PageCache/AccessList: Add CIDR support

[tdgroot]

Description (*)

When accepting purge requests within a network, it's easier to just supply a CIDR range.

Related Pull Requests

None.

Fixed Issues (if relevant)

None.

Manual testing scenarios (*)

1. Go to Advanced -> System -> Full Page Cache -> Varnish Configuration
2. Configure a CIDR range like 172.16.0.1/24
3. Value should be valid and saved

Questions or comments

Contribution checklist (*)

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• README.md files for modified modules are updated and included in the pull request if any README.md predefined sections require an update
• All automated tests passed successfully (all builds are green)

Resolved issues:

1. resolves [Issue] PageCache/AccessList: Add CIDR support #39953: PageCache/AccessList: Add CIDR support

[m2-assistant]

Hi @tdgroot. Thank you for your contribution!
Here are some useful tips on how you can test your changes using Magento test environment.

Add the comment under your pull request to deploy test or vanilla Magento instance:

• @magento give me test instance - deploy test instance based on PR changes
• @magento give me 2.4-develop instance - deploy vanilla Magento instance

❗ Automated tests can be triggered manually with an appropriate comment:

• @magento run all tests - run or re-run all required tests against the PR changes
• @magento run <test-build(s)> - run or re-run specific test build(s)
  For example: @magento run Unit Tests

<test-build(s)> is a comma-separated list of build names.

Allowed build names are:

1. Database Compare
2. Functional Tests CE
3. Functional Tests EE
4. Functional Tests B2B
5. Integration Tests
6. Magento Health Index
7. Sample Data Tests CE
8. Sample Data Tests EE
9. Sample Data Tests B2B
10. Static Tests
11. Unit Tests
12. WebAPI Tests
13. Semantic Version Checker

You can find more information about the builds here
ℹ️ Run only required test builds during development. Run all test builds before sending your pull request for review.

---

For more details, review the Code Contributions documentation.
Join Magento Community Engineering Slack and ask your questions in #github channel.

[engcom-Hotel]

@magento run all tests

[engcom-Hotel]

@magento create issue

[engcom-Hotel]

Hello @tdgroot,

Thanks for the contribution!

But as this is feature enhancement, we need a PO confirmation to proceed with this PR. We have started the process for the same. Meanwhile we are moving this PR On Hold.

Thanks

[engcom-Hotel]

@magento run all tests

[engcom-Hotel]

Hello @tdgroot,

We have received an approval for this PR for further evaluation. Hence moving it to appropriate bucket.

Thanks

[engcom-Hotel]

Hello @tdgroot,

Thank you for your contribution to add CIDR notation support to PageCache access lists. This is a valuable enhancement that would allow for more flexible IP-based access control.

However, the PR currently only modifies the validation pattern without implementing the actual CIDR functionality. For full CIDR support, we need changes in:

• The component that performs IP matching against the access list
• A utility method to properly compare an IP against a CIDR range

Thanks

[engcom-Hotel]

1. The pattern places (\/\d+)? inside a character class ([...]), which means these are treated as individual characters rather than a sequence.
2. The pattern remains overly permissive and would validate strings like "this is: a more / or less, valid string.... oh, lets add numbers 12345" which aren't valid IP addresses or CIDR notations

[hostep]

The extra CIDR validation regex should indeed be moved outside of the character class, so should become something like this: ^[\w\s\.\-\,\:]+(\/\d+)?$
Good remark!

[hostep]

However, the PR currently only modifies the validation pattern without implementing the actual CIDR functionality. For full CIDR support, we need changes in:

The component that performs IP matching against the access list
A utility method to properly compare an IP against a CIDR range

That's not really true, the only place where we use this configuration value is over here:

magento2/app/code/Magento/PageCache/Model/Varnish/VclGenerator.php

Line 164 in 7da46f5

$this->getAccessList(),

Which is used to output the access list into the VCL file that Magento generates for Varnish.
Varnish already supports CIDR notation in ACL's, so there is no need for extra matching or parsing.

One thing that I'm not sure about, but maybe @tdgroot can clarify, is that the Varnish docs say to put the IP address in double quotes and the CIDR part outside of those quotes: https://varnish-cache.org/docs/trunk/users-guide/vcl-example-acls.html#acls
In this Magento code, the CIDR part would be included inside the double quotes. I have no idea if this will cause issues or will just work as expected?