From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <w.bumiller@proxmox.com>
Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256)
(No client certificate requested)
by lists.proxmox.com (Postfix) with ESMTPS id DFD0F970A7
for <pve-devel@lists.proxmox.com>; Fri, 27 Jan 2023 12:41:59 +0100 (CET)
Received: from firstgate.proxmox.com (localhost [127.0.0.1])
by firstgate.proxmox.com (Proxmox) with ESMTP id 6DD7F7C6F
for <pve-devel@lists.proxmox.com>; Fri, 27 Jan 2023 12:41:29 +0100 (CET)
Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com
[94.136.29.106])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by firstgate.proxmox.com (Proxmox) with ESMTPS
for <pve-devel@lists.proxmox.com>; Fri, 27 Jan 2023 12:41:28 +0100 (CET)
Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1])
by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 9E808467D0
for <pve-devel@lists.proxmox.com>; Fri, 27 Jan 2023 12:41:26 +0100 (CET)
Date: Fri, 27 Jan 2023 12:41:25 +0100
From: Wolfgang Bumiller <w.bumiller@proxmox.com>
To: Leo Nunner <l.nunner@proxmox.com>
Cc: pve-devel@lists.proxmox.com
Message-ID: <20230127114125.bquh7kdugu2arvd2@fwblub>
References: <20230126143020.150338-1-l.nunner@proxmox.com>
<20230126143020.150338-5-l.nunner@proxmox.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20230126143020.150338-5-l.nunner@proxmox.com>
X-SPAM-LEVEL: Spam detection results: 0
AWL 2.695 Adjusted score from AWL reputation of From: address
BAYES_00 -1.9 Bayes spam probability is 0 to 1%
KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
RCVD_IN_DNSWL_HI -5 Sender listed at https://www.dnswl.org/,
high trust
SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record
SPF_PASS -0.001 SPF: sender matches SPF record
Subject: Re: [pve-devel] [PATCH firewall 4/4] config: combine group/ipset
and their comments
X-BeenThere: pve-devel@lists.proxmox.com
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com>
List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe>
List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/>
List-Post: <mailto:pve-devel@lists.proxmox.com>
List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help>
List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>,
<mailto:pve-devel-request@lists.proxmox.com?subject=subscribe>
X-List-Received-Date: Fri, 27 Jan 2023 11:41:59 -0000
On Thu, Jan 26, 2023 at 03:30:19PM +0100, Leo Nunner wrote:
> This patch restructures the parsed config structure a bit to be more
> consistent across objects.
>
> group_comments and ipset_comments were removed from the config structure
> and are now stored directly within the group/ipset objects themselves.
> They now follow the same structure as aliases, with
>
> <name> => {
> comment => <...>,
> [entries|rules] => { <...> },
> }
>
> We don't need to store separate instances of the original + the
> lower-case name for aliases anymore, so the structure was changed to
>
> <name> => {
> comment => <...>,
> cidr => <...>,
> ipversion => <...>,
> }
>
> Signed-off-by: Leo Nunner <l.nunner@proxmox.com>
> ---
> RFC: This one is optional, it's just that while experimenting with
> the capitalization issue I also looked into using a "name" property
> for everything (like for aliases), and while I was at it, I also transfered
> the comments into the main object… I feel like this structure is nicer, but
> we don't _need_ it. My main worry is that there might still be some calls to
> $conf->{ipset}->{foo} instead of $conf->{ipset}->{foo}->{entries}, but I
> couldn't find any aside from the ones modified in this patch ^^
But in the end you dropped the `name` property of aliases instead.
Could you clarify your conclusion a bit?
Because now we have hashes with original names and need to `grep` their
keys instead of doing lookups because we don't know their
capitalization, and need to remember doing so everywhere.
To me this seems like a step backwards, given that the firewall is
already quite CPU-hungry at times?
It seems to me that all-lowercase hashes with original names inside
would be much eaiser? Sure, we'd have to "undo" this when saving or
returning stuff via the API for backward compatibility.