mTLS in XoT fails with multiple tls-auth

NSD
1

Hello,

I’m testing mTLS in XoT with 1 primary and 2 secondaries, each having its own certificate/CN/SAN. The configuration of the primary server looks like this:

server:
    ip-address: 10.0.0.52@53530
    ip-address: 10.0.0.52@58530
    ip-address: 10.0.0.52@58531
    port: 53530
    tls-port: 58530
    tls-auth-port: 58531
    zonesdir: "/etc/nsd/zones"
    tls-service-key: "/etc/pki/tls/private/nsd.key"
    tls-service-pem: "/etc/pki/tls/certs/nsd.crt"
    tls-cert-bundle: "/etc/pki/tls/certs/bundle.crt"
#    tls-auth-xfr-only: yes

key:
    name: "tsig.key"
    algorithm: hmac-sha512
    secret: "<...>"

tls-auth:
    name: xot-dns2.tls
    auth-domain-name: dns2.test.tld

tls-auth:
    name: xot-dns3.tls
    auth-domain-name: dns3.test.tld

pattern:
    name: "zone.pattern"
    zonefile: "primary/%s"
    allow-query: 10.0.0.52 NOKEY
    allow-query: 10.0.0.53 NOKEY
    allow-query: 10.0.0.54 NOKEY
    notify: 10.0.0.53@53530 tsig.key
    notify: 10.0.0.54@53530 tsig.key
    provide-xfr: 10.0.0.53 tsig.key xot-dns2.tls
    provide-xfr: 10.0.0.54 tsig.key xot-dns3.tls

zone:
    name: "tld"
    include-pattern: "zone.pattern"

I’m not using NSD for the secondaries but the configuration should be very similar. When a secondary tries to request a zone transfer, the two ACLs are evaluated and the second ACL verification fails, blocking the zone transfer. If I have only one ACL the transfer is successful.

failure
+++++
info: TLS-AUTH handshake succeeded.
info: query from client: address is: 10.0.0.53, port is: 55074
info: to server (local): address is: 10.0.0.52, port is: 58531
info: query good tsig signature for tsig.key.
info: testing acl 10.0.0.53 tsig.key xot-dns2.tls
info: xot-dns2.tls dns2.test.tld verified
info: testing acl 10.0.0.54 tsig.key xot-dns3.tls
info: SAN dns2.test.tld does not match acl for dns3.test.tld
info: CN dns2.test.tld does not match acl for dns3.test.tld
warning: client cert does not match xot-dns3.tls dns3.test.tld
info: axfr for tld. from 10.0.0.53 refused, no acl matches
info: axfr refused, no acl matches
info: from server (local): address is: 10.0.0.52, port is: 58531
info: response to client: address is: 10.0.0.53, port is: 55074

success
+++++
info: TLS-AUTH handshake succeeded.
info: query from client: address is: 10.0.0.53, port is: 37470
info: to server (local): address is: 10.0.0.52, port is: 58531
info: xot-dns2.tls dns2.test.tld verified
info: axfr for tld. from 10.0.0.53 tls-auth dns2.test.tld
info: from server (local): address is: 10.0.0.52, port is: 58531
info: response to client: address is: 10.0.0.53, port is: 37470

The second ACL should not be evaluated as the IP addresses do not match. Is it a bug or does NSD expect only a single tls-auth block?

Tested on RHEL 9.8 with NSD 4.14.0 from EPEL.

Thanks.