dns/bind: Add option to allow the rndc-key for zone transfers (#4177)

dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml

@@ -17,6 +17,12 @@
         <type>select_multiple</type>
         <help>Define the ACLs where you allow which server can retrieve this zone.</help>
     </field>
+    <field>
+        <id>domain.allowrndctransfer</id>
+        <label>Allow RDNC key transfer</label>
+        <type>checkbox</type>
+        <help>Allow transfers via the RDNC key named "rndc-key". The key is shown in the general tab.</help>
+    </field>
     <field>
         <id>domain.allowquery</id>
         <label>Allow Query</label>

dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml

@@ -61,6 +61,7 @@
                     <Multiple>Y</Multiple>
                     <Required>N</Required>
                 </allowtransfer>
+                <allowrndctransfer type="BooleanField"/>
                 <allowquery type="ModelRelationField">
                     <Model>
                         <template>

dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf

@@ -164,12 +164,17 @@ zone "{{ domain.domainname }}" {
 {%       else %}
         file "/usr/local/etc/namedb/primary/{{ domain.domainname }}.db";
 {%       endif %}
-{%      if domain.allowtransfer is defined %}
+{%      if domain.allowtransfer is defined or (domain.allowrndctransfer is defined and domain.allowrndctransfer == "1") %}
         allow-transfer {
-{%              for acl in domain.allowtransfer.split(',') %}
-{%              set transfer_acl = helpers.getUUID(acl) %}
+{%              if domain.allowrndctransfer is defined and domain.allowrndctransfer == "1" %}
+                key "rndc-key";
+{%              endif %}
+{%              if domain.allowtransfer is defined %}
+{%                for acl in domain.allowtransfer.split(',') %}
+{%                  set transfer_acl = helpers.getUUID(acl) %}
                 {{ transfer_acl.name }};
-{%              endfor %}
+{%                endfor %}
+{%              endif %}
         };
 {%      endif %}
 {%      if domain.allowquery is defined %}