Problems downloading custom rules in Suricata

darvin

Snort Rules Custom Download URL work fine. Here is local log from Apache Server:

192.168.1.1 - - [16/Dec/2020:13:52:59 -0500] "GET /snortrules-snapshot-29170.tar.gz.md5 HTTP/1.1" 200 4906 "-" "pfSense/2.4.5-RELEASE : 44454c4c-4300-1032-8031-cac04f433aaa"
192.168.1.1 - - [16/Dec/2020:13:52:59 -0500] "GET /snortrules-snapshot-29170.tar.gz HTTP/1.1" 200 132593762 "-" "pfSense/2.4.5-RELEASE : 44454c4c-4300-1032-8031-cac04f433aaa"

but Snort GPLv2 Custom Rule Download URL (Community rules) not download. Here is local log from Apache Server:
192.168.1.1 - - [16/Dec/2020:13:25:02 -0500] "GET /community-rules.tar.gz/md5 HTTP/1.1" 404 4961 "-" "pfSense/2.4.5-RELEASE : 44454c4c-4300-1032-8031-cac04f433aaa"

in GET log i see community-rules.tar.gz/md5 and it should be community-rules.tar.gz.md5

Can someone check if this also happens in Snort...
Any fix?

Impatient

@darvin
snortrules-snapshot-29170.tar.gz.md5
Snort on pfSense 2.5 and as far as I know the latest stable branch is 2.9.16.1 so perhap's
something has changed in the 2.9.17 branch.

darvin

[Solved]
Edit file /usr/local/pkg/suricata/suricata_check_for_rule_updates.php
Modify line 448: Remplace /md5 with .md5

bmeeks

@darvin said in Problems downloading custom rules in Suricata:

[Solved]
Edit file /usr/local/pkg/suricata/suricata_check_for_rule_updates.php
Modify line 448: Remplace /md5 with .md5

Good catch. Yes, that line is incorrect. Basically what that error will cause is new GPLv2 Community Rules will be downloaded with each periodic update check, whether there are actually new rules posted or not.

Anyway, I will see that it is fixed in the next release.

darvin

@bmeeks
Snort has the same problem...
Edit file /usr/local/pkg/snort/snort_check_for_rule_updates.php
Modify line 476: Remplace /md5 with .md5

Both need an update fix.

Update: (Snort AppID Open Text Rules)
Edit file /usr/local/pkg/snort/snort_check_for_rule_updates.php
Modify line 451: Remplace /md5 with .md5

bmeeks

@darvin said in Problems downloading custom rules in Suricata:

@bmeeks
Snort has the same problem...
Edit file /usr/local/pkg/snort/snort_check_for_rule_updates.php
Modify line 476: Remplace /md5 with .md5

Both need an update fix.

Update: (Snort AppID Open Text Rules)
Edit file /usr/local/pkg/snort/snort_check_for_rule_updates.php
Modify line 451: Remplace /md5 with .md5

Okay. Thanks!