Merge remote-tracking branch 'salsa/master' into disco

25 files changed, 797 insertions, 67 deletions

diff --git a/debian/changelog b/debian/changelog
index b65ab355..9a980b4e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,98 @@
+network-manager (1.14.4-4ubuntu1) UNRELEASED; urgency=medium
+
+  * Resynchronized with Debian
+
+ -- Sebastien Bacher <seb128@ubuntu.com>  Fri, 25 Jan 2019 11:10:07 +0100
+
+network-manager (1.14.4-4) unstable; urgency=medium
+
+  * Move D-Bus policy files to /usr/share/dbus-1/system.d/
+  * Remove obsolete D-Bus policy conffiles on upgrades
+
+ -- Michael Biebl <biebl@debian.org>  Tue, 27 Nov 2018 01:35:50 +0100
+
+network-manager (1.14.4-3) unstable; urgency=medium
+
+  * cli: wait for all wifi scans to finish before displaying the result.
+    Otherwise devices are displayed in an inconsistent order.
+    Replaces debian/patches/Ignore-client-tests-failures.patch.
+
+ -- Michael Biebl <biebl@debian.org>  Mon, 05 Nov 2018 16:05:51 +0100
+
+network-manager (1.14.4-2) unstable; urgency=high
+
+  * dhcp6: Make sure we have enough space for the DHCP6 option header.
+    Fixes out-of-bounds heap write in systemd-networkd dhcpv6 option handling
+    which also affects the "internal" DHCP plugin of NetworkManager.
+    (CVE-2018-15688, LP: #1795921)
+
+ -- Michael Biebl <biebl@debian.org>  Tue, 30 Oct 2018 09:34:25 +0100
+
+network-manager (1.14.4-1) unstable; urgency=medium
+
+  * New upstream version 1.14.4
+    - Fix a crash in ifupdown (Debian) configuration plugin (Closes: #911621)
+  * Switch to debhelper compat level 12 and dh_installsystemd
+  * Update symbols file for libnm0
+  * Ignore client/tests failures.
+    check-local-clients-tests-test-client appears to be flaky and prone to
+    fail on slower architectures. Ignore failures of this test until this
+    has been properly investigated.
+
+ -- Michael Biebl <biebl@debian.org>  Thu, 25 Oct 2018 00:30:39 +0200
+
+network-manager (1.14.2-2) unstable; urgency=medium
+
+  * Upload to unstable
+
+ -- Michael Biebl <biebl@debian.org>  Sun, 21 Oct 2018 16:09:49 +0200
+
+network-manager (1.14.2-1) experimental; urgency=medium
+
+  * New upstream version 1.14.2
+  * Rebase patches
+  * Disable obsolete ibft settings plugin.
+    It has been replaced by an iBFT reader which parses /sys/firmware/ibft
+    directly instead of iscsiadm output.
+  * Drop debian/patches/Fix-iscsiadm-path.patch.
+    No longer needed.
+
+ -- Michael Biebl <biebl@debian.org>  Sun, 21 Oct 2018 02:56:25 +0200
+
+network-manager (1.14.0-2) experimental; urgency=medium
+
+  * Tighten inter-package dependencies.
+    Make sure network-manager and libnm0 are always upgraded in lockstep.
+    (Closes: #818165)
+
+ -- Michael Biebl <biebl@debian.org>  Mon, 08 Oct 2018 16:55:10 +0200
+
+network-manager (1.14.0-1) experimental; urgency=medium
+
+  * New upstream version 1.14.0
+  * Rebase patches
+  * Update symbols file for libnm0.
+    The nm_connection_get_setting_{6lowpan,sriov,wpan} API had been
+    introduced during the 1.14 development cycle but as it was duplicating
+    existing functionality it was removed again.
+
+ -- Michael Biebl <biebl@debian.org>  Sat, 15 Sep 2018 10:57:07 +0200
+
+network-manager (1.13.90-1) experimental; urgency=medium
+
+  * New upstream version 1.13.90 (1.14 rc1)
+  * Refresh patches
+  * Update symbols file for libnm0
+  * Bump Standards-Version to 4.2.1
+
+ -- Michael Biebl <biebl@debian.org>  Sat, 08 Sep 2018 18:23:20 +0200
+
+network-manager (1.12.6-0ubuntu4) disco; urgency=medium
+
+  * No-change rebuild for readline soname change.
+
+ -- Matthias Klose <doko@ubuntu.com>  Mon, 14 Jan 2019 20:02:35 +0000
+
 network-manager (1.12.6-0ubuntu3) disco; urgency=medium
 
