From 2371638c44f69d1d54933766fde04fad795a3c3d Mon Sep 17 00:00:00 2001
From: Giannis Kapetanakis <bilias@edu.physics.uoc.gr>
Date: Fri, 5 Jun 2026 15:18:49 +0300
Subject: [PATCH] Server should check only specific tls-auth

---
 options.c | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/options.c b/options.c
index a60059001..c01554b80 100644
--- a/options.c
+++ b/options.c
@@ -2025,6 +2025,27 @@ acl_check_incoming(struct acl_options* acl, struct query* q,
 		}
 #endif
 		if(acl_addr_matches(acl, q) && acl_key_matches(acl, q)) {
+#ifdef HAVE_SSL
+			/* we are in a acl with tls_auth */
+			if (acl->tls_auth_name) {
+				/* we have auth_domain_name in tls_auth */
+				if (acl->tls_auth_options && acl->tls_auth_options->auth_domain_name) {
+					if (!acl_tls_hostname_matches(q->tls_auth, acl->tls_auth_options->auth_domain_name)) {
+						VERBOSITY(3, (LOG_WARNING,
+								"client cert does not match %s %s",
+								acl->tls_auth_name, acl->tls_auth_options->auth_domain_name));
+						q->cert_cn = NULL;
+						return -1;
+					}
+					VERBOSITY(5, (LOG_INFO, "%s %s verified",
+						acl->tls_auth_name, acl->tls_auth_options->auth_domain_name));
+					q->cert_cn = acl->tls_auth_options->auth_domain_name;
+				} else {
+					/* nsd gives error on start for this, but check just in case */
+					log_msg(LOG_ERR, "auth-domain-name not defined in %s", acl->tls_auth_name);
+				}
+			}
+#endif
 			if(!match)
 			{
 				match = acl; /* remember first match */
@@ -2036,27 +2057,6 @@ acl_check_incoming(struct acl_options* acl, struct query* q,
 				return -1;
 			}
 		}
-#ifdef HAVE_SSL
-		/* we are in a acl with tls_auth */
-		if (acl->tls_auth_name) {
-			/* we have auth_domain_name in tls_auth */
-			if (acl->tls_auth_options && acl->tls_auth_options->auth_domain_name) {
-				if (!acl_tls_hostname_matches(q->tls_auth, acl->tls_auth_options->auth_domain_name)) {
-					VERBOSITY(3, (LOG_WARNING,
-							"client cert does not match %s %s",
-							acl->tls_auth_name, acl->tls_auth_options->auth_domain_name));
-					q->cert_cn = NULL;
-					return -1;
-				}
-				VERBOSITY(5, (LOG_INFO, "%s %s verified",
-					acl->tls_auth_name, acl->tls_auth_options->auth_domain_name));
-				q->cert_cn = acl->tls_auth_options->auth_domain_name;
-			} else {
-				/* nsd gives error on start for this, but check just in case */
-				log_msg(LOG_ERR, "auth-domain-name not defined in %s", acl->tls_auth_name);
-			}
-		}
-#endif
 		number++;
 		acl = acl->next;
 	}