os-intrusion-detection-content-et-open: still downloads the suricata-7.0 ruleset on Suricata 8, 14 current ET Open rules missing

Abierto Apto para principiantes
  • ¿Algo no está bien?
#5,924 0 comentarios 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@juergen2025sys ya está trabajando en esto.

Desde el 14/11/2026.

  • #5927 de @juergen2025sys — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
74/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
xml
Área
security

Línea de trabajo

Empieza en security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml. Cambia las URL location y version de suricata-7.0 a suricata-8.0 y luego añade las cinco nuevas categorías a la lista de archivos, usando el mismo patrón de prefijo et_open. que las entradas existentes. Está terminado cuando el XML se analiza correctamente y todos los archivos .rules del tarball 8.0 aparecen en la lista. Ten en cuenta que rule-updater.py puede omitir la descarga de archivos sin cambios, lo que el issue describe como un problema aparte.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Important notices

  • I have read the contributing guide lines
  • I have searched the existing issues, open and closed, and I'm convinced that mine is new.
  • The title contains the plugin to which this issue belongs

Describe the bug

Core et-open.xml downloads the ET Open ruleset for Suricata 8 (.../open/suricata-8.0/emerging.rules.tar.gz). The complementary plugin for ET Pro Telemetry users (os-intrusion-detection-content-et-open, file security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml) still points to the Suricata 7 tarball:

<location url="https://rules.emergingthreats.net/open/suricata-7.0/emerging.rules.tar.gz" prefix="ET open"/>
<version url="https://rules.emergingthreats.net/open/suricata-7.0/version.txt"/>

The plugin was last changed in 2024 (PLUGIN_VERSION 1.0.2). Since ET restructured the Suricata 8 tarball, users of ET Pro Telemetry plus this plugin get an outdated ruleset on Suricata 8:

  1. 14 SIDs exist only in the suricata-8.0 tarball (same ET version 11334). On my system they are missing completely, because ET Telemetry (emerging-*) does not contain them either. Examples:
    • 2055641 / 2055644 ET EXPLOIT Microsoft Windows IPv6 (CVE-2024-38063)
    • 2061633 / 2061634 ET MALWARE zgRAT / PureLogs CnC
    • 2066447 ET EXPLOIT FreeBSD rtsold DNSSL Remote Code Execution (CVE-2025-14558)
    • 2060259–2060266 ET MALWARE implant.js CnC
    • 2071869 ET EXPLOIT Traefik Authentication Bypass
  2. About 40% of the shared rules differ between the 7.0 and 8.0 builds (sample: 162 of 400 SIDs). The 8.0 variants are the ones ET maintains for the Suricata 8 engine.
  3. The Suricata 8 tarball uses new categories that are not in the plugin's file list: emerging-dyn_dns, emerging-file_sharing, emerging-remote_access, emerging-retired, emerging-ta_abused_services. Most former emerging-policy rules moved to emerging-info (1079), emerging-dyn_dns (84), emerging-remote_access (13) and emerging-file_sharing (6). emerging-icmp_info was merged into emerging-icmp.

To Reproduce

for v in 7.0 8.0; do
  fetch -o et$v.tgz https://rules.emergingthreats.net/open/suricata-$v/emerging.rules.tar.gz
  mkdir x$v && tar -xzf et$v.tgz -C x$v
  cat x$v/rules/*.rules | grep -E '^#? ?(alert|drop)' | grep -oE 'sid:[0-9]+;' | sort -u > s$v.txt
done
comm -13 s7.0.txt s8.0.txt   # 14 SIDs only in 8.0
comm -23 s7.0.txt s8.0.txt   # 1 SID only in 7.0

Proposed fix

Switch both URLs to suricata-8.0 and add the five new categories, prefixed with et_open. like the existing entries. The obsolete entries (3coresec, emerging-icmp_info, emerging-policy) are kept, just like core et-open.xml still lists them. Missing files in the tarball are ignored by the downloader.

-    <location url="https://rules.emergingthreats.net/open/suricata-7.0/emerging.rules.tar.gz" prefix="ET open"/>
-    <version url="https://rules.emergingthreats.net/open/suricata-7.0/version.txt"/>
+    <location url="https://rules.emergingthreats.net/open/suricata-8.0/emerging.rules.tar.gz" prefix="ET open"/>
+    <version url="https://rules.emergingthreats.net/open/suricata-8.0/version.txt"/>
...
+        <file description="emerging-dyn_dns" url="inline::rules/emerging-dyn_dns.rules">et_open.emerging-dyn_dns.rules</file>
+        <file description="emerging-file_sharing" url="inline::rules/emerging-file_sharing.rules">et_open.emerging-file_sharing.rules</file>
+        <file description="emerging-remote_access" url="inline::rules/emerging-remote_access.rules">et_open.emerging-remote_access.rules</file>
+        <file description="emerging-retired" url="inline::rules/emerging-retired.rules">et_open.emerging-retired.rules</file>
+        <file description="emerging-ta_abused_services" url="inline::rules/emerging-ta_abused_services.rules">et_open.emerging-ta_abused_services.rules</file>

Checked:

  • The patched XML parses. With it, every .rules file in the 8.0 tarball is listed (0 missing).
  • suricata -T (Suricata 8.0.8, OPNsense config) on the complete suricata-8.0 ruleset: exit 0, no parse errors.
  • Applied on my system: all 14 previously missing SIDs are now loaded and active.

Additional finding: after only switching the URL, rule-updater.py does not re-download the existing et_open.* files. The local version hash is based on version.txt, which is identical for suricata-7.0 and suricata-8.0 (both 11334), so the updater logs download skipped et_open.*.rules, same version. On my system the 8.0 content was only installed after removing the old source files in /usr/local/etc/suricata/rules/et_open.*.rules. Without that, the switch only takes effect with the next ET release. A plugin revision bump/changelog note, or including the source URL in the stored hash, would avoid this.

Note for users after the update: rules that were enabled through et_open.emerging-policy now live in the new categories (mostly et_open.emerging-info), so ruleset selections and policies may need to be adjusted.

Environment

OPNsense 26.7.9_1 (amd64), Suricata 8.0.8 (IPS, netmap)
os-intrusion-detection-content-et-open 1.0.2_2
os-etpro-telemetry 1.8_3

AI disclosure

This report and the proposed fix were prepared with the help of an AI assistant (Claude). The analysis was done on my own OPNsense system: the SID comparison, the suricata -T test and the applied fix were run on my firewall. I reviewed the report before submitting.

Lenguaje dominante
PHP
Estrellas
1.2k
Forks
909
Merge medio
1 d 23 h
PR fusionados (30 d)
17

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de opnsense/plugins

Todos los issues de opnsense/plugins

Issues similares

Más issues de PHP

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.