add documentation for cidr macros (#599)

add docs and examples for cidr macros

docs/http/traffic-policy/expressions.mdx

@@ -357,18 +357,20 @@ The trailers of the response wherein a string key maps to a list of string value
 CEL provides a set of [predefined macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros) that can
 also be used in policy expressions. For convenience, the following custom macros are also supported:
 
-| Name                                            | Return Type | Description                                                                                                                   |
-| ----------------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------- |
-| [`hasReqHeader(string)`](#hasreqheaderstring)   | bool        | Returns true or false if the provided header key is present on the request. Header keys must be written in canonical format.  |
-| [`getReqHeader(string)`](#getreqheaderstring)   | list        | Returns a list of header values for the provided key on the request. Header keys must be written in canonical format.         |
-| [`hasQueryParam(string)`](#hasqueryparamstring) | bool        | Returns true or false if the specified query parameter key is part of the request URL.                                        |
-| [`getQueryParam(string)`](#getqueryparamstring) | list        | Returns a list of the query parameter values from the request URL for the specified key.                                      |
-| [`hasReqCookie(string)`](#hasreqcookiestring)   | bool        | Returns true or false if a cookie exists on the request with the specified name.                                              |
-| [`getReqCookie(string)`](#getreqcookiestring)   | bool        | Returns the cookie struct for the specified cookie name, if it exists on the request.                                         |
-| [`hasResHeader(string)`](#hasresheaderstring)   | bool        | Returns true or false if the provided header key is present on the response. Header keys must be written in canonical format. |
-| [`getResHeader(string)`](#getresheaderstring)   | list        | Returns a list of header values for the provided key on the response. Header keys must be written in canonical format.        |
-| [`hasResCookie(string)`](#hasrescookiestring)   | bool        | Returns true or false if a cookie exists on the response with the specified name.                                             |
-| [`getResCookie(string)`](#getrescookiestring)   | bool        | Returns the cookie struct for the specified cookie name, if it exists on the response.                                        |
+| Name                                                                       | Return Type | Description                                                                                                                                       |
+| -------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`hasReqHeader(string)`](#hasreqheaderstring)                              | bool        | Returns true or false if the provided header key is present on the request. Header keys must be written in canonical format.                      |
+| [`getReqHeader(string)`](#getreqheaderstring)                              | list        | Returns a list of header values for the provided key on the request. Header keys must be written in canonical format.                             |
+| [`hasQueryParam(string)`](#hasqueryparamstring)                            | bool        | Returns true or false if the specified query parameter key is part of the request URL.                                                            |
+| [`getQueryParam(string)`](#getqueryparamstring)                            | list        | Returns a list of the query parameter values from the request URL for the specified key.                                                          |
+| [`hasReqCookie(string)`](#hasreqcookiestring)                              | bool        | Returns true or false if a cookie exists on the request with the specified name.                                                                  |
+| [`getReqCookie(string)`](#getreqcookiestring)                              | bool        | Returns the cookie struct for the specified cookie name, if it exists on the request.                                                             |
+| [`hasResHeader(string)`](#hasresheaderstring)                              | bool        | Returns true or false if the provided header key is present on the response. Header keys must be written in canonical format.                     |
+| [`getResHeader(string)`](#getresheaderstring)                              | list        | Returns a list of header values for the provided key on the response. Header keys must be written in canonical format.                            |
+| [`hasResCookie(string)`](#hasrescookiestring)                              | bool        | Returns true or false if a cookie exists on the response with the specified name.                                                                 |
+| [`getResCookie(string)`](#getrescookiestring)                              | bool        | Returns the cookie struct for the specified cookie name, if it exists on the response.                                                            |
+| [`inCidrRange(ip string, cidr string)`](#incidrrangeip-string-cidr-string) | bool        | Returns true or false if the provided IP address falls within the provided CIDR range. Returns false if the provided CIDR range is invalid.       |
+| [`inCidrRanges(ip string, cidrs list)`](#incidrrangesip-string-cidrs-list) | bool        | Returns true or false if the provided IP address falls within any of the provided CIDR ranges. Ignores any provided CIDR ranges that are invalid. |
 
 ### `hasReqHeader(string)`
 
@@ -473,3 +475,25 @@ Returns the cookie struct for the specified cookie name, if it exists on the res
 		expressions: ["getResCookie('_device_id').Value == 'mobile-phone-14'"],
 	}}
 />
+
+### `inCidrRange(ip string, cidr string)`
+
+Returns true or false if the provided IP address falls within the provided CIDR range. Returns false if the provided CIDR range is invalid.
+
+<ConfigExample
+	config={{
+		expressions: ["inCidrRange(conn.ClientIP, '66.249.66.1/24')"],
+	}}
+/>
+
+### `inCidrRanges(ip string, cidrs list)`
+
+Returns true or false if the provided IP address falls within any of the provided CIDR ranges. Ignores any provided CIDR ranges that are invalid.
+
+<ConfigExample
+	config={{
+		expressions: [
+			"inCidrRanges(conn.ClientIP, ['66.249.66.1/24', '2001:4860::/32'])",
+		],
+	}}
+/>

docs/tcp/traffic-policy/expressions.mdx

@@ -3,7 +3,7 @@ import ConfigExample from "/src/components/ConfigExample.tsx";
 # Expressions
 
