Page MenuHomePhabricator

Local Special:GlobalBlockStatus does not work at all
Closed, ResolvedPublic

Description

When trying to locally unblock 2001:41D0:0:0:0:0:0:0/40 (globally blocked) at pl.wp (https://pl.wikipedia.org/wiki/Specjalna:Lokalny_status_globalnych_blokad) I get the following error:

Your change to the local status of a global block was unsuccessful, for the following reason:
You made no change to the local status of this block. Return to the global block list.

I can confirm the block by unchecking the checkbox – this works, but when trying to unblock again I get the same message. The block itself is not being lifted, of course.

IPv6-related?


Version: unspecified
Severity: critical

Details

Reference
bz54496
Related Gerrit Patches:
mediawiki/extensions/GlobalBlocking : masterAdd script to fix broken global block whitelist entries
mediawiki/extensions/GlobalBlocking : masterDo UPDATE instead of DELETE+INSERT when modifying a global block

Event Timeline

bzimport raised the priority of this task from to High.Nov 22 2014, 2:13 AM
bzimport added projects: GlobalBlocking, IPv6.
bzimport set Reference to bz54496.
bzimport added a subscriber: Unknown Object (MLST).
matmarex created this task.Sep 24 2013, 9:37 AM

I can confirm the listing is in the DB

mysql:wikiadmin@db1036 [plwiki]> select * from global_block_whitelist where gbw_address like '2001%';
+--------+--------------------------+--------+-------------+------------+----------------+

gbw_idgbw_addressgbw_bygbw_by_textgbw_reasongbw_expiry

+--------+--------------------------+--------+-------------+------------+----------------+

256822001:41D0:0:0:0:0:0:0/4077940MastiToolserver20140530153054

+--------+--------------------------+--------+-------------+------------+----------------+
1 row in set (0.00 sec)

But IP's are still being blocked from that range?

(In reply to comment #1)

But IP's are still being blocked from that range?

I wonder if that was a question to MatmaRex...

(In reply to comment #2)

(In reply to comment #1)

But IP's are still being blocked from that range?

I wonder if that was a question to MatmaRex...

Sorry, yeah. MatmaRex, can you confirm that ipv6 addresses in that range were still being blocked?

Oh, and again for MatmaRex, could you check that if the blocked users are coming from those addresses directly, or if it's an XFF block?

(In reply to comment #3)

Sorry, yeah. MatmaRex, can you confirm that ipv6 addresses in that range were
still being blocked?

Editing from that IP range was still not possible after I tried to unblock it, yes.

(In reply to comment #4)

Oh, and again for MatmaRex, could you check that if the blocked users are
coming from those addresses directly, or if it's an XFF block?

No idea how I could check that. (I am not a checkuser nor a global sysop.)

(The range includes the Wikimedia Poland Toolserver – tools.wikimedia.pl, which is where I was trying to edit from when I encountered this. Not sure if this answers your question.)

I was trying to reproduce this on a dev instance, but I'm unable to do that. The whitelist seems to be working just fine for ipv6.

Is the affected user a bot, since this is on a tools server? Can you give any more details? A capture of the headers? Or of the actual error message, which would verify if this is the IP or an xff block?

(In reply to comment #7)

Is the affected user a bot, since this is on a tools server?

When I filed this bug, the block affected logged-in users as well; this was since changed to just anonymous, so this is not troublesome.

I just tried again:

I get the following red error:

Your change to the local status of a global block was unsuccessful, for
the following reason:

You made no change to the local status of this block. Return to the global
block list.

It is still not possible to anonymously edit pl.wp from tools.wikimedia.pl
(I tried via Lynx while being SSH-d there) – it's in English, even though the wiki language is Polish:

Your IP address has been blocked on all wikis.

The block was made by Matanya (meta.wikimedia.org). The reason given is
abused web hosting. ovh.com.
  * Start of block: 10:32, 24 wrz 2013            // == 2013-09-24
  * Expiry of block: 20:40, 22 mar 2014           // == 2014-03-22

Your current IP address is 2001:41d0:2:7530::2000. Please include all
above details in any queries you make.

We could probably get you an account on the toolserver if you're interested in testing yourself :) (CC-ing Saper who is an admin there.)

csteipp: Is the information in comment 8 sufficient, or do you need more?

I think I'll need to actually play with it a bit, I'm not able to reproduce this locally.

