dns/bind: add some small options (#1079)

dns/bind/pkg-descr

@@ -12,6 +12,8 @@ Plugin Changelog
 
 * Add Bing Strict Search
 * Add 4 new blacklists to DNSBL
+* Ability to hide system hostname and version
+* Rate-Limiting support
 
 1.3
 

dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml

@@ -59,4 +59,41 @@
         <type>dropdown</type>
         <help>Default is "No". Set to "Auto" to use the static trust anchor configuration by the system.</help>
     </field>
+    <field>
+        <id>general.hidehostname</id>
+        <label>Hide Hostname</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help>This will hide the system hostname for DNS queries.</help>
+    </field>
+    <field>
+        <id>general.hideversion</id>
+        <label>Hide Version</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help>This will hide the local BIND version in DNS queries.</help>
+    </field>
+    <field>
+        <id>general.enableratelimiting</id>
+        <label>Enable Rate Limiting</label>
+        <type>checkbox</type>
+        <advanced>true</advanced>
+        <help>This will enable rate-limiting for DNS replies.</help>
+    </field>
+    <field>
+        <id>general.ratelimitcount</id>
+        <label>Rate Limit Replies</label>
+        <type>text</type>
+        <advanced>true</advanced>
+        <help>Set how many replies per second are allowed.</help>
+    </field>
+    <field>
+        <id>general.ratelimitexcept</id>
+        <label>Rate Limit Exceptions</label>
+        <style>tokenize</style>
+        <type>select_multiple</type>
+        <allownew>true</allownew>
+        <advanced>true</advanced>
+        <help>Except a list of IPs from rate-limiting like ::1</help>
+    </field>
 </form>

dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml

@@ -1,7 +1,7 @@
 <model>
     <mount>//OPNsense/bind/general</mount>
     <description>BIND configuration</description>
-    <version>1.0.4</version>
+    <version>1.0.5</version>
     <items>
         <enabled type="BooleanField">
             <default>0</default>
@@ -67,5 +67,29 @@
             <Multiple>N</Multiple>
             <Required>Y</Required>
         </dnssecvalidation>
+        <hidehostname type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </hidehostname>
+        <hideversion type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </hideversion>
+        <enableratelimiting type="BooleanField">
+            <default>0</default>
+            <Required>Y</Required>
+        </enableratelimiting>
+        <ratelimitcount type="IntegerField">
+            <Required>N</Required>
+            <MinimumValue>1</MinimumValue>
+            <MaximumValue>1000</MaximumValue>
+            <ValidationMessage>Choose a value between 1 and 1000.</ValidationMessage>
+        </ratelimitcount>
+        <ratelimitexcept type="NetworkField">
+            <default>127.0.0.1,::1</default>
+            <FieldSeparator>,</FieldSeparator>
+            <Required>Y</Required>
+            <asList>Y</asList>
+        </ratelimitexcept>
     </items>
 </model>

dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf

@@ -38,15 +38,28 @@ options {
 {%   endfor %}
 {% endif %}
 
-
 {% if helpers.exists('OPNsense.bind.general.maxcachesize') and OPNsense.bind.general.maxcachesize != '' %}
         max-cache-size    {{ OPNsense.bind.general.maxcachesize }}%;
 {% endif %}
-
 {% if helpers.exists('OPNsense.bind.general.dnssecvalidation') and OPNsense.bind.general.dnssecvalidation != '' %}
         dnssec-validation    {{ OPNsense.bind.general.dnssecvalidation }};
 {% endif %}
-
+{% if helpers.exists('OPNsense.bind.general.hidehostname') and OPNsense.bind.general.hidehostname == '1' %}
+        hostname none;
+{% endif %}
+{% if helpers.exists('OPNsense.bind.general.hideversion') and OPNsense.bind.general.hideversion == '1' %}
+        version none;
+{% endif %}
+{% if helpers.exists('OPNsense.bind.general.enableratelimiting') and OPNsense.bind.general.enableratelimiting == '1' %}
+{%   if helpers.exists('OPNsense.bind.general.ratelimitcount') and OPNsense.bind.general.ratelimitcount != '' %}
+	rate-limit {
+                responses-per-second {{ OPNsense.bind.general.ratelimitcount }};
+{%     if helpers.exists('OPNsense.bind.general.ratelimitexcept') and OPNsense.bind.general.ratelimitexcept != '' %}
+                exempt-clients { {{ OPNsense.bind.general.ratelimitexcept.replace(',', '; ') }}; };
+{%     endif %}
+        };
+{%   endif %}
+{% endif %}
 };
 
 key "rndc-key" {