From 23768090bbf32979d42a277f24cc17ff52cf7b6f Mon Sep 17 00:00:00 2001 From: Matteo Di Lorenzi Date: Wed, 7 Oct 2026 11:04:28 +0200 Subject: [PATCH 1/2] fix(banip): update installation scripts and add feed rebuilding logic --- packages/ns-threat_shield/Makefile | 3 ++- packages/ns-threat_shield/README.md | 4 ++++ .../files/banip-feeds-defaults | 21 +++++++++++++++++++ 3 files changed, 27 insertions(+), 1 deletion(-) create mode 100644 packages/ns-threat_shield/files/banip-feeds-defaults diff --git a/packages/ns-threat_shield/Makefile b/packages/ns-threat_shield/Makefile index 57740c7ca..18ee4544c 100644 --- a/packages/ns-threat_shield/Makefile +++ b/packages/ns-threat_shield/Makefile @@ -64,7 +64,8 @@ define Package/ns-threat_shield/install $(INSTALL_DIR) $(1)/etc/uci-defaults $(INSTALL_BIN) ./files/banip-defaults $(1)/etc/uci-defaults/99-nethsec-banip $(INSTALL_BIN) ./files/banip-extra-defaults $(1)/etc/uci-defaults/96-nethsec-banip-extra - $(INSTALL_BIN) ./files/banip-insights-defaults $(1)/etc/uci-defaults/97-nethsec-banip-insights + $(INSTALL_BIN) ./files/banip-feeds-defaults $(1)/etc/uci-defaults/97-nethsec-banip-feeds + $(INSTALL_BIN) ./files/banip-insights-defaults $(1)/etc/uci-defaults/98-nethsec-banip-insights $(INSTALL_BIN) ./files/35_ns-threat_shield $(1)/etc/uci-defaults/35_ns-threat_shield $(INSTALL_BIN) ./files/96_ns-threat_shield $(1)/etc/uci-defaults/96_ns-threat_shield gzip -9n $(1)/usr/share/threat_shield/nethesis-dns.sources diff --git a/packages/ns-threat_shield/README.md b/packages/ns-threat_shield/README.md index 2fe48b9a4..c4eef0fbe 100644 --- a/packages/ns-threat_shield/README.md +++ b/packages/ns-threat_shield/README.md @@ -25,6 +25,10 @@ The following categories require a valid entitlement: After machine registration, above categories will be automatically added to existing banip categories (`/etc/banip/banip.custom.feeds`). +On upgrade from banIP 1.0, apk can install banip before ns-threat_shield: the banip housekeeping then rebuilds +`banip.custom.feeds` from the old `banip.nethesis.feeds`, and banIP skips the enterprise feeds as incomplete. +The `97-nethsec-banip-feeds` uci-default rebuilds the file with `ts-ip` and reloads banIP when it is still in the old format (`rule_4`). + A special global allowlist will also be added to banip (`ban_allowurl` option). ### Examples diff --git a/packages/ns-threat_shield/files/banip-feeds-defaults b/packages/ns-threat_shield/files/banip-feeds-defaults new file mode 100644 index 000000000..7244e5e36 --- /dev/null +++ b/packages/ns-threat_shield/files/banip-feeds-defaults @@ -0,0 +1,21 @@ +#!/bin/sh + +# +# Copyright (C) 2026 Nethesis S.r.l. +# SPDX-License-Identifier: GPL-2.0-only +# + +# Rebuild the enterprise feeds left in the banIP 1.0 format (rule_4) by an upgrade. +# apk can install banip before ns-threat_shield: 95-banip-housekeeping then runs ts-ip +# with the old banip.nethesis.feeds, and banIP skips the enterprise feeds as incomplete. +# If banip.feeds is still in the old format banip is not updated yet, and its own +# housekeeping rebuilds the file later. +# This runs before 98-nethsec-banip-insights, which can run ts-ip too but does not reload banIP. + +grep -q '"rule_4"' /etc/banip/banip.custom.feeds 2>/dev/null || exit 0 +grep -q '"rule_4"' /etc/banip/banip.feeds && exit 0 + +/usr/sbin/ts-ip +/etc/init.d/banip enabled && /etc/init.d/banip reload + +exit 0 From 9ad6102fc4ae397af895b63b3166b3c0aeeba2ad Mon Sep 17 00:00:00 2001 From: Matteo Di Lorenzi Date: Wed, 