Re: [PATCH pve-firewall 3/3] fix #1965: firewall: cache cluster config

[Stefan Hanreich <s.hanreich@proxmox.com>]

On 11/4/26 3:20 PM, Arthur Bied-Charreton wrote:
> Large firewall configs can take a noticeable amount of time to parse,
> as noted by the user on the linked issue.
> 
> Register the config with cfs_register_file in order to avoid re-parsing
> it unless cluster.fw changed.
> 
> Rule verification still depends on the SDN config, which can change
> independently. A rule referencing an SDN ipset that did not exist when
> it was parsed and cached is still stored with errors, even if that rule
> becomes valid later (e.g. if the rule references 'foo-dhcp' and the
> VNet 'foo' is created later).
> 
> For this reason, the cached config keeps the SDN config it was verified
> against last time it was fully parsed. If the ipset names yielded by the
> current SDN config differ from what is stored, all cluster and group
> rules are re-verified against the new ones. The ccache cannot be
> invalidated from pve-firewall, so after an SDN change this happens on
> every load until cluster.fw is parsed again due to a new version or a
> daemon restart.
> 
> Errors found on re-verification are logged to preserve the original
> behavior.
> 
> Benchmark with two 25k-entry ipsets and 1050 rules (50 loads):
> 
>     without caching:
>         first load 0.2447s, then avg 0.2509s (min 0.2301 max 0.2835)
> 
>     cached, not re-verified (steady state):
>         first load 0.2694s, then avg 0.0157s (min 0.0131 max 0.0204)
> 
>     cached, re-verified (worst case, transient until next parse):
>         avg 0.0721s (min 0.0657 max 0.1012)
That is with eea1b88b9 applied already? In that case the gain seems
marginal? Are there other possible configurations that would get
a bigger speed up. Because the core problem seems to be addressed
with eea1b88b9 alone and then we don't have the added logic of
re-verifying / caching?