in LiipCacheControlBundle, we refactored this lately to get rid of limitations: https://github.com/liip/LiipCacheControlBundle/pull/40/files

imho, $this->hosts should be a regexp (maybe built by the DI container if the config does not define a regexp), and the $hosts parameter should optionally be allowed to be string, which would mean it already is a regexp and not handled any further.

regarding self::REGEX_MATCH_ALL - should we not simply not send a header if it is not filtering anything, and be clever on the varnish vcl side?