Re: ipblocklist - Call for testers (disable attribute in sources)

[Matthias Fischer <matthias.fischer@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 700 bytes --]

Hi Stefan, hi Tim,

I hadn't the time to test yet - but found a small typo.

Patch is attached.

Great work!

Best,
Matthias

On 10.04.2022 20:21, Charles Brown wrote:
> Tim, Stefan,
> 
> I have installed the ipblocklist feature. It looks great.
> 
> I’m curious about the disable attribute in the sources file.
> 
> I have all the lists enabled, I would have thought enabling 
> EMERGING_FWRULE would have the DSHIELD list automatically disabled. 
> However, I am showing several hits on DSHIELD and I see 20 entries in 
> ipset for DSHIELD. Is the disable attribute in sources there for 
> informational purposes only?
> 
> Thanks for your excellent work on this feature,
> Charles Brown
> 
> 



[-- Attachment #2: fix_aggresive.patch --]
[-- Type: text/plain, Size: 1683 bytes --]

diff -U 3 a/var/ipfire/ipblocklist/sources b/var/ipfire/ipblocklist/sources
--- a/var/ipfire/ipblocklist/sources	Sun Apr  3 13:22:06 2022
+++ b/var/ipfire/ipblocklist/sources	Sun Apr 10 20:48:08 2022
@@ -42,7 +42,7 @@
                                     'parser'   => 'ip-or-net-list',
                                     'rate'     => '1h',
                                     'category' => 'composite',
-                                    'disable'  => ['FEODO_RECOMMENDED', 'FEODO_IP', 'FEODO_AGGRESIVE', 'SPAMHAUS_DROP', 'DSHIELD'] },
+                                    'disable'  => ['FEODO_RECOMMENDED', 'FEODO_IP', 'FEODO_AGGRESSIVE', 'SPAMHAUS_DROP', 'DSHIELD'] },
              'EMERGING_COMPROMISED' => { 'name' => 'Emerging Threats Compromised IPs',
                                     'url'      => 'https://rules.emergingthreats.net/blockrules/compromised-ips.txt',
                                     'info'     => 'https://doc.emergingthreats.net/bin/view/Main/CompromisedHost',
@@ -80,7 +80,7 @@
                                     'rate'     => '5m',
                                     'category' => 'c and c',
                                     'disable'  => 'FEODO_RECOMMENDED' },
-             'FEODO_AGGRESIVE' => { 'name'     => 'Feodo Trojan IP Blocklist (Aggresive)',
+             'FEODO_AGGRESSIVE' => { 'name'     => 'Feodo Trojan IP Blocklist (Aggressive)',
                                     'url'      => 'https://feodotracker.abuse.ch/downloads/ipblocklist_aggressive.txt',
                                     'info'     => 'https://feodotracker.abuse.ch/blocklist',
                                     'parser'   => 'ip-or-net-list',