diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/RpzController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/RpzController.php new file mode 100644 index 0000000000..91226d035f --- /dev/null +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/RpzController.php @@ -0,0 +1,37 @@ + + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Bind\Api; + +use OPNsense\Base\ApiMutableModelControllerBase; + +class RpzController extends ApiMutableModelControllerBase +{ + protected static $internalModelClass = '\OPNsense\Bind\Rpz'; + protected static $internalModelName = 'rpz'; +} diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php index cfa86649db..2d39e18899 100644 --- a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/GeneralController.php @@ -34,6 +34,7 @@ public function indexAction() { $this->view->generalForm = $this->getForm("general"); $this->view->dnsblForm = $this->getForm("dnsbl"); + $this->view->rpzForm = $this->getForm("rpz"); $this->view->formDialogEditBindAcl = $this->getForm("dialogEditBindAcl"); $this->view->formDialogEditBindPrimaryDomain = $this->getForm("dialogEditBindPrimaryDomain"); $this->view->formDialogEditBindSecondaryDomain = $this->getForm("dialogEditBindSecondaryDomain"); diff --git a/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/rpz.xml b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/rpz.xml new file mode 100644 index 0000000000..676b615f3c --- /dev/null +++ b/dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/forms/rpz.xml @@ -0,0 +1,26 @@ +
+ + rpz.enabled + + checkbox + Enable Response Policy Zone support. The zone file must exist at /usr/local/etc/namedb/primary/<zone>.db before applying. + + + rpz.zone + + text + Name of the RPZ zone (e.g. rpz.local). The zone file is expected at /usr/local/etc/namedb/primary/<zone>.db. + + + rpz.policy + + dropdown + Override policy applied to names matching the RPZ zone. Leave empty to use the zone's own CNAME records (given). + + + rpz.break_dnssec + + checkbox + Allow RPZ to rewrite DNSSEC-signed responses. Required when using NXDOMAIN or NODATA policy with DNSSEC-validating clients. + +
diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Rpz.php b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Rpz.php new file mode 100644 index 0000000000..9b83894631 --- /dev/null +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Rpz.php @@ -0,0 +1,35 @@ + + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Bind; + +use OPNsense\Base\BaseModel; + +class Rpz extends BaseModel +{ +} diff --git a/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Rpz.xml b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Rpz.xml new file mode 100644 index 0000000000..6cbe7ba7c2 --- /dev/null +++ b/dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Rpz.xml @@ -0,0 +1,30 @@ + + //OPNsense/bind/rpz + Response Policy Zone configuration + 1.0.0 + + + 0 + Y + + + N + /^([a-zA-Z0-9_\-\.]{0,253})$/ + Zone name may only contain letters, digits, hyphens, dots, and underscores. + + + N + + NXDOMAIN (block — return non-existent domain) + NODATA (block — return empty answer) + Passthru (disable policy for matching names) + Drop (do not answer) + TCP only (force TCP retry) + + + + 0 + Y + + + diff --git a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt index 0d9b55eda9..930a3830cc 100644 --- a/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt +++ b/dns/bind/src/opnsense/mvc/app/views/OPNsense/Bind/general.volt @@ -30,6 +30,7 @@