{"action":"opened","issue":{"url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/434","labels_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/434/labels{/name}","comments_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/434/comments","events_url":"https://api.github.com/repos/sandstorm-io/sandstorm/issues/434/events","html_url":"https://github.com/sandstorm-io/sandstorm/issues/434","id":80705184,"number":434,"title":"Sandstorm tries to resolve DNS for Tor .onion domains","user":{"login":"isislovecruft","id":907241,"avatar_url":"https://avatars.githubusercontent.com/u/907241?v=3","gravatar_id":"","url":"https://api.github.com/users/isislovecruft","html_url":"https://github.com/isislovecruft","followers_url":"https://api.github.com/users/isislovecruft/followers","following_url":"https://api.github.com/users/isislovecruft/following{/other_user}","gists_url":"https://api.github.com/users/isislovecruft/gists{/gist_id}","starred_url":"https://api.github.com/users/isislovecruft/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/isislovecruft/subscriptions","organizations_url":"https://api.github.com/users/isislovecruft/orgs","repos_url":"https://api.github.com/users/isislovecruft/repos","events_url":"https://api.github.com/users/isislovecruft/events{/privacy}","received_events_url":"https://api.github.com/users/isislovecruft/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-25T23:29:30Z","updated_at":"2015-05-25T23:29:30Z","closed_at":null,"body":"If configure Tor to run a Hidden Service like so:\r\n\r\nIn `/etc/tor/torrc`:\r\n```\r\nHiddenServiceDir /var/lib/tor/hidden_service_sandstorm\r\nHiddenServicePort 80 127.0.0.1:6080\r\n```\r\nwhere `6080` is the configured port in `/opt/sandstorm/sandstorm.conf`, and then I navigate a Tor Browser to the .onion hostname for the configured Tor Hidden Service above, I get the following error page from Sandstorm:\r\n\r\n![ticket-sandstorm-hs](https://cloud.githubusercontent.com/assets/907241/7802930/42dad86c-0331-11e5-85a8-45dc5e355a50.jpg)\r\nThe immediate issues with this behaviour are:\r\n\r\n1. Sandstorm is attempting to resolve `.onion` domains, which means that it is leaking (to several layers of DNS servers, as well as anyone eavesdropping in between any of them) that this server is running a Tor Hidden Service.\r\n\r\n2. Sandstorm is revealing the public-internet location of the server (including the port number!) to any clients who attempt to reach the Hidden Service.\r\n\r\nThese two problems combined mean that it is trivial (given the public, non-Tor location of the server, either by IP address or public domain name) to know that this server is running a Tor Hidden Service, and it is *beyond trivial* (given the server's `.onion` address) to find the actual server on the public internet.\r\n\r\nMy suggestions for better behaviour would be to instead:\r\n\r\n1. Never attempt to resolve DNS for something which ends in [`.onion`](https://en.wikipedia.org/wiki/.onion) — nor [`.i2p`](https://en.wikipedia.org/wiki/I2P#Terminology), nor [`.gnu`](https://en.wikipedia.org/wiki/GNUnet#GNU_Name_System) .\r\n\r\n   If you're absolutely certain that the resolution request will properly go to the server's listening Tor/I2P/GNUnet instance to be dealt with there, you could forward the resolution request to Tor/I2P/GNUnet (you probably don't want to do this, as I'm not sure what purpose it would serve, and it definitely would make Sandstorm configuration more difficult because there'd probably be the need to specify Tor/I2P/GNUnet's listening port in the `sandstorm.conf` file).\r\n\r\n2. If a Sandstorm instance is contacted by a client via some domain name which the Sandstorm instance does not recognise, Sandstorm should probably allow access to the normal Sandstorm user interface.\r\n\r\n    I assume this behaviour was originally implemented to redirect users who attempt to go to the IP address of the Sandstorm server to the public interface…  Was this design chosen in order to seem friendlier? Are there any other problems/concerns with allowing access to the normal Sandstorm user interface via an unrecognised domain name?\r\n"}}