ipaddress "is_private" and "is_global" are insufficiently documented and is_global probably has a bug #65056

bitdancer · 2014-03-06T16:20:36Z

BPO	20857
Nosy	@loewis, @ncoghlan, @bitdancer

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2014-03-06.16:20:35.832>
labels = ['type-bug']
title = 'ipaddress "is_private" and "is_global" are insufficiently documented and is_global probably has a bug'
updated_at = <Date 2014-03-06.21:50:40.486>
user = 'https://github.com/bitdancer'

bugs.python.org fields:

activity = <Date 2014-03-06.21:50:40.486>
actor = 'loewis'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = []
creation = <Date 2014-03-06.16:20:35.832>
creator = 'r.david.murray'
dependencies = []
files = []
hgrepos = []
issue_num = 20857
keywords = []
message_count = 3.0
messages = ['212812', '212813', '212843']
nosy_count = 4.0
nosy_names = ['loewis', 'ncoghlan', 'pmoody', 'r.david.murray']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue20857'
versions = ['Python 3.4', 'Python 3.5']

Linked PRs

GH-65056: Improve the IP address' is_global/is_private documentation #113186

bitdancer · 2014-03-06T16:20:35Z

The 'is_private' and 'is_global' properties refer to the iana registries, but the terms 'private network' and 'public network' do no appear in the registry documentation. There is no way to know what these methods are going to return other than examining the source code.

In particular, without looking at the source code a best-guess interpretation of the documentation would lead one to expect that is_private would return true only for RFC1918 addresses, since that is the one place the term 'private' appears. Similarly, the naive interpretation of is_global would be that it would return False for all addresses listed in the ipv4 registry *except* 192.88.99.0/24, which is the only one whose global routing flag is True in the table.

I would submit that the fact that the latter is not true is a bug.

It is really not at all clear what 'is_private' means (see also bpo-17400, which introduced is_global), so I am completely unclear how to rewrite the documentation to fully specify it, other than to list out the address ranges that it considers private.

bitdancer · 2014-03-06T16:25:38Z

Oh, and just to make things more complicated, there are footnotes that some protocols allow global routing for protocol-allocated addresses that are otherwise not globally routable. It would be reasonable to for is_global to ignore this, but it should be documented that it does so.

loewis · 2014-03-06T21:50:40Z

I'm always in favour of using official terminology (and adjust if that changes over time). So in this case, I agree with David's analysis, and suggest the following specification:

is_global returns False for all addresses where "Global" is "False" in the IPv4 or IPv6 Special-Purpose Address Registry
a new method is_private_use is introduced, giving True only for the RFC1918 addresses
a new method is_unique_local is introduced, giving True only for the RFC 4193 addresses.
is_private is deprecated. Alternatively, it could be preserved and documented to being the union of is_privte_use and is_unique_local.

I don't think it it necessary to discuss footnote 1 in the IPv6 registry ("not global unless a specific allocations says otherwise"). The specific allocations that might override this come right below, so if we implement the table, we would cover all those more specific case.

I'm puzzled why Teredo is listed as "not global"; my understanding is that the Teredo prefixes even get announced in BGP, and are fully global.

jstasiak · 2023-12-15T12:13:32Z

I second @loewis' conclusions, the current semantics is pretty confusing. In the meantime we can document it better, I'll take a stab at it.

…ation It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). I opted to fully replace the docstrings with the content from the documentation to save myself some work.

jstasiak · 2023-12-15T17:41:07Z

See the attached PR. The documentation preview: https://cpython-previews--113186.org.readthedocs.build/en/113186/library/ipaddress.html#ipaddress.IPv4Address.is_private

…H-113186) * GH-65056: Improve the IP address' is_global/is_private documentation It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). Co-authored-by: Petr Viktorin <[email protected]>

encukou · 2024-03-18T13:04:06Z

Docs are now updated; thank you!
The bug is tracked in #113171.

