# HG changeset patch
# User Matthew Wild <mwild1@gmail.com>
# Date 1778080538 -3600
# Node ID 5aeefc2251d4b6fc281a3295f96a0d4f26b131e2
# Parent  0f61d13ebbdeb04ef2c43c10f6692c2a930d6c39
mod_firewall: Load a script completely or not at all

Previously it was possible that some chains would load, but others would not.
This can be surprising (that a "half-loaded" state is possible) and hard to
debug.

This change makes it so that if some chains don't compile, the whole script
will be treated as not loaded.

diff -r 0f61d13ebbde -r 5aeefc2251d4 mod_firewall/mod_firewall.lua
--- a/mod_firewall/mod_firewall.lua	Wed May 06 15:41:56 2026 +0100
+++ b/mod_firewall/mod_firewall.lua	Wed May 06 16:15:38 2026 +0100
@@ -688,6 +688,8 @@
 		return;
 	end
 
+	local errs;
+
 	-- Loop through the chains in the script, and for each chain attach the compiled code to the
 	-- relevant events, keeping track in events_hooked so we can cleanly unload later
 	local events_hooked = {};
@@ -695,6 +697,8 @@
 		local new_handler, err = compile_handler(handler_code, "mod_firewall::"..chain);
 		if not new_handler then
 			module:log("error", "Compilation error for %s: %s", script, err);
+			errs = true;
+			break;
 		else
 			local chain_definition = chains[chain];
 			if chain_definition and chain_definition.type == "event" then
@@ -711,6 +715,13 @@
 			module:hook(event_name, handler);
 		end
 	end
+	if errs then
+		for event_name, event_handler in pairs(events_hooked) do
+			module:unhook(event_name, event_handler);
+			events_hooked[event_name] = nil;
+		end
+		return;
+	end
 	loaded_scripts[script] = { last_modified = last_modified, events_hooked = events_hooked };
 	module:log("debug", "Loaded %s", script);
 	return true;