fix(plesk): open zone transfers through Plesk's transfer ACL, not options

[0kaba0]

Defect. Plesk writes allow-transfer { common-allow-transfer; }; into every zone, which overrides options. The Plesk installer put our IP into options and told customers to add allow-transfer to Server-wide Settings → Additional DNS settings, which lands in options too. Neither opened a transfer for Plesk zones.

Seen read-only on a live Plesk Obsidian 18.0.81.2 (AlmaLinux 9.8, BIND in chroot): 150 of 152 zones carry the ACL, the ACL was { none; }, and named-user-options.conf (the server-wide settings) is included in options. No zone in prod SecondDNS is affected right now: the two stale zones have a private and an unreachable primary.

How Plesk keeps the ACL. Verified on that server (the owner ran the command, I checked before and after):

• Transfer Restrictions Template = misc.DNS_Allow_Transfer0..N in the Plesk database, not dns_recs_t.
• plesk bin server_dns -u -add-acl <ip> adds to it. Within the same second it rewrote named.conf, put the IP into acl common-allow-transfer and reloaded named ("reloading configuration succeeded"). Recursion, zone count and answers were unchanged.
• AXFR from our ns3 got "Transfer failed" before and "XFR size: 16 records" after.

The Plesk docs (CLI server_dns) give only the syntax. The installer therefore checks the result instead of assuming it.

Change:

• plesk/install.sh: configure_named_axfr (the options edit) removed. New configure_plesk_acl:

  • reads misc.DNS_Allow_Transfer*;
  • calls server_dns -u -add-acl once for the missing IPs (all of DNS_IPS, so IPv4 and IPv6 when both are chosen);
  • checks every one of them in acl common-allow-transfer of the resolved named.conf, and says so with the UI path when one is missing.

  The prompt and the final summary no longer advise allow-transfer in the server-wide settings. also-notify stays there: zones do not set it, so it applies.

• plesk/uninstall.sh: the existing note about options remains for old installs. A new note says to remove the IPs in Transfer Restrictions Template, because server_dns has no remove command; the XML API one would need an API key created on the customer's server.

• READMEs updated.

Tests:

• test_plesk_acl.sh (13 checks): runs the function from the installer against a stand-in plesk that behaves as observed. Covers: empty ACL (one call with both IPs), rerun (no call), one present (only the other), 203.0.113.90 not mistaken for 203.0.113.9, named.conf not rewritten (reported, non-zero), add-acl failing (reported, ACL untouched).
• test_plesk_acl_named.sh (4 checks, real named, Plesk-style named.conf), the discriminating pair:
  • our IP only in options: AXFR refused;
  • after configure_plesk_acl: AXFR transfers, an address outside the ACL stays refused.
• test_named_conf_edit.sh: the options checks now cover cPanel and DirectAdmin; Plesk is asserted not to edit options and to use the ACL.
• Run on Ubuntu 24.04 with BIND 9.18 as a non-root user: test_plesk_acl_named 4/4, test_plesk_acl 13/13, test_named_conf_edit 28/28, test_tsig_bind_named 9/9.

The customer guide in k8s_web gets a separate PR (two sentences in five languages). TSIG for Plesk follows after this.

[0kaba0]

APPROVED at 91a2426.

Verified: the Plesk installer no longer edits the options block; configure_plesk_acl reads the template from misc.DNS_Allow_Transfer*, adds only the missing addresses with one server_dns -u -add-acl call, and checks that each one landed in acl common-allow-transfer of the real named.conf instead of assuming it, with a clear message and the UI path when it did not; an exact match so 203.0.113.90 is not taken for 203.0.113.9; the uninstaller keeps the old options revert and tells where to remove the addresses, since server_dns cannot. The real-named test is the distinguishing pair: our IP only in options is refused on a Plesk-style zone, the same IP in the ACL transfers, another address stays refused; the stand-in test covers idempotence, partial presence, a failed add and a config that was not regenerated. test_named_conf_edit.sh now asserts that Plesk does not edit options. README and the plesk README match the code. No attribution lines.

Noted, not a point: the old installer also wrote also-notify into options; the new one prints it for Server-wide Settings, where it persists across regeneration. The README says so.