dns/bind: allow RNDC key updates (#3830)

dns/bind/Makefile

@@ -1,5 +1,5 @@
 PLUGIN_NAME=		bind
-PLUGIN_VERSION=		1.29
+PLUGIN_VERSION=		1.30
 PLUGIN_COMMENT=		BIND domain name service
 PLUGIN_DEPENDS=		bind918
 PLUGIN_MAINTAINER=	m.muenz@gmail.com

dns/bind/pkg-descr

@@ -10,6 +10,10 @@ WWW: https://www.isc.org
 Plugin Changelog
 ================
 
+1.30
+
+* Add ability for RNDC key updates from other nameservers
+
 1.29
 
 * Migrate General Log to Syslog

dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml

@@ -23,6 +23,11 @@
         <type>select_multiple</type>
         <help>Define the ACLs where you allow which client are allowed to query this zone.</help>
     </field>
+    <id>domain.allowrndcupdate</id>  
+        <label>Allow RDNC key update</label> 
+        <type>checkbox</type>        
+        <help>Allow updates via the RDNC key named "rndc-key". The key is shown in the general tab.</help>
+    </field>  
     <field>
         <id>domain.ttl</id>
         <label>TTL</label>

dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml

@@ -72,6 +72,10 @@
                     <Multiple>Y</Multiple>
                     <Required>N</Required>
                 </allowquery>
+                <allowrndcupdate type="BooleanField">
+                    <default>1</default>
+                    <Required>Y</Required>
+                </allowrndcupdate>
                 <serial type="TextField">
                     <Required>N</Required>
                 </serial>

dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh

@@ -15,3 +15,7 @@ chmod 755 /var/stats
 mkdir -p /var/log/named
 chown -R bind:bind /var/log/named
 chmod 755 /var/log/named
+
+mkdir -p /usr/local/etc/namedb/primary
+chown -R bind:bind /usr/local/etc/namedb/primary
+chmod 755 /usr/local/etc/namedb/primary

dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf

@@ -180,6 +180,11 @@ zone "{{ domain.domainname }}" {
 {%              endfor %}
         };
 {%      endif %}
+{%      if domain.allowrndcupdate is defined and domain.allowrndc == "1" %}
+        update-policy {
+		grant rndc-key zonesub ANY;
+        };
+{%      endif %}
 };
 {%       if domain.type == 'secondary' and domain.transferkey is defined and not(domain.transferkeyname in usedkeys) %}
 {%         do usedkeys.append(domain.transferkeyname) %}