…ation (pythonGH-113186) * pythonGH-65056: Improve the IP address' is_global/is_private documentation It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). Co-authored-by: Petr Viktorin <[email protected]>

…ges (GH-113179) (GH-113186) (GH-118177) * GH-113171: Fix "private" (non-global) IP address ranges (GH-113179) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] #61602 * GH-65056: Improve the IP address' is_global/is_private documentation (GH-113186) It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). (cherry picked from commit 2a4cbf1) (cherry picked from commit 40d75c2) --------- Co-authored-by: Jakub Stasiak <[email protected]>

…s ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) * pythonGH-113171: Fix "private" (non-global) IP address ranges (pythonGH-113179) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] python#61602 * pythonGH-65056: Improve the IP address' is_global/is_private documentation (pythonGH-113186) It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). (cherry picked from commit 2a4cbf1) (cherry picked from commit 40d75c2) --------- (cherry picked from commit f86b17a) Co-authored-by: Jakub Stasiak <[email protected]>

…ges (GH-113179) (GH-113186) (GH-118177) (#118227)

…s ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) * pythonGH-113171: Fix "private" (non-global) IP address ranges (pythonGH-113179) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] python#61602 * pythonGH-65056: Improve the IP address' is_global/is_private documentation (pythonGH-113186) It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). (cherry picked from commit 2a4cbf1) (cherry picked from commit 40d75c2) --------- (cherry picked from commit f86b17a) Co-authored-by: Jakub Stasiak <[email protected]>

…ges (GH-113179) (GH-113186) (GH-118177) (GH-118229) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] #61602 In 3.10 and below, is_private checks whether the network and broadcast address are both private. In later versions (where the test wss backported from), it checks whether they both are in the same private network. For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private, but one is in 0.0.0.0/8 ("This network") and the other in 255.255.255.255/32 ("Limited broadcast"). --------- Co-authored-by: Jakub Stasiak <[email protected]>

…es (GH-113179) (GH-113186) (GH-118177) (GH-118472) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] #61602 In 3.10 and below, is_private checks whether the network and broadcast address are both private. In later versions (where the test wss backported from), it checks whether they both are in the same private network. For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private, but one is in 0.0.0.0/8 ("This network") and the other in 255.255.255.255/32 ("Limited broadcast"). --------- Co-authored-by: Jakub Stasiak <[email protected]>

…es (GH-113179) (GH-113186) (GH-118177) (GH-118479) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] #61602 In 3.10 and below, is_private checks whether the network and broadcast address are both private. In later versions (where the test wss backported from), it checks whether they both are in the same private network. For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private, but one is in 0.0.0.0/8 ("This network") and the other in 255.255.255.255/32 ("Limited broadcast"). --------- Co-authored-by: Jakub Stasiak <[email protected]>

…113179) (pythonGH-113186) (pythonGH-118177) (cherry picked from commit f86b17a) Co-authored-by: Jakub Stasiak <[email protected]> (cherry picked from commit 05a1467) pythongh-113171: pythongh-65056: Fix "private" (non-global) IP address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) * pythonGH-113171: Fix "private" (non-global) IP address ranges (pythonGH-113179) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] python#61602 * pythonGH-65056: Improve the IP address' is_global/is_private documentation (pythonGH-113186) It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). (cherry picked from commit 2a4cbf1) (cherry picked from commit 40d75c2) --------- (cherry picked from commit f86b17a) Co-authored-by: Jakub Stasiak <[email protected]> (cherry picked from commit 05a1467) Add IPv6 addresses to suspignore.csv That's a lot of semicolons! (cherry picked from commit e366724) Add notable changes

…113179) (pythonGH-113186) (pythonGH-118177) * Fix "private" (non-global) IP address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) (cherry picked from commit f86b17a) Co-authored-by: Jakub Stasiak <[email protected]> (cherry picked from commit 05a1467) pythongh-113171: pythongh-65056: Fix "private" (non-global) IP address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) * pythonGH-113171: Fix "private" (non-global) IP address ranges (pythonGH-113179) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] python#61602 * pythonGH-65056: Improve the IP address' is_global/is_private documentation (pythonGH-113186) It wasn't clear what the semantics of is_global/is_private are and, when one gets to the bottom of it, it's not quite so simple (hence the exceptions listed). (cherry picked from commit 2a4cbf1) (cherry picked from commit 40d75c2) --------- (cherry picked from commit f86b17a) Co-authored-by: Jakub Stasiak <[email protected]> (cherry picked from commit 05a1467) Add IPv6 addresses to suspignore.csv That's a lot of semicolons! (cherry picked from commit e366724)

