From 27bb69523f4a036acc37bc682eaa27e85b85ce4d Mon Sep 17 00:00:00 2001
From: Naomi Rennie-Waldock <naomi.renniewaldock@gmail.com>
Date: Thu, 19 Sep 2024 15:17:55 +0100
Subject: [PATCH] dns/bind: Add option to allow the rndc-key for zone transfers
 (#4177)

---
 .../Bind/forms/dialogEditBindPrimaryDomain.xml      |  6 ++++++
 .../mvc/app/models/OPNsense/Bind/Domain.xml         |  1 +
 .../service/templates/OPNsense/Bind/named.conf      | 13 +++++++++----
 3 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml
index 3a296f636..8439403d1 100644
--- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml
+++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml
@@ -17,6 +17,12 @@
         <type>select_multiple</type>
         <help>Define the ACLs where you allow which server can retrieve this zone.</help>
     </field>
+    <field>
+        <id>domain.allowrndctransfer</id>
+        <label>Allow RDNC key transfer</label>
+        <type>checkbox</type>
+        <help>Allow transfers via the RDNC key named "rndc-key". The key is shown in the general tab.</help>
+    </field>
     <field>
         <id>domain.allowquery</id>
         <label>Allow Query</label>
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml
index e6ea2505d..4541eb182 100644
--- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml
+++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml
@@ -61,6 +61,7 @@
                     <Multiple>Y</Multiple>
                     <Required>N</Required>
                 </allowtransfer>
+                <allowrndctransfer type="BooleanField"/>
                 <allowquery type="ModelRelationField">
                     <Model>
                         <template>
diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
index d479cfa16..00bf5afbb 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
@@ -164,12 +164,17 @@ zone "{{ domain.domainname }}" {
 {%       else %}
         file "/usr/local/etc/namedb/primary/{{ domain.domainname }}.db";
 {%       endif %}
-{%      if domain.allowtransfer is defined %}
+{%      if domain.allowtransfer is defined or (domain.allowrndctransfer is defined and domain.allowrndctransfer == "1") %}
         allow-transfer {
-{%              for acl in domain.allowtransfer.split(',') %}
-{%              set transfer_acl = helpers.getUUID(acl) %}
+{%              if domain.allowrndctransfer is defined and domain.allowrndctransfer == "1" %}
+                key "rndc-key";
+{%              endif %}
+{%              if domain.allowtransfer is defined %}
+{%                for acl in domain.allowtransfer.split(',') %}
+{%                  set transfer_acl = helpers.getUUID(acl) %}
                 {{ transfer_acl.name }};
-{%              endfor %}
+{%                endfor %}
+{%              endif %}
         };
 {%      endif %}
 {%      if domain.allowquery is defined %}