Saper, is it possible to get an account there that I can bounce through to see what's happening?

saper added a comment.Nov 22 2013, 7:09 PM

Chris, I just need your public SSH key.

Hopefully we can trust that my bugzilla account is me:

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDOjXk3AOCJUGvRwZcnFxCKHZqxkwpr53ZX4atkFzeB7uBnGoyyhYHstD5X56THqF4o3Mg5y7kK1YrdbFyKAenHPXh06AAIck5FecLVoc9HPyUbnicuC7kelQHgzox/41RzfmnFyAjoelOgXG/rFj6iFy3+WCbFL9RdGXcbUPK457u8IMgJS/Bvsze5x0KTVyU464aAHfkuWNepAaWinUgJAjJZ0aM8iJS2/dC3wfZMNHS2+k1oqKNhR0E+G87YcHtobyXZ6Qke0XR5fpP0ncUZCelYXtUNHrkqEk2h2NS93eUuku5vgSiio6UCoRgBDPKwnf1/jnxKuCe0RzFaaDAd csteipp@linux-hv06.site

We're interested in a person posing as csteipp online, not some real Chris :)

Ok, so the root of the issue is that the block whitelist is linked to a non-existent block. The whitelisting is mostly based on block id numbers.

The whitelist prevents global block 25682 from applying, which doesn't exist. The block by Matanya was gb_id 30986.

So deleting and re-issuing the whitelist should work. I'm guessing the global block was issued, the whitelist was created, and then someone re created the global block, so it got a new id number.

Aklapper lowered the priority of this task from High to Low.Oct 5 2015, 8:27 AM
Aklapper added a subscriber: Aklapper.

So deleting and re-issuing the whitelist should work. I'm guessing the global block was issued, the whitelist was created, and then someone re created the global block, so it got a new id number.

Workaround available; lowering priority.

Our ruwiki admin OneLittleMouse encountered a similar issue with unblocking 188.32.0.0/16 and 77.37.128.0/18.

Glaisher raised the priority of this task from Low to Normal.Apr 24 2016, 5:15 PM
Glaisher added a subscriber: Glaisher.

Workaround available; lowering priority.

Even if workaround is available, users using the whitelist and users who do the blocks won't necessarily be aware of this bug (which isn't a trivial bug).

Glaisher removed a subscriber: wikibugs-l-list.

Change 285081 had a related patch set uploaded (by Glaisher):
Do UPDATE instead of DELETE INSERT when modifying a global block

https://gerrit.wikimedia.org/r/285081

Change 285081 merged by jenkins-bot:
Do UPDATE instead of DELETE INSERT when modifying a global block

https://gerrit.wikimedia.org/r/285081

Fixed?

The above patch only prevents new entries from getting hit by this bug. I will try to work on a script to fix the existing entries soon-ish.

Change 285217 had a related patch set uploaded (by Glaisher):
Add script to fix broken global block whitelist entries

https://gerrit.wikimedia.org/r/285217

Change 285217 merged by jenkins-bot:
Add script to fix broken global block whitelist entries

https://gerrit.wikimedia.org/r/285217

Glaisher assigned this task to Legoktm.May 11 2016, 10:06 AM
Glaisher added a subscriber: Legoktm.

Ping @Legoktm as he said he will run the script.

