From patchwork Thu Aug 27 09:16:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Philippe SCARSELLI X-Patchwork-Id: 10165 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4hVwsK0yTcz3wqw for ; Thu, 27 Aug 2026 09:17:41 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE1" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hVws84Y7fz7CM for ; Thu, 27 Aug 2026 09:17:32 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4hVwrj3Hnmz36WB for ; Thu, 27 Aug 2026 09:17:09 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR2" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4hVwrf5vsXz2xRF for ; Thu, 27 Aug 2026 09:17:06 +0000 (UTC) Received: from smtp.smtpout.orange.fr (smtp-22.smtpout.orange.fr [80.12.242.22]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "*.smtpout.orange.fr", Issuer "DigiCert Global G2 TLS RSA SHA256 2020 CA1" (verified OK)) by mail01.ipfire.org (Postfix) with ESMTPS id 4hVwrV2L8lzPZ for ; Thu, 27 Aug 2026 09:16:58 +0000 (UTC) Authentication-Results: mail01.ipfire.org; dkim=pass header.d=orange.fr header.s=t20230301 header.b=N+cWEOz3; spf=pass (mail01.ipfire.org: domain of p27m@orange.fr designates 80.12.242.22 as permitted sender) smtp.mailfrom=p27m@orange.fr; dmarc=pass (policy=quarantine) header.from=orange.fr ARC-Seal: i=1; a=rsa-sha256; d=lists.ipfire.org; s=202003rsa; cv=none; t=1787822218; b=PSR6nyXH2+Tgo9AEmDgmL7LjxFmDm7KwfE8a8PU6Y2HQMZd9uV8qhfM/ADsG2TGxdAsca2 npFlmgZwHpyABQu4TCuF9yv1ntqaIruWEsKNcre+Myc7nBn2Ujmhq4/eGJXW4CPSNC5L0M c2chEQXISeruGy8I8V79qBj3h0A9qDQY0CbmV2ZsQjH8+6fXAdPjfzBj+g41YvYrdlEAMw DW/Vy/ziy3BvO35Z3JjqT4I8F7jrjD31/8svHgIMzWnLS6X727J7Kxl0rUff0MGxTYC2xR 4yvTvdQX2xrrY7dai3vaO+c/0CU5ORN6NDU4azXLUyVMYKU8r5g9f6yC4/tlaQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=lists.ipfire.org; s=202003rsa; t=1787822218; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding:dkim-signature; bh=+W7ithq+cePo2AvodeHiFvf46HtplTCA1eHgA+bV7jA=; b=VOREgtN88KtIOHZHvRda7cb8FzkSbRfrHRjc57G68x+xCuncWdHQM8+hYborenX4Gu1VPr qnZyQ3+3Ae9mfot3sarvUCIrGnScsyCHsZcArpPXOeTWLJNg462fupbJqVQBe5tUOMuwoj VlNakSiHlAM6a1tObRtsvVg8Y1JKAOvvGBBZ5Uuz7FfvcOmcX5tvkYsuIkdQzTPDoQeFMD 4DOpMR1JF7mqynqoN94Y0IYZ256B9FP+ScC3gSQ4lzsoA/jNdHb3K3u2RbTIWXWF43uoR4 jBHdes/M0Dui2ouFU0n4At26ffF5bKs9qrSC+ogjMwuASkwUMHi7KtPJiYJx2A== ARC-Authentication-Results: i=1; mail01.ipfire.org; dkim=pass header.d=orange.fr header.s=t20230301 header.b=N+cWEOz3; spf=pass (mail01.ipfire.org: domain of p27m@orange.fr designates 80.12.242.22 as permitted sender) smtp.mailfrom=p27m@orange.fr; dmarc=pass (policy=quarantine) header.from=orange.fr Received: from PCBUREAU.pshome ([176.146.212.228]) by smtp.orange.fr with ESMTPSA id zWE5wO15g9svzzWEDw7P7w; Thu, 27 Aug 2026 11:16:57 +0200 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=orange.fr; s=t20230301; t=1787822217; bh=+W7ithq+cePo2AvodeHiFvf46HtplTCA1eHgA+bV7jA=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=N+cWEOz34W4gcLBllNp/xN/KjEgHW1NQQ5CUKzlOeZjzhhE4VcRXFc3ZQNLPgVw10 