Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:dhcpcd
User: [email protected]
Usertags: pu
[ Reason ]
This upload fixes an issue with NTP options received via DHCP.
It also imports housekeeping fixes to patches and autopkgtest.
[ Impact ]
Minimal. Without it, the DHCP client still works.
[ Tests ]
Succesfully tested locally with autopkgtest.
[ Risks ]
Trivial changes.
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
dhcpcd (1:10.1.0-11+deb13u5) trixie; urgency=medium
* [autopkgtest]
= Import the refactored timesyncd test from Forky.
This makes it easier to spot if a failure is caused by Salsa CI
inconsistencies or by regressions in the upstream code.
* [patches]
+ Add "Forwarded: not-needed" to all cherry-picks from upstream Git.
+ Add cherry-pick from upstream Git (already in Forky) (Closes: #1148659):
"ntp: Build new_ntp_servers without superfluous spaces"
diff --git a/debian/changelog b/debian/changelog
index 0fbad031..58e9606c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,16 @@
+dhcpcd (1:10.1.0-11+deb13u5) trixie; urgency=medium
+
+ * [autopkgtest]
+ = Import the refactored timesyncd test from Forky.
+ This makes it easier to spot if a failure is caused by Salsa CI
+ inconsistencies or by regressions in the upstream code.
+ * [patches]
+ + Add "Forwarded: not-needed" to all cherry-picks from upstream Git.
+ + Add cherry-pick from upstream Git (already in Forky) (Closes: #1148659):
+ "ntp: Build new_ntp_servers without superfluous spaces"
+
+ -- Martin-Éric Racine <[email protected]> Thu, 13 Aug 2026 20:32:18
+0300
+
dhcpcd (1:10.1.0-11+deb13u4) trixie; urgency=medium
* [patches]
diff --git a/debian/patches/117742d755b591764036dd4218f314f748a3d2b7.patch
b/debian/patches/117742d755b591764036dd4218f314f748a3d2b7.patch
index 9a090b27..aa14695e 100644
--- a/debian/patches/117742d755b591764036dd4218f314f748a3d2b7.patch
+++ b/debian/patches/117742d755b591764036dd4218f314f748a3d2b7.patch
@@ -2,6 +2,7 @@ From 117742d755b591764036dd4218f314f748a3d2b7 Mon Sep 17
00:00:00 2001
From: Roy Marples <[email protected]>
Date: Sun, 21 Dec 2025 08:31:52 +0000
Subject: [PATCH] options: Ensure ldop is not NULL dereferenced (#568)
+Forwarded: not-needed
ldop itself cannot be non NULL as it points to the location.
but *ldop CAN be NULL.
diff --git a/debian/patches/2f00c7bfc408b6582d331932dfa47829c4819029.patch
b/debian/patches/2f00c7bfc408b6582d331932dfa47829c4819029.patch
index a9055cc3..51206a06 100644
--- a/debian/patches/2f00c7bfc408b6582d331932dfa47829c4819029.patch
+++ b/debian/patches/2f00c7bfc408b6582d331932dfa47829c4819029.patch
@@ -2,6 +2,7 @@ From 2f00c7bfc408b6582d331932dfa47829c4819029 Mon Sep 17
00:00:00 2001
From: Roy Marples <[email protected]>
Date: Tue, 23 Jun 2026 02:06:55 +0100
Subject: [PATCH] DHCPv6: Prefix exclude option can be 17 octets (#671)
+Forwarded: not-needed
Well that's a simple off by one error.
diff --git a/debian/patches/5733d3c59a5651f64357ac11c98b4f39895c8d25.patch
b/debian/patches/5733d3c59a5651f64357ac11c98b4f39895c8d25.patch
index f8f8c068..1e76e05b 100644
--- a/debian/patches/5733d3c59a5651f64357ac11c98b4f39895c8d25.patch
+++ b/debian/patches/5733d3c59a5651f64357ac11c98b4f39895c8d25.patch
@@ -1,8 +1,8 @@
From 5733d3c59a5651f64357ac11c98b4f39895c8d25 Mon Sep 17 00:00:00 2001
From: Roy Marples <[email protected]>
Date: Tue, 23 Jun 2026 02:17:10 +0100
-Subject: [PATCH] DHCPv6: When deprecating addresses, restart on prefix
- deletions
+Subject: [PATCH] DHCPv6: When deprecating addresses, restart on prefix
deletions
+Forwarded: not-needed
As that might invalidate the next address to iterate on.
