Overlapping IPRanges are accepted if prefix lengths are different #10180

New Issue

adam · 2025-12-29T21:27:52+01:00

adam commented

2025-12-29 21:27:52 +01:00

Originally created by @candlerb on GitHub (Sep 4, 2024).

Originally assigned to: @bctiemann on GitHub.

Deployment Type

Self-hosted

NetBox Version

v4.0.11

Python Version

3.12

Steps to Reproduce

Create an IPRange with start 1.2.3.100/24 and end 1.2.3.200/24
Create an IPRange with start 1.2.3.123/26 and end 1.2.3.124/26

Expected Behavior

The second IPRange should be rejected, as it overlaps with the first. (There is code in IPRange.clean() which is clearly intended to do this)

Observed Behavior

The overlapping range is accepted.

The problem occurs because the Django ORM lte/gte filter for overlapping ranges only works if the prefix lengths match:

>>> ip = "1.2.3.101/24"
>>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None)
<RestrictedQuerySet [<IPRange: 1.2.3.100-200/24>]>
>>> ip = "1.2.3.101/26"
>>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None)
<RestrictedQuerySet []>

I cannot see an obvious solution here, apart from brute force iterating over all possible prefix lengths:

>>> [IPRange.objects.filter(start_address__lte=f"1.2.3.101/{pl}", end_address__gte=f"1.2.3.101/{pl}", vrf=None).count() for pl in range(33)]
[0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0]

Alternatively, changing the data model so that a range uses IPAddress instead of IPNetwork for the start/end addresses would eliminate this problem.

Originally created by @candlerb on GitHub (Sep 4, 2024). Originally assigned to: @bctiemann on GitHub. ### Deployment Type Self-hosted ### NetBox Version v4.0.11 ### Python Version 3.12 ### Steps to Reproduce 1. Create an IPRange with start 1.2.3.100/24 and end 1.2.3.200/24 2. Create an IPRange with start 1.2.3.123/26 and end 1.2.3.124/26 ### Expected Behavior The second IPRange should be rejected, as it overlaps with the first. (There is code in `IPRange.clean()` which is clearly intended to do this) ### Observed Behavior The overlapping range is accepted. The problem occurs because the Django ORM lte/gte filter for overlapping ranges only works if the prefix lengths match: ``` >>> ip = "1.2.3.101/24" >>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None) <RestrictedQuerySet [<IPRange: 1.2.3.100-200/24>]> >>> ip = "1.2.3.101/26" >>> IPRange.objects.filter(start_address__lte=ip, end_address__gte=ip, vrf=None) <RestrictedQuerySet []> ``` I cannot see an obvious solution here, apart from brute force iterating over all possible prefix lengths: ``` >>> [IPRange.objects.filter(start_address__lte=f"1.2.3.101/{pl}", end_address__gte=f"1.2.3.101/{pl}", vrf=None).count() for pl in range(33)] [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0] ``` Alternatively, changing the data model so that a range uses IPAddress instead of IPNetwork for the start/end addresses would eliminate this problem.

adam added the type: bug status: accepted netbox severity: low labels 2025-12-29 21:27:52 +01:00

adam closed this issue

2025-12-29 21:27:53 +01:00

adam referenced this issue

2025-12-29 23:19:38 +01:00

[PR #10180] [MERGED] Update filtersets.md #13572

Sign in to join this conversation.

Branches Tags

main

update-changelog-comments-docs

feature-removal-issue-type

20911-dropdown

20239-plugin-menu-classes-mutable-state

21097-graphql-id-lookups

feature

fix_module_substitution

20923-dcim-templates

20044-elevation-stuck-lightmode

feature-ip-prefix-link

v4.5-beta1-release

20068-import-moduletype-attrs

20766-fix-german-translation-code-literals

20378-del-script

7604-filter-modifiers-v3

circuit-swap

12318-case-insensitive-uniqueness

20637-improve-device-q-filter

20660-script-load

19724-graphql

20614-update-ruff

14884-script

02496-max-page

19720-macaddress-interface-generic-relation

19408-circuit-terminations-export-templates

20203-openapi-check

fix-19669-api-image-download

7604-filter-modifiers

19275-fixes-interface-bulk-edit

fix-17794-get_field_value_return_list

11507-show-aggregate-and-rir-on-api

9583-add_column_specific_search_field_to_tables

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/netbox#10180