Optimization #7353: files: remove deprecated force-md5 config option - Suricata - Open Information Security Foundation

Custom queries

8.0.0 Stories
Good First Issues
OISF community

Actions

Copy link

Optimization #7353

closed

files: remove deprecated force-md5 config option

Added by Philippe Antoine 9 months ago. Updated 2 months ago.

Status:

Closed

Priority:

Normal

Assignee:

Philippe Antoine

Target version:

8.0.0-rc1

Effort:

Difficulty:

Label:

Beginner, Good First Issue, Outreachy

Description

in util-file.c

History
Notes
Property changes

Actions

Copy link

Updated by Victor Julien 5 months ago

Subject changed from Remove deprecated force-md5 config option to files: remove deprecated force-md5 config option
Target version changed from 8.0.0-beta1 to TBD

This is something we'd only do if we remove md5 tracking, matching and logging.

Actions

Copy link

Updated by Jason Ish 5 months ago

I'm curious what is the reason to deprecate md5? Besides not being cryptographically secure, it still seems to be in wide use for identifying files.

Actions

Copy link

Updated by Philippe Antoine 5 months ago

        SCLogWarning("deprecated 'force-md5' option " 
                     "found. Please use 'force-hash: [md5]' instead");

Actions

Copy link

Updated by Philippe Antoine 5 months ago

Victor Julien wrote in #note-1:

This is something we'd only do if we remove md5 tracking, matching and logging.

No, we do md5 tracking, matching and logging with force-hash: [md5] instead of force-md5 in suricata.yaml

Do not we want to have this for 8 ?

Actions

Copy link

Updated by Philippe Antoine 5 months ago

git grep deprecated shows other stuff like legacy.uricontent ...

Actions

Copy link

Updated by Jason Ish 5 months ago

Philippe Antoine wrote in #note-4:

Victor Julien wrote in #note-1:

This is something we'd only do if we remove md5 tracking, matching and logging.

No, we do md5 tracking, matching and logging with force-hash: [md5] instead of force-md5 in suricata.yaml

Do not we want to have this for 8 ?

I think this makes sense then. The ticket didn't have enough context to reason about it properly.

Actions

Copy link