[MIR] dhcpcd

[Shengjing Zhu]

[Availability]
The package dhcpcd5 is already in Ubuntu universe.
The package dhcpcd5 builds for the architectures it is designed to work on.
It currently builds and works for architectures: amd64, arm64, armhf, ppc64el, riscv64, s390x
Link to package https://launchpad.net/ubuntu/+source/dhcpcd5

[Rationale]
The package dhcpcd5 is required in Ubuntu main to replace isc-dhcp-client.
ISC has announced the end of life for ISC DHCP as of the end of 2022.

In FO092 specification, we compare the alternatives among dhcpcd, udhcpc,
ipconfig, dhclient, systemd-networkd, network-manager, dhcpcanon.
dhcpcd is small (to be included in initramfs), supports DHCPv6, can be called
from shell (to be used in initramfs and cloud-init). It’s the best candidate currently.

The package dhcpcd5 is required in Ubuntu main no later than 23.10 release.
So in 24.04 we can have sufficient time to replace the usage of isc-dhcp-client,
and finally demote isc-dhcp-client to universe.

[Security]
- Had 15 security issues in the past
  - links to such security issues in trackers
    https://ubuntu.com/security/CVE-2005-1848 allows remote attackers to cause a denial of service (daemon crash)
    https://ubuntu.com/security/CVE-2011-0996 allows remote attackers to execute arbitrary commands
    https://ubuntu.com/security/CVE-2012-2152 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code
    https://ubuntu.com/security/CVE-2012-6698 allows remote DHCP servers to cause a denial of service (out-of-bounds write)
    https://ubuntu.com/security/CVE-2012-6699 allows remote DHCP servers to cause a denial of service (out-of-bounds read)
    https://ubuntu.com/security/CVE-2012-6700 allows remote DHCP servers to cause a denial of service
    https://ubuntu.com/security/CVE-2014-6060 allows remote DHCP servers to cause a denial of service
    https://ubuntu.com/security/CVE-2014-7912 allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption)
    https://ubuntu.com/security/CVE-2014-7913 allows remote DHCP servers to execute arbitrary code or cause a denial of service (memory corruption)
    https://ubuntu.com/security/CVE-2016-1503 allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow)
    https://ubuntu.com/security/CVE-2016-1504 allows remote attackers to cause a denial of service (invalid read and crash)
    https://ubuntu.com/security/CVE-2019-11577 contains a buffer overflow
    https://ubuntu.com/security/CVE-2019-11578 allowed attackers to infer secrets
    https://ubuntu.com/security/CVE-2019-11579 contains a 1-byte read overflow
    https://ubuntu.com/security/CVE-2019-11766 buffer over-read
  - context that shows how these issues got handled in
    the past
    https://launchpad.net/ubuntu/+source/dhcpcd5/6.0.5-2build0.14.04.1
    A fakesync from Debian to trusty-security for CVE-2014-6060
  - no `suid` or `sgid` binaries
  - Binary dhcpcd in /usr/sbin/dhcpcd is no problem because it’s expected to be executed by daemon scripts or services.
  - Package dhcpcd-base does not install services, timers or recurring jobs
  - Package dhcpcd does install services, timers or recurring jobs
    - dhcpcd.service
      Hardened systemd service, Protect{System, Home, Clock, KernelModules, KernelLogs, ControlGroups},
      Restrict{Namespaces, Realtime, SUIDSGID}, SystemCallFilter,
      PrivateDevices, LockPersonality, MemoryDenyWriteExecute,
    - dhcpcd@.service
      Not used by default, for single network interface.
  - apparmor-profiles package contains profile /usr/share/apparmor/extra-profiles/sbin.dhcpcd
  - Package does open privileged ports (ports < 1024).
    - DHCPv6 client port: 546/UDP
    - BOOTP client port: 68/UDP
  - Packages contains extensions to security-sensitive software
      hook plugins in /usr/lib/dhcpcd/dhcpcd-hooks/

