Hello Sylvain, ti 14.7.2026 klo 17.00 Sylvain Beucler ([email protected]) kirjoitti: > On 14/07/2026 15:19, Martin-Éric Racine wrote: > >>> - Please explain how you tested the update. > >> > >> See Bug#1141987. I don't have any Bullseye host left, but the fixes > >> are one-character changes that have been verified to boot on Bookworm > >> and Trixie. > > I believe this needs an actual test, too many times I've seen updates > that shouldn't fail, do fail -_- > > You can run a bullseye VM and do some manual tests.
Please note that dhcpcd5 hadn't seen any update in ages. Version 7.1.0-2 was uploaded many Debian releases before Bullseye and left unattended until I took over maintenance just before Bookworm, renamed it dhcpcd and packaged the latest upstream. Given this, two of the autopkgtest targets didn't work. One was easily fixed, while the other fails because it expects features that haven't been offered by the dependency for a while, so I marked it FLAKY. > Additionally, Salsa CI only ran trivial tests, due to lack of > 'isolation-machine' support: > https://salsa.debian.org/debian/dhcpcd/-/pipelines/1129013 > https://salsa.debian.org/debian/dhcpcd/-/jobs/9954999 We only need isolation-machine to perform consecutive installations of mutually-exclusive NTP daemons and test that our exit hooks correctly pass DHCP-provided NTP servers to the daemon. DHCP is not tested per-se. However, _all_ of our NTP hook tests would fail if we couldn't fetch an IP via DHCP. Here, only one NTP test fails for the above reason. > We have some docs for testing locally with autopkgtest: > https://lts-team.pages.debian.net/wiki/TestSuites/autopkgtest.html#full-vm-environment-isolation-machine Which only works until Bookworm. Qemu stalls at the login prompt in Trixie and later (bug already filed). Anyhow, Bullseye still works, which is how I was able to test and fix those autopkgtest targets as above. chrony-ntp-servers-from-dhcp FLAKY non-zero exit status 2 timesyncd-ntp-servers-from-dhcp PASS ntpd-ntp-servers-from-dhcp PASS openntpd-ntp-servers-from-dhcp PASS sbin-dhcpcd-exists-without-usrmerge PASS sbin-dhcpcd-exists-with-usrmerge PASS qemu-system-x86_64: terminating on signal 15 from pid 250471 (/usr/bin/python3) We're now up to the attached debdiff. Are we good with this one? Martin-Éric
diff --git a/debian/changelog b/debian/changelog index 97a58386..7513864f 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,25 @@ +dhcpcd5 (7.1.0-2+deb11u1) bullseye-security; urgency=medium + + * [autopkgtest] + + Mark the Chrony test as FLAKY. + + Fix the timesyncd test. + * [control] + = Put myself as the Maintainer since I maintain subsequent releases. + = Migrate Vcs-Browser and Vcs-Git to the current Salsa URL. + * [copyright] + + Add myself to the debian/* block. + * [patches] + + Cherry-pick upstream fix for CVE-2025-70102 (commit 117742d). + + Cherry-pick upstream fix for CVE-2026-56114 (commit 2f00c7b). + * [salsa-ci.yml] + + Implement basic CI support using the stock Debian pipeline include. + * [upstream] + + Add upstream PGP signing key to quiet the Salsa CI uscan test. + * [watch] + = Update to current Github URL to quiet the Salsa CI uscan test. + + -- Martin-Éric Racine <[email protected]> Wed, 15 Jul 2026 10:33:22 +0300 + dhcpcd5 (7.1.0-2) unstable; urgency=high * Apply upstream patches to fix potential security vulnerabilities: diff --git a/debian/control b/debian/control index 96abd6ac..54cd8554 100644 --- a/debian/control +++ b/debian/control @@ -1,13 +1,13 @@ Source: dhcpcd5 Section: net Priority: optional -Maintainer: Scott Leggett <[email protected]> +Maintainer: Martin-Éric Racine <[email protected]> Build-Depends: debhelper (>= 11) Standards-Version: 4.3.0 Homepage: https://roy.marples.name/projects/dhcpcd -Vcs-Browser: https://salsa.debian.org/smlx-guest/dhcpcd5 -Vcs-Git: https://salsa.debian.org/smlx-guest/dhcpcd5.git +Vcs-Browser: https://salsa.debian.org/debian/dhcpcd +Vcs-Git: https://salsa.debian.org/debian/dhcpcd.git Package: dhcpcd5 Provides: diff --git a/debian/copyright b/debian/copyright index ccb8a410..e4aa00ed 100644 --- a/debian/copyright +++ b/debian/copyright @@ -61,6 +61,7 @@ Copyright: 2010-2013 Roy Marples <[email protected]> 2013 Christoph Egger <[email protected]> 2014 Salvatore Bonaccorso <[email protected]> 2015 Daniel Echeverry <[email protected]> + 2026 Martin-Éric Racine <[email protected]> License: BSD-2 Files: debian/hooks/* diff --git a/debian/patches/0006_CVE-2025-70102_117742d.patch b/debian/patches/0006_CVE-2025-70102_117742d.patch new file mode 100644 index 00000000..8c2799e0 --- /dev/null +++ b/debian/patches/0006_CVE-2025-70102_117742d.patch @@ -0,0 +1,24 @@ +From 117742d755b591764036dd4218f314f748a3d2b7 Mon Sep 17 00:00:00 2001 +From: Roy Marples <[email protected]> +Date: Sun, 21 Dec 2025 08:31:52 +0000 +Subject: [PATCH] options: Ensure ldop is not NULL dereferenced (#568) + +ldop itself cannot be non NULL as it points to the location. +but *ldop CAN be NULL. + +Fixes #567. +--- + src/if-options.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/src/if-options.c ++++ b/src/if-options.c +@@ -1586,7 +1586,7 @@ + if (*edop) { + dop = &(*edop)->embopts; + dop_len = &(*edop)->embopts_len; +- } else if (ldop) { ++ } else if (*ldop) { + dop = &(*ldop)->embopts; + dop_len = &(*ldop)->embopts_len; + } else { diff --git a/debian/patches/0007_CVE-2026-56114_2f00c7b.patch b/debian/patches/0007_CVE-2026-56114_2f00c7b.patch new file mode 100644 index 00000000..3a277c28 --- /dev/null +++ b/debian/patches/0007_CVE-2026-56114_2f00c7b.patch @@ -0,0 +1,25 @@ +From 2f00c7bfc408b6582d331932dfa47829c4819029 Mon Sep 17 00:00:00 2001 +From: Roy Marples <[email protected]> +Date: Tue, 23 Jun 2026 02:06:55 +0100 +Subject: [PATCH] DHCPv6: Prefix exclude option can be 17 octets (#671) + +Well that's a simple off by one error + +Reported-by: CuB3y0nd <[email protected]> +--- + src/dhcp6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/src/dhcp6.c b/src/dhcp6.c +index 4a15319c..460040bd 100644 +--- a/src/dhcp6.c ++++ b/src/dhcp6.c +@@ -1060,7 +1060,7 @@ dhcp6_makemessage(struct interface *ifp) + + /* RFC6603 Section 4.2 */ + if (ap->prefix_exclude_len) { +- uint8_t exb[16], *ep, u8; ++ uint8_t exb[17], *ep, u8; + const uint8_t *pp; + + n = (size_t)((ap->prefix_exclude_len - diff --git a/debian/patches/series b/debian/patches/series index 960add30..55b14475 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -3,3 +3,6 @@ 0003-DHCP-Fix-a-potential-1-byte-read-overflow-with-DHO_O.patch 0004-auth-Use-consttime_memequal-3-to-compare-hashes.patch 0005-DHCPv6-Fix-a-potential-read-overflow-with-D6_OPTION_.patch +#7.1.0-2+deb11u1 +0006_CVE-2025-70102_117742d.patch +0007_CVE-2026-56114_2f00c7b.patch diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml new file mode 100644 index 00000000..98cf3bda --- /dev/null +++ b/debian/salsa-ci.yml @@ -0,0 +1,3 @@ +--- +include: + - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml