From cf2ca4761d79ba642d623b3462edebc3f606b3b6 Mon Sep 17 00:00:00 2001
From: Ad Schellevis <ad@opnsense.org>
Date: Mon, 12 Apr 2021 09:21:21 +0200
Subject: [PATCH] IDPS - ruleset : add copy of some rule files which are being
 shipped empty in et-pro telemetry. closes
 https://github.com/opnsense/core/issues/4914

---
 .../intrusion-detection-content-et-open/Makefile   |  8 ++++++++
 .../intrusion-detection-content-et-open/pkg-descr  |  5 +++++
 .../suricata/metadata/rules/et-open-extra.xml      | 14 ++++++++++++++
 3 files changed, 27 insertions(+)
 create mode 100644 security/intrusion-detection-content-et-open/Makefile
 create mode 100644 security/intrusion-detection-content-et-open/pkg-descr
 create mode 100644 security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml

diff --git a/security/intrusion-detection-content-et-open/Makefile b/security/intrusion-detection-content-et-open/Makefile
new file mode 100644
index 000000000..31eceaaaf
--- /dev/null
+++ b/security/intrusion-detection-content-et-open/Makefile
@@ -0,0 +1,8 @@
+PLUGIN_NAME=		intrusion-detection-content-et-open
+PLUGIN_VERSION=		1.0.0
+#PLUGIN_REVISION=	1
+PLUGIN_COMMENT=		IDS Proofpoint ET open ruleset, duplicates some rule files which are being delivered empty in ET Pro Telemetry edition so both can be installed
+PLUGIN_MAINTAINER=	ad@opnsense.org
+PLUGIN_WWW=		https://rules.emergingthreats.net/
+
+.include "../../Mk/plugins.mk"
diff --git a/security/intrusion-detection-content-et-open/pkg-descr b/security/intrusion-detection-content-et-open/pkg-descr
new file mode 100644
index 000000000..74ae50435
--- /dev/null
+++ b/security/intrusion-detection-content-et-open/pkg-descr
@@ -0,0 +1,5 @@
+IDS Proofpoint ET open ruleset, duplicates some rule files which are being delivered empty in ET Pro Telemetry edition so both can be installed
+
+LICENSE: https://www.proofpoint.com/us/license
+
+WWW: https://www.proofpoint.com/us/blog/threat-insight
diff --git a/security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml b/security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml
new file mode 100644
index 000000000..8f4a92951
--- /dev/null
+++ b/security/intrusion-detection-content-et-open/src/opnsense/scripts/suricata/metadata/rules/et-open-extra.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<ruleset documentation_url="http://doc.emergingthreats.net/bin/view/Main/EmergingFAQ">
+    <location url="https://rules.emergingthreats.net/open/suricata-4.0/emerging.rules.tar.gz" prefix="ET open"/>
+    <version url="https://rules.emergingthreats.net/open/suricata-4.0/version.txt"/>
+    <files>
+        <file description="botcc.portgrouped" url="inline::rules/botcc.portgrouped.rules"et_open-botcc.portgrouped.rules</file>
+        <file description="botcc" url="inline::rules/botcc.rules">et_open.botcc.rules</file>
+        <file description="ciarmy" url="inline::rules/ciarmy.rules">et_open.ciarmy.rules</file>
+        <file description="compromised" url="inline::rules/compromised.rules">et_open.compromised.rules</file>
+        <file description="drop" url="inline::rules/drop.rules">et_open.drop.rules</file>
+        <file description="dshield" url="inline::rules/dshield.rules">et_open.dshield.rules</file>
+        <file description="tor" url="inline::rules/tor.rules">et_open.tor.rules</file>
+    </files>
+</ruleset>