diff --git a/debian/patches/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0.patch
b/debian/patches/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0.patch
index a630a4d5..a912afd9 100644
--- a/debian/patches/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0.patch
+++ b/debian/patches/708b4a56bae080a5b18c2e0c4c6fbe103131a2b0.patch
@@ -2,6 +2,7 @@ From 708b4a56bae080a5b18c2e0c4c6fbe103131a2b0 Mon Sep 17
00:00:00 2001
From: Roy Marples <[email protected]>
Date: Tue, 23 Jun 2026 00:34:58 +0100
Subject: [PATCH] IPv6ND: Free routeinfo when it expires (#670)
+Forwarded: not-needed
Fixes: CVE-2026-56116
diff --git a/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
b/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
index d3bf4cd7..63cbfc6f 100644
--- a/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
+++ b/debian/patches/75289ca54211481d21b0c915db98dd733b30794f.patch
@@ -2,6 +2,7 @@ From 75289ca54211481d21b0c915db98dd733b30794f Mon Sep 17
00:00:00 2001
From: Roy Marples <[email protected]>
Date: Sat, 7 Dec 2024 10:25:44 +0000
Subject: [PATCH] IPv6: Discard NA packets with a zero length option
+Forwarded: not-needed
As per RFC 4861 4.6.
diff --git a/debian/patches/78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch
b/debian/patches/78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch
index 04647fc4..826d2395 100644
--- a/debian/patches/78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch
+++ b/debian/patches/78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch
@@ -2,6 +2,7 @@ From 78ea09ed1633a583dbcde6e7bab9df4639ec8a34 Mon Sep 17
00:00:00 2001
From: Roy Marples <[email protected]>
Date: Mon, 22 Jun 2026 23:41:53 +0100
Subject: [PATCH] control: Avoid hangup in the recvdata path
+Forwarded: not-needed
Instead return an error and bubble it up where it can be
hangup / freed more cleanly.
diff --git a/debian/patches/84c95b689c3903a66b6f5688ee26696be8c3ad60.patch
b/debian/patches/84c95b689c3903a66b6f5688ee26696be8c3ad60.patch
new file mode 100644
index 00000000..23ef8739
--- /dev/null
+++ b/debian/patches/84c95b689c3903a66b6f5688ee26696be8c3ad60.patch
@@ -0,0 +1,42 @@
+From 84c95b689c3903a66b6f5688ee26696be8c3ad60 Mon Sep 17 00:00:00 2001
+From: Roy Marples <[email protected]>
+Date: Fri, 6 Mar 2026 11:48:30 +0000
+Subject: [PATCH] ntp: Build new_ntp_servers without superfluous spaces
+Forwarded: not-needed
+
+Fixes #582.