   * debian/tests/nm.py: Make assert_iface_down() not check the interface's
diff --git a/debian/compat b/debian/compat
index f599e28b..48082f72 100644
--- a/debian/compat
+++ b/debian/compat
@@ -1 +1 @@
-10
+12
diff --git a/debian/control b/debian/control
index 8bd28c51..9bcbe75e 100644
--- a/debian/control
+++ b/debian/control
@@ -6,7 +6,7 @@ XSBC-Original-Maintainer: Utopia Maintenance Team <pkg-utopia-maintainers@lists.
 Uploaders: Michael Biebl <biebl@debian.org>,
  Sjoerd Simons <sjoerd@debian.org>,
  Aron Xu <aron@debian.org>
-Build-Depends: debhelper (>= 10.3),
+Build-Depends: debhelper (>= 11.4~),
                automake (>= 1.12),
                dpkg-dev (>= 1.17.14),
                pkg-config,
@@ -43,8 +43,10 @@ Build-Depends: debhelper (>= 10.3),
                valac (>= 0.17.1.24),
                dbus <!nocheck>,
                python-dbus <!nocheck>
-Standards-Version: 4.1.5
+Standards-Version: 4.2.1
 Rules-Requires-Root: no
+XS-Debian-Vcs-Git: https://salsa.debian.org/utopia-team/network-manager.git
+XS-Debian-Vcs-Browser: https://salsa.debian.org/utopia-team/network-manager
 Vcs-Git: https://git.launchpad.net/network-manager -b disco
 Vcs-Browser: https://git.launchpad.net/network-manager?h=disco
 Homepage: https://wiki.gnome.org/Projects/NetworkManager
@@ -54,6 +56,7 @@ Architecture: linux-any
 Pre-Depends: ${misc:Pre-Depends}
 Depends: ${shlibs:Depends},
          ${misc:Depends},
+         libnm0 (= ${binary:Version}),
          lsb-base,
          wpasupplicant,
          dbus,
diff --git a/debian/libnm0.symbols b/debian/libnm0.symbols
index 3e7c9ed1..fd43fa93 100644
--- a/debian/libnm0.symbols
+++ b/debian/libnm0.symbols
@@ -3,9 +3,11 @@ libnm.so.0 libnm0 #MINVER#
  libnm_1_0_4@libnm_1_0_4 1.0.4
  libnm_1_0_6@libnm_1_0_6 1.0.6
  libnm_1_10_0@libnm_1_10_0 1.9.90
+ libnm_1_10_14@libnm_1_10_14 1.14.4
  libnm_1_10_2@libnm_1_10_2 1.10.2
  libnm_1_12_0@libnm_1_12_0 1.11.3
  libnm_1_12_2@libnm_1_12_2 1.12.2
+ libnm_1_14_0@libnm_1_14_0 1.13.90
  libnm_1_2_0@libnm_1_2_0 1.1.90
  libnm_1_2_4@libnm_1_2_4 1.2.4
  libnm_1_4_0@libnm_1_4_0 1.4.0
@@ -192,6 +194,7 @@ libnm.so.0 libnm0 #MINVER#
  nm_connection_get_virtual_device_description@libnm_1_0_0 1.0.0
  nm_connection_is_type@libnm_1_0_0 1.0.0
  nm_connection_is_virtual@libnm_1_0_0 1.0.0
+ nm_connection_multi_connect_get_type@libnm_1_14_0 1.13.90
  nm_connection_need_secrets@libnm_1_0_0 1.0.0
  nm_connection_normalize@libnm_1_0_0 1.0.0
  nm_connection_remove_setting@libnm_1_0_0 1.0.0
@@ -206,6 +209,7 @@ libnm.so.0 libnm0 #MINVER#
  nm_connectivity_state_get_type@libnm_1_0_0 1.0.0
  nm_crypto_error_get_type@libnm_1_0_0 1.0.0
  nm_crypto_error_quark@libnm_1_0_0 1.0.0
+ nm_device_6lowpan_get_type@libnm_1_14_0 1.13.90
  nm_device_adsl_get_carrier@libnm_1_0_0 1.0.0
  nm_device_adsl_get_type@libnm_1_0_0 1.0.0
  nm_device_bond_get_carrier@libnm_1_0_0 1.0.0
@@ -401,6 +405,11 @@ libnm.so.0 libnm0 #MINVER#
  nm_device_wimax_get_rssi@libnm_1_0_0 1.0.0
  nm_device_wimax_get_tx_power@libnm_1_0_0 1.0.0
  nm_device_wimax_get_type@libnm_1_0_0 1.0.0
+ nm_device_wireguard_get_fwmark@libnm_1_14_0 1.13.90
+ nm_device_wireguard_get_listen_port@libnm_1_14_0 1.13.90
+ nm_device_wireguard_get_public_key@libnm_1_14_0 1.13.90
+ nm_device_wireguard_get_type@libnm_1_14_0 1.13.90
+ nm_device_wpan_get_type@libnm_1_14_0 1.13.90
  nm_dhcp_config_get_family@libnm_1_0_0 1.0.0
  nm_dhcp_config_get_one_option@libnm_1_0_0 1.0.0
  nm_dhcp_config_get_options@libnm_1_0_0 1.0.0
@@ -512,6 +521,7 @@ libnm.so.0 libnm0 #MINVER#
  nm_secret_agent_old_unregister@libnm_1_0_0 1.0.0
  nm_secret_agent_old_unregister_async@libnm_1_0_0 1.0.0
  nm_secret_agent_old_unregister_finish@libnm_1_0_0 1.0.0
+ nm_setting_6lowpan_get_type@libnm_1_14_0 1.13.90
  nm_setting_802_1x_add_altsubject_match@libnm_1_0_0 1.0.0
  nm_setting_802_1x_add_eap_method@libnm_1_0_0 1.0.0
  nm_setting_802_1x_add_phase2_altsubject_match@libnm_1_0_0 1.0.0
@@ -666,10 +676,13 @@ libnm.so.0 libnm0 #MINVER#
  nm_setting_connection_get_id@libnm_1_0_0 1.0.0
  nm_setting_connection_get_interface_name@libnm_1_0_0 1.0.0
  nm_setting_connection_get_lldp@libnm_1_2_0 1.1.90
+ nm_setting_connection_get_llmnr@libnm_1_14_0 1.13.90
  nm_setting_connection_get_master@libnm_1_0_0 1.0.0
+ nm_setting_connection_get_mdns@libnm_1_10_14 1.14.4
  nm_setting_connection_get_mdns@libnm_1_12_0 1.11.3
  nm_setting_connection_get_metered@libnm_1_0_6 1.0.6
  nm_setting_connection_get_metered@libnm_1_2_0 1.1.90
+ nm_setting_connection_get_multi_connect@libnm_1_14_0 1.13.90
  nm_setting_connection_get_num_permissions@libnm_1_0_0 1.0.0
  nm_setting_connection_get_num_secondaries@libnm_1_0_0 1.0.0
  nm_setting_connection_get_permission@libnm_1_0_0 1.0.0
@@ -683,6 +696,8 @@ libnm.so.0 libnm0 #MINVER#
  nm_setting_connection_get_zone@libnm_1_0_0 1.0.0
  nm_setting_connection_is_slave_type@libnm_1_0_0 1.0.0
  nm_setting_connection_lldp_get_type@libnm_1_2_0 1.1.90
+ nm_setting_connection_llmnr_get_type@libnm_1_14_0 1.13.90
+ nm_setting_connection_mdns_get_type@libnm_1_10_14 1.14.4
  nm_setting_connection_mdns_get_type@libnm_1_12_0 1.11.3
  nm_setting_connection_new@libnm_1_0_0 1.0.0
  nm_setting_connection_permissions_user_allowed@libnm_1_0_0 1.0.0
@@ -720,6 +735,11 @@ libnm.so.0 libnm0 #MINVER#
  nm_setting_dummy_new@libnm_1_8_0 1.8.0
  nm_setting_duplicate@libnm_1_0_0 1.0.0
  nm_setting_enumerate_values@libnm_1_0_0 1.0.0
+ nm_setting_ethtool_clear_features@libnm_1_14_0 1.13.90
+ nm_setting_ethtool_get_feature@libnm_1_14_0 1.13.90
+ nm_setting_ethtool_get_type@libnm_1_14_0 1.13.90
+ nm_setting_ethtool_new@libnm_1_14_0 1.13.90
+ nm_setting_ethtool_set_feature@libnm_1_14_0 1.13.90
  nm_setting_generic_get_type@libnm_1_0_0 1.0.0
  nm_setting_generic_new@libnm_1_0_0 1.0.0
  nm_setting_get_dbus_property_type@libnm_1_0_0 1.0.0
@@ -842,6 +862,14 @@ libnm.so.0 libnm0 #MINVER#
  nm_setting_macvlan_get_type@libnm_1_2_0 1.1.90
  nm_setting_macvlan_mode_get_type@libnm_1_2_0 1.1.90
  nm_setting_macvlan_new@libnm_1_2_0 1.1.90
+ nm_setting_match_add_interface_name@libnm_1_14_0 1.13.90
+ nm_setting_match_clear_interface_names@libnm_1_14_0 1.13.90
+ nm_setting_match_get_interface_name@libnm_1_14_0 1.13.90
+ nm_setting_match_get_interface_names@libnm_1_14_0 1.13.90
+ nm_setting_match_get_num_interface_names@libnm_1_14_0 1.13.90
+ nm_setting_match_get_type@libnm_1_14_0 1.13.90
+ nm_setting_match_remove_interface_name@libnm_1_14_0 1.13.90
+ nm_setting_match_remove_interface_name_by_value@libnm_1_14_0 1.13.90
  nm_setting_olpc_mesh_get_channel@libnm_1_0_0 1.0.0
  nm_setting_olpc_mesh_get_dhcp_anycast_address@libnm_1_0_0 1.0.0
  nm_setting_olpc_mesh_get_ssid@libnm_1_0_0 1.0.0
@@ -911,6 +939,16 @@ libnm.so.0 libnm0 #MINVER#
  nm_setting_serial_new@libnm_1_0_0 1.0.0
  nm_setting_serial_parity_get_type@libnm_1_0_0 1.0.0
  nm_setting_set_secret_flags@libnm_1_0_0 1.0.0
+ nm_setting_sriov_add_vf@libnm_1_14_0 1.13.90
+ nm_setting_sriov_clear_vfs@libnm_1_14_0 1.13.90
+ nm_setting_sriov_get_autoprobe_drivers@libnm_1_14_0 1.13.90
+ nm_setting_sriov_get_num_vfs@libnm_1_14_0 1.13.90
+ nm_setting_sriov_get_total_vfs@libnm_1_14_0 1.13.90
+ nm_setting_sriov_get_type@libnm_1_14_0 1.13.90
+ nm_setting_sriov_get_vf@libnm_1_14_0 1.13.90
+ nm_setting_sriov_new@libnm_1_14_0 1.13.90
+ nm_setting_sriov_remove_vf@libnm_1_14_0 1.13.90
+ nm_setting_sriov_remove_vf_by_index@libnm_1_14_0 1.13.90
  nm_setting_tc_config_add_qdisc@libnm_1_10_2 1.10.2
  nm_setting_tc_config_add_tfilter@libnm_1_10_2 1.10.2
  nm_setting_tc_config_clear_qdiscs@libnm_1_10_2 1.10.2
@@ -1136,6 +1174,7 @@ libnm.so.0 libnm0 #MINVER#
  nm_setting_wireless_security_set_wep_key@libnm_1_0_0 1.0.0
  nm_setting_wireless_security_wps_method_get_type@libnm_1_10_0 1.9.90
  nm_setting_wireless_wake_on_wlan_get_type@libnm_1_12_0 1.11.90
+ nm_setting_wpan_get_type@libnm_1_14_0 1.13.90
  nm_settings_connection_flags_get_type@libnm_1_12_0 1.11.3
  nm_settings_error_get_type@libnm_1_0_0 1.0.0
  nm_settings_error_quark@libnm_1_0_0 1.0.0
@@ -1144,6 +1183,24 @@ libnm.so.0 libnm0 #MINVER#
  nm_simple_connection_new@libnm_1_0_0 1.0.0
  nm_simple_connection_new_clone@libnm_1_0_0 1.0.0
  nm_simple_connection_new_from_dbus@libnm_1_0_0 1.0.0
+ nm_sriov_vf_add_vlan@libnm_1_14_0 1.13.90
+ nm_sriov_vf_dup@libnm_1_14_0 1.13.90
+ nm_sriov_vf_equal@libnm_1_14_0 1.13.90
+ nm_sriov_vf_get_attribute@libnm_1_14_0 1.13.90
+ nm_sriov_vf_get_attribute_names@libnm_1_14_0 1.13.90
+ nm_sriov_vf_get_index@libnm_1_14_0 1.13.90
+ nm_sriov_vf_get_type@libnm_1_14_0 1.13.90
+ nm_sriov_vf_get_vlan_ids@libnm_1_14_0 1.13.90
+ nm_sriov_vf_get_vlan_protocol@libnm_1_14_0 1.13.90
+ nm_sriov_vf_get_vlan_qos@libnm_1_14_0 1.13.90
+ nm_sriov_vf_new@libnm_1_14_0 1.13.90
+ nm_sriov_vf_ref@libnm_1_14_0 1.13.90
+ nm_sriov_vf_remove_vlan@libnm_1_14_0 1.13.90
+ nm_sriov_vf_set_attribute@libnm_1_14_0 1.13.90
+ nm_sriov_vf_set_vlan_protocol@libnm_1_14_0 1.13.90
+ nm_sriov_vf_set_vlan_qos@libnm_1_14_0 1.13.90
+ nm_sriov_vf_unref@libnm_1_14_0 1.13.90
+ nm_sriov_vf_vlan_protocol_get_type@libnm_1_14_0 1.13.90
  nm_state_get_type@libnm_1_0_0 1.0.0
  nm_tc_action_dup@libnm_1_10_2 1.10.2
  nm_tc_action_equal@libnm_1_10_2 1.10.2
@@ -1193,6 +1250,7 @@ libnm.so.0 libnm0 #MINVER#
  nm_team_link_watcher_new_nsna_ping@libnm_1_10_2 1.10.2
  nm_team_link_watcher_ref@libnm_1_10_2 1.10.2
  nm_team_link_watcher_unref@libnm_1_10_2 1.10.2
+ nm_ternary_get_type@libnm_1_14_0 1.13.90
  nm_utils_ap_mode_security_valid@libnm_1_0_0 1.0.0
  nm_utils_bin2hexstr@libnm_1_0_0 1.0.0
  nm_utils_bond_mode_int_to_string@libnm_1_2_0 1.1.90
@@ -1245,6 +1303,8 @@ libnm.so.0 libnm0 #MINVER#
  nm_utils_same_ssid@libnm_1_0_0 1.0.0
  nm_utils_security_type_get_type@libnm_1_0_0 1.0.0
  nm_utils_security_valid@libnm_1_0_0 1.0.0
+ nm_utils_sriov_vf_from_str@libnm_1_14_0 1.13.90
+ nm_utils_sriov_vf_to_str@libnm_1_14_0 1.13.90
  nm_utils_ssid_to_utf8@libnm_1_0_0 1.0.0
  nm_utils_tc_action_from_str@libnm_1_10_2 1.10.2
  nm_utils_tc_action_to_str@libnm_1_10_2 1.10.2
diff --git a/debian/network-manager.install b/debian/network-manager.install
index 4568e8fd..4873679f 100644
--- a/debian/network-manager.install
+++ b/debian/network-manager.install
@@ -5,8 +5,8 @@ usr/bin/nmtui*
 usr/lib/NetworkManager/nm-dhcp-helper
 usr/lib/NetworkManager/nm-iface-helper
 usr/lib/NetworkManager/nm-dispatcher
+usr/lib/NetworkManager/nm-initrd-generator
 usr/lib/*/NetworkManager/*/libnm-settings-plugin-ifupdown.so
-usr/lib/*/NetworkManager/*/libnm-settings-plugin-ibft.so
 usr/lib/*/NetworkManager/*/libnm-device-plugin-*.so
 usr/lib/*/NetworkManager/*/libnm-ppp-plugin.so
 usr/lib/*/NetworkManager/*/libnm-wwan.so
@@ -14,10 +14,10 @@ usr/lib/pppd/*/*.so
 usr/share/locale/
 usr/share/man/
 usr/share/dbus-1/system-services/
+usr/share/dbus-1/system.d/org.freedesktop.NetworkManager.conf
+usr/share/dbus-1/system.d/nm-dispatcher.conf
 usr/share/polkit-1/
 usr/share/bash-completion/
-etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf
-etc/dbus-1/system.d/nm-dispatcher.conf
 etc/NetworkManager/dispatcher.d/
 lib/udev/rules.d/*.rules
 lib/systemd/system/NetworkManager.service
diff --git a/debian/network-manager.links b/debian/network-manager.links
index 60ddb3ee..d37ab78d 100644
--- a/debian/network-manager.links
+++ b/debian/network-manager.links
@@ -1 +1,2 @@
 /usr/share/apport/package-hooks/source_network-manager.py /usr/share/apport/package-hooks/source_network-manager-applet.py
+lib/systemd/system/NetworkManager.service lib/systemd/system/network-manager.service
diff --git a/debian/network-manager.maintscript b/debian/network-manager.maintscript
index bc1dbf5e..1c8a42cf 100644
--- a/debian/network-manager.maintscript
+++ b/debian/network-manager.maintscript
@@ -1,3 +1,5 @@
 rm_conffile /etc/dbus-1/system.d/nm-avahi-autoipd.conf 1.1.90-2~
 mv_conffile /etc/NetworkManager/dispatcher.d/01ifupdown /etc/NetworkManager/dispatcher.d/01-ifupdown 1.8.0-5~
 rm_conffile /etc/dbus-1/system.d/nm-ofono.conf 1.2.4-1~
+rm_conffile /etc/dbus-1/system.d/nm-dispatcher.conf 1.14.4-4~
+rm_conffile /etc/dbus-1/system.d/org.freedesktop.NetworkManager.conf 1.14.4-4~
diff --git a/debian/patches/Disable-general-with-expect.patch b/debian/patches/Disable-general-with-expect.patch
index c053fe1e..1440af27 100644
--- a/debian/patches/Disable-general-with-expect.patch
+++ b/debian/patches/Disable-general-with-expect.patch
@@ -7,11 +7,11 @@ which tends to fail on ppc64el and arm64
  Makefile.am | 1 -
  1 file changed, 1 deletion(-)
 
