frr (10.4.1-3ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2120326). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: adjust log directory ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped:
    - d/control: go back to libyang2, as libyang3 is still in universe
      [src:libyang MIR approved, see LP #2120329]
    - d/control: Add lua5.4 to build and runtime dependencies
      [In 10.4.1-3]
  * Added:
    - d/rules: set INET_NTOP_NO_OVERRIDE to workaround build failure with newer
      glibc and FORTIFY_SOURCE
    - d/t/{utils,zebra-lo,py-frr-reload,bgpd-snmp-rpki}: Add a controlled loop
      to wait for the service to be ready:

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 13 Aug 2025 09:43:00 -0300

frr (10.4.1-3) sid; urgency=medium

  * Building with lua 5.4, thanks to Andreas Hasenack
    <andreas.hasenack@canonical.com> (Closes: #1110869).

 -- Daniel Baumann <daniel@debian.org>  Tue, 12 Aug 2025 05:10:15 +0200

frr (10.4.1-2) sid; urgency=medium

  * Uploading without changes to sid.

 -- Daniel Baumann <daniel@debian.org>  Sun, 10 Aug 2025 20:57:41 +0200

frr (10.4.1-1) experimental; urgency=medium

  * Merging upstream version 10.4.1.

 -- Daniel Baumann <daniel@debian.org>  Wed, 06 Aug 2025 06:07:31 +0200

frr (10.4.0-1) experimental; urgency=medium

  * Merging upstream version 10.4.0.

 -- Daniel Baumann <daniel@debian.org>  Mon, 21 Jul 2025 06:07:07 +0200

frr (10.3.1-4) experimental; urgency=medium

  * Also build-conflicting against libunwind-14-dev from llvm-
    toolchain-14.

 -- Daniel Baumann <daniel@debian.org>  Sun, 13 Jul 2025 12:12:00 +0200

frr (10.3.1-3) experimental; urgency=medium

  * Adding build-conflicts to libunwind-dev from llvm-toolchain (#1100483)
    to fix FTBFS.

 -- Daniel Baumann <daniel@debian.org>  Sun, 13 Jul 2025 07:38:53 +0200

frr (10.3.1-2) experimental; urgency=medium

  * Updating watch file to exclude pre-releases.
  * Updating maintainer field.

 -- Daniel Baumann <daniel@debian.org>  Tue, 24 Jun 2025 19:44:32 +0200

frr (10.3.1-1) experimental; urgency=medium

  * Merging upstream version 10.3.1.
  * Removing fix-ftbfs-s390x.patch, included upstream.

 -- Daniel Baumann <daniel@debian.org>  Sun, 01 Jun 2025 21:13:56 +0200

frr (10.3-5) experimental; urgency=medium

  * Adding upstream metadata.
  * Adding explicit libcrypt-dev to build-depends, thanks to Helmut Grohne
    <helmut@subdivi.de> (Closes: #1106979).

 -- Daniel Baumann <daniel@debian.org>  Sun, 01 Jun 2025 07:20:19 +0200

frr (10.3-4) experimental; urgency=medium

  * Harmonizing upstream urls.
  * Updating watch file to exclude dev tags.

 -- Daniel Baumann <daniel@debian.org>  Sat, 17 May 2025 09:22:46 +0200

frr (10.3-3ubuntu2) questing; urgency=medium

  * d/control: go back to libyang2, as libyang3 is still in universe

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 13 Jun 2025 11:56:54 -0300

frr (10.3-3ubuntu1) questing; urgency=medium

  * Merge with Debian unstable (LP: #2110434). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: adjust log directory ownership
      + d/frr.logrotate: change rotated log file ownership
    - d/control: Add lua5.4 to build and runtime dependencies
  * Dropped:
    - Fix FTBFS on big-endian systems due to build-time test failure
      (Closes: #1091379):
      + d/p/fix-big-endian-test.patch: Fix TestFrrscript.test_exit_cleanly test
        case on big endian platforms
      + d/rules: don't ignore test failures on s390x
      [Fixed in 10.3-2]
    - d/p/add-lua5.4-support-*.patch: Add support for lua 5.4 (LP #2094850)
      [Included in 10.3 upstream]

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 11 Jun 2025 11:57:35 -0300

frr (10.3-3) sid; urgency=medium

  * Simplifying watch file.

