{{ lang._('Zones') }}
@@ -192,6 +223,7 @@
{{ partial("layout_partials/base_dialog",['fields':formDialogEditBindAcl,'id':'dialogEditBindAcl','label':lang._('Edit ACL')])}}
+{{ partial("layout_partials/base_dialog",['fields':formDialogEditBindKey,'id':'dialogEditBindKey','label':lang._('Edit KEY')])}}
{{ partial("layout_partials/base_dialog",['fields':formDialogEditBindPrimaryDomain,'id':'dialogEditBindPrimaryDomain','label':lang._('Edit Primary Zone')])}}
{{ partial("layout_partials/base_dialog",['fields':formDialogEditBindSecondaryDomain,'id':'dialogEditBindSecondaryDomain','label':lang._('Edit Secondary Zone')])}}
{{ partial("layout_partials/base_dialog",['fields':formDialogEditBindRecord,'id':'dialogEditBindRecord','label':lang._('Edit Record')])}}
@@ -362,6 +394,15 @@ $(document).ready(function() {
'toggle': '/api/bind/acl/toggleAcl/'
});
+ $("#grid-keys").UIBootgrid({
+ 'search': '/api/bind/key/searchKey',
+ 'get': '/api/bind/key/getKey/',
+ 'set': '/api/bind/key/setKey/',
+ 'add': '/api/bind/key/addKey/',
+ 'del': '/api/bind/key/delKey/',
+ 'toggle': '/api/bind/key/toggleKey/'
+ });
+
$("#grid-primary-domains").UIBootgrid({
'search': '/api/bind/domain/searchPrimaryDomain',
'get': '/api/bind/domain/getDomain/',
@@ -492,6 +533,16 @@ $(document).ready(function() {
});
});
+ $("#saveAct_key").click(function() {
+ saveFormToEndpoint(url = "/api/bind/key/set", formid = 'frm_general_settings', callback_ok = function() {
+ $("#saveAct_key_progress").addClass("fa fa-spinner fa-pulse");
+ ajaxCall(url = "/api/bind/service/reconfigure", sendData = {}, callback = function(data, status) {
+ updateServiceControlUI('bind');
+ $("#saveAct_key_progress").removeClass("fa fa-spinner fa-pulse");
+ });
+ });
+ });
+
$(".saveAct_domain").click(function() {
$(".saveAct_domain_progress").addClass("fa fa-spinner fa-pulse");
ajaxCall("/api/bind/service/reconfigure", {}, function(data, status) {
diff --git a/dns/bind/src/opnsense/scripts/OPNsense/Bind/preStart.sh b/dns/bind/src/opnsense/scripts/OPNsense/Bind/preStart.sh
new file mode 100644
index 00000000000..9ae18e6c320
--- /dev/null
+++ b/dns/bind/src/opnsense/scripts/OPNsense/Bind/preStart.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+# Thaw all zones before starting BIND
+/usr/local/sbin/rndc thaw
diff --git a/dns/bind/src/opnsense/scripts/OPNsense/Bind/preStop.sh b/dns/bind/src/opnsense/scripts/OPNsense/Bind/preStop.sh
new file mode 100644
index 00000000000..19ad67642fd
--- /dev/null
+++ b/dns/bind/src/opnsense/scripts/OPNsense/Bind/preStop.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+# Freeze all zones before stopping BIND
+/usr/local/sbin/rndc freeze
diff --git a/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf b/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf
index c3d4a47a5e0..8324fa5266f 100644
--- a/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf
+++ b/dns/bind/src/opnsense/service/conf/actions.d/actions_bind.conf
@@ -1,20 +1,20 @@
[start]
-command:/usr/local/etc/rc.d/named start
+command:/usr/local/opnsense/scripts/OPNsense/Bind/preStart.sh; /usr/local/etc/rc.d/named start
parameters:
type:script
-message:starting BIND
+message:thawing all zones and starting BIND
[stop]
-command:/usr/local/etc/rc.d/named stop
+command:/usr/local/opnsense/scripts/OPNsense/Bind/preStop.sh; /usr/local/etc/rc.d/named stop
parameters:
type:script
-message:stopping BIND
+message:freezing all zones and stopping BIND
[restart]
-command:/usr/local/etc/rc.d/named restart
+command:/usr/local/opnsense/scripts/OPNsense/Bind/preStop.sh; /usr/local/etc/rc.d/named restart; /usr/local/opnsense/scripts/OPNsense/Bind/preStart.sh
parameters:
type:script
-message:restarting BIND
+message:freezing all zones, restarting BIND, and thawing all zones
[status]
