Unbound reload on rc.newwanip even when generated host entries are unchanged

[Retired_Ninja]

I am seeing a reproducible ~30–40 second DNS outage during WAN failback on pfSense Plus 26.07-RELEASE on a Netgate 6100.

I have traced this to the following path:

rc.newwanip
→ system_hosts_generate()
→ unbound_hosts_generate()
→ unbound_control("reload")

WAN/WAN2 are not configured as Unbound listening interfaces, and the interface guard in services_unbound_configure() is present and working.

However, system_hosts_generate() still calls unbound_hosts_generate(), which unconditionally reloads Unbound.

I verified that both /etc/hosts and /var/unbound/host_entries.conf are byte-for-byte unchanged before and after a complete WAN failover/failback cycle.

In my case this is particularly visible because pfBlockerNG runs in Unbound mode with a large DNSBL configuration:

/var/unbound/pfb_dnsbl.conf
96 MB
1,144,725 lines

unbound-checkconf /var/unbound/unbound.conf takes 37.38 seconds, and a direct pfSense-style Unbound reload produces approximately the same DNS outage.

I tested a local patch to unbound_hosts_generate() which compares host_entries.conf before/after generation and only calls unbound_control("reload") when the content actually changed.

With that patch:

WAN1 → WAN2 failover: DNS remains available
WAN2 → WAN1 failback: DNS remains available
resolver.log: no Unbound reload during failback

Would it make sense for pfSense to avoid the Unbound reload when the generated host_entries.conf is unchanged?

This appears related to, but distinct from, #12612 because the reload occurs through system_hosts_generate() rather than the later guarded services_unbound_configure() path.