion names with NXDOMAIN to prevent leaks to the resolving name server. This intercepts .onion queries and synthesizes an NXDOMAIN response locally. Fixes #42980 (cherry picked from commit d0cf688a62c16f0f03580d7d250b4a338bb69824) (cherry picked from commit 03a92ca415c93be1036209e0876d54dc01b02c5c) --- src/resolve/test-dns-synthesize.c | 21 +++++++++++++++++++++ src/shared/dns-domain.c | 4 ++++ test/units/TEST-75-RESOLVED.sh | 1 + 3 files changed, 26 insertions(+) diff --git a/src/resolve/test-dns-synthesize.c b/src/resolve/test-dns-synthesize.c index 64b79df45eb..7d55e18793b 100644 --- a/src/resolve/test-dns-synthesize.c +++ b/src/resolve/test-dns-synthesize.c @@ -302,4 +302,25 @@ TEST(dns_synthesize_answer_address_local_dns_proxy) { ASSERT_TRUE(dns_answer_contains(answer, rr)); } +TEST(dns_synthesize_answer_onion) { + Manager manager = {}; + int type; + + FOREACH_ARGUMENT(type, DNS_TYPE_A, DNS_TYPE_TXT) { + _cleanup_(dns_question_unrefp) DnsQuestion *question = NULL; + _cleanup_(dns_resource_key_unrefp) DnsResourceKey *key = NULL; + _cleanup_(dns_answer_unrefp) DnsAnswer *answer = NULL; + + question = dns_question_new(1); + ASSERT_NOT_NULL(question); + + key = dns_resource_key_new(DNS_CLASS_IN, type, "mysecret.onion"); + ASSERT_NOT_NULL(key); + ASSERT_OK(dns_question_add(question, key, 0)); + + ASSERT_ERROR(dns_synthesize_answer(&manager, question, 0, &answer), ENXIO); + ASSERT_NULL(answer); + } +} + DEFINE_TEST_MAIN(LOG_DEBUG); diff --git a/src/shared/dns-domain.c b/src/shared/dns-domain.c index c90da5fc465..de8d261d0b0 100644 --- a/src/shared/dns-domain.c +++ b/src/shared/dns-domain.c @@ -1368,6 +1368,10 @@ bool dns_name_dont_resolve(const char *name) { if (dns_name_endswith(name, "invalid") > 0) return true; + /* Never respond to the domains listed in RFC7686 */ + if (dns_name_endswith(name, "onion") > 0) + return true; + /* Never respond to some of the domains listed in RFC9476 */ if (dns_name_endswith(name, "alt") > 0) return true; diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh index e7dcf59ec2a..ba9fd44a17c 100755 --- a/test/units/TEST-75-RESOLVED.sh +++ b/test/units/TEST-75-RESOLVED.sh @@ -512,6 +512,7 @@ testcase_07_22229() { "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" "hello.invalid" "hello.alt" + "hello.onion" ) for name in "${FILTERED_NAMES[@]}"; do