diff --git a/debian/tests/control b/debian/tests/control index ff2b8c15..ad519627 100644 --- a/debian/tests/control +++ b/debian/tests/control @@ -1,9 +1,9 @@ Tests: chrony-ntp-servers-from-dhcp Depends: @, iproute2, dnsmasq, chrony -Restrictions: isolation-machine, needs-root, breaks-testbed +Restrictions: isolation-machine, needs-root, breaks-testbed, flaky Tests: timesyncd-ntp-servers-from-dhcp -Depends: @, iproute2, dnsmasq +Depends: @, iproute2, dnsmasq, systemd-timesyncd Restrictions: isolation-machine, needs-root, breaks-testbed Tests: ntpd-ntp-servers-from-dhcp diff --git a/debian/upstream/signing-key.asc b/debian/upstream/signing-key.asc new file mode 100644 index 00000000..06d4dd45 --- /dev/null +++ b/debian/upstream/signing-key.asc @@ -0,0 +1,37 @@ +-----BEGIN PGP PUBLIC KEY BLOCK----- + +xsBNBEkrCoIBCACyCfZ4qEaFPi33OT1EYDziIOb5KnvW3E9zP7O8oHGmhzi+v11X +AsShyiQCFaKD3QgQ/Ra5TV6mjfjV2fPjSXp6wVy9ojvmIFpvIgu1AQJIqkYl0jpV +JFNT1n9RcI3RkZdYYbxkncmp3M8NMhWo0Txpuw6dx2c7gLeQp0PQiwJUPiLS1rUw +KQLFGnPfvMu4koCoxeyYydijR8XuMmEk3KkYxqDKw81IljwhvOiJa9AVik01GMnE +C+9xQcrdaa5+0yqPt3n/9WrGk+yC2oLiSjGgJHNB7niU716gf5HVUYrqEdiuVw4+ +scSjEdCOmRoWcq6D84EIkoXXX0gurSLcHh7xABEBAAHNHlJveSBNYXJwbGVzIDxy +b3lAbWFycGxlcy5uYW1lPsLAkQQTAQgAOxYhBKeF7SdVlV2ek+pZ9ll/l+qa1FVJ +BQJkRp31AhsDBQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEFl/l+qa1FVJ +0u8H/2DUrOEsJYpCSRJTvVX+swpFlsnfq55z0/27QwbPmtHak61WTzfr8psBki4g +xKjpyVTpmvXhJVMzCVoMmUCRbYui2BCJ562yM7puxT3e6H8cCdjoezymkhPp9g2A +Xm2QuHvhVvSi1spilgDm5S3o7E6qeoz2NDkItnXuwYvc3uKAUIg9hfSRjXDopV+H +bo0G4pDI010hr3eRRmcZgPcvL4mzxeLasV9ZVFLCQ78C9h2+SzmkcOXE/SAFNT3J +sg7Z5ferEninNiFIDVSDFg9eunA/uhY45waggtjUSjsgCS4PcJnXsDz/dUCyUvNH +PHi48tImjP9oFXCQcMWYUZyIk9PNJVJveSBNYXJwbGVzIChOZXRCU0QpIDxyb3lA +TmV0QlNELm9yZz7CwHgEEwECACIFAkuAGkkCGwMGCwkIBwMCBhUIAgkKCwQWAgMB +Ah4BAheAAAoJEFl/l+qa1FVJHnMH/2zHxpWdNcfMCkOvUo9ZVGjS2K57fKCIb2EH +whyQPqFcY4OtFYNCJC75s4imY5ym24PCeFxxXG8GLMqgVtK5Bbrnx0UMI68x6UzP ++2ap+SBDFE7FaudCAbdX48ABkrHdLA7VzB+Bk/AbpqEIKz86o8NFVFdAxMLdwrLd +TjGG3figbGEOqBIlFog5c+9ijn8uvhRYW3dIb6b4hQ6laOfmZwKAThVhx3Dk9RBH +9DkHe7jD8+PJ05zdCgAa0cx7w7C/eMcpNNakPLASpgzCEmVCobgpuoEcZXmEv8hJ +ZYQ3bzzKEIHhzQNd5Ack7r7r5MrFspD6y5Q419DybL3NiU9gcdjOwE0ESSsK+gEI +AMOYyNnU8QvuP68M3ODgzy3NgqwUViZCTXKiaJhpCgQWTvVYHFMN/DSCBKIWjpJn +B11rVlzeRRO6sjOBl9wiIOCcvv20Soc2sRdysTH7K4stgLFIFXIqT9QxGeaJwe+l +oSwjtbrCZW7G90H4DMfhM/VbEZjv817434XNIAd3fn2sykOnwm9B8vMdy8jk1/vj ++/lmU/YYFkHLKausbkr+FHRaBLJyBBin/Po5D953BaSe/ATN2IGHSfPo0P4hqJ/G +8Tg8QTeBysDk1UpxePY4Sas/rlkmyi/4ssn65BwsUe9W4BxOjX4XO5Pkg368CVo8 +/rk13uGqzqFFFkShj1BaRtEAEQEAAcLAdgQYAQgAIAIbDBYhBKeF7SdVlV2ek+pZ +9ll/l+qa1FVJBQJkRpwjAAoJEFl/l+qa1FVJ5o4H/0M8J+BaAIRcmq6IPnRknvU9 +FiIXCXliuPOZm0a6Vc+U+a5rr8ErSJXzAK/IqtOzHn7KUrlHT/V6w5VRSmIFjR5e +JVXhdcYB9PywxBjr6ffD7v2X4EGhQCTNzrbwmsXP9PF5ES4s++hZa3XO0fbfxnwO +cu+4jJAENupk9lxduXlU2FIoKKctGpzW8RRmM8b5Afi0XLKfR8w+eL7HXtsIfYqo +QMSOuCupmNd+iWS+RZXm0yl30qnLzKs+ZMUvWgkkTZEUFR29yYnPLBQMcq0c7QVo +iCC8dtq0EwWROJeo+dVtczXZORQ3VPM880fBqy2Ppu61lL8OMUlLxmrxqPFakcY= +=S+ww +-----END PGP PUBLIC KEY BLOCK----- diff --git a/debian/watch b/debian/watch index b104fb31..9ff12d3e 100644 --- a/debian/watch +++ b/debian/watch @@ -1,3 +1,4 @@ -version=3 -https://roy.marples.name/downloads/dhcpcd/dhcpcd-([0-9\.]*)\.(?:zip|tgz|tbz|txz|(?:tar\.(?:gz|bz2|xz))) debian uupdate - +version=4 +opts="mode=git,pgpmode=gittag" \ +https://github.com/NetworkConfiguration/dhcpcd.git refs/tags/v([\d\.]+) \ +debian uupdate --no-symlink
