From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <pve-devel-bounces@lists.proxmox.com>
Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40])
	by lore.proxmox.com (Postfix) with ESMTPS id 2268D1FF0C0
	for <inbox@lore.proxmox.com>; Wed, 04 Nov 2026 17:15:27 +0100 (CET)
Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1])
	by gate001.proxmox.com (Proxmox) with ESMTP id 1914B21283;
	Wed, 04 Nov 2026 17:15:24 +0100 (CET)
Message-ID: <baf38240-5062-4ace-8586-1929050f4bd8@proxmox.com>
Date: Wed, 4 Nov 2026 17:15:20 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH pve-firewall 3/3] fix #1965: firewall: cache cluster
 config
To: pve-devel@lists.proxmox.com
References: <20261104141931.399659-1-a.bied-charreton@proxmox.com>
 <20261104141931.399659-4-a.bied-charreton@proxmox.com>
Content-Language: en-US
From: Stefan Hanreich <s.hanreich@proxmox.com>
In-Reply-To: <20261104141931.399659-4-a.bied-charreton@proxmox.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
X-SPAM-LEVEL: Spam detection results:  0
	AWL                     0.319 Adjusted score from AWL reputation of From:
 address
	DMARC_MISSING             0.1 Missing DMARC policy
	KAM_DMARC_STATUS         0.01 Test Rule for DKIM or SPF Failure with Strict
 Alignment (newer systems)
	RCVD_IN_DNSWL_MED        -2.3 Sender listed at https://www.dnswl.org/,
 medium trust
	SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
	SPF_PASS               -0.001 SPF: sender matches SPF record
Message-ID-Hash: IU5EOZKKXFGXS3TAZ7CJSAO6EARAQ5X4
X-Message-ID-Hash: IU5EOZKKXFGXS3TAZ7CJSAO6EARAQ5X4
X-MailFrom: s.hanreich@proxmox.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop;
 banned-address; emergency; member-moderation; nonmember-moderation;
 administrivia; implicit-dest; max-recipients; max-size; news-moderation;
 no-subject; digests; suspicious-header
X-Mailman-Version: 3.3.10
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Owner: <mailto:pve-devel-owner@lists.proxmox.com>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Subscribe: <mailto:pve-devel-join@lists.proxmox.com>
List-Unsubscribe: <mailto:pve-devel-leave@lists.proxmox.com>

On 11/4/26 3:20 PM, Arthur Bied-Charreton wrote:

[...]

> +    # cluster.fw is not bumped on SDN changes, however a change in the SDN config may make a
> +    # rule that previously failed to parse valid again, or invalidate a previously valid one.
> +    # re-verify all rules if the ipsets names yielded by the current SDN config differ from the
> +    # stored ones.
> +    my $names = sub { join(',', sort keys(($_[0] // {})->{ipset}->%*)) };
> +    my $sdn_ipsets_changed = $names->($sdn_conf) ne $names->($cluster_conf->{sdn});
> +    $cluster_conf->{sdn} = $sdn_conf;
> +
> +    return $cluster_conf if !$sdn_ipsets_changed;
> +
> +    my $reverify = sub {
> +        my ($rules, $conf, $rule_env) = @_;
> +        for my $rule ($rules->@*) {
> +            delete $rule->{errors};
> +            verify_rule($rule, $cluster_conf, $conf, $rule_env, 1);

verify_rule can die, so we should probably eval here? Or at least in the loop below?