Bug 14616

**Environment**

IPFire 2.29 (x86_64), Core Update 204.

**Problem**

After enabling the julioliraup/Antiphishing IPS ruleset, Suricata reports three failed signatures because their datasets cannot be initialized.

Affected signatures:
- SID 6000000: AT DNS query to suspicious domain - Phishing
- SID 6000001: AT TLS SNI to suspicious domain - Phishing
- SID 6000002: AT IP dataset - Phishing

**Observed errors (October 23, 2026)**

```
failed to set up dataset 'phishing_domains'.
failed to set up dataset 'phishing_ips'.
25 rule files processed. 130124 rules successfully loaded,
3 rules failed, 0 rules skipped.
```

The rules file is present:

```
/var/lib/suricata/julioliraup_antiphishing-antiphishing.rules
```

However, searching `/var/lib/suricata` for the required `phishing.lst` and `phishing_ips.lst` files returns no results.

The errors are reproducible across rule reloads (observed at approximately 01:24 and 13:24).

**Expected behavior**

The IPFire IPS ruleset updater should install the rules and all required dataset files so that all valid signatures can be loaded.

**Possible cause**

The upstream project distributes its rules together with additional datasets. The IPFire integration may be importing the rules file without installing the supplementary dataset files at the paths expected by Suricata.

This is a hypothesis, not a confirmed root cause.

**Impact**

Three phishing-detection signatures are not loaded. The remaining signatures load successfully and the Suricata rule reload completes.

**Upstream project**

https://github.com/julioliraup/Antiphishing


** Log Snippet ** 

01:24:14 	suricata: 	[29437] <Info> -- tenant id 0: 129860 signatures processed. 21137 are IP-only rules, 3463 are inspecting packet payload, 105209 inspect application layer, 0 are decoder event only
01:24:14 	suricata: 	[29437] <Info> -- tenant id 0: Threshold config parsed: 0 rule(s) found
01:24:14 	suricata: 	[29437] <Info> -- tenant id 0: 25 rule files processed. 129858 rules successfully loaded, 3 rules failed, 0 rules skipped
01:24:10 	suricata: 	[29437] <Error> -- error parsing signature "alert ip $HOME_NET any -> any any (msg:"AT IP dataset - Phishing"; ip.dst; dataset:isset,phishing_ips,type ipv4,load phishing_ips.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000002; classtype:social-engineering; sid:6000002; rev:1; metadata: signature_severity Major, created_et 2026_08_14;)" from file /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules at line 10
01:24:10 	suricata: 	[29437] <Error> -- failed to set up dataset 'phishing_ips'.
01:24:10 	suricata: 	[29437] <Error> -- error parsing signature "alert tls $HOME_NET any -> any any (msg:"AT TLS SNI to suspicious domain - Phishing"; tls.sni; dataset:isset,phishing_domains,type string,load phishing.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000001; classtype:social-engineering; sid:6000001; rev:1; metadata: signature_severity Major, created_et 2025_02_19;)" from file /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules at line 8
01:24:10 	suricata: 	[29437] <Error> -- failed to set up dataset 'phishing_domains'.
01:24:10 	suricata: 	[29437] <Error> -- error parsing signature "alert dns $HOME_NET any -> any any (msg:"AT DNS query to suspicious domain - Phishing"; dns.query; dataset:isset,phishing_domains,type string,load phishing.lst; reference:url,github.com/julioliraup/Antiphishing; reference:url,julioliraup.github.io/AT/signature.html?sid=6000000; classtype:social-engineering; sid:6000000; rev:1; metadata: signature_severity Major, created_et 2025_02_19;)" from file /var/lib/suricata/julioliraup_antiphishing-antiphishing.rules at line 6
01:24:10 	suricata: 	[29437] <Error> -- failed to set up dataset 'phishing_domains'.
01:23:58 	suricata: 	[29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-used-rulesfiles.yaml.
01:23:58 	suricata: 	[29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-http-ports.yaml.
01:23:58 	suricata: 	[29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-dns-servers.yaml.
01:23:58 	suricata: 	[29437] <Info> -- Including configuration file /var/ipfire/suricata/suricata-homenet.yaml.
01:23:58 	suricata: 	[29437] <Notice> -- rule reload starting