Skip to content

gh-151749: Add 5f00::/16 (RFC 9602) and 100:0:0:1::/64 (RFC 9780) to ipaddress IPv6 private networks#151764

Open
tonghuaroot wants to merge 2 commits into
python:mainfrom
tonghuaroot:fix-ipaddress-5f00-100-private
Open

gh-151749: Add 5f00::/16 (RFC 9602) and 100:0:0:1::/64 (RFC 9780) to ipaddress IPv6 private networks#151764
tonghuaroot wants to merge 2 commits into
python:mainfrom
tonghuaroot:fix-ipaddress-5f00-100-private

Conversation

@tonghuaroot

@tonghuaroot tonghuaroot commented Jun 20, 2026

Copy link
Copy Markdown
Contributor

Add the 5f00::/16 (RFC 9602) and 100:0:0:1::/64 (RFC 9780) special-purpose IPv6 ranges to ipaddress's _private_networks so is_global/is_private match the IANA registry.

Fixes #151749

Problem

Both ranges are listed in the IANA IPv6 Special-Purpose Address Registry with Globally Reachable = False, but ipaddress currently reports them as globally reachable:

  • 5f00::/16 — SRv6 SIDs, defined in RFC 9602 (Globally Reachable: False).
  • 100:0:0:1::/64 — Dummy IPv6 Prefix, defined in RFC 9780 (Globally Reachable: False). Note this block is disjoint from the already-listed 100::/64 (RFC 6666 Discard-Only), so it is not currently covered.

Before this change IPv6Address.is_global returns True (and is_private returns False) for addresses in both blocks, which is incorrect.

Fix

Adds the two networks to _IPv6Constants._private_networks, alongside the existing not-globally-reachable IPv6 entries. This follows the precedent set by CVE-2024-4032 / gh-113171 and gh-124217 (3fff::/20, RFC 9637), which added sibling ranges to these same tables.

Scope: This PR is intentionally limited to _private_networks. It does not touch _private_networks_exceptions; the related 2001:1::3/128 (RFC 9665) exception is handled separately in #151050 and is deliberately left unchanged here.

Behaviour (stock vs. patched)

Address stock is_global patched is_global patched is_private
5f00:: True False True
5f00::1 True False True
5f00:ffff:ffff:ffff:ffff:ffff:ffff:ffff True False True
100:0:0:1:: True False True
100:0:0:1:ffff:ffff:ffff:ffff True False True
5eff:ffff:ffff:ffff:ffff:ffff:ffff:ffff (adjacent below) True True False
5f01:: (adjacent above) True True False
100:0:0:2:: (adjacent) True True False

Addresses immediately adjacent to each new block are unchanged. A regression test covering both the changed and adjacent addresses is added to testReservedIpv6, and a Misc/NEWS.d entry is included.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ipaddress: Two more IPv6 ranges (RFC 9602, 9780) missing from _private_networks

2 participants