If the kernel module is loaded automatically/implicitly through
insertion of an iptables rule, it gets loaded with only the default
module parameters. Add a modprobe.d fragment to handle this case.

Change-Id: I08659e2f0db8fed401cbcce6edee51e942da1f3e
(cherry picked from commit 85b8a765d1)

Capabilities listed in the ambient set must also be included in the
bounding set.

Change-Id: I172bd30c9fbe488574e9cc015ba552e805c95fe6
(cherry picked from commit 7200c7af64)

lsb-base as of version 11.5 and as present in Debian/testing AKA
bookworm is a transitional package (depending on sysvinit-utils).
As of lintian >=2.116.0 a dependency on lsb-base is considered an error:

| E: ngcp-rtpengine-daemon: depends-on-obsolete-package Depends: lsb-base (>= 3.0-6)
| E: ngcp-rtpengine-recording-daemon: depends-on-obsolete-package Depends: lsb-base (>= 3.0-6)

Now having lintian 2.116.1 in Debian/testing AKA bookworm our package
builds fail because of this.

Since we still have init script support and references to
/lib/lsb/init-functions, let's depend on either sysvinit-utils
or lsb-base.

See related discussion on debian-devel mailing list:
https://lists.debian.org/debian-devel/2023/01/msg00149.html

Change-Id: Id3228425405e39904e52de8fdf00911539ac63bb
(cherry picked from commit e774bcb30f)

/var/spool/rtpengine is used by the main daemon as well as the recording
daemon. The recording daemon is not really useful without the main
daemon, while it's perfectly fine to use the main daemon without the
recording daemon. That directory should therefore be managed by the main
daemon package.

This fixes a broken systemd unit stemming from a missing directory if
the recording daemon is not installed.

Fix-up for 26bf2b05a5
Fix-up for I4abf4df218b1ba0dc70ed8974c0661d16e0b6ea7

Fixes GH #1510

Change-Id: If75b6c1b675c8abf0bb33ae58b41e036276f8640
(cherry picked from commit de8b3d59c1)

Fixes:

| Warning: using insecure memory!

as triggered via libgcrypt, see
https://sources.debian.org/src/libgcrypt20/1.10.1-2/src/secmem.c/?#L283

Let's use 8388608 AKA 8MB as default, as present in systemd versions
251 and newer, see commit:

| commit 852b62507b22c0a986032a2c9fa9cc464a5b7bd2
| Author: Lennart Poettering <lennart@poettering.net>
| Date:   Thu Mar 10 13:22:57 2022 +0100
|
|     pid1,nspawn: raise default RLIMIT_MEMLOCK to 8M
|
|     This mirrors a similar check in Linux kernel 5.16
|     (9dcc38e2813e0cd3b195940c98b181ce6ede8f20) that raised the
|     RLIMIT_MEMLOCK to 8M.
|
|     This change does two things: raise the default limit for nspawn
|     containers (where we try to mimic closely what the kernel does), and
|     bump it when running on old kernels which still have the lower setting.
|
|     Fixes: #16300
|     See: https://lwn.net/Articles/876288/

Change-Id: I56f6d173d316386501ce8b13cc7a8ad6bea4ed26
(cherry picked from commit fd2dfd0b6a)

By default we use /var/spool/rtpengine as recording directory,
so ensure we have R/W access to it.

Change-Id: I4abf4df218b1ba0dc70ed8974c0661d16e0b6ea7
(cherry picked from commit 26bf2b05a5)

Now that we run as non-root user by default, we didn't have
proper capabilities for still running under root user.
Document, what's required to do so.

NOTE: related to TT#157800 (rtpengine: run as non-root) and
TT#76552 (systemd hardening)

Change-Id: Ie9f44bb75dc63cd407b27faab2219647d079359e
(cherry picked from commit 81a9366f49)

This avoids duplicating the call we want to hook into.

