From 1415dcccc24a88b1e5e5f0cca6854cb41c867e00 Mon Sep 17 00:00:00 2001
From: Zane Chua <4265429+zanechua@users.noreply.github.com>
Date: Wed, 2 Feb 2022 23:31:47 -0800
Subject: [PATCH] dns/bind: Implement filter-aaaa (#1722)

---
 .../OPNsense/Bind/forms/general.xml           | 20 +++++++++++++++++++
 .../mvc/app/models/OPNsense/Bind/General.xml  | 13 ++++++++++++
 .../templates/OPNsense/Bind/named.conf        | 14 +++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
index da2938c35..8c1521210 100644
--- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
+++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
@@ -69,6 +69,26 @@
         <allownew>true</allownew>
         <help>Set one or more hosts to send your DNS queries if the request is unknown.</help>
     </field>
+    <field>
+        <id>general.filteraaaav4</id>
+        <label>Enable filter-aaaa on IPv4 Clients</label>
+        <type>checkbox</type>
+        <help>This will filter AAAA records on IPv4 Clients</help>
+    </field>
+    <field>
+        <id>general.filteraaaav6</id>
+        <label>Enable filter-aaaa on IPv6 Clients</label>
+        <type>checkbox</type>
+        <help>This will filter AAAA records on IPv6 Clients</help>
+    </field>
+    <field>
+        <id>general.filteraaaaacl</id>
+        <label>ACl for filter-aaaa</label>
+        <style>tokenize</style>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+        <help>Specifies a list of client addresses for which AAAA filtering is to be applied.</help>
+    </field>
     <field>
         <id>general.logsize</id>
         <label>Logsize in MB</label>
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
index 5d67e7931..edd75d160 100644
--- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
+++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
@@ -56,6 +56,19 @@
             <Required>N</Required>
             <asList>Y</asList>
         </forwarders>
+        <filteraaaav4 type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </filteraaaav4>
+        <filteraaaav6 type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </filteraaaav6>
+        <filteraaaaacl type="NetworkField">
+            <FieldSeparator>,</FieldSeparator>
+            <Required>N</Required>
+            <asList>Y</asList>
+        </filteraaaaacl>
         <logsize type="IntegerField">
             <default>5</default>
             <Required>Y</Required>
diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
index abb5b5720..d0c552157 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
@@ -193,3 +193,17 @@ logging {
         category lame-servers { null; };
 };
 {% endif %}
+
+{% if helpers.exists('OPNsense.bind.general.filteraaaav4') and OPNsense.bind.general.filteraaaav4 == '1' or helpers.exists('OPNsense.bind.general.filteraaaav6') and OPNsense.bind.general.filteraaaav6 == '1' %}
+plugin query "/usr/local/lib/named/filter-aaaa.so" {
+{% if helpers.exists('OPNsense.bind.general.filteraaaav4') and OPNsense.bind.general.filteraaaav4 == '1' %}
+                   filter-aaaa-on-v4 yes;
+{% endif %}
+{% if helpers.exists('OPNsense.bind.general.filteraaaav6') and OPNsense.bind.general.filteraaaav6 == '1' %}
+                   filter-aaaa-on-v6 yes;
+{% endif %}
+{% if helpers.exists('OPNsense.bind.general.filteraaaaacl') and OPNsense.bind.general.filteraaaaacl != '' %}
+        filter-aaaa    { {{ OPNsense.bind.general.filteraaaaacl.replace(',', '; ') }}; };
+{% endif %}
+           };
+{% endif %}