[Quality assurance - function/usage]
- integration with ntp is broken after ntp was replaced by ntpsec. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036085

[Quality assurance - maintenance]
- The package is maintained well in Debian/Ubuntu/Upstream and does
 not have too many, long-term & critical, open bugs
  - Ubuntu https://bugs.launchpad.net/ubuntu/+source/dhcpcd5/+bug
  - Debian https://bugs.debian.org/cgi-bin/pkgreport.cgi?src=dhcpcd5
  - Upstream's bug tracker
    https://github.com/NetworkConfiguration/dhcpcd/issues
  - The package has important open bugs, listing them:
    - https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1034465 dhcpcd -U results in "Bad system call"
      Fixed in the new release, but it’s not uploaded due to freeze in Debian.
  - The package does not deal with exotic hardware we cannot support

[Quality assurance - testing]
- The package runs a test suite on build time, if it fails
  it makes the build fail, link to build log
  https://launchpad.net/ubuntu/+source/dhcpcd5/9.4.1-21/+build/26015669/+files/buildlog_ubuntu-mantic-amd64.dhcpcd5_9.4.1-21_BUILDING.txt.gz

  The tests are very trivial, not related to its core functionality.
  https://github.com/NetworkConfiguration/dhcpcd/tree/master/tests

- The package does have failing autopkgtests tests right now, but since
  they always fail, they are handled as "ignored failure".
  https://autopkgtest.ubuntu.com/packages/d/dhcpcd5

  dhcpcd itself conflicts/replaces isc-dhcp-client, which is needed by ubuntu-minimal.
  So Ubuntu autopkgtest can't run the tests.
  We want to drop isc-dhcp-client in the future, so it should be ok currently.
  the tests pass on Debian however Debian doesn't run the isolation-machine tests https://ci.debian.net/packages/d/dhcpcd5/

[Quality assurance - packaging]
- debian/watch is present but not works because upstream no longer provides
  tarball on their website.
  It has been fixed in https://salsa.debian.org/debian/dhcpcd5/-/commit/4fe065dbf546e4e79b0327cb91dc883a34380a88
  not uploaded yet.
- debian/control defines a correct Maintainer field (no Ubuntu delta)
- This package does not yield massive lintian Warnings, Errors
- Please link to a recent build log of the package
  https://launchpad.net/ubuntu/+source/dhcpcd5/9.4.1-21/+build/26015669/+files/buildlog_ubuntu-mantic-amd64.dhcpcd5_9.4.1-21_BUILDING.txt.gz
- Please attach the full output you have got from
  W: dhcpcd: changelog-distribution-does-not-match-changes-file unstable != mantic [usr/share/doc/dhcpcd/changelog.Debian.gz:1]
  W: dhcpcd-base: changelog-distribution-does-not-match-changes-file unstable != mantic [usr/share/doc/dhcpcd-base/changelog.Debian.gz:1]
  W: dhcpcd5: changelog-distribution-does-not-match-changes-file unstable != mantic [usr/share/doc/dhcpcd5/changelog.Debian.gz:1]
  W: dhcpcd5 changes: distribution-and-changes-mismatch mantic unstable
  W: dhcpcd-base: groff-message command exited with status 1: /usr/libexec/man-db/zsoelim | /usr/libexec/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE | preconv -e UTF-8 | groff -mandoc -Z -rLL=117n -rLT=117n -wmac -Tutf8 [usr/share/man/man5/dhcpcd.conf.5.gz:1]
  W: dhcpcd-base: groff-message command exited with status 1: /usr/libexec/man-db/zsoelim | /usr/libexec/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE | preconv -e UTF-8 | groff -mandoc -Z -rLL=117n -rLT=117n -wmac -Tutf8 [usr/share/man/man8/dhcpcd-run-hooks.8.gz:1]
  W: dhcpcd-base: groff-message command exited with status 1: /usr/libexec/man-db/zsoelim | /usr/libexec/man-db/manconv -f UTF-8:ISO-8859-1 -t UTF-8//IGNORE | preconv -e UTF-8 | groff -mandoc -Z -rLL=117n -rLT=117n -wmac -Tutf8 [usr/share/man/man8/dhcpcd.8.gz:1]

