[Pkg-utopia-maintainers] Bug#1142986: trixie-pu: package avahi/0.8-18~deb13u1
Michael Biebl
biebl at debian.org
Wed Jul 29 13:18:20 BST 2026
Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: avahi at packages.debian.org, pkg-utopia-maintainers at lists.alioth.debian.org
Control: affects -1 + src:avahi
User: release.debian.org at packages.debian.org
Usertags: pu
Hi,
I'd like to make a stable upload for avahi, fixing various CVEs.
Instead of preparing a whole new release, I considered to simple upload
what's currently in unstable/testing to trixie. The full changelog reads
```
avahi (0.8-18~deb13u1) trixie; urgency=medium
* Upload to stable
-- Michael Biebl <biebl at debian.org> Wed, 29 Jul 2026 14:08:02 +0200
avahi (0.8-18) unstable; urgency=medium
[ Simon McVittie ]
* d/copyright: Don't quote the FSF's former postal address here
[ Michael Biebl ]
* core: refuse to create wide-area record browsers when wide-area is off.
Patch cherry-picked from upstream Git
CVE-2025-68276 (Closes: #1125417)
* core: fix DoS bug by removing incorrect assertion.
Patch cherry-picked from upstream Git
CVE-2025-68468 (Closes: #1125418)
* core: fix DoS bug by changing assert to return.
Patch cherry-picked from upstream Git
CVE-2025-68471 (Closes: #1125419)
* core: fix uncontrolled recursion bug using a simple loop detection
algorithm.
Patch cherry-picked from upstream Git
CVE-2026-24401 (Closes: #1126342)
* Randomize transaction IDs in wide area queries.
Patch cherry-picked from upstream Git.
CVE-2024-52616 (Closes: #1088111)
* Bump Standards-Version to 4.7.3
-- Michael Biebl <biebl at debian.org> Sun, 01 Feb 2026 16:54:47 +0100
avahi (0.8-17) unstable; urgency=medium
* Team upload
[ Lukas Märdian ]
* d/t/local-resolve-service: Add non-superficial DEP-8 test, which
validates resolving of mDNS .local domains and service discovery
[ Simon McVittie ]
* d/control: Build-depend on gobject-introspection, gir1.2-*-dev.
libgirepository1.0-dev is non-multiarch-friendly and should be phased
out during the forky cycle.
* Add patch from upstream 0.9-rc2 to turn off wide-area by default.
(Mitigates: CVE-2024-52615, CVE-2024-52616, #1088110, #1088111)
* Standards-Version: 4.7.2 (no changes required)
-- Simon McVittie <smcv at debian.org> Tue, 09 Sep 2025 10:24:58 +0100
```
Including the build dependency changes from 0.8-17 is probably a bit meh,
but they work fine for trixie. And instead of re-doing the whole work
with cherry-picking and preparing a 0.8-16+deb13u1, I think just
uploading the state from testing to stable is the safer approach, or at
least the one which requires less work.
If you disagree and would rather prefer a 0.8-16+deb13u1, please let me
know.
Full debdiff is attached.
Regards,
Michael
-------------- next part --------------
diff --git a/debian/changelog b/debian/changelog
index 43adccdf..eef219c1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,53 @@
+avahi (0.8-18~deb13u1) trixie; urgency=medium
+
+ * Upload to stable
+
+ -- Michael Biebl <biebl at debian.org> Wed, 29 Jul 2026 14:08:02 +0200
+
+avahi (0.8-18) unstable; urgency=medium
+
+ [ Simon McVittie ]
+ * d/copyright: Don't quote the FSF's former postal address here
+
+ [ Michael Biebl ]
+ * core: refuse to create wide-area record browsers when wide-area is off.
+ Patch cherry-picked from upstream Git
+ CVE-2025-68276 (Closes: #1125417)
+ * core: fix DoS bug by removing incorrect assertion.
+ Patch cherry-picked from upstream Git
+ CVE-2025-68468 (Closes: #1125418)
+ * core: fix DoS bug by changing assert to return.
