gh-134062: Fix hash collisions in IPv4Network and IPv6Network by mssalvatore · Pull Request #134063 · python/cpython · GitHub

Issue: Excessive hash collisions in IPv4Network and IPv6Network classes #134062

Ideally, a regression test would be good but hash() is an implementation detail, making it CPython-only (I don't know how PyPy and co implement it), and if we don't already have a test for the similar issue you found, there's no need for one.

Ideally, a regression test would be good but hash() is an implementation detail, making it CPython-only (I don't know how PyPy and co implement it), and if we don't already have a test for the similar issue you found, there's no need for one.

I can add a regression test.

I can add a regression test.

Let's add a test where we manually craft the values that are hashed. I'm however unsure whether hash((X, Y)) where X and Y are known to be ints is always stable. For strings and bytes, this is not the case due to security reasons, but for ints, I think it's stable but I cannot say for sure that it's the case.

If there wasn't a test introduced for the previous CVE, just don't bother with a test.

If there wasn't a test introduced for the previous CVE, just don't bother with a test.

These tests were introduced for the previous CVE:

cpython/Lib/test/test_ipaddress.py

Lines 2753 to 2763 in 62f66ca

    
           # issue41004 Hash collisions in IPv4Interface and IPv6Interface 
        
           def testV4HashIsNotConstant(self): 
        
               ipv4_address1 = ipaddress.IPv4Interface("1.2.3.4") 
        
               ipv4_address2 = ipaddress.IPv4Interface("2.3.4.5") 
        
               self.assertNotEqual(ipv4_address1.__hash__(), ipv4_address2.__hash__()) 
        
           # issue41004 Hash collisions in IPv4Interface and IPv6Interface 
        
           def testV6HashIsNotConstant(self): 
        
               ipv6_address1 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:1") 
        
               ipv6_address2 = ipaddress.IPv6Interface("2001:658:22a:cafe:200:0:0:2") 
        
               self.assertNotEqual(ipv6_address1.__hash__(), ipv6_address2.__hash__())

I added some tests in a separate commit. Feel free to drop it if you don't think the tests are valuable.

🤖 New build scheduled with the buildbot fleet by @gpshead for commit 492c579 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F134063%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

Thanks @mssalvatore for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.9, 3.10, 3.11, 3.12, 3.13, 3.14.
🐍🍒⛏🤖

…ythonGH-134063) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com> pythongh-134062: Fix hash collisions in IPv4Network and IPv6Network pythongh-134062: Add hash collision regression test

GH-134476 is a backport of this pull request to the 3.14 branch.

…ythonGH-134063) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com> pythongh-134062: Fix hash collisions in IPv4Network and IPv6Network pythongh-134062: Add hash collision regression test

GH-134477 is a backport of this pull request to the 3.13 branch.

…ythonGH-134063) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com> pythongh-134062: Fix hash collisions in IPv4Network and IPv6Network pythongh-134062: Add hash collision regression test

GH-134478 is a backport of this pull request to the 3.12 branch.

GH-134479 is a backport of this pull request to the 3.11 branch.

…ythonGH-134063) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com> pythongh-134062: Fix hash collisions in IPv4Network and IPv6Network pythongh-134062: Add hash collision regression test

GH-134480 is a backport of this pull request to the 3.10 branch.

GH-134481 is a backport of this pull request to the 3.9 branch.

…H-134063) (#134477) gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063) (cherry picked from commit f3fc0c1) gh-134062: Fix hash collisions in IPv4Network and IPv6Network gh-134062: Add hash collision regression test Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

…H-134063) (#134476) gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063) (cherry picked from commit f3fc0c1) gh-134062: Fix hash collisions in IPv4Network and IPv6Network gh-134062: Add hash collision regression test Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

…H-134063) (#134478) gh-134062: Fix hash collisions in IPv4Network and IPv6Network (GH-134063) (cherry picked from commit f3fc0c1) gh-134062: Fix hash collisions in IPv4Network and IPv6Network gh-134062: Add hash collision regression test Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

…ythonGH-134063) pythongh-134062: Fix hash collisions in IPv4Network and IPv6Network pythongh-134062: Add hash collision regression test

