Component: vyos-1x
 
Description:
 
_are_same_ip(one, two) in python/vyos/utils/network.py computes the address family for both arguments but only ever uses the first one's family for both inet_pton()
calls:

def _are_same_ip(one, two):
    from socket import inet_pton
    from vyos.template import is_ipv4
    # compare the binary representation of the IP
    f_one = AF_INET if is_ipv4(one) else AF_INET6
    s_two = AF_INET if is_ipv4(two) else AF_INET6
    return inet_pton(f_one, one) == inet_pton(f_one, two)
    
s_two (the computed family of two) is never used — inet_pton(f_one, two) parses two with one's family instead. If one and two are of different address families (e.g.
one is IPv4, two is IPv6), inet_pton() raises OSError/ValueError instead of the function cleanly returning False. Found via ruff flagging s_two as an unused local
variable (F841) during unrelated review work — not observed as a live incident; the function currently has no callers in the tree.
    
Suggested fix:

    f_one = AF_INET if is_ipv4(one) else AF_INET6
    f_two = AF_INET if is_ipv4(two) else AF_INET6
    if f_one != f_two:
        return False
    return inet_pton(f_one, one) == inet_pton(f_two, two)
    
How to reproduce: _are_same_ip is private/unexported and currently has no callers, so there's no CLI-level repro — this is a static-analysis finding, confirmed by
code inspection.
    
Version: found on rolling branch, current as of 2026-08-07.