ruleset_generate_vm_rules: use 'warn' instead of 'die'

We want to be able to update our rules, even if somebody defined
a wrong rule for his VM.

diff --git a/src/PVE/Firewall.pm b/src/PVE/Firewall.pm
index 01de542d3305e8dc397ad15110eab2d5775bd0b3..0d9dcdebaa9b7a356ad5988a754a9f6d71297370 100644 (file)
--- a/src/PVE/Firewall.pm
+++ b/src/PVE/Firewall.pm
@@ -1525,12 +1525,18 @@ sub ruleset_generate_vm_rules {
 
        } else {
            next if $rule->{type} ne $lc_direction;
-           if ($direction eq 'OUT') {
-               ruleset_generate_rule($ruleset, $chain, $rule,
-                                     { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, undef, $cluster_conf);
-           } else {
-               ruleset_generate_rule($ruleset, $chain, $rule, { ACCEPT => $in_accept , REJECT => "PVEFW-reject" }, undef, $cluster_conf);
-           }
+           eval {
+               if ($direction eq 'OUT') {
+                   ruleset_generate_rule($ruleset, $chain, $rule,
+                                         { ACCEPT => "PVEFW-SET-ACCEPT-MARK", REJECT => "PVEFW-reject" }, 
+                                         undef, $cluster_conf);
+               } else {
+                   ruleset_generate_rule($ruleset, $chain, $rule, 
+                                         { ACCEPT => $in_accept , REJECT => "PVEFW-reject" }, 
+                                         undef, $cluster_conf);
+               }
+           };
+           warn $@ if $@;
        }
     }
 }