U6xJnhSamrBhGV/1N7u4cjmqyHdvdxY23Bq3IpaHrY7hQ+DE7lDBR2q9Wx2P+xVQ7O tT/LtU53P+i5yZdTbKi0fxw2gMF1OBvvB56XnoEY7lYRf0Z8zSYIlU7bFN1RwMh4Ys 8Q8s+yTO5iYbizOD5vXe5O7NsWFrqm0UfebWP/Js6jrm3tnaB4hD4Cf6c26LrvaTvC 9moiLXQ/upYluLILopHY6UcEdKrYizRtudvvKuBL9kI9jC8QHUodohot5mORxxTpGQ f2RQpY6+QhsMA== X-ME-Helo: PCBUREAU.pshome X-ME-Auth: cDI3bUBvcmFuZ2UuZnI= X-ME-Date: Thu, 27 Aug 2026 11:16:57 +0200 X-ME-IP: 176.146.212.228 From: Philippe SCARSELLI To: development@lists.ipfire.org Cc: Philippe SCARSELLI Subject: [PATCH] urlfilter: Remove bundled Toulouse blacklist Date: Thu, 27 Aug 2026 11:16:39 +0200 Message-ID: <20260827091639.4064898-1-p27m@orange.fr> X-Mailer: git-send-email 2.47.3 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 X-Rspamd-Action: no action X-Spamd-Result: default: False [-6.30 / 11.00]; BAYES_HAM(-3.00)[100.00%]; NEURAL_HAM(-3.00)[-1.000]; MID_CONTAINS_FROM(1.00)[]; DMARC_POLICY_ALLOW(-0.50)[orange.fr,quarantine]; RWL_MAILSPIKE_EXCELLENT(-0.40)[80.12.242.22:from]; ONCE_RECEIVED(0.20)[]; R_SPF_ALLOW(-0.20)[+ip4:80.12.242.0/25]; R_DKIM_ALLOW(-0.20)[orange.fr:s=t20230301]; MIME_GOOD(-0.10)[text/plain]; MX_GOOD(-0.10)[smtp-in2.orange.fr]; FREEMAIL_ENVFROM(0.00)[orange.fr]; RCPT_COUNT_TWO(0.00)[2]; IP_REPUTATION_HAM(0.00)[asn: 3215(0.00), country: FR(-0.00), ip: 80.12.242.22(0.00)]; MIME_TRACE(0.00)[0:+]; TO_DN_SOME(0.00)[]; FREEMAIL_FROM(0.00)[orange.fr]; ARC_NA(0.00)[]; RCVD_TLS_ALL(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[80.12.242.22:from]; TO_MATCH_ENVRCPT_SOME(0.00)[]; ARC_SIGNED(0.00)[lists.ipfire.org:s=202003rsa:i=1]; FROM_EQ_ENVFROM(0.00)[]; FROM_HAS_DN(0.00)[]; FREEMAIL_CC(0.00)[orange.fr]; RECEIVED_SPAMHAUS_PBL(0.00)[176.146.212.228:received]; ASN(0.00)[asn:3215, ipnet:80.12.240.0/20, country:FR]; DKIM_TRACE(0.00)[orange.fr:+]; RCVD_VIA_SMTP_AUTH(0.00)[]; DKIM_REPUTATION(0.00)[0]; RCVD_COUNT_ONE(0.00)[1]; DWL_DNSWL_NONE(0.00)[orange.fr:dkim] X-Rspamd-Server: mail01.haj.ipfire.org X-Rspamd-Queue-Id: 4hVwrV2L8lzPZ Related to bug 13969 - CU201: restore URLFilter with the Toulouse list. To avoid future changes to the list—as happened during CU201— here is a proposed fix Remove the bundled Toulouse blacklist archive and create an empty blacklists directory instead. During upgrades, detect installations that still contain the bundled blacklist and remove it while preserving the custom blacklist. Updated blacklists are preserved. When restoring a backup, remove previous blacklist entries while keeping the custom blacklist to prevent clashes between files and symlinks. Tested upgrades from CU204 with the bundled, Toulouse, and IPFire DBL blacklists, backup restoration from CU203, and a fresh CU205 installation. Note: The patch was generated using "git format-patch --no-binary" to avoid including the 329 KB binary blacklist archive in the email. The patch shows the deletion of config/urlfilter/blacklists.tar.gz, but does not contain the binary data itself. Therefore, the file must be deleted separately when applying the