+---
+ hooks/50-ntp.conf | 4 +++-
+ hooks/50-timesyncd.conf | 4 +++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/hooks/50-ntp.conf b/hooks/50-ntp.conf
+index cbaa37440..c6b36933c 100644
+--- a/hooks/50-ntp.conf
++++ b/hooks/50-ntp.conf
+@@ -131,7 +131,9 @@ remove_ntp_conf()
+ # For ease of use, map DHCP6 names onto our DHCP4 names
+ case "$reason" in
+ BOUND6|RENEW6|REBIND6|REBOOT6|INFORM6)
+- new_ntp_servers="$new_dhcp6_sntp_servers $new_dhcp6_ntp_server_addr
$new_dhcp6_ntp_server_fqdn"
++ new_ntp_servers="$new_dhcp6_sntp_servers"
++ new_ntp_servers="$new_ntp_servers${new_ntp_servers:+
}$new_dhcp6_ntp_server_addr"
++ new_ntp_servers="$new_ntp_servers${new_ntp_servers:+
}$new_dhcp6_ntp_server_fqdn"
+ ;;
+ esac
+
+diff --git a/hooks/50-timesyncd.conf b/hooks/50-timesyncd.conf
+index 8ee722bda..f213bd8c4 100644
+--- a/hooks/50-timesyncd.conf
++++ b/hooks/50-timesyncd.conf
+@@ -54,7 +54,9 @@ add_timesyncd_conf()
+ # For ease of use, map DHCP6 names onto our DHCP4 names
+ case "$reason" in
+ BOUND6|RENEW6|REBIND6|REBOOT6|INFORM6)
+- new_ntp_servers="$new_dhcp6_sntp_servers $new_dhcp6_ntp_server_addr
$new_dhcp6_ntp_server_fqdn"
++ new_ntp_servers="$new_dhcp6_sntp_servers"
++ new_ntp_servers="$new_ntp_servers${new_ntp_servers:+
}$new_dhcp6_ntp_server_addr"
++ new_ntp_servers="$new_ntp_servers${new_ntp_servers:+
}$new_dhcp6_ntp_server_fqdn"
+ ;;
+ esac
+
diff --git a/debian/patches/Debian_uncomment_hostname_in_dhcpcd_conf.patch
b/debian/patches/Debian_uncomment_hostname_in_dhcpcd_conf.patch
index d54bfd0f..43209fda 100644
--- a/debian/patches/Debian_uncomment_hostname_in_dhcpcd_conf.patch
+++ b/debian/patches/Debian_uncomment_hostname_in_dhcpcd_conf.patch
@@ -1,7 +1,7 @@
-Description: Uncomment 'hostname' in dhcpcd.conf (Closes: #1089598)
Author: Martin-Éric Racine <[email protected]>
-Forwarded: not-needed
Last-Update: 2025-01-24
+Description: Uncomment 'hostname' in dhcpcd.conf (Closes: #1089598)
+Forwarded: not-needed
Debian really wants DDNS to work out of the box, so let's uncomment
'hostname' in /etc/dhcpcd.conf until this has been fixed upstream.
diff --git a/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
b/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
index 3e7b67eb..65021fb4 100644
--- a/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
+++ b/debian/patches/Debian_uncomment_ntp_servers_dhcpcd_conf.patch
@@ -1,7 +1,7 @@
-Description: Uncomment 'ntp_servers' in dhcpcd.conf (Closes: #1123962)
Author: Martin-Éric Racine <[email protected]>
-Forwarded: not-needed
Last-Update: 2025-12-25
+Description: Uncomment 'ntp_servers' in dhcpcd.conf (Closes: #1123962)
+Forwarded: not-needed
Debian really wants NTP to work out of the box, so let's uncomment
'ntp_servers' in /etc/dhcpcd.conf until this got fixed upstream.
diff --git a/debian/patches/eac7152ec04f5a330f01ab9504514a03f873b35c.patch
b/debian/patches/eac7152ec04f5a330f01ab9504514a03f873b35c.patch
index cb2550d4..103c6f7b 100644
--- a/debian/patches/eac7152ec04f5a330f01ab9504514a03f873b35c.patch
+++ b/debian/patches/eac7152ec04f5a330f01ab9504514a03f873b35c.patch
@@ -2,6 +2,7 @@ From eac7152ec04f5a330f01ab9504514a03f873b35c Mon Sep 17
00:00:00 2001
From: Roy Marples <[email protected]>
Date: Wed, 5 Feb 2025 18:06:01 +0000
Subject: [PATCH] DHCP: Fix crash when someone deletes our address
+Forwarded: not-needed
Fixes #455
---
diff --git a/debian/patches/series b/debian/patches/series
index 446aa6e0..ebb095bf 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -18,3 +18,5 @@ Debian_uncomment_ntp_servers_dhcpcd_conf.patch
78ea09ed1633a583dbcde6e7bab9df4639ec8a34.patch
#10.1.0-11+deb13u4
75289ca54211481d21b0c915db98dd733b30794f.patch
+#10.1.0-11+deb13u5
+84c95b689c3903a66b6f5688ee26696be8c3ad60.patch
diff --git a/debian/tests/control b/debian/tests/control
index db1df65b..6a662bd7 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -6,7 +6,6 @@ Restrictions: superficial
Tests: timesyncd-ntp-servers-from-dhcp
Depends: dnsmasq,
- ethtool,
iproute2,
systemd-timesyncd,
@
diff --git a/debian/tests/timesyncd-ntp-servers-from-dhcp
b/debian/tests/timesyncd-ntp-servers-from-dhcp
index 37778cd1..f7498156 100755
--- a/debian/tests/timesyncd-ntp-servers-from-dhcp
+++ b/debian/tests/timesyncd-ntp-servers-from-dhcp
@@ -4,73 +4,84 @@ set -e
added_servers_ipv4="/run/systemd/timesyncd.conf.d/dhcpcd-veth1.dhcp.conf"
added_servers_ipv6="/run/systemd/timesyncd.conf.d/dhcpcd-veth1.dhcp6.conf"
server_list_cmd="timedatectl show-timesync"
+sleepy_seconds=5
-# vi: ft=sh
-
-# These common functions ensure that NTP servers obtained from DHCP are
-# made available to the NTP daemon, and that they are removed when
-# releasing the DHCP lease.
