opnsense · Jeremy-Boyle · Nov 14, 2024
diff --git a/dns/bind/Makefile b/dns/bind/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		bind
-PLUGIN_VERSION=		1.33
+PLUGIN_VERSION=		1.34
 PLUGIN_COMMENT=		BIND domain name service
 PLUGIN_DEPENDS=		bind920
 PLUGIN_MAINTAINER=	[email protected]

diff --git a/dns/bind/pkg-descr b/dns/bind/pkg-descr
@@ -8,6 +8,10 @@ WWW: https://www.isc.org
 
 Plugin Changelog
 ================
+1.34
+
+* Added page for management of keys for rndc control and transfer usage (contributed by Jeremy Jeremy-Boyle)
+* Fix out of sync journal with pre-start and pre-stop scripts (contributed by Jeremy Jeremy-Boyle)
 
 1.33
 

diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/KeyController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/KeyController.php
@@ -0,0 +1,65 @@
+<?php
+
+/**
+ *    Copyright (C) 2024 Jeremy Boyle
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+
+namespace OPNsense\Bind\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class KeyController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'key';
+    protected static $internalModelClass = '\OPNsense\Bind\Key';
+
+    public function searchKeyAction()
+    {
+        return $this->searchBase('keys.key', array("enabled", "name","algo","secret"));
+    }
+    public function getKeyAction($uuid = null)
+    {
+        $this->sessionClose();
+        return $this->getBase('key', 'keys.key', $uuid);
+    }
+    public function addKeyAction()
+    {
+        return $this->addBase('key', 'keys.key');
+    }
+    public function delKeyAction($uuid)
+    {
+        return $this->delBase('keys.key', $uuid);
+    }
+    public function setKeyAction($uuid)
+    {
+        return $this->setBase('key', 'keys.key', $uuid);
+    }
+    public function toggleKeyAction($uuid)
+    {
+        return $this->toggleBase('keys.key', $uuid);
+    }
+}
diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php
@@ -35,6 +35,7 @@ public function indexAction()
         $this->view->generalForm = $this->getForm("general");
         $this->view->dnsblForm = $this->getForm("dnsbl");
         $this->view->formDialogEditBindAcl = $this->getForm("dialogEditBindAcl");
+        $this->view->formDialogEditBindKey = $this->getForm("dialogEditBindKey");
         $this->view->formDialogEditBindPrimaryDomain = $this->getForm("dialogEditBindPrimaryDomain");
         $this->view->formDialogEditBindSecondaryDomain = $this->getForm("dialogEditBindSecondaryDomain");
         $this->view->formDialogEditBindRecord = $this->getForm("dialogEditBindRecord");

diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindKey.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindKey.xml
@@ -0,0 +1,28 @@
+<form>
+    <field>
+        <id>key.enabled</id>
+        <label>Enabled</label>
+        <type>checkbox</type>
+        <help>This will enable or disable the key.</help>
+    </field>
+    <field>
+        <id>key.name</id>
+        <label>Name</label>
+        <type>text</type>
+        <help>Set the name for this key key.</help>
+    </field>
+    <field>
+        <id>key.algo</id>
+        <label>Algorithm</label>
+        <type>dropdown</type>
+        <advanced>true</advanced>
+        <help>Set the authentication algorithm for the key. This requires a restart of the Bind Service.</help>
+    </field>
+    <field>
+        <id>key.secret</id>
+        <label>Secret</label>
+        <type>text</type>
+        <advanced>true</advanced>
+        <help>The base64-encoded key. This requires a restart of the Bind Service.</help>
+    </field>
+</form>
diff --git a/...bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml b/...bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/dialogEditBindPrimaryDomain.xml
@@ -17,11 +17,17 @@
         <type>select_multiple</type>
         <help>Define the ACLs where you allow which server can retrieve this zone.</help>
     </field>
+    <field>
+        <id>domain.allowedkeys</id>
+        <label>Allowed RNDC keys</label>
+        <type>select_multiple</type>
+        <help>Allowed RNDC keys for this zone.</help>
+    </field>
     <field>
         <id>domain.allowrndctransfer</id>
-        <label>Allow RDNC key transfer</label>
+        <label>Allow RNDC key transfer</label>
         <type>checkbox</type>
-        <help>Allow transfers via the RDNC key named "rndc-key". The key is shown in the general tab.</help>
+        <help>Allow transfers via the selected RNDC keys</help>
     </field>
     <field>
         <id>domain.allowquery</id>
@@ -31,9 +37,9 @@
     </field>
     <field>
         <id>domain.allowrndcupdate</id>
-        <label>Allow RDNC key update</label>
+        <label>Allow RNDC key update</label>
         <type>checkbox</type>
-        <help>Allow updates via the RDNC key named "rndc-key". The key is shown in the general tab.</help>
+        <help>Allow updates via the selected RNDC keys.</help>
     </field>
     <field>
         <id>domain.ttl</id>

diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/general.xml
@@ -182,17 +182,17 @@
         <advanced>true</advanced>
     </field>
     <field>
-        <id>general.rndcalgo</id>
-        <label>Algorithm</label>
-        <type>dropdown</type>
+        <id>general.rndccontrolkeys</id>
+        <label>Allowed RNDC Control Keys</label>
+        <type>select_multiple</type>
+        <help>Allowed RNDC control keys</help>
         <advanced>true</advanced>
-        <help>Set the authentication algorithm for the RNDC key. This requires a restart of the Bind Service.</help>
     </field>
     <field>
-        <id>general.rndcsecret</id>
-        <label>Secret</label>
-        <type>text</type>
+        <id>general.defaultrndccontrolkey</id>
+        <label>Default RNDC Control Key</label>
+        <type>dropdown</type>
+        <help>Default RNDC control key</help>
         <advanced>true</advanced>
-        <help>The base64-encoded RNDC key. This requires a restart of the Bind Service.</help>
     </field>
 </form>
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml
@@ -51,6 +51,16 @@
                     <Multiple>Y</Multiple>
                 </allowtransfer>
                 <allowrndctransfer type="BooleanField"/>
+                <allowedkeys type="ModelRelationField">
+                    <Model>
+                        <template>
+                            <source>OPNsense.Bind.Key</source>
+                            <items>keys.key</items>
+                            <display>name</display>
+                        </template>
+                    </Model>
+                    <Multiple>Y</Multiple>
+                </allowedkeys>
                 <allowquery type="ModelRelationField">
                     <Model>
                         <template>

diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/General.xml
@@ -156,7 +156,7 @@
             <Required>Y</Required>
             <asList>Y</asList>
         </ratelimitexcept>
-        <rndcalgo type="OptionField">
+        <!-- <rndcalgo type="OptionField">
             <Required>Y</Required>
             <Default>hmac-sha256</Default>
             <OptionValues>
@@ -171,6 +171,29 @@
         <rndcsecret type="Base64Field">
             <Required>Y</Required>
             <Default>VxtIzJevSQXqnr7h2qerrcwjnZlMWSGGFBndKeNIDfw=</Default>
-        </rndcsecret>
+        </rndcsecret> -->
+        <rndccontrolkeys type="ModelRelationField">
+            <Model>
+                <template>
+                    <source>OPNsense.Bind.Key</source>
+                    <items>keys.key</items>
+                    <display>name</display>
+                    <group>name</group>
+                </template>
+            </Model>
+            <Multiple>Y</Multiple>
+        </rndccontrolkeys>
+        <defaultrndccontrolkey type="ModelRelationField">
+            <Model>
+                <template>
+                    <source>OPNsense.Bind.Key</source>
+                    <items>keys.key</items>
+                    <display>name</display>
+                    <group>name</group>
+                </template>
+            </Model>
+            <Multiple>N</Multiple>
+            <AllowDynamic>N</AllowDynamic>
+        </defaultrndccontrolkey>
     </items>
 </model>
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Key.php b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Key.php
@@ -0,0 +1,45 @@
+<?php
+
+/*
+    Copyright (C) 2024 Jeremy Boyle
+
+    All rights reserved.
+    Redistribution and use in source and binary forms, with or without
+    modification, are permitted provided that the following conditions are met:
+    1. Redistributions of source code must retain the above copyright notice,
+       this list of conditions and the following disclaimer.
+    2. Redistributions in binary form must reproduce the above copyright
+       notice, this list of conditions and the following disclaimer in the
+       documentation and/or other materials provided with the distribution.
+    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+    POSSIBILITY OF SUCH DAMAGE.
+*/
+
+namespace OPNsense\Bind;
+
+use OPNsense\Base\BaseModel;
+
+class Key extends BaseModel
+{
+    /**
+     * @param $uuid string key uuid
+     * @return mixed key
+     */
+    public function getKey($uuid)
+    {
+        foreach ($this->keys->key->iterateItems() as $key) {
+            if ($key->getAttribute('uuid') == $uuid) {
+                return $key;
+            }
+        }
+        return null;
+    }
+}
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Key.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Key.xml
@@ -0,0 +1,42 @@
+<model>
+    <mount>//OPNsense/bind/key</mount>
+    <description>BIND KEY configuration</description>
+    <version>1.0.0</version>
+    <items>
+        <keys>
+            <key type="ArrayField">
+                <enabled type="BooleanField">
+                    <Default>1</Default>
+                    <Required>Y</Required>
+                </enabled>
+                <name type="TextField">
+                    <Required>Y</Required>
+                    <mask>/^[0-9a-zA-Z_\-]{1,32}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 32 characters. Allowed characters are 0-9, a-z, A-Z, _ and -.</ValidationMessage>
+                    <Constraints>
+                        <check001>
+                            <ValidationMessage>A Key with this name already exists.</ValidationMessage>
+                            <type>UniqueConstraint</type>
+                        </check001>
+                    </Constraints>
+                </name>
+                <algo type="OptionField">
+                    <Required>Y</Required>
+                    <Default>hmac-sha256</Default>
+                    <OptionValues>
+                        <hmac-sha512>HMAC-SHA512</hmac-sha512>
+                        <hmac-sha384>HMAC-SHA384</hmac-sha384>
+                        <hmac-sha256>HMAC-SHA256</hmac-sha256>
+                        <hmac-sha224>HMAC-SHA224</hmac-sha224>
+                        <hmac-sha1>HMAC-SHA1</hmac-sha1>
+                        <hmac-md5>HMAC-MD5</hmac-md5>
+                    </OptionValues>
+                </algo>
+                <secret type="Base64Field">
+                    <Required>Y</Required>
+                    <Default>VxtIzJevSQXqnr7h2qerrcwjnZlMWSGGFBndKeNIDfw=</Default>
+                </secret>
+            </key>
+        </keys>
+    </items>
+</model>