pfSense

               $a_unboundcfg['dnssec'] = isset($a_unboundcfg['dnssec']) ? $a_unboundcfg['dnssec'] : false;

               $a_unboundcfg['qname'] = isset($a_unboundcfg['qname']) ? $a_unboundcfg['qname'] : 'disabled';

$tab_array[] = array(gettext("Security and Privacy"), false, "services_unbound_security.php");

$tab_array[] = array(gettext("Security and Privacy"), false, "services_unbound_security.php");

++ /usr/local/www/services_unbound_advanced.php       2018-04-19 17:44:49.000000000 +0100

$pconfig['proto'] = ($config['unbound']['proto'] =='tcp' || $config['unbound']['proto'] == 'udp') ? $config['unbound']['proto'] : 'both';

               if (isset($_POST['proto']) && !in_array($_POST['proto'], array('both', 'tcp', 'udp'))) {

                       $input_errors[] = gettext("A valid protocol must be specified.");

               }

                       if (isset($_POST['proto']) && ($_POST['proto'] == 'udp' || $_POST['proto'] == 'tcp')) {

                               $config['unbound']['proto'] = $_POST['proto'];

                       } else {

                               unset($config['unbound']['proto']);

                       }

$tab_array[] = array(gettext("Security and Privacy"), false, "services_unbound_security.php");

       'proto',

       'Protocols',

       $pconfig['proto'],

       array('both' => 'Both UDP and TCP', 'udp' => 'UDP only', 'tcp' => 'TCP only')

))->setHelp('Normally the resolver will allow both UDP and TCP for incoming and outgoing data. In some cases - particularly when DNS traffic will be proxied or tunnelled ' .

       '- it can be necessary to restrict the resolver to using only UDP or only TCP.%1$sThis setting should usually be left at the default, "both".%2$s',

       '<br/><b>',

       '</b>'

);

$section->addInput(new Form_Select(

++ /usr/local/www/services_unbound_security.php       2018-04-19 17:19:08.000000000 +0100

<?php

/*

 * services_unbound_security.php

 *

 * part of pfSense (https://www.pfsense.org)

 * Copyright (c) 2004-2018 Rubicon Communications, LLC (Netgate)

 * Copyright (c) 2014 Warren Baker (warren@pfsense.org)

 * All rights reserved.

 *

 * Licensed under the Apache License, Version 2.0 (the "License");

 * you may not use this file except in compliance with the License.

 * You may obtain a copy of the License at

 *

 * http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

##|+PRIV

##|*IDENT=page-services-dnsresolver-security

##|*NAME=Services: DNS Resolver: Security and Privacy

##|*DESCR=Allow access to the 'Services: DNS Resolver: Security and Privacy' page.

##|*MATCH=services_unbound_security.php*

##|-PRIV

require_once("guiconfig.inc");

require_once("unbound.inc");

$dnssec_opts = array(

       0 => array(

               'descrip' => 'DNSSEC disabled',

               'dnssec_value' => false,

               'dnssecstripped_value' => false

       ),

       1 => array(

               'descrip' => 'DNSSEC enabled: zones without DNSSEC data considered INSECURE',

               'dnssec_value' => true,

               'dnssecstripped_value' => false

       ),

       2 => array(

               'descrip' => 'DNSSEC enabled and hardened: zones without DNSSEC data considered BOGUS',

               'dnssec_value' => true,

               'dnssecstripped_value' => true

       )

);

$qname_opts = array(

       'disabled' => 'QNAME minimization disabled',

       'preferred' => 'QNAME minimization preferred ("best efforts")',

       'strict' => 'QNAME minimization required'

);

if (!is_array($config['unbound'])) {

       $config['unbound'] = array();

}

if (isset($config['unbound']['hideidentity'])) {

       $pconfig['hideidentity'] = true;

}

if (isset($config['unbound']['hideversion'])) {

       $pconfig['hideversion'] = true;

}

if (isset($a_unboundcfg['dnssec'])) {

       $pconfig['dnssec'] = true;