command:/usr/local/etc/rc.d/named status; exit 0
diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
index 6b833e19a9c..82f420a3b87 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/named.conf
@@ -101,14 +101,41 @@ options {
{% endif %}
};
-{% if helpers.exists('OPNsense.bind.general.rndcalgo') and helpers.exists('OPNsense.bind.general.rndcsecret') %}
-key "rndc-key" {
- algorithm "{{ OPNsense.bind.general.rndcalgo }}";
- secret "{{ OPNsense.bind.general.rndcsecret }}";
+{% if helpers.exists('OPNsense.bind.key.keys.key') %}
+{% set control_keys_list = [] %}
+
+{% for key_item in helpers.toList('OPNsense.bind.key.keys.key') %}
+{% if key_item.enabled == '1' %}
+key "{{ key_item.name }}" {
+ algorithm "{{ key_item.algo }}";
+ secret "{{ key_item.secret }}";
};
+{% if helpers.exists('OPNsense.bind.general.rndccontrolkeys') %}
+{% for control_key in OPNsense.bind.general.rndccontrolkeys.split(',') %}
+{% if key_item['@uuid'] == control_key %}
+{% set _ = control_keys_list.append(key_item.name) %}
+{% endif %}
+{% endfor %}
+{% endif %}
+{% if helpers.exists('OPNsense.bind.general.defaultrndccontrolkeys') %}
+{% for default_control_key in OPNsense.bind.general.defaultrndccontrolkey %}
+{% if key_item['@uuid'] == default_control_key %}
+{% if key_item.name not in control_keys_list %}
+{% set _ = control_keys_list.append(key_item.name) %}
+{% endif %}
+{% endif %}
+{% endfor %}
+{% endif %}
+{% endif %}
+{% endfor %}
+
controls {
- inet 127.0.0.1 port 9530
- allow { 127.0.0.1; } keys { "rndc-key"; };
+ inet 127.0.0.1 port 9530
+ allow { 127.0.0.1; } keys {
+ {% for key_name in control_keys_list %}
+ "{{ key_name }}";
+ {% endfor %}
+ };
};
{% endif %}
@@ -167,7 +194,14 @@ zone "{{ domain.domainname }}" {
{% if domain.allowtransfer is defined or (domain.allowrndctransfer is defined and domain.allowrndctransfer == "1") %}
allow-transfer {
{% if domain.allowrndctransfer is defined and domain.allowrndctransfer == "1" %}
- key "rndc-key";
+{% if domain.allowedkeys is defined %}
+{% for rndckey in domain.allowedkeys.split(',') %}
+{% set transfer_key = helpers.getUUID(rndckey) %}
+{% if transfer_key.enabled == "1" %}
+ key "{{ transfer_key.name }}";
+{% endif %}
+{% endfor %}
+{% endif %}
{% endif %}
{% if domain.allowtransfer is defined %}
{% for acl in domain.allowtransfer.split(',') %}
@@ -187,7 +221,14 @@ zone "{{ domain.domainname }}" {
{% endif %}
{% if domain.allowrndcupdate is defined and domain.allowrndcupdate == "1" and domain.type != 'secondary' %}
update-policy {
- grant rndc-key zonesub ANY;
+{% if domain.allowedkeys is defined %}
+{% for rndckey in domain.allowedkeys.split(',') %}
+{% set update_key = helpers.getUUID(rndckey) %}
+{% if update_key.enabled == "1" %}
+ grant "{{ update_key.name }}" zonesub ANY;
+{% endif %}
+{% endfor %}
+{% endif %}
};
{% endif %}
};
diff --git a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/rndc.conf b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/rndc.conf
index d4800520f14..0b9c8cc5800 100644
--- a/dns/bind/src/opnsense/service/templates/OPNsense/Bind/rndc.conf
+++ b/dns/bind/src/opnsense/service/templates/OPNsense/Bind/rndc.conf
@@ -1,11 +1,12 @@
-{% if helpers.exists('OPNsense.bind.general.rndcalgo') and helpers.exists('OPNsense.bind.general.rndcsecret') %}
-key "rndc-key" {
- algorithm "{{ OPNsense.bind.general.rndcalgo }}";
- secret "{{ OPNsense.bind.general.rndcsecret }}";
+{% if helpers.exists('OPNsense.bind.general.defaultrndccontrolkey') and helpers.exists('OPNsense.bind.key.keys.key') %}
+{% set key = helpers.getUUID(OPNsense.bind.general.defaultrndccontrolkey) %}
+key "{{ key.name }}" {
+ algorithm "{{ key.algo }}";
+ secret "{{ key.secret }}";
};
options {
- default-key "rndc-key";
+ default-key "{{ key.name }}";
default-server 127.0.0.1;
default-port 9530;
};