fix: allow list group initialization with partial source failures (#1889)

* fix: allow list group initialization with partial source failures

When multiple list sources are configured for a blocking group, a
transient error (e.g., timeout) on one source no longer fails the
entire group if other sources loaded successfully.

Previously, any TransientError would cause the entire group to fail
initialization, even when other sources in the group had successfully
loaded entries. This left users without any DNS blocking functionality.

Now, groups succeed if at least one source loads successfully. Failed
sources will be retried on the next refresh cycle, maintaining blocking
functionality with available lists.

Fixes #1825

* fix: race condition

* fix lint error

Author: 0xERR0R

helpertest/mock_call_sequence.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"fmt"
 	"sync"
+	"sync/atomic"
 	"time"
 )
 
@@ -13,7 +14,7 @@ type MockCallSequence[T any] struct {
 	driver    func(chan<- T, chan<- error)
 	res       chan T
 	err       chan error
-	callCount uint
+	callCount atomic.Uint32
 	initOnce  sync.Once
 	closeOnce sync.Once
 }
@@ -25,7 +26,7 @@ func NewMockCallSequence[T any](driver func(chan<- T, chan<- error)) MockCallSeq
 }
 
 func (m *MockCallSequence[T]) Call() (T, error) {
-	m.callCount++
+	m.callCount.Add(1)
 
 	m.initOnce.Do(func() {
 		m.res = make(chan T)
@@ -67,7 +68,7 @@ func (m *MockCallSequence[T]) Call() (T, error) {
 }
 
 func (m *MockCallSequence[T]) CallCount() uint {
-	return m.callCount
+	return uint(m.callCount.Load())
 }
 
 func (m *MockCallSequence[T]) Close() {

lists/list_cache.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"fmt"
 	"net"
+	"sync/atomic"
 
 	"github.com/sirupsen/logrus"
 
@@ -177,12 +178,12 @@ func (b *ListCache) createCacheForGroup(
 		})
 	}
 
-	hasEntries := false
+	var hasEntries atomic.Bool
 
 	producers.GoConsume(func(ctx context.Context, ch <-chan string) error {
 		for host := range ch {
 			if groupFactory.AddEntry(host) {
-				hasEntries = true
+				hasEntries.Store(true)
 			} else {
 				logger().WithField("host", host).Warn("no list cache was able to use host")
 			}
@@ -192,18 +193,11 @@ func (b *ListCache) createCacheForGroup(
 	})
 
 	err := producers.Wait()
-	if err != nil {
-		if !hasEntries {
-			// Always fail the group if no entries were parsed
-			return err
-		}
-
-		var transientErr *TransientError
-
-		if errors.As(err, &transientErr) {
-			// Temporary error: fail the whole group to retry later
-			return err
-		}
+	if err != nil && !hasEntries.Load() {
+		// Only fail the group if no entries were parsed at all
+		// If we have entries from some sources, proceed even if other sources had errors
+		// Transient errors will be retried on the next refresh cycle
+		return err
 	}
 
 	groupFactory.Finish()

lists/list_cache_test.go

@@ -437,6 +437,68 @@ var _ = Describe("ListCache", func() {
 			})
 		})
 	})
+
+	Describe("multiple sources with transient error (issue #1825)", func() {
+		When("one source succeeds and another has a transient error", func() {
+			BeforeEach(func() {
+				// First source succeeds, second source has transient error (timeout)
+				mockDownloader = newMockDownloader(func(res chan<- string, err chan<- error) {
+					res <- "blocked1.com\nblocked2.com\n"
+					err <- &TransientError{inner: errors.New("Client.Timeout exceeded while awaiting headers")}
+				})
+
+				sutConfig.Strategy = config.InitStrategyFailOnError
+
+				lists = map[string][]config.BytesSource{
+					"gr1": {
+						mockDownloader.ListSource(), // First call succeeds with entries
+						mockDownloader.ListSource(), // Second call has transient error
+					},
+				}
+			})
+
+			It("should succeed with entries from the successful source", func() {
+				// This test reproduces the bug reported in issue #1825
+				// Currently this FAILS because transient errors cause the entire group to fail
+				// even when other sources loaded successfully
+				Expect(err).Should(Succeed(), "initialization should succeed when at least one source loads")
+				Expect(sut).ShouldNot(BeNil())
+
+				// Verify the successful source's entries are available
+				group := sut.Match("blocked1.com", []string{"gr1"})
+				Expect(group).Should(ContainElement("gr1"), "entries from successful source should be available")
+
+				group = sut.Match("blocked2.com", []string{"gr1"})
+				Expect(group).Should(ContainElement("gr1"), "entries from successful source should be available")
+			})
+		})
+
+		When("one source succeeds and another has a transient error with blocking strategy", func() {
+			BeforeEach(func() {
+				mockDownloader = newMockDownloader(func(res chan<- string, err chan<- error) {
+					res <- "blocked1.com\nblocked2.com\n"
+					err <- &TransientError{inner: errors.New("Client.Timeout exceeded while awaiting headers")}
+				})
+
+				sutConfig.Strategy = config.InitStrategyBlocking
+
+				lists = map[string][]config.BytesSource{
+					"gr1": {
+						mockDownloader.ListSource(),
+						mockDownloader.ListSource(),
+					},
+				}
+			})
+
+			It("should succeed with entries from the successful source", func() {
+				Expect(err).Should(Succeed(), "initialization should succeed when at least one source loads")
+				Expect(sut).ShouldNot(BeNil())
+
+				group := sut.Match("blocked1.com", []string{"gr1"})
+				Expect(group).Should(ContainElement("gr1"))
+			})
+		})
+	})
 })
 
 type MockDownloader struct {