I maintain netip, a Rust library for fast IPv4/IPv6 network operations with arbitrary masks.

For example, start with 10.*.0.*, represented by the mask 255.0.255.0, and exclude 10.0.0.0/9:

use netip::Ipv4Network; let network = Ipv4Network::parse("10.0.0.0/255.0.255.0").unwrap(); let excluded = Ipv4Network::parse("10.0.0.0/9").unwrap(); for remaining in network.difference(&excluded) { println!("{remaining}"); }

Output:

10.128.0.0/255.128.255.0

The result matches 10.{128..255}.0.*: the third octet stays fixed at zero, while the second ranges from 128 to 255. No individual addresses need to be enumerated. Intersection, containment and aggregation support arbitrary masks too.

The library includes fast parsers and allocation-free network operations. It uses only core, has zero dependencies, and forbids unsafe code. CIDR-only applications can use Contiguous<T> to enforce contiguous masks. The MSRV is Rust 1.88.

If you work on packet classifiers or network policy tools, I'd be interested in API feedback and examples of masks you need to handle.

Crate | API documentation

1 post - 1 participant

Read full topic