GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — ipaddress considers some not globally reachable addresses global and vice versa · Issue #113171 · python/cpython

ipaddress considers some not globally reachable addresses global and vice versa #113171

New issue
Copy link
New issue
Copy link
Closed
Closed
ipaddress considers some not globally reachable addresses global and vice versa#113171
Copy link
Assignees
encukou
Labels
type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

Description

@jstasiak
jstasiak
opened on Dec 15, 2023
Issue body actions

Bug report

Bug description:

Judging by what the is_private and is_global implementations in the ipaddress module do[1], everything that IANA special-purpose address registries[2][3] considers globally reachable should result in is_global == True, the rest should be is_global = True.

is_private is almost always the opposite of is_global (100.64.0.0/10 is special).

The problem is the ranges present in the code (in the _private_networks variables) are not quite right:

  • There are some ranges missing (so we incorrectly treat them as globally reachable)
  • Some of the ranges fail to account for more specific allocations defined as globally reachable (so we incorrectly treat them as not globally reachable)

This is what I have right now and I'll submit that as a PR:

diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
index 5b5520b92bde..3ee565bcd30b 100644
--- a/Lib/ipaddress.py
+++ b/Lib/ipaddress.py
@@ -1558,13 +1558,18 @@ class _IPv4Constants:
 
     _public_network = IPv4Network('100.64.0.0/10')
 
+    # Not globally reachable address blocks listed on
+    # https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
     _private_networks = [
         IPv4Network('0.0.0.0/8'),
         IPv4Network('10.0.0.0/8'),
+        # 100.64.0.0/10 missing
         IPv4Network('127.0.0.0/8'),
         IPv4Network('169.254.0.0/16'),
         IPv4Network('172.16.0.0/12'),
+        # Incomplete. Should be 192.0.0.0/24 - (192.0.0.9/32 + 192.0.0.10/32)
         IPv4Network('192.0.0.0/29'),
+        # 192.0.0.8/32 missing
         IPv4Network('192.0.0.170/31'),
         IPv4Network('192.0.2.0/24'),
         IPv4Network('192.168.0.0/16'),
@@ -2306,15 +2311,31 @@ class _IPv6Constants:
 
     _multicast_network = IPv6Network('ff00::/8')
 
+    # Not globally reachable address blocks listed on
+    # https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
     _private_networks = [
         IPv6Network('::1/128'),
         IPv6Network('::/128'),
         IPv6Network('::ffff:0:0/96'),
+        # 64:ff9b:1::/48 missing
         IPv6Network('100::/64'),
+        # Not quite right as there are multiple more specific allocations that are globally
+        # reachable. Should be:
+        # 2001::/23 - (
+        #     2001:1::1/128
+        #     + 2001:1::2/128
+        #     + 2001:3::/32
+        #     + 2001:4:112::/48
+        #     + 2001:20::/28
+        #     + 2001:30::/28
+        # )
         IPv6Network('2001::/23'),
+        # Unnecessary, covered by 2001::/23
         IPv6Network('2001:2::/48'),
         IPv6Network('2001:db8::/32'),
+        # Unnecessary, covered by 2001::/23
         IPv6Network('2001:10::/28'),
+        # Potentially 2002::/16 missing? IANA says N/A, there is no true/false value
         IPv6Network('fc00::/7'),
         IPv6Network('fe80::/10'),
         ]

[1] And which should really be documented per #65056 – a separate issue though
[2] https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
[3] https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

  • GH-113171: Fix "private" (non-global) IP address ranges #113179
  • [3.12] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) #118177
  • [3.11] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118227
  • [3.10] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118229
  • [3.9] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118472
  • [3.8] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118479
Reacted by David Tolnay

Activity

Next
  1. jstasiak
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Dec 15, 2023
  2. jstasiak
    added 2 commits that reference this issue on Dec 15, 2023

    pythonGH-113171: Fix "private" (really non-global) IP address ranges

    9bfb09f

    pythonGH-113171: Fix "private" (really non-global) IP address ranges

    b83b987
  3. jstasiak commented on Dec 15, 2023

    @jstasiak
    jstasiak
    on Dec 15, 2023
    ContributorAuthor
    More actions

    #61602 (e5019d5) made 100.64.0.0/10 special and I'm not sure what to do about it.

  4. encukou
    added a commit that references this issue on Mar 22, 2024

    GH-113171: Fix "private" (non-global) IP address ranges (GH-113179)

    40d75c2
  5. encukou commented on Mar 22, 2024

    @encukou
    encukou
    on Mar 22, 2024
    Member
    More actions

    Thank you for the PR!
    That leaves the 100.64.0.0/10 range.

  6. adorilson
    added a commit that references this issue on Mar 25, 2024

    pythonGH-113171: Fix "private" (non-global) IP address ranges (python…

    364f3b0
  7. NGRsoftlab
    added 2 commits that reference this issue on Apr 2, 2024

    Squashed commit of the following:

    1b5fe4c

    Squashed commit of the following:

    a016a54
  8. diegorusso
    added a commit that references this issue on Apr 17, 2024

    pythonGH-113171: Fix "private" (non-global) IP address ranges (python…

    c08ada7
  9. gpshead
    assigned
    encukou
    on Apr 22, 2024
  10. gpshead
    added
    type-securityA security issueA security issue
    on Apr 22, 2024
  11. gpshead commented on Apr 22, 2024

    @gpshead
    gpshead
    on Apr 22, 2024
    Member
    More actions

    Per a PSRT discussion, lets backport this as a security fix @encukou. (@sethmlarson & @ambv who were in that conversation FYI)

    Reacted by Seth Larson and Petr Viktorin
  12. encukou
    added a commit that references this issue on Apr 23, 2024

    [3.12] pythonGH-113171: Fix "private" (non-global) IP address ranges (p…

    a74a45b
  13. encukou commented on Apr 23, 2024

    @encukou
    encukou
    on Apr 23, 2024
    Member
    More actions

    OK.
    I assume docs fixes from GH-113186 should be backported as well.

    Reacted by Gregory P. Smith
  14. 17 remaining items

  15. smoser
    added a commit that references this issue on Jun 27, 2024

    python-3.10 - address CVE-2024-4032

    3f8caf6
  16. frenzymadness
    added 2 commits that reference this issue on Jul 2, 2024

    00431: CVE-2024-4032

    27b5160

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    b137e12
  17. rickprice
    added 2 commits that reference this issue on Jul 3, 2024

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    677b465

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    6e7c097
  18. frenzymadness
    added a commit that references this issue on Jul 4, 2024

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    a03f753
  19. rickprice
    added 2 commits that reference this issue on Jul 8, 2024

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    89f48de

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    0a34c66
  20. frenzymadness
    added 2 commits that reference this issue on Aug 13, 2024

    00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…

    7ef313f

    00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…

    71337f4
  21. stratakis
    added a commit that references this issue on Aug 15, 2024

    00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…

    234aea1
  22. hrnciar
    added a commit that references this issue on Apr 23, 2025

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    5e1f9b8
  23. hroncok
    added a commit that references this issue on Jul 4, 2025

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    9f46b5e
  24. frenzymadness
    added a commit that references this issue on Aug 12, 2025

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    0517d62
  25. hroncok
    added a commit that references this issue on Feb 3, 2026

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    50e3128
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

  • @encukou
    encukou

Labels

type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or errortype-securityA security issueA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.