From patchwork Mon Oct 26 11:07:50 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Adam Gibbons X-Patchwork-Id: 10496 Return-Path: Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by web04.haj.ipfire.org (Postfix) with ESMTPS id 4jCrSy21vsz3wb2 for ; Mon, 26 Oct 2026 11:08:02 +0000 (UTC) Received: from mail02.haj.ipfire.org (mail02.haj.ipfire.org [IPv6:2001:678:b28::201]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519) (Client CN "mail02.haj.ipfire.org", Issuer "YE2" (not verified)) by mail01.ipfire.org (Postfix) with ESMTPS id 4jCrSy0Yj2z5fH for ; Mon, 26 Oct 2026 11:08:02 +0000 (UTC) Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4jCrSx5D3yz2xnN for ; Mon, 26 Oct 2026 11:08:01 +0000 (UTC) X-Original-To: development@lists.ipfire.org Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "YR1" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4jCrSn1HxYz2xMZ for ; Mon, 26 Oct 2026 11:07:53 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4jCrSl5Tjrz1Nb for ; Mon, 26 Oct 2026 11:07:51 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1793012871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uBc61R8T8MxTlgrXnoLBnz12cVPm/wqnW2Nk5rmI91Q=; b=H/mWK44cIHGLYHdKBr6ql3ugo7RCtQWZtd1ak7mAcB5nVsBOkU/byCJF87NyfIKhWiRl2V nYOMj73PiK2hKzCQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1793012871; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=uBc61R8T8MxTlgrXnoLBnz12cVPm/wqnW2Nk5rmI91Q=; b=uK7jYPECf+2uM+eWvoKY68pN5+M2XP8ss0/EIXIaraA/BdN9WlIUKcYigmbNeJi06EsNbg XY0Ppjts7yxeRXrU6AlVzyu09Y6/XhmwD3fOg3aYpy+lZExQZZdw8z5fnj0GmANqBwmxh7 ds6Mkzf9Vt1QqAJrKrfmuq8aHcw+HnpkuhDxBUlnjJN0GEtmTb+FDHrtebakcmoEtLq7/K ItJNBaJ2O0VSBue7iymaAQ+g2bL+QctrzQQM5ekU/Jq4Qe/aoBbIE8KZv4cJHvdjzuXbyW +goQeue5E6eiIyF5thziRbIrWrLtLKUwXKPEP5gzhSbRwsuAUUQqPPKoEAw2sg== Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Date: Mon, 26 Oct 2026 11:07:50 +0000 From: Adam Gibbons To: Development Subject: [PATCH] ruleset-sources: Require an Auth-Key for ThreatFox downloads Message-ID: <241bd42817b9c5a0a2f5384921da9d84@ipfire.org> X-Sender: adam.gibbons@ipfire.org Since 21 October 2026, ThreatFox file exports require an abuse.ch Auth-Key. News link: https://www.linkedin.com/posts/abuse-ch_authenticate-steadyplatform-steadysignal-activity-7518660733203832832-ohAX IPFire's ThreatFox provider still uses the unauthenticated download URL, which prevents ruleset updates. I have tested a two-line change that marks ThreatFox as requiring a subscription code and uses the authenticated v2 export URL. This reuses the existing WUI "Subscription Code" field, stored provider settings and URL substitution. Fixes bug report: https://bugzilla.ipfire.org/show_bug.cgi?id=14664 Signed-off-by: Adam Gibbons --- sid_range => ["91000000", "91999999"], }, diff --git a/config/suricata/ruleset-sources b/config/suricata/ruleset-sources index 3cef7c657..71d18c780 100644 --- a/config/suricata/ruleset-sources +++ b/config/suricata/ruleset-sources @@ -143,8 +143,8 @@ our %Providers = ( summary => "ThreatFox Indicators Of Compromise Rules", website => "https://threatfox.abuse.ch/", tr_string => "threatfox rules", - requires_subscription => "False", - dl_url => "https://threatfox.abuse.ch/downloads/threatfox_suricata.rules", + requires_subscription => "True", + dl_url => "https://threatfox-api.abuse.ch/v2/files/exports//threatfox_suricata.rules", dl_type => "plain",