Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:dhcpcd
User: [email protected]
Usertags: pu
[ Reason ]
Backporting fixes for 2 minor CVEs reported by DSA yesterday.
CVE-2025-70102 was fixed in 10.3.1 (Sid has 10.3.2) but never backported until
now.
Meanwhile, the fix for CVE-2026-56114 has long been sitting in upstream Git.
Both patches have been applied to Sid/Forky pending a new upstream release.
Also both patches have been applied to Trixie (see similar trixie-pu bug).
[ Impact ]
Minor.
[ Tests ]
Verified to boot on a host running Bookworm.
[ Risks ]
Minor. Both patches are one-line fixes.
[ Checklist ]
[*] *all* changes are documented in the d/changelog
[*] I reviewed all changes and I approve them
[*] attach debdiff against the package in (old)stable
[*] the issue is verified as fixed in unstable
[ Changes ]
dhcpcd5 (9.4.1-24~deb12u5) bookworm; urgency=medium
.
* [control]
= Migrate Build-Depends from pkg-config to pkgconf.
* [salsa-ci.yml]
+ Implement basic CI support using the stock Debian pipeline include.
* [patches] (Closes: #1140767)
+ Cherry-pick upstream fix for CVE-2025-70102 (commit 117742d).
+ Cherry-pick upstream fix for CVE-2026-56114 (commit 2f00c7b).
= Refresh all patches.
diff --git a/debian/changelog b/debian/changelog
index fe291ccb..96f007ea 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+dhcpcd5 (9.4.1-24~deb12u5) bookworm; urgency=medium
+
+ * [control]
+ = Migrate Build-Depends from pkg-config to pkgconf.
+ * [salsa-ci.yml]
+ + Implement basic CI support using the stock Debian pipeline include.
+ * [patches] (Closes: #1140767)
+ + Cherry-pick upstream fix for CVE-2025-70102 (commit 117742d).
+ + Cherry-pick upstream fix for CVE-2026-56114 (commit 2f00c7b).
+ = Refresh all patches.
+
+ -- Martin-Éric Racine <[email protected]> Sun, 28 Jun 2026 12:02:44
+0300
+
dhcpcd5 (9.4.1-24~deb12u4) bookworm; urgency=medium
* Add --no-stop-on-upgrade --no-restart-after-upgrade (Closes: #1057959).
diff --git a/debian/control b/debian/control
index fdfc87a6..172998bb 100644
--- a/debian/control
+++ b/debian/control
@@ -5,7 +5,7 @@ Homepage: https://roy.marples.name/projects/dhcpcd
Maintainer: Martin-Éric Racine <[email protected]>
Build-Depends: debhelper-compat (= 13),
libudev-dev [linux-any],
- pkg-config
+ pkgconf
Rules-Requires-Root: no
Standards-Version: 4.6.2
Vcs-Browser: https://salsa.debian.org/debian/dhcpcd
diff --git a/debian/patches/0001_typo-in-manual-page.patch
b/debian/patches/0001_typo-in-manual-page.patch
index 6336b9af..a074ef2e 100644
--- a/debian/patches/0001_typo-in-manual-page.patch
+++ b/debian/patches/0001_typo-in-manual-page.patch
@@ -6,9 +6,9 @@ Origin: Debian
Forwarded: yes
Last-Update: 2022-02-22
---- dhcpcd5-9.4.1.orig/hooks/dhcpcd-run-hooks.8.in
-+++ dhcpcd5-9.4.1/hooks/dhcpcd-run-hooks.8.in
-@@ -94,7 +94,7 @@ dhcpcd lost the carrier.
+--- a/hooks/dhcpcd-run-hooks.8.in
++++ b/hooks/dhcpcd-run-hooks.8.in
+@@ -94,7 +94,7 @@
The cable may have been unplugged or association to the wireless point lost.
.It Dv NOCARRIER_ROAMING
dhcpcd lost the carrier but the interface configuration is persisted.
@@ -17,9 +17,9 @@ Last-Update: 2022-02-22
.It Dv INFORM | Dv INFORM6
dhcpcd informed a DHCP server about its address and obtained other
configuration details.
---- dhcpcd5-9.4.1.orig/src/dhcpcd.8.in
-+++ dhcpcd5-9.4.1/src/dhcpcd.8.in
-@@ -267,7 +267,7 @@ instead of the default
+--- a/src/dhcpcd.8.in
++++ b/src/dhcpcd.8.in
+@@ -267,7 +267,7 @@
.It Fl D , Fl Fl duid Op Ar ll | lt | uuid | value
Use a DHCP Unique Identifier.