-Index: network-manager-1.12.2/Makefile.am
+Index: network-manager-1.14.4/Makefile.am
 ===================================================================
---- network-manager-1.12.2.orig/Makefile.am
-+++ network-manager-1.12.2/Makefile.am
-@@ -3180,7 +3180,6 @@ src_tests_ldadd = \
+--- network-manager-1.14.4.orig/Makefile.am
++++ network-manager-1.14.4/Makefile.am
+@@ -3404,7 +3404,6 @@ src_tests_ldadd = \
  
  check_programs += \
  	src/tests/test-general \
diff --git a/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch b/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch
index b8a4c486..636865a4 100644
--- a/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch
+++ b/debian/patches/Don-t-make-NetworkManager-D-Bus-activatable.patch
@@ -10,10 +10,10 @@ to be autostarted by a client request.
  2 files changed, 6 deletions(-)
 
 diff --git a/Makefile.am b/Makefile.am
-index 0b8becd..1803e1a 100644
+index 1e100f6..204f1a0 100644
 --- a/Makefile.am
 +++ b/Makefile.am
-@@ -3895,11 +3895,6 @@ endif
+@@ -4110,11 +4110,6 @@ endif
  data/NetworkManager-dispatcher.service: $(srcdir)/data/NetworkManager-dispatcher.service.in
  	$(AM_V_GEN) $(data_edit) $< >$@
  
