Update fails with curl error CRYPT_E_REVOCATION_OFFLINE (0x80092013)

[Tmp341]

Version / Release:
IPFilter v4.4

Platform / OS:
Windows 10 Home 64-bit (10.0, Build 19045), Ubuntu 22.04.1 LTS (GNU/Linux 5.15.153.1-microsoft-standard-WSL2 x86_64), Git for Windows v2.45.2

Bug description:
Update starts, then script closes itself.

Steps to reproduce:
I'm not doing any special steps. Just double clicking on my script file. But it seems this error is being logged since the start of July.

Console output:

--------------- Started: Sun Aug  4 13:29:20 TSS 2024 ---------------
Downloading I-BlockList blocklists...
Downloading blocklist 'Pedophiles'...
curl: (35) schannel: next InitializeSecurityContext failed: CRYPT_E_REVOCATION_OFFLINE (0x80092013) - The revocation function was unable to check revocation because the revocation server was offline.
An error occured while updating, aborting.

Solution:
I was creating this issue, but i also found a solution for this. Adding "--ssl-no-revoke" at this line fixes the problem:

ipfilter/ipfilter.conf

Line 43 in e22359f

CURL_OPTS=("--fail" "--location" "--silent" "--show-error" "--retry" "2" "--connect-timeout" "60")

[fonic]

Thank you for reporting this.

That error indicates that curl fails to verify whether the connection to I-Blocklist (via URL https://list.iblocklist.com/) actually is secure or not.

Even though adding --ssl-no-revoke to CURL_OPTS in ipfilter.conf might be a quick and tempting workaround (*), the real question is why does this check fail. Could be that your connection is somehow partially blocked (e.g. by a firewall or even malware), could be that I-BlockList changed something on their end.

I'm currently unable to reproduce the error, thus we'll have to wait and see if there are other users with the same issue.

---

(*) Be aware that using option --ssl-no-revoke significantly lessens your security:

--ssl-no-revoke
    (TLS) (Schannel) Disable certificate revocation checks. WARNING: this option loosens the
    SSL security, and by using this flag you ask for exactly that.

For that very reason, I'll reject the pull request.

[Tmp341]

Well, i know removing SSL check is harmful, but i somehow couldn't pass an invisible block without this. I can open I-Blocklist site on my browsers. I should check other methods to see if my IP partially blocked to use via this automated script.

[fonic]

We'll leave this open for now, in case other users with the same issue come here looking for answers.

[fonic]

Well, i know removing SSL check is harmful, but i somehow couldn't pass an invisible block without this. I can open I-Blocklist site on my browsers. I should check other methods to see if my IP partially blocked to use via this automated script.

What happens when you open https://list.iblocklist.com/ (this exact URL) in a browser?

[Tmp341]

What happens when you open https://list.iblocklist.com/ (this exact URL) in a browser?

Leads me to https://list.iblocklist.com/humantest?.
And completing the test leads me to https://list.iblocklist.com/?, which shows:
Bad request; list unavailable

[fonic]

What happens when you open https://list.iblocklist.com/ (this exact URL) in a browser?

Leads me to https://list.iblocklist.com/humantest

That might be the cause. Maybe they're doing some redirection stuff that curl doesn't like.

You could try to solve the captcha and then run the script again without --ssl-no-revoke (both from the same machine) and check if that changes anything.

[Tmp341]

That might be the cause. Maybe they're doing some redirection stuff that curl doesn't like.

You could try to solve the captcha and then run the script again without --ssl-no-revoke (both from the same machine) and check if that changes anything.

Tried again with this method. First try, no problem:

"IP filter successfully updated."

[fonic]

Tried again with this method. First try, no problem:

"IP filter successfully updated."

So just to make sure: you solved the captcha, then ran the script without --ssl-no-revoke and it worked?

That would indicate that I-BlockList is using some sort of IP-based blocking with redirection to captcha.