If a system UUID is available, that will be used to create a DUID-UUID,
@@ -28,7 +28,7 @@ Last-Update: 2022-02-22
(link local address + time) is generated,
otherwise DUID-LL is generated (link local address).
The DUID type can be hinted as an optional parameter if the file
-@@ -671,7 +671,7 @@ from the DHCP message before processing.
+@@ -671,7 +671,7 @@
Print the
.Pa pidfile
.Nm
@@ -37,9 +37,9 @@ Last-Update: 2022-02-22
.It Fl Q , Fl Fl require Ar option
Requires the
.Ar option
---- dhcpcd5-9.4.1.orig/src/dhcpcd.conf.5.in
-+++ dhcpcd5-9.4.1/src/dhcpcd.conf.5.in
-@@ -216,7 +216,7 @@ of the hardware family and the hardware
+--- a/src/dhcpcd.conf.5.in
++++ b/src/dhcpcd.conf.5.in
+@@ -216,7 +216,7 @@
.It Ic duid Op ll | lt | uuid | value
Use a DHCP Unique Identifier.
If a system UUID is available, that will be used to create a DUID-UUID,
diff --git a/debian/patches/0002_type_to_command-v.patch
b/debian/patches/0002_type_to_command-v.patch
index 0153dcff..d1aa06c1 100644
--- a/debian/patches/0002_type_to_command-v.patch
+++ b/debian/patches/0002_type_to_command-v.patch
@@ -13,11 +13,9 @@ command -v is now required by POSIX, type is technically an
extension.
hooks/dhcpcd-run-hooks.in | 10 +++++-----
6 files changed, 14 insertions(+), 14 deletions(-)
-diff --git a/hooks/10-wpa_supplicant b/hooks/10-wpa_supplicant
-index 04acce08..1da0108d 100644
--- a/hooks/10-wpa_supplicant
+++ b/hooks/10-wpa_supplicant
-@@ -102,8 +102,8 @@ wpa_supplicant_stop()
+@@ -102,8 +102,8 @@
}
if [ "$ifwireless" = "1" ] && \
@@ -28,11 +26,9 @@ index 04acce08..1da0108d 100644
then
case "$reason" in
PREINIT) wpa_supplicant_start;;
-diff --git a/hooks/20-resolv.conf b/hooks/20-resolv.conf
-index 504a6c53..7c29e276 100644
--- a/hooks/20-resolv.conf
+++ b/hooks/20-resolv.conf
-@@ -11,7 +11,7 @@ nocarrier_roaming_dir="$state_dir/roaming"
+@@ -11,7 +11,7 @@
NL="
"
: ${resolvconf:=resolvconf}
@@ -41,11 +37,9 @@ index 504a6c53..7c29e276 100644
have_resolvconf=true
else
have_resolvconf=false
-diff --git a/hooks/29-lookup-hostname b/hooks/29-lookup-hostname
-index 811c7a9c..a1540dd9 100644
--- a/hooks/29-lookup-hostname
+++ b/hooks/29-lookup-hostname
-@@ -4,20 +4,20 @@ lookup_hostname()
+@@ -4,20 +4,20 @@
{
[ -z "$new_ip_address" ] && return 1
# Silly ISC programs love to send error text to stdout
@@ -69,11 +63,9 @@ index 811c7a9c..a1540dd9 100644
h=$(getent hosts $new_ip_address)
if [ $? = 0 ]; then
echo "$h" | sed 's/[^ ]* *\([^ ]*\).*/\1/'
-diff --git a/hooks/30-hostname.in b/hooks/30-hostname.in
-index abeb3696..b0a37576 100644
--- a/hooks/30-hostname.in
+++ b/hooks/30-hostname.in
-@@ -25,7 +25,7 @@ _hostname()
+@@ -25,7 +25,7 @@
if [ -z "${1+x}" ]; then
if [ -r /proc/sys/kernel/hostname ]; then
read name </proc/sys/kernel/hostname && echo "$name"
@@ -82,7 +74,7 @@ index abeb3696..b0a37576 100644
hostname
elif sysctl kern.hostname >/dev/null 2>&1; then
sysctl -n kern.hostname
-@@ -39,7 +39,7 @@ _hostname()
+@@ -39,7 +39,7 @@
if [ -w /proc/sys/kernel/hostname ]; then
echo "$1" >/proc/sys/kernel/hostname
@@ -91,11 +83,9 @@ index abeb3696..b0a37576 100644
hostname "$1"
