Skip to content

Commit 3c6966f

Browse files
benyamin-codezbenyamin-codez
committed
dns/bind: Make builtin ACLs available
Makes the builtin ACLs (none, any. localhost and localnets) available for selection: 1. Created new custom field types: * AclField extending ArrayField * AclModelRelationField extending ModelRelationField * AclNetField extending NetworkField 2. Adds builtin ACLs as child nodes to ACL list via new AclField field type 3. Removes builtin name RegEx constraint from name field in Acl model 4. Ensures "any" and "none" builtins cannot be part of an ACL multi-select via new AclModelRelationField field type 5. Ensures network validation is skipped for builtin ACLs via new AclNetField field type 6. Updates the General and Domain models to use AclModelRelationField 7. Updates general.volt to: * Disable command buttons for builtin ACLs * Ensure the builtin ACLs are added to config.xml 8. Updates named.conf to exclude builtin ACLs from custom name list 9. Bumps model versions: * Acl to v1.0.1 * General to v1.0.13 * Domain to v1.1.3 Signed-off-by: benyamin-codez <[email protected]>
1 parent 25b4d65 commit 3c6966f

File tree

9 files changed

+482
-14
lines changed

9 files changed

+482
-14
lines changed

‎dns/bind/src/opnsense/mvc/app/controllers/OPNsense/Bind/Api/AclController.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,7 +52,11 @@ public function addAclAction()
5252

5353
public function delAclAction($uuid)
5454
{
55-
return $this->delBase('acls.acl', $uuid);
55+
$del_tgt = $this->getBase('acl', 'acls.acl', $uuid);
56+
# skip if builtins...
57+
if (!($del_tgt['acl']['name'] == 'any' || $del_tgt['acl']['name'] == 'localnets' || $del_tgt['acl']['name'] == 'localhost' || $del_tgt['acl']['name'] == 'none')) {
58+
return $this->delBase('acls.acl', $uuid);
59+
}
5660
}
5761

5862
public function setAclAction($uuid)

‎dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Acl.xml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,26 @@
11
<model>
22
<mount>//OPNsense/bind/acl</mount>
33
<description>BIND ACL configuration</description>
4-
<version>1.0.0</version>
4+
<version>1.0.1</version>
55
<items>
66
<acls>
7-
<acl type="ArrayField">
7+
<acl type=".\AclField">
88
<enabled type="BooleanField">
99
<Default>1</Default>
1010
<Required>Y</Required>
1111
</enabled>
1212
<name type="TextField">
1313
<Required>Y</Required>
14-
<Mask>/^(?!any$|localhost$|localnets$|none$)[0-9a-zA-Z_\-]{1,32}$/u</Mask>
15-
<ValidationMessage>Should be a string between 1 and 32 characters. Allowed characters are 0-9, a-z, A-Z, _ and -. Built-in ACL names must not be used: any, localhost, localnets, none.</ValidationMessage>
14+
<Mask>/^[0-9a-zA-Z_\-]{1,32}$/u</Mask>
15+
<ValidationMessage>Should be a string between 1 and 32 characters. Allowed characters are 0-9, a-z, A-Z, _ and -.</ValidationMessage>
1616
<Constraints>
1717
<check001>
1818
<ValidationMessage>An ACL with this name already exists.</ValidationMessage>
1919
<type>UniqueConstraint</type>
2020
</check001>
2121
</Constraints>
2222
</name>
23-
<networks type="NetworkField">
23+
<networks type=".\AclNetField">
2424
<Required>Y</Required>
2525
<AsList>Y</AsList>
2626
</networks>

‎dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/Domain.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<model>
22
<mount>//OPNsense/bind/domain</mount>
33
<description>BIND domain configuration</description>
4-
<version>1.1.2</version>
4+
<version>1.1.3</version>
55
<items>
66
<domains>
77
<domain type="ArrayField">
@@ -42,7 +42,7 @@
4242
<domainname type="TextField">
4343
<Required>Y</Required>
4444
</domainname>
45-
<allowtransfer type="ModelRelationField">
45+
<allowtransfer type=".\AclModelRelationField">
4646
<Model>
4747
<template>
4848
<source>OPNsense.Bind.Acl</source>
@@ -53,7 +53,7 @@
5353
<Multiple>Y</Multiple>
5454
</allowtransfer>
5555
<allowrndctransfer type="BooleanField"/>
56-
<allowquery type="ModelRelationField">
56+
<allowquery type=".\AclModelRelationField">
5757
<Model>
5858
<template>
5959
<source>OPNsense.Bind.Acl</source>