 Traffic Policy module enables you to filter inbound and outbound traffic with [Common Expression Language (CEL)](https://github.com/google/cel-spec) expressions. Each policy rule expression must evaluate to true in order for
-the rule's actions to take effect against traffic. In addition to CEL's [built-in functions and macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros) we provide additional variables for the [connection](#connection-variables).
+the rule's actions to take effect against traffic. In addition to CEL's [built-in functions and macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros) we provide additional variables for the [connection](#connection-variables) along with [custom macros](#macros).
 
 ## Connection Variables
 
@@ -66,3 +66,37 @@ The approximate longitude based on the client IP.
 		expressions: ["double(conn.Geo.Longitude) <= -93.0"],
 	}}
 />
+
+---
+
+## Macros
+
+CEL provides a set of [predefined macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros) that can
+also be used in policy expressions. For convenience, the following custom macros are also supported:
+
+| Name                                                                       | Return Type | Description                                                                                                                                       |
+| -------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`inCidrRange(ip string, cidr string)`](#incidrrangeip-string-cidr-string) | bool        | Returns true or false if the provided IP address falls within the provided CIDR range. Returns false if the provided CIDR range is invalid.       |
+| [`inCidrRanges(ip string, cidrs list)`](#incidrrangesip-string-cidrs-list) | bool        | Returns true or false if the provided IP address falls within any of the provided CIDR ranges. Ignores any provided CIDR ranges that are invalid. |
+
+### `inCidrRange(ip string, cidr string)`
+
+Returns true or false if the provided IP address falls within the provided CIDR range. Returns false if the provided CIDR range is invalid.
+
+<ConfigExample
+	config={{
+		expressions: ["inCidrRange(conn.ClientIP, '66.249.66.1/24')"],
+	}}
+/>
+
+### `inCidrRanges(ip string, cidrs list)`
+
+Returns true or false if the provided IP address falls within any of the provided CIDR ranges. Ignores any provided CIDR ranges that are invalid.
+
+<ConfigExample
+	config={{
+		expressions: [
+			"inCidrRanges(conn.ClientIP, ['66.249.66.1/24', '2001:4860::/32'])",
+		],
+	}}
+/>

docs/tls/traffic-policy/expressions.mdx

@@ -3,7 +3,7 @@ import ConfigExample from "/src/components/ConfigExample.tsx";
 # Expressions
 
 Traffic Policy module enables you to filter inbound and outbound traffic with [Common Expression Language (CEL)](https://github.com/google/cel-spec) expressions. Each policy rule expression must evaluate to true in order for
-the rule's actions to take effect against traffic. In addition to CEL's [built-in functions and macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros) we provide additional variables for the [connection](#connection-variables).
+the rule's actions to take effect against traffic. In addition to CEL's [built-in functions and macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros) we provide additional variables for the [connection](#connection-variables) along with [custom macros](#macros).
 
 ## Connection Variables
 
@@ -110,3 +110,37 @@ The TLS Version used on the connection.
 		expressions: ["conn.TLS.Version.contains('1.3')"],
 	}}
 />
+
+---
+
+## Macros
+
+CEL provides a set of [predefined macros](https://github.com/google/cel-spec/blob/master/doc/langdef.md#macros) that can
+also be used in policy expressions. For convenience, the following custom macros are also supported:
+
+| Name                                                                       | Return Type | Description                                                                                                                                       |
+| -------------------------------------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| [`inCidrRange(ip string, cidr string)`](#incidrrangeip-string-cidr-string) | bool        | Returns true or false if the provided IP address falls within the provided CIDR range. Returns false if the provided CIDR range is invalid.       |
+| [`inCidrRanges(ip string, cidrs list)`](#incidrrangesip-string-cidrs-list) | bool        | Returns true or false if the provided IP address falls within any of the provided CIDR ranges. Ignores any provided CIDR ranges that are invalid. |
+
+### `inCidrRange(ip string, cidr string)`
+
+Returns true or false if the provided IP address falls within the provided CIDR range. Returns false if the provided CIDR range is invalid.
+
+<ConfigExample
+	config={{
+		expressions: ["inCidrRange(conn.ClientIP, '66.249.66.1/24')"],
+	}}
+/>
+
+### `inCidrRanges(ip string, cidrs list)`
+
+Returns true or false if the provided IP address falls within any of the provided CIDR ranges. Ignores any provided CIDR ranges that are invalid.
+
+<ConfigExample
+	config={{
+		expressions: [
+			"inCidrRanges(conn.ClientIP, ['66.249.66.1/24', '2001:4860::/32'])",
+		],
+	}}
+/>