Project

General

Profile

Actions
Copy link

Bug #6854

closed

file hash lists: no longer written out, due to dataset fix

Added by Jason Ish 8 months ago. Updated 8 months ago.

Status:
Closed
Priority:
High
Assignee:
Jason Ish
Target version:
1.3.2
Affected Versions:
Effort:
Difficulty:
Label:

Description

1.3.1 included a fix to prevent datasets from different sources from clobbering each other. This had the same effect for file hash lists, but the file hash list code wasn't updating the filename unique-ification.

This wasn't caught sooner as I don't believe they're are any public ruleset releasing such rules. There are hashlists, but not integrated with a rule.

I've since created a test ruleset to catch these, and will integrate this into the testing process: https://github.com/jasonish/suricata-test-rules/archive/refs/heads/main.zip

Actions
Copy link

Also available in: Atom PDF