more stuff

internal/acl/acl.go

@@ -327,6 +327,12 @@ func matchPTR(n, suffix string) bool {
 	if suffix == "" || len(n) < len(suffix) || !strings.HasSuffix(n, suffix) {
 		return false
 	}
+	// A suffix written with its own leading dot (".lan.") is the natural way to
+	// say "anything under lan" and the console's own hint suggests it. Its dot
+	// is the label boundary, so there is nothing more to check.
+	if suffix[0] == '.' {
+		return true
+	}
 	// The suffix has to start a label: it is either the whole name, or the
 	// character in front of it is a dot.
 	rest := n[:len(n)-len(suffix)]