Actions
Bug #6854
closedfile hash lists: no longer written out, due to dataset fix
Affected Versions:
Effort:
Difficulty:
Label:
Description
1.3.1 included a fix to prevent datasets from different sources from clobbering each other. This had the same effect for file hash lists, but the file hash list code wasn't updating the filename unique-ification.
This wasn't caught sooner as I don't believe they're are any public ruleset releasing such rules. There are hashlists, but not integrated with a rule.
I've since created a test ruleset to catch these, and will integrate this into the testing process: https://github.com/jasonish/suricata-test-rules/archive/refs/heads/main.zip
Actions