v0.31.0

src/cache/model/entry.rs

@@ -78,6 +78,7 @@ impl Settings {
                 "cache bypass prefixes must be normalized absolute paths"
             );
         }
+        self.validate_http_invalidation_allowlist()?;
         ensure!(
             self.static_extensions.len() <= 64,
             "at most 64 static cache extensions"

src/cache/model/http_invalidation.rs

@@ -0,0 +1,31 @@
+// A strict, human-editable IP/CIDR policy. The caller supplies only a client IP
+// produced by the existing forwarding trust boundary, never an arbitrary header.
+fn parse_invalidation_cidr(value: &str) -> anyhow::Result<ipnet::IpNet> {
+    let value = value.trim();
+    if let Ok(ip) = value.parse::<std::net::IpAddr>() {
+        return Ok(ipnet::IpNet::from(ip));
+    }
+    value.parse::<ipnet::IpNet>().map_err(|_| anyhow::anyhow!("invalid HTTP invalidation IP/CIDR: {value}"))
+}
+impl Settings {
+    fn validate_http_invalidation_allowlist(&self) -> anyhow::Result<()> {
+        ensure!(
+            self.http_invalidation_allowed_cidrs.len() <= 32,
+            "cache.http_invalidation_allowed_cidrs allows at most 32 entries"
+        );
+        let mut networks = std::collections::HashSet::new();
+        for input in &self.http_invalidation_allowed_cidrs {
+            ensure!(input.len() <= 64, "HTTP invalidation address too long");
+            let net = parse_invalidation_cidr(input)?;
+            ensure!(net.prefix_len() > 0, "HTTP invalidation cannot authorize the entire Internet");
+            ensure!(networks.insert(net), "duplicate HTTP invalidation IP/CIDR");
+        }
+        Ok(())
+    }
+    pub fn permits_http_invalidation(&self, client: std::net::IpAddr) -> bool {
+        let client = crate::vhost::canonical_ip(client);
+        self.http_invalidation_allowed_cidrs.iter().any(|value| {
+            parse_invalidation_cidr(value).ok().is_some_and(|network| network.contains(&client))
+        })
+    }
+}

src/cache/model/settings.rs

@@ -149,6 +149,9 @@ pub struct Settings {
     pub max_ttl_seconds: u64,
     pub bypass_query: bool,
     pub bypass_prefixes: Vec<String>,
+    /// Actual client IP/CIDR allowlist for HTTP BAN/PURGE. Empty disables these
+    /// public-listener methods (independent of authenticated admin API).
+    pub http_invalidation_allowed_cidrs: Vec<String>,
     /// For explicitly selected static extensions, ignore request Cookie when
     /// deciding cache eligibility and when building the shared cache key.
     pub static_ignore_cookies: bool,
@@ -210,6 +213,7 @@ impl Default for Settings {
             max_ttl_seconds: 86_400,
             bypass_query: false,
             bypass_prefixes: Vec::new(),
+            http_invalidation_allowed_cidrs: Vec::new(),
             // Static assets are normally representation-identical for logged-in and
             // anonymous visitors. Keep this enabled by default once the shared cache
             // itself is enabled; response-side privacy guards still reject Set-Cookie,