From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hvMkl0LDsz30Lt for ; Tue, 29 Sep 2026 15:37:51 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hvMkg4wJ0z2xHk for ; Tue, 29 Sep 2026 15:37:47 +0000 (UTC) Received: from out.smtpout.orange.fr (out-16.smtpout.orange.fr [193.252.22.16]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "*.smtpout.orange.fr", Issuer "DigiCert Global G2 TLS RSA SHA256 2020 CA1" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hvMkf4FDVz7Y for ; Tue, 29 Sep 2026 15:37:46 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=orange.fr header.s=t20230301 header.b=G+kioa3d; spf=pass (mail01.ipfire.org: domain of p27m@orange.fr designates 193.252.22.16 as permitted sender) smtp.mailfrom=p27m@orange.fr; dmarc=pass (policy=quarantine) header.from=orange.fr ARC-Seal: i=1; a=rsa-sha256; d=lists.ipfire.org; s=202003rsa; cv=none; t=1790696266; b=pe3cKKNWI83scK6gvdaAH0rILvXB1igU35+BTYd5QAz37WEr80/O5YCt2xKDL/xmtSW1++ 6zX4W4FR80qMGByFmYijWQ9zk1H3hfOyp9B/v/wVT8PFmEMm6PjYpOtcBM+BlNeMWOfM3G vwSIXFMnxvLLd/mrsm9LvW7ApgrthkktVlvfPwRxCZu2HMlyUTyEA8SEBU4NwCSxHYOZ0k Bj7BGw1n81V7mjm2BjuPJHeET29Ccfm28G84hfIP7WzNOvEQVgPxLDVgyf+r8f9KqutMKM 5uPHtW5Yz8wnsbEcXnvEDUyT14c5igaCCjZqO2SBBG36yENkVEp89cfe9QfAuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1790696266; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=svt6UIyBvxR8tzKlStRsuHoNNKi1eQ2kdH4OexKoRyw=; b=F59TDM6Y760mBWM5aXmxZpCEacdjKuA3EPDwi84tr2Cxi/nz683T0njX5bEtuAfavkXVzz +sIXLnoXU4bu9JnG+Jol8bJhKg+ehGDSxVXboODTqrri/FfVMQg0+i99mG+9qXdjsLCFqZ 84ji3Nkm5KV7ynuzCDsaF6w1xSyzZMbwZ277pU/oTU4EHoW1mBi3DvYzqMcygzh/17O+ja 218kWwMLWujbzYccMxdmddNQWVZKhfZPg1eUZzEdYfWLY2uVMnM3kS+2N4veQzd0kC9Ztm lF9rzqpcdSYH1DueP9p3VjDDfPNEftZ5UXaJmJrZ7pJwtpU2IiiHhvPJAvJITg== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=orange.fr header.s=t20230301 header.b=G+kioa3d; spf=pass (mail01.ipfire.org: domain of p27m@orange.fr designates 193.252.22.16 as permitted sender) smtp.mailfrom=p27m@orange.fr; dmarc=pass (policy=quarantine) header.from=orange.fr Received: from [192.168.20.32] ([176.146.212.228]) by smtp.orange.fr with ESMTPSA id BZtpxN02kTLk9BZtpxlUUn; Tue, 29 Sep 2026 17:37:45 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.fr; s=t20230301; t=1790696265; bh=svt6UIyBvxR8tzKlStRsuHoNNKi1eQ2kdH4OexKoRyw=; h=Message-ID:Date:MIME-Version:Subject:To:From; b=G+kioa3drSFu4uYjQ0Sh/QVEG9O2nYThIV3X9754K2e7iAQFEgJue9G2RgyfRXQnU xk+cr3fcwp2h6f3U+UHrsB/EfL9tBNfa9gZX9SYkRCSH5XCzbxD2wUIP9A+6G6zZzH 1ncmwUBHgjzsXG9U2z8I/jVcnDxS6bVccbP+JJSAF+3JpSegQkowhll3gLR5LorjX7 VNlFH7pHQOUbSZuAqDbgZq42Z31ydGeBYvp78TBscjoONxF5whZHNM7hpYLPe2Zwjz KHr9yGF0ylP+xJf/2vMj/AyJsdqyvuI0y5qgefMHmMls9+9jA5s1sBDz2fjUulh3iV Fz60nIGYzaAXQ== X-ME-Helo: [192.168.20.32] X-ME-Auth: cDI3bUBvcmFuZ2UuZnI= X-ME-Date: Tue, 29 Sep 2026 17:37:45 +0200 X-ME-IP: 176.146.212.228 Message-ID: <77b98f70-5ca1-44bf-9e51-2501df58cbfc@orange.fr> Date: Tue, 29 Sep 2026 17:37:45 +0200 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] urlfilter: Remove bundled Toulouse blacklist To: development@lists.ipfire.org References: <20260827091639.4064898-1-p27m@orange.fr> <217EBED3-D400-4695-A345-816C7DD47207@ipfire.org> <6C039B7E-2BAF-45B7-9C87-A7D008EF3443@ipfire.org> <807301F9-A750-46D9-B614-2D4B1E99CA7A@ipfire.org> <706ad76b-d06e-4a85-975a-b53a2e39bf46@orange.fr> <4FD17803-1E9B-41C4-A51B-CCE5F3BC92D1@ipfire.org> Content-Language: fr, en-US From: p27m In-Reply-To: <4FD17803-1E9B-41C4-A51B-CCE5F3BC92D1@ipfire.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Rspamd-Action: no action X-Spamd-Result: default: False [-6.90 / 11.00]; NEURAL_HAM(-3.00)[-1.000]; BAYES_HAM(-3.00)[100.00%]; DMARC_POLICY_ALLOW(-0.50)[orange.fr,quarantine]; R_SPF_ALLOW(-0.20)[+ip4:193.252.22.0/25]; ONCE_RECEIVED(0.20)[]; R_DKIM_ALIGNED(-0.10)[strict]; R_DKIM_ALLOW(-0.10)[orange.fr:s=t20230301]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.10)[smtp-in2.orange.fr]; TO_MATCH_ENVRCPT_ALL(0.00)[]; FROM_HAS_DN(0.00)[]; ARC_NA(0.00)[]; MIME_TRACE(0.00)[0:+]; DWL_DNSWL_NONE(0.00)[orange.fr:dkim]; RCPT_COUNT_ONE(0.00)[1]; FREEMAIL_ENVFROM(0.00)[orange.fr]; FREEMAIL_FROM(0.00)[orange.fr]; IP_REPUTATION_SPAM(0.00)[asn: 3215(0.00), country: FR(0.00), ip: 