applied: [PATCH pve-firewall] fix #8261: config parser: check prefix length without Net::IP

[Thomas Lamprecht <t.lamprecht@proxmox.com>]

On Tue, 03 Nov 2026 13:10:14 +0100, Arthur Bied-Charreton wrote:
> 99343fe ("firewall: reject cidrs with invalid netmask") made
> parse_ip_or_cidr call pve_verify_ip_or_cidr. That function masks the
> host bits and constructs a Net::IP object for every alias and IPSet
> entry, which is very expensive.
> 
> As noted in the linked bug, a cluster config with about 30k IPSet
> entries took 6 seconds to parse vs. 0.4 before this call was introduced.
> 
> [...]

Applied, thanks!

I folded in `\z` anchors, so a trailing newline stays rejected like with the
removed call, plus a test for that, and noted in the commit message that a
`/0` prefix with host bits set is now accepted. I also made the API accept
that in a follow-up, since clean_cidr treated a literal `/0` like a missing
prefix:

82888bc ("api: accept host bits in /0 networks like for other prefixes")

[1/1] fix #8261: config parser: check prefix length without Net::IP
      commit: eea1b88b9eaf8735197943ed2f4353a4a6715069