 -- Daniel Baumann <daniel@debian.org>  Fri, 02 May 2025 04:59:37 +0200

frr (10.3-2) sid; urgency=medium

  * Adding patch from upstream to fix FTBFS with tests on s390 and others
    (Closes: #1102693).

 -- Daniel Baumann <daniel@debian.org>  Wed, 16 Apr 2025 12:17:16 +0200

frr (10.3-1) sid; urgency=medium

  * Updating to standards version 4.7.1.
  * Updating to standards version 4.7.2.
  * Merging upstream version 10.3.
  * Removing ftbfs-big-endian.patch, not needed anymore.

 -- Daniel Baumann <daniel@debian.org>  Wed, 12 Mar 2025 10:27:23 +0100

frr (10.2.1-6) sid; urgency=medium

  * Harmonizing watch file.
  * Removing Ondřej from Uploaders as wished and with thanks for his past
    work (#1098233).
  * Wrap and sorting debian files.

 -- Daniel Baumann <daniel@debian.org>  Thu, 20 Feb 2025 06:51:41 +0100

frr (10.2.1-5) sid; urgency=medium

  * Updating vcs fields.
  * Using codename instead of suitename in changelog.

 -- Daniel Baumann <daniel@debian.org>  Sun, 16 Feb 2025 20:31:38 +0100

frr (10.2.1-4) experimental; urgency=medium

  * Building with libyang 3.

 -- Daniel Baumann <daniel@debian.org>  Tue, 11 Feb 2025 20:12:28 +0100

frr (10.2.1-3) sid; urgency=medium

  * Manually adding ftbfs-big-endian.patch from previous upload to git
    (patches are excluded because of upstreams gitignore file).
  * Updating vcs fields.

 -- Daniel Baumann <daniel@debian.org>  Thu, 06 Feb 2025 23:58:04 +0100

frr (10.2.1-2) sid; urgency=medium

  * Adding patch from Helge Deller <deller@kernel.org> to fix FTBFS on all
    big endian architectures (Closes: #1091379).
  * Removing disabling of tests on s390.
  * Removing dpkg-statoverride for /etc/frr in postrm, thanks Andreas
    Hasenack <andreas.hasenack@canonical.com> (Closes: #1091415).

 -- Daniel Baumann <daniel@debian.org>  Tue, 14 Jan 2025 16:58:11 +0100

frr (10.2.1-1ubuntu3) plucky; urgency=medium

  * Re-add scripting support with lua 5.4 (LP: #2094850)
    - d/p/add-lua5.4-support-*.patch: Add support for lua 5.4
    - d/control: Add lua5.4 to build and runtime dependencies
    - d/rules: Revert pkg.frr.nolua build profile addition

 -- Lena Voytek <lena.voytek@canonical.com>  Wed, 15 Jan 2025 17:50:42 -0500

frr (10.2.1-1ubuntu2) plucky; urgency=medium

  * d/control, d/rules: disable scripting support (lua) to avoid a component
    mismatch when building on Ubuntu and derivatives (LP: #2093186)

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 07 Jan 2025 10:50:06 -0300

frr (10.2.1-1ubuntu1) plucky; urgency=medium

  * Merge with Debian unstable (LP: #2085232). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: adjust log directory ownership
      + d/frr.logrotate: change rotated log file ownership
  * Added:
    - Fix FTBFS on big-endian systems due to build-time test failure
      (Closes: #1091379):
      + d/p/fix-big-endian-test.patch: Fix TestFrrscript.test_exit_cleanly test
        case on big endian platforms
      + d/rules: don't ignore test failures on s390x

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 25 Dec 2024 10:20:03 -0300

frr (10.2.1-1) sid; urgency=medium

  * Merging upstream version 10.2.1.

 -- Daniel Baumann <daniel@debian.org>  Tue, 24 Dec 2024 08:34:42 +0100

frr (10.2-2) sid; urgency=medium

  * Avoid failing the testsuite on s390x for now.

 -- Daniel Baumann <daniel@debian.org>  Mon, 16 Dec 2024 16:03:09 +0100

frr (10.2-1) sid; urgency=medium

  * Merging upstream version 10.2.

 -- Daniel Baumann <daniel@debian.org>  Sun, 17 Nov 2024 07:18:11 +0100

frr (10.1.1-3) sid; urgency=medium

  * Changing lua build-profile to match its original intendet purpose of
    enabling scripting support by default but allowing to exclude it if
    needed.
  * Changing pim6d build-profile to match its original intendet purpose of
    enabling pim6d by default but allowing to exclude it if needed
    (Closes: #1071653).
  * Updating TODO file.

 -- Daniel Baumann <daniel@debian.org>  Tue, 12 Nov 2024 14:56:14 +0100

frr (10.1.1-2) sid; urgency=medium

  * Updating to debhelper-compat 13.
  * Updating standards version.
  * Updating homepage field.
  * Trimming alternative from depends pre-bookworm.
  * Trimming versions from depends pre-bookworm.
  * Removing obsolete quagga conflicts.
  * Removing obsolete zebra conflicts.
  * Prefixing debhelper names with explicit package names.
  * Removing obsolete doc-base debhelper file.
  * Removing old lintian-overrides.
  * Making maintainer scripts executable in debian directory.
  * Adding Rules-Requires-Root field.
  * Adding binary package sections explicitly.
  * Wrap and sorting debian packaging files.
  * Skipping sysvinit script.
  * Removing spurious frr.tmpfile copy.
  * Updating package descriptions.
  * Removing redundant information from README.Debian.
  * Removing unused frr-test-tools remains.
  * Trimming README.Maintainer.
  * Renaming remaining README.Maintainers to TODO.
  * Reformating TODO file.
  * Updating TODO file.
  * Replacing adduser with tools from util-linux.
  * Removing now unused quagga upgrade handling in frr postinst.
  * Reformating install files.
  * Rewriting frr.postinst in policy compliant way.
  * Rewriting frr.postrm in policy compliant way.

 -- Daniel Baumann <daniel@debian.org>  Sun, 10 Nov 2024 17:13:38 +0100

frr (10.1.1-1) sid; urgency=medium

  * Adding myself to uploaders, thanks David.
  * Harmonizing my email address in changelog entries.

 -- Daniel Baumann <daniel@debian.org>  Sat, 09 Nov 2024 14:27:13 +0100

frr (10.1.1-0.1) sid; urgency=medium

  * Non-maintainer upload.
  * New upstream release.

 -- Daniel Baumann <daniel@debian.org>  Tue, 17 Sep 2024 05:15:20 +0200

frr (10.1-0.2) sid; urgency=medium

  * Non-maintainer upload to unstable.

 -- Daniel Baumann <daniel@debian.org>  Wed, 11 Sep 2024 13:57:30 +0200

frr (10.1-0.1) experimental; urgency=medium

  * Non-maintainer upload.
  * New upstream release.
  * Removing add-XREF_SETUP-to-libraries-and-utilites.patch, included upstream.
  * Adding conditional in rules to fix FTBFS when building without frr-test-tools.

 -- Daniel Baumann <daniel@debian.org>  Mon, 05 Aug 2024 09:11:22 +0200

frr (10.0.1-0.1ubuntu2) oracular; urgency=medium

  * SECURITY UPDATE: BGP overflow via TLV value
    - debian/patches/CVE-2024-44070.patch: check the actual remaining
      stream length before taking TLV value in bgpd/bgp_attr.c.
    - CVE-2024-44070

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 10 Sep 2024 07:35:31 -0400

frr (10.0.1-0.1ubuntu1) oracular; urgency=medium

  * Merge with Debian unstable (LP: #2064404). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped security patches included upstream:
    - SECURITY UPDATE: DoS via MP_REACH_NLRI data
      + debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
        packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
        bgpd/bgp_packet.c.
      + CVE-2023-46752
    - SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
      + debian/patches/CVE-2023-46753.patch: check mandatory attributes more
        carefully for UPDATE message in bgpd/bgp_attr.c.
      + CVE-2023-46753
    - SECURITY UPDATE: read beyond stream during labeled unicast parsing
      + debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
        labeled unicast parsing in bgpd/bgp_label.c.
      + CVE-2023-38407
    - SECURITY UPDATE: crash via malformed BGP UPDATE message
      + debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
        unwanted handling of malformed attrs in bgpd/bgp_attr.c.
      + CVE-2023-47235
    - SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
      + debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
        received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
        bgpd/bgp_packet.c.
      + CVE-2023-47234
    - SECURITY UPDATE: DoS via malformed OSPF LSA packet
      + debian/patches/CVE-2024-27913.patch: solved crash in OSPF TE parsing
        in ospfd/ospf_te.c.
      + CVE-2024-27913

 -- Andreas Hasenack <andreas@canonical.com>  Mon, 29 Jul 2024 09:49:25 -0300

frr (10.0.1-0.1) sid; urgency=medium

  * Non-maintainer upload.
  * New upstream release:
    - an attacker using a malformed Prefix SID attribute in a BGP UPDATE
      packet can cause the bgpd daemon to crash [CVE-2024-31948]
      (Closes: #1072126)
    - an infinite loop can occur when receiving a MP/GR capability as a
      dynamic capability because malformed data results in a pointer not
      advancing [CVE-2024-31949] (Closes: #1072125)
    - there can be a buffer overflow and daemon crash in ospf_te_parse_ri for
      OSPF LSA packets during an attempt to read Segment Routing subTLVs (their
      size is not validated) [CVE-2024-31950] (Closes: #1070377)
    - there can be a buffer overflow and daemon crash in
      ospf_te_parse_ext_link for OSPF LSA packets during an attempt to read
      Segment Routing Adjacency SID subTLVs (lengths are not validated)
      [CVE-2024-31951 (Closes: #1070377)
    - ospf_te_parse_te in ospfd/ospf_te.c allows remote attackers to cause a
      denial of service (ospfd daemon crash) via a malformed OSPF LSA packet,
      because of an attempted access to a missing attribute field
      [CVE-2024-27913]
    - it is possible for the get_edge() function in ospf_te.c in the OSPF
      daemon to return a NULL pointer. In cases where calling functions do not
      handle the returned NULL value, the OSPF daemon crashes, leading to denial
      of service [CVE-2024-34088] (Closes: #1070377)

 -- Daniel Baumann <daniel@debian.org>  Sat, 27 Jul 2024 02:19:29 +0200

frr (10.0-2) unstable; urgency=medium

  * fix build on hppa
  * only use libunwind on architectures where it is available
  * remove /var/lib/frr on purge
  * drop some ancient dependency alternates

 -- David Lamparter <equinox-debian@diac24.net>  Fri, 03 May 2024 14:53:50 +0200

frr (10.0-1) unstable; urgency=medium

  * IRDP module is no longer packaged (slated to be removed upstream)
  * added mkdir+chown /var/lib/frr which is now used by FRR
  * sysconfdir and localstatedir configure args are no longer needed
  * NB: refer to never-released 8.5.2-1 changes below!
  * Link libatomic unconditionally (closes: #1067077)
  * known to not build on hppa due to struct.calcsize python exception

 -- David Lamparter <equinox-debian@diac24.net>  Tue, 30 Apr 2024 19:36:44 +0200

frr (10.0-0.2) sid; urgency=medium

  * Non-maintainer upload.
  * Linking with atomic like armel to fix FTBFS.

 -- Daniel Baumann <daniel@debian.org>  Sat, 27 Apr 2024 07:44:24 +0200

frr (10.0-0.1) sid; urgency=medium

  * Non-maintainer upload.
  * New upstream release.
  * Bumping libyang2 build-depends to required version.
  * Removing CVE-2024-27913.patch, included upstream.
  * Adding now explicit configure flag to keep enabled building zebra_irdp.

