From 3a163e8c941d8e1b9d75c4f1b977e03884a50eec Mon Sep 17 00:00:00 2001
From: Ang Iongchun <ang@iongchun.tw>
Date: Thu, 15 Apr 2021 19:48:10 +0800
Subject: [PATCH] dns/bind: enhance allow transfer (#1814)

* dns/bind: allow-transfer/query for slave zones

* dns/bind: global allow-transfer configuration
---
 .../Bind/forms/dialogEditBindDomain.xml       | 24 +++++++++----------
 .../OPNsense/Bind/forms/general.xml           |  6 +++++
 .../mvc/app/models/OPNsense/Bind/General.xml  | 11 +++++++++
 .../templates/OPNsense/Bind/named.conf        |  7 ++++++
 4 files changed, 36 insertions(+), 12 deletions(-)

diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDomain.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDomain.xml
index dfd13fd20..c5e51d492 100644
--- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDomain.xml
+++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindDomain.xml
@@ -11,6 +11,18 @@
         <type>text</type>
         <help>Set the name for this zone. Both forward and reverse zones may be specified, i.e. example.com or 0.168.192.in-addr.arpa.</help>
     </field>
+    <field>
+        <id>domain.allowtransfer</id>
+        <label>Allow Transfer</label>
+        <type>dropdown</type>
+        <help>Define an ACL where you allow which server can retrieve this zone.</help>
+    </field>
+    <field>
+        <id>domain.allowquery</id>
+        <label>Allow Query</label>
+        <type>dropdown</type>
+        <help>Define an ACL where you allow which client are allowed to query this zone.</help>
+    </field>
     <field>
         <id>domain.type</id>
         <label>Type</label>
@@ -41,18 +53,6 @@
         <type>header</type>
         <style>zone_type zone_type_master</style>
     </field>
-    <field>
-        <id>domain.allowtransfer</id>
-        <label>Allow Transfer</label>
-        <type>dropdown</type>
-        <help>Define an ACL where you allow which server can retrieve this zone. If this value is empty, domain transfers from everywhere are allowed.</help>
-    </field>
-    <field>
-        <id>domain.allowquery</id>
-        <label>Allow Query</label>
-        <type>dropdown</type>
-        <help>Define an ACL where you allow which client are allowed to query this zone.</help>
-    </field>
     <field>
         <id>domain.ttl</id>
         <label>TTL</label>
diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
index 1889a6a47..05ea9fb72 100644
--- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
+++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
@@ -73,6 +73,12 @@
         <type>dropdown</type>
         <help>Define an ACL where you allow which clients can resolve via this service. Usually use your local LAN.</help>
     </field>
+    <field>
+        <id>general.allowtransfer</id>
+        <label>Allow Transfer</label>
+        <type>dropdown</type>
+        <help>Define an ACL where you allow which server can retrieve zones.</help>
+    </field>
     <field>
         <id>general.dnssecvalidation</id>
         <label>DNSSEC Validation</label>
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
index 1d0dc3c7f..455f87d3d 100644
--- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
+++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
@@ -72,6 +72,17 @@
             <Required>N</Required>
             <ValidationMessage>Choose an ACL.</ValidationMessage>
         </recursion>
+        <allowtransfer type="ModelRelationField">
+            <Model>
+                <template>
+                    <source>OPNsense.Bind.Acl</source>
+                    <items>acls.acl</items>
+                    <display>name</display>
+                </template>
+            </Model>
+            <Multiple>N</Multiple>
+            <Required>N</Required>
+        </allowtransfer>
         <dnssecvalidation type="OptionField">
             <OptionValues>
                 <no>No</no>
diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
index 9309033bc..e6f4a53d2 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
@@ -46,6 +46,13 @@ options {
 {%   endfor %}
 {% endif %}
 
+{% if helpers.exists('OPNsense.bind.general.allowtransfer') and OPNsense.bind.general.allowtransfer != '' %}
+{%   for list in helpers.toList('OPNsense.bind.general.allowtransfer') %}
+{%   set allowtransfer = helpers.getUUID(list) %}
+        allow-transfer    { {{ allowtransfer.name }}; };
+{%   endfor %}
+{% endif %}
+
 {% if helpers.exists('OPNsense.bind.general.maxcachesize') and OPNsense.bind.general.maxcachesize != '' %}
         max-cache-size    {{ OPNsense.bind.general.maxcachesize }}%;
 {% endif %}