+ Patch cherry-picked from upstream Git
+ CVE-2025-68471 (Closes: #1125419)
+ * core: fix uncontrolled recursion bug using a simple loop detection
+ algorithm.
+ Patch cherry-picked from upstream Git
+ CVE-2026-24401 (Closes: #1126342)
+ * Randomize transaction IDs in wide area queries.
+ Patch cherry-picked from upstream Git.
+ CVE-2024-52616 (Closes: #1088111)
+ * Bump Standards-Version to 4.7.3
+
+ -- Michael Biebl <biebl at debian.org> Sun, 01 Feb 2026 16:54:47 +0100
+
+avahi (0.8-17) unstable; urgency=medium
+
+ * Team upload
+
+ [ Lukas Märdian ]
+ * d/t/local-resolve-service: Add non-superficial DEP-8 test, which
+ validates resolving of mDNS .local domains and service discovery
+
+ [ Simon McVittie ]
+ * d/control: Build-depend on gobject-introspection, gir1.2-*-dev.
+ libgirepository1.0-dev is non-multiarch-friendly and should be phased
+ out during the forky cycle.
+ * Add patch from upstream 0.9-rc2 to turn off wide-area by default.
+ (Mitigates: CVE-2024-52615, CVE-2024-52616, #1088110, #1088111)
+ * Standards-Version: 4.7.2 (no changes required)
+
+ -- Simon McVittie <smcv at debian.org> Tue, 09 Sep 2025 10:24:58 +0100
+
avahi (0.8-16) unstable; urgency=medium
* Stop using embedded copy of sd-daemon.{c,h} and use libsystemd instead.
diff --git a/debian/control b/debian/control
index 2e751fa3..ab971f98 100644
--- a/debian/control
+++ b/debian/control
@@ -8,6 +8,8 @@ Build-Depends: debhelper (>= 13.11.6~),
debhelper-compat (= 13),
dh-sequence-gir <!nogir>,
dh-sequence-python3,
+ gir1.2-gobject-2.0-dev <!nogir>,
+ gobject-introspection (>= 1.80) <!nogir>,
intltool,
libcap-dev [linux-any],
libsystemd-dev [linux-any],
@@ -15,7 +17,6 @@ Build-Depends: debhelper (>= 13.11.6~),
libdbus-1-dev,
libexpat-dev,
libgdbm-dev,
- libgirepository1.0-dev <!nogir>,
libglib2.0-dev,
libgtk-3-dev <!pkg.avahi.nogui>,
pkgconf,
@@ -26,7 +27,7 @@ Build-Depends: debhelper (>= 13.11.6~),
python3-gi <!nopython>,
xmltoman
Rules-Requires-Root: no
-Standards-Version: 4.7.0
+Standards-Version: 4.7.3
Vcs-Git: https://salsa.debian.org/utopia-team/avahi.git
Vcs-Browser: https://salsa.debian.org/utopia-team/avahi
Homepage: https://avahi.org/
diff --git a/debian/copyright b/debian/copyright
index 9ef7a09c..cd64f888 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -28,10 +28,6 @@ The main portion of Avahi is copyright:
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
- You should have received a copy of the GNU Lesser General Public
- License along with this library; if not, write to the Free Software
- Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
-
See /usr/share/common-licenses/LGPL-2.1 on your debian system.