diff --git a/debian/patches/Don-t-setup-Sleep-Monitor-if-not-booted-with-systemd.patch b/debian/patches/Don-t-setup-Sleep-Monitor-if-not-booted-with-systemd.patch
index e2516d62..5ab7a01d 100644
--- a/debian/patches/Don-t-setup-Sleep-Monitor-if-not-booted-with-systemd.patch
+++ b/debian/patches/Don-t-setup-Sleep-Monitor-if-not-booted-with-systemd.patch
@@ -16,7 +16,7 @@ Closes: #742933
  1 file changed, 5 insertions(+)
 
 diff --git a/src/nm-sleep-monitor.c b/src/nm-sleep-monitor.c
-index a7e3a7c..9931f12 100644
+index 54d7577..a4bb43f 100644
 --- a/src/nm-sleep-monitor.c
 +++ b/src/nm-sleep-monitor.c
 @@ -25,6 +25,7 @@
diff --git a/debian/patches/Fix-iscsiadm-path.patch b/debian/patches/Fix-iscsiadm-path.patch
deleted file mode 100644
index 7af98133..00000000
--- a/debian/patches/Fix-iscsiadm-path.patch
+++ /dev/null
@@ -1,26 +0,0 @@
-From: Michael Biebl <biebl@debian.org>
-Date: Wed, 6 May 2015 18:17:51 +0200
-Subject: Fix iscsiadm path
-
-The open-scsi package in Debian installs the iscisadm binary as
-/usr/bin/iscsiadm.
-
-This patch can be dropped post-stretch as open-iscsi now also ships the
-binary as /sbin/iscsiadm (and /usr/bin/iscsiadm is a compat symlink).
----
- src/settings/plugins/ibft/nms-ibft-plugin.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/settings/plugins/ibft/nms-ibft-plugin.c b/src/settings/plugins/ibft/nms-ibft-plugin.c
-index 77ce208..f84276d 100644
---- a/src/settings/plugins/ibft/nms-ibft-plugin.c
-+++ b/src/settings/plugins/ibft/nms-ibft-plugin.c
-@@ -74,7 +74,7 @@ read_connections (NMSIbftPlugin *self)
- 	GError *error = NULL;
- 	NMSIbftConnection *connection;
- 
--	if (!nms_ibft_reader_load_blocks ("/sbin/iscsiadm", &blocks, &error)) {
-+	if (!nms_ibft_reader_load_blocks ("/usr/bin/iscsiadm", &blocks, &error)) {
- 		nm_log_dbg (LOGD_SETTINGS, "ibft: failed to read iscsiadm records: %s", error->message);
- 		g_error_free (error);
- 		return;
diff --git a/debian/patches/Force-online-state-with-unmanaged-devices.patch b/debian/patches/Force-online-state-with-unmanaged-devices.patch
index 022154c6..ae96f968 100644
--- a/debian/patches/Force-online-state-with-unmanaged-devices.patch
+++ b/debian/patches/Force-online-state-with-unmanaged-devices.patch
@@ -12,7 +12,7 @@ Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=512286
  1 file changed, 115 insertions(+)
 
 diff --git a/src/nm-manager.c b/src/nm-manager.c
-index ad90616..d5f0f95 100644
+index 7598995..1439c47 100644
 --- a/src/nm-manager.c
 +++ b/src/nm-manager.c
 @@ -62,6 +62,8 @@
@@ -35,7 +35,7 @@ index ad90616..d5f0f95 100644
  	guint timestamp_update_id;
  
  	guint devices_inited_id;
-@@ -1387,6 +1393,27 @@ find_best_device_state (NMManager *manager)
+@@ -1417,6 +1423,27 @@ find_best_device_state (NMManager *manager)
  	return best_state;
  }
  
@@ -63,7 +63,7 @@ index ad90616..d5f0f95 100644
  static void
  nm_manager_update_metered (NMManager *self)
  {
-@@ -1425,6 +1452,9 @@ nm_manager_update_state (NMManager *self)
+@@ -1455,6 +1482,9 @@ nm_manager_update_state (NMManager *self)
  	else
  		new_state = find_best_device_state (self);
  
@@ -73,7 +73,7 @@ index ad90616..d5f0f95 100644
  	if (   new_state >= NM_STATE_CONNECTED_LOCAL
  	    && priv->connectivity_state == NM_CONNECTIVITY_FULL) {
  		new_state = NM_STATE_CONNECTED_GLOBAL;
-@@ -5884,6 +5914,62 @@ impl_manager_check_connectivity (NMDBusObject *obj,
+@@ -6209,6 +6239,62 @@ impl_manager_check_connectivity (NMDBusObject *obj,
  	nm_auth_chain_add_call (chain, NM_AUTH_PERMISSION_NETWORK_CONTROL, TRUE);
  }
  
@@ -136,7 +136,7 @@ index ad90616..d5f0f95 100644
  static void
  start_factory (NMDeviceFactory *factory, gpointer user_data)
  {
-@@ -6034,6 +6120,9 @@ nm_manager_start (NMManager *self, GError **error)
+@@ -6377,6 +6463,9 @@ nm_manager_start (NMManager *self, GError **error)
  	nm_clear_g_source (&priv->devices_inited_id);
  	priv->devices_inited_id = g_idle_add_full (G_PRIORITY_LOW + 10, devices_inited_cb, self, NULL);
  
@@ -146,7 +146,7 @@ index ad90616..d5f0f95 100644
  	return TRUE;
  }
  
-@@ -6897,6 +6986,22 @@ nm_manager_init (NMManager *self)
+@@ -7231,6 +7320,22 @@ nm_manager_init (NMManager *self)
  		       KERNEL_FIRMWARE_DIR);
  	}
  
@@ -169,7 +169,7 @@ index ad90616..d5f0f95 100644
  	/* Update timestamps in active connections */
  	priv->timestamp_update_id = g_timeout_add_seconds (300, (GSourceFunc) periodic_update_active_connection_timestamps, self);
  
-@@ -7172,6 +7277,16 @@ dispose (GObject *object)
+@@ -7506,6 +7611,16 @@ dispose (GObject *object)
  		g_clear_object (&priv->fw_monitor);
  	}
  
diff --git a/debian/patches/Update-dnsmasq-parameters.patch b/debian/patches/Update-dnsmasq-parameters.patch
index d80cf672..6820bca3 100644
--- a/debian/patches/Update-dnsmasq-parameters.patch
+++ b/debian/patches/Update-dnsmasq-parameters.patch
@@ -10,10 +10,10 @@ See also: https://blueprints.launchpad.net/ubuntu/+spec/foundations-p-dns-resolv
  src/dns/nm-dns-manager.c | 6 +++---
  2 files changed, 5 insertions(+), 5 deletions(-)
 
-Index: network-manager-1.12.2/src/dns/nm-dns-dnsmasq.c
+Index: network-manager-1.14.4/src/dns/nm-dns-dnsmasq.c
 ===================================================================
---- network-manager-1.12.2.orig/src/dns/nm-dns-dnsmasq.c
-+++ network-manager-1.12.2/src/dns/nm-dns-dnsmasq.c
+--- network-manager-1.14.4.orig/src/dns/nm-dns-dnsmasq.c
++++ network-manager-1.14.4/src/dns/nm-dns-dnsmasq.c
 @@ -330,8 +330,8 @@ start_dnsmasq (NMDnsDnsmasq *self)
  	argv[idx++] = "--no-hosts"; /* don't use /etc/hosts to resolve */
  	argv[idx++] = "--bind-interfaces";
@@ -25,11 +25,11 @@ Index: network-manager-1.12.2/src/dns/nm-dns-dnsmasq.c
  	argv[idx++] = "--clear-on-reload"; /* clear cache when dns server changes */
  	argv[idx++] = "--conf-file=/dev/null"; /* avoid loading /etc/dnsmasq.conf */
  	argv[idx++] = "--proxy-dnssec"; /* Allow DNSSEC to pass through */
-Index: network-manager-1.12.2/src/dns/nm-dns-manager.c
+Index: network-manager-1.14.4/src/dns/nm-dns-manager.c
 ===================================================================
---- network-manager-1.12.2.orig/src/dns/nm-dns-manager.c
-+++ network-manager-1.12.2/src/dns/nm-dns-manager.c
-@@ -1426,12 +1426,12 @@ update_dns (NMDnsManager *self,
+--- network-manager-1.14.4.orig/src/dns/nm-dns-manager.c
++++ network-manager-1.14.4/src/dns/nm-dns-manager.c
+@@ -1428,12 +1428,12 @@ update_dns (NMDnsManager *self,
  		;
  	}
  