…H-134063) (GH-134479) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

…H-134063) (GH-134480) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

…H-134063) (GH-134481) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

…ythonGH-134063) pythongh-134062: Fix hash collisions in IPv4Network and IPv6Network pythongh-134062: Add hash collision regression test

bedevere-app Bot mentioned this pull request May 15, 2025

Excessive hash collisions in IPv4Network and IPv6Network classes #134062

Closed

mssalvatore marked this pull request as ready for review May 15, 2025 18:49

bedevere-app Bot added the awaiting review label May 15, 2025

picnixz reviewed May 15, 2025

View reviewed changes

Comment thread Misc/NEWS.d/next/Library/2025-05-15-14-27-01.gh-issue-134062.fRbJet.rst Outdated

picnixz reviewed May 15, 2025

View reviewed changes

picnixz added needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes labels May 15, 2025

mssalvatore force-pushed the fix-network-hash-collisions branch from eeabe2a to 264bf69 Compare May 16, 2025 14:08

mssalvatore added 2 commits May 16, 2025 10:11

pythongh-134062 : Fix hash collisions in IPv4Network and IPv6Network

bd15816

pythongh-134062 : Add hash collision regression test

492c579

mssalvatore force-pushed the fix-network-hash-collisions branch from 264bf69 to 492c579 Compare May 16, 2025 14:12

gpshead added the type-security A security issue label May 17, 2025

gpshead approved these changes May 17, 2025

View reviewed changes

bedevere-app Bot added awaiting merge and removed awaiting review labels May 17, 2025

gpshead added needs backport to 3.9 needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes 🔨 test-with-buildbots Test PR w/ buildbots; report in status section labels May 17, 2025

bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label May 17, 2025

gpshead self-assigned this May 17, 2025

gpshead merged commit f3fc0c1 into python:main May 22, 2025

bedevere-app Bot removed the awaiting merge label May 22, 2025

bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label May 22, 2025

bedevere-app Bot removed the needs backport to 3.13 only security fixes label May 22, 2025

bedevere-app Bot removed the needs backport to 3.12 only security fixes label May 22, 2025

bedevere-app Bot removed the needs backport to 3.11 only security fixes label May 22, 2025

bedevere-app Bot removed the needs backport to 3.10 label May 22, 2025

bedevere-app Bot removed the needs backport to 3.9 label May 22, 2025

ambv pushed a commit that referenced this pull request Jun 2, 2025

[3.11] gh-134062 : Fix hash collisions in IPv4Network and IPv6Network (G…

f8b4421

…H-134063) (GH-134479) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

ambv pushed a commit that referenced this pull request Jun 2, 2025

[3.10] gh-134062 : Fix hash collisions in IPv4Network and IPv6Network (G…

880adf6

…H-134063) (GH-134480) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

ambv pushed a commit that referenced this pull request Jun 2, 2025

[3.9] gh-134062 : Fix hash collisions in IPv4Network and IPv6Network (G…

03ac445

…H-134063) (GH-134481) (cherry picked from commit f3fc0c1) Co-authored-by: Mike Salvatore <mike.s.salvatore@gmail.com>

gh-134062: Fix hash collisions in IPv4Network and IPv6Network by mssalvatore · Pull Request #134063 · python/cpython · GitHub

Repository navigation

gh-134062: Fix hash collisions in IPv4Network and IPv6Network - #134063

gh-134062: Fix hash collisions in IPv4Network and IPv6Network#134063gpshead merged 2 commits intopython:mainpython/cpython:mainfrom mssalvatore:fix-network-hash-collisionsmssalvatore/cpython:fix-network-hash-collisionsCopy head branch name to clipboard

Conversation

mssalvatore commented May 15, 2025 • edited by bedevere-app Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

picnixz left a comment

Choose a reason for hiding this comment

Uh oh!

mssalvatore commented May 16, 2025

Uh oh!

picnixz commented May 16, 2025

Uh oh!

mssalvatore commented May 16, 2025

Uh oh!

bedevere-bot commented May 17, 2025

Uh oh!

miss-islington-app Bot commented May 22, 2025

Uh oh!

bedevere-app Bot commented May 22, 2025

Uh oh!

bedevere-app Bot commented May 22, 2025

Uh oh!

bedevere-app Bot commented May 22, 2025

Uh oh!

bedevere-app Bot commented May 22, 2025

Uh oh!

bedevere-app Bot commented May 22, 2025

Uh oh!

bedevere-app Bot commented May 22, 2025

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

gh-134062: Fix hash collisions in IPv4Network and IPv6Network#134063
gpshead merged 2 commits into
python:mainfrom
mssalvatore:fix-network-hash-collisions

mssalvatore commented May 15, 2025 •
edited by bedevere-app Bot
Loading