unbound: add basic split view DNS support

plist

@@ -463,22 +463,31 @@
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/AclController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/AdvancedController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/DiagnosticsController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/HostsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/OverviewController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/ServiceController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/SettingsController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/SubnetsController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/ViewsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/DnsblController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/DotController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/ForwardController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/GeneralController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/HostsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/OverridesController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/OverviewController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/StatsController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/SubnetsController.php
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/ViewsController.php
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/acl.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/advanced.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dialogAcl.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dialogDot.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dialogViewHost.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dialogHostAlias.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dialogHostOverride.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dialogViewSubnet.xml
+/usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dialogView.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/dnsbl.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/forwarding.xml
 /usr/local/opnsense/mvc/app/controllers/OPNsense/Unbound/forms/general.xml
@@ -977,6 +986,7 @@
 /usr/local/opnsense/mvc/app/views/OPNsense/Unbound/overrides.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Unbound/overview.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Unbound/stats.volt
+/usr/local/opnsense/mvc/app/views/OPNsense/Unbound/views.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Wireguard/diagnostics.volt
 /usr/local/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt
 /usr/local/opnsense/mvc/app/views/layout_partials/base_apply_button.volt
@@ -1492,6 +1502,7 @@
 /usr/local/opnsense/service/templates/OPNsense/Unbound/core/private_domains.conf
 /usr/local/opnsense/service/templates/OPNsense/Unbound/core/safesearch.conf
 /usr/local/opnsense/service/templates/OPNsense/Unbound/core/unbound_dhcpd.conf
+/usr/local/opnsense/service/templates/OPNsense/Unbound/core/views.conf
 /usr/local/opnsense/service/templates/OPNsense/WebGui/+TARGETS
 /usr/local/opnsense/service/templates/OPNsense/WebGui/etc.php.ini
 /usr/local/opnsense/service/templates/OPNsense/WebGui/lib.php.ini

src/etc/inc/plugins.inc.d/unbound.inc

@@ -384,6 +384,8 @@ remote-control:
     control-key-file: /var/unbound/unbound_control.key
     control-cert-file: /var/unbound/unbound_control.pem
 
+include-toplevel:  /var/unbound/views.conf
+
 EOD;
 
     file_put_contents('/var/unbound/unbound.conf', $unboundconf);

src/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/HostsController.php

@@ -0,0 +1,117 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Unbound\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+use OPNsense\Core\Config;
+
+class HostsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'host';
+    protected static $internalModelClass = '\OPNsense\Unbound\Unbound';
+
+    public function listViewsAction()
+    {
+        if ($this->request->isGet()) {
+            $results = ['rows' => [], 'status' => 'ok'];
+            foreach ($this->getModel()->split_dns->views->view->iterateItems() as $key => $node) {
+                $results['rows'][] = [
+                    'uuid' => $key,
+                    'name' => (string)$node->name
+                ];
+            }
+            return $results;
+        }
+        return ['status' => 'failed'];
+    }
+
+    public function searchHostAction()
+    {
+        $views = $this->request->get('views');
+        $filter_funct = function ($record) use ($views) {
+            return empty($views) || array_intersect(explode(',', $record->view_uuids), $views);
+        };
+
+        return $this->searchBase('split_dns.view_hosts.host', null, null, $filter_funct);
+    }
+
+    public function getHostAction($uuid = null)
+    {
+        return $this->getBase('host', 'split_dns.view_hosts.host', $uuid);
+    }
+
+    public function addHostAction()
+    {
+        return $this->setHostAction(null);
+    }
+
+    public function delHostAction($uuid)
+    {
+        // Note: For Unbound, we don't need to clean up view references
+        // because hosts reference views, not the other way around
+        return $this->delBase('split_dns.view_hosts.host', $uuid);
+    }
+
+    public function setHostAction($uuid)
+    {
+        $add_uuid = null;
+        if (!empty($this->request->getPost(static::$internalModelName)) && $this->request->isPost()) {
+            $views = [];
+            if (!empty($this->request->getPost(static::$internalModelName)['view_uuids'])) {
+                $views = explode(',', $this->request->getPost(static::$internalModelName)['view_uuids']);
+            }
+            Config::getInstance()->lock();
+            $mdl = $this->getModel();
+            if (empty($uuid)) {
+                // add new host, generate uuid
+                $uuid = $mdl->split_dns->view_hosts->host->generateUUID();
+                $add_uuid = $uuid;
+            }
+
+            // Note: Unlike WireGuard, we don't need to update view references
+            // because Unbound uses a unidirectional relationship (hosts reference views)
+
+            /**
+             * Ignore validations as $uuid might be new or trigger an existing validation issue.
+             * Persisting the data is handled by setBase()
+             */
+            $mdl->serializeToConfig(false, true);
+        }
+        $result = $this->setBase('host', 'split_dns.view_hosts.host', $uuid);
+        if (!empty($add_uuid) && $result['result'] == 'saved') {
+            $result['uuid'] = $add_uuid;
+        }
+        return $result;
+    }
+
+    public function toggleHostAction($uuid)
+    {
+        return $this->toggleBase('split_dns.view_hosts.host', $uuid);
+    }
+}

