GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.9] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) by encukou · Pull Request #118472 · python/cpython

Conversation

@encukou

@encukou encukou commented May 1, 2024

Copy link
Copy Markdown
Member

Note that 3.10 & below has slightly different semantics of is_private on networks; see the second commit here.

GH-113171: Fix "private" (non-global) IP address ranges (GH-113179)

The _private_networks variables, used by various is_private implementations,
were missing some ranges and at the same time had overly strict ranges
(where there are more specific ranges considered globally reachable by
the IANA registries).

This patch updates the ranges with what was missing or otherwise incorrect.

100.64.0.0/10 is left alone, for now, as it's been made special in [1].

The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6.

[1] #61602

(cherry picked from commit 2a4cbf1)

GH-65056: Improve the IP address' is_global/is_private documentation (GH-113186)

It wasn't clear what the semantics of is_global/is_private are and,
when one gets to the bottom of it, it's not quite so simple (hence
the exceptions listed).

(cherry picked from commit 40d75c2)


(cherry picked from commit f86b17a)

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
encukou and others added 2 commits May 1, 2024 13:45
@encukou @jstasiak
pythongh-113171: pythongh-65056: Fix "private" (non-global) IP addres…
5e58376
…s ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177)

* pythonGH-113171: Fix "private" (non-global) IP address ranges (pythonGH-113179)

The _private_networks variables, used by various is_private
implementations, were missing some ranges and at the same time had
overly strict ranges (where there are more specific ranges considered
globally reachable by the IANA registries).

This patch updates the ranges with what was missing or otherwise
incorrect.

100.64.0.0/10 is left alone, for now, as it's been made special in [1].

The _address_exclude_many() call returns 8 networks for IPv4, 121
networks for IPv6.

[1] python#61602

* pythonGH-65056: Improve the IP address' is_global/is_private documentation (pythonGH-113186)

It wasn't clear what the semantics of is_global/is_private are and, when
one gets to the bottom of it, it's not quite so simple (hence the
exceptions listed).

(cherry picked from commit 2a4cbf1)
(cherry picked from commit 40d75c2)

---------

(cherry picked from commit f86b17a)

Co-authored-by: Jakub Stasiak <[email protected]>
@encukou
Adjust test for 3.9 semantics of is_private on networks
5ad4fcf
In 3.10 and below, is_private checks whether the network and broadcast
address are both private.
In later versions (where the test wss backported from), it checks
whether they both are in the same private network.

For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private,
but one is in 0.0.0.0/8 ("This network") and the other in
255.255.255.255/32 ("Limited broadcast").
@bedevere-app bedevere-app Bot mentioned this pull request May 1, 2024
ipaddress considers some not globally reachable addresses global and vice versa #113171
Closed
@bedevere-app bedevere-app Bot added the skip news label May 1, 2024
@bedevere-app bedevere-app Bot mentioned this pull request May 1, 2024
[3.12] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) #118177
Merged
@bedevere-app bedevere-app Bot added the awaiting core review label May 1, 2024
@encukou
Add IPv6 addresses to suspignore.csv
248e0f2
That's a lot of semicolons!
@encukou encukou added type-security A security issue release-blocker 3.9 (EOL) end of life labels May 2, 2024
@ambv
ambv merged commit 22adf29 into python:3.9 May 7, 2024
@bedevere-app bedevere-app Bot removed the awaiting core review label May 7, 2024
@misterdjules

misterdjules commented Jun 18, 2024

Copy link
Copy Markdown

Is there a way to track when this will make it into a 3.9.20 release? Thank you!

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@encukou
encukou deleted the backport-f86b17a-3.9 branch June 19, 2024 07:27
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull request Aug 13, 2024
@encukou @jstasiak @frenzymadness
00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…
7ef313f
… address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) (pythonGH-118472)

The _private_networks variables, used by various is_private
implementations, were missing some ranges and at the same time had
overly strict ranges (where there are more specific ranges considered
globally reachable by the IANA registries).

This patch updates the ranges with what was missing or otherwise
incorrect.

100.64.0.0/10 is left alone, for now, as it's been made special in [1].

The _address_exclude_many() call returns 8 networks for IPv4, 121
networks for IPv6.

[1] python#61602

In 3.10 and below, is_private checks whether the network and broadcast
address are both private.
In later versions (where the test wss backported from), it checks
whether they both are in the same private network.

For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private,
but one is in 0.0.0.0/8 ("This network") and the other in
255.255.255.255/32 ("Limited broadcast").

---------

Co-authored-by: Jakub Stasiak <[email protected]>
frenzymadness pushed a commit to fedora-python/cpython that referenced this pull request Aug 15, 2024
@encukou @jstasiak @frenzymadness
00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…
71337f4
… address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) (pythonGH-118472)

The _private_networks variables, used by various is_private
implementations, were missing some ranges and at the same time had
overly strict ranges (where there are more specific ranges considered
globally reachable by the IANA registries).

This patch updates the ranges with what was missing or otherwise
incorrect.

100.64.0.0/10 is left alone, for now, as it's been made special in [1].

The _address_exclude_many() call returns 8 networks for IPv4, 121
networks for IPv6.

[1] python#61602

In 3.10 and below, is_private checks whether the network and broadcast
address are both private.
In later versions (where the test wss backported from), it checks
whether they both are in the same private network.

For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private,
but one is in 0.0.0.0/8 ("This network") and the other in
255.255.255.255/32 ("Limited broadcast").

---------

Co-authored-by: Jakub Stasiak <[email protected]>
stratakis pushed a commit to stratakis/cpython that referenced this pull request Aug 15, 2024
@encukou @stratakis
00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…
234aea1
… address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) (pythonGH-118472)

The _private_networks variables, used by various is_private
implementations, were missing some ranges and at the same time had
overly strict ranges (where there are more specific ranges considered
globally reachable by the IANA registries).

This patch updates the ranges with what was missing or otherwise
incorrect.

100.64.0.0/10 is left alone, for now, as it's been made special in [1].

The _address_exclude_many() call returns 8 networks for IPv4, 121
networks for IPv6.

[1] python#61602

In 3.10 and below, is_private checks whether the network and broadcast
address are both private.
In later versions (where the test wss backported from), it checks
whether they both are in the same private network.

For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private,
but one is in 0.0.0.0/8 ("This network") and the other in
255.255.255.255/32 ("Limited broadcast").
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

3.9 (EOL) end of life release-blocker skip news type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@encukou @misterdjules @ambv
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.