so-rule-update error

[jgiuliano63]

When I run so-rule-update on master node I get back this error. Oink code removed

Fetching https://rules.emergingthreatspro.com/xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/suricata-6.0.0/etpro.rules.tar.gz.
Traceback (most recent call last):
File "/usr/local/bin/idstools-rulecat", line 12, in
sys.exit(main())
File "/usr/local/lib/python3.9/site-packages/idstools/scripts/rulecat.py", line 845, in main
files = Fetch(args).run()
File "/usr/local/lib/python3.9/site-packages/idstools/scripts/rulecat.py", line 329, in run
files.update(self.fetch(url))
File "/usr/local/lib/python3.9/site-packages/idstools/scripts/rulecat.py", line 317, in fetch
idstools.net.get(
File "/usr/local/lib/python3.9/site-packages/idstools/net.py", line 55, in get
remote = urlopen(url)
File "/usr/local/lib/python3.9/urllib/request.py", line 214, in urlopen
return opener.open(url, data, timeout)
File "/usr/local/lib/python3.9/urllib/request.py", line 523, in open
response = meth(req, response)
File "/usr/local/lib/python3.9/urllib/request.py", line 632, in http_response
response = self.parent.error(
File "/usr/local/lib/python3.9/urllib/request.py", line 561, in error
return self._call_chain(*args)
File "/usr/local/lib/python3.9/urllib/request.py", line 494, in _call_chain
result = func(*args)
File "/usr/local/lib/python3.9/urllib/request.py", line 641, in http_error_default
raise HTTPError(req.full_url, code, msg, hdrs, fp)
urllib.error.HTTPError: HTTP Error 404: Not Found

Network firewall is not blocking no proxy running?

Restarted a few times no change.

ran soup at latest version no updates

any ideas?

Thank You
Joe

[cm-ops]

What do you get for a response if you curl -v that url?

[jgiuliano63]

curl -v https://rules.emergingthreatspro.com/xxxxxxxxx/suricata-6.0.0/etpro.rules.tar.gz.

• About to connect() to rules.emergingthreatspro.com port 443 (#0)
• Trying 54.160.58.225...
• Connected to rules.emergingthreatspro.com (54.160.58.225) port 443 (#0)
• Initializing NSS with certpath: sql:/etc/pki/nssdb
• CAfile: /etc/pki/tls/certs/ca-bundle.crt
  CApath: none
• SSL connection using TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
• Server certificate:

•   subject: CN=rules.emergingthreats.net,O="Proofpoint, Inc.",ST=California,C=US
  

•   start date: Dec 21 00:00:00 2022 GMT
  

•   expire date: Dec 21 23:59:59 2023 GMT
  

•   common name: rules.emergingthreats.net
  

•   issuer: CN=Sectigo RSA Organization Validation Secure Server CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB
  

GET /xxxxxxxxxxxxx/suricata-6.0.0/etpro.rules.tar.gz. HTTP/1.1
User-Agent: curl/7.29.0
Host: rules.emergingthreatspro.com
Accept: /

< HTTP/1.1 404 Not Found
< Date: Tue, 21 Feb 2023 14:34:21 GMT
< Content-Type: text/html
< Content-Length: 146
< Connection: keep-alive
< Server: nginx
<

<title>404 Not Found</title>

404 Not Found

---

nginx * Connection #0 to host rules.emergingthreatspro.com left intact

[cm-ops]

Have you tried to tcpdump port 443 to see if there are any clues when you run so-rule-update?

[jgiuliano63]

Just tried it I do see 2 way traffic from SO to the repo. there are pushes from the repo yet the error message persists.

[jgiuliano63]

I found the issue. I had ETPRO for the rule set when it is actually TALOS. After changing ETPRO to TALOS in idstools. so-idstools-restart now so-rule-update works like it should.

Sorry for wasting your time. Hopefully this helps someone down the road.

Thanks
Joe