sha256 support for wazuh-ossec#410
Conversation
|
Hi @arshad01, This is an impressive work! SHA256 checking for FIM will add a lot of value to Wazuh. We don't plan to release 3.1.x versions so I suggest you to change the base branch to I see that there are 3 extra commits in your PR, this is because we moved them into the Please let me review your changes carefully before accepting the PR. So far, I've taken a look at your code and I've seen two details, I'll comment you in the code. Thank you very much for your work. Looking forward to see it working! Best regards. |
vikman90
left a comment
There was a problem hiding this comment.
Please consider changing these two issues before merging the PR.
Thanks again.
src/LOCATION
Outdated
| @@ -1 +1 @@ | |||
| DIR="/var/ossec" | |||
| DIR="/var/ossec31" | |||
There was a problem hiding this comment.
Please restore the original value of this parameter. This is the default installation directory, it should still being /var/ossec.
src/headers/syscheck_op.h
Outdated
| #define SK_GNAME 8 | ||
| #define SK_INODE 9 | ||
| #define SK_NFIELDS 10 | ||
| #define SK_SHA256 11 |
There was a problem hiding this comment.
This definition exceeds the field size limit.
SK_NFIELDS is the number of fields, now there will be 11 fields. This parameter is used to evaluate all fields: https://github.com/wazuh/wazuh/blob/master/src/shared/syscheck_op.c#L104-L106
Please swap SK_NFIELDS and SK_SHA256:
#define SK_SHA256 10
#define SK_NFIELDS 11|
Hi @vikman90 Thanks very much for reviewing. I have changed base branch to master. Please note that I haven't tested this change on Windows so there may be some parts of this PR that need further changes. Regards |
|
Hi @vikman90 |
|
First of all thank you for the hard work you did in this PR. We have tested it and it works but as we need retrocompatibility with older versions I have made changes over your code. I will merge this PR and upload the changes I made. Again thank you for this! |
|
Thanks for accepting and merging the pull request. |
Hello
Please review my pull request based on 3.1 branch for sha256 signature support. I have followed the current code structure to add the new signature. Hope this is useful.
Added a new attribute "check_sha256sum" with values yes/no in the syscheck's directories option.
Thanks
Arshad