The xml to man conversion files
diff --git a/debian/gbp.conf b/debian/gbp.conf
index cc9b21eb..71659a45 100644
--- a/debian/gbp.conf
+++ b/debian/gbp.conf
@@ -1,5 +1,5 @@
[DEFAULT]
pristine-tar = True
-debian-branch = debian/latest
+debian-branch = debian/trixie
upstream-branch = upstream/latest
patch-numbers = False
diff --git a/debian/patches/Properly-randomize-query-id-of-DNS-packets.patch b/debian/patches/Properly-randomize-query-id-of-DNS-packets.patch
new file mode 100644
index 00000000..51d488bf
--- /dev/null
+++ b/debian/patches/Properly-randomize-query-id-of-DNS-packets.patch
@@ -0,0 +1,99 @@
+From: =?utf-8?b?UGV0ciBNZW7FocOtaw==?= <pemensik at redhat.com>
+Date: Mon, 11 Nov 2024 00:56:09 +0100
+Subject: Properly randomize query id of DNS packets
+
+(cherry picked from commit f8710bdc8b29ee1176fe3bfaeabebbda1b7a79f7)
+---
+ avahi-core/wide-area.c | 36 ++++++++++++++++++++++++++++--------
+ configure.ac | 3 ++-
+ 2 files changed, 30 insertions(+), 9 deletions(-)
+
+diff --git a/avahi-core/wide-area.c b/avahi-core/wide-area.c
+index d5e64e5..4cbba6c 100644
+--- a/avahi-core/wide-area.c
++++ b/avahi-core/wide-area.c
+@@ -40,6 +40,13 @@
+ #include "addr-util.h"
+ #include "rr-util.h"
+
++#ifdef HAVE_SYS_RANDOM_H
++#include <sys/random.h>
++#endif
++#ifndef HAVE_GETRANDOM
++# define getrandom(d, len, flags) (-1)
++#endif
++
+ #define CACHE_ENTRIES_MAX 500
+
+ typedef struct AvahiWideAreaCacheEntry AvahiWideAreaCacheEntry;
+@@ -84,8 +91,6 @@ struct AvahiWideAreaLookupEngine {
+ int fd_ipv4, fd_ipv6;
+ AvahiWatch *watch_ipv4, *watch_ipv6;
+
+- uint16_t next_id;
+-
+ /* Cache */
+ AVAHI_LLIST_HEAD(AvahiWideAreaCacheEntry, cache);
+ AvahiHashmap *cache_by_key;
+@@ -201,6 +206,26 @@ static void sender_timeout_callback(AvahiTimeEvent *e, void *userdata) {
+ avahi_time_event_update(e, avahi_elapse_time(&tv, 1000, 0));
+ }
+
++static uint16_t get_random_uint16(void) {
++ uint16_t next_id;
++
++ if (getrandom(&next_id, sizeof(next_id), 0) == -1)
++ next_id = (uint16_t) rand();
++ return next_id;
++}
++
++static uint16_t avahi_wide_area_next_id(AvahiWideAreaLookupEngine *e) {
++ uint16_t next_id;
++
++ next_id = get_random_uint16();
++ while (find_lookup(e, next_id)) {
++ /* This ID is already used, get new. */
++ next_id = get_random_uint16();
++ }
++ return next_id;
++}
++
++
+ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
+ AvahiWideAreaLookupEngine *e,
+ AvahiKey *key,
+@@ -227,11 +252,7 @@ AvahiWideAreaLookup *avahi_wide_area_lookup_new(
+ /* If more than 65K wide area quries are issued simultaneously,
+ * this will break. This should be limited by some higher level */
+
+- for (;; e->next_id++)
+- if (!find_lookup(e, e->next_id))
+- break; /* This ID is not yet used. */
+-
+- l->id = e->next_id++;
++ l->id = avahi_wide_area_next_id(e);
+
+ /* We keep the packet around in case we need to repeat our query */
+ l->packet = avahi_dns_packet_new(0);
+@@ -603,7 +624,6 @@ AvahiWideAreaLookupEngine *avahi_wide_area_engine_new(AvahiServer *s) {
+ e->watch_ipv6 = s->poll_api->watch_new(e->server->poll_api, e->fd_ipv6, AVAHI_WATCH_IN, socket_event, e);
+
+ e->n_dns_servers = e->current_dns_server = 0;
+- e->next_id = (uint16_t) rand();
+
+ /* Initialize cache */
+ AVAHI_LLIST_HEAD_INIT(AvahiWideAreaCacheEntry, e->cache);
+diff --git a/configure.ac b/configure.ac
+index 584b9c1..035d958 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -368,7 +368,8 @@ AC_FUNC_SELECT_ARGTYPES
+ # whether libc's malloc does too. (Same for realloc.)
