bpo-36845: validate integer network prefix when constructing IP networks (GH-13298)

(cherry picked from commit 5e48e3db6f5a937023e99d89cef8884d22bd8533)

Co-authored-by: Nicolai Moore <niconorsk@gmail.com>

diff --git a/Lib/ipaddress.py b/Lib/ipaddress.py
index cc9ae7118d67914d40153d434821aac0e9d19875..4eec1f337c13379050aefc107398439e76ef50f8 100644 (file)
--- a/Lib/ipaddress.py
+++ b/Lib/ipaddress.py
@@ -1101,6 +1101,8 @@ class _BaseV4:
         if arg not in cls._netmask_cache:
             if isinstance(arg, int):
                 prefixlen = arg
+                if not (0 <= prefixlen <= cls._max_prefixlen):
+                    cls._report_invalid_netmask(prefixlen)
             else:
                 try:
                     # Check for a netmask in prefix length form
@@ -1622,6 +1624,8 @@ class _BaseV6:
         if arg not in cls._netmask_cache:
             if isinstance(arg, int):
                 prefixlen = arg
+                if not (0 <= prefixlen <= cls._max_prefixlen):
+                    cls._report_invalid_netmask(prefixlen)
             else:
                 prefixlen = cls._prefix_from_prefix_string(arg)
             netmask = IPv6Address(cls._ip_int_from_prefix(prefixlen))

diff --git a/Lib/test/test_ipaddress.py b/Lib/test/test_ipaddress.py
index 0e0753f34c490543fe522fcce54dcd9b77bd23f6..3c50eec456ab2c9714b836a86a99f73a584c529c 100644 (file)
--- a/Lib/test/test_ipaddress.py
+++ b/Lib/test/test_ipaddress.py
@@ -466,6 +466,14 @@ class NetmaskTestMixin_v4(CommonTestMixin_v4):
         assertBadNetmask("1.1.1.1", "pudding")
         assertBadNetmask("1.1.1.1", "::")
 
+    def test_netmask_in_tuple_errors(self):
+        def assertBadNetmask(addr, netmask):
+            msg = "%r is not a valid netmask" % netmask
+            with self.assertNetmaskError(re.escape(msg)):
+                self.factory((addr, netmask))
+        assertBadNetmask("1.1.1.1", -1)
+        assertBadNetmask("1.1.1.1", 33)
+
     def test_pickle(self):
         self.pickle_test('192.0.2.0/27')
         self.pickle_test('192.0.2.0/31')  # IPV4LENGTH - 1
@@ -579,6 +587,14 @@ class NetmaskTestMixin_v6(CommonTestMixin_v6):
         assertBadNetmask("::1", "pudding")
         assertBadNetmask("::", "::")
 
+    def test_netmask_in_tuple_errors(self):
+        def assertBadNetmask(addr, netmask):
+            msg = "%r is not a valid netmask" % netmask
+            with self.assertNetmaskError(re.escape(msg)):
+                self.factory((addr, netmask))
+        assertBadNetmask("::1", -1)
+        assertBadNetmask("::1", 129)
+
     def test_pickle(self):
         self.pickle_test('2001:db8::1000/124')
         self.pickle_test('2001:db8::1000/127')  # IPV6LENGTH - 1

diff --git a/Misc/ACKS b/Misc/ACKS
index 8998c7bf6b61dfa88ab19c77703728b205c22470..025944f318f9e7646a61a1daf7a6e2ae37dfe1a7 100644 (file)
--- a/Misc/ACKS
+++ b/Misc/ACKS
@@ -1093,6 +1093,7 @@ Bastien Montagne
 Skip Montanaro
 Peter Moody
 Alan D. Moore
+Nicolai Moore
 Paul Moore
 Ross Moore
 Ben Morgan

diff --git a/Misc/NEWS.d/next/Library/2019-05-14-07-57-02.bpo-36845._GtFFf.rst b/Misc/NEWS.d/next/Library/2019-05-14-07-57-02.bpo-36845._GtFFf.rst
new file mode 100644 (file)
index 0000000..c819dce
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2019-05-14-07-57-02.bpo-36845._GtFFf.rst
@@ -0,0 +1,2 @@
+Added validation of integer prefixes to the construction of IP networks and
+interfaces in the ipaddress module.