Merge pull request #1181 from TheMasterOfDisasters/feature/ip-blacklist-cidr-support

feat: support CIDR ranges in imported IP blacklists

Author: GyulyVGC

CHANGELOG.md

@@ -3,6 +3,7 @@
 All Sniffnet releases with the relative changes are documented in this file.
 
 ## [UNRELEASED]
+- Support CIDR ranges in imported IP blacklists ([#1181](https://github.com/GyulyVGC/sniffnet/pull/1181))
 - Updated some of the existing translations to v1.5:
   - Ukrainian ([#1039](https://github.com/GyulyVGC/sniffnet/pull/1039))
   - German ([#1122](https://github.com/GyulyVGC/sniffnet/pull/1122))

Cargo.lock

@@ -46,6 +46,7 @@ ctrlc = { version = "3.5.2", features = ["termination"] }
 dns-lookup = "3.0.1"
 etherparse = "0.20.1"
 iced = { version = "0.14.0", features = ["tokio", "svg", "advanced", "lazy", "image"] }
+ipnet = "2.12.0"
 listeners = "0.5.1"
 maxminddb = "0.28.1"
 pcap = "2.4.0"
@@ -54,6 +55,7 @@ phf_shared = "0.13.1"
 picon = "0.1.0"
 plotters = { version = "0.3.7", default-features = false, features = ["area_series", "line_series"] }
 plotters-iced2 = "0.14.0"
+prefix-trie = { version = "0.8.3", features = ["ipnet"] }
 reqwest = { version = "0.13.3", features = ["json"] }
 rfd = "0.17.2"
 rodio = { version = "0.22.2", default-features = false, features = ["mp3", "playback"] }

Cargo.toml

@@ -195,4 +195,3 @@ Follow the <a href="https://sniffnet.net/news"><b>news</b></a> and Sniffnet soci
     </td>
   </tr>
 </table>
-

README.md

@@ -0,0 +1,6 @@
+209.186.20.0/22
+209.186.24.0/21
+209.186.224.0/21
+209.186.232.0/22
+209.186.236.0/24
+209.233.156.0/22

resources/test/ip_blacklist_real_cidr_ranges.txt

@@ -0,0 +1 @@
+1.2.3.0/24

resources/test/ip_blacklist_valid_cidr_only.txt

@@ -0,0 +1,9 @@
+8.8.8.8
+2001:db8::1
+1.2.3.0/24
+2001:db9::/32 # IPv6 test network
+5.6.7.0/24 ; SBL123456
+9.9.9.0/24 # inline hash comment
+# full-line hash comment
+; full-line semicolon comment
+invalid text that should be ignored

resources/test/ip_blacklist_valid_with_cidr.txt

@@ -1,133 +1,134 @@
-use crate::networking::types::ip_collection::IpCollection;
+use ipnet::IpNet;
 use std::net::IpAddr;
 
 pub struct Bogon {
-    pub range: IpCollection,
+    pub ranges: Vec<IpNet>,
     pub description: &'static str,
 }
 
 // IPv4 bogons
 
 static THIS_NETWORK: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("0.0.0.0-0.255.255.255").unwrap(),
+    ranges: vec!["0.0.0.0/8".parse().unwrap()],
     description: "\"this\" network",
 });
 
 static PRIVATE_USE: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new(
-        "10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, 192.168.0.0-192.168.255.255",
-    )
-    .unwrap(),
+    ranges: vec![
+        "10.0.0.0/8".parse().unwrap(),
+        "172.16.0.0/12".parse().unwrap(),
+        "192.168.0.0/16".parse().unwrap(),
+    ],
     description: "private-use",
 });
 
 static CARRIER_GRADE: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("100.64.0.0-100.127.255.255").unwrap(),
+    ranges: vec!["100.64.0.0/10".parse().unwrap()],
     description: "carrier-grade NAT",
 });
 
 static LOOPBACK: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("127.0.0.0-127.255.255.255").unwrap(),
+    ranges: vec!["127.0.0.0/8".parse().unwrap()],
     description: "loopback",
 });
 
 static LINK_LOCAL: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("169.254.0.0-169.254.255.255").unwrap(),
+    ranges: vec!["169.254.0.0/16".parse().unwrap()],
     description: "link local",
 });
 
 static IETF_PROTOCOL: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("192.0.0.0-192.0.0.255").unwrap(),
+    ranges: vec!["192.0.0.0/24".parse().unwrap()],
     description: "IETF protocol assignments",
 });
 
