Re: [PATCH pve-firewall 3/3] fix #1965: firewall: cache cluster config

[Stefan Hanreich <s.hanreich@proxmox.com>]

On 11/4/26 3:20 PM, Arthur Bied-Charreton wrote:

[...]

> +    # cluster.fw is not bumped on SDN changes, however a change in the SDN config may make a
> +    # rule that previously failed to parse valid again, or invalidate a previously valid one.
> +    # re-verify all rules if the ipsets names yielded by the current SDN config differ from the
> +    # stored ones.
> +    my $names = sub { join(',', sort keys(($_[0] // {})->{ipset}->%*)) };
> +    my $sdn_ipsets_changed = $names->($sdn_conf) ne $names->($cluster_conf->{sdn});
> +    $cluster_conf->{sdn} = $sdn_conf;
> +
> +    return $cluster_conf if !$sdn_ipsets_changed;
> +
> +    my $reverify = sub {
> +        my ($rules, $conf, $rule_env) = @_;
> +        for my $rule ($rules->@*) {
> +            delete $rule->{errors};
> +            verify_rule($rule, $cluster_conf, $conf, $rule_env, 1);

verify_rule can die, so we should probably eval here? Or at least in the loop below?