[GH-ISSUE #43] registration with invalid `allowfrom` fails open #11

New issue

Closed

opened 2026-03-13 15:21:08 +03:00 by kerem · 3 comments

kerem commented

2026-03-13 15:21:08 +03:00

Owner

Originally created by @cpu on GitHub (Feb 28, 2018).
Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/43

I didn't read the documentation very carefully and thought I could POST /registration with an allowfrom entry for a single host address instead of a CIDR range, e.g.:

{
    "allowfrom": [
        "127.0.0.1"
    ]
}

acme-dns filters this invalid allowfrom in acmedb.Register using cidrslice.ValidEntries. The registration is created successfully with no errors, but the returned allowfrom is empty and so is the field in the database for this user:

{
  "username": "<rand>",
  "password": "<rand>",
  "fulldomain": "<rand>.example.com",
  "subdomain": "<rand>",
  "allowfrom": []
}

The documentation specifically says to use a CIDR range but I think there might be a case to be made for rejecting the registration with an error when the allowfrom contains invalid entries. Since allowfrom is a security control I think acme-dns should be conservative and fail fast when it can't fulfill the request as received.

@joohoi What do you think?

Originally created by @cpu on GitHub (Feb 28, 2018). Original GitHub issue: https://github.com/acme-dns/acme-dns/issues/43 I didn't read the documentation very carefully and thought I could POST `/registration` with an `allowfrom` entry for a single host address instead of a CIDR range, e.g.: ``` { "allowfrom": [ "127.0.0.1" ] } ``` `acme-dns` filters this invalid `allowfrom` in `acmedb.Register` using `cidrslice.ValidEntries`. The registration is created successfully with no errors, but the returned `allowfrom` is empty and so is the field in the database for this user: ``` { "username": "<rand>", "password": "<rand>", "fulldomain": "<rand>.example.com", "subdomain": "<rand>", "allowfrom": [] } ``` The documentation specifically says to use a CIDR range but I think there might be a case to be made for rejecting the registration with an error when the `allowfrom` contains invalid entries. Since `allowfrom` is a security control I think `acme-dns` should be conservative and fail fast when it can't fulfill the request as received. @joohoi What do you think?

kerem

2026-03-13 15:21:08 +03:00

closed this issue
added the
feature request
label

kerem commented

2026-03-13 15:21:24 +03:00

Author

Owner

@joohoi commented on GitHub (Mar 1, 2018):

I think you are on the right track here, and we should fail early. But from the UX perspective, I think what would be best way to handle this, would be to automatically add /32 bitmask if none is specified but the IP address itself is valid.

@joohoi commented on GitHub (Mar 1, 2018): I think you are on the right track here, and we should fail early. But from the UX perspective, I think what would be best way to handle this, would be to automatically add `/32` bitmask if none is specified but the IP address itself is valid.

kerem commented

2026-03-13 15:21:30 +03:00

Author

Owner

@cpu commented on GitHub (Mar 1, 2018):

from the UX perspective, I think what would be best way to handle this, would be to automatically add /32 bitmask if none is specified but the IP address itself is valid.

That sounds like a nice compromise 👍

@cpu commented on GitHub (Mar 1, 2018): > from the UX perspective, I think what would be best way to handle this, would be to automatically add /32 bitmask if none is specified but the IP address itself is valid. That sounds like a nice compromise :+1:

kerem commented

2026-03-13 15:21:35 +03:00

Author

Owner

@joohoi commented on GitHub (Feb 5, 2019):

This is now finally fixed. I opted to not to introduce magic I proposed in https://github.com/joohoi/acme-dns/issues/43#issuecomment-369604662 . The only magic is removing [ and ] from the IP addresses as the net.ParseCIDR cannot handle that notation of IPv6 addresses.

@joohoi commented on GitHub (Feb 5, 2019): This is now finally fixed. I opted to not to introduce magic I proposed in https://github.com/joohoi/acme-dns/issues/43#issuecomment-369604662 . The only magic is removing `[` and `]` from the IP addresses as the `net.ParseCIDR` cannot handle that notation of IPv6 addresses.

kerem referenced this issue

2026-03-13 16:13:35 +03:00

[PR #20] [MERGED] Get rid of Iris and use julienschmidt/httprouter instead #251