Skip to content

http.server with HTTPS fails to bind IPv6 addresses #134168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
ggqlq opened this issue May 18, 2025 · 7 comments
Closed

http.server with HTTPS fails to bind IPv6 addresses #134168

ggqlq opened this issue May 18, 2025 · 7 comments
Labels
3.14 bugs and security fixes 3.15 new features, bugs and security fixes stdlib Python modules in the Lib dir type-bug An unexpected behavior, bug, or error

Comments

@ggqlq
Copy link
Contributor

ggqlq commented May 18, 2025 •
edited by bedevere-app bot
Loading

Bug report

Bug description:

When HTTPS is enabled, the command-line interface of http.server can't bind IPv6 addresses correctly and the --directory flag doesn't work.

bind IPv6

HTTPS server throw an exception when I was trying to bind a IPv6 address, but HTTP server can bind IPv6 address.

# HTTPS
$ ./python -m http.server --tls-cert ~/Projects/ssl/localhost.crt --tls-key ~/Projects/ssl/localhost.key -b ::1
# ...
TypeError: AF_INET address must be a pair (host, port)

# HTTP
$ ./python -m http.server -b ::1
Serving HTTP on ::1 port 8000 (http://[::1]:8000/) ...

--directory issue

The HTTPS server always uses the work path of current terminal as its root directory and ignores the --directory flag:

# HTTPS
$ ./python -m http.server --tls-cert ~/Projects/ssl/localhost.crt --tls-key ~/Projects/ssl/localhost.key -d ~/test
Serving HTTPS on 0.0.0.0 port 8000 (https://0.0.0.0:8000/) ...
127.0.0.1 - - [18/May/2025 13:28:16] "GET / HTTP/1.1" 200 -

$ curl -k https://0.0.0.0:8000/
<!DOCTYPE HTML>
<html lang="en">
<head>
# ...
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href=".azure-pipelines/">.azure-pipelines/</a></li>
<li><a href=".coveragerc">.coveragerc</a></li>
<li><a href=".devcontainer/">.devcontainer/</a></li>
<li><a href=".editorconfig">.editorconfig</a></li>
<li><a href=".git/">.git/</a></li>
<li><a href=".gitattributes">.gitattributes</a></li>
<li><a href=".github/">.github/</a></li>
# ...
# Files in my cpython repo's root path
</ul>
<hr>
</body>
</html>

# HTTP

$ ./python -m http.server -d ~/test
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
127.0.0.1 - - [18/May/2025 13:24:30] "GET / HTTP/1.1" 200 -

$ curl http://0.0.0.0:8000/
<!DOCTYPE HTML>
<html lang="en">
<head>
# ...
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href="1">1</a></li>
<li><a href="2">2</a></li>
<li><a href="3">3</a></li>
</ul>
<hr>
</body>
</html>

CPython versions tested on:

CPython main branch

Operating systems tested on:

Linux

Linked PRs
@ggqlq ggqlq added the type-bug An unexpected behavior, bug, or error label May 18, 2025
@bedevere-app bedevere-app bot mentioned this issue May 18, 2025
Merged
@picnixz picnixz added the stdlib Python modules in the Lib dir label May 18, 2025
@picnixz
Copy link
Member

picnixz commented May 18, 2025

cc @donBarbos

@picnixz

This comment has been minimized.

Sign in to view
@picnixz picnixz added the 3.14 bugs and security fixes label May 18, 2025
@donBarbos
Copy link
Contributor

thank you very much, my bad. really one of the problems is that we use DualStackServer(ThreadingHTTPServer) with address_family field as ServerClass in the test function to run http.server cli but we don't have same patch for HTTPS server

@picnixz picnixz changed the title http.server with HTTPS fails to bind IPv6 addresses and ignores --directory flag http.server with HTTPS fails to bind IPv6 addresses May 18, 2025
@picnixz picnixz mentioned this issue May 18, 2025
Closed
@picnixz
Copy link
Member

picnixz commented May 18, 2025

I've opened #134176 for the --directory issue.

@ggqlq
Copy link
Contributor Author

ggqlq commented May 18, 2025

I think both of these two bugs are related to the DualStackServer class, which override the finish_request function to pass the directory and the server_bind function to bind IPv6 addresses. The original HTTPS implementation directly uses ThreadingHTTPSServer, which lacks the dual-stack support and directory handling from DualStackServer. We can solve them all once by adding the HTTPSDualStackServer.

    class HTTPSDualStackServer(ThreadingHTTPSServer):
        def server_bind(self):
            with contextlib.suppress(Exception):
                self.socket.setsockopt(
                    socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0) # bind IPv6 addresses
            return super().server_bind()

        def finish_request(self, request, client_address):
            self.RequestHandlerClass(request, client_address, self,
                                     directory=args.directory) # handle --directory flag

Would it be acceptable to address both issues in a single PR? They share the same root cause, and separating the fixes would introduce unnecessary code duplication.

@picnixz
Copy link
Member

picnixz commented May 18, 2025

Oh so if the root issue is the same, yes a single PR is better.

@picnixz picnixz marked this as a duplicate of #134176 May 18, 2025
@picnixz picnixz added the 3.15 new features, bugs and security fixes label May 24, 2025
picnixz pushed a commit that referenced this issue May 24, 2025
@ggqlq
gh-134168: fix http.server CLI support for IPv6 and --directory w…
2fd09b0 
…hen serving over HTTPS (#134169)
picnixz pushed a commit to picnixz/cpython that referenced this issue May 24, 2025
@ggqlq @picnixz
pythongh-134168: fix http.server CLI support for IPv6 and `--direct…
b931d45 
…ory` when serving over HTTPS (python#134169)

---------
(cherry picked from commit 2fd09b0)

Co-authored-by: ggqlq <[email protected]>
@bedevere-app bedevere-app bot mentioned this issue May 24, 2025
Merged
picnixz pushed a commit to picnixz/cpython that referenced this issue May 24, 2025
@ggqlq @picnixz
[3.14] pythongh-134168: fix http.server CLI support for IPv6 and `-…
06f32d7 
…-directory` when serving over HTTPS (pythonGH-134169)

(cherry picked from commit 2fd09b0)

Co-authored-by: ggqlq <[email protected]>
picnixz added a commit that referenced this issue May 24, 2025
@picnixz @ggqlq
[3.14] gh-134168: fix http.server CLI support for IPv6 and `--direc…
81f0993 
…tory` when serving over HTTPS (GH-134169) (#134630)

[3.14] gh-134168: fix `http.server` CLI support for IPv6 and `--directory` when serving over HTTPS (GH-134169)
(cherry picked from commit 2fd09b0)

Co-authored-by: ggqlq <[email protected]>
@picnixz picnixz closed this as completed May 24, 2025
@picnixz
Copy link
Member

picnixz commented May 24, 2025

Thank you for the report, the fix and your patience!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
3.14 bugs and security fixes 3.15 new features, bugs and security fixes stdlib Python modules in the Lib dir type-bug An unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@picnixz @donBarbos @ggqlq