feat: support CIDR ranges in imported IP blacklists

Author: TheMasterOfDisasters

CHANGELOG.md

@@ -13,6 +13,7 @@ All Sniffnet releases with the relative changes are documented in this file.
   - Greek ([#1175](https://github.com/GyulyVGC/sniffnet/pull/1175))
 - Fix unseen hosts and services not appearing dimmed in thumbnail mode (fixes [#1142](https://github.com/GyulyVGC/sniffnet/issues/1142))
 - Fix `X-AppImage-Version` field in Linux AppImage metadata to correctly reflect the app version ([#1174](https://github.com/GyulyVGC/sniffnet/pull/1174) — fixes [#1003](https://github.com/GyulyVGC/sniffnet/issues/1003))
+- Support CIDR ranges in imported IP blacklists.
 
 ## [1.5.0] - 2026-04-14
 - Show which apps and programs are generating network traffic ([#1056](https://github.com/GyulyVGC/sniffnet/pull/1056) — fixes [#170](https://github.com/GyulyVGC/sniffnet/issues/170))

Cargo.lock

@@ -46,6 +46,7 @@ ctrlc = { version = "3.5.2", features = ["termination"] }
 dns-lookup = "3.0.1"
 etherparse = "0.20.1"
 iced = { version = "0.14.0", features = ["tokio", "svg", "advanced", "lazy", "image"] }
+ipnet = "2.12.0"
 listeners = "0.5.1"
 maxminddb = "0.28.1"
 pcap = "2.4.0"

Cargo.toml

@@ -116,7 +116,7 @@ Not what you're looking for? Check out [alternative installation methods](https:
 - 📌 keep an eye on your network even when the application is **minimized**
 - ️🔎 search and **inspect** each of your network connections in real time
 - 🔉 set custom **notifications** to inform you when defined network events occur
-- 🚫 import custom **IP blacklists** to highlight potentially dangerous connections
+- 🚫 import custom **IP blacklists** with exact IPs or CIDR ranges to highlight potentially dangerous connections
 - 🎨 choose the **style** that fits you the most, including custom themes support
 - ...and more!
 
@@ -195,4 +195,3 @@ Follow the <a href="https://sniffnet.net/news"><b>news</b></a> and Sniffnet soci
     </td>
   </tr>
 </table>
-

README.md

@@ -0,0 +1,6 @@
+209.186.20.0/22
+209.186.24.0/21
+209.186.224.0/21
+209.186.232.0/22
+209.186.236.0/24
+209.233.156.0/22

resources/test/ip_blacklist_real_cidr_ranges.txt

@@ -0,0 +1 @@
+1.2.3.0/24

resources/test/ip_blacklist_valid_cidr_only.txt

@@ -0,0 +1,9 @@
+8.8.8.8
+2001:db8::1
+1.2.3.0/24
+2001:db9::/32 # IPv6 test network
+5.6.7.0/24 ; SBL123456
+9.9.9.0/24 # inline hash comment
+# full-line hash comment
+; full-line semicolon comment
+invalid text that should be ignored

resources/test/ip_blacklist_valid_with_cidr.txt

@@ -534,9 +534,14 @@ mod tests {
     use crate::Service;
     use crate::networking::manage_packets::{
         get_service, get_traffic_direction, get_traffic_type, is_local_connection,
-        mac_from_dec_to_hex,
+        mac_from_dec_to_hex, modify_or_insert_in_map,
     };
     use crate::networking::types::address_port_pair::AddressPortPair;
+    use crate::networking::types::arp_type::ArpType;
+    use crate::networking::types::capture_context::{CaptureSource, MyPcapImport};
+    use crate::networking::types::icmp_type::IcmpType;
+    use crate::networking::types::info_traffic::InfoTraffic;
+    use crate::networking::types::ip_blacklist::IpBlacklist;
     use crate::networking::types::service_query::ServiceQuery;
     use crate::networking::types::traffic_direction::TrafficDirection;
     use crate::networking::types::traffic_type::TrafficType;
@@ -1534,6 +1539,56 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn test_cidr_blacklist_marks_remote_address_blacklisted() {
+        let blacklist =
+            IpBlacklist::from_file("resources/test/ip_blacklist_real_cidr_ranges.txt".to_string())
+                .await;
+        let mut info_traffic = InfoTraffic::default();
+        let capture_source = CaptureSource::File(MyPcapImport::new(String::new()));
+        let key = AddressPortPair::new(
+            IpAddr::from_str("192.168.1.10").unwrap(),
+            Some(50000),
+            IpAddr::from_str("209.186.21.7").unwrap(),
+            Some(443),
+            Protocol::TCP,
+        );
+
+        modify_or_insert_in_map(
+            &mut info_traffic,
+            &key,
+            &capture_source,
+            (None, None),
+            IcmpType::default(),
+            ArpType::default(),
+            100,
+            &blacklist,
+        );
+
+        assert!(info_traffic.map.get(&key).unwrap().is_blacklisted);
+
+        let key = AddressPortPair::new(
+            IpAddr::from_str("192.168.1.10").unwrap(),
+            Some(50001),
+            IpAddr::from_str("209.186.237.1").unwrap(),
+            Some(443),
+            Protocol::TCP,
+        );
+
+        modify_or_insert_in_map(
+            &mut info_traffic,
+            &key,
+            &capture_source,
+            (None, None),
+            IcmpType::default(),
+            ArpType::default(),
+            100,
+            &blacklist,
+        );
+
+        assert!(!info_traffic.map.get(&key).unwrap().is_blacklisted);
+    }
+
     #[test]
     fn test_get_service_unknown() {
         let unknown_port_1 = Some(39332);

src/networking/manage_packets.rs

@@ -2,9 +2,12 @@ use std::collections::HashSet;
 use std::net::IpAddr;
 use std::sync::Arc;
 
+use ipnet::IpNet;
+
 #[derive(Clone, Default, Debug)]
 pub struct IpBlacklist {
     ips: Arc<HashSet<IpAddr>>,
+    networks: Arc<Vec<IpNet>>,
     is_loading: bool,
 }
 
@@ -13,24 +16,32 @@ impl IpBlacklist {
         let Ok(buf) = tokio::fs::read_to_string(&path).await else {
             return IpBlacklist::default();
         };
-        let mut set = HashSet::new();
+        let mut ips = HashSet::new();
+        let mut networks = Vec::new();
         for line in buf.lines() {
-            if let Ok(ip) = line.trim().parse::<IpAddr>() {
-                set.insert(ip);
+            let Some(line) = clean_blacklist_line(line) else {
+                continue;
+            };
+
+            if let Ok(ip) = line.parse::<IpAddr>() {
+                ips.insert(ip);
+            } else if let Ok(network) = line.parse::<IpNet>() {
+                networks.push(network);
             }
         }
         IpBlacklist {
-            ips: Arc::new(set),
+            ips: Arc::new(ips),
+            networks: Arc::new(networks),
             is_loading: false,
         }
     }
 
     pub fn contains(&self, ip: &IpAddr) -> bool {
-        self.ips.contains(ip)
+        self.ips.contains(ip) || self.networks.iter().any(|network| network.contains(ip))
     }
 
     pub fn is_invalid(&self) -> bool {
-        self.ips.is_empty() && !self.is_loading
+        self.ips.is_empty() && self.networks.is_empty() && !self.is_loading
     }
 
     pub fn is_loading(&self) -> bool {
@@ -42,6 +53,20 @@ impl IpBlacklist {
     }
 }
 
