From e6ceff0fe134ff17d2ed9f7f5731f4ec8664b16a Mon Sep 17 00:00:00 2001
From: Joachim Friberg <friberg.joachim@gmail.com>
Date: Tue, 27 Feb 2024 16:45:36 +0100
Subject: [PATCH] dns/bind: allow RNDC key updates (#3830)

---
 dns/bind/Makefile                                            | 2 +-
 dns/bind/pkg-descr                                           | 4 ++++
 .../OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml      | 5 +++++
 .../src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml     | 4 ++++
 dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh         | 4 ++++
 .../src/opnsense/service/templates/OPNsense/Bind/named.conf  | 5 +++++
 6 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/dns/bind/Makefile b/dns/bind/Makefile
index 773381a4c..c7dbfdf42 100644
--- a/dns/bind/Makefile
+++ b/dns/bind/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		bind
-PLUGIN_VERSION=		1.29
+PLUGIN_VERSION=		1.30
 PLUGIN_COMMENT=		BIND domain name service
 PLUGIN_DEPENDS=		bind918
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
diff --git a/dns/bind/pkg-descr b/dns/bind/pkg-descr
index 160e424f5..fc882fdcd 100644
--- a/dns/bind/pkg-descr
+++ b/dns/bind/pkg-descr
@@ -10,6 +10,10 @@ WWW: https://www.isc.org
 Plugin Changelog
 ================
 
+1.30
+
+* Add ability for RNDC key updates from other nameservers
+
 1.29
 
 * Migrate General Log to Syslog
diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml
index f22169f61..143c95d27 100644
--- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml
+++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml
@@ -23,6 +23,11 @@
         <type>select_multiple</type>
         <help>Define the ACLs where you allow which client are allowed to query this zone.</help>
     </field>
+    <id>domain.allowrndcupdate</id>  
+        <label>Allow RDNC key update</label> 
+        <type>checkbox</type>        
+        <help>Allow updates via the RDNC key named "rndc-key". The key is shown in the general tab.</help>
+    </field>  
     <field>
         <id>domain.ttl</id>
         <label>TTL</label>
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml
index 7d89d9e16..e6ea2505d 100644
--- a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml
+++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml
@@ -72,6 +72,10 @@
                     <Multiple>Y</Multiple>
                     <Required>N</Required>
                 </allowquery>
+                <allowrndcupdate type="BooleanField">
+                    <default>1</default>
+                    <Required>Y</Required>
+                </allowrndcupdate>
                 <serial type="TextField">
                     <Required>N</Required>
                 </serial>
diff --git a/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh b/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh
index e46b77b4b..47a5e1549 100755
--- a/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh
+++ b/dns/bind/src/opnsense/scripts/OPNsense/Bind/setup.sh
@@ -15,3 +15,7 @@ chmod 755 /var/stats
 mkdir -p /var/log/named
 chown -R bind:bind /var/log/named
 chmod 755 /var/log/named
+
+mkdir -p /usr/local/etc/namedb/primary
+chown -R bind:bind /usr/local/etc/namedb/primary
+chmod 755 /usr/local/etc/namedb/primary
diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
index d6cf8515c..b0de3585d 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
@@ -180,6 +180,11 @@ zone "{{ domain.domainname }}" {
 {%              endfor %}
         };
 {%      endif %}
+{%      if domain.allowrndcupdate is defined and domain.allowrndc == "1" %}
+        update-policy {
+		grant rndc-key zonesub ANY;
+        };
+{%      endif %}
 };
 {%       if domain.type == 'secondary' and domain.transferkey is defined and not(domain.transferkeyname in usedkeys) %}
 {%         do usedkeys.append(domain.transferkeyname) %}