- Lintian overrides are not present
- This package does not rely on obsolete or about to be demoted packages.
- This package has no python2 or GTK2 dependencies
- The package will be installed by default, but does not ask debconf
  questions higher than medium (no debconf questions)
- Packaging and build is easy, link to debian/rules
  https://salsa.debian.org/debian/dhcpcd5/-/blob/debian/sid/debian/rules

[UI standards]
- Application is not end-user facing (does not need translation)

[Dependencies]
- No further depends or recommends dependencies that are not yet in main

[Standards compliance]
- This package correctly follows FHS
- Misuse of Conflicts/Breaks violate Debian Policy 7.4 (but not strictly forbidden). https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1036085

[Maintenance/Owner]
- Owning Team will be Foundations team
- Team is not yet, but will subscribe to the package before promotion
- This does not use static builds
- This does not use vendored code
- This package is not rust based
- The package has been built in the archive more recently than the last
  test rebuild

[Background information]
- The Package description explains the package well
- Upstream Name is dhcpcd
- Link to upstream project https://github.com/NetworkConfiguration/dhcpcd
- The source package may be renamed to dhcpcd as requested in
  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1026169

[Martin-Éric Racine (q-funk)]

I suggest waiting until dhcpcd 10.0.1 has been uploaded to Debian and imported into Ubuntu before switching the default DHCP client. It should also be noted that Debian will migrate the source:pkg to dhcpcd (i.e.drop the 5) starting with the 10.0.1 upload.

[Shengjing Zhu (zhsj)]

@Martin-Éric This bug is not about switching default DHCP client, it's prerequisite. Only when dhcpcd is in Ubuntu main, we would consider changing various components (like initramfs, cloud-init, network-manager) in Ubuntu to use dhcpcd. This bug is for reviewing the quality of dhcpcd before promoting it to main.

However it's great to have you involved in this process.

[Shengjing Zhu (zhsj)]

I'm staging some changes in my PPA https://launchpad.net/~zhsj/+archive/ubuntu/dhcpcd5

dhcpcd5 (9.4.1-21ubuntu2) mantic; urgency=medium

  * Drop incompatible ntpd integration.
    No longer working after ntpd was replaced by ntpsec.
  * Fix autopkgtests
    + Use bind-interfaces in dnsmasq conf
    + Wait until ntp server is reloaded

dhcpcd5 (9.4.1-21ubuntu1) mantic; urgency=medium

  [ Martin-Éric Racine ]
  * Migrate debian/watch to Github in cadence with upstream.

  [ Shengjing Zhu ]
  * Remove Conflicts/Replaces dhcp-client

The autopkgtest now pass on amd64, arm64, armhf, s390x.
However on ppc64el, the package ends up with "Bad system call (core dumped)".

  - dhcpcd5/9.4.1-21ubuntu2
    + ✅ dhcpcd5 on mantic for amd64 @ 16.05.23 10:15:50
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-zhsj-dhcpcd5/mantic/amd64/d/dhcpcd5/20230516_101550_35dd5@/log.gz
    + ✅ dhcpcd5 on mantic for arm64 @ 16.05.23 08:59:31
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-zhsj-dhcpcd5/mantic/arm64/d/dhcpcd5/20230516_085931_e152f@/log.gz
    + ✅ dhcpcd5 on mantic for armhf @ 16.05.23 08:19:01
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-zhsj-dhcpcd5/mantic/armhf/d/dhcpcd5/20230516_081901_f7f4d@/log.gz
    + ❌ dhcpcd5 on mantic for ppc64el @ 16.05.23 08:33:23
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-zhsj-dhcpcd5/mantic/ppc64el/d/dhcpcd5/20230516_083323_abad0@/log.gz
    + ✅ dhcpcd5 on mantic for s390x @ 16.05.23 11:06:03
      • Log: https://autopkgtest.ubuntu.com/results/autopkgtest-mantic-zhsj-dhcpcd5/mantic/s390x/d/dhcpcd5/20230516_110603_d5dc6@/log.gz

