T7873: Bump Suricata version to 7.0.10

[asklymenko]

Change summary

It is required to bump the Suricata package version to address multiple vulnerabilities.
This version of package (suricata 7.0.*) is available in bookworm-backports repository only. It also requires libhtp2 package of specific version from bookworm-backports.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Code style update (formatting, renaming)
• Refactoring (no functional changes)
• Migration from an old Vyatta component to vyos-1x, please link to related PR inside obsoleted component
• Other (please describe):

Related Task(s)

• https://vyos.dev/T7873

Related PR(s)

Checklist:

• I have read the CONTRIBUTING document
• I have linked this PR to one or more Phabricator Task(s)
• My commit headlines contain a valid Task id
• My change requires a change to the documentation
• I have updated the documentation accordingly

[github-actions]

👍
No issues in PR Title / Commit Title

[dmbaturin]

We certainly shouldn't leave a vulnerable package in the image, so I'm not against the version update, if it doesn't break anything.

It looks like Suricata is the only dependent package of libhtp2 at the moment so any changes related to libhtp2 will not have any consequences for anything else.

vyos@vyos:~$ apt rdepends libhtp2
libhtp2
Reverse Depends:
  Depends: suricata (>= 1:0.5.42-1~)

[asklymenko]

Service:

vyos@vyos:~$ sudo systemctl status suricata.service
● suricata.service - Suricata IDS/IDP daemon
     Loaded: loaded (/lib/systemd/system/suricata.service; disabled; preset: enabled)
    Drop-In: /etc/systemd/system/suricata.service.d
             └─10-override.conf
     Active: active (running) since Mon 2025-09-29 13:48:28 UTC; 21s ago
       Docs: man:suricata(8)
             man:suricatasc(8)
             https://suricata.io/documentation/
    Process: 4158 ExecStart=/usr/bin/suricata -D --af-packet -c /run/suricata/suricata.yaml --pidfile /run/suricata/suricata.pid (code=exited, status=0/SUCCESS)
   Main PID: 4160 (Suricata-Main)
      Tasks: 9 (limit: 19152)
     Memory: 121.7M
        CPU: 1.484s
     CGroup: /system.slice/suricata.service
             └─4160 /usr/bin/suricata -D --af-packet -c /run/suricata/suricata.yaml --pidfile /run/suricata/suricata.pid

Sep 29 13:48:27 vyos systemd[1]: Starting Suricata IDS/IDP daemon...
Sep 29 13:48:27 vyos suricata[4158]: Notice: suricata: This is Suricata version 7.0.10 RELEASE running in SYSTEM mode
Sep 29 13:48:27 vyos suricata[4158]: Info: cpu: CPUs/cores online: 3
Sep 29 13:48:27 vyos suricata[4158]: Info: suricata: Setting engine mode to IDS mode by default
Sep 29 13:48:28 vyos systemd[1]: Started Suricata IDS/IDP daemon.
vyos@vyos:~$

Config:

$ show conf
...
    suricata {
        address-group testg {
        }
        interface eth0
        port-group ssh {
            port 22
        }
    }
...

[sever-sever]

The service appears to be working based on the output.
A backport is not required, as we do not have it for 1.5.x