What does the logged Tor warning "Onion address foo requested from a port with .onion disabled" mean?

Question

I am experimenting with different ways to Torify DNS requests for applications that do not support SOCKS5's RESOLVE or SOCKS4a, themselves. One simple way to do this is to configure Tor itself to resolve DNS requests using DNSPort 127.0.0.1:53, then tell your system that its DNS resolver is the localhost (with echo "nameserver 127.0.0.1" > /etc/resolv.conf or whatever is appropriate for your operating system).

In doing so, and then tailing my Tor's logfile (having been configured with SafeLogging 0 and Log notice file /tmp/tor.log or similar), I noticed that each time an application that doesn't explicitly use SOCKS4a or SOCKS5 with remote DNS resolution requests DNS resolution of a .onion address, a line appears in my Tor log like this:

[warn] Onion address FOO requested from a port with .onion disabled

I'm aware that .onion addresses actually don't have IP addresses associated with them (of course) but I still don't understand exactly what the warning means and, oddly, searching for the log output text produces exactly 0 results on various popular search engines.

Thus, two questions:

1. What does the warning mean to Tor? And is there a way to configure Tor so that one "enables" the .onion on this "disabled" "port"…whatever that means?
2. Also, is there a way to change Tor's behavior regarding this apparent configuration.

Thanks in advance.

Answer 1

Ah, the answer turns out to be "use AutomapHostsOnResolve 1." From the Tor manual for the AutomapHostsOnResolve configuration directive:

When this option is enabled, and we get a request to resolve an address that ends with one of the suffixes in AutomapHostsSuffixes, we map an unused virtual address to that address, and return the new virtual address. This is handy for making ".onion" addresses work with applications that resolve an address and then connect to it. (Default: 0)

I've read this many times but it is unfortunately not a great description. What it means is that, given the configuration posed in the question, above, i.e., a configuration wherein Tor itself is handling DNS queries (by using its DNSPort config directive), then upon request of certain queries for A, AAAA, and PTR records, Tor will return a random response because, well, it doesn't really matter what the application making the request receives.

Specifically, Tor will send a DNS response containing a "virtual address" for the two Tor-specific top-level domains (TLDs), namely .onion and .exit or whatever you have defined using Tor's AutomapHostsSuffixes directive, so that the requesting application receives some DNS response. The virtual address is not a real address, but rather just some placeholder to ensure the requesting application doesn't raise a "can't resolve hostname" error to the user, because that is exactly what would happen if the application tries to resolve a .onion address through the "real" DNS system.

This is a very handy thing to know about if what you are trying to do is reconfigure a system without use of an isolating proxy to avoid DNS leaks, but still allow that system to access Onion services (also known as "hidden services") by proxifying a given application through your local Tor client.

Also, for the curious this "virtual address" is in the CIDR IP range 127.192.0.0/10 by default, which makes a lot of sense. This IP range can be configured using the VirtualAddrNetwork* configuration options.