Re: [PATCH pve-firewall 3/3] fix #1965: firewall: cache cluster config

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

On Wed, Nov 04, 2026 at 05:15:20PM +0100, Stefan Hanreich wrote:
> On 11/4/26 3:20 PM, Arthur Bied-Charreton wrote:
> 
> [...]
> 
> > +    # cluster.fw is not bumped on SDN changes, however a change in the SDN config may make a
> > +    # rule that previously failed to parse valid again, or invalidate a previously valid one.
> > +    # re-verify all rules if the ipsets names yielded by the current SDN config differ from the
> > +    # stored ones.
> > +    my $names = sub { join(',', sort keys(($_[0] // {})->{ipset}->%*)) };
> > +    my $sdn_ipsets_changed = $names->($sdn_conf) ne $names->($cluster_conf->{sdn});
> > +    $cluster_conf->{sdn} = $sdn_conf;
> > +
> > +    return $cluster_conf if !$sdn_ipsets_changed;
> > +
> > +    my $reverify = sub {
> > +        my ($rules, $conf, $rule_env) = @_;
> > +        for my $rule ($rules->@*) {
> > +            delete $rule->{errors};
> > +            verify_rule($rule, $cluster_conf, $conf, $rule_env, 1);
> 
> verify_rule can die, so we should probably eval here? Or at least in the loop below?
> 
good point, thanks! will fix that if we decide we want this change.