Change-Id: If166c690709ee633e4928f9574b7d9e141509c01

- Switch to debhelper compat level 13.
- Remove obsolete override_dh_dwz now handled properly by dh_dwz.

Change-Id: I28432b110b958ddc14eadee97007a07ec329a14d

* update generator to deal with manpages references to ngcp-*

Change-Id: Ibabf15e461d5aaac2099b5750f98ca21a59c09af

ngcp-rtpengine-daemon service state BEFORE this change:

| $ sudo systemd-analyze security ngcp-rtpengine-daemon | tail -1
| → Overall exposure level for ngcp-rtpengine-daemon.service: 9.3 UNSAFE 😨

ngcp-rtpengine-daemon service state AFTER this change:

| $ sudo SYSTEMD_COLORS=0 PAGER= COLUMNS=100 unbuffer systemd-analyze security ngcp-rtpengine-daemon | grep -v '✓'
|   NAME                                         DESCRIPTION                                  EXPOSURE
| ✗ PrivateNetwork=                              Service has access to the host's network          0.5
| ✗ RestrictAddressFamilies=~AF_(INET|INET6)     Service may allocate Internet sockets             0.3
| ✗ DeviceAllow=                                 Service has a device ACL with some special …      0.1
| ✗ IPAddressDeny=                               Service does not define an IP address allow…      0.2
| ✗ SystemCallFilter=~@privileged                System call allow list defined for service,…      0.2
| ✗ SystemCallFilter=~@resources                 System call allow list defined for service,…      0.2
| ✗ AmbientCapabilities=                         Service process receives ambient capabiliti…      0.1
| ✗ RestrictAddressFamilies=~AF_NETLINK          Service may allocate netlink sockets              0.1
| ✗ RootDirectory=/RootImage=                    Service runs within the host's root directo…      0.1
| ✗ RestrictAddressFamilies=~AF_UNIX             Service may allocate local sockets                0.1
| ✗ ProcSubset=                                  Service has full access to non-process /pro…      0.1
|
| → Overall exposure level for ngcp-rtpengine-daemon.service: 1.4 OK 🙂

As of systemd v247.3-7.

Change-Id: I1bc2a82b0b9a945a3fa25f3e35d1b751ee0e4041

Change-Id: I183fe1d12fe08d3ec83260b187fc14c301fc7e90

Use the latest policy version from Debian bullseye.

Change-Id: I1ba3c02257c4bb5ebcff6b4358bfebc7ecd74759

These packages do not provide architecture-specific interfaces. The only
problematic one is the kernel module, which requires a matching kernel
where to run on, independently of the userland. In addition the kernel
interface is arch-specific so running, say, a 64-bit kernel and module
and a 32-bit userland will not work.

Change-Id: Ic7327e422ec6f2e3cd4145b8ae172db9149287b4

We have had DKMS support for a long time, which is easier to integrate
to, and manage as a user. As we have not been testing module-assistant
support and it's redundant with the DKMS support, let's just remove it.

Change-Id: Iff546a4a333a2e4e48fbc1e49fecee9bab3a0138

Otherwise new recordings won't have expected owner/group,
when running rtpengine as its own user

Change-Id: I8a6cf123a5467a412c1b2c3ea6c8db7fddc9dc2d

Neither main daemons nor auxiliary tools require root privileges to run,
therefore they should go into /usr/bin instead of /usr/sbin.

Change-Id: I22fd0f4e622df0362a686dfe9e0ce1fb86b43a9e

Fixup for git commit 23f5660314, fixing
SC2034 (x appears unused) +
SC2181 (check exit code directly).

Change-Id: I50684e8e76940153c98d02210ac349f24962bac4

This has become important after the latest change to run rtpengine as
non-root user as it requires reloading the kernel module with the new
user/group permissions.

Change-Id: Iedf2624402397f5d444955e9d5d6d5aa414be1c3

*) Create dedicated rtpengine user in postinst and remove it in postrm.