elif sysctl kern.hostname >/dev/null 2>&1; then
sysctl -w "kern.hostname=$1" >/dev/null
-diff --git a/hooks/50-ntp.conf b/hooks/50-ntp.conf
-index 046ab6b3..767e8360 100644
--- a/hooks/50-ntp.conf
+++ b/hooks/50-ntp.conf
-@@ -43,7 +43,7 @@ fi
+@@ -43,7 +43,7 @@
# Debian has a separate file for DHCP config to avoid stamping on
# the master.
@@ -104,11 +94,9 @@ index 046ab6b3..767e8360 100644
[ -e /var/lib/ntp ] || mkdir /var/lib/ntp
: ${ntp_service:=ntp}
: ${NTP_DHCP_CONF:=/var/lib/ntp/ntp.conf.dhcp}
-diff --git a/hooks/dhcpcd-run-hooks.in b/hooks/dhcpcd-run-hooks.in
-index a237f6af..c858da3b 100644
--- a/hooks/dhcpcd-run-hooks.in
+++ b/hooks/dhcpcd-run-hooks.in
-@@ -67,7 +67,7 @@ key_get_value()
+@@ -67,7 +67,7 @@
key="$1"
shift
@@ -117,7 +105,7 @@ index a237f6af..c858da3b 100644
sed -n "s/^$key//p" $@
else
for x do
-@@ -89,7 +89,7 @@ remove_markers()
+@@ -89,7 +89,7 @@
in_marker=0
shift; shift
@@ -126,7 +114,7 @@ index a237f6af..c858da3b 100644
sed "/^$m1/,/^$m2/d" $@
else
for x do
-@@ -109,9 +109,9 @@ comp_file()
+@@ -109,9 +109,9 @@
{
[ -e "$1" ] && [ -e "$2" ] || return 1
@@ -138,7 +126,7 @@ index a237f6af..c858da3b 100644
diff -q "$1" "$2" >/dev/null
else
# Hopefully we're only working on small text files ...
-@@ -178,7 +178,7 @@ syslog()
+@@ -178,7 +178,7 @@
err|error) echo "$interface: $*" >&2;;
*) echo "$interface: $*";;
esac
diff --git a/debian/patches/0003_RFC4862_minimum_lft.patch
b/debian/patches/0003_RFC4862_minimum_lft.patch
index 826ba3cf..123fcbfe 100644
--- a/debian/patches/0003_RFC4862_minimum_lft.patch
+++ b/debian/patches/0003_RFC4862_minimum_lft.patch
@@ -18,11 +18,9 @@ Subject: [PATCH] inet6: Support RFC 4862 5.5.3.e in regards
to Valid Lifetime
src/ipv6nd.h | 2 ++
2 files changed, 63 insertions(+), 11 deletions(-)
-diff --git a/src/ipv6nd.c b/src/ipv6nd.c
-index 4b9c735d..94ffebd4 100644
--- a/src/ipv6nd.c
+++ b/src/ipv6nd.c
-@@ -1314,6 +1314,9 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+@@ -1306,6 +1306,9 @@
switch (ndo.nd_opt_type) {
case ND_OPT_PREFIX_INFORMATION:
@@ -32,7 +30,7 @@ index 4b9c735d..94ffebd4 100644
loglevel = new_data ? LOG_ERR : LOG_DEBUG;
if (ndo.nd_opt_len != 4) {
logmessage(loglevel,
-@@ -1337,9 +1340,10 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+@@ -1329,9 +1332,10 @@
ifp->name);
continue;
}
@@ -46,7 +44,7 @@ index 4b9c735d..94ffebd4 100644
logmessage(loglevel, "%s: pltime > vltime",
ifp->name);
continue;
-@@ -1364,10 +1368,15 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+@@ -1356,10 +1360,15 @@
&pi_prefix, pi.nd_opt_pi_prefix_len, flags);
if (ia == NULL)
break;
@@ -63,7 +61,7 @@ index 4b9c735d..94ffebd4 100644
TAILQ_INSERT_TAIL(&rap->addrs, ia, next);
#ifdef IPV6_MANAGETEMPADDR
-@@ -1384,18 +1393,58 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+@@ -1376,18 +1385,58 @@
else
new_ia = true;
#endif
@@ -129,7 +127,7 @@ index 4b9c735d..94ffebd4 100644
if (ia->prefix_vltime != 0 &&
ia->flags & IPV6_AF_AUTOCONF)
has_address = true;
-@@ -1418,6 +1467,7 @@ ipv6nd_handlera(struct dhcpcd_ctx *ctx,
+@@ -1410,6 +1459,7 @@
}
#endif
break;
