add more properties and start developing a CrowdSec integration

Author: Daniel-Nashed

.gitattributes

@@ -0,0 +1,24 @@
+# Normalize all text files to LF on commit
+* text=auto eol=lf
+
+# Explicitly mark common text types
+*.go    text eol=lf
+*.sh    text eol=lf
+*.md    text eol=lf
+*.json  text eol=lf
+*.yaml  text eol=lf
+*.yml   text eol=lf
+*.txt   text eol=lf
+*.mod   text eol=lf
+*.sum   text eol=lf
+*.toml  text eol=lf
+*.svg   text eol=lf
+*.xml   text eol=lf
+
+# Explicitly mark binary types (no line-ending conversion)
+*.png   binary
+*.jpg   binary
+*.jpeg  binary
+*.gif   binary
+*.ico   binary
+*.exe   binary

README.md

@@ -206,15 +206,44 @@ curl -X DELETE localhost:8090/block/1.2.3.4
 ```
 
 
+## Blocking a Network (CIDR)
+
+Add a network range to the blocklist:
+
+```bash
+curl -X PUT localhost:8090/block-network/192.168.1.0/24
+```
+
+Add with expiration and source:
+
+```bash
+curl -X PUT "localhost:8090/block-network/10.0.0.0/8?duration=24h&source=manual"
+```
+
+IPv6 networks are supported the same way:
+
+```bash
+curl -X PUT "localhost:8090/block-network/2001:db8::/32?duration=12h"
+```
+
+Remove a network block:
+
+```bash
+curl -X DELETE localhost:8090/block-network/192.168.1.0/24
+```
+
+The host bits of the supplied address are masked automatically, so `192.168.1.55/24` is stored as `192.168.1.0/24`.
+
+
 ## HTTP Lookup API
 
-Query the blocklist:
+Query the blocklist by IP address:
 
 ```bash
 curl localhost:8080/lookup/1.2.3.4
 ```
 
-Example response:
+Example response (exact IP match):
 
 ```json
 {
@@ -231,6 +260,19 @@ Example response:
 }
 ```
 
+If the IP is not individually blocked but falls within a blocked network range, the lookup still returns blocked and includes the matching CIDR:
+
+```json
+{
+  "blocked": true,
+  "ip": "192.168.1.55",
+  "matched_cidr": "192.168.1.0/24",
+  "source": "manual",
+  "remaining_duration": "23h59m12s",
+  ...
+}
+```
+
 
 ## HTTP Metadata Headers
 
@@ -251,6 +293,12 @@ X-Blocklist-Source: open-blocklist
 X-Blocklist-Remaining-Duration: permanent
 ```
 
+When the match is a CIDR network block, an additional header is returned:
+
+```
+X-Blocklist-Matched-CIDR: 192.168.1.0/24
+```
+
 