+# These checks ensure that NTP servers obtained from DHCP are passed
+# to timesyncd, and then removed when releasing the DHCP lease.
#
-# DEBUGGING NOTE: dhcpcd logs verbosely to the system log even with
-# --quiet.
+# DEBUGGING NOTE: dhcpcd logs verbosely to syslog even with --quiet.
ntp_server_ipv4="192.168.1.50"
ntp_server_ipv6="fdae:9322:f1cc::7"
prepare_interfaces() {
- echo "Preparing virtual interfaces..."
+ echo "Prepare virtual interfaces..."
ip link add veth0 type veth peer name veth1
- ip address add 192.168.1.1/24 dev veth0
- ip address add fdae:9322:f1cc::1/64 dev veth0
+ ip addr add 192.168.1.1/24 dev veth0
+ ip addr add fdae:9322:f1cc::1/64 dev veth0
ip link set dev veth0 up
- # work around veth checksum failures
- ethtool -K veth0 tx off
+ ip -br addr show dev veth0
}
dnsmasq_config() {
- echo "Preparing dnsmasq configuration..."
+ echo "Prepare dnsmasq configuration..."
cat <<EOF >/etc/dnsmasq.conf
interface=veth0
bind-interfaces
dhcp-range=192.168.1.100,192.168.1.150,12h
dhcp-range=fdae:9322:f1cc::9,fdae:9322:f1cc::99,12h
-dhcp-option=option:ntp-server,$ntp_server_ipv4
-dhcp-option=option6:sntp-server,[$ntp_server_ipv6]
+dhcp-option=42,$ntp_server_ipv4
+dhcp-option=option6:31,[$ntp_server_ipv6]
+dhcp-option=option6:56,time.cloudflare.com
enable-ra
log-dhcp
EOF
+ systemctl restart dnsmasq
+ # Reduce probability of race condition which causes dnsmasq
+ # to send RAs from public interface.
+ sleep $sleepy_seconds
+ journalctl -b -u dnsmasq.service | grep -v systemd
}
+#042 ntp_servers array ipaddress
+#00031 sntp_servers array ip6address
+#00056 ntp_server encap
+
configure_interface() {
- echo "Obtaining network configuration for veth1 via dhcp... "
+ echo "Obtain network configuration for veth1 via DHCP... "
dhcpcd --quiet \
- --option=ntp_servers --option=dhcp6_sntp_servers \
+ --option=042 --option=00031 --option=00056 \
--waitip=4 --waitip=6 \
--rebind veth1 2>&1
+ ip -br addr show dev veth1
+ # Wait until the NTP server has reloaded with new configuration.
+ sleep $sleepy_seconds
}
check_ntp_server_obtained() {
- echo -n "Check if the NTP server is made available to daemon..."
- fgrep -q $ntp_server_ipv4 $added_servers_ipv4 &&
- fgrep -q $ntp_server_ipv6 $added_servers_ipv6 &&
- $server_list_cmd | fgrep -q $ntp_server_ipv4 &&
- $server_list_cmd | fgrep -q $ntp_server_ipv6 &&
- echo "SUCCESS!"