+ #AC_FUNC_MALLOC
+ #AC_FUNC_REALLOC
+-AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname])
++AC_CHECK_FUNCS([gethostname memchr memmove memset mkdir select socket strchr strcspn strdup strerror strrchr strspn strstr uname setresuid setreuid setresgid setregid strcasecmp gettimeofday putenv strncasecmp strlcpy gethostbyname seteuid setegid setproctitle getprogname getrandom])
++AC_CHECK_HEADERS([sys/random.h])
+
+ AC_FUNC_CHOWN
+ AC_FUNC_STAT
diff --git a/debian/patches/avahi-daemon.conf-turn-off-wide-area.patch b/debian/patches/avahi-daemon.conf-turn-off-wide-area.patch
new file mode 100644
index 00000000..24f1ab0b
--- /dev/null
+++ b/debian/patches/avahi-daemon.conf-turn-off-wide-area.patch
@@ -0,0 +1,33 @@
+From: Evgeny Vereshchagin <evvers at ya.ru>
+Date: Sun, 3 Mar 2024 23:05:12 +0000
+Subject: avahi-daemon.conf: turn off wide-area
+
+In its current form it doesn't interact with mDNS well. For example
+services advertised over mDNS where PTR RRs point "_services._dns-sd._udp.local"
+to unresolvable wide-area domain names bring down mDNS browsers. DNS
+isn't supported well either. For example responses larger than 512 bytes
+aren't supported, all the queries come from the same UDP port and so on.
+All in all in its current form it isn't something that should be enabled
+by default or picked up accidentally by packages downstream.
+
+It reverts the part of 2c453196ee040e17e357f3431b0647391c88d616 where
+that feature was turned on.
+
+Origin: upstream, 0.9-rc2, commit:9c4214146738146e454f098264690e8e884c39bd
+---
+ avahi-daemon/avahi-daemon.conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/avahi-daemon/avahi-daemon.conf b/avahi-daemon/avahi-daemon.conf
+index f2eca08..51ebe5a 100644
+--- a/avahi-daemon/avahi-daemon.conf
++++ b/avahi-daemon/avahi-daemon.conf
+@@ -39,7 +39,7 @@ ratelimit-interval-usec=1000000
+ ratelimit-burst=1000
+
+ [wide-area]
+-enable-wide-area=yes
++#enable-wide-area=no
+
+ [publish]
+ #disable-publishing=no
diff --git a/debian/patches/core-fix-DoS-bug-by-changing-assert-to-return.patch b/debian/patches/core-fix-DoS-bug-by-changing-assert-to-return.patch
new file mode 100644
index 00000000..d795d7a7
--- /dev/null
+++ b/debian/patches/core-fix-DoS-bug-by-changing-assert-to-return.patch
@@ -0,0 +1,27 @@
+From: Hugo Muis <198191869+friendlyhugo at users.noreply.github.com>
+Date: Sun, 2 Mar 2025 18:06:24 +0100
+Subject: core: fix DoS bug by changing assert to return
+
+Closes https://github.com/avahi/avahi/issues/678
+
+(cherry picked from commit 9c6eb53bf2e290aed84b1f207e3ce35c54cc0aa1)
+---
+ avahi-core/browse.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/avahi-core/browse.c b/avahi-core/browse.c
+index 05bd111..57435fc 100644
+--- a/avahi-core/browse.c
++++ b/avahi-core/browse.c
+@@ -319,7 +319,10 @@ static int lookup_start(AvahiSRBLookup *l) {
+ assert(l);
+
+ assert(!(l->flags & AVAHI_LOOKUP_USE_WIDE_AREA) != !(l->flags & AVAHI_LOOKUP_USE_MULTICAST));
+- assert(!l->wide_area && !l->multicast);
++ if (l->wide_area || l->multicast) {
++ /* Avoid starting a duplicate lookup */
++ return 0;
++ }
+
+ if (l->flags & AVAHI_LOOKUP_USE_WIDE_AREA) {
+
diff --git a/debian/patches/core-fix-DoS-bug-by-removing-incorrect-assertion.patch b/debian/patches/core-fix-DoS-bug-by-removing-incorrect-assertion.patch
new file mode 100644
index 00000000..fdea5013
--- /dev/null
+++ b/debian/patches/core-fix-DoS-bug-by-removing-incorrect-assertion.patch
@@ -0,0 +1,23 @@
+From: Hugo Muis <198191869+friendlyhugo at users.noreply.github.com>
+Date: Sun, 2 Mar 2025 18:06:24 +0100
+Subject: core: fix DoS bug by removing incorrect assertion
+
+Closes https://github.com/avahi/avahi/issues/683
+
+(cherry picked from commit f66be13d7f31a3ef806d226bf8b67240179d309a)
