pad-queries default yes

diff --git a/doc/example.conf.in b/doc/example.conf.in
index ff68db014b2786aefb109d0d810eec0eeadc6258..ac282950f2d528bae2d67ab00c05e43001d5bd31 100644 (file)
--- a/doc/example.conf.in
+++ b/doc/example.conf.in
@@ -771,7 +771,7 @@ server:
        # tls-win-cert: no
 
        # Pad queries over TLS upstreams
-       # pad-queries: no
+       # pad-queries: yes
 
        # Padded queries will be padded to the closest multiple of this size.
        # pad-queries-block-size: 128

diff --git a/doc/unbound.conf.5.in b/doc/unbound.conf.5.in
index 12c2b20f6e838d3f7970cdbde45233b1d1a37178..107ccb93845124874080a6a2e2a50104aaa8b4cd 100644 (file)
--- a/doc/unbound.conf.5.in
+++ b/doc/unbound.conf.5.in
@@ -560,7 +560,7 @@ Default is 468.
 .B pad\-queries: \fI<yes or no>
 If enabled, all queries sent over TLS upstreams will be padded to the closest
 multiple of the size specified in \fBpad\-queries\-block\-size\fR.
-Default is no.
+Default is yes.
 .TP
 .B pad\-queries\-block\-size: \fI<number>
 The block size with which to pad queries sent over TLS upstreams.

diff --git a/util/config_file.c b/util/config_file.c
index 7f7f2dc22a0d67ec22c18e3f06452ce829818e34..1071f9a7b4beacbc2cbfb34862243b8bcd6d4a75 100644 (file)
--- a/util/config_file.c
+++ b/util/config_file.c
@@ -324,7 +324,7 @@ config_create(void)
        cfg->dnscrypt_nonce_cache_slabs = 4;
        cfg->pad_responses = 1;
        cfg->pad_responses_block_size = 468; /* from RFC8467 */
-       cfg->pad_queries = 0;
+       cfg->pad_queries = 1;
        cfg->pad_queries_block_size = 128; /* from RFC8467 */
 #ifdef USE_IPSECMOD
        cfg->ipsecmod_enabled = 1;

diff --git a/util/data/msgencode.c b/util/data/msgencode.c
index debb9eed100910dbab108c554ebf0734d5afe7e9..49e48954bb6e3057fa7318077e219cefd3a759be 100644 (file)
--- a/util/data/msgencode.c
+++ b/util/data/msgencode.c
@@ -843,8 +843,7 @@ attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns,
 
                /* By use of calc_edns_field_size, calling functions should
                 * have made sure that there is enough space for at least a
-                * zero sized padding option, but it cannot harm to leave it
-                * out if there isn't.
+                * zero sized padding option.
                 */
                log_assert(pad_pos + 4 <= msg_sz);