‎dns/bind/src/opnsense/mvc/app/models/OPNsense/Bind/FieldTypes/AclField.php‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
<?php
2+
3+
/*
4+
* Copyright (C) 2025 Deciso B.V.
5+
* All rights reserved.
6+
*
7+
* Redistribution and use in source and binary forms, with or without
8+
* modification, are permitted provided that the following conditions are met:
9+
*
10+
* 1. Redistributions of source code must retain the above copyright notice,
11+
* this list of conditions and the following disclaimer.
12+
*
13+
* 2. Redistributions in binary form must reproduce the above copyright
14+
* notice, this list of conditions and the following disclaimer in the
15+
* documentation and/or other materials provided with the distribution.
16+
*
17+
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
18+
* INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
19+
* AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
20+
* AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
21+
* OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
22+
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
23+
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
24+
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
25+
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
26+
* POSSIBILITY OF SUCH DAMAGE.
27+
*/
28+
29+
namespace OPNsense\BIND\FieldTypes;
30+
31+
use OPNsense\Base\FieldTypes\ArrayField;
32+
33+
class ACLField extends ArrayField
34+
{
35+
/*
36+
* Extends ArrayField to programmatically add BIND's builtin ACL types to
37+
* the model. The private property $internalTemplateNode is duplicated.
38+
* The actionPostLoadingEvent() method is replaced to add the builtin ACLs
39+
* as child nodes. The ability to add static children is removed. The builtin
40+
* ACL names are defined by the static $builtinNames property. Values for the
41+
* builtin ACLs are populated by the getBuiltinChildren() method. The public
42+
* function add() is also required.
43+
*/
44+
45+
/**
46+
* {@inheritdoc}
47+
*/
48+
private $internalTemplateNode = null;
49+
50+
/**
51+
* @var list to define builtin BIND ACL names
52+
*/
53+
private static $builtinNames = ['none', 'localhost', 'localnets', 'any'];
54+
55+
/**
56+
* @return array of builtin BIND ACLs
57+
*/
58+
protected function getBuiltinChildren()
59+
{
60+
$builtins = [];
61+
foreach (self::$builtinNames as $aclName) {
62+
$builtins [] = [
63+
'enabled' => '1',
64+
'name' => $aclName,
65+
'networks' => 'system derived'
66+
];
67+
}
68+
return $builtins;
69+
}
70+
71+
/**
72+
* {@inheritdoc}
73+
*/
74+
public function add()
75+
{
76+
$nodeUUID = $this->generateUUID();
77+
$container_node = $this->newContainerField($this->__reference . "." . $nodeUUID, $this->internalXMLTagName);
78+
79+
$template_ref = $this->internalTemplateNode->__reference;
80+
foreach ($this->internalTemplateNode->iterateItems() as $key => $node) {
81+
$new_node = clone $node;
82+
$new_node->setInternalReference($container_node->__reference . "." . $key);
83+
$new_node->applyDefault();
84+
$new_node->setChanged();
85+
$container_node->addChildNode($key, $new_node);
86+
87+
if ($node->isContainer()) {
88+
foreach ($node->iterateRecursiveItems() as $subnode) {
89+
if (is_a($subnode, "OPNsense\\Base\\FieldTypes\\ArrayField")) {
90+
// validate child nodes, nesting not supported in this version.
91+
throw new \Exception("Unsupported copy, Array doesn't support nesting.");
92+
}
93+
}
94+
95+
/**
96+
* XXX: incomplete, only supports one nesting level of container fields. In the long run we probably
97+
* should refactor the add() function to push identifiers differently.
98+
*/
99+
foreach ($node->iterateItems() as $subkey => $subnode) {
100+
$new_subnode = clone $subnode;
101+
$new_subnode->setInternalReference($new_node->__reference . "." . $subkey);
102+
$new_subnode->applyDefault();
103+
$new_subnode->setChanged();
104+
$new_node->addChildNode($subkey, $new_subnode);
105+
}
106+
}
107+
}
108+
109+
// make sure we have a UUID on repeating child items
110+
$container_node->setAttributeValue("uuid", $nodeUUID);
111+
112+
// add node to this object
113+
$this->addChildNode($nodeUUID, $container_node);
114+
115+
return $container_node;
116+
}
117+
118+
/**
119+
* {@inheritdoc}
120+
*/
121+
protected function actionPostLoadingEvent()
122+
{
123+
// always make sure there's a node to copy our structure from
124+
if ($this->internalTemplateNode == null) {
125+
$firstKey = array_keys($this->internalChildnodes)[0];
126+
$this->internalTemplateNode = $this->internalChildnodes[$firstKey];
127+
/**
128+
* if first node is empty, remove reference node.
129+
*/
130+
if ($this->internalChildnodes[$firstKey]->getInternalIsVirtual()) {
131+
unset($this->internalChildnodes[$firstKey]);
132+
}
133+
}
134+
135+
// init builtin entries returned by getBuiltinChildren()
136+
foreach (static::getBuiltinChildren() as $skey => $payload) {
137+
$nodeUUID = $this->generateUUID();
138+
$container_node = $this->newContainerField($this->__reference . "." . $nodeUUID, $this->internalXMLTagName);
139+
$container_node->setAttributeValue("uuid", $nodeUUID);
140+
$template_ref = $this->internalTemplateNode->__reference;
141+
foreach ($this->internalTemplateNode->iterateItems() as $key => $value) {
142+
if ($key == 'name') {
143+
foreach ($this->iterateItems() as $pkey => $pnode) {
144+
foreach ($pnode->iterateItems() as $subkey => $subnode) {
145+
if ($subkey == 'name' && $subnode == $payload[$key]) {
146+
// The builtin ACL already exists, let's skip it...
147+
continue 4;
148+
}
149+
}
150+
}
151+
}
152+
$node = clone $value;
153+
$node->setInternalReference($container_node->__reference . "." . $key);
154+
if (isset($payload[$key])) {
155+
$node->setValue($payload[$key]);
156+
}
157+
$node->setChanged();
158+
$container_node->addChildNode($key, $node);
159+
}
160+
$this->addChildNode($nodeUUID, $container_node);
161+
}
162+
}
163+
}

0 commit comments

Comments
 (0)