+---
+ avahi-core/browse.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/avahi-core/browse.c b/avahi-core/browse.c
+index 59d53cb..05bd111 100644
+--- a/avahi-core/browse.c
++++ b/avahi-core/browse.c
+@@ -295,7 +295,6 @@ static void lookup_multicast_callback(
+ lookup_drop_cname(l, interface, protocol, 0, r);
+ else {
+ /* It's a normal record, so let's call the user callback */
+- assert(avahi_key_equal(b->key, l->key));
+
+ b->callback(b, interface, protocol, event, r, flags, b->userdata);
+ }
diff --git a/debian/patches/core-fix-uncontrolled-recursion-bug-using-a-simple-loop-d.patch b/debian/patches/core-fix-uncontrolled-recursion-bug-using-a-simple-loop-d.patch
new file mode 100644
index 00000000..6410ab8a
--- /dev/null
+++ b/debian/patches/core-fix-uncontrolled-recursion-bug-using-a-simple-loop-d.patch
@@ -0,0 +1,70 @@
+From: Hugo Muis <198191869+friendlyhugo at users.noreply.github.com>
+Date: Sun, 2 Mar 2025 18:06:24 +0100
+Subject: core: fix uncontrolled recursion bug using a simple loop detection
+ algorithm
+
+Closes https://github.com/avahi/avahi/issues/501
+
+(cherry picked from commit 78eab31128479f06e30beb8c1cbf99dd921e2524)
+---
+ avahi-core/browse.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+diff --git a/avahi-core/browse.c b/avahi-core/browse.c
+index 57435fc..d7d541b 100644
+--- a/avahi-core/browse.c
++++ b/avahi-core/browse.c
+@@ -400,6 +400,40 @@ static int lookup_go(AvahiSRBLookup *l) {
+ return n;
+ }
+
++static int lookup_exists_in_path(AvahiSRBLookup* lookup, AvahiSRBLookup* from, AvahiSRBLookup* to) {
++ AvahiRList* rl;
++ if (from == to)
++ return 0;
++ for (rl = from->cname_lookups; rl; rl = rl->rlist_next) {
++ int r = lookup_exists_in_path(lookup, rl->data, to);
++ if (r == 1) {
++ /* loop detected, propagate result */
++ return r;
++ } else if (r == 0) {
++ /* is loop detected? */
++ return lookup == from;
++ } else {
++ /* `to` not found, continue */
++ continue;
++ }
++ }
++ /* no path found */
++ return -1;
++}
++
++static int cname_would_create_loop(AvahiSRBLookup* l, AvahiSRBLookup* n) {
++ int ret;
++ if (l == n)
++ /* Loop to self */
++ return 1;
++
++ ret = lookup_exists_in_path(n, l->record_browser->root_lookup, l);
++
++ /* Path to n always exists */
++ assert(ret != -1);
++ return ret;
++}
++
+ static void lookup_handle_cname(AvahiSRBLookup *l, AvahiIfIndex interface, AvahiProtocol protocol, AvahiLookupFlags flags, AvahiRecord *r) {
+ AvahiKey *k;
+ AvahiSRBLookup *n;
+@@ -419,6 +453,12 @@ static void lookup_handle_cname(AvahiSRBLookup *l, AvahiIfIndex interface, Avahi
+ return;
+ }
+
++ if (cname_would_create_loop(l, n)) {
++ /* CNAME loops are not allowed */
++ lookup_unref(n);
++ return;
++ }
++
+ l->cname_lookups = avahi_rlist_prepend(l->cname_lookups, lookup_ref(n));
+
+ lookup_go(n);
diff --git a/debian/patches/core-refuse-to-create-wide-area-record-browsers-when-wide.patch b/debian/patches/core-refuse-to-create-wide-area-record-browsers-when-wide.patch
new file mode 100644
index 00000000..a0174bde
--- /dev/null
+++ b/debian/patches/core-refuse-to-create-wide-area-record-browsers-when-wide.patch
@@ -0,0 +1,60 @@
+From: Evgeny Vereshchagin <evvers at ya.ru>
+Date: Wed, 17 Dec 2025 08:11:23 +0000
+Subject: core: refuse to create wide-area record browsers when wide-area is
+ off
+
+It fixes a bug where it was possible for unprivileged local users to
+crash avahi-daemon (with wide-area disabled) by creating record browsers
+with the AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus (either by calling
+the RecordBrowserNew method directly or by creating hostname/address/service
+resolvers/browsers that create those browsers internally themselves).
