From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 671021FF0C0 for ; Wed, 04 Nov 2026 15:19:52 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 445EB214D5; Wed, 04 Nov 2026 15:19:42 +0100 (CET) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH firewall 0/3] fix #1965: cache the cluster firewall config Date: Wed, 4 Nov 2026 15:19:28 +0100 Message-ID: <20261104141931.399659-1-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1793801977592 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.685 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_MED -2.3 Sender listed at https://www.dnswl.org/, medium trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: F27RGZJXP6QJ3LGGDSRMSSJQN645YXNX X-Message-ID-Hash: F27RGZJXP6QJ3LGGDSRMSSJQN645YXNX X-MailFrom: a.bied-charreton@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: The cluster firewall config is is not currently cached, so it is re- parsed on every load. This can use a noticeable amount of CPU if the firewall configuration contains large ipsets, for example. These changes are based on an old series by Stefan Hrdlicka [0]. The only major diff compared to that series is that the in-memory firewall config now includes SDN ipsets. Those are not stored in cluster.fw, so changes to those do not create new versions for it and therefore need to be handled separately, see commit messages for details. [0] https://lists.proxmox.com/pipermail/pve-devel/2022-November/055051.html pve-firewall: Arthur Bied-Charreton (3): firewall: run make tidy firewall: parser: factor out error logging fix #1965: firewall: cache cluster config src/PVE/API2/Firewall/Helpers.pm | 3 +- src/PVE/Firewall.pm | 124 ++++++++++++++++++++++--------- 2 files changed, 89 insertions(+), 38 deletions(-) Summary over all repositories: 2 files changed, 89 insertions(+), 38 deletions(-) -- Generated by murpp 0.12.1