Add CIDR criteria for entity rules (for ip and subnet). closes #2452