+fn clean_blacklist_line(line: &str) -> Option<&str> {
+    let line = line.trim();
+
+    if line.is_empty() || line.starts_with('#') || line.starts_with(';') {
+        return None;
+    }
+
+    let line = line.split(';').next().unwrap_or(line);
+    let line = line.split('#').next().unwrap_or(line);
+    let line = line.trim();
+
+    if line.is_empty() { None } else { Some(line) }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -55,6 +80,7 @@ mod tests {
         assert!(!blacklist.is_invalid());
         assert!(!blacklist.is_loading());
         assert_eq!(blacklist.ips.len(), 4);
+        assert_eq!(blacklist.networks.len(), 0);
 
         assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8))));
         assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(1, 2, 3, 255))));
@@ -75,10 +101,86 @@ mod tests {
         assert!(blacklist.is_invalid());
         assert!(!blacklist.is_loading());
         assert_eq!(blacklist.ips.len(), 0);
+        assert_eq!(blacklist.networks.len(), 0);
 
         assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8))));
         assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(0, 0, 0, 0))));
         assert!(!blacklist.contains(&"::123".parse::<IpAddr>().unwrap()));
         assert!(!blacklist.contains(&"::".parse::<IpAddr>().unwrap()));
     }
+
+    #[tokio::test]
+    async fn test_ip_blacklist_valid_with_cidr() {
+        let blacklist =
+            IpBlacklist::from_file("resources/test/ip_blacklist_valid_with_cidr.txt".to_string())
+                .await;
+
+        assert!(!blacklist.is_invalid());
+        assert!(!blacklist.is_loading());
+        assert_eq!(blacklist.ips.len(), 2);
+        assert_eq!(blacklist.networks.len(), 4);
+
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(8, 8, 8, 8))));
+        assert!(blacklist.contains(&"2001:db8::1".parse::<IpAddr>().unwrap()));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(8, 8, 8, 9))));
+        assert!(!blacklist.contains(&"2001:db8::2".parse::<IpAddr>().unwrap()));
+
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(1, 2, 3, 1))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(1, 2, 3, 255))));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(1, 2, 5, 1))));
+
+        assert!(blacklist.contains(&"2001:db9::1".parse::<IpAddr>().unwrap()));
+        assert!(blacklist.contains(&"2001:db9:ffff::1".parse::<IpAddr>().unwrap()));
+        assert!(!blacklist.contains(&"2001:dba::1".parse::<IpAddr>().unwrap()));
+
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(5, 6, 7, 10))));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(5, 6, 8, 10))));
+
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(9, 9, 9, 9))));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(9, 9, 10, 9))));
+    }
+
+    #[tokio::test]
+    async fn test_ip_blacklist_valid_with_cidr_only() {
+        let blacklist =
+            IpBlacklist::from_file("resources/test/ip_blacklist_valid_cidr_only.txt".to_string())
+                .await;
+
+        assert!(!blacklist.is_invalid());
+        assert!(!blacklist.is_loading());
+        assert_eq!(blacklist.ips.len(), 0);
+        assert_eq!(blacklist.networks.len(), 1);
+
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(1, 2, 3, 1))));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(1, 2, 4, 1))));
+    }
+
+    #[tokio::test]
+    async fn test_ip_blacklist_real_cidr_ranges() {
+        let blacklist =
+            IpBlacklist::from_file("resources/test/ip_blacklist_real_cidr_ranges.txt".to_string())
+                .await;
+
+        assert!(!blacklist.is_invalid());
+        assert_eq!(blacklist.ips.len(), 0);
+        assert_eq!(blacklist.networks.len(), 6);
+
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 20, 0))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 23, 255))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 24, 0))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 31, 255))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 224, 0))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 231, 255))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 232, 0))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 235, 255))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 236, 0))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 236, 255))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 233, 156, 0))));
+        assert!(blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 233, 159, 255))));
+
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 19, 255))));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 32, 0))));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 186, 237, 0))));
+        assert!(!blacklist.contains(&IpAddr::V4(Ipv4Addr::new(209, 233, 160, 0))));
+    }
 }