@@ -137,11 +135,9 @@ index 4b9c735d..94ffebd4 100644
case ND_OPT_MTU:
if (len < sizeof(mtu)) {
-diff --git a/src/ipv6nd.h b/src/ipv6nd.h
-index fd5990cf..2efc3536 100644
--- a/src/ipv6nd.h
+++ b/src/ipv6nd.h
-@@ -98,6 +98,8 @@ struct rs_state {
+@@ -98,6 +98,8 @@
#define RETRANS_TIMER 1000 /* milliseconds */
#define DELAY_FIRST_PROBE_TIME 5 /* seconds */
diff --git a/debian/patches/0005_fix_configure_prefix.patch
b/debian/patches/0005_fix_configure_prefix.patch
index 46aa809b..1b1fc960 100644
--- a/debian/patches/0005_fix_configure_prefix.patch
+++ b/debian/patches/0005_fix_configure_prefix.patch
@@ -9,11 +9,9 @@ Fixes #139
configure | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/configure b/configure
-index 8ff66a1a..daee6df9 100755
--- a/configure
+++ b/configure
-@@ -71,7 +71,7 @@ for x do
+@@ -71,7 +71,7 @@
--disable-privsep) PRIVSEP=no;;
--enable-privsep) PRIVSEP=yes;;
--privsepuser) PRIVSEP_USER=$var;;
diff --git a/debian/patches/0006_skip_hooks_with_tilde.patch
b/debian/patches/0006_skip_hooks_with_tilde.patch
index 3216f597..ca0a24ee 100644
--- a/debian/patches/0006_skip_hooks_with_tilde.patch
+++ b/debian/patches/0006_skip_hooks_with_tilde.patch
@@ -11,11 +11,9 @@ appears to be the intent of this code.
hooks/dhcpcd-run-hooks.in | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/hooks/dhcpcd-run-hooks.in b/hooks/dhcpcd-run-hooks.in
-index c858da3b..b0dc2ea5 100644
--- a/hooks/dhcpcd-run-hooks.in
+++ b/hooks/dhcpcd-run-hooks.in
-@@ -338,9 +338,11 @@ for hook in \
+@@ -338,9 +338,11 @@
@HOOKDIR@/* \
@SYSCONFDIR@/dhcpcd.exit-hook
do
diff --git a/debian/patches/0007_set_buffer_lenght_to_0.patch
b/debian/patches/0007_set_buffer_lenght_to_0.patch
index b68e907a..217d8c57 100644
--- a/debian/patches/0007_set_buffer_lenght_to_0.patch
+++ b/debian/patches/0007_set_buffer_lenght_to_0.patch
@@ -9,11 +9,9 @@ Fixes #156.
src/dhcp.c | 1 +
1 file changed, 1 insertion(+)
-diff --git a/src/dhcp.c b/src/dhcp.c
-index ce3b87c8..c7154634 100644
--- a/src/dhcp.c
+++ b/src/dhcp.c
-@@ -3833,6 +3833,7 @@ dhcp_free(struct interface *ifp)
+@@ -3833,6 +3833,7 @@
free(ctx->opt_buffer);
ctx->opt_buffer = NULL;
diff --git a/debian/patches/0008_fix_incorrect_assert.patch
b/debian/patches/0008_fix_incorrect_assert.patch
index 60336a0b..66f3fcdf 100644
--- a/debian/patches/0008_fix_incorrect_assert.patch
+++ b/debian/patches/0008_fix_incorrect_assert.patch
@@ -8,11 +8,9 @@ Fix incorrect CTASSERT in ND_OPT_DNSSL
src/ipv6nd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/src/ipv6nd.c b/src/ipv6nd.c
-index 24274790..906bb93e 100644
--- a/src/ipv6nd.c
+++ b/src/ipv6nd.c
-@@ -92,7 +92,7 @@ struct nd_opt_dnssl { /* DNSSL option RFC
6106 */
+@@ -92,7 +92,7 @@
uint32_t nd_opt_dnssl_lifetime;
/* followed by list of DNS servers */
};
diff --git a/debian/patches/0009_allow_newfstatat_syscall.patch
b/debian/patches/0009_allow_newfstatat_syscall.patch
index 93f6d1b8..842798f9 100644
--- a/debian/patches/0009_allow_newfstatat_syscall.patch
+++ b/debian/patches/0009_allow_newfstatat_syscall.patch
@@ -9,11 +9,9 @@ As reported in #84 and #89.
