Add configurable IP forward header for Varnish purge ACL

Console/Command/GenerateVclCommand.php

@@ -144,6 +144,7 @@ protected function execute(InputInterface $input, OutputInterface $output): int
                 'sslOffloadedHeader' => $this->varnishExtendedConfig->getSslOffloadedHeader(),
                 'trackingParameters' => $this->varnishExtendedConfig->getTrackingParameters(),
                 'designExceptions' => $this->varnishExtendedConfig->getDesignExceptions(),
+                'ipForwardHeader' => $this->varnishExtendedConfig->getIpForwardHeader(),
             ]);
             $vclGenerator = $this->vclGeneratorFactory->create($vclParameters);
             $vcl = $vclGenerator->generateVcl($varnishVersion, $inputFile);

Model/Config.php

@@ -34,6 +34,8 @@ class Config extends PageCacheConfig
 
     public const XML_PATH_VARNISH_PASS_ON_COOKIE_PRESENCE = 'system/full_page_cache/varnish/pass_on_cookie_presence';
 
+    public const XML_PATH_VARNISH_IP_FORWARD_HEADER = 'system/full_page_cache/varnish/ip_forward_header';
+
     public function __construct(
         ReadFactory $readFactory,
         ScopeConfigInterface $scopeConfig,
@@ -132,4 +134,9 @@ public function getEnableStaticCache(): bool
     {
         return (bool) $this->scopeConfig->getValue(static::XML_PATH_VARNISH_ENABLE_STATIC_CACHE);
     }
+
+    public function getIpForwardHeader(): string
+    {
+        return (string) $this->scopeConfig->getValue(static::XML_PATH_VARNISH_IP_FORWARD_HEADER);
+    }
 }

Model/Varnish/VCLGenerator.php

@@ -54,7 +54,8 @@ public function getVariables(): array
             'use_xkey_vmod' => (int) $this->varnishExtendedConfig->getUseXkeyVmod(),
             'use_soft_purging' => (int) $this->varnishExtendedConfig->getUseSoftPurging(),
             'pass_on_cookie_presence' => $this->varnishExtendedConfig->getPassOnCookiePresence(),
-            'design_exceptions_code' => $this->getRegexForDesignExceptions()
+            'design_exceptions_code' => $this->getRegexForDesignExceptions(),
+            'ip_forward_header' => $this->varnishExtendedConfig->getIpForwardHeader()
         ];
     }
 

etc/adminhtml/system.xml

@@ -65,6 +65,13 @@
                             <field id="system/full_page_cache/varnish/use_xkey_vmod">1</field>
                         </depends>
                     </field>
+                    <field id="ip_forward_header" type="text" translate="label comment" sortOrder="37" showInDefault="1" showInWebsite="0" showInStore="0">
+                        <label>IP Forward Header</label>
+                        <comment><![CDATA[Header name for forwarded client IP address (e.g., X-Forwarded-For, X-Real-IP). Used for purge access control.]]></comment>
+                        <depends>
+                            <field id="caching_application">1</field>
+                        </depends>
+                    </field>
                 </group>
             </group>
         </section>

etc/config.xml

@@ -116,6 +116,7 @@
                     </tracking_parameters>
                     <use_xkey_vmod>0</use_xkey_vmod>
                     <use_soft_purging>0</use_soft_purging>
+                    <ip_forward_header>X-Forwarded-For</ip_forward_header>
                 </varnish>
             </full_page_cache>
         </system>

etc/varnish6.vcl

@@ -57,7 +57,7 @@ sub vcl_recv {
 
     # Allow cache purge via Ctrl-Shift-R or Cmd-Shift-R for IP's in purge ACL list
     if (req.http.pragma ~ "no-cache" || req.http.Cache-Control ~ "no-cache") {
-        if (client.ip ~ purge) {
+        if (std.ip(regsub(req.http.{{var ip_forward_header}}, "^([^,]+),?.*$", "\1"), client.ip) ~ purge) {
             set req.hash_always_miss = true;
         }
     }
@@ -67,7 +67,7 @@ sub vcl_recv {
     # The X-Magento-Tags-Pattern value is matched to the tags in the X-Magento-Tags header
     # If X-Magento-Tags-Pattern is not set, a URL-based purge is executed
     if (req.method == "PURGE") {
-        if (client.ip !~ purge) {
+        if (std.ip(regsub(req.http.{{var ip_forward_header}}, "^([^,]+),?.*$", "\1"), client.ip) !~ purge) {
             return (synth(405));
         }
 

tests/varnish/helpers/parse_vcl.pl

@@ -13,6 +13,7 @@
     'PORT' => $ENV{PORT} || $ENV{s1_port},
     'GRACE_PERIOD' => '300',
     'SSL_OFFLOADED_HEADER' => 'X-Forwarded-Proto',
+    'IP_FORWARD_HEADER' => 'X-Forwarded-For',
     'USE_XKEY_VMOD' => '1',
     'ENABLE_BFCACHE' => '1',
     'ENABLE_MEDIA_CACHE' => '1',

tests/varnish/ip_forward_header.vtc

@@ -0,0 +1,59 @@
+varnishtest "IP Forward Header allows purge from forwarded IP"
+
+barrier b1 cond 2
+
+server s1 {
+    # first request will be the probe, handle it and be on our way
+    rxreq
+    expect req.url == "/health_check.php"
+    txresp
+
+    # the probe expects the connection to close
+    close
+    barrier b1 sync
+    accept
+
+    rxreq
+    expect req.url == "/"
+    expect req.method == "GET"
+    txresp
+
+    rxreq
+    expect req.url == "/"
+    expect req.method == "PURGE"
+    txresp
+} -start
+
+# Generate the VCL file based on included variables and write it to output.vcl
+# Set up ACL with a single whitelisted IP that is not the test client
+shell {
+    export ACCESS_LIST="whitelisted"
+    export WHITELISTED_IP="10.0.0.1"
+    export s1_addr="${s1_addr}"
+    export s1_port="${s1_port}"
+    ${testdir}/helpers/parse_vcl.pl "${testdir}/../../etc/varnish6.vcl" "${tmpdir}/output.vcl"
+}
+
+varnish v1 -arg "-f" -arg "${tmpdir}/output.vcl" -arg "-p" -arg "vsl_mask=+Hash" -start
+
+# make sure the probe request fired
+barrier b1 sync
+
+client c1 {
+    # First request to cache the page
+    txreq -method "GET" -url "/"
+    rxresp
+    expect resp.http.X-Magento-Cache-Debug == "MISS"
+
+    # Second request: PURGE without X-Forwarded-For header should fail (405)
+    # because client IP (127.0.0.1) is not whitelisted
+    txreq -method "PURGE" -url "/"
+    rxresp
+    expect resp.status == 405
+
+    # Third request: PURGE with X-Forwarded-For header should succeed
+    # because forwarded IP (10.0.0.1) is whitelisted
+    txreq -method "PURGE" -url "/" -hdr "X-Forwarded-For: 10.0.0.1"
+    rxresp
+    expect resp.status == 200
+} -run