patch. Signed-off-by: Philippe SCARSELLI --- config/backup/backup.pl | 5 ++- config/rootfiles/common/squidguard | 55 ---------------------------- config/rootfiles/core/205/update.sh | 11 ++++++ config/urlfilter/blacklists.tar.gz | Bin 329408 -> 0 bytes lfs/squidguard | 2 +- 5 files changed, 16 insertions(+), 57 deletions(-) delete mode 100644 config/urlfilter/blacklists.tar.gz diff --git a/config/backup/backup.pl b/config/backup/backup.pl index f948c4d21..ec15b2910 100644 --- a/config/backup/backup.pl +++ b/config/backup/backup.pl @@ -85,7 +85,10 @@ restore_backup() { # remove all previous blacklist entries from urlfilter # to prevent any clashes between symlinks and files - rm -Rf /var/ipfire/urlfilter/blacklists/* + find /var/ipfire/urlfilter/blacklists -mindepth 1 \ + ! -path '/var/ipfire/urlfilter/blacklists/custom' \ + ! -path '/var/ipfire/urlfilter/blacklists/custom/*' \ + -exec rm -rf {} + # Extract backup if ! tar xvzpf "${filename}" -C / \ diff --git a/config/rootfiles/common/squidguard b/config/rootfiles/common/squidguard index 389f03787..8c895062c 100644 --- a/config/rootfiles/common/squidguard +++ b/config/rootfiles/common/squidguard @@ -11,21 +11,6 @@ var/ipfire/urlfilter/bin/autoupdate.pl var/ipfire/urlfilter/bin/prebuild.pl var/ipfire/urlfilter/blacklists #var/ipfire/urlfilter/blacklists/README -#var/ipfire/urlfilter/blacklists/ads -#var/ipfire/urlfilter/blacklists/ads/domains -#var/ipfire/urlfilter/blacklists/ads/domains.db -#var/ipfire/urlfilter/blacklists/ads/urls -#var/ipfire/urlfilter/blacklists/ads/urls.db -#var/ipfire/urlfilter/blacklists/aggressive -#var/ipfire/urlfilter/blacklists/aggressive/domains -#var/ipfire/urlfilter/blacklists/aggressive/domains.db -#var/ipfire/urlfilter/blacklists/aggressive/urls -#var/ipfire/urlfilter/blacklists/aggressive/urls.db -#var/ipfire/urlfilter/blacklists/audio-video -#var/ipfire/urlfilter/blacklists/audio-video/domains -#var/ipfire/urlfilter/blacklists/audio-video/domains.db -#var/ipfire/urlfilter/blacklists/audio-video/urls -#var/ipfire/urlfilter/blacklists/audio-video/urls.db #var/ipfire/urlfilter/blacklists/custom #var/ipfire/urlfilter/blacklists/custom/allowed #var/ipfire/urlfilter/blacklists/custom/allowed/domains @@ -33,46 +18,6 @@ var/ipfire/urlfilter/blacklists #var/ipfire/urlfilter/blacklists/custom/blocked #var/ipfire/urlfilter/blacklists/custom/blocked/domains #var/ipfire/urlfilter/blacklists/custom/blocked/urls -#var/ipfire/urlfilter/blacklists/drugs -#var/ipfire/urlfilter/blacklists/drugs/domains -#var/ipfire/urlfilter/blacklists/drugs/domains.db -#var/ipfire/urlfilter/blacklists/drugs/urls -#var/ipfire/urlfilter/blacklists/drugs/urls.db -#var/ipfire/urlfilter/blacklists/gambling -#var/ipfire/urlfilter/blacklists/gambling/domains -#var/ipfire/urlfilter/blacklists/gambling/domains.db -#var/ipfire/urlfilter/blacklists/gambling/urls -#var/ipfire/urlfilter/blacklists/gambling/urls.db -#var/ipfire/urlfilter/blacklists/hacking -#var/ipfire/urlfilter/blacklists/hacking/domains -#var/ipfire/urlfilter/blacklists/hacking/domains.db -#var/ipfire/urlfilter/blacklists/hacking/urls -#var/ipfire/urlfilter/blacklists/hacking/urls.db -#var/ipfire/urlfilter/blacklists/mail -#var/ipfire/urlfilter/blacklists/mail/domains -#var/ipfire/urlfilter/blacklists/mail/domains.db -#var/ipfire/urlfilter/blacklists/porn -#var/ipfire/urlfilter/blacklists/porn/domains -#var/ipfire/urlfilter/blacklists/porn/domains.db -#var/ipfire/urlfilter/blacklists/porn/expressions -#var/ipfire/urlfilter/blacklists/porn/urls -#var/ipfire/urlfilter/blacklists/porn/urls.db -#var/ipfire/urlfilter/blacklists/proxy -#var/ipfire/urlfilter/blacklists/proxy/domains -#var/ipfire/urlfilter/blacklists/proxy/domains.db -#var/ipfire/urlfilter/blacklists/proxy/urls -#var/ipfire/urlfilter/blacklists/proxy/urls.db -#var/ipfire/urlfilter/blacklists/violence -#var/ipfire/urlfilter/blacklists/violence/domains -#var/ipfire/urlfilter/blacklists/violence/domains.db -#var/ipfire/urlfilter/blacklists/violence/expressions -#var/ipfire/urlfilter/blacklists/violence/urls -#var/ipfire/urlfilter/blacklists/violence/urls.db -#var/ipfire/urlfilter/blacklists/warez -#var/ipfire/urlfilter/blacklists/warez/domains -#var/ipfire/urlfilter/blacklists/warez/domains.db -#var/ipfire/urlfilter/blacklists/warez/urls -#var/ipfire/urlfilter/blacklists/warez/urls.db var/ipfire/urlfilter/settings var/ipfire/urlfilter/squidGuard.conf var/ipfire/urlfilter/version diff --git a/config/rootfiles/core/205/update.sh b/config/rootfiles/core/205/update.sh index 1c4acfbb0..a61f2ff7f 100644 --- a/config/rootfiles/core/205/update.sh +++ b/config/rootfiles/core/205/update.sh @@ -37,6 +37,17 @@ done rm -rfv \ /usr/local/bin/unboundctrl +# remove old installed blacklist entries from urlfilter +# The blacklist is no longer installed +if [ ! -e "/var/ipfire/urlfilter/blacklists/.autoupdate.last" ] && + [ -f "/var/ipfire/urlfilter/blacklists/README" ] && + grep -q "(squidGuardRobot)" "/var/ipfire/urlfilter/blacklists/README"; then + find /var/ipfire/urlfilter/blacklists -mindepth 1 \ + ! -path "/var/ipfire/urlfilter/blacklists/custom" \ + ! -path "/var/ipfire/urlfilter/blacklists/custom/*" \ + -exec rm -rf {} + +fi + # Extract files extract_files diff --git a/config/urlfilter/blacklists.tar.gz b/config/urlfilter/blacklists.tar.gz deleted file mode 100644 index dc21990be..000000000 Binary files a/config/urlfilter/blacklists.tar.gz and /dev/null differ diff --git a/lfs/squidguard b/lfs/squidguard index 8ad95c472..63eb39125 100644 --- a/lfs/squidguard +++ b/lfs/squidguard @@ -112,7 +112,7 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) cp -f $(DIR_CONF)/urlfilter/redirect_wrapper /usr/sbin chmod 755 /usr/sbin/redirect_wrapper - /bin/tar --no-same-owner -xzf $(DIR_CONF)/urlfilter/blacklists.tar.gz -C /var/ipfire/urlfilter + -mkdir -p /var/ipfire/urlfilter/blacklists /usr/bin/perl $(DIR_CONF)/urlfilter/makeconf.pl touch /var/ipfire/urlfilter/settings chown -R nobody:nobody /var/ipfire/urlfilter