src/privsep-linux.c | 3 +++
1 file changed, 3 insertions(+)
-diff --git a/src/privsep-linux.c b/src/privsep-linux.c
-index 4d5c195d..66aeb490 100644
--- a/src/privsep-linux.c
+++ b/src/privsep-linux.c
-@@ -353,6 +353,9 @@ static struct sock_filter ps_seccomp_filter[] = {
+@@ -325,6 +325,9 @@
#ifdef __NR_nanosleep
SECCOMP_ALLOW(__NR_nanosleep), /* XXX should use ppoll instead */
#endif
diff --git a/debian/patches/0010_miss_seccomp_on_ppc64el.patch
b/debian/patches/0010_miss_seccomp_on_ppc64el.patch
index 969a1914..30432bfe 100644
--- a/debian/patches/0010_miss_seccomp_on_ppc64el.patch
+++ b/debian/patches/0010_miss_seccomp_on_ppc64el.patch
@@ -10,11 +10,9 @@ Signed-off-by: Xiangyu Chen <[email protected]>
src/privsep-linux.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
-diff --git a/src/privsep-linux.c b/src/privsep-linux.c
-index 7372d26b..6a301950 100644
--- a/src/privsep-linux.c
+++ b/src/privsep-linux.c
-@@ -232,7 +232,11 @@ ps_root_sendnetlink(struct dhcpcd_ctx *ctx, int protocol,
struct msghdr *msg)
+@@ -213,7 +213,11 @@
#elif defined(__or1k__)
# define SECCOMP_AUDIT_ARCH AUDIT_ARCH_OPENRISC
#elif defined(__powerpc64__)
diff --git a/debian/patches/117742d755b591764036dd4218f314f748a3d2b7.patch
b/debian/patches/117742d755b591764036dd4218f314f748a3d2b7.patch
new file mode 100644
index 00000000..c149b0f3
--- /dev/null
+++ b/debian/patches/117742d755b591764036dd4218f314f748a3d2b7.patch
@@ -0,0 +1,26 @@
+From 117742d755b591764036dd4218f314f748a3d2b7 Mon Sep 17 00:00:00 2001
+From: Roy Marples <[email protected]>
+Date: Sun, 21 Dec 2025 08:31:52 +0000
+Subject: [PATCH] options: Ensure ldop is not NULL dereferenced (#568)
+
+ldop itself cannot be non NULL as it points to the location.
+but *ldop CAN be NULL.
+
+Fixes: CVE-2025-70102
+
+Fixes #567.
+---
+ src/if-options.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/if-options.c
++++ b/src/if-options.c
+@@ -1666,7 +1666,7 @@
+ if (*edop) {
+ dop = &(*edop)->embopts;
+ dop_len = &(*edop)->embopts_len;
+- } else if (ldop) {
++ } else if (*ldop) {
+ dop = &(*ldop)->embopts;
+ dop_len = &(*ldop)->embopts_len;
+ } else {
diff --git a/debian/patches/2f00c7bfc408b6582d331932dfa47829c4819029.patch
b/debian/patches/2f00c7bfc408b6582d331932dfa47829c4819029.patch
new file mode 100644
index 00000000..ea29e4fe
--- /dev/null
+++ b/debian/patches/2f00c7bfc408b6582d331932dfa47829c4819029.patch
@@ -0,0 +1,25 @@
+From 2f00c7bfc408b6582d331932dfa47829c4819029 Mon Sep 17 00:00:00 2001
+From: Roy Marples <[email protected]>
+Date: Tue, 23 Jun 2026 02:06:55 +0100
+Subject: [PATCH] DHCPv6: Prefix exclude option can be 17 octets (#671)
+
+Well that's a simple off by one error.
