fix: degrade getsockopt read failures instead of aborting

bdraco · bdraco · commit 37f6b1af3448 · 2026-06-22T09:38:23.000-05:00
make_wrapped_transport runs on the startup/connection path; re-raising a
failed IPV6_MULTICAST_IF read there could abort instance startup to protect
multicast_index, which only selects the interface for a benign group leave
that drop_multicast_member already tolerates. Fall back to the default index
with a debug log instead. Apply the same graceful fallback to
_listen_socket_supports (assume dual-stack) so a getsockopt failure can't
abort a rescan, and the two paths agree. Soften the _core config-commit
comment, which overstated the invariant on a partial reconcile failure.
diff --git a/src/zeroconf/_core.py b/src/zeroconf/_core.py
@@ -460,7 +460,8 @@ async def async_update_interfaces(
         """
         # Resolve against the retained config but only commit it after the
         # engine reconcile succeeds, so a failed reconcile leaves the stored
-        # values matching the sockets actually bound.
+        # config unchanged rather than recording a set that never fully bound
+        # (a mid-reconcile failure may still have changed some sockets).
         interfaces = self._interfaces if interfaces is None else interfaces
         ip_version = self._ip_version if ip_version is None else ip_version
         apple_p2p = self._apple_p2p if apple_p2p is None else apple_p2p
diff --git a/src/zeroconf/_engine.py b/src/zeroconf/_engine.py
@@ -25,10 +25,10 @@
 import asyncio
 import itertools
 import socket
-import sys
 import threading
 from typing import TYPE_CHECKING, cast
 
+from ._logger import log
 from ._record_update import RecordUpdate
 from ._utils.asyncio import get_running_loop, run_coro_with_timeout
 from ._utils.net import (
@@ -79,13 +79,12 @@ def _listen_socket_supports(
     supported = True
     try:
         supported = not listen_socket.getsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY)
-    except OSError:
-        # Windows rejects reading IPV6_V6ONLY on some sockets; assume supported
-        # there (consistent with make_wrapped_transport) so a read failure can't
-        # drive a rebuild loop. Elsewhere the read does not fail, so surface a
-        # genuine error rather than mask an unreceivable family as supported.
-        if sys.platform != "win32":
-            raise
+    except OSError as exc:
+        # Reading IPV6_V6ONLY can fail (Windows rejects it on some sockets;
+        # other platforms shouldn't). Assume dual-stack so a read failure can't
+        # abort the rescan; at worst this skips a rebuild the next reconcile
+        # re-evaluates, consistent with make_wrapped_transport's fallback.
+        log.debug("Unable to read IPV6_V6ONLY, assuming dual-stack: %s", exc)
     return supported
 
 
diff --git a/src/zeroconf/_transport.py b/src/zeroconf/_transport.py
@@ -24,9 +24,10 @@
 
 import asyncio
 import socket
-import sys
 from typing import cast
 
+from ._logger import log
+
 
 def _strip_zone(address: str) -> str:
     """Drop a ``%zone`` suffix from an IPv6 address string."""
@@ -103,17 +104,14 @@ def make_wrapped_transport(transport: asyncio.DatagramTransport) -> _WrappedTran
     if is_ipv6:
         # IPV6_MULTICAST_IF holds the interface index new_respond_socket
         # joined the group with; capture it so a later group leave uses the
-        # same index. Windows rejects reading the option (WSAEINVAL); there
-        # the leave falls back to the default interface as it did before.
+        # same index. This is on the startup/connection path, and the index
+        # only selects the interface for a future (benign) group leave, so a
+        # read failure (Windows rejects it with WSAEINVAL; other platforms
+        # shouldn't) keeps the default index 0 rather than aborting setup.
         try:
             multicast_index = sock.getsockopt(socket.IPPROTO_IPV6, socket.IPV6_MULTICAST_IF)
-        except OSError:
-            # Windows rejects reading IPV6_MULTICAST_IF (WSAEINVAL); the
-            # default index 0 set above is kept there. On other platforms this
-            # read does not fail, so re-raise rather than mask a genuine error
-            # into a wrong-interface group leave.
-            if sys.platform != "win32":
-                raise
+        except OSError as exc:
+            log.debug("Unable to read IPV6_MULTICAST_IF, using default index 0: %s", exc)
     return _WrappedTransport(
         transport=transport,
         is_ipv6=is_ipv6,
diff --git a/tests/test_interface_update.py b/tests/test_interface_update.py
@@ -76,20 +76,19 @@ def test_make_wrapped_transport_reads_v6_multicast_index() -> None:
 
 
 def test_make_wrapped_transport_unreadable_multicast_index() -> None:
-    """A socket that rejects reading IPV6_MULTICAST_IF falls back to index 0."""
+    """A socket that rejects reading IPV6_MULTICAST_IF falls back to index 0.
+
+    This runs on the startup/connection path, so a read failure must not abort
+    setup; it degrades to the default index (only a future group leave cares).
+    """
     sock = Mock()
     sock.family = socket.AF_INET6
     sock.fileno.return_value = 0
     sock.getsockname.return_value = ("fe80::1", 5353, 0, 0)
     sock.getsockopt.side_effect = OSError
     transport = Mock()
     transport.get_extra_info.return_value = sock
-    # Windows: expected (WSAEINVAL), silent fallback to the default index.
-    with patch("zeroconf._transport.sys.platform", "win32"):
-        assert make_wrapped_transport(transport).multicast_index == 0
-    # Other platforms: the read does not fail there, so an error is re-raised.
-    with patch("zeroconf._transport.sys.platform", "linux"), pytest.raises(OSError):
-        make_wrapped_transport(transport)
+    assert make_wrapped_transport(transport).multicast_index == 0
 
 
 def test_listen_socket_supports_family() -> None:
@@ -108,14 +107,10 @@ def test_listen_socket_supports_family() -> None:
     assert _listen_socket_supports(v6_sock, "1.2.3.4") is True
     v6_sock.getsockopt.return_value = 1  # IPV6_V6ONLY on -> v6-only
     assert _listen_socket_supports(v6_sock, "1.2.3.4") is False
-    # An unreadable option is expected only on Windows (WSAEINVAL); treat as
-    # supported there so it can't drive a rebuild loop, but surface a genuine
-    # read failure on other platforms rather than mask an unreceivable family.
+    # An unreadable option degrades to "assume dual-stack" rather than aborting
+    # the rescan; at worst it skips a rebuild the next reconcile re-evaluates.
     v6_sock.getsockopt.side_effect = OSError
-    with patch("zeroconf._engine.sys.platform", "win32"):
-        assert _listen_socket_supports(v6_sock, "1.2.3.4") is True
-    with patch("zeroconf._engine.sys.platform", "linux"), pytest.raises(OSError):
-        _listen_socket_supports(v6_sock, "1.2.3.4")
+    assert _listen_socket_supports(v6_sock, "1.2.3.4") is True
 
 
 @pytest.mark.asyncio