*) Use RuntimeDirectory= systemd unit config.

*) Use dedicated user for /proc interface and set file umask to hide it
from other users.

*) Set owner and permissions on default directories used for call recording.

Change-Id: I8e225b36d065d46da2489fb8286916371950f490

A working stock config makes it possible to install this package and
have a working setup right away. Previously installing this package
fresh results in an error from systemd because the daemon refuses to
start due to lack of working config.

Change-Id: I470b4ec29a9aeea147a8d001b8e126611921c39e

It makes no sense to have the recording daemon installed without the
main daemon, therefore add an explicit dependency. This also allows us
to add some postinst/postrm scripts to the main daemon package that also
applies to the recording daemon (e.g. creating a user).

Change-Id: Id698907515ad94b2ac4988454607385bee72e7ca

The per-table /proc files may contain sensitive information. Add an
optional file mode mask to apply to the top directly to hide it from
unprivileged users.

Change-Id: I3ec02739e0d97e53c8628259922ccf64ddfa8415

Change-Id: Idd1b413d720b7be8f36849660c547332a344a698

If there's no config file present then retrieval of the table number
yields an empty string. Allow this as an expected case to silence a
warning from bash (using -lt against an empty string)

Change-Id: I0420d2e1c555f6b56a56fc5f47d3bc183a929e50

The aliases created by systemd under Install/Alias are created and
removed as the service is enabled and disabled, and don't serve as
generic alias names. Furthermore they seem to linger behind when the
package is removed or replaced, which leads to collisions and
installation failures when the NGCP-specific package is replaced by the
non-NGCP version.

Change-Id: I2313ffffb1fa4fb1d570b23113b0618744c58e26

This package name is not used anywhere as a dependency, therefore it
makes no sense to list as a "provides"

Change-Id: I20db5308328b1c911495bf31417e4996a9824c3c

This transition has long past, it is safe to remove now.

Change-Id: Id834f5ba3bfc9272851402973a9c139d879a6abc

Fixes:

| In debian/ngcp-rtpengine-iptables-setup line 15:
| TABLE=$(/usr/libexec/rtpengine/rtpengine-get-table --config-file=$CONFIG_FILE)
|                                                                  ^----------^ SC2086: Double quote to prevent globbing and word splitting.
|
| In el/rtpengine.init line 36:
| configfile=${CONFIG_FILE-/etc/rtpengine/rtpengine.conf}
| ^--------^ SC2034: configfile appears unused. Verify use (or export if used externally).
|
| In el/rtpengine.init line 38:
| TABLE=$(/usr/libexec/rtpengine/rtpengine-get-table --config-file=$CONFIG_FILE)
|                                                                  ^----------^ SC2086: Double quote to prevent globbing and word splitting.

Those went unnoticed in commit 111b0a769c, but are failing
in github actions with shellcheck v0.7.2.

While at it, ensure that /etc/rtpengine/rtpengine.conf
is used as fallback, if CONFIG_FILE isn't defined.

Change-Id: I1c1948245a907bd6d299b242a9faff960d0608bc

These can be set from the config file, which makes the support in the
sysvinit script redundant. Remove all these and leave only the minimally
relevant ones involved in the startup of the daemon.

Change-Id: I3faac4594d7f1a21e65761036c2ab153acb96152

If the user wants to disable the sysvinit service they should use
update-rc.d disable instead.

Change-Id: Ibbd4ba374d310fea9fcd906d79ef224cbef15b74

This centralizes the table setting into the respective config files
instead of keeping copies all over the place, that can easily get out
of sync.

Change-Id: I12f3fa172f34861365c31c8d8718b3fae8a9de5b

Bullseye doesn't install iptables by default any more, but the included
startup script uses iptables to set up the kernel forwarding by default.
Add an explicit dependency.

closes #1343

Change-Id: I6c222c290e51177f92136f9df59fa769c05ec266