+
+Fixes: CVE-2026-56114
+
+Reported-by: CuB3y0nd <[email protected]>
+---
+ src/dhcp6.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/dhcp6.c
++++ b/src/dhcp6.c
+@@ -993,7 +993,7 @@
+
+ /* RFC6603 Section 4.2 */
+ if (ap->prefix_exclude_len) {
+- uint8_t exb[16], *ep, u8;
++ uint8_t exb[17], *ep, u8;
+ const uint8_t *pp;
+
+ n = (size_t)((ap->prefix_exclude_len -
diff --git a/debian/patches/53e2f6de4ba87d0534c89cae674e6c1a48724ef0.patch
b/debian/patches/53e2f6de4ba87d0534c89cae674e6c1a48724ef0.patch
index c9869176..0065586d 100644
--- a/debian/patches/53e2f6de4ba87d0534c89cae674e6c1a48724ef0.patch
+++ b/debian/patches/53e2f6de4ba87d0534c89cae674e6c1a48724ef0.patch
@@ -11,11 +11,9 @@ Fix for #179.
src/privsep.h | 2 +-
3 files changed, 10 insertions(+), 19 deletions(-)
-diff --git a/src/privsep-inet.c b/src/privsep-inet.c
-index 3a192ee0..7f7494f6 100644
--- a/src/privsep-inet.c
+++ b/src/privsep-inet.c
-@@ -53,7 +53,7 @@ ps_inet_recvbootp(void *arg)
+@@ -53,7 +53,7 @@
{
struct dhcpcd_ctx *ctx = arg;
@@ -24,7 +22,7 @@ index 3a192ee0..7f7494f6 100644
logerr(__func__);
}
#endif
-@@ -67,12 +67,12 @@ ps_inet_recvra(void *arg)
+@@ -67,12 +67,12 @@
struct rs_state *state = RS_STATE(ifp);
struct dhcpcd_ctx *ctx = ifp->ctx;
@@ -39,7 +37,7 @@ index 3a192ee0..7f7494f6 100644
logerr(__func__);
#endif
}
-@@ -84,7 +84,7 @@ ps_inet_recvdhcp6(void *arg)
+@@ -84,7 +84,7 @@
{
struct dhcpcd_ctx *ctx = arg;
@@ -48,7 +46,7 @@ index 3a192ee0..7f7494f6 100644
logerr(__func__);
}
#endif
-@@ -374,7 +374,7 @@ ps_inet_recvinbootp(void *arg)
+@@ -374,7 +374,7 @@
{
struct ps_process *psp = arg;
@@ -57,7 +55,7 @@ index 3a192ee0..7f7494f6 100644
PS_BOOTP, psp->psp_ctx->ps_data_fd) == -1)
logerr(__func__);
}
-@@ -463,7 +463,7 @@ ps_inet_recvin6dhcp6(void *arg)
+@@ -463,7 +463,7 @@
{
struct ps_process *psp = arg;
@@ -66,11 +64,9 @@ index 3a192ee0..7f7494f6 100644
PS_DHCP6, psp->psp_ctx->ps_data_fd) == -1)
logerr(__func__);
}
-diff --git a/src/privsep.c b/src/privsep.c
-index ab29bb7b..0f78907a 100644
--- a/src/privsep.c
+++ b/src/privsep.c
-@@ -897,7 +897,7 @@ ps_sendcmdmsg(int fd, uint16_t cmd, const struct msghdr
*msg)
+@@ -896,7 +896,7 @@
}
ssize_t
@@ -79,7 +75,7 @@ index ab29bb7b..0f78907a 100644
{
struct sockaddr_storage ss = { .ss_family = AF_UNSPEC };
uint8_t controlbuf[sizeof(struct sockaddr_storage)] = { 0 };
-@@ -913,24 +913,15 @@ ps_recvmsg(struct dhcpcd_ctx *ctx, int rfd, uint16_t
cmd, int wfd)
+@@ -912,24 +912,15 @@
ssize_t len = recvmsg(rfd, &msg, 0);
@@ -106,11 +102,9 @@ index ab29bb7b..0f78907a 100644
return len;
}
-diff --git a/src/privsep.h b/src/privsep.h
-index 132f679a..00184d07 100644
--- a/src/privsep.h
+++ b/src/privsep.h
-@@ -192,7 +192,7 @@ ssize_t ps_sendmsg(struct dhcpcd_ctx *, int, uint16_t,
unsigned long,
+@@ -187,7 +187,7 @@
const struct msghdr *);
ssize_t ps_sendcmd(struct dhcpcd_ctx *, int, uint16_t, unsigned long,
const void *data, size_t len);
diff --git a/debian/patches/6e127eac6903524d401b31893167e4529b8ab111.patch
b/debian/patches/6e127eac6903524d401b31893167e4529b8ab111.patch
index 19655b55..021f5902 100644
--- a/debian/patches/6e127eac6903524d401b31893167e4529b8ab111.patch
+++ b/debian/patches/6e127eac6903524d401b31893167e4529b8ab111.patch
@@ -12,11 +12,9 @@ Update for #179.