@@ -44,7 +44,7 @@ Index: network-manager-1.12.2/src/dns/nm-dns-manager.c
  
  		if (NM_IS_DNS_SYSTEMD_RESOLVED (priv->plugin)) {
  			/* systemd-resolved uses a different link-local address */
-@@ -1756,7 +1756,7 @@ nm_dns_manager_stop (NMDnsManager *self)
+@@ -1758,7 +1758,7 @@ nm_dns_manager_stop (NMDnsManager *self)
  	_LOGT ("stopping...");
  
  	/* If we're quitting, leave a valid resolv.conf in place, not one
diff --git a/debian/patches/cli-fix-memory-leaks.patch b/debian/patches/cli-fix-memory-leaks.patch
new file mode 100644
index 00000000..457a7f85
--- /dev/null
+++ b/debian/patches/cli-fix-memory-leaks.patch
@@ -0,0 +1,37 @@
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Wed, 31 Oct 2018 10:10:10 +0100
+Subject: cli: fix memory leaks
+
+(cherry picked from commit a985efaf934cedd37a69f94cd35990d7e2c43f0b)
+(cherry picked from commit e22602096fe60fd73586bf041863b63aad84bbee)
+---
+ clients/cli/devices.c | 2 +-
+ clients/cli/utils.c   | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/clients/cli/devices.c b/clients/cli/devices.c
+index 38e24e7..b7ba50f 100644
+--- a/clients/cli/devices.c
++++ b/clients/cli/devices.c
+@@ -2795,7 +2795,7 @@ show_access_point_info (NMDeviceWifi *wifi, NmCli *nmc, NmcOutputData *out)
+ 
+ 		aps = sort_access_points (nm_device_wifi_get_access_points (wifi));
+ 		g_ptr_array_foreach (aps, fill_output_access_point, &info);
+-		g_ptr_array_free (aps, FALSE);
++		g_ptr_array_free (aps, TRUE);
+ 	}
+ 
+ 	print_data_prepare_width (out->output_data);
+diff --git a/clients/cli/utils.c b/clients/cli/utils.c
+index e21c108..feb6722 100644
+--- a/clients/cli/utils.c
++++ b/clients/cli/utils.c
+@@ -919,6 +919,8 @@ nmc_empty_output_fields (NmcOutputData *output_data)
+ 	/* Empty output_data array */
+ 	if (output_data->output_data->len > 0)
+ 		g_ptr_array_remove_range (output_data->output_data, 0, output_data->output_data->len);
++
++	g_ptr_array_unref (output_data->output_data);
+ }
+ 
+ /*****************************************************************************/
diff --git a/debian/patches/cli-tests-fix-output-on-failure.patch b/debian/patches/cli-tests-fix-output-on-failure.patch
new file mode 100644
index 00000000..4a213a92
--- /dev/null
+++ b/debian/patches/cli-tests-fix-output-on-failure.patch
@@ -0,0 +1,25 @@
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Wed, 31 Oct 2018 11:29:26 +0100
+Subject: cli/tests: fix output on failure
+
+(cherry picked from commit 5665f67bae25ee9f96e057c2a993b8cf69cbc127)
+(cherry picked from commit d1afd1c4206d3720de7776ed93ae61c48a7cc71d)
+---
+ clients/tests/test-client.py | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/clients/tests/test-client.py b/clients/tests/test-client.py
+index e8f1f7f..d92d499 100755
+--- a/clients/tests/test-client.py
++++ b/clients/tests/test-client.py
+@@ -744,8 +744,8 @@ class TestNmcli(NmTestBase):
+                     skip_test_for_l10n_diff.append(n['test_name'])
+                     continue
+                 print("\n\n\nThe file '%s' does not have the expected content:" % (filename))
+-                print("ACTUAL OUTPUT:\n[[%s]]\n" % (results_expect[i]))
+-                print("EXPECT OUTPUT:\n[[%s]]\n" % (n['content']))
++                print("ACTUAL OUTPUT:\n[[%s]]\n" % (n['content']))
++                print("EXPECT OUTPUT:\n[[%s]]\n" % (results_expect[i]))
+                 print("Let the test write the file by rerunning with NM_TEST_REGENERATE=1")
+                 print("See howto in %s for details.\n" % (PathConfiguration.canonical_script_filename()))
+                 self.fail("Unexpected output of command, expected %s. Rerun test with NM_TEST_REGENERATE=1 to regenerate files" % (filename))
diff --git a/debian/patches/cli-wait-for-all-wifi-scans-to-finish-before-displaying-t.patch b/debian/patches/cli-wait-for-all-wifi-scans-to-finish-before-displaying-t.patch
new file mode 100644
index 00000000..aaf4f28b
--- /dev/null
+++ b/debian/patches/cli-wait-for-all-wifi-scans-to-finish-before-displaying-t.patch
@@ -0,0 +1,219 @@
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Wed, 31 Oct 2018 10:00:22 +0100
+Subject: cli: wait for all wifi scans to finish before displaying the result
+
+Otherwise devices are displayed in a inconsistent order.
+
+https://gitlab.freedesktop.org/NetworkManager/NetworkManager/issues/39
+(cherry picked from commit c0138cdb35b51bf268c361a2dc7f4c4f6f36ef52)
+(cherry picked from commit c1bf574ea5b191bf081dbb31eee7f709e0b654a1)
+---
+ clients/cli/devices.c | 140 ++++++++++++++++++++++++++++----------------------
+ 1 file changed, 78 insertions(+), 62 deletions(-)
+
+diff --git a/clients/cli/devices.c b/clients/cli/devices.c
+index 029ca67..38e24e7 100644
+--- a/clients/cli/devices.c
++++ b/clients/cli/devices.c
+@@ -2870,28 +2870,38 @@ wifi_print_aps (NMDeviceWifi *wifi,
+ 
+ typedef struct {
+ 	NmCli *nmc;
+-	NMDeviceWifi *wifi;
+-	const NMMetaAbstractInfo *const*tmpl;
+-
++	NMDevice **devices;
++	const NMMetaAbstractInfo *const *tmpl;
+ 	const char *bssid_user;
++	GArray *out_indices;
++} ScanInfo;
++
++typedef struct {
++	ScanInfo *scan_info;
++	NMDeviceWifi *wifi;
+ 	gulong last_scan_id;
+ 	guint  timeout_id;
+ 	GCancellable *scan_cancellable;
+-	GArray *out_indices;
+ } WifiListData;
+ 
+ static void
+ wifi_list_finish (WifiListData *data)
+ {
+-	NmCli *nmc = data->nmc;
+-
+-	wifi_print_aps (data->wifi, data->nmc, data->out_indices,
+-	                data->tmpl, data->bssid_user);
++	ScanInfo *info = data->scan_info;
++	NmCli *nmc = info->nmc;
++	guint i;
+ 
+-	if (--nmc->should_wait == 0) {
++	if (--info->nmc->should_wait == 0) {
++		for (i = 0; info->devices[i]; i++) {
++			wifi_print_aps (NM_DEVICE_WIFI (info->devices[i]),
++			                info->nmc,
++			                info->out_indices,
++			                info->tmpl,
++			                info->bssid_user);
++		}
+ 		if (nmc->return_value == NMC_RESULT_ERROR_NOT_FOUND) {
+ 			g_string_printf (nmc->return_text, _("Error: Access point with bssid '%s' not found."),
+-			                 data->bssid_user);
++			                 data->scan_info->bssid_user);
+ 		}
+ 		g_main_loop_quit (loop);
+ 	}
+@@ -2899,9 +2909,15 @@ wifi_list_finish (WifiListData *data)
+ 	g_signal_handler_disconnect (data->wifi, data->last_scan_id);
+ 	nm_clear_g_source (&data->timeout_id);
+ 	nm_clear_g_cancellable (&data->scan_cancellable);
+-	g_array_unref (data->out_indices);
+-	g_object_unref (data->wifi);
+ 	g_slice_free (WifiListData, data);
++
++	if (info->nmc->should_wait == 0) {
++		for (i = 0; info->devices[i]; i++)
++			g_object_unref (info->devices[i]);
++		g_free (info->devices);
++		g_array_unref (info->out_indices);
++		g_free (info);
++	}
+ }
+ 
+ static void
+@@ -2945,49 +2961,6 @@ wifi_list_scan_timeout (gpointer user_data)
+ 	return G_SOURCE_REMOVE;
+ }
+ 
+-static void
+-wifi_list_aps (NMDeviceWifi *wifi,
+-               NmCli *nmc,
+-               GArray *out_indices,
+-               const NMMetaAbstractInfo *const*tmpl,
+-               const char *bssid_user,
+-               gint64 rescan_cutoff)
+-{
+-	gboolean needs_rescan;
+-	WifiListData *data;
+-
+-	needs_rescan = rescan_cutoff < 0 || (rescan_cutoff > 0 && nm_device_wifi_get_last_scan (wifi) < rescan_cutoff);
+-
+-	/* FIXME: nmcli should either
+-	 *  - don't request any new scan for any device and print the full AP list right
+-	 *    away.
+-	 *  - or, when requesting a scan on one or more devices, don't print the result
+-	 *    before all requests complete.
+-	 *
+-	 *  Otherwise:
+-	 *    - the printed output is not self consistent. E.g. it will print the result
+-	 *      on one device at a certain time, while printing the result for another
+-	 *      device at a later point in time.
+-	 *    - the order in which we print the AP list per-device, is unstable. */
+-	if (needs_rescan) {
+-		data = g_slice_new0 (WifiListData);
+-		data->nmc = nmc;
+-		data->wifi = g_object_ref (wifi);
+-		data->tmpl = tmpl;
+-		data->out_indices = g_array_ref (out_indices);;
+-		data->bssid_user = bssid_user;
+-		data->last_scan_id = g_signal_connect (wifi, "notify::" NM_DEVICE_WIFI_LAST_SCAN,
+-		                                       G_CALLBACK (wifi_last_scan_updated), data);
+-		data->scan_cancellable = g_cancellable_new ();
+-		data->timeout_id = g_timeout_add_seconds (15, wifi_list_scan_timeout, data);
+-		nm_device_wifi_request_scan_async (wifi, data->scan_cancellable, wifi_list_rescan_cb, data);
+-
+-		nmc->should_wait++;
+-	} else {
+-		wifi_print_aps (wifi, nmc, out_indices, tmpl, bssid_user);
+-	}
+-}
+-
+ static void
+ complete_aps (NMDevice **devices, const char *ifname,
+               const char *bssid_prefix, const char *ssid_prefix)
+@@ -3017,12 +2990,15 @@ do_device_wifi_list (NmCli *nmc, int argc, char **argv)
+ 	const char *bssid_user = NULL;
+ 	const char *rescan = NULL;
+ 	gs_free NMDevice **devices = NULL;
+-	guint i;
+ 	const char *fields_str = NULL;
+ 	const NMMetaAbstractInfo *const*tmpl;
+ 	gs_unref_array GArray *out_indices = NULL;
+ 	int option;
+ 	guint64 rescan_cutoff;
++	NMDeviceWifi *wifi;
++	ScanInfo *scan_info = NULL;
++	WifiListData *data;
++	guint i, j;
+ 
+ 	devices = nmc_get_devices_sorted (nmc->client);
+ 
+@@ -3110,7 +3086,8 @@ do_device_wifi_list (NmCli *nmc, int argc, char **argv)
+ 		}
+ 
+ 		if (NM_IS_DEVICE_WIFI (device)) {
+-			wifi_list_aps (NM_DEVICE_WIFI (device), nmc, out_indices, tmpl, bssid_user, rescan_cutoff);
++			devices[0] = device;
++			devices[1] = NULL;
+ 		} else {
+ 			if (   nm_device_get_device_type (device) == NM_DEVICE_TYPE_GENERIC
+ 			    && g_strcmp0 (nm_device_get_type_description (device), "wifi") == 0) {
+@@ -3124,13 +3101,52 @@ do_device_wifi_list (NmCli *nmc, int argc, char **argv)
+ 			}
+ 			return NMC_RESULT_ERROR_UNKNOWN;
+ 		}
++	}
++
++	/* Filter out non-wifi devices */
++	for (i = 0, j = 0; devices[i]; i++) {
++		if (NM_IS_DEVICE_WIFI (devices[i]))