[Christian Ehrhardt  (paelzer)]

Review for Package: dhcpcd5

[Summary]

MIR team ACK under the constraint to resolve the below listed
required TODOs and as much as possible having a look at the
recommended TODOs.
And let me be clear, while I have a few small requests here and there
it looks much better than the isc-dhcp-client it is replacing.
So please do not consider this a set-back, but a motivational list of todos :-)

This does need a security review, so I'll assign ubuntu-security

List of specific binary packages to be promoted to main: dhcpcd-base
Specific binary packages built, but NOT to be promoted to main: dhcpcd, dhcpcd5

Recommended TODOs:
- #1 please clarify if you even want/need the binary package dhcpcd, AFAICS
  none of the use cases you listed to replace in FO092 are needing a service
  to run on all interfaces. Maybe I'm wrong - it would be helpful to know what
  to expect - will a future system have dhcpcd and run this on all interfaces
  or just dhcpcd-base to call the client as needed on specific interfaces.
- #2 The package should get a team bug subscriber before being promoted

Required TODOs:
- #3 While I understand that the majority of todays test blockers are due to
  package dependencies you'll need to get them running and working. The plan is
  to get this into main in 23.10 and only do the replacement in 24.04. That
  means there should be some way to get this testable (like not uninstalling
  ubuntu-minimal) in 23.10 as well.
   You already started the needed changes in the linked Debian bug discussions
- #4 please fix d/watch to use github tags from
  https://github.com/NetworkConfiguration/dhcpcd/tags
  (it is broken right now)
- #5 please update the packge to something more recent. For now Debian was
  in a freeze which explains it to some extent. But we should start and stay
  recent. (There is also nothing recent in experimental so far.)

[Duplication]
There is an obvious package in main providing the same functionality being
isc-dhcpi-client, but the whole reason to do this is to supersede that.
So this aspect is fine.

[Dependencies]
OK:
- no other Dependencies to MIR due to this
- no -dev/-debug/-doc packages that need exclusion
- No dependencies in main that are only superficially tested requiring
  more tests now.

Problems: None

[Embedded sources and static linking]
OK:
- no embedded source present
- no static linking
- does not have unexpected Built-Using entries
- not a go package, no extra constraints to consider in that regard
- not a rust package, no extra constraints to consider in that regard

Problems: None

[Security]
OK:
- does not use webkit1,2
- does not use lib*v8 directly
- does not open a port/socket
- does not process arbitrary web content
- does not use centralized online accounts
- does not integrate arbitrary javascript into the desktop
- does not deal with system authentication (eg, pam), etc)
- does not deal with security attestation (secure boot, tpm, signatures)
- does not deal with cryptography (en-/decryption, certificates, signing, ...)

Problems:
- history of CVEs does look concerning, but given that this is a commonly
  attacked code also not too much to block it (other dhcp implementations
  are simil...

[Shengjing Zhu (zhsj)]

> #1 please clarify if you even want/need the binary package dhcpcd,

only bin:dhcpcd-base is needed.

[Shengjing Zhu (zhsj)]

> #3 While I understand that the majority of todays test blockers are due to
  package dependencies you'll need to get them running and working.

https://autopkgtest.ubuntu.com/packages/d/dhcpcd5 is green on mantic now.

> #4 please fix d/watch to use github tags from

Fixed in 9.4.1-22ubuntu1

[Martin-Éric Racine (q-funk)]

Fixed in 9.4.1-24 on Debian.

[Martin-Éric Racine (q-funk)]

Please note that the source package is now called 'dhcpcd'. The 5 has been dropped from the name starting with Debian 10.0.1-1.

