suricata: Change midstream policy to "pass-flow"

[ipfire-2.x.git] / lfs / configroot

diff --git a/lfs/configroot b/lfs/configroot
index 31b9a946389409fae349a79886eb05c19a29b760..9f6c1ff8ca1a3d5e883c604618d64e1d3fafbc0f 100644 (file)
--- a/lfs/configroot
+++ b/lfs/configroot
@@ -1,7 +1,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2007-2022  IPFire Team  <info@ipfire.org>                     #
+# Copyright (C) 2007-2024  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -51,7 +51,7 @@ $(TARGET) :
 
        # Create all directories
        for i in addon-lang auth backup ca captive certs connscheduler crls ddns dhcp dhcpc dns dnsforward \
-                       ethernet extrahd/bin fwlogs fwhosts firewall ipblocklist isdn key langs logging mac main \
+                       ethernet extrahd/bin fwlogs fwhosts firewall ipblocklist key langs logging mac main \
                        menu.d modem optionsfw \
                        ovpn patches pakfire portfw ppp private proxy/advanced/cre \
                        proxy/calamaris/bin qos/bin red remote sensors suricata time \
@@ -64,9 +64,9 @@ $(TARGET) :
        for i in auth/users backup/include.user backup/exclude.user \
            captive/settings captive/agb.txt captive/clients captive/voucher_out certs/index.txt certs/index.txt.attr ddns/config ddns/settings ddns/ipcache dhcp/settings \
            dhcp/fixleases dhcp/advoptions dhcp/dhcpd.conf.local dns/settings dns/servers dnsforward/config ethernet/aliases ethernet/settings ethernet/known_nics ethernet/scanned_nics \
-           ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/config firewall/locationblock firewall/input firewall/outgoing \
+           ethernet/wireless extrahd/scan extrahd/devices extrahd/partitions extrahd/settings firewall/settings firewall/locationblock firewall/input firewall/outgoing \
            fwhosts/customnetworks fwhosts/customhosts fwhosts/customgroups fwhosts/customservicegrp fwhosts/customlocationgrp fwlogs/ipsettings fwlogs/portsettings ipblocklist/modified \
-           ipblocklist/settings isdn/settings mac/settings main/hosts main/routing main/security main/settings optionsfw/settings \
+           ipblocklist/settings mac/settings main/hosts main/routing main/security main/settings optionsfw/settings \
            ovpn/ccd.conf ovpn/ccdroute ovpn/ccdroute2 pakfire/settings portfw/config ppp/settings-1 ppp/settings-2 ppp/settings-3 ppp/settings-4 \
            ppp/settings-5 ppp/settings proxy/settings proxy/squid.conf proxy/advanced/settings proxy/advanced/cre/enable remote/settings qos/settings qos/classes qos/subclasses qos/level7config qos/portconfig \
            qos/tosconfig suricata/settings vpn/config vpn/settings vpn/ipsec.conf \
@@ -102,6 +102,7 @@ $(TARGET) :
        cp $(DIR_SRC)/config/cfgroot/logging-settings           $(CONFIG_ROOT)/logging/settings
        cp $(DIR_SRC)/config/cfgroot/ethernet-vlans             $(CONFIG_ROOT)/ethernet/vlans
        cp $(DIR_SRC)/langs/list                                $(CONFIG_ROOT)/langs/
+       cp $(DIR_SRC)/config/firewall/config                    $(CONFIG_ROOT)/firewall/config
        cp $(DIR_SRC)/config/firewall/convert-xtaccess          /usr/sbin/convert-xtaccess
        cp $(DIR_SRC)/config/firewall/convert-outgoingfw        /usr/sbin/convert-outgoingfw
        cp $(DIR_SRC)/config/firewall/convert-dmz               /usr/sbin/convert-dmz
@@ -132,6 +133,8 @@ $(TARGET) :
        echo  "DROPWIRELESSFORWARD=on"  >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "DROPSPOOFEDMARTIAN=on"   >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "DROPHOSTILE=on"          >> $(CONFIG_ROOT)/optionsfw/settings
+       echo  "LOGDROPHOSTILEIN=on"             >> $(CONFIG_ROOT)/optionsfw/settings
+       echo  "LOGDROPHOSTILEOUT=on"    >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "LOGDROPCTINVALID=on"     >> $(CONFIG_ROOT)/optionsfw/settings
        echo  "POLICY=MODE2"            >> $(CONFIG_ROOT)/firewall/settings
        echo  "POLICY1=MODE2"           >> $(CONFIG_ROOT)/firewall/settings
@@ -167,10 +170,10 @@ $(TARGET) :
        cp $(DIR_SRC)/langs/*/cgi-bin/*.pl $(CONFIG_ROOT)/langs/
 
        # Configroot permissions
-       chown -R nobody:nobody $(CONFIG_ROOT)
-       chown      root:root   $(CONFIG_ROOT)
-       for i in backup/ *.pl addon-lang/ langs/ ; do \
-            chown -R root:root $(CONFIG_ROOT)/$$i; \
+       chown -Rv       nobody:nobody   $(CONFIG_ROOT)
+       chown           root:root       $(CONFIG_ROOT)
+       for i in backup/exclude.user backup/include.user connscheduler/lib.pl *.pl addon-lang/ langs/ menu.d/; do \
+            chown -Rv root:root $(CONFIG_ROOT)/$$i; \
        done
        chown -Rv root:root $(CONFIG_ROOT)/*/bin
        chown root:nobody $(CONFIG_ROOT)/dhcpc