From 88f9af2af6422c125b31591ba4066ec1b3a40023 Mon Sep 17 00:00:00 2001 From: imSp4rky Date: Tue, 27 Oct 2026 13:54:18 -0600 Subject: [PATCH] fix(tunnel): refuse 192.0.0.0/24 and 6to4 literals on python before 3.11.10 ipaddress.is_global reports these ranges as global before 3.11.10, so connect_public dialled them on the macOS and Windows CI runners. --- unshackle/core/tunnel.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/unshackle/core/tunnel.py b/unshackle/core/tunnel.py index 05b3a747..c8ddb3ce 100644 --- a/unshackle/core/tunnel.py +++ b/unshackle/core/tunnel.py @@ -54,6 +54,8 @@ LOCAL_NETWORKS = tuple( ) ) NAT64 = (ipaddress.ip_network("64:ff9b::/96"), ipaddress.ip_network("64:ff9b:1::/48")) +# is_global counts these as global before Python 3.11.10; drop once requires-python is >=3.11.10 +NOT_GLOBAL = (ipaddress.ip_network("192.0.0.0/24"), ipaddress.ip_network("2002::/16")) MAX_TUNNELS = 4 MAX_STREAMS = 256 CHUNK = 65536 @@ -326,7 +328,8 @@ def is_local_ip(address: str) -> bool: def is_public_ip(address: str) -> bool: - return (ip := parse_ip(address)) is not None and ip.is_global and not is_local_ip(address) + ip = parse_ip(address) + return ip is not None and ip.is_global and not any(ip in n for n in NOT_GLOBAL) and not is_local_ip(address) def is_ip_literal(host: str) -> bool: