litespeedtech / litespeedtech/openlitespeed
OpenLiteSpeed 1.8.2 Virtual Host ACL lists not working correctly
Nobody has claimed this yet.
- Dominant language
- C++
- Stars
- 1.5k
- Forks
- 233
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 5
Description
I upgraded OpenLiteSpeed using Debian apt today, which has arrived at 1.8.2.
All of this was working perfectly before the update.
What I am observing in the IP Address Allow and Deny lists are now having unexpected results.
- IPs in the allow list are blocked by the deny list "ALL". Removing the value in deny allows the requests again.
- Somehow, removing my own IP from the allow list still allows requests from my IP, but removing all entries from allow list blocks my IP.
My configuration for the ACL.
Allow list - Allowing my IP (replaced with x.x.x.x) and all Cloudflare IPs.
x.x.x.xT, y.y.y.yT, 173.245.48.0/20, 103.21.244.0/22, 103.22.200.0/22, 103.31.4.0/22, 141.101.64.0/18, 108.162.192.0/18, 190.93.240.0/20, 188.114.96.0/20, 197.234.240.0/22, 198.41.128.0/17, 162.158.0.0/1, 104.16.0.0/13, 104.24.0.0/14, 172.64.0.0/13, 131.0.72.0/22
Denied List
ALL
Additional: This is in the logs when I try accessing from Cloudflare, which is definitely covered by the entries "108.162.192.0/18" and "172.64.0.0/13".
2025-02-01 21:14:11.582732 | INFO | [1914618] [108.162.250.168:43610] [ACL] Access to virtual host [my.url] is denied.
2025-02-01 21:18:36.388820 | INFO | [1914618] [172.69.60.144:65358] [ACL] Access to virtual host [my.url] is denied.
2025-02-01 21:18:39.197265 | INFO | [1914618] [172.69.60.144:65358] [ACL] Access to virtual host [my.url] is denied.
Thanks
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file, test, or entry point is identified. Start by reproducing the virtual-host ACL behavior on OpenLiteSpeed 1.8.2 with the reported allow-list entries and deny value ALL, then trace the ACL handling used for those requests. Done means allow-listed IPs are accepted, removing an IP changes access as expected, and the reported Cloudflare addresses are no longer denied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp, linux
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100