}

if (isset($config['unbound']['dnssecstripped'])) {

       $pconfig['dnssecstripped'] = true;

}

if (isset($config['unbound']['use_caps'])) {

       $pconfig['use_caps'] = true;

}

if (array_key_exists($config['unbound']['qname'], $qname_opts)) {

       $pconfig['qname'] = $config['unbound']['qname'];

} else {

       $pconfig['qname'] = 'disabled';

}

if (isset($config['unbound']['tls_upstream'])) {

       $pconfig['tls_upstream'] = true;

}

if ($_POST) {

       if ($_POST['apply']) {

               $retval = 0;

               $retval |= services_unbound_configure();

               if ($retval == 0) {

                       clear_subsystem_dirty('unbound');

               }

       } else {

               unset($input_errors);

               $pconfig = $_POST;

               if (!array_key_exists($_POST['dnssec_level'], $dnssec_opts)) {

                       $input_errors[] = gettext("Invalid DNSSEC option.");

               }

               if (!array_key_exists($_POST['qname'], $qname_opts)) {

                       $input_errors[] = gettext("Invalid QNAME minimization option.");

               }

               if (!$input_errors) {

                       if (isset($_POST['hideidentity'])) {

                               $config['unbound']['hideidentity'] = true;

                       } else {

                               unset($config['unbound']['hideidentity']);

                       }

                       if (isset($_POST['hideversion'])) {

                               $config['unbound']['hideversion'] = true;

                       } else {

                               unset($config['unbound']['hideversion']);

                       }

                       $config['unbound']['dnssec'] = $dnsopts[$_POST['dnssec_level']]['dnssec_value'];

                       if ($dnsopts[$_POST['dnssec_level']]['dnssecstripped_value']) {

                               $config['unbound']['dnssecstripped'] = true;

                       } else {

                               unset($config['unbound']['dnssecstripped']);

                       }

                       if (isset($_POST['use_caps'])) {

                               $config['unbound']['use_caps'] = true;

                       } else {

                               unset($config['unbound']['use_caps']);

                       }

                       $config['qname'] = $_POST['qname'];

                       if (isset($_POST['tls_upstream'])) {

                               $config['unbound']['tls_upstream'] = true;

                       } else {

                               unset($config['unbound']['tls_upstream']);

                       }

                       write_config(gettext("DNS Resolver configured."));

                       mark_subsystem_dirty('unbound');

               }

       }

}

$pgtitle = array(gettext("Services"), gettext("DNS Resolver"), gettext("Security and Privacy"));

$pglinks = array("", "services_unbound.php", "@self");

$shortcut_section = "resolver";

include_once("head.inc");

if ($input_errors) {

       print_input_errors($input_errors);

}

if ($_POST['apply']) {

       print_apply_result_box($retval);

}

if (is_subsystem_dirty('unbound')) {

       print_apply_box(gettext("The DNS resolver configuration has been changed.") . "<br />" . gettext("The changes must be applied for them to take effect."));

}

$tab_array = array();

$tab_array[] = array(gettext("General Settings"), false, "services_unbound.php");

$tab_array[] = array(gettext("Security and Privacy"), true, "services_unbound_security.php");

$tab_array[] = array(gettext("Advanced Settings"), false, "services_unbound_advanced.php");

$tab_array[] = array(gettext("Access Lists"), false, "/services_unbound_acls.php");

display_top_tabs($tab_array, true);

$form = new Form();

$section = new Form_Section('Resolver Security and Privacy Options');

$section->addInput(new Form_Checkbox(

       'hideidentity',

       'Hide Identity',

       'id.server and hostname.bind queries are refused',

       $pconfig['hideidentity']

));

$section->addInput(new Form_Checkbox(

       'hideversion',

       'Hide Version',

       'version.server and version.bind queries are refused',

       $pconfig['hideversion']

));

if (!isset($pconfig['dnssec']) || !$pconfig['dnssec']) {

       $lev = 0;

} elseif (!isset($pconfig['dnssecstripped']) || !$pconfig['dnssecstripped']) {

       $lev = 1;

} else {

       $lev=2;

}

$section->addInput(new Form_Select(

       'dnssec_level',

       'DNSSEC enable and hardening',

       $lev,

       array_combine(array_keys($dnssec_opts), array_column($dnssec_opts, 'descrip'))

))->setHelp('When DNSSEC is enabled, DNS data will be required in all replies, for trust-anchored zones.<br/>' .