src/dhcp.c | 4 ++--
2 files changed, 9 insertions(+), 6 deletions(-)
-diff --git a/src/bpf.c b/src/bpf.c
-index 339f3a014..44b08e6e8 100644
--- a/src/bpf.c
+++ b/src/bpf.c
-@@ -612,16 +612,19 @@ static const struct bpf_insn bpf_bootp_base[] = {
+@@ -612,16 +612,19 @@
#define BPF_BOOTP_BASE_LEN __arraycount(bpf_bootp_base)
static const struct bpf_insn bpf_bootp_read[] = {
@@ -40,11 +38,9 @@ index 339f3a014..44b08e6e8 100644
BPF_STMT(BPF_LD + BPF_W + BPF_IND, 0),
BPF_JUMP(BPF_JMP + BPF_JEQ + BPF_K, (BOOTPC << 16) + BOOTPS, 1, 0),
BPF_STMT(BPF_RET + BPF_K, 0),
-diff --git a/src/dhcp.c b/src/dhcp.c
-index f76807605..9a790b50d 100644
--- a/src/dhcp.c
+++ b/src/dhcp.c
-@@ -3459,8 +3459,8 @@ is_packet_udp_bootp(void *packet, size_t plen)
+@@ -3458,8 +3458,8 @@
if (ip_hlen + ntohs(udp.uh_ulen) > plen)
return false;
diff --git a/debian/patches/727c78f503d456875e2a3cee7609288b537d9d25.patch
b/debian/patches/727c78f503d456875e2a3cee7609288b537d9d25.patch
index 96de419c..8a4b457c 100644
--- a/debian/patches/727c78f503d456875e2a3cee7609288b537d9d25.patch
+++ b/debian/patches/727c78f503d456875e2a3cee7609288b537d9d25.patch
@@ -14,11 +14,9 @@ Fixes #283
src/dhcp.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
-diff --git a/src/dhcp.c b/src/dhcp.c
-index a58e1db2..581a9faa 100644
--- a/src/dhcp.c
+++ b/src/dhcp.c
-@@ -3532,12 +3532,6 @@ dhcp_handlebootp(struct interface *ifp, struct bootp
*bootp, size_t len,
+@@ -3528,12 +3528,6 @@
{
size_t v;
@@ -31,7 +29,7 @@ index a58e1db2..581a9faa 100644
/* Unlikely, but appeases sanitizers. */
if (len > FRAMELEN_MAX) {
logerrx("%s: packet exceeded frame length (%zu) from %s",
-@@ -3670,6 +3664,13 @@ dhcp_recvmsg(struct dhcpcd_ctx *ctx, struct msghdr *msg)
+@@ -3663,6 +3657,13 @@
logerr(__func__);
return;
}
diff --git a/debian/patches/series b/debian/patches/series
index e5519b8d..765797fc 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -8,6 +8,10 @@
0008_fix_incorrect_assert.patch
0009_allow_newfstatat_syscall.patch
0010_miss_seccomp_on_ppc64el.patch
+#9.4.1-24_deb12u4
53e2f6de4ba87d0534c89cae674e6c1a48724ef0.patch
6e127eac6903524d401b31893167e4529b8ab111.patch
727c78f503d456875e2a3cee7609288b537d9d25.patch
+#9.4.1-24_deb12u5
+2f00c7bfc408b6582d331932dfa47829c4819029.patch
+117742d755b591764036dd4218f314f748a3d2b7.patch
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
new file mode 100644
index 00000000..98cf3bda
--- /dev/null
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,3 @@
+---
+include:
+ -
https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/recipes/debian.yml
