diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-08-15 15:24:37 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-08-15 15:29:05 +0200 |
| commit | 53083d91e918398ccaaea05556371c9417cbcac2 (patch) | |
| tree | df232f7376f87db911913e0a5c6ef0e612c76a96 /python | |
| parent | 84906d5a12d4faeffc98f998fdd7eb00934d9ee2 (diff) | |
| download | vyos-1x-53083d91e918398ccaaea05556371c9417cbcac2.tar.gz vyos-1x-53083d91e918398ccaaea05556371c9417cbcac2.zip | |
firewall: T9210: bugfix in fqdn_resolve() exception handling
Commit 4d621da33 ("firewall: T9210: fix ruff findings in python/vyos/firewall.py")
narrowed fqdn_resolve() exception handling in from a bare except: statement to
except gaierror:, claiming "no behavior change." That let non-gaierror OSErrors
(e.g. transient network errors right after commit) escape uncaught, crashing
the unguarded main loop of the vyos-domain-resolver daemon, the process that
fills in D_* (domain-group) nftables sets.
Change except clause back to OSError, as gaierror is a subclass.
Diffstat (limited to 'python')
| -rwxr-xr-x | python/vyos/firewall.py | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index b8356717f..729af8c57 100755 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -16,7 +16,6 @@ import re from socket import AF_INET from socket import AF_INET6 -from socket import gaierror from socket import getaddrinfo from vyos.template import is_ipv4 @@ -80,7 +79,7 @@ def fqdn_resolve(fqdn, ipv6=False): try: res = getaddrinfo(fqdn, None, AF_INET6 if ipv6 else AF_INET) return set(item[4][0] for item in res) - except gaierror: + except OSError: return None def find_nftables_rule(table, chain, rule_matches=[]): |