enable rpz zone support

manifests/config.pp

@@ -53,7 +53,7 @@
 
   concat::fragment { 'options.conf+10-main.dns':
     target  => $dns::optionspath,
-    content => template($dns::optionsconf_template),
+    content => epp($dns::optionsconf_template),
     order   => '10',
   }
 

manifests/init.pp

@@ -43,6 +43,8 @@
 #   The forward option
 # @param forwarders
 #   The forwarders option
+# @param rpz_zones
+#   Array of zones that will be included in response-policy definition
 # @param listen_on
 #   The listen-on option
 # @param listen_on_v6
@@ -161,6 +163,7 @@
   Variant[Enum['unmanaged'], Stdlib::Absolutepath] $defaultzonepath = $dns::params::defaultzonepath,
   Optional[Enum['only', 'first']] $forward                          = undef,
   Array[Dns::Forwarder] $forwarders                                 = [],
+  Array[Stdlib::Fqdn] $rpz_zones                                    = [],
   Optional[String] $listen_on                                       = undef,
   Variant[String, Boolean] $listen_on_v6                            = 'any',
   Enum['yes', 'no'] $recursion                                      = 'yes',
@@ -172,7 +175,7 @@
   Enum['yes', 'no', 'auto'] $dnssec_validation                      = 'auto',
   String $namedconf_template                                        = 'dns/named.conf.erb',
   Hash[String, Array[String]] $acls                                 = {},
-  String $optionsconf_template                                      = 'dns/options.conf.erb',
+  String $optionsconf_template                                      = 'dns/options.conf.epp',
   Optional[Stdlib::Absolutepath] $sysconfig_file                    = $dns::params::sysconfig_file,
   Optional[String] $sysconfig_template                              = $dns::params::sysconfig_template,
   Optional[String] $sysconfig_startup_options                       = $dns::params::sysconfig_startup_options,

spec/classes/dns_init_spec.rb

@@ -265,6 +265,14 @@
           'listen-on-v6 { none; };',
         ])}
       end
+
+      describe 'with rpz zone' do
+        let(:params) { {:rpz_zones => [ 'rpz.block.local' ]} }
+
+        it { verify_concat_fragment_contents(catalogue, 'options.conf+10-main.dns', [
+          'zone "rpz.block.local";'
+        ])}
+      end
 
       describe 'with empty zones disabled' do
         let(:params) { {:empty_zones_enable => 'no'} }

templates/options.conf.epp

@@ -0,0 +1,51 @@
+directory "<%= $dns::vardir %>";
+<% unless empty($dns::forwarders) { -%>
+forwarders { <%= join($dns::forwarders, '; ') %>; };
+<% } -%>
+<% if $dns::forward { -%>
+forward <%= $dns::forward %>;
+<% } -%>
+
+<% unless empty($dns::rpz_zones) { -%>
+response-policy {
+<%   $dns::rpz_zones.each |$zone| { -%>
+zone "<%= $zone %>";
+<%   } -%>
+};
+<% } -%>
+
+recursion <%= $dns::recursion %>;
+allow-query { <%= join($dns::allow_query, '; ') %>; };
+<% if $dns::dnssec_enable { -%>
+dnssec-enable <%= $dns::dnssec_enable %>;
+<% } -%>
+dnssec-validation <%= $dns::dnssec_validation %>;
+
+empty-zones-enable <%= $dns::empty_zones_enable %>;
+
+<% if $dns::dns_notify { -%>
+notify <%= $dns::dns_notify %>;
+<% } -%>
+<% if $dns::listen_on { -%>
+listen-on { <%= $dns::listen_on %>; };
+<% } -%>
+<% if $dns::listen_on_v6 { -%>
+listen-on-v6 { <%= $dns::listen_on_v6 %>; };
+<% } -%>
+
+<% if $dns::allow_recursion { -%>
+allow-recursion { <%= join($dns::allow_recursion, '; ') %>; };
+<% } -%>
+
+<% if $facts['os']['family'] =~ /^(FreeBSD|DragonFly)$/ { -%>
+pid-file "/var/run/named/pid";
+<% } -%>
+
+<% $dns::disable_empty_zones.sort.each |$disable_empty_zone| { -%>
+disable-empty-zone "<%= $disable_empty_zone %>";
+<% } -%>
+
+<% $dns::additional_options.keys.sort.each |$option| { -%>
+<%  $value = $dns::additional_options[$option] -%>
+<%= $option %> <%= $value %>;
+<% } -%>