Add Libsodium sodium support for sha256 filehashes #1381
Commits on Dec 19, 2017
Commits on Jan 15, 2018
-
Try to use libsodium to allow us to check sha256 hashes.
It will switch from running OS_md5_sha1_File to OS_algorithm_File The output will be different. Enable with LIBSODIUM_ENABLED=y !! Incomplete and untested !!
Commits on Jan 17, 2018
Commits on Feb 11, 2018
Commits on Feb 14, 2018
Commits on Feb 15, 2018
-
-
-
-
-
The basic idea is to have hash1 and hash2. Then the hash strings
will be prepended with the hash type followed by an '='. This will cause changes in analysisd, I think. It will have to handle the different hash strings and types. I can probably either change to a generic signature for "HASH changed," and maybe add the hash type into a field in the alert (like src_ip). Or continue with the way rules are currently written and add rules for the new hash types.
Commits on Mar 6, 2018
Commits on Mar 7, 2018
-
lots of devug left in, need to free file_sums or change how it's being handled plenty of other cleanups available. sleep now. code later
-
Commits on Mar 11, 2018
Commits on Mar 13, 2018
Commits on Mar 15, 2018
-
-
Oops, I prefer -ggdb to -g, so I often change it and switch back before
pushing. This one snuck through
Commits on Mar 23, 2018
Commits on Apr 11, 2018
-
CID 166736: Ignoring number of bytes read
CID 166735: String not null terminated
-
-
-
Commits on Apr 17, 2018
-
Merge branch 'master' of https://github.com/ossec/ossec-hids into cov…
…erity_20180411
-
Commits on Apr 23, 2018
Commits on Apr 30, 2018
-
Clarify calculation precedence for '&' and '?'.
From codacy. More to come if this seems to work.
Commits on May 1, 2018
Commits on May 30, 2018
Commits on May 31, 2018
Commits on Jun 8, 2018
-
Don't mention blake2b in case libsodium changes their generic algorithm.
Make room for the libsodium generic hash algorithm. Make it easier to see which hashes will be checked.
-
Commits on Jun 22, 2018
-
-
-
Looks like I was previously truncating the SHA256 and GENERIC hash
outputs, oops. Make sure to traverse the entire hash to translate from unsigned char to signed char.
-
Generichash wasn't named in the log output.
simplify some of the ifdefs.
-
Make sure the generic hash is written to new_hashes.
LOTS of debugging stuff that will be removed shortly.
-
-
-
Commits on Jun 26, 2018
Commits on Jun 27, 2018
Commits on Jun 28, 2018
-
Increase the alert_msg size from 916 to 2048 in some places.
The instances that are MAC_PATH stayed the same.
Commits on Jul 12, 2018
-
-
Get rid of a free that was apparently not ok.
-
Instead of passing syscheck_opts around (which I didn't do correctly)
pass the opts in the function.
Commits on Jul 13, 2018
-
I forgot to copy new_hashes_tmp to new_hashes like a moron.
Also remove some debugging.
-
Remove the poorly done syscheck_opts idea. I switched to passing
the opts to the functions that needed it instead. Much cleaner.
-
Commits on Jul 19, 2018
-
Add the hash names into the hash output so that we know what we're
looking at when investigating later. I'm not sure if I should use GENERIC or BLAKE2B for the "generic" hash. It's set to GENERIC for now. Hopefully correct some ifdef/else/endif LIBSODIUM stuff. I think alert_msg was being overwritten in a few places making my actual hashes to be written as "xxx:xxx" (no value, basically) instead of the actual computed hashes. Also a bunch of debugging stuff that will be removed later.
Commits on Jul 25, 2018
Commits on Jul 31, 2018
Commits on Aug 6, 2018
Commits on Oct 12, 2018
Commits on Oct 15, 2018
Commits on Oct 16, 2018
Commits on Oct 23, 2018
Commits on Oct 29, 2018
Commits on Nov 5, 2018
-
-
Handle the different hash types better.
Also try not to truncate the hashes when reporting changes.
-
Commits on Feb 19, 2019
Commits on Apr 18, 2019
-
-
I'm not sure there is enough space for the blake2b hash, so default
to SHA256 and MD5. SHA256 should be good enough for integrity checking for now, and MD5 can be used with services (if necessary, and sha256 isn't an option).