From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 83A323858D38; Mon, 12 Jun 2023 13:32:11 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 83A323858D38 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sourceware.org; s=default; t=1686576731; bh=vjFoLnzakmP/aD2adofdgwMl/ldXgqIrgdb6yB/FIKg=; h=From:To:Subject:Date:In-Reply-To:References:From; b=nwitY9trZXPFPneO7poijumK2YTtFmAjfwlf+sXh5HnaJ6U8zg7EouAPtPFvKR/Gu Q5Mr4dlfGdfszHE4SUYPbeKKS0yN5d2WpfkaRLSsocgKM7sPjwCcFbKZ7fd/YV1QWb 3uCPtvLdF0ChxBqmcC2srufewhd5BmSkIdDnhT14= From: "pemensik at redhat dot com" To: glibc-bugs@sourceware.org Subject: [Bug network/24255] resolver should handle special domains correctly Date: Mon, 12 Jun 2023 13:32:10 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: glibc X-Bugzilla-Component: network X-Bugzilla-Version: unspecified X-Bugzilla-Keywords: X-Bugzilla-Severity: enhancement X-Bugzilla-Who: pemensik at redhat dot com X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at sourceware dot org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: security- X-Bugzilla-Changed-Fields: cc Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://sourceware.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://sourceware.org/bugzilla/show_bug.cgi?id=3D24255 Petr Men=C5=A1=C3=ADk changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |pemensik at redhat dot com --- Comment #1 from Petr Men=C5=A1=C3=ADk --- I do not think this is a good idea. If one is running a local cache on his machine, he might be able to forward onion. zone and all requests to it into TOR network to appropriate DNS servers. That would be no longer possible if glibc blocked that query from DNS. I th= ink we want it blocked only from forwarding to 3rd party servers. For example unbound or bind will create empty zones for it, blocking forwarding it to upstream DNS servers. That is what we want. It either handles it or blocks = it. I don't think this can be decided by glibc, it is not aware of configuration details of DNS. I would instead propose to have optional NSS hosts plugin w= ith configurable blocklist, which could be put before dns in /etc/nsswitch.conf= . If you would include onion in it, it would authoritatively say does not exist without allowing that in DNS. If you would have local dns cache able to configure this properly, it would not use such module. --=20 You are receiving this mail because: You are on the CC list for the bug.=