From aa957be5381b2165352898bc96c23df432264fcc Mon Sep 17 00:00:00 2001
From: Thomas Eizinger <thomas@eizinger.io>
Date: Thu, 27 Mar 2025 11:36:39 +1100
Subject: [PATCH] fix(connlib): only disable not-yet-disabled resources (#8525)

Didn't test this but I think the logic checks out (and our proptests
should catch any bugs here).

Fixes: #8523
---
 rust/connlib/tunnel/src/client.rs | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/rust/connlib/tunnel/src/client.rs b/rust/connlib/tunnel/src/client.rs
index 28933d0da..46e04254e 100644
--- a/rust/connlib/tunnel/src/client.rs
+++ b/rust/connlib/tunnel/src/client.rs
@@ -965,8 +965,9 @@ impl ClientState {
             self.add_resource(resource.clone());
         }
 
-        for disabled_resource in &new_disabled_resources {
-            self.disable_resource(*disabled_resource);
+        for new_disabled_resource in new_disabled_resources.difference(&current_disabled_resources)
+        {
+            self.disable_resource(*new_disabled_resource);
         }
 
         self.maybe_update_cidr_resources();