++			devices[j++] = devices[i];
++	}
++	devices[j] = NULL;
++
++	/* Start a new scan for devices that need it */
++	for (i = 0; devices[i]; i++) {
++		wifi = (NMDeviceWifi *) devices[i];
++		g_object_ref (wifi);
++
++		if (   rescan_cutoff == 0
++		    || (rescan_cutoff > 0 && nm_device_wifi_get_last_scan (wifi) >= rescan_cutoff))
++			continue;
++
++		if (!scan_info) {
++			scan_info = g_new0 (ScanInfo, 1);
++			scan_info->out_indices = g_array_ref (out_indices);
++			scan_info->tmpl = tmpl;
++			scan_info->bssid_user = bssid_user;
++			scan_info->nmc = nmc;
++		}
++
++		nmc->should_wait++;
++		data = g_slice_new0 (WifiListData);
++		data->wifi = wifi;
++		data->scan_info = scan_info;
++		data->last_scan_id = g_signal_connect (wifi, "notify::" NM_DEVICE_WIFI_LAST_SCAN,
++		                                       G_CALLBACK (wifi_last_scan_updated), data);
++		data->scan_cancellable = g_cancellable_new ();
++		data->timeout_id = g_timeout_add_seconds (15, wifi_list_scan_timeout, data);
++		nm_device_wifi_request_scan_async (wifi, data->scan_cancellable, wifi_list_rescan_cb, data);
++	}
++
++	if (scan_info) {
++		scan_info->devices = g_steal_pointer (&devices);
+ 	} else {
++		/* Print results right away if no scan is pending */
+ 		for (i = 0; devices[i]; i++) {
+-			NMDevice *dev = devices[i];
+-
+-			if (NM_IS_DEVICE_WIFI (dev)) {
+-				wifi_list_aps (NM_DEVICE_WIFI (dev), nmc, out_indices, tmpl, bssid_user, rescan_cutoff);
+-			}
++			wifi_print_aps (NM_DEVICE_WIFI (devices[i]),
++			                nmc, out_indices,
++			                tmpl, bssid_user);
++			g_object_unref (devices[i]);
+ 		}
+ 	}
+ 
diff --git a/debian/patches/dhcp6-fix-buffer-size-checking.patch b/debian/patches/dhcp6-fix-buffer-size-checking.patch
new file mode 100644
index 00000000..921573b8
--- /dev/null
+++ b/debian/patches/dhcp6-fix-buffer-size-checking.patch
@@ -0,0 +1,25 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Thu, 27 Sep 2018 23:48:51 +0900
+Subject: dhcp6: fix buffer size checking
+
+(cherry picked from commit cb1bdeaf56852275e6b0dd1fba932bb174767f70)
+(cherry picked from commit 91fb1673d5217aaf1461998fd2675630f5c265f9)
+---
+ src/systemd/src/libsystemd-network/sd-dhcp6-client.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+index 8444a75..0b261a2 100644
+--- a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
++++ b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+@@ -818,8 +818,8 @@ static int client_parse_message(
+                 uint8_t *optval;
+                 be32_t iaid_lease;
+ 
+-                if (len < offsetof(DHCP6Option, data) ||
+-                    len < offsetof(DHCP6Option, data) + be16toh(option->len))
++                if (len < pos + offsetof(DHCP6Option, data) ||
++                    len < pos + offsetof(DHCP6Option, data) + be16toh(option->len))
+                         return -ENOBUFS;
+ 
+                 optcode = be16toh(option->code);
diff --git a/debian/patches/dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch b/debian/patches/dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch
new file mode 100644
index 00000000..3c5c4051
--- /dev/null
+++ b/debian/patches/dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch
@@ -0,0 +1,31 @@
+From: Lennart Poettering <lennart@poettering.net>
+Date: Fri, 19 Oct 2018 12:12:33 +0200
+Subject: dhcp6: make sure we have enough space for the DHCP6 option header
+
+Fixes a vulnerability originally discovered by Felix Wilhelm from
+Google.
+
+CVE-2018-15688
+LP: #1795921
+https://bugzilla.redhat.com/show_bug.cgi?id=1639067
+
+(cherry picked from commit 4dac5eaba4e419b29c97da38a8b1f82336c2c892)
+(cherry picked from commit 01ca2053bbea09f35b958c8cc7631e15469acb79)
+(cherry picked from commit fc230dca139142f409d7bac99dbfabe9b004e2fb)
+---
+ src/systemd/src/libsystemd-network/dhcp6-option.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c
+index be5c222..2297044 100644
+--- a/src/systemd/src/libsystemd-network/dhcp6-option.c
++++ b/src/systemd/src/libsystemd-network/dhcp6-option.c
+@@ -105,7 +105,7 @@ int dhcp6_option_append_ia(uint8_t **buf, size_t *buflen, DHCP6IA *ia) {
+                 return -EINVAL;
+         }
+ 
+-        if (*buflen < len)
++        if (*buflen < offsetof(DHCP6Option, data) + len)
+                 return -ENOBUFS;
+ 
+         ia_hdr = *buf;
diff --git a/debian/patches/sd-dhcp-lease-fix-memleaks.patch b/debian/patches/sd-dhcp-lease-fix-memleaks.patch
new file mode 100644
index 00000000..4866a6f6
--- /dev/null
+++ b/debian/patches/sd-dhcp-lease-fix-memleaks.patch
@@ -0,0 +1,23 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Thu, 27 Sep 2018 18:04:59 +0900
+Subject: sd-dhcp-lease: fix memleaks
+
+(cherry picked from commit e2975f854831d08a25b4f5eb329b6d04102e115f)
+(cherry picked from commit 157094abd83f933fad142758a7d177cfa1a347f7)
+---
+ src/systemd/src/libsystemd-network/sd-dhcp-lease.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-lease.c b/src/systemd/src/libsystemd-network/sd-dhcp-lease.c
+index d240259..cac07d3 100644
+--- a/src/systemd/src/libsystemd-network/sd-dhcp-lease.c
++++ b/src/systemd/src/libsystemd-network/sd-dhcp-lease.c
+@@ -279,6 +279,8 @@ sd_dhcp_lease *sd_dhcp_lease_unref(sd_dhcp_lease *lease) {
+                 free(option);
+         }
+ 
++        free(lease->root_path);
++        free(lease->timezone);
+         free(lease->hostname);
+         free(lease->domainname);
+         free(lease->dns);
diff --git a/debian/patches/sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch b/debian/patches/sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch
new file mode 100644
index 00000000..f49c9476
--- /dev/null
+++ b/debian/patches/sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch
@@ -0,0 +1,24 @@
+From: Li Song <song.li@honeywell.com>
+Date: Fri, 19 Oct 2018 13:41:51 -0400
+Subject: sd-dhcp: remove unreachable route after rebinding return NAK
+
+(cherry picked from commit cc3981b1272b9ce37e7d734a7b2f42e84acac535)
+(cherry picked from commit 915c2f675a23b2ae16d292d1ac570706f76b384d)
+(cherry picked from commit cb77290a696dce924e2a993690634986ac035490)
+---
+ src/systemd/src/libsystemd-network/sd-dhcp-client.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/systemd/src/libsystemd-network/sd-dhcp-client.c b/src/systemd/src/libsystemd-network/sd-dhcp-client.c
+index 42707f1..9158945 100644
+--- a/src/systemd/src/libsystemd-network/sd-dhcp-client.c
++++ b/src/systemd/src/libsystemd-network/sd-dhcp-client.c
+@@ -1688,6 +1688,8 @@ static int client_handle_message(sd_dhcp_client *client, DHCPMessage *message, i
+                         client->timeout_resend =
+                                 sd_event_source_unref(client->timeout_resend);
+ 
++                        client_notify(client, SD_DHCP_CLIENT_EVENT_EXPIRED);
++
+                         r = client_initialize(client);
+                         if (r < 0)
+                                 goto error;
diff --git a/debian/patches/sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch b/debian/patches/sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch
new file mode 100644
index 00000000..c04a95a9
--- /dev/null
+++ b/debian/patches/sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch
@@ -0,0 +1,60 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Fri, 19 Oct 2018 03:44:56 +0900
+Subject: sd-dhcp6: fix argument and error handling of
+ dhcp6_option_parse_status()
+
+(cherry picked from commit 91c43f3978fa7c8341550b9ca279e460ba7e74e6)
+(cherry picked from commit 373cbfc8c6e9591b3c8cc12d58c4b31ac35ab24f)
+(cherry picked from commit 0e93fd895daa6f0f578ffa8fc4ed3e0ea85c62e8)
+---
+ src/systemd/src/libsystemd-network/dhcp6-option.c    | 10 ++++++----
+ src/systemd/src/libsystemd-network/sd-dhcp6-client.c |  9 +++++----
+ 2 files changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c
+index ff1cbf1..cfddefc 100644
+--- a/src/systemd/src/libsystemd-network/dhcp6-option.c
++++ b/src/systemd/src/libsystemd-network/dhcp6-option.c
+@@ -465,13 +465,15 @@ int dhcp6_option_parse_ia(DHCP6Option *iaoption, DHCP6IA *ia) {
+ 
+                 case SD_DHCP6_OPTION_STATUS_CODE:
+ 
+-                        status = dhcp6_option_parse_status(option, optlen);
+-                        if (status) {
++                        status = dhcp6_option_parse_status(option, optlen + sizeof(DHCP6Option));
++                        if (status < 0) {
++                                r = status;
++                                goto error;
++                        }
++                        if (status > 0) {
+                                 log_dhcp6_client(client, "IA status %d",
+                                                  status);
+ 
+-                                dhcp6_lease_free_ia(ia);
+-
+                                 r = -EINVAL;
+                                 goto error;
+                         }
+diff --git a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+index 0b261a2..b694786 100644
+--- a/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
++++ b/src/systemd/src/libsystemd-network/sd-dhcp6-client.c
+@@ -870,13 +870,14 @@ static int client_parse_message(
+                         break;
+ 
+                 case SD_DHCP6_OPTION_STATUS_CODE:
+-                        status = dhcp6_option_parse_status(option, optlen);
+-                        if (status) {
++                        status = dhcp6_option_parse_status(option, optlen + sizeof(DHCP6Option));
++                        if (status < 0)
++                                return status;
++
++                        if (status > 0) {
+                                 log_dhcp6_client(client, "%s Status %s",
+                                                  dhcp6_message_type_to_string(message->type),
+                                                  dhcp6_message_status_to_string(status));
