Suricata et-open-extra missing rules

[0nnyx]

Important notices Our forum is located at https://forum.opnsense.org , please consider joining discussions there in stead of using GitHub for these matters.

Before you ask a new question, we ask you kindly to acknowledge the following:

• [x] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
• [x] I have searched the existing issues, open and closed, and I'm convinced that mine is new.

After upgrade to 24.1, I was expecting to see my PR #3644 working. Despite the minor changes involved, 24.1 doesn't show all ET Open rules when installed, but only 3coresec and threatview_CS_c2 while the PR includes many more. No clue why they are not populated on ui/ids#download_settings.

[AdSchellevis]

@0nnyx I assumed you tested the xml earlier to be honest, can you re-add the et_open- prefixes in the keys?

e.g

<file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules">botcc.portgrouped.rules</file>

should look like:

<file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules">et_open-botcc.portgrouped.rules</file>

[0nnyx]

@AdSchellevis Right, the prefix must be the cause. But which one is it exactly ? et_open- or et_open. ?

<file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules">et_open-botcc.portgrouped.rules</file>
<file description="botcc" url="inline::rules/botcc.rules">et_open.botcc.rules</file>

[AdSchellevis]

@0nnyx I would go for the et_open. variant as most of the previous ones used these.

[0nnyx]

From the logic, seems to be "et_open-" when the rule name contains a "." already and it's "et_open." otherwise. Just submitted a PR #3794 with "et_open." except for the "botcc.portgrouped". Feel free to correct it

[0nnyx]

Just did another PR #3795 after testing and now it's all fine. It was my first PR here and I thought you would do some testing before approval.