From e7223f2ab2cfa38aaa5449690f80acdad005619b Mon Sep 17 00:00:00 2001
From: dongshengyuan <545258830@qq.com>
Date: Thu, 13 Aug 2026 10:13:53 +0800
Subject: [PATCH] resolvectl: reject --raw for regular lookups

--raw only affects ResolveRecord output. Without --type= or an
RFC4501 dns: URI, query takes the ResolveHostname/ResolveAddress
paths, where --raw was silently ignored.

Reproducer:

  build/resolvectl --raw query localhost

Before:

  The command exited successfully and printed regular text output,
  such as:

    localhost: 127.0.0.1

After:

  The command fails before issuing a lookup:

    --raw may only be combined with --type= or dns: URIs.

Follow-up for: 05ea7e87b616650b5829bd439deff6bb0bc9e534
---
 man/resolvectl.xml             | 4 ++++
 src/resolve/resolvectl.c       | 4 ++++
 test/units/TEST-75-RESOLVED.sh | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/man/resolvectl.xml b/man/resolvectl.xml
index b7a28b47bb..e908345d48 100644
--- a/man/resolvectl.xml
+++ b/man/resolvectl.xml
@@ -482,6 +482,10 @@
         types: SSHFP, TLSA, OPENPGPKEY where this dumps the key material only; and A, AAAA where
         this dumps the address data.</para>
 
+        <para>This option may only be used with <option>--type=</option> or an RFC 4501
+        <literal>dns:</literal> URI, which both perform DNS resource record lookups. It may not be combined
+        with regular hostname or address lookups.</para>
+
         <xi:include href="version-info.xml" xpointer="v239"/></listitem>
       </varlistentry>
 
diff --git a/src/resolve/resolvectl.c b/src/resolve/resolvectl.c
index d77ae3d631..be596841a6 100644
--- a/src/resolve/resolvectl.c
+++ b/src/resolve/resolvectl.c
@@ -894,6 +894,10 @@ static int verb_query(int argc, char *argv[], uintptr_t _data, void *userdata) {
                                 int family, ifindex;
                                 union in_addr_union a;
 
+                                if (arg_raw != RAW_NONE)
+                                        return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
+                                                               "--raw may only be combined with --type= or dns: URIs.");
+
                                 r = in_addr_ifindex_from_string_auto(*p, &family, &a, &ifindex);
                                 if (r >= 0)
                                         RET_GATHER(ret, resolve_address(family, &a, ifindex));
diff --git a/test/units/TEST-75-RESOLVED.sh b/test/units/TEST-75-RESOLVED.sh
index 9f18f3dcf3..707a6f3011 100755
--- a/test/units/TEST-75-RESOLVED.sh
+++ b/test/units/TEST-75-RESOLVED.sh
@@ -565,6 +565,10 @@ testcase_08_resolved() {
     run resolvectl query signed.test
     grep -qF "signed.test: 10.0.0.10" "$RUN_OUT"
     grep -qF "authenticated: yes" "$RUN_OUT"
+    (! run resolvectl --raw query localhost)
+    grep -qF -- "--raw may only be combined with --type= or dns: URIs." "$RUN_OUT"
+    resolvectl --raw=packet query --type=A signed.test >"$RUN_OUT"
+    test -s "$RUN_OUT"
     run dig @ns1.unsigned.test +short MX signed.test
     grep -qF "10 mail.signed.test." "$RUN_OUT"
     run resolvectl query --legend=no -t MX signed.test