[Camila Camargo de Matos (ccdm94)]

I reviewed dhcpcd5 9.4.1-24 as checked into mantic. This shouldn't be considered a full audit but rather a quick gauge of maintainability.

dhcpcd5 is a DHCP client (for both IPv4 and IPv6 hosts) and a IPv4LL client. It silently configures the network in a computer and requires mostly no configuration to do so.

- CVE History:
  - Has a few CVEs attributed to it in the past (15).
  - Patches for CVEs are not as clear/easy to find in older CVEs, but since 2019 it seems like upstream has adopted a more organized system in order to patch vulnerabilities, providing the appropriate commits and including messages that explain the issue.
  - Most recent CVE is from 2019.
  - Upstream is active and frequently applying fixes.
- Build-Depends:
  - libudev-dev, debhelper-compat, pkg-config
  - Does not depend on encryption libraries directly, however, this is because during the configure step, there is a check for the presence of certain libraries, and if they do not exist, they are recovered from the '/compat' directory, which in turn contains a '/crypt' directory. This directory contains C files with hashing functions that are to be used by dhcpcd5. The SHA256 files seems to be recovered from 'libscrypt', which is a package available in Ubuntu. The MD5 and HMAC functions seem to have been implemented for NetBSD and I cannot find a package which implements the functions in those files, only coming across packages that do the same as dhcpcd5 and have an internal copy of the code. Possibly package 'util-linux'? TODO: possibly finding if we have packages which contains the functions recovered from 'compat'.
  - Other dependencies in this directory include functions available through 'libbsd', like the 'arc4random' random number generator function and some string functions. If the libraries that provide these functions are not set as dependencies for the package, this means that maintenance of this package might involve keeping a close eye in this "outside" functions, as they could be susceptible to vulnerabilities as well.
- pre/post inst/rm scripts:
  - They seem to run regular set up and clean up actions, other than additional commands included in order to prepare the system for privilege separation.
  - dhcpcd/preinst: sets 'dhcpcd' in 'init.d' as executable if an 'install' command is executed and if the file exists. Ends 'dhcpcd.service' if 'systemd' is in the system and if it is running, and in case of an upgrade.
  - dhcpdcd/postinst: if a 'configure' is run or an 'abort' (upgrade, configure or remove) command is run, will enable/(set '+x' permission) dhcpcd service/(to 'init.d' dhcpcd file).
  - dhcpdcd/postrm: disables dhcpcd service in 'init.d' if a 'remove' command (by removing execution flag), and deletes the file completely if the command is a 'purge'. Does the equivalent to the systemd service.
  - dhcpcd-base/postinst: creates a 'dhcpcd' system user with no shell. Runs the dhcpcd daemon.
  - dhcpcd-base/postrm: deletes 'dhcpcd' system user IF 'deluser' exists. Presents system message if the user is not deleted. Removes directory where dhcpcd stores leases and DUIDs.
- init scripts:
  - Creates './etc/init.d/dhcpcd' (which is expected sinc...

[Tobias Heider (tobhe)]

From a FIPS POV it looks mostly ok so far. I am currently looking into modifying the package dependencies to use system libraries for sha and arc4random. I am planning to upload a diff for that later.

[Benjamin Drung (bdrung)]

Thanks Tobias. It is probably the safest option to remove the 'compat' directory before the build to ensure that it is not used. If you need help, let me know.

[Tobias Heider (tobhe)]

I found that we can use libmd instead of the bundled compat/ sha implementations and opened a Debian PR here: https://salsa.debian.org/debian/dhcpcd/-/merge_requests/2
libmd is not currently cerified but it is included in main and thus gets the full security team CVE treatment. Besides, when it comes to cryptography we want to have as few different implementations as possible.

With 10.0.1-1 from Debian the configure script also seems to pick up arc4random from libc, which is another huge improvement.

