Skip to content

ipaddress considers some not globally reachable addresses global and vice versa #113171

Closed
Closed
ipaddress considers some not globally reachable addresses global and vice versa#113171
Assignees
encukou
Labels
type-bugAn unexpected behavior, bug, or errortype-securityA security issue

Description

@jstasiak
jstasiak
opened on Dec 15, 2023

Bug report

Bug description:

Judging by what the is_private and is_global implementations in the ipaddress module do[1], everything that IANA special-purpose address registries[2][3] considers globally reachable should result in is_global == True, the rest should be is_global = True.

is_private is almost always the opposite of is_global (100.64.0.0/10 is special).

The problem is the ranges present in the code (in the _private_networks variables) are not quite right:

  • There are some ranges missing (so we incorrectly treat them as globally reachable)
  • Some of the ranges fail to account for more specific allocations defined as globally reachable (so we incorrectly treat them as not globally reachable)

This is what I have right now and I'll submit that as a PR:

diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
index 5b5520b92bde..3ee565bcd30b 100644
--- a/Lib/ipaddress.py
+++ b/Lib/ipaddress.py
@@ -1558,13 +1558,18 @@ class _IPv4Constants:
 
     _public_network = IPv4Network('100.64.0.0/10')
 
+    # Not globally reachable address blocks listed on
+    # https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
     _private_networks = [
         IPv4Network('0.0.0.0/8'),
         IPv4Network('10.0.0.0/8'),
+        # 100.64.0.0/10 missing
         IPv4Network('127.0.0.0/8'),
         IPv4Network('169.254.0.0/16'),
         IPv4Network('172.16.0.0/12'),
+        # Incomplete. Should be 192.0.0.0/24 - (192.0.0.9/32 + 192.0.0.10/32)
         IPv4Network('192.0.0.0/29'),
+        # 192.0.0.8/32 missing
         IPv4Network('192.0.0.170/31'),
         IPv4Network('192.0.2.0/24'),
         IPv4Network('192.168.0.0/16'),
@@ -2306,15 +2311,31 @@ class _IPv6Constants:
 
     _multicast_network = IPv6Network('ff00::/8')
 
+    # Not globally reachable address blocks listed on
+    # https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml
     _private_networks = [
         IPv6Network('::1/128'),
         IPv6Network('::/128'),
         IPv6Network('::ffff:0:0/96'),
+        # 64:ff9b:1::/48 missing
         IPv6Network('100::/64'),
+        # Not quite right as there are multiple more specific allocations that are globally
+        # reachable. Should be:
+        # 2001::/23 - (
+        #     2001:1::1/128
+        #     + 2001:1::2/128
+        #     + 2001:3::/32
+        #     + 2001:4:112::/48
+        #     + 2001:20::/28
+        #     + 2001:30::/28
+        # )
         IPv6Network('2001::/23'),
+        # Unnecessary, covered by 2001::/23
         IPv6Network('2001:2::/48'),
         IPv6Network('2001:db8::/32'),
+        # Unnecessary, covered by 2001::/23
         IPv6Network('2001:10::/28'),
+        # Potentially 2002::/16 missing? IANA says N/A, there is no true/false value
         IPv6Network('fc00::/7'),
         IPv6Network('fe80::/10'),
         ]

[1] And which should really be documented per #65056 – a separate issue though
[2] https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml
[3] https://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

Activity

  1. jstasiak
    added
    type-bugAn unexpected behavior, bug, or error
    on Dec 15, 2023
  2. jstasiak
    added 2 commits that reference this issue on Dec 15, 2023

    pythonGH-113171: Fix "private" (really non-global) IP address ranges

    9bfb09f

    pythonGH-113171: Fix "private" (really non-global) IP address ranges

    b83b987

  3. jstasiak commented on Dec 15, 2023

    @jstasiak
    jstasiak
    on Dec 15, 2023
    ContributorAuthor

    #61602 (e5019d5) made 100.64.0.0/10 special and I'm not sure what to do about it.

  4. encukou
    added a commit that references this issue on Mar 22, 2024

    GH-113171: Fix "private" (non-global) IP address ranges (GH-113179)

    40d75c2

  5. encukou commented on Mar 22, 2024

    @encukou
    encukou
    on Mar 22, 2024
    Member

    Thank you for the PR!
    That leaves the 100.64.0.0/10 range.

  6. adorilson
    added a commit that references this issue on Mar 25, 2024

    pythonGH-113171: Fix "private" (non-global) IP address ranges (python…

    364f3b0
  7. NGRsoftlab
    added 2 commits that reference this issue on Apr 2, 2024

    Squashed commit of the following:

    1b5fe4c

    Squashed commit of the following:

    a016a54
  8. diegorusso
    added a commit that references this issue on Apr 17, 2024

    pythonGH-113171: Fix "private" (non-global) IP address ranges (python…

    c08ada7
  9. gpshead
    assigned
    encukou
    on Apr 22, 2024
  10. gpshead
    added
    type-securityA security issue
    on Apr 22, 2024

  11. gpshead commented on Apr 22, 2024

    @gpshead
    gpshead
    on Apr 22, 2024
    Member

    Per a PSRT discussion, lets backport this as a security fix @encukou. (@sethmlarson & @ambv who were in that conversation FYI)

  12. encukou
    added a commit that references this issue on Apr 23, 2024

    [3.12] pythonGH-113171: Fix "private" (non-global) IP address ranges (p…

    a74a45b

  13. encukou commented on Apr 23, 2024

    @encukou
    encukou
    on Apr 23, 2024
    Member

    OK.
    I assume docs fixes from GH-113186 should be backported as well.

  14. 17 remaining items

  15. smoser
    added a commit that references this issue on Jun 27, 2024

    python-3.10 - address CVE-2024-4032

    3f8caf6
  16. frenzymadness
    added 2 commits that reference this issue on Jul 2, 2024

    00431: CVE-2024-4032

    27b5160

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    b137e12
  17. rickprice
    added 2 commits that reference this issue on Jul 3, 2024

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    677b465

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    6e7c097
  18. frenzymadness
    added a commit that references this issue on Jul 4, 2024

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    a03f753
  19. rickprice
    added 2 commits that reference this issue on Jul 8, 2024

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    89f48de

    CVE-2024-4032 Fix "private" (non-global) IP address ranges (pythonGH-…

    0a34c66
  20. frenzymadness
    added 2 commits that reference this issue on Aug 13, 2024

    00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…

    7ef313f

    00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…

    71337f4
  21. stratakis
    added a commit that references this issue on Aug 15, 2024

    00431: pythongh-113171: pythongh-65056: Fix "private" (non-global) IP…

    234aea1
  22. hrnciar
    added a commit that references this issue on Apr 23, 2025

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    5e1f9b8
  23. hroncok
    added a commit that references this issue on Jul 4, 2025

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    9f46b5e
  24. frenzymadness
    added a commit that references this issue on Aug 12, 2025

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    0517d62
  25. hroncok
    added a commit that references this issue on Feb 3, 2026

    00431: CVE-2024-4032: incorrect IPv4 and IPv6 private ranges

    50e3128
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

type-bugAn unexpected behavior, bug, or errortype-securityA security issue

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions