6 releases

0.8.1 Nov 13, 2023
0.7.2 Aug 18, 2023
0.7.0 Jul 10, 2023

#829 in Network programming

Download history 1/week @ 2024-02-13 7/week @ 2024-02-20 3/week @ 2024-02-27 1/week @ 2024-03-12 13/week @ 2024-03-26 59/week @ 2024-04-02

72 downloads per month

MIT license

527 lines



Fragmented Classless Inter-Domain Routing (FCIDR)

A library exposing a data structure to represent a set of CIDR ranges as well as an interface to compute set operations over CIDRs.

This data structure can be applied, for example, in configuring firewalls that implicitly deny (AWS Security Groups) using a rule set that explicitly expresses rules for both allow and deny.

Note Currently, only IPv4 is supported. IPv6 support is tracked by #6.


This project also publishes a binary application for use on the command line to support composing chains of set operations on CIDRs by reading from standard input.


For now, crates.io is the only place this is being distributed.

cargo install fcidr


Fragmented Classless Inter-Domain Routing (FCIDR)

Usage: fcidr [CIDR] <COMMAND>

  complement  Compute the complement of the input CIDR(s) [aliases: !, not]
  difference  Compute the set difference between the input CIDR(s) and another CIDR [aliases: -, exclude, minus]
  superset    Exits successfully if the input CIDR(s) is a superset of another CIDR [aliases: >, contains]
  union       Compute the set union of the input CIDR(s) and another CIDR [aliases: +, include, plus]
  help        Print this message or the help of the given subcommand(s)

  [CIDR]  The input CIDR range and first operand to the computation. If omitted, input is taken from stdin. In this way, multiple computations can be chained together

  -h, --help     Print help
  -V, --version  Print version`


Computing a specific set of CIDRs within, excluding some subranges, and including a subrange of one that was excluded

fcidr difference | fcidr difference | fcidr union

Inverting the previous result

fcidr difference | fcidr difference | fcidr union | fcidr complement

Alternative concise syntax

Note these symbols may not play nice with your shell, so you can quote them if you want, for example fcidr "!").

fcidr + | fcidr - | fcidr !

Check if an IP is within a CIDR

fcidr contains "" && echo Woohoo!
echo | fcidr contains "" && echo Woohoo!
Error: "not a superset of"

Check if a CIDR is within any of a large set of CIDRs

Expanding upon the previous example, thanks to Amazon publishing a JSON formatted list of their public IP ranges, we can check if an IP or CIDR effectively is owned by Amazon. As long as we can get the list of ranges separated by new lines, piping that to fcidr makes the task trivial.

curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[].ip_prefix' | fcidr contains && echo "This CIDR is within an Amazon range."
This CIDR is within an Amazon range.
curl -s https://ip-ranges.amazonaws.com/ip-ranges.json | jq -r '.prefixes[].ip_prefix' | fcidr contains && echo "This CIDR is within an Amazon range."
Error: "not a superset of"




Create the development shell environment. Necessary to run all other commands.

nix develop

Build with cargo.

just build

Check the code with cargo's built-in fast static analysis.

just check

Remove build files.

just clean

Format the code.

just format

Check the code with clippy for better static analysis.

just lint

Run the application.

just run

Run tests with cargo's built-in test runner.

just test

Watch for code changes and rebuild.

just watch

All just commands can accept additional command line arguments after a --.

For example: run the application with a flag to report the version.

just run -- --version

Tips and Recommendations

Open IDE from Development Shell

To get linking to rust binaries in your IDE, you should open the development shell from your terminal and then open your IDE from that shell session. This will carry over the development shell's environment into your IDE.

For example if you work with VSCode.

cd path/to/this/project
nix develop
code .

By doing this, you can install the rust-analyzer VSCode extension and it will work properly since it will be able to point to the correct rust binaries and libraries. You will also have access in VSCode to any packages installed by the nix flake.


~36K SLoC