 static TEST_NET_1: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("192.0.2.0-192.0.2.255").unwrap(),
+    ranges: vec!["192.0.2.0/24".parse().unwrap()],
     description: "TEST-NET-1",
 });
 
 static NETWORK_INTERCONNECT: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("198.18.0.0-198.19.255.255").unwrap(),
+    ranges: vec!["198.18.0.0/15".parse().unwrap()],
     description: "network interconnect device benchmark testing",
 });
 
 static TEST_NET_2: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("198.51.100.0-198.51.100.255").unwrap(),
+    ranges: vec!["198.51.100.0/24".parse().unwrap()],
     description: "TEST-NET-2",
 });
 
 static TEST_NET_3: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("203.0.113.0-203.0.113.255").unwrap(),
+    ranges: vec!["203.0.113.0/24".parse().unwrap()],
     description: "TEST-NET-3",
 });
 
 static MULTICAST: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("224.0.0.0-239.255.255.255").unwrap(),
+    ranges: vec!["224.0.0.0/4".parse().unwrap()],
     description: "multicast",
 });
 
 static FUTURE_USE: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("240.0.0.0-255.255.255.255").unwrap(),
+    ranges: vec!["240.0.0.0/4".parse().unwrap()],
     description: "future use",
 });
 
 // IPv6 bogons
 
 static NODE_SCOPE_UNSPECIFIED: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("::").unwrap(),
+    ranges: vec!["::/128".parse().unwrap()],
     description: "node-scope unicast unspecified",
 });
 
 static NODE_SCOPE_LOOPBACK: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("::1").unwrap(),
+    ranges: vec!["::1/128".parse().unwrap()],
     description: "node-scope unicast loopback",
 });
 
 static IPV4_MAPPED: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("::ffff:0.0.0.0-::ffff:255.255.255.255").unwrap(),
+    ranges: vec!["::ffff:0.0.0.0/96".parse().unwrap()],
     description: "IPv4-mapped",
 });
 
 static IPV4_COMPATIBLE: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("::-::255.255.255.255").unwrap(),
+    ranges: vec!["::/96".parse().unwrap()],
     description: "IPv4-compatible",
 });
 
 static REMOTELY_TRIGGERED: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("100::-100::ffff:ffff:ffff:ffff").unwrap(),
+    ranges: vec!["100::/64".parse().unwrap()],
     description: "remotely triggered black hole",
 });
 
 static ORCHID: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("2001:10::-2001:1f:ffff:ffff:ffff:ffff:ffff:ffff").unwrap(),
+    ranges: vec!["2001:10::/28".parse().unwrap()],
     description: "ORCHID",
 });
 
-static DOCUMENTATION_PREFIX: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| {
-    Bogon {
-    range: IpCollection::new("2001:db8::-2001:db8:ffff:ffff:ffff:ffff:ffff:ffff, 3fff::-3fff:fff:ffff:ffff:ffff:ffff:ffff:ffff")
-        .unwrap(),
+static DOCUMENTATION_PREFIX: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
+    ranges: vec![
+        "2001:db8::/32".parse().unwrap(),
+        "3fff::/20".parse().unwrap(),
+    ],
     description: "documentation prefix",
-}
 });
 
 static ULA: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("fc00::-fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff").unwrap(),
+    ranges: vec!["fc00::/7".parse().unwrap()],
     description: "ULA",
 });
 
 static LINK_LOCAL_UNICAST: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("fe80::-febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff").unwrap(),
+    ranges: vec!["fe80::/10".parse().unwrap()],
     description: "link-local unicast",
 });
 
 static SITE_LOCAL_UNICAST: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("fec0::-feff:ffff:ffff:ffff:ffff:ffff:ffff:ffff").unwrap(),
+    ranges: vec!["fec0::/10".parse().unwrap()],
     description: "site-local unicast",
 });
 
 static MULTICAST_V6: std::sync::LazyLock<Bogon> = std::sync::LazyLock::new(|| Bogon {
-    range: IpCollection::new("ff00::-ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff").unwrap(),
+    ranges: vec!["ff00::/8".parse().unwrap()],
     description: "multicast v6",
 });
 
@@ -163,7 +164,7 @@ static BOGONS: std::sync::LazyLock<Vec<&'static Bogon>> = std::sync::LazyLock::n
 
 pub fn is_bogon(address: &IpAddr) -> Option<&'static str> {
     for bogon in BOGONS.iter() {
-        if bogon.range.contains(address) {
+        if bogon.ranges.iter().any(|net| net.contains(address)) {
             return Some(bogon.description);
         }
     }