From: Daniel Salzman <daniel.salzman@nic.cz>
Date: Thu, 30 Oct 2025 14:12:44 +0000 (+0100)
Subject: process_query: don't try to evaluate automatic ACL if disabled
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=bef8d0e4ef8fd2eba5c6f54a999d57d43940a80a;p=thirdparty%2Fknot-dns.git

process_query: don't try to evaluate automatic ACL if disabled
---

diff --git a/src/knot/nameserver/process_query.c b/src/knot/nameserver/process_query.c
index faa7e4e17f..b8dd17757f 100644
--- a/src/knot/nameserver/process_query.c
+++ b/src/knot/nameserver/process_query.c
@@ -723,7 +723,7 @@ bool process_query_acl_check(conf_t *conf, acl_action_t action,
 	default:                     tls_session = NULL;
 	}
 
-	if (action != ACL_ACTION_UPDATE) {
+	if (conf->cache.srv_auto_acl && action != ACL_ACTION_UPDATE) {
 		// ACL_ACTION_QUERY is used for SOA/refresh query.
 		assert(action == ACL_ACTION_QUERY || action == ACL_ACTION_NOTIFY ||
 		       action == ACL_ACTION_TRANSFER);