Project

General

Profile

Actions
Copy link

Bug #15925

open

DNS Resolver option for Query Name Minimization cannot be disabled

Added by David Burns about 1 month ago. Updated 1 day ago.

Status:
Feedback
Priority:
Normal
Assignee:
Marcos M
Category:
DNS Resolver
Target version:
2.8.0
Start date:
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
25.03
Release Notes:
Default
Affected Version:
2.8.0
Affected Architecture:
All

Description

In the pfSense DNS Resolver / Advanced Settings there is a setting for Query Name Minimisation which in the pfSense UI defaults to off.
  • Enabling the Query Name Minimisation setting in pfSense UI results in the addition of
    qname-minimisation: yes
    to pfSense unbound.conf as expected.
  • If the Query Name Minimisation is disabled in the pfSense UI (default) then the qname-minimisation config line is removed.

However the Unbound default for the qname-minimisation setting is on (refer https://nlnetlabs.nl/documentation/unbound/unbound.conf/)

qname-minimisation: <yes or no>
              Send minimum amount of information to upstream  servers  to  en-
              hance  privacy.   Only send minimum required labels of the QNAME
              and set QTYPE to A when possible.  Best  effort  approach;  full
              QNAME and original QTYPE will be sent when upstream replies with
              a RCODE other than NOERROR, except when receiving NXDOMAIN  from
              a DNSSEC signed zone. Default is yes.

On checking the Unbound release changes documentation the default appears to have changed quite some time ago. This likely impacts both pfSense & pfSense Plus.

Proposed fix: modify the configuration generation logic so that the pfSense UI generates
qname-minimisation: no
for the default setting.

Suggestion: with this change additional logic could also be considered to warn the user that qname-minimisation is not useful when Unbound is configured as a forwarding resolver
(refer https://docs.quad9.net/Quad9_For_Organizations/DNS_Forwarder_Best_Practices/#disable-qname-minimization)

Actions
Copy link
 #1

Updated by Jim Pingle about 1 month ago

  • Subject changed from Unbound query name minimisation enabled by default to DNS Resolver option for Query Name Minimization cannot be disabled
  • Status changed from New to Confirmed
  • Target version set to 2.8.0
  • Plus Target Version set to 25.03

The default for that one must have changed upstream. As it is now, it's always on and can't be disabled.

We may also want to change our default to match the new default in Unbound, but it should still work either way based on what the user selects, and it doesn't currently.

With the GUI option disabled:

: grep qname-minimisation /var/unbound/*.conf
: unbound-control -c /var/unbound/unbound.conf get_option qname-minimisation
yes

With the GUI option enabled:

: grep qname-minimisation /var/unbound/*.conf
/var/unbound/unbound.conf:qname-minimisation: yes
: unbound-control -c /var/unbound/unbound.conf get_option qname-minimisation
yes
Actions
Copy link
 #2

Updated by Jordan G 8 days ago

this behavior persists in 25.03.b.20250108.0156, GUI selection for q-name minimization has no effect when querying with unbound-control

Actions
Copy link
 #3

Updated by Marcos M 7 days ago

  • Assignee set to Marcos M
Actions
Copy link
 #4

Updated by Marcos M 6 days ago

  • Status changed from Confirmed to Pull Request Review
Actions
Copy link
 #5

Updated by Marcos M 6 days ago

  • Affected Version set to 2.8.0
Actions
Copy link
 #6

Updated by Marcos M 4 days ago

  • Status changed from Pull Request Review to Feedback
  • % Done changed from 0 to 100
Actions
Copy link
 #7

Updated by Christopher Cope 1 day ago

Tested on

25.03-BETA (amd64)
built on Wed Jan 8 1:56:00 UTC 2025
FreeBSD 15.0-CURRENT

Applying the patch makes the GUI checkbox function; however the default on pfSense is still off. If it is decided that the default should match upstream, that will still need an additional patch.

Actions
Copy link

Also available in: Atom PDF