 -- Daniel Baumann <daniel@debian.org>  Sat, 27 Apr 2024 05:46:52 +0200

frr (9.1-0.1) sid; urgency=high

  * Non-maintainer upload.
  * New upstream release (Closes: #1042473, #1055852):
    - CVE-2023-3748: parsing certain babeld unicast hello messages that are
      intended to be ignored. This issue may allow an attacker to send specially
      crafted hello messages with the unicast flag set, the interval field set
      to 0, or any TLV that contains a sub-TLV with the Mandatory flag set to
      enter an infinite loop and cause a denial of service.
    - CVE-2023-38407: bgpd/bgp_label.c attempts to read beyond the end of the
      stream during labeled unicast parsing.
    - CVE-2023-41361: bgpd/bgp_open.c does not check for an overly large
      length of the rcv software version.
    - CVE-2023-46752: It mishandles malformed MP_REACH_NLRI data, leading to a
      crash.
    - CVE-2023-46753: A crash can occur for a crafted BGP UPDATE message
      without mandatory attributes, e.g., one with only an unknown transit
      attribute.
    - CVE-2023-47234: A crash can occur when processing a crafted BGP UPDATE
      message with a MP_UNREACH_NLRI attribute and additional NLRI data (that
      lacks mandatory path attributes).
    - CVE-2023-47235: A crash can occur when a malformed BGP UPDATE message
      with an EOR is processed, because the presence of EOR does not lead to a
      treat-as-withdraw outcome.
  * Updating patches:
    - removing CVE-2023-38802.patch, included upstream.
    - removing CVE-2023-41358.patch, included upstream.
    - removing CVE-2023-41360.patch, included upstream.
    - removing unapplied CVE-2023-41361.patch, included upstream.
    - adding CVE-2024-27913.patch from upstream:
      ospf_te_parse_te in ospfd/ospf_te.c allows remote attackers to cause a
      denial of service (ospfd daemon crash) via a malformed OSPF LSA packet,
      because of an attempted access to a missing attribute field (Closes:
      #1065144).
  * Updating build-depends:
    - adding now required protobuf-c-compiler to build-depends.
    - adding now required libprotobuf-c-dev to build-depends.
    - adding new libmgmt_be_nb.so to frr.install.
    - removing obsolete lsb-base.
    - prefering new pkgconf over old pkg-config.
  * Updating override_dh_auto_clean to fix FTBFS when built twice in a row
    (Closes: #1044470):
    - call dh_auto_clean which is safe to run now.
    - remove tests/.pytest_cache.
  * Removing obsolete doc-base.

 -- Daniel Baumann <daniel@debian.org>  Fri, 08 Mar 2024 23:21:21 +0100

frr (8.5.2-1) UNRELEASED; urgency=medium

  * new upstream release FRR 8.5.2
  * cleaned up outdated debian/README files
  * build against libunwind.  Results in better backtraces captured for both
    crashes and non-crash deviations from expected operations.
    (libunwind is used automatically if present, this also fixes an
    uncontrolled build environment influence on the result binaries by always
    requiring it.)
  * this version was never uploaded to Debian, the changelog entry is here for
    reference.

 -- David Lamparter <equinox-debian@diac24.net>  Sat, 15 Jul 2023 08:33:59 -0700

frr (8.4.4-1.1ubuntu6) noble; urgency=medium

  * No-change rebuild for c-ares t64.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 16 Apr 2024 11:56:13 +0200

frr (8.4.4-1.1ubuntu5) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- Steve Langasek <steve.langasek@ubuntu.com>  Sun, 31 Mar 2024 05:25:32 +0000

frr (8.4.4-1.1ubuntu4) noble; urgency=medium

  * SECURITY UPDATE: DoS via malformed OSPF LSA packet
    - debian/patches/CVE-2024-27913.patch: solved crash in OSPF TE parsing
      in ospfd/ospf_te.c.
    - CVE-2024-27913

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Tue, 05 Mar 2024 08:25:28 -0500

frr (8.4.4-1.1ubuntu3) noble; urgency=medium

  * SECURITY UPDATE: read beyond stream during labeled unicast parsing
    - debian/patches/CVE-2023-38407.patch: fix use beyond end of stream of
      labeled unicast parsing in bgpd/bgp_label.c.
    - CVE-2023-38407
  * SECURITY UPDATE: crash via MP_UNREACH_NLRI attribute
    - debian/patches/CVE-2023-47234.patch: ignore handling NLRIs if we
      received MP_UNREACH_NLRI in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-47234
  * SECURITY UPDATE: crash via malformed BGP UPDATE message
    - debian/patches/CVE-2023-47235.patch: treat EOR as withdrawn to avoid
      unwanted handling of malformed attrs in bgpd/bgp_attr.c.
    - CVE-2023-47235

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Thu, 16 Nov 2023 09:19:43 -0500

frr (8.4.4-1.1ubuntu2) noble; urgency=medium

  * SECURITY UPDATE: DoS via MP_REACH_NLRI data
    - debian/patches/CVE-2023-46752.patch: handle MP_REACH_NLRI malformed
      packets with session reset in bgpd/bgp_attr.c, bgpd/bgp_attr.h,
      bgpd/bgp_packet.c.
    - CVE-2023-46752
  * SECURITY UPDATE: DoS via BGP UPDATE without mandatory attributes
    - debian/patches/CVE-2023-46753.patch: check mandatory attributes more
      carefully for UPDATE message in bgpd/bgp_attr.c.
    - CVE-2023-46753