+
+```
+$ gdbus call --system --dest org.freedesktop.Avahi --object-path / --method org.freedesktop.Avahi.Server.ResolveHostName -- -1 -1 yo.local -1 1
+Error: GDBus.Error:org.freedesktop.DBus.Error.NoReply: Message recipient disconnected from message bus without replying
+```
+```
+dbus-protocol.c: interface=org.freedesktop.Avahi.Server, path=/, member=ResolveHostName
+avahi-daemon: wide-area.c:725: avahi_wide_area_scan_cache: Assertion `e' failed.
+==307948==
+==307948== Process terminating with default action of signal 6 (SIGABRT)
+==307948== at 0x4B3630C: __pthread_kill_implementation (pthread_kill.c:44)
+==307948== by 0x4ADF921: raise (raise.c:26)
+==307948== by 0x4AC74AB: abort (abort.c:77)
+==307948== by 0x4AC741F: __assert_fail_base.cold (assert.c:118)
+==307948== by 0x48D8B85: avahi_wide_area_scan_cache (wide-area.c:725)
+==307948== by 0x48C8953: lookup_scan_cache (browse.c:351)
+==307948== by 0x48C8B1B: lookup_go (browse.c:386)
+==307948== by 0x48C9148: defer_callback (browse.c:516)
+==307948== by 0x48AEA0E: expiration_event (timeeventq.c:94)
+==307948== by 0x489D3AE: timeout_callback (simple-watch.c:447)
+==307948== by 0x489D787: avahi_simple_poll_dispatch (simple-watch.c:563)
+==307948== by 0x489D91E: avahi_simple_poll_iterate (simple-watch.c:605)
+==307948==
+```
+
+wide-area has been disabled by default since
+9c4214146738146e454f098264690e8e884c39bd (v0.9-rc2).