+-                                dhcp6_lease_free_ia(&lease->ia);
+-                                dhcp6_lease_free_ia(&lease->pd);
+ 
+                                 return -EINVAL;
+                         }
diff --git a/debian/patches/sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch b/debian/patches/sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch
new file mode 100644
index 00000000..f8144605
--- /dev/null
+++ b/debian/patches/sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch
@@ -0,0 +1,111 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Fri, 19 Oct 2018 03:42:10 +0900
+Subject: sd-dhcp6: make dhcp6_option_parse_domainname() not store empty
+ domain
+
+This improves performance of fuzzer.
+C.f. oss-fuzz#11019.
+
+(cherry picked from commit 3c72b6ed4252e7ff5f7704bfe44557ec197b47fa)
+(cherry picked from commit 50403cccee28c7dcd54b138a0d3b3f69ea0204fe)
+(cherry picked from commit f11f5abb1a8b96b553d2d156f8b5cf440695c04d)
+---
+ src/systemd/src/libsystemd-network/dhcp6-option.c | 66 ++++++++++-------------
+ 1 file changed, 29 insertions(+), 37 deletions(-)
+
+diff --git a/src/systemd/src/libsystemd-network/dhcp6-option.c b/src/systemd/src/libsystemd-network/dhcp6-option.c
+index cfddefc..be5c222 100644
+--- a/src/systemd/src/libsystemd-network/dhcp6-option.c
++++ b/src/systemd/src/libsystemd-network/dhcp6-option.c
+@@ -555,6 +555,7 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char *
+                 bool first = true;
+ 
+                 for (;;) {
++                        const char *label;
+                         uint8_t c;
+ 
+                         c = optval[pos++];
+@@ -562,47 +563,41 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char *
+                         if (c == 0)
+                                 /* End of name */
+                                 break;
+-                        else if (c <= 63) {
+-                                const char *label;
+-
+-                                /* Literal label */
+-                                label = (const char *)&optval[pos];
+-                                pos += c;
+-                                if (pos >= optlen)
+-                                        return -EMSGSIZE;
+-
+-                                if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX)) {
+-                                        r = -ENOMEM;
+-                                        goto fail;
+-                                }
+-
+-                                if (first)
+-                                        first = false;
+-                                else
+-                                        ret[n++] = '.';
+-
+-                                r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX);
+-                                if (r < 0)
+-                                        goto fail;
+-
+-                                n += r;
+-                                continue;
+-                        } else {
+-                                r = -EBADMSG;
+-                                goto fail;
+-                        }
+-                }
++                        if (c > 63)
++                                return -EBADMSG;
++
++                        /* Literal label */
++                        label = (const char *)&optval[pos];
++                        pos += c;
++                        if (pos >= optlen)
++                                return -EMSGSIZE;
++
++                        if (!GREEDY_REALLOC(ret, allocated, n + !first + DNS_LABEL_ESCAPED_MAX))
++                                return -ENOMEM;
++
++                        if (first)
++                                first = false;
++                        else
++                                ret[n++] = '.';
++
++                        r = dns_label_escape(label, c, ret + n, DNS_LABEL_ESCAPED_MAX);
++                        if (r < 0)
++                                return r;
+ 
+-                if (!GREEDY_REALLOC(ret, allocated, n + 1)) {
+-                        r = -ENOMEM;
+-                        goto fail;
++                        n += r;
+                 }
+ 
++                if (n == 0)
++                        continue;
++
++                if (!GREEDY_REALLOC(ret, allocated, n + 1))
++                        return -ENOMEM;
++
+                 ret[n] = 0;
+ 
+                 r = strv_extend(&names, ret);
+                 if (r < 0)
+-                        goto fail;
++                        return r;
+ 
+                 idx++;
+         }
+@@ -610,7 +605,4 @@ int dhcp6_option_parse_domainname(const uint8_t *optval, uint16_t optlen, char *
+         *str_arr = TAKE_PTR(names);
+ 
+         return idx;
+-
+-fail:
+-        return r;
+ }
diff --git a/debian/patches/series b/debian/patches/series
index 85b43c21..05ef7082 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1,12 +1,18 @@
 Force-online-state-with-unmanaged-devices.patch
 Don-t-setup-Sleep-Monitor-if-not-booted-with-systemd.patch
 Don-t-make-NetworkManager-D-Bus-activatable.patch
-Fix-iscsiadm-path.patch
+sd-dhcp-lease-fix-memleaks.patch
+dhcp6-fix-buffer-size-checking.patch
+sd-dhcp6-fix-argument-and-error-handling-of-dhcp6_option_.patch
+sd-dhcp6-make-dhcp6_option_parse_domainname-not-store-emp.patch
+sd-dhcp-remove-unreachable-route-after-rebinding-return-N.patch
+dhcp6-make-sure-we-have-enough-space-for-the-DHCP6-option.patch
+cli-wait-for-all-wifi-scans-to-finish-before-displaying-t.patch
+cli-fix-memory-leaks.patch
+cli-tests-fix-output-on-failure.patch
+tests-simulate-old-LastScan-wifi-value-in-test-networkman.patch
+# Ubuntu patches
 Provide-access-to-some-of-NM-s-interfaces-to-whoopsie.patch
 Update-dnsmasq-parameters.patch
 Disable-general-with-expect.patch
 libnm-Check-self-still-NMManager-or-not.patch
-#dns-manager-don-t-merge-split-DNS-search-domains.patch
-Read-system-connections-from-run.patch
-Import-some-missing-WoWLAN-patches.patch
-git-mac-change.patch
diff --git a/debian/patches/tests-simulate-old-LastScan-wifi-value-in-test-networkman.patch b/debian/patches/tests-simulate-old-LastScan-wifi-value-in-test-networkman.patch
new file mode 100644
index 00000000..31ec7ee6
--- /dev/null
+++ b/debian/patches/tests-simulate-old-LastScan-wifi-value-in-test-networkman.patch
@@ -0,0 +1,37 @@
+From: Beniamino Galvani <bgalvani@redhat.com>
+Date: Fri, 2 Nov 2018 13:49:25 +0100
+Subject: tests: simulate old LastScan wifi value in
+ test-networkmanager-service.py
+
+In this way clients will randomly find that the AP list is older than
+30 seconds and they will issue a new scan.
+
+(cherry picked from commit 5ba301f4eb652a208a500a39d59dadf427a64590)
+(cherry picked from commit 9b0735f6fd9d69b486d54a7ed99b595c111e54f7)
+---
+ tools/test-networkmanager-service.py | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/tools/test-networkmanager-service.py b/tools/test-networkmanager-service.py
+index 8a37fb1..9aa44a9 100755
+--- a/tools/test-networkmanager-service.py
++++ b/tools/test-networkmanager-service.py
+@@ -916,16 +916,8 @@ class WifiDevice(Device):
+         self.aps = []
+         self.scan_cb_id = None
+ 
+-        # Note: we would like to simulate how nmcli calls RequestScan() and we could
+-        # do so by using an older timestamp. However, that makes the client tests
+-        # racy, because if a bunch of nmcli instances run in parallel against this
+-        # service, earlier instances will issue a RequestScan(), while later instances
+-        # won't do that (because the LastScan timestamp is already updated). That means,
+-        # the later instances will print the scan result immediately, and in another sort
+-        # order. That should be fixed, by nmcli not starting to print anything, before
+-        # all RequestScan() requests complete, and thus, always print a consistent list
+-        # of results.
+-        ts = NM.utils_get_timestamp_msec()
++        # Use a randomly older timestamp to trigger RequestScan() from the client
++        ts = max(0, NM.utils_get_timestamp_msec() - Util.random_int(self.path, 20000, 40000))
+ 
+         props = {
+             PRP_WIFI_HW_ADDRESS:            mac,
diff --git a/debian/rules b/debian/rules
index bc6331c6..7c066f7c 100755
--- a/debian/rules
+++ b/debian/rules
@@ -28,6 +28,7 @@ override_dh_auto_configure:
 		--with-dnssec-trigger=/usr/lib/dnssec-trigger/dnssec-trigger-script \
 		--with-systemdsystemunitdir=/lib/systemd/system \
 		--with-udev-dir=/lib/udev \
+		--with-dbus-sys-dir=/usr/share/dbus-1/system.d \
 		--with-crypto=gnutls \
 		--with-session-tracking=systemd \
 		--with-suspend-resume=systemd \
@@ -44,7 +45,6 @@ override_dh_auto_configure:
 		--enable-polkit-agent \
 		--enable-ppp \
 		--enable-ifupdown \
-		--enable-config-plugin-ibft \
 		--enable-introspection \
 		--enable-gtk-doc \
 		--enable-concheck \
@@ -52,6 +52,7 @@ override_dh_auto_configure:
 		--enable-json-validation \
 		--enable-bluez5-dun \
 		--enable-vala \
+		--disable-config-plugin-ibft \
 		--disable-more-warnings \
 		--disable-modify-system \
 		--disable-ovs
@@ -74,13 +75,9 @@ override_dh_installinit:
 override_dh_makeshlibs:
 	dh_makeshlibs -X/usr/lib/$(DEB_HOST_MULTIARCH)/NetworkManager/ -X/usr/lib/pppd/
 
-override_dh_systemd_start:
-	dh_link -pnetwork-manager \
-		lib/systemd/system/NetworkManager.service \
-		lib/systemd/system/network-manager.service
-	dh_systemd_start -pnetwork-manager --no-start NetworkManager-dispatcher.service
-	dh_systemd_start -pnetwork-manager --no-start NetworkManager-wait-online.service
-	dh_systemd_start -pnetwork-manager --restart-after-upgrade NetworkManager.service
+override_dh_installsystemd:
+	dh_installsystemd -pnetwork-manager --no-start NetworkManager-dispatcher.service NetworkManager-wait-online.service
+	dh_installsystemd -pnetwork-manager --no-also NetworkManager.service
 
 override_dh_ppp:
 	dh_ppp --breaks