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 01 Nov 2023 14:12:59 -0400

frr (8.4.4-1.1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2033921). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 01 Sep 2023 15:15:39 -0300

frr (8.4.4-1.1) unstable; urgency=high

  * Non-maintainer upload by the Security Team.
  * Upstream fixes for CVE-2023-38802, CVE-2023-41358, CVE-2023-41360

 -- Aron Xu <aron@debian.org>  Fri, 01 Sep 2023 16:57:41 +0800

frr (8.4.4-1ubuntu1) mantic; urgency=medium

  * Merge with Debian unstable (LP: #2018072). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped:
    - SECURITY UPDATE: denial of service via bgp_capability_llgr()
      + debian/patches/CVE-2023-31489.patch: check 7 bytes for Long-lived
        Graceful-Restart capability in bgpd/bgp_open.c.
      + CVE-2023-31489
        [Fixed upstream in 8.4.4]
    - SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
      + debian/patches/CVE-2023-31490.patch: ensure stream received has
        enough data in bgpd/bgp_attr.c.
      + CVE-2023-31490
        [Fixed upstream in version 8.4.4]

 -- Andreas Hasenack <andreas@canonical.com>  Wed, 26 Jul 2023 17:43:05 -0300

frr (8.4.4-1) unstable; urgency=medium

  * new upstream release FRR 8.4.4
  * upstream fix CVE-2023-31489 (closes: #1036061)
  * upstream fix CVE-2023-31490 (closes: #1036062)
  * correctly use sphinxdoc:Built-Using
  * point watch file at git tarball, no more upstream dist tarballs

 -- David Lamparter <equinox-debian@diac24.net>  Wed, 12 Jul 2023 14:28:34 +0200

frr (8.4.2-1ubuntu2) mantic; urgency=medium

  * SECURITY UPDATE: denial of service via bgp_capability_llgr()
    - debian/patches/CVE-2023-31489.patch: check 7 bytes for Long-lived
      Graceful-Restart capability in bgpd/bgp_open.c.
    - CVE-2023-31489
  * SECURITY UPDATE: denial of service via bgp_attr_psid_sub()
    - debian/patches/CVE-2023-31490.patch: ensure stream received has
      enough data in bgpd/bgp_attr.c.
    - CVE-2023-31490

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 02 Jun 2023 13:14:57 -0400

frr (8.4.2-1ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable. Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <andreas@canonical.com>  Sun, 29 Jan 2023 15:28:40 -0300

frr (8.4.2-1) unstable; urgency=medium

  * new upstream release FRR 8.4.2
  * drop all patches in debian/patches/, they got merged upstream

 -- David Lamparter <equinox-debian@diac24.net>  Mon, 23 Jan 2023 17:32:02 +0100

frr (8.4.1-2ubuntu1) lunar; urgency=medium

  * Merge with Debian unstable (LP: #1993401). Remaining changes:
    - Fix logging with Ubuntu's unprivileged rsyslog (LP #1958162):
      + d/frr.postinst: change log files ownership
      + d/frr.logrotate: change rotated log file ownership
  * Dropped (fixed upstream):
    - SECURITY UPDATE: overflow via input packet length
      + debian/patches/CVE-2022-26125.patch: fix router capability TLV
        parsing issues in isisd/isis_tlvs.*.
      + debian/patches/disable_isisd_fuzz_test.patch: disable fuzz tests as
        the security update changed expected results in
        tests/isisd/test_fuzz_isis_tlv.py.
      + CVE-2022-26125
    - SECURITY UPDATE: overflow via use of strdup with binary string
      + debian/patches/CVE-2022-26126.patch: use base64 encoding in
        isisd/isis_nb_notifications.c, lib/base64.c, lib/base64.h,
        lib/subdir.am, lib/yang_wrappers.c, lib/yang_wrappers.h.
      + CVE-2022-26126
    - SECURITY UPDATE: overflow via missing check on the input packet length
      + debian/patches/CVE-2022-26127.patch: add check on packet length in
        babeld/message.c.
      + CVE-2022-2612
    - SECURITY UPDATE: overflow via wrong checks
      + debian/patches/CVE-2022-26128_9.patch: fix checks on length in
        babeld/message.c.
      + CVE-2022-26128
      + CVE-2022-26129
    - SECURITY UPDATE: DoS via out-of-bounds read
      + debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
        minimum of what is expected in bgpd/bgp_packet.c.
      + CVE-2022-37032
    - SECURITY UPDATE: use-after-free due to a race condition
      + debian/patches/CVE-2022-37035.patch: avoid notify race between io and
        main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
      + CVE-2022-37035

