From 53083d91e918398ccaaea05556371c9417cbcac2 Mon Sep 17 00:00:00 2001 From: Christian Breunig Date: Sat, 15 Aug 2026 15:24:37 +0200 Subject: firewall: T9210: bugfix in fqdn_resolve() exception handling Commit 4d621da33 ("firewall: T9210: fix ruff findings in python/vyos/firewall.py") narrowed fqdn_resolve() exception handling in from a bare except: statement to except gaierror:, claiming "no behavior change." That let non-gaierror OSErrors (e.g. transient network errors right after commit) escape uncaught, crashing the unguarded main loop of the vyos-domain-resolver daemon, the process that fills in D_* (domain-group) nftables sets. Change except clause back to OSError, as gaierror is a subclass. --- python/vyos/firewall.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'python') diff --git a/python/vyos/firewall.py b/python/vyos/firewall.py index b8356717f..729af8c57 100755 --- a/python/vyos/firewall.py +++ b/python/vyos/firewall.py @@ -16,7 +16,6 @@ import re from socket import AF_INET from socket import AF_INET6 -from socket import gaierror from socket import getaddrinfo from vyos.template import is_ipv4 @@ -80,7 +79,7 @@ def fqdn_resolve(fqdn, ipv6=False): try: res = getaddrinfo(fqdn, None, AF_INET6 if ipv6 else AF_INET) return set(item[4][0] for item in res) - except gaierror: + except OSError: return None def find_nftables_rule(table, chain, rule_matches=[]): -- cgit v1.2.3