[Bug network/24255] resolver should handle special domains correctly

["pemensik at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=24255

Petr Menšík <pemensik at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pemensik at redhat dot com

--- Comment #1 from Petr Menšík <pemensik at redhat dot com> ---
I do not think this is a good idea. If one is running a local cache on his
machine, he might be able to forward onion. zone and all requests to it into
TOR network to appropriate DNS servers.

That would be no longer possible if glibc blocked that query from DNS. I think
we want it blocked only from forwarding to 3rd party servers. For example
unbound or bind will create empty zones for it, blocking forwarding it to
upstream DNS servers. That is what we want. It either handles it or blocks it.

I don't think this can be decided by glibc, it is not aware of configuration
details of DNS. I would instead propose to have optional NSS hosts plugin with
configurable blocklist, which could be put before dns in /etc/nsswitch.conf. If
you would include onion in it, it would authoritatively say does not exist
without allowing that in DNS. If you would have local dns cache able to
configure this properly, it would not use such module.

-- 
You are receiving this mail because:
You are on the CC list for the bug.