7 Oct 2026 12:29:09 +0200 Subject: [PATCH 2/2] fix(banip): update banip feed handling and add new feed rebuilding script --- packages/ns-threat_shield/Makefile | 5 ++--- packages/ns-threat_shield/README.md | 4 ---- .../files/{banip-feeds-defaults => 97-nethsec-banip-feeds} | 3 +-- 3 files changed, 3 insertions(+), 9 deletions(-) rename packages/ns-threat_shield/files/{banip-feeds-defaults => 97-nethsec-banip-feeds} (80%) diff --git a/packages/ns-threat_shield/Makefile b/packages/ns-threat_shield/Makefile index 18ee4544c..d122b98cd 100644 --- a/packages/ns-threat_shield/Makefile +++ b/packages/ns-threat_shield/Makefile @@ -64,7 +64,7 @@ define Package/ns-threat_shield/install $(INSTALL_DIR) $(1)/etc/uci-defaults $(INSTALL_BIN) ./files/banip-defaults $(1)/etc/uci-defaults/99-nethsec-banip $(INSTALL_BIN) ./files/banip-extra-defaults $(1)/etc/uci-defaults/96-nethsec-banip-extra - $(INSTALL_BIN) ./files/banip-feeds-defaults $(1)/etc/uci-defaults/97-nethsec-banip-feeds + $(INSTALL_BIN) ./files/97-nethsec-banip-feeds $(1)/etc/uci-defaults/97-nethsec-banip-feeds $(INSTALL_BIN) ./files/banip-insights-defaults $(1)/etc/uci-defaults/98-nethsec-banip-insights $(INSTALL_BIN) ./files/35_ns-threat_shield $(1)/etc/uci-defaults/35_ns-threat_shield $(INSTALL_BIN) ./files/96_ns-threat_shield $(1)/etc/uci-defaults/96_ns-threat_shield @@ -75,8 +75,7 @@ endef define Package/ns-threat_shield/postinst #!/bin/sh if [ -z "$${IPKG_INSTROOT}" ]; then - (. /etc/uci-defaults/20_threat_shield) - rm -f /etc/uci-defaults/20_threat_shield + /etc/init.d/banip reload /etc/init.d/rsyslog restart /etc/init.d/cron restart fi diff --git a/packages/ns-threat_shield/README.md b/packages/ns-threat_shield/README.md index c4eef0fbe..2fe48b9a4 100644 --- a/packages/ns-threat_shield/README.md +++ b/packages/ns-threat_shield/README.md @@ -25,10 +25,6 @@ The following categories require a valid entitlement: After machine registration, above categories will be automatically added to existing banip categories (`/etc/banip/banip.custom.feeds`). -On upgrade from banIP 1.0, apk can install banip before ns-threat_shield: the banip housekeeping then rebuilds -`banip.custom.feeds` from the old `banip.nethesis.feeds`, and banIP skips the enterprise feeds as incomplete. -The `97-nethsec-banip-feeds` uci-default rebuilds the file with `ts-ip` and reloads banIP when it is still in the old format (`rule_4`). - A special global allowlist will also be added to banip (`ban_allowurl` option). ### Examples diff --git a/packages/ns-threat_shield/files/banip-feeds-defaults b/packages/ns-threat_shield/files/97-nethsec-banip-feeds similarity index 80% rename from packages/ns-threat_shield/files/banip-feeds-defaults rename to packages/ns-threat_shield/files/97-nethsec-banip-feeds index 7244e5e36..3a68fa012 100644 --- a/packages/ns-threat_shield/files/banip-feeds-defaults +++ b/packages/ns-threat_shield/files/97-nethsec-banip-feeds @@ -10,12 +10,11 @@ # with the old banip.nethesis.feeds, and banIP skips the enterprise feeds as incomplete. # If banip.feeds is still in the old format banip is not updated yet, and its own # housekeeping rebuilds the file later. -# This runs before 98-nethsec-banip-insights, which can run ts-ip too but does not reload banIP. +# The postinst reloads banIP after all the uci-defaults. grep -q '"rule_4"' /etc/banip/banip.custom.feeds 2>/dev/null || exit 0 grep -q '"rule_4"' /etc/banip/banip.feeds && exit 0 /usr/sbin/ts-ip -/etc/init.d/banip enabled && /etc/init.d/banip reload exit 0