legoktm@terbium:~$ grep "Whitelist broken" fgbw-dry-run.log 
dewiki:   Whitelist broken 212.227.0.0/16: current gb_id is 31327
enwiki:   Whitelist broken 188.29.164.0/23: current gb_id is 58201
enwiki:   Whitelist broken 208.53.128.0/18: current gb_id is 35012
enwiki:   Whitelist broken 5.135.0.0/16: current gb_id is 34686
enwiki:   Whitelist broken 69.162.64.0/18: current gb_id is 28514
eswikiquote:   Whitelist broken 176.31.0.0/16: current gb_id is 58963
frwiki:   Whitelist broken 107.170.0.0/16: current gb_id is 51130
frwiki:   Whitelist broken 195.154.128.0/17: current gb_id is 58803
frwiki:   Whitelist broken 212.129.0.0/18: current gb_id is 58792
frwiki:   Whitelist broken 62.210.128.0/17: current gb_id is 58798
pswiki:   Whitelist broken 178.62.0.0/17: current gb_id is 49603
ptwiki:   Whitelist broken 107.170.0.0/16: current gb_id is 51130
trwiki:   Whitelist broken 173.254.0.0/17: current gb_id is 58444
legoktm@terbium:~$ mwscript ../../../../../../home/legoktm/fixGlobalBlockWhitelist.php --wiki=dewiki --delete=1
Found 1 broken whitelist entries.
 Fixed 212.227.0.0/16: id changed to 31327
Finished processing broken whitelist entries.
Found 5 whitelist entries with no corresponding global blocks:
178.198.24.98
212.149.48.43
81.173.210.73
95.172.88.5
2003:68:E800:0:0:0:0:0/37
Finished deleting whitelist entries with no corresponding global blocks.
legoktm@terbium:~$ mwscript ../../../../../../home/legoktm/fixGlobalBlockWhitelist.php --wiki=enwiki --delete=1
Found 4 broken whitelist entries.
 Fixed 188.29.164.0/23: id changed to 58201
 Fixed 208.53.128.0/18: id changed to 35012
 Fixed 5.135.0.0/16: id changed to 34686
 Fixed 69.162.64.0/18: id changed to 28514
Finished processing broken whitelist entries.
Found 22 whitelist entries with no corresponding global blocks:
38.99.180.126
66.249.85.133
96.225.223.99
85.158.139.228
72.14.194.1
203.116.198.69
85.158.139.227
85.158.138.20
85.158.139.100
85.158.138.21
85.158.138.19
78.40.239.4
24.171.168.223
98.77.0.0/17
222.166.181.0/24
93.186.31.82
220.255.2.172
204.93.32.0/19
162.96.105.84
129.78.233.210
69.71.1.1
172.56.0.0/18
Finished deleting whitelist entries with no corresponding global blocks.
legoktm@terbium:~$ mwscript ../../../../../../home/legoktm/fixGlobalBlockWhitelist.php --wiki=eswikiquote --delete=1
Found 1 broken whitelist entries.
 Fixed 176.31.0.0/16: id changed to 58963
Finished processing broken whitelist entries.
All whitelist entries have corresponding global blocks.
legoktm@terbium:~$ mwscript ../../../../../../home/legoktm/fixGlobalBlockWhitelist.php --wiki=frwiki --delete=1
Found 4 broken whitelist entries.
 Fixed 107.170.0.0/16: id changed to 51130
 Fixed 195.154.128.0/17: id changed to 58803
 Fixed 212.129.0.0/18: id changed to 58792
 Fixed 62.210.128.0/17: id changed to 58798
Finished processing broken whitelist entries.
Found 4 whitelist entries with no corresponding global blocks:
210.136.3.18
221.186.143.131
194.126.21.9
2001:41D0:0:0:0:0:0:0/32
Finished deleting whitelist entries with no corresponding global blocks.
legoktm@terbium:~$ mwscript ../../../../../../home/legoktm/fixGlobalBlockWhitelist.php --wiki=pswiki --delete=1
Found 1 broken whitelist entries.
 Fixed 178.62.0.0/17: id changed to 49603
Finished processing broken whitelist entries.
Found 1 whitelist entries with no corresponding global blocks:
180.94.64.0/19
Finished deleting whitelist entries with no corresponding global blocks.
legoktm@terbium:~$ mwscript ../../../../../../home/legoktm/fixGlobalBlockWhitelist.php --wiki=ptwiki --delete=1
Found 1 broken whitelist entries.
 Fixed 107.170.0.0/16: id changed to 51130
Finished processing broken whitelist entries.
All whitelist entries have corresponding global blocks.
legoktm@terbium:~$ mwscript ../../../../../../home/legoktm/fixGlobalBlockWhitelist.php --wiki=trwiki --delete=1
Found 1 broken whitelist entries.
 Fixed 173.254.0.0/17: id changed to 58444
Finished processing broken whitelist entries.
All whitelist entries have corresponding global blocks.

Mentioned in SAL [2016-05-27T23:44:49Z] <legoktm> ran extensions/GlobalBlocking/fixGlobalBlockWhitelist.php for T56496

Legoktm reassigned this task from Legoktm to Glaisher.May 27 2016, 11:45 PM

Once https://gerrit.wikimedia.org/r/291375 is merged, I think we can call this done.

Glaisher closed this task as Resolved.May 28 2016, 8:50 AM

Thanks a lot.