os-intrusion-detection-content-et-open: still downloads the suricata-7.0 ruleset on Suricata 8, 14 current ET Open rules missing

Aperta Adatta ai principianti
  • Qualcosa non va?
#5,924 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
74/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
xml
Ambito
security

Direzione di ricerca

Inizia da security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml. Cambia gli URL location e version da suricata-7.0 a suricata-8.0, quindi aggiungi le cinque nuove categorie all'elenco dei file usando lo stesso schema di prefisso et_open. delle voci esistenti. È completato quando l'XML viene analizzato correttamente e tutti i file .rules nel tarball 8.0 sono elencati. Nota che rule-updater.py potrebbe saltare il nuovo download dei file non modificati, cosa che la issue descrive come un problema separato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Important notices

  • I have read the contributing guide lines
  • I have searched the existing issues, open and closed, and I'm convinced that mine is new.
  • The title contains the plugin to which this issue belongs

Describe the bug

Core et-open.xml downloads the ET Open ruleset for Suricata 8 (.../open/suricata-8.0/emerging.rules.tar.gz). The complementary plugin for ET Pro Telemetry users (os-intrusion-detection-content-et-open, file security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml) still points to the Suricata 7 tarball:

<location url="https://rules.emergingthreats.net/open/suricata-7.0/emerging.rules.tar.gz" prefix="ET open"/>
<version url="https://rules.emergingthreats.net/open/suricata-7.0/version.txt"/>

The plugin was last changed in 2024 (PLUGIN_VERSION 1.0.2). Since ET restructured the Suricata 8 tarball, users of ET Pro Telemetry plus this plugin get an outdated ruleset on Suricata 8:

  1. 14 SIDs exist only in the suricata-8.0 tarball (same ET version 11334). On my system they are missing completely, because ET Telemetry (emerging-*) does not contain them either. Examples:
    • 2055641 / 2055644 ET EXPLOIT Microsoft Windows IPv6 (CVE-2024-38063)
    • 2061633 / 2061634 ET MALWARE zgRAT / PureLogs CnC
    • 2066447 ET EXPLOIT FreeBSD rtsold DNSSL Remote Code Execution (CVE-2025-14558)
    • 2060259–2060266 ET MALWARE implant.js CnC
    • 2071869 ET EXPLOIT Traefik Authentication Bypass
  2. About 40% of the shared rules differ between the 7.0 and 8.0 builds (sample: 162 of 400 SIDs). The 8.0 variants are the ones ET maintains for the Suricata 8 engine.
  3. The Suricata 8 tarball uses new categories that are not in the plugin's file list: emerging-dyn_dns, emerging-file_sharing, emerging-remote_access, emerging-retired, emerging-ta_abused_services. Most former emerging-policy rules moved to emerging-info (1079), emerging-dyn_dns (84), emerging-remote_access (13) and emerging-file_sharing (6). emerging-icmp_info was merged into emerging-icmp.

To Reproduce

for v in 7.0 8.0; do
  fetch -o et$v.tgz https://rules.emergingthreats.net/open/suricata-$v/emerging.rules.tar.gz
  mkdir x$v && tar -xzf et$v.tgz -C x$v
  cat x$v/rules/*.rules | grep -E '^#? ?(alert|drop)' | grep -oE 'sid:[0-9]+;' | sort -u > s$v.txt
done
comm -13 s7.0.txt s8.0.txt   # 14 SIDs only in 8.0
comm -23 s7.0.txt s8.0.txt   # 1 SID only in 7.0

Proposed fix

Switch both URLs to suricata-8.0 and add the five new categories, prefixed with et_open. like the existing entries. The obsolete entries (3coresec, emerging-icmp_info, emerging-policy) are kept, just like core et-open.xml still lists them. Missing files in the tarball are ignored by the downloader.

-    <location url="https://rules.emergingthreats.net/open/suricata-7.0/emerging.rules.tar.gz" prefix="ET open"/>
-    <version url="https://rules.emergingthreats.net/open/suricata-7.0/version.txt"/>
+    <location url="https://rules.emergingthreats.net/open/suricata-8.0/emerging.rules.tar.gz" prefix="ET open"/>
+    <version url="https://rules.emergingthreats.net/open/suricata-8.0/version.txt"/>
...
+        <file description="emerging-dyn_dns" url="inline::rules/emerging-dyn_dns.rules">et_open.emerging-dyn_dns.rules</file>
+        <file description="emerging-file_sharing" url="inline::rules/emerging-file_sharing.rules">et_open.emerging-file_sharing.rules</file>
+        <file description="emerging-remote_access" url="inline::rules/emerging-remote_access.rules">et_open.emerging-remote_access.rules</file>
+        <file description="emerging-retired" url="inline::rules/emerging-retired.rules">et_open.emerging-retired.rules</file>
+        <file description="emerging-ta_abused_services" url="inline::rules/emerging-ta_abused_services.rules">et_open.emerging-ta_abused_services.rules</file>

Checked:

  • The patched XML parses. With it, every .rules file in the 8.0 tarball is listed (0 missing).
  • suricata -T (Suricata 8.0.8, OPNsense config) on the complete suricata-8.0 ruleset: exit 0, no parse errors.
  • Applied on my system: all 14 previously missing SIDs are now loaded and active.

Additional finding: after only switching the URL, rule-updater.py does not re-download the existing et_open.* files. The local version hash is based on version.txt, which is identical for suricata-7.0 and suricata-8.0 (both 11334), so the updater logs download skipped et_open.*.rules, same version. On my system the 8.0 content was only installed after removing the old source files in /usr/local/etc/suricata/rules/et_open.*.rules. Without that, the switch only takes effect with the next ET release. A plugin revision bump/changelog note, or including the source URL in the stored hash, would avoid this.

Note for users after the update: rules that were enabled through et_open.emerging-policy now live in the new categories (mostly et_open.emerging-info), so ruleset selections and policies may need to be adjusted.

Environment

OPNsense 26.7.9_1 (amd64), Suricata 8.0.8 (IPS, netmap)
os-intrusion-detection-content-et-open 1.0.2_2
os-etpro-telemetry 1.8_3

AI disclosure

This report and the proposed fix were prepared with the help of an AI assistant (Claude). The analysis was done on my own OPNsense system: the SID comparison, the suricata -T test and the applied fix were run on my firewall. I reviewed the report before submitting.

Lingua principale
PHP
Stelle
1.2k
Fork
909
Merge medio
1g 23h
PR unite (30g)
17

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di opnsense/plugins

Tutte le issue di opnsense/plugins

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.