 -- Andreas Hasenack <andreas@canonical.com>  Sun, 08 Jan 2023 17:57:05 -0300

frr (8.4.1-2) unstable; urgency=medium

  * commit to git tarball as source instead of dist tarball
  * ditch unneeded sphinx missing files patch
  * fix clippy symbol lookup issue (build SEGV on mips64el)
  * correctly mark :native for libelf-dev & libpython3-dev to fix cross-build
  * use mutex for zserv stats (atomic uint64_t is too wide for 32-bit archs)

 -- David Lamparter <equinox-debian@diac24.net>  Fri, 06 Jan 2023 14:59:57 +0100

frr (8.4.1-1) unstable; urgency=medium

  * New upstream release FRR 8.4.1 (closes: #1017518)
  * New frr@ systemd service unit to run inside network namespace
  * egrep to grep -E
  * upstream fix ospfd crash (PR 8876) (closes: #981139)
  * upstream fix isisd parsing issues CVE-2022-26125, CVE-2022-26126 and
    babeld parsing issues CVE-2022-26127, CVE-2022-26128, CVE-2022-26129
    (closes: #1008010)
  * upstream fix bgpd out-of-bounds read CVE-2022-37032 (closes: #1021016)
  * upstream fix bgpd UAF CVE-2022-37035 (closes: #1016978)
  * libyang-related pcre3 dep replaced with pcre2 (closes: #1000032)
  * disable ELF magic on mips64el
  * fixed texinfo figure installation directory
  * enable dh_sphinxdoc to get rid of embedded javascript in frr-doc
  * removed bogus iproute dependency choice

 -- David Lamparter <equinox-debian@diac24.net>  Mon, 02 Jan 2023 14:46:06 +0100

frr (8.1-1ubuntu4) lunar; urgency=medium

  * d/frr.postinst: don't change log ownership if the syslog user
    doesn't exist. Thanks to Alessandro Ratti
    <alessandro.ratti@exoscale.ch> for the fix (LP: #1991812).

 -- Andreas Hasenack <andreas@canonical.com>  Fri, 28 Oct 2022 11:35:27 -0300

frr (8.1-1ubuntu3) kinetic; urgency=medium

  * SECURITY UPDATE: DoS via out-of-bounds read
    - debian/patches/CVE-2022-37032.patch: make sure hdr length is at a
      minimum of what is expected in bgpd/bgp_packet.c.
    - CVE-2022-37032
  * SECURITY UPDATE: use-after-free due to a race condition
    - debian/patches/CVE-2022-37035.patch: avoid notify race between io and
      main pthreads in bgpd/bgp_io.c, bgpd/bgp_packet.c, bgpd/bgp_packet.h.
    - CVE-2022-37035

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Wed, 05 Oct 2022 12:31:38 -0400

frr (8.1-1ubuntu2) kinetic; urgency=medium

  * Fix logging with Ubuntu's unprivileged rsyslog (LP: #1958162):
    - d/frr.postinst: change log files ownership
    - d/frr.logrotate: change rotated log file ownership

 -- Andreas Hasenack <andreas@canonical.com>  Thu, 09 Jun 2022 12:35:58 -0300

frr (8.1-1ubuntu1) jammy; urgency=medium

  * SECURITY UPDATE: overflow via input packet length
    - debian/patches/CVE-2022-26125.patch: fix router capability TLV
      parsing issues in isisd/isis_tlvs.*.
    - debian/patches/disable_isisd_fuzz_test.patch: disable fuzz tests as
      the security update changed expected results in
      tests/isisd/test_fuzz_isis_tlv.py.
    - CVE-2022-26125
  * SECURITY UPDATE: overflow via use of strdup with binary string
    - debian/patches/CVE-2022-26126.patch: use base64 encoding in
      isisd/isis_nb_notifications.c, lib/base64.c, lib/base64.h,
      lib/subdir.am, lib/yang_wrappers.c, lib/yang_wrappers.h.
    - CVE-2022-26126
  * SECURITY UPDATE: overflow via missing check on the input packet length
    - debian/patches/CVE-2022-26127.patch: add check on packet length in
      babeld/message.c.
    - CVE-2022-26127
  * SECURITY UPDATE: overflow via wrong checks
    - debian/patches/CVE-2022-26128_9.patch: fix checks on length in
      babeld/message.c.
    - CVE-2022-26128
    - CVE-2022-26129

 -- Marc Deslauriers <marc.deslauriers@ubuntu.com>  Fri, 11 Mar 2022 07:33:41 -0500

frr (8.1-1) unstable; urgency=medium

  * New upstream release FRR 8.1
  * Upload to unstable.

