3753. [bug] allow-notify was ignoring keys. [RT #35425]

diff --git a/CHANGES b/CHANGES
index 9c06ffde8090b37abb412675a42a0657793af434..f14e0cefc06c1f14e5104bb0a654c4c5ca863c42 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3753.  [bug]           allow-notify was ignoring keys. [RT #35425]
+
 3752.  [bug]           Address potential REQUIRE failure if
                        DNS_STYLEFLAG_COMMENTDATA is set when printing out
                        a rdataset.

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b45cd87c4c281b8485760be4b9b964c2e655a6ef..88f359cfa1ee05eff860e28cef838f1e77a135e9 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -12325,6 +12325,8 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
        isc_sockaddr_t local, remote;
        isc_uint32_t serial = 0;
        isc_boolean_t have_serial = ISC_FALSE;
+       dns_tsigkey_t *tsigkey;
+       dns_name_t *tsig;
 
        REQUIRE(DNS_ZONE_VALID(zone));
 
@@ -12410,8 +12412,10 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
         * Accept notify requests from non masters if they are on
         * 'zone->notify_acl'.
         */
+       tsigkey = dns_message_gettsigkey(msg);
+       tsig = dns_tsigkey_identity(tsigkey);
        if (i >= zone->masterscnt && zone->notify_acl != NULL &&
-           dns_acl_match(&netaddr, NULL, zone->notify_acl,
+           dns_acl_match(&netaddr, tsig, zone->notify_acl,
                          &zone->view->aclenv,
                          &match, NULL) == ISC_R_SUCCESS &&
            match > 0)