src/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/SubnetsController.php

@@ -0,0 +1,67 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Unbound\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+
+class SubnetsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'subnet';
+    protected static $internalModelClass = '\OPNsense\Unbound\Unbound';
+
+    public function searchSubnetAction()
+    {
+        return $this->searchBase('split_dns.view_subnets.subnet', null, null);
+    }
+
+    public function getSubnetAction($uuid = null)
+    {
+        return $this->getBase('subnet', 'split_dns.view_subnets.subnet', $uuid);
+    }
+
+    public function addSubnetAction($uuid = null)
+    {
+        return $this->addBase('subnet', 'split_dns.view_subnets.subnet', $uuid);
+    }
+
+    public function delSubnetAction($uuid)
+    {
+        return $this->delBase('split_dns.view_subnets.subnet', $uuid);
+    }
+
+    public function setSubnetAction($uuid = null)
+    {
+        return $this->setBase('subnet', 'split_dns.view_subnets.subnet', $uuid);
+    }
+
+    public function toggleSubnetAction($uuid)
+    {
+        return $this->toggleBase('split_dns.view_subnets.subnet', $uuid);
+    }
+}

src/opnsense/mvc/app/controllers/OPNsense/Unbound/Api/ViewsController.php

@@ -0,0 +1,89 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Unbound\Api;
+
+use OPNsense\Base\ApiMutableModelControllerBase;
+use OPNsense\Core\Config;
+
+class ViewsController extends ApiMutableModelControllerBase
+{
+    protected static $internalModelName = 'view';
+    protected static $internalModelClass = '\OPNsense\Unbound\Unbound';
+
+    public function searchViewAction()
+    {
+        return $this->searchBase('split_dns.views.view', null, null);
+    }
+
+    public function getViewAction($uuid = null)
+    {
+        return $this->getBase('view', 'split_dns.views.view', $uuid);
+    }
+
+    public function addViewAction($uuid = null)
+    {
+        return $this->addBase('view', 'split_dns.views.view', $uuid);
+    }
+
+    public function delViewAction($uuid)
+    {
+        if ($this->request->isPost()) {
+            Config::getInstance()->lock();
+            $mdl = $this->getModel();
+
+            // Clean up host references (similar to WireGuard client cleanup)
+            foreach ($mdl->split_dns->view_hosts->host->iterateItems() as $key => $node) {
+                $view_uuids = array_filter(explode(',', (string)$node->view_uuids));
+                if (in_array($uuid, $view_uuids)) {
+                    $node->view_uuids = implode(',', array_diff($view_uuids, [$uuid]));
+                }
+            }
+
+            // Clean up subnet references
+            foreach ($mdl->split_dns->view_subnets->subnet->iterateItems() as $key => $node) {
+                if ((string)$node->view_uuid === $uuid) {
+                    $node->view_uuid = '';
+                }
+            }
+
+            $mdl->serializeToConfig(false, true);
+        }
+        return $this->delBase('split_dns.views.view', $uuid);
+    }
+
+    public function setViewAction($uuid = null)
+    {
+        return $this->setBase('view', 'split_dns.views.view', $uuid);
+    }
+
+    public function toggleViewAction($uuid)
+    {
+        return $this->toggleBase('split_dns.views.view', $uuid);
+    }
+}

src/opnsense/mvc/app/controllers/OPNsense/Unbound/HostsController.php

@@ -0,0 +1,46 @@
+<?php
+
+/*
+ * Copyright (C) 2025 Deciso B.V.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+namespace OPNsense\Unbound;
+
+use OPNsense\Base\IndexController;
+
+/**
+ * Class HostsController
+ * @package OPNsense\Unbound
+ */
+class HostsController extends IndexController
+{
+    public function indexAction()
+    {
+        $this->view->pick('OPNsense/Unbound/hosts');
+
+        $this->view->formDialogHost = $this->getForm('dialogViewHost');
+        $this->view->formGridHost = $this->getFormGrid('dialogViewHost');
+    }
+}