… address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) (pythonGH-118472) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] python#61602 In 3.10 and below, is_private checks whether the network and broadcast address are both private. In later versions (where the test wss backported from), it checks whether they both are in the same private network. For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private, but one is in 0.0.0.0/8 ("This network") and the other in 255.255.255.255/32 ("Limited broadcast"). --------- Co-authored-by: Jakub Stasiak <[email protected]>

… address ranges (pythonGH-113179) (pythonGH-113186) (pythonGH-118177) (pythonGH-118472) The _private_networks variables, used by various is_private implementations, were missing some ranges and at the same time had overly strict ranges (where there are more specific ranges considered globally reachable by the IANA registries). This patch updates the ranges with what was missing or otherwise incorrect. 100.64.0.0/10 is left alone, for now, as it's been made special in [1]. The _address_exclude_many() call returns 8 networks for IPv4, 121 networks for IPv6. [1] python#61602 In 3.10 and below, is_private checks whether the network and broadcast address are both private. In later versions (where the test wss backported from), it checks whether they both are in the same private network. For 0.0.0.0/0, both 0.0.0.0 and 255.225.255.255 are private, but one is in 0.0.0.0/8 ("This network") and the other in 255.255.255.255/32 ("Limited broadcast").

bitdancer added the type-bug An unexpected behavior, bug, or error label Mar 6, 2014

ezio-melotti transferred this issue from another repository Apr 10, 2022

iritkatriel added the stdlib Python modules in the Lib dir label Nov 28, 2023

jstasiak mentioned this issue Dec 15, 2023

192.0.0.8 (IPv4 dummy address) considered globally reachable #87103

Open

jstasiak mentioned this issue Dec 15, 2023

ipaddress considers some not globally reachable addresses global and vice versa #113171

Closed

bedevere-app bot mentioned this issue Dec 15, 2023

GH-65056: Improve the IP address' is_global/is_private documentation #113186

Merged

encukou closed this as completed Mar 18, 2024

encukou mentioned this issue Apr 24, 2024

[3.11] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118227

Merged

encukou mentioned this issue Apr 24, 2024

[3.10] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118229

Merged

pablogsal pushed a commit that referenced this issue Apr 25, 2024

[3.11] gh-113171: gh-65056: Fix "private" (non-global) IP address ran…

ba43157

…ges (GH-113179) (GH-113186) (GH-118177) (#118227)

encukou mentioned this issue May 1, 2024

[3.9] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118472

Merged

encukou mentioned this issue May 1, 2024

[3.8] gh-113171: gh-65056: Fix "private" (non-global) IP address ranges (GH-113179) (GH-113186) (GH-118177) #118479

Merged

jstasiak mentioned this issue May 30, 2024

ipaddress: Shared Address Space (100.64.0.0/10) is neither private nor global #119812

Open

rickprice mentioned this issue Jul 3, 2024

CVE-2024-4032 Fix "private" (non-global) IP address ranges (GH-113179… ActiveState/cpython#57

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ipaddress "is_private" and "is_global" are insufficiently documented and is_global probably has a bug #65056

ipaddress "is_private" and "is_global" are insufficiently documented and is_global probably has a bug #65056

bitdancer commented Mar 6, 2014 •

edited by bedevere-app bot

Loading

bitdancer commented Mar 6, 2014

bitdancer commented Mar 6, 2014

loewis mannequin commented Mar 6, 2014

jstasiak commented Dec 15, 2023

jstasiak commented Dec 15, 2023

encukou commented Mar 18, 2024

ipaddress "is_private" and "is_global" are insufficiently documented and is_global probably has a bug #65056

ipaddress "is_private" and "is_global" are insufficiently documented and is_global probably has a bug #65056

Comments

bitdancer commented Mar 6, 2014 • edited by bedevere-app bot Loading

Linked PRs

bitdancer commented Mar 6, 2014

bitdancer commented Mar 6, 2014

loewis mannequin commented Mar 6, 2014

jstasiak commented Dec 15, 2023

jstasiak commented Dec 15, 2023

encukou commented Mar 18, 2024

bitdancer commented Mar 6, 2014 •

edited by bedevere-app bot

Loading