From: Mark Andrews <marka@isc.org>
Date: Thu, 20 Feb 2014 13:09:28 +0000 (+1100)
Subject: 3753.   [bug]           allow-notify was ignoring keys. [RT #35425]
X-Git-Tag: v9.10.0b1~41
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=edd82b2ce275d513fb2799b90ec464f434880e87;p=thirdparty%2Fbind9.git

3753.   [bug]           allow-notify was ignoring keys. [RT #35425]
---

diff --git a/CHANGES b/CHANGES
index 9c06ffde809..f14e0cefc06 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3753.	[bug]		allow-notify was ignoring keys. [RT #35425]
+
 3752.	[bug]		Address potential REQUIRE failure if
 			DNS_STYLEFLAG_COMMENTDATA is set when printing out
 			a rdataset.
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b45cd87c4c2..88f359cfa1e 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -12325,6 +12325,8 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	isc_sockaddr_t local, remote;
 	isc_uint32_t serial = 0;
 	isc_boolean_t have_serial = ISC_FALSE;
+	dns_tsigkey_t *tsigkey;
+	dns_name_t *tsig;
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
@@ -12410,8 +12412,10 @@ dns_zone_notifyreceive(dns_zone_t *zone, isc_sockaddr_t *from,
 	 * Accept notify requests from non masters if they are on
 	 * 'zone->notify_acl'.
 	 */
+	tsigkey = dns_message_gettsigkey(msg);
+	tsig = dns_tsigkey_identity(tsigkey);
 	if (i >= zone->masterscnt && zone->notify_acl != NULL &&
-	    dns_acl_match(&netaddr, NULL, zone->notify_acl,
+	    dns_acl_match(&netaddr, tsig, zone->notify_acl,
 			  &zone->view->aclenv,
 			  &match, NULL) == ISC_R_SUCCESS &&
 	    match > 0)