litespeedtech / litespeedtech/openlitespeed

OpenLiteSpeed 1.8.2 Virtual Host ACL lists not working correctly

Open
#439 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C++
Stars
1.5k
Forks
233
Avg merge
2d 19h
Merged PRs (30d)
5

Description

I upgraded OpenLiteSpeed using Debian apt today, which has arrived at 1.8.2.
All of this was working perfectly before the update.

What I am observing in the IP Address Allow and Deny lists are now having unexpected results.
- IPs in the allow list are blocked by the deny list "ALL". Removing the value in deny allows the requests again.
- Somehow, removing my own IP from the allow list still allows requests from my IP, but removing all entries from allow list blocks my IP.

My configuration for the ACL.
Allow list - Allowing my IP (replaced with x.x.x.x) and all Cloudflare IPs.
x.x.x.xT, y.y.y.yT, 173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/1, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22
Denied List
ALL

Additional: This is in the logs when I try accessing from Cloudflare, which is definitely covered by the entries "108.162.192.0/18" and "172.64.0.0/13".
2025-02-01 21:14:11.582732 | INFO | [1914618] [108.162.250.168:43610] [ACL] Access to virtual host [my.url] is denied.
2025-02-01 21:18:36.388820 | INFO | [1914618] [172.69.60.144:65358] [ACL] Access to virtual host [my.url] is denied.
2025-02-01 21:18:39.197265 | INFO | [1914618] [172.69.60.144:65358] [ACL] Access to virtual host [my.url] is denied.

Thanks

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, test, or entry point is identified. Start by reproducing the virtual-host ACL behavior on OpenLiteSpeed 1.8.2 with the reported allow-list entries and deny value ALL, then trace the ACL handling used for those requests. Done means allow-listed IPs are accepted, removing an IP changes access as expected, and the reported Cloudflare addresses are no longer denied.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.