 ## Authorization Endpoint
 
@@ -366,4 +414,19 @@ docker exec open-blocklist-etcd \
 etcdctl watch /skydns/internal/open-blocklist --prefix
 ```
 
+Network (CIDR) blocks are stored under a separate prefix:
+
+```bash
+docker exec open-blocklist-etcd \
+etcdctl get /skydns/internal/open-blocklist-cidr --prefix
+```
+
+Example:
+
+```
+/skydns/internal/open-blocklist-cidr/192.168.1.0_24
+{"v":1,"host":"127.0.0.2","ttl":120,"source":"manual","first_seen":1773602647,"expiration":0}
+```
+```
+
 This streams updates whenever entries are created, modified, or deleted.

container/dockerfile_wolfi

@@ -3,7 +3,7 @@
 FROM cgr.dev/chainguard/go:latest AS builder
 ARG GIT_COMMIT
 ARG GO_BUILD_TAGS
-WORKDIR /srv
+WORKDIR /src
 COPY ./src .
 RUN CGO_ENABLED=0 go build -tags "${GO_BUILD_TAGS}" -trimpath -ldflags="-s -w -X main.gBuildPlatform=wolfi" -o /tmp/open-blocklist
 

src/cidr.go

@@ -0,0 +1,153 @@
+// open-blocklist - CIDR table
+// Copyright Nash!Com, Daniel Nashed 2026  - APACHE 2.0 see LICENSE
+
+package main
+
+import (
+    "fmt"
+    "net"
+    "sync"
+    "time"
+)
+
+// CIDREntry stores a blocked network range and its metadata.
+type CIDREntry struct {
+    CIDR       string     // canonical CIDR, e.g. "1.2.3.0/24"
+    Net        *net.IPNet // parsed network for Contains() matching
+    Source     string
+    Scenario   string
+    Action     string
+    ReturnCode uint32
+    FirstSeen  int64
+    LastSeen   int64
+    Expiration int64
+}
+
+type cidrTableStore struct {
+    sync.RWMutex
+    entries []*CIDREntry
+}
+
+var cidrTable cidrTableStore
+
+var (
+    cidrPrefix     = fmt.Sprintf("%s/internal/%s-cidr", SKY_DNS_PREFIX, RBL_ZONE)
+    cidrPrefixScan = cidrPrefix + "/"
+)
+
+// lookup returns the first CIDR entry that contains ip, or nil.
+// Sequential scan is fast enough for the expected scale (~2,000 entries).
+// Expired entries are skipped and queued for asynchronous deletion.
+func (t *cidrTableStore) lookup(ip net.IP) *CIDREntry {
+    t.RLock()
+    defer t.RUnlock()
+    now := time.Now().Unix()
+    for _, e := range t.entries {
+        if e.Net.Contains(ip) {
+            if e.Expiration > 0 && e.Expiration <= now {
+                go deleteExpiredCIDR(e.CIDR)
+                return nil
+            }
+            return e
+        }
+    }
+    return nil
+}
+
+func deleteExpiredCIDR(cidr string) {
+
+    etcdDeleteCIDR(cidr)
+
+    if !gMultiInstanceMode {
+        cidrTable.remove(cidr)
+    }
+
+    logMsg(LOG_INFO, "Lazy expiry: CIDR %s", cidr)
+}
+
+// findByCIDR returns the entry with the exact canonical CIDR string, or nil.
+func (t *cidrTableStore) findByCIDR(cidr string) *CIDREntry {
+    t.RLock()
+    defer t.RUnlock()
+    for _, e := range t.entries {
+        if e.CIDR == cidr {
+            return e
+        }
+    }
+    return nil
+}
+
+// upsert adds a new entry or replaces the existing one with the same CIDR.
+func (t *cidrTableStore) upsert(e *CIDREntry) {
+    t.Lock()
+    defer t.Unlock()
+    for i, existing := range t.entries {
+        if existing.CIDR == e.CIDR {
+            t.entries[i] = e
+            return
+        }
+    }
+    t.entries = append(t.entries, e)
+}
+
+// remove deletes the entry for the given CIDR using swap-with-last for O(1) removal.
+func (t *cidrTableStore) remove(cidr string) {
+    t.Lock()
+    defer t.Unlock()
+    for i, e := range t.entries {
+        if e.CIDR == cidr {
+            last := len(t.entries) - 1
+            t.entries[i] = t.entries[last]
+            t.entries[last] = nil
+            t.entries = t.entries[:last]
+            return
+        }
+    }
+}
+
+func (t *cidrTableStore) len() int {
+    t.RLock()
+    n := len(t.entries)
+    t.RUnlock()
+    return n
+}
+
+// cidrEntryToMap returns a plain map suitable for JSON encoding.
+// net.IPNet is not included — only the canonical CIDR string is used.
+func cidrEntryToMap(e *CIDREntry) map[string]interface{} {
+    return map[string]interface{}{
+        "cidr":     e.CIDR,
+        "source":   e.Source,
+        "scenario": e.Scenario,
+        "action":   e.Action,
+
+        "first_seen":     e.FirstSeen,
+        "first_seen_iso": epochToISO(e.FirstSeen),
+
+        "last_seen":     e.LastSeen,
+        "last_seen_iso": epochToISO(e.LastSeen),
+
+        "expiration":     e.Expiration,
+        "expiration_iso": epochToISO(e.Expiration),
+
+        "remaining_seconds":  remainingSeconds(e.Expiration),
+        "remaining_duration": remainingDuration(e.Expiration),
+
+        "return_code": Uint32ToIPv4Str(e.ReturnCode),
+    }
+}
+
+// cidrEntryToBlockEntry converts a CIDREntry for use in HTTP responses.
+// The caller is responsible for overriding IP with the queried IP address.
+func cidrEntryToBlockEntry(e *CIDREntry) *BlockEntry {
+    return &BlockEntry{
+        IP:         e.CIDR,
+        Source:     e.Source,
+        Scenario:   e.Scenario,
+        Action:     e.Action,
+        ReturnCode: e.ReturnCode,
+        FirstSeen:  e.FirstSeen,
+        LastSeen:   e.LastSeen,
+        Expiration: e.Expiration,
+    }
+}