[Tobias Heider (tobhe)]

@bdrung I like that idea. We can't drop the whole thing but with compat/arc4random* and compat/crypt removed we would reduce the risk of a future update pulling in the wrong implementations.

[Benjamin Drung (bdrung)]

dhcpcd 10.0.1-1 passed Debian NEW and is synced to Ubuntu. This version got the source package renamed from dhcpcd5 to dhcpcd.

[Tobias Heider (tobhe)]

Update from security-certs: I have started working on a larger patch to use openssl for the crypto operations here: https://github.com/NetworkConfiguration/dhcpcd/pull/223
With that it should work out of the box on certified systems because all the checks are implemented in the library.

[Christian Ehrhardt  (paelzer)]

"In progress" means this would be ready, but it isn't having a few requests open to be addressed.
Setting to incomplete until provided for final sign off.

[Martin-Éric Racine (q-funk)]

I could already add the Build-Depends on libmd-dev at Debian. This would solve the crypto issue. It can always be changed to use OpenSSL later on.

The BSD compat wrapper issue remains. As far as I can tell, libbsd-dev is only partially found by ./configure.

[Martin-Éric Racine (q-funk)]

Btw, Debian now has 10.0.2-1 which fixes a number of bugs.

[Lukas Märdian (slyon)]

So it looks like we're (only?) waiting on a FIPS related TODO here that @tobhe is working on (cc @bdrung).

See comment #10 & https://salsa.debian.org/debian/dhcpcd/-/merge_requests/4

Assigning to Tobias for now.

[Lukas Märdian (slyon)]

bump. This should now be ready for MIR approval IMO

[Tobias Heider (tobhe)]

Thanks everyone, my concerns are resolved with the newest version. Setting it back to "In progress".

[Benjamin Drung (bdrung)]

debian/watch from dhcpcd 1:10.0.2-3ubuntu1 is working for me.

[Christian Ehrhardt  (paelzer)]

Checking if all is in place:

MIR Required TODOs:
- ok - #3 Tests active now (red atm, but you'll need to get these green to migrate)
- ok - #4 d/watch is fixed
- ok - #5 package was updated to the most recent

MIR Recommended TODOs:
- ok - #1 clarified - just dhcpcd-base
- ok - #2 foundations-bugs is subscribed

Security TODOs
- ok - is CONFIG_SECCOMP_FILTER enabled (it is on in Ubuntu kernels)
- ok - reduce use of crypto code from compat directory (done in 10.0.2-3ubuntu1)
- ok - ensure 'open_memstream' is used (present in build and provided by libc)
- ok - Security certification team ack - given in comment #21

It is also shown in component mismatches, so it could be state "Fix Committed" and waiting for promotion.
This is valid for 1:10.0.2-3ubuntu2 (which has all changes required above) in mantic-proposed which should carry "being in main" over to -release once it migrates.

[Christian Ehrhardt  (paelzer)]

As requested just source + dhcpcd-base in mantic-proposed for now.

Override component to main
dhcpcd 1:10.0.2-3ubuntu2 in mantic: universe/misc -> main
Override [y|N]? y
1 publication overridden.

Override component to main
dhcpcd-base 1:10.0.2-3ubuntu2 in mantic amd64: universe/net/optional/100% -> main
dhcpcd-base 1:10.0.2-3ubuntu2 in mantic arm64: universe/net/optional/100% -> main
dhcpcd-base 1:10.0.2-3ubuntu2 in mantic armhf: universe/net/optional/100% -> main
dhcpcd-base 1:10.0.2-3ubuntu2 in mantic ppc64el: universe/net/optional/100% -> main
dhcpcd-base 1:10.0.2-3ubuntu2 in mantic riscv64: universe/net/optional/100% -> main
dhcpcd-base 1:10.0.2-3ubuntu2 in mantic s390x: universe/net/optional/100% -> main
Override [y|N]? y
6 publications overridden.

[Martin-Éric Racine (q-funk)]

10.0.4-1 eliminates the Ubuntu diff.