       'A zone whose reply omits DNSSEC data will be treated as INSECURE, ' .

       'or as BOGUS with hardening selected.');

$section->addInput(new Form_Checkbox(

       'use_caps',

       'Experimental Bit 0x20 Support',

       'Use 0x-20 encoded random bits in the DNS query to foil spoofing attempts.',

       $pconfig['use_caps']

))->setHelp('See the implementation %1$sdraft dns-0x20%2$s for more information.', '<a href="https://tools.ietf.org/html/draft-vixie-dnsext-dns0x20-00">', '</a>');

$section->addInput(new Form_Select(

       'QNAME minimization',

       'Minimize data sent to DNS servers',

       $pconfig['qname'],

       $qname_opts

))->setHelp('QNAME minimization is a privacy option that reduces the risk that a third party or major DNS servers can track domain queries.%1$s' .

       '%2$sDisabled (the default for most devices on the Internet)%3$s -  full query information is sent to DNS servers, for fast and efficient lookup.%4$s' .

       '%2$sPreferred%3$s - The resolver attempts to query each DNS server for one level of the domain only. For example, %5$swww.example.com%6$s will ' .

       'be resolved by querying a root server for the ".com" domain, then querying the .com name server for "example.com", and finally querying the ' .

       '.example.com name server for "www.example.com". The result is that higher level name servers do not see lower level subdomain targets. %5$s' .

       'Many DNS servers do not support this feature yet. The resolver will retry with normal lookup on failure.%6$s%4$s' .

       '%2$sStrict%3$s - The lookup will fail if QNAME minimization can not be maintained (instead of falling back to usual lookup). ' .

       '%2$sWarning: This will cause DNS lookup failure for many sites and domains!%3$s%7$s',

       '<ul><li>',

       '<b>',

       '</b>',

       '</li><li>',

       '<i>',

       '</i>',

       '</li></ul>'

);

$section->addInput(new Form_Checkbox(

       'tls_upstream',

       'Use TLS for upstream queries',

       '',

       $pconfig['tls_upstream']

))->setHelp('Wrap outgoing DNS queries within TLS encryption. This provides good security for the query and reply %1$sbetween this platform ' .

       'and the DNS server%2$s, but does not protect against a malicious user or logging with access to the DNS server or the local network.<br/>' .

       '%1$sWarning: not all servers can accept TLS. If a remote DNS server can not accept TLS, then the DNS query will fail.%2$s',

       '<b>',

       '</b>'

);

$form->add($section);

print($form);

include("foot.inc");

++ /etc/inc/unbound.inc 2018-04-19 18:03:11.000000000 +0100

       // only disallow TCP if option set to UDP and vice-versa

       $do_udp = ($unboundcfg['proto'] == 'tcp') ? "no" : "yes";

       $do_tcp = ($unboundcfg['proto'] == 'udp') ? "no" : "yes";

       $tls_upstream = isset($unboundcfg['tls_upstream']) ? "yes" : "no";

    $qname_minimisation = ($unboundcfg['qname'] == 'preferred' || $unboundcfg['qname'] == 'strict')  ? "yes" : "no";

       $qname_minimisation_strict = ($unboundcfg['qname'] == 'strict')  ? "yes" : "no";

do-udp: {$do_udp}

do-tcp: {$do_tcp}

qname-minimisation: {$qname_minimisation}

qname-minimisation-strict: {$qname_minimisation_strict}

### UPSTREAM BUG: FIXME: for some reason "tls-upstream" isn't accepted, but the equivalent "ssl-upstream" is fine. So use that instead!

ssl-upstream: {$tls_upstream}