+
+https://github.com/avahi/avahi/security/advisories/GHSA-mhf3-865v-g5rc
+(cherry picked from commit 2d48e42d44a183f26a4d12d1f5d41abb9b7c6355)
+---
+ avahi-core/browse.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/avahi-core/browse.c b/avahi-core/browse.c
+index e8a915e..59d53cb 100644
+--- a/avahi-core/browse.c
++++ b/avahi-core/browse.c
+@@ -541,6 +541,11 @@ AvahiSRecordBrowser *avahi_s_record_browser_prepare(
+ AVAHI_CHECK_VALIDITY_RETURN_NULL(server, AVAHI_FLAGS_VALID(flags, AVAHI_LOOKUP_USE_WIDE_AREA|AVAHI_LOOKUP_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
+ AVAHI_CHECK_VALIDITY_RETURN_NULL(server, !(flags & AVAHI_LOOKUP_USE_WIDE_AREA) || !(flags & AVAHI_LOOKUP_USE_MULTICAST), AVAHI_ERR_INVALID_FLAGS);
+
++ if ((flags & AVAHI_LOOKUP_USE_WIDE_AREA) && !server->wide_area_lookup_engine) {
++ avahi_server_set_errno(server, AVAHI_ERR_NOT_SUPPORTED);
++ return NULL;
++ }
++
+ if (!(b = avahi_new(AvahiSRecordBrowser, 1))) {
+ avahi_server_set_errno(server, AVAHI_ERR_NO_MEMORY);
+ return NULL;
diff --git a/debian/patches/series b/debian/patches/series
index faf479e8..a2472f63 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -23,3 +23,9 @@ core-extract-host-name-using-avahi_unescape_label.patch
common-derive-alternative-host-name-from-its-unescaped-ve.patch
core-no-longer-supply-bogus-services-to-callbacks.patch
Stop-using-embedded-copy-of-sd-daemon.-c-h-and-use-libsys.patch
+avahi-daemon.conf-turn-off-wide-area.patch
+core-refuse-to-create-wide-area-record-browsers-when-wide.patch
+core-fix-DoS-bug-by-removing-incorrect-assertion.patch
+core-fix-DoS-bug-by-changing-assert-to-return.patch
+core-fix-uncontrolled-recursion-bug-using-a-simple-loop-d.patch
+Properly-randomize-query-id-of-DNS-packets.patch
diff --git a/debian/tests/control b/debian/tests/control
index 45952ebd..438fe535 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -27,3 +27,7 @@ Test-Command: debian/tests/build libavahi-ui-gtk3-dev
Features: test-name=libavahi-ui-gtk3-dev
Restrictions: allow-stderr, superficial
Depends: build-essential, libavahi-ui-gtk3-dev, pkgconf
+
+Tests: local-resolve-service
+Restrictions: needs-sudo
+Depends: avahi-daemon, avahi-utils, ipcalc, awk
diff --git a/debian/tests/local-resolve-service b/debian/tests/local-resolve-service
new file mode 100755
index 00000000..eccaa0fb
--- /dev/null
+++ b/debian/tests/local-resolve-service
@@ -0,0 +1,47 @@
+#!/bin/bash
+set -e
+
+function cleanup ()
+{
+ # delete files created by this test
+ rm -f out.txt
+ sudo rm -f /etc/avahi/services/dummy.service
+}
+trap cleanup EXIT
+
+# resolve an IPv4 .local name
+avahi-resolve -v -n -4 "$(hostname).local" > out.txt 2>&1
+cat out.txt
+grep "Server version: avahi" out.txt
+IP4=$(tail -n1 out.txt | awk '{ print $NF }')
+ipcalc -c $IP4 | grep "Address:" # validates IP
+
+# resolve an IPv6 .local name
+avahi-resolve -v -n -6 "$(hostname).local" > out.txt 2>&1
+cat out.txt
+grep "Server version: avahi" out.txt
+IP6=$(tail -n1 out.txt | awk '{ print $NF }')
+ipcalc -c $IP6 | grep "Address:" # validates IP
+
+# announce a dummy service
+cat <<EOF | sudo tee /etc/avahi/services/dummy.service
+<?xml version="1.0" standalone='no'?><!--*-nxml-*-->
+<!DOCTYPE service-group SYSTEM "avahi-service.dtd">
+<service-group>
+ <name replace-wildcards="yes">%h Dummy</name>
+ <service>
+ <type>_dummy._tcp</type>
+ <port>4242</port>
+ <txt-record>Autopkgtest dummy</txt-record>
+ </service>
+</service-group>
+EOF
+sudo systemctl reload avahi-daemon.service
+
+# search for the new dummy service
+avahi-browse -v -d local _dummy._tcp --resolve -t > out.txt 2>&1
+grep "hostname = \[$(hostname).local\]" out.txt
+grep "address = \[$IP6\]" out.txt
+grep "address = \[$IP4\]" out.txt
+grep "port = \[4242\]" out.txt
+grep "txt = \[\"Autopkgtest dummy\"\]" out.txt
More information about the Pkg-utopia-maintainers
mailing list