+ printf "Check if the NTP servers are made available to DHCP... "
+ grep -F -q $ntp_server_ipv4 $added_servers_ipv4 &&
+ grep -F -q $ntp_server_ipv6 $added_servers_ipv6 &&
+ $server_list_cmd | grep -F -q $ntp_server_ipv4 &&
+ $server_list_cmd | grep -F -q $ntp_server_ipv6 &&
+ echo "SUCCESS!" &&
+ $server_list_cmd | grep -F -e $ntp_server_ipv4 -e $ntp_server_ipv6
}
deconfigure_interface() {
- echo "Release the current lease... "
+ echo "Release the current lease..."
dhcpcd --quiet --release veth1
- sleep 8 # give the ntp daemon time to react
+ # Wait until the NTP server has reloaded with new configuration.
+ sleep $sleepy_seconds
}
check_ntp_server_gone() {
- echo -n "Check if the NTP server has been correctly removed... "
- ! fgrep -qs $ntp_server_ipv4 $added_servers_ipv4 &&
- ! fgrep -qs $ntp_server_ipv6 $added_servers_ipv6 &&
- ! $server_list_cmd | fgrep -q $ntp_server_ipv4 &&
- ! $server_list_cmd | fgrep -q $ntp_server_ipv6 &&
- echo "SUCCESS!"
+ printf "Check if the NTP servers have been correctly removed... "
+ ! grep -F -q -s $ntp_server_ipv4 $added_servers_ipv4 &&
+ ! grep -F -q -s $ntp_server_ipv6 $added_servers_ipv6 &&
+ ! $server_list_cmd | grep -F -q $ntp_server_ipv4 &&
+ ! $server_list_cmd | grep -F -q $ntp_server_ipv6 &&
+ echo "SUCCESS!"
}
get_conf_hash() {
@@ -86,30 +97,30 @@ check_conf_hash() {
if [ -f "$added_servers_ipv4" ]; then
if [ -z "$added_servers_ipv4_hash" ]; then
# there's no hash, so the file didn't exist before
- >&2 echo "ERROR: CONF FILE $added_servers_ipv4 created!"
+ >&2 echo "ERROR: CONF FILE $added_servers_ipv4 CREATED!"
return
fi
- local new_ipv4_hash=$(sha256sum "$added_servers_ipv4" | cut -d'
' -f1)
+ new_ipv4_hash=$(sha256sum "$added_servers_ipv4" | cut -d' ' -f1)
if [ "$new_ipv4_hash" != "$added_servers_ipv4_hash" ]; then
>&2 echo "ERROR: CONF FILE $added_servers_ipv4 CHANGED!"
fi
elif [ -n "$added_servers_ipv4_hash" ]; then
# there's a hash, so the file existed before
- >&2 echo "ERROR: CONF FILE $added_servers_ipv4 deleted!"
+ >&2 echo "ERROR: CONF FILE $added_servers_ipv4 DELETED!"
return
fi
if [ -f "$added_servers_ipv6" ]; then
if [ -z "$added_servers_ipv6_hash" ]; then
- >&2 echo "ERROR: CONF FILE $added_servers_ipv6 created!"
+ >&2 echo "ERROR: CONF FILE $added_servers_ipv6 CREATED!"
return
fi
- local new_ipv6_hash=$(sha256sum "$added_servers_ipv6" | cut -d'
' -f1)
+ new_ipv6_hash=$(sha256sum "$added_servers_ipv6" | cut -d' ' -f1)
if [ "$new_ipv6_hash" != "$added_servers_ipv6_hash" ]; then
>&2 echo "ERROR: CONF FILE $added_servers_ipv6 CHANGED!"
fi
elif [ -n "$added_servers_ipv6_hash" ]; then
- >&2 echo "ERROR: CONF FILE $added_servers_ipv6 deleted!"
+ >&2 echo "ERROR: CONF FILE $added_servers_ipv6 DELETED!"
return
fi
}
@@ -119,24 +130,14 @@ run_test() {
prepare_interfaces
dnsmasq_config
- systemctl restart dnsmasq
- # reduce probability of race condition which causes dnsmasq to send RAs
- # from public interface
- sleep 5
configure_interface
- # wait until ntp server is reloaded with new configuration
- sleep 5
check_ntp_server_obtained
deconfigure_interface
- # wait until ntp server is reloaded with new configuration
- sleep 5
check_ntp_server_gone
check_conf_hash
}
-# End common functions.
-
run_test
