Threat Shield IP: enterprise feeds skipped after upgrade from banIP 1.0

Steps to reproduce

Start from a registered (enterprise) unit running NethSecurity 8.8.0 with banip-1.0.1-r4 and ns-threat_shield-1.0.1-r1
Enable Threat Shield IP with the enterprise feeds (yoroimallvl1, yoroimallvl2, yoroisusplvl1, yoroisusplvl2, nethesislvl3) and check they are active: /etc/init.d/banip status
Upgrade the packages from the stable channel (both via UI or executing apk update && apk upgrade to install banip-1.8.10-r2 and ns-threat_shield-1.0.3-r1)
Check /etc/init.d/banip status and the system log

Expected behavior

After the upgrade, the selected enterprise feeds are rebuilt in the banIP 1.8 format and are loaded correctly also in nft banIP table.

Actual behavior

banIP skips every enterprise feed:

    ...
    banIP-1.8.10-r2: skip incomplete feed 'nethesislvl3'
    banIP-1.8.10-r2: skip incomplete feed 'yoroisusplvl2'
    ...

Only the allowlist.* and blocklist.* sets stay active. The UI still shows the feeds as selected, because it reads them from /etc/banip/banip.custom.feeds.

Workaround:

Execute the following command from the firewall CLI:

    /usr/sbin/ts-ip && /etc/init.d/banip reload

Components

Image version: NethSecurity 8.8.0

QA

Upgrading a broken machine

Log in to NethSecurity 8.8.0 without upgrading the available packages.
Register the firewall with a valid subscription.
Enable Threat Shield IP and select one or more premium feeds (Yoroi malware - Level 1, Yoroi malware - Level 2, Yoroi suspicious - Level 1, Yoroi suspicious - Level 2, Nethesis suspicious - Level 3).
Check /var/log/messages and the nft inet banIP table to verify that the IPs are correctly downloaded and imported into the configuration.
Upgrade all packages (banIP should now be at version 1.8.10).
Upgrade the ns_threat-shield package with the latest changes (either built locally and installed with the apk add command, or installed directly from the package repository).
Verify the configuration: it must be the same as before the upgrade.
Check /var/log/messages and the nft inet banIP table to verify that the IPs are correctly downloaded and imported into the configuration, and that no messages such as skip incomplete feed appear.

Other scenarios where banip and ns_threat-shield are upgraded simultaneously are also covered, since both packages run the ts-ip script on installation.

Tested with package upgrade:

cat > /etc/apk/repositories.d/98-overrides.list <<'EOF'
set repo_channel=dev
set version=8.8.0-dev.519.20261014143126.505effa
set endpoint=updates.nethsecurity.nethserver.org/${repo_channel}
EOF
apk update
apk upgrade

Lists are loaded only after /etc/init.d banip reloaded

Verified even if a reload is needed

Navigation Menu

Repository navigation

Threat Shield IP: enterprise feeds skipped after upgrade from banIP 1.0 #1921

QA

Upgrading a broken machine

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Threat Shield IP: enterprise feeds skipped after upgrade from banIP 1.0 #1921

Description

Activity

m-dilorenzi commented on Oct 7, 2026

QA

Upgrading a broken machine

gsanchietti commented on Oct 14, 2026

gsanchietti commented on Oct 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions