update-ipblocklists: Do not longer require/load lang.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

update-ipblocklists: Adjust code to work with latest improvements

The former used modified file is not longer used (does not longer exist)
because the new general downloader uses stat instead.

Now to calculate the correct holdoff time when doing automatic updates
of a ruleset, we need to grab the last download time also by using stat.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist: Add support for 3CORESec lists.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist: Add support for Etnetera Aggressive Blocklist

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Call the customsrvgrp loader in case a set should be loaded.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Add load_customsrvgrp() function.

This is the set loader function to deal with custom service groups.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

firewall-lib.pl: Use an ipset set if a service group contains more than
15 ports.

The iptables multiport only supports up to 15 ports (ranges costs more).
To avoid this kind of limitation, now an ipset set will be used which
could handle up to 65k ports at once.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

firewall-lib.pl: Add get_custom_srvgrp_ports() function

This function can be used to get all service port numbers which are
attached to a custom service group by it's name.

You also have to choose if you want to get the ports for TCP or UDP
services.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipset-functions.pl: Proper map add_to_set() to the correct add function

Use a hash to map to the correct function to call for adding elements,
to a set, based on the given and detected data.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipset-functions.pl: Improve hashtype detection

Cleanup code and allow to detect hashtypes of bitmap:port.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-IPSet: Update to latest development snapshot

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

configroot: Fix typo

It is called ipset-functions.pl not ipsec-functions.pl.

May the second one comes any days in future - who knows....

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Register load_customgrp() function for custom groups

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Add load_customgrp() function.

This function is used to perfom as loader for custom
host/newtworks groups.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

firewall-lib.pl: Return custom host/neworks groups as sets to match
against

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

firewall-lib.pl: Add get_custom_group_addresses() function

This function is used to get the host/nework address of
each element of a given custom group name.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

firewall-lib.pl: Introduce get_custom_groups() function.

This function is used to get a list of all created custom
host/nework groups.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Drop obsolete dummy/workaround code

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Use new load_set() function to load a given set name

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Introduce set_loader mechanism

This introduces a mechanism where each setname and the function
which is used to proper load this set are stored in a hash.

The load_set function will use this information to call the correct
function.

To register a set loader the register_set_loader function can be used by
specifying the function name and an array of affected set names.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist: Adjust indention in sources file

This makes the file and it's data better human read-able.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

update-location-database: Export as list into new directory

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

libloc: Export networks as plain list

Also change the export directory to /var/lib/location/export

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Drop old ipset related code

This code is not longer used and safely can be dropped

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Use load_location function to load a location set

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

Revert "rules.pl: Use ipset_exists() function to avoid loading the same set"

We need this to avoid from loading the same set multiple times during
one run but update allready loaded sets.

This reverts commit 6dfa1854fb9ce74c0449b90f8475ac0fa9d87e2e.

location-functions.pl: Introduce load_location() function.

This function uses the ipset-functions library to create/update
a location list.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Use ipset_load_set function from
ipset-functions library

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipset-functions.pl: Add ipset_load_set function.

This function can be used to load/update a given set and
it's data.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipset-functions.pl: Drop debug output from clenup_ipsets() function

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Drop old code to load a blocklist

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Use ipset_exists() function to avoid loading the same set
multiple times.

Asking the kernel if a set is allready loaded/know is much smarter.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Avoid creating iptables rules if the corresponding blocklist is not loaded

In case a blocklist is empty after de-duplication of the entries, it
would not be loaded. In such a case we also can skip creating any
iptables rules for this list.

This avoids us checking against an empty list and therefore saves a few cpu cycles.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

rules.pl: Use load_blocklists() function to load all
enabled blocklists.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

firewall: Use cleanup_ipsets() function from ipset-functions library

Asking the kernel for all known sets and unloading unused ones is a much
smarter approach than the old one.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Fix regex in downloader

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist.cgi: Adjust code to work with latest ipblocklist-functions.pl
changes

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

update-ipblocklists: Adjust code to work with latest
ipblocklist-function.pl changes

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Fix return codes of the downloader

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Drop _calculate_hashsize() function.

This function is part of the ipset-functions library and is not
longer required here.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Add load_blocklist function.

This function uses the ipset-functions library and the perl ipset
bindings to load or update a given blocklist into the kernel.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Introduce load_blocklists() function

This function is responsible for loading the enabled blocklists.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Adjust return codes of the download function

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Add function to get all enabled blocklists

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Download and store blocklist only as plain
file in cache directory

Do not longer convert into ipset compatible format - only parse and
store the file.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Switch to get_cached_blocklist_file()

Replace the get_ipset_db_file() function to get_cache_blocklist_file().

This function will return the filename of the cached blocklist file
in "/var/cache/ipblocklist/".

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Use download function from
general-functions.pl

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipblocklist-functions.pl: Use strict

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ipset-functions.pl: Introduce new functions library.

This library uses the perl-IPset bindings and contains a lot of
additional functions to deal with ipsets within perl.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

perl-IPSet: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ids-functions.pl: Use new general downloader function.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

general-functions.pl: Use new downloader for FetchPublicIp function.

This helps to drop the Net::SSLeay module and to remove a lot of legacy
code.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

general-functions.pl: Add LWP-based flexible downloader function.

This function can be used to grab content and/or store it into files.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

cpufrequtils: hide output on disabled cores.

We disable cores if the are affected by some cpu vulnerabilities
this cores report errors if you try to change the settings.
So only print the output for core0 and hide it for all cores.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core184: fix rtl8812au module compression

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

rtl8812au: fix module compression

the kernel cannot load the compressed module so fix compression
parameters.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

cpufrequtils: fix initskript for amd-pstate

the initskript loads a test-modul for amd-pstate (which traces on intel)
and off course reports errors if firmware settings are missing.

this also fix the error at start because also amd-pstate doesn't support
ondemand mode.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

freeradius: Increment PAK_VER & ship freeradius to link to the updated libssl version

- OpenSSL was updated to 3.1.4 in CU181 and to 3.2.1 in CU183 but in both cases freeradius
   was not incremented to cause it to be shipped.
- This patch increments the freeradius PAK_VER to ensure it will be shipped.

Fixes: Bug#13590
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

files: Ship collectd.conf for bug#12981

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

graphs.pl: Fixes graph failure when the DROP_HOSTILE directory is missing

- If a fresh install is done then only the DROP_HOSTILE_IN & DROP_HOSTILE_OUT
   rrd directories are created.
- With the DROP_HOSTILE directory missing then when the fwhits graph is updated an error
   message is caused by the inability to open the required files.
- This patch adds an if/else loop into the fwhits graph code to deal with the two cases
   of the DROP_HOSTILE being present or not depending on the history and if a backup with
   logs has been restored from when DROP_HOSTILE was in use.
- Tested on vm testbed and created a historical line for the hostile data when it was not
   split
- There might be a simpler or better approach than this but it was the only option I
   could identify. I couldn't find anything about being able to use if loops within the
   RRD::Graph loop

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Ship unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.19.1

For details see:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-19-1

"Bug Fixes

    Fix CVE-2023-50387, DNSSEC verification complexity can be exploited
    to exhaust CPU resources and stall DNS resolvers.
    Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound 1.19.1: Fix for forgotten rootfile

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Ship bind

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.16.48

For details see:
https://downloads.isc.org/isc/bind9/9.16.48/doc/arm/html/notes.html#notes-for-bind-9-16-48

Fixes several CVEs.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'next'

core183: Ship suricata

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Update to 6.0.16

  https://redmine.openinfosecfoundation.org/versions/201

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libhtp: Update to 0.5.46

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Fail if the bootloader could not be installed

If GRUB could not be installed during installation, the installer
continued without reporting the error to the user.

This change will make the installer fail.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Ship suricata & libhtp

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libhtp: Update to 0.5.46

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Update to 6.0.16

  https://redmine.openinfosecfoundation.org/versions/201

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Ship squid

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

squid: Update to 6.7

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
For details see:
https://github.com/squid-cache/squid/commits/v6

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Ship expat

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

expat: Update to version 2.6.0

- Update from version 2.5.0 to 2.6.0
- Update of rootfile
- This update fixes two CVE's. Not sure if IPFire would be vulnerable or not but safer
   to update anyway.
- Changelog
    2.6.0
        Security fixes:
      #789 #814  CVE-2023-52425 -- Fix quadratic runtime issues with big tokens
                   that can cause denial of service, in partial where
                   dealing with compressed XML input.  Applications
                   that parsed a document in one go -- a single call to
                   functions XML_Parse or XML_ParseBuffer -- were not affected.
                   The smaller the chunks/buffers you use for parsing
                   previously, the bigger the problem prior to the fix.
                   Backporters should be careful to no omit parts of
                   pull request #789 and to include earlier pull request #771,
                   in order to not break the fix.
           #777  CVE-2023-52426 -- Fix billion laughs attacks for users
                   compiling *without* XML_DTD defined (which is not common).
                   Users with XML_DTD defined have been protected since
                   Expat >=2.4.0 (and that was CVE-2013-0340 back then).
        Bug fixes:
            #753  Fix parse-size-dependent "invalid token" error for
                    external entities that start with a byte order mark
            #780  Fix NULL pointer dereference in setContext via
                    XML_ExternalEntityParserCreate for compilation with
                    XML_DTD undefined
       #812 #813  Protect against closing entities out of order
        Other changes:
            #723  Improve support for arc4random/arc4random_buf
       #771 #788  Improve buffer growth in XML_GetBuffer and XML_Parse
       #761 #770  xmlwf: Support --help and --version
       #759 #770  xmlwf: Support custom buffer size for XML_GetBuffer and read
            #744  xmlwf: Improve language and URL clickability in help output
            #673  examples: Add new example "element_declarations.c"
            #764  Be stricter about macro XML_CONTEXT_BYTES at build time
            #765  Make inclusion to expat_config.h consistent
       #726 #727  Autotools: configure.ac: Support --disable-maintainer-mode
    #678 #705 ..
  #706 #733 #792  Autotools: Sync CMake templates with CMake 3.26
            #795  Autotools: Make installation of shipped man page doc/xmlwf.1
                    independent of docbook2man availability
            #815  Autotools|CMake: Add missing -DXML_STATIC to pkg-config file
                    section "Cflags.private" in order to fix compilation
                    against static libexpat using pkg-config on Windows
       #724 #751  Autotools|CMake: Require a C99 compiler
                    (a de-facto requirement already since Expat 2.2.2 of 2017)
            #793  Autotools|CMake: Fix PACKAGE_BUGREPORT variable
       #750 #786  Autotools|CMake: Make test suite require a C++11 compiler
            #749  CMake: Require CMake >=3.5.0
            #672  CMake: Lowercase off_t and size_t to help a bug in Meson
            #746  CMake: Sort xmlwf sources alphabetically
            #785  CMake|Windows: Fix generation of DLL file version info
            #790  CMake: Build tests/benchmark/benchmark.c as well for
                    a build with -DEXPAT_BUILD_TESTS=ON
       #745 #757  docs: Document the importance of isFinal + adjust tests
                    accordingly
            #736  docs: Improve use of "NULL" and "null"
            #713  docs: Be specific about version of XML (XML 1.0r4)
                    and version of C (C99); (XML 1.0r5 will need a sponsor.)
            #762  docs: reference.html: Promote function XML_ParseBuffer more
            #779  docs: reference.html: Add HTML anchors to XML_* macros
            #760  docs: reference.html: Upgrade to OK.css 1.2.0
       #763 #739  docs: Fix typos
            #696  docs|CI: Use HTTPS URLs instead of HTTP at various places
    #669 #670 ..
    #692 #703 ..
       #733 #772  Address compiler warnings
       #798 #800  Address clang-tidy warnings
       #775 #776  Version info bumped from 9:10:8 (libexpat*.so.1.8.10)
                    to 10:0:9 (libexpat*.so.1.9.0); see https://verbump.de/
                    for what these numbers do
        Infrastructure:
       #700 #701  docs: Document security policy in file SECURITY.md
            #766  docs: Improve parse buffer variables in-code documentation
    #674 #738 ..
    #740 #747 ..
  #748 #781 #782  Refactor coverage and conformance tests
       #714 #716  Refactor debug level variables to unsigned long
            #671  Improve handling of empty environment variable value
                    in function getDebugLevel (without visible user effect)
    #755 #774 ..
    #758 #783 ..
       #784 #787  tests: Improve test coverage with regard to parse chunk size
  #660 #797 #801  Fuzzing: Improve fuzzing coverage
       #367 #799  Fuzzing|CI: Start running OSS-Fuzz fuzzing regression tests
       #698 #721  CI: Resolve some Travis CI leftovers
            #669  CI: Be robust towards absence of Git tags
       #693 #694  CI: Set permissions to "contents: read" for security
            #709  CI: Pin all GitHub Actions to specific commits for security
            #739  CI: Reject spelling errors using codespell
            #798  CI: Enforce clang-tidy clean code
    #773 #808 ..
       #809 #810  CI: Upgrade Clang from 15 to 18
            #796  CI: Start using Clang's Control Flow Integrity sanitizer
  #675 #720 #722  CI: Adapt to breaking changes in GitHub Actions Ubuntu images
            #689  CI: Adapt to breaking changes in Clang/LLVM Debian packaging
            #763  CI: Adapt to breaking changes in codespell
            #803  CI: Adapt to breaking changes in Cppcheck

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libvirt: Don't build for riscv64

There seems to be some problem that this package does not build from
source, but as we don't currently have any hardware that supports thise,
there is no point in debugging it.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Ship vpnmain.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Add option to regenerate the host certificate

This is necessary since we now have a much shorter lifetime for the host
certificate. However, it is complicated to do this is which is why we
are copying the previous certificate and generate a new CSR. This is
then signed.

A caveat of this patch is that we do not rollover the key.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Return the entire error message if OpenSSL fails

The function did not evaluate the return code which is why it used a
hack to figure out if some output is an error or not.

This is being fixed in this commit and the entire output is being
returned if the return code is non-zero.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vpnmain.cgi: Do not use a bad source for randomness

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Ship HOSTILE IN/OUT changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Improve labelling of hostile networks hits

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: graphs: Add a line for the total number of hostile hits

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

optionsfw.cgi: Move Firewall Options Drop commands to before the logging section

- Moved the Firewall Options Drop commands to before the logging section, as discussed
   at January 2024 Video Call.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

graphs.pl: Fixes bug12981 - Creates in and outgoing drop hostile graph entries

- This v3 version of the patch set splits the single hostile networks graph entry into
   incoming hostile networks and outgoing hostile networks entries.

Fixes: bug12981
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

collectd.conf: Fix bug12981 - This creates in and out drop hostile data collection

- In this v3 version of the patch set the splitting of drop hostile logging into incoming
   and outgoing logging means that the data collection and graphs need to have drop hostile
   also split into incoming and outgoing.

Fixes: bug12981
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

en.pl: Fixes bug12981 - adds english language input for choice of drop hostile logging

- In this v3 version have added translations for hostile networks in and hostile
   networks out and log drop hostile in and log drop hostile out.

Fixes: bug12981
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firewall: Fixes bug12981 - add if loop to log or not log dropped hostile traffic

- This v3 version now has two if loops allowing logging of incoming drop hostile or
   outgoing drop hostile or both or neither.
- Dependent on the choice in optionsfw.cgi this loop will either log or not log the
   dropped hostile traffic.

Fixes: bug12981
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rules.pl: Fixes bug12981 - Add in and out specific actions for drop hostile

- This changes the action from HOSTILE_DROP to HOSTILE_DROP_IN for icnoming traffic and
   HOSTILE_DROP_OUT for outgoing traffic enabling logging decisions to be taken on each
   independently.

Fixes: bug12981
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Acked-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

optionsfw.cgi: Fix bug12981 - Add option to log or not log dropped hostile traffic

- This v3 version has split the logging choice for drop hostile to separate the logging of
   incoming drop hostile and outgoing drop hostile.
- The bug originator had no port forwards so all hostile would be dropped normally anyway.
   However the logs were being swamped by the logging of drop hostile making analysis
   difficult. So incoming drop hostile was desired to not be logged. However logging of
   outgoing drop hostile was desired to identify if clients on the internal lan were
   infected with malware trying to reach home.
- Added option with drop hostile section to decide if the dropped traffic should be
   logged or not.

Fixes: bug12981
Tested-by: Adolf Belka <adolf.belka@ipfire.org
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
Tested-by: Bernhard Bitsch <bbitsch@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

elfutils: Don't ship tools

I don't think there is any point that we ship these.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core184: Remove elfutils pakfire metadata (if installed)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

strace: elfutils moved from addon dependency to core program

Fixes: Bug#13516
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

qemu: elfutils moved from addon dependency to core program

Fixes: Bug#13516
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ltrace: elfutils moved from addon dependency to core program

Fixes: Bug#13516
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

frr: elfutils moved from addon dependency to core program

Fixes: Bug#13516
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

elfutils: Move from addon to core program. Required by suricata-7.0.2 for execution

- Updated lfs file to core program type
- Moved rootfile from packages to common
- Older suricata versions required elfutils only for building but suricata-7.0.2 fails to
   start if elfutils is not present due to libelf.so.1 being missing.
- The requirement for elfutils is not mentioned at all in the changelog.

Fixes: Bug#13516
Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vdr_streamdev: update to 0.6.3

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>