 -- Ondřej Surý <ondrej@debian.org>  Sat, 13 Nov 2021 13:32:48 +0100

frr (7.5.1-1) unstable; urgency=medium

  * Update the d/gbp.conf for 7.5.1 release
  * Use wrap-and-sort -a to unify debian/ wrapping and sorting
  * Work around the sphinx-build error that doesn't copy images to texinfo
  * Change the upstream-tag in d/gbp.conf to track the upstream tarballs

 -- Ondřej Surý <ondrej@debian.org>  Mon, 08 Mar 2021 09:40:19 +0100

frr (7.5-1) unstable; urgency=medium

  * New upstream version 7.5

 -- Ondřej Surý <ondrej@debian.org>  Sun, 14 Feb 2021 21:38:50 +0100

frr (7.4-2) unstable; urgency=medium

  * Bump libyang dependency to >= 1.0.184-1~
  * Make the autopkgtest more resilient (Closes: #980111)
  * Adjust the ax_python.m4 to hardcode python3.9

 -- Ondřej Surý <ondrej@debian.org>  Sun, 07 Feb 2021 13:15:07 +0100

frr (7.4-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Backport upstream fix for FTBFS with Python 3.9. (Closes: #972767)

 -- Adrian Bunk <bunk@debian.org>  Thu, 21 Jan 2021 16:06:12 +0200

frr (7.4-1) unstable; urgency=medium

  [ Ondřej Surý ]
  * Use dh_installinit capabilities to install frr.tmpfile
  * Remove unused debian/watchfrr.rc file
  * Add missing lsof dependency
  * Remove mention of pkg.frr.snmp build profile from debian/README.Debian
  * Make lsb-base a hard dependency
  * Update gbp.conf for 7.4 release
  * Update and simplify d/watch
  * Change the debian source format from 3.0 (git) to 3.0 (quilt)
  * Convert the package to dh compat level 10
  * Add myself to Uploaders
  * Bump standards version to 4.5.0.2 (latest) - no change
  * Use wrap-and-sort -a to unify debian/ wrapping and sorting
  * Work around the sphinx-build error that doesn't copy images to texinfo
    (Properly closes: #955067)
  * Depend on debhelper >= 9.20160709 and drop dh-systemd dependency
    (Closes: #958626)

 -- Ondřej Surý <ondrej@debian.org>  Mon, 10 Aug 2020 11:50:45 +0200

frr (7.3.1-1) unstable; urgency=medium

  [ David Lamparter ]
  * allow cross-compile with sbuild --host

  [ Ondřej Surý ]
  * Add myself to Uploaders
  * Add d/gbp.conf
  * Update changelog for 7.3.1-1~1.gbp2292a4 release
  * Change the source format from git to quilt to use git-buildpackage
  * Don't install frr-doc texinfo images, they are gone (Closes: #955067)
  * Bump the dh_compat to 10

 -- Ondřej Surý <ondrej@debian.org>  Mon, 01 Jun 2020 08:41:03 +0200

frr (7.3-1) unstable; urgency=medium

  * new upstream release

 -- David Lamparter <equinox-debian@diac24.net>  Tue, 25 Feb 2020 17:45:16 +0100

frr (7.2.1-1) unstable; urgency=medium

  * new upstream release
  * daemon man pages renamed to frr-* (closes: #944392)
  * fix/improve multi-arch markers on doc
  * fix git URLs to point to debian branch

 -- David Lamparter <equinox-debian@diac24.net>  Mon, 20 Jan 2020 17:06:21 +0100

frr (7.2-1) unstable; urgency=medium

  * New upstream release

 -- Jafar Al-Gharaibeh <jafar@atcorp.com>  Sun, 03 Nov 2019 18:45:23 +0100

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog frr`.