193.252.22.16(0.00)]; DKIM_TRACE(0.00)[orange.fr:+]; RCVD_IN_DNSWL_NONE(0.00)[193.252.22.16:from]; RECEIVED_SPAMHAUS_PBL(0.00)[176.146.212.228:received]; TO_DN_NONE(0.00)[]; FROM_EQ_ENVFROM(0.00)[]; RCVD_TLS_ALL(0.00)[]; MID_RHS_MATCH_FROM(0.00)[]; ASN(0.00)[asn:3215, ipnet:193.252.20.0/22, country:FR]; RCVD_VIA_SMTP_AUTH(0.00)[]; DKIM_REPUTATION(0.00)[0]; RCVD_COUNT_ONE(0.00)[1]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1] X-Rspamd-Queue-Id: 4hvMkf4FDVz7Y X-Rspamd-Server: mail01.haj.ipfire.org Hi , “Clear the directory before the lists are being restored” is actually already what Adolf implemented in |backup.pl| in CU203 to fix this bug. However, this is not done in |installer/hw.c|, as discussed in Bugzilla: https://bugzilla.ipfire.org/show_bug.cgi?id=13969#c5 So clearing the directory before restoring the lists there would indeed be another approach that should work. My intention in proposing this patch was simply to help and avoid additional work, rather than to argue about which solution is the best one. I think there are several possible ways to address the issue, so I will leave it to you to choose and implement the approach that you consider most appropriate for IPFire. Regards, Philippe Le 29/09/2026 à 17:10, Michael Tremer a écrit : > Hello Philippe, > > Thanks for getting back so quickly. > > I suppose we will just have to clear the directory before the lists are being restored. That should eliminate any problems after extraction. > > Where the list should be backed up at all is a completely different story. We have been talking about this many times. Some people expect only the configuration to be included in the backup and others expect a full snapshot of the system. There is also the question of when the backup is going to be restored: A couple of days later you will be okay with a slightly out-of-date list; a couple of months later you will be carrying a lot of data that is basically worthless. But we are doing the same with the IPS rulesets and so on, so we should at least be consistent. > > Best, > -Michael > >> On 29 Sep 2026, at 16:07, p27m wrote: >> >> Hi Michael, >> >> Yes, I think this is a good functional solution, although it would require a different implementation. >> However, it does not address the original problem that led me to propose this patch: the failure of a backup restore on fresh install when the backup contains a recent Toulouse blacklist. >> >> In fact, the IPFire DBL list also contains the following directories: >> - ads >> - porn >> - violence >> >> These are symlinks in the current Toulouse `blacklists.tar.gz`: >> - ads -> publicite >> - porn -> adult >> - violence -> agressif >> >> Therefore, if IPFire DBL is installed by default in new IPFire system, restoring a backup containing a recent Toulouse blacklist could still result in exactly the same directory/symlink conflict during the untar restoration. >> >> Regards, >> -- >> Philippe >> >> Le 29/09/2026 à 15:19, Michael Tremer a écrit : >>> Hello, >>> >>> I generally do agree with dropping the old data. It is more than obsolete, but that leaves us with some new problems: >>> >>> * No data is available immediately. Users would have to go down to the section of the page where they can select a list, enable the updates and trigger a manual update. Only then they will be able to start the URL Filter. This is a very convoluted process to enable a feature that should be very easy to configure. >>> >>> * If we shipped IPFire DBL by default, that would be a very sensible solution actually. But then there is a danger that people will enable the categories they want, enable URL Filter, but never enable the automatic updates. If we enable the automatic updates ourselves, we would run into the problem that a lot of IPFire instances all over the world would be updating their blacklists although they are never being used which will simply waste disk space and bandwidth. >>> >>> So I think we need a change which is to ship IPFire DBL for new installations, enable the auto-updates by default, but then only make them actually work if URL filter is enabled at the top. That will solve the problem in the latter case. >>> >>> Does that sound good to you, too? >>> >>> -Michael >