Re: [PATCH] Suricata rule: Antiphishing fix url for datasets and sids information

[Adolf Belka <adolf.belka@ipfire.org>]

Tested-by: Adolf Belka <adolf.belka@ipfire.org>


On 31/10/2026 20:48, Adolf Belka wrote:
> Hi All,
> 
> This patch is related to https://bugzilla.ipfire.org/show_bug.cgi?id=14616
> 
> I reported the issue into the julioliraup github issues#13 and this patch is the proposed solution which is to have a tailored rules tarball for IPFire in the same way as for other firewalls.
> 
> The commit for the creation of an IPFire specific tarball is https://github.com/julioliraup/Antiphishing/commit/c674976b3f0818db11aa9c920dd1162a136d47f6
> 
> Many thanks julioliraup for the speedy response on this.
> 
> Regards,
> 
> Adolf.
> 
> On 31/10/2026 18:59, jul10l1r4@disroot.org wrote:
>>  From d5cb2a1c4156ef830e49d92679b4038739620808 Mon Sep 17 00:00:00 2001
>> From: jul10l1r4 <jul10l1r4@disroot.org>
>> Date: Sat, 31 Oct 2026 14:46:43 -0300
>> Subject: [PATCH] Suricata rule: Antiphishing fix url for datasets and sids information
>>
>> ---
>>   config/suricata/ruleset-sources | 3 ++-
>>   1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources
>> index 71d18c780..ff1289902 100644
>> --- a/config/suricata/ruleset-sources
>> +++ b/config/suricata/ruleset-sources
>> @@ -166,9 +166,10 @@ our %Providers = (
>>           website => "https://github.com/julioliraup/Antiphishing",
>>           tr_string => "julioliraup/Antiphishing for protect against phishing attack",
>>           requires_subscription => "False",
>> -        dl_url => "https://raw.githubusercontent.com/julioliraup/Antiphishing/refs/heads/main/antiphishing.tar.gz",
>> +        dl_url => "https://raw.githubusercontent.com/julioliraup/Antiphishing/refs/heads/main/antiphishing-ipfire.tar.gz",
>>           dl_type => "archive",
>>           sid_range => ["6000000", "6100000"],
>> +        sid_info_url => "https://julioliraup.github.io/AT/signature.html?sid=<sid>",
>>       },
>>
>>       ipfire_dbl => {
>