Merge ~enr0n/ubuntu/+source/systemd:ubuntu-jammy-sru into ~ubuntu-core-dev/ubuntu/+source/systemd:ubuntu-jammy

[Nick Rosbrook]

Built in this PPA: https://launchpad.net/~enr0n/+archive/ubuntu/systemd-249/+packages?field.name_filter=&field.status_filter=published&field.series_filter=jammy.

autopkgtest results:

systemd 249.11-0ubuntu3.7~ppa10 (amd64) -- Fail: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-enr0n-systemd-249/jammy/amd64/s/systemd/20230302_134642_e44e5@/log.gz
systemd 249.11-0ubuntu3.7~ppa10 (arm64) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-enr0n-systemd-249/jammy/arm64/s/systemd/20230302_035632_08b52@/log.gz
systemd 249.11-0ubuntu3.7~ppa11 (armhf) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-enr0n-systemd-249/jammy/armhf/s/systemd/20230302_174243_705d5@/log.gz
systemd 249.11-0ubuntu3.7~ppa10 (s390x) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-enr0n-systemd-249/jammy/s390x/s/systemd/20230301_220055_2f4d9@/log.gz
systemd 249.11-0ubuntu3.7~ppa10 (ppc64el) -- Pass: https://autopkgtest.ubuntu.com/results/autopkgtest-jammy-enr0n-systemd-249/jammy/ppc64el/s/systemd/20230301_222715_2f4d9@/log.gz

The amd64 failure is in the upstream tests, which can be flaky (the amd64 tests passed for me locally).

434480a... by Nick Rosbrook on 2023-03-06

Enable /dev/sgx_vepc access for the group 'sgx' (LP: #2009502)

2d20df8... by Nick Rosbrook on 2023-03-06

Update changelog

9e36277... by Nick Rosbrook on 2023-03-06

Release systemd 249.11-0ubuntu3.7

[Lukas Märdian (slyon)]

Thank you for providing a test build and autopkgtest results and for confirming that the amd64 test passes for you locally.

This LGTM (thanks for making use of the "Gbp-Pq: Topic ..." header)!

Are the fixes/SRU for bug #2004478 & bug #2002445 for Kinetic and/or Lunar already in the pipeline? Those will block this SRU migrating to jammy-updates, but I think we can still go ahead and get it into -proposed for verification already. Generally, I feel it is the better approach to do SRUs from newer to older (Lunar -> ... -> Focal), but I know in this case we had some urgency to get the Focal SRU out and tested, so we'll work around this situation a bit.

I've rebased your work on the (very) recent security update "249.11-0ubuntu3.7" and picked the next free revision for your upload: "249.11-0ubuntu3.8".

review: Approve

[Lukas Märdian (slyon)]

https://launchpad.net/ubuntu/jammy/+queue?queue_state=1&queue_text=systemd

[Nick Rosbrook (enr0n)]

Thanks, Lukas!

In this case it was more convenient for patching and testing to go older->newer. I did not necessarily require that things be uploaded in that order, but it is convenient since Focal is the most urgent, and the releases are being prepped already.

diff --git a/debian/changelog b/debian/changelog
index 4ef5f38..7c17eb9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,25 @@
+systemd (249.11-0ubuntu3.7) jammy; urgency=medium
+
+  * network/dhcp4: accept local subnet routes from DHCP (LP: #2004478)
+    File: debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=96928d5f45ebbfe682b47e842d63506fa0ac9583
+  * udev: avoid NIC renaming race with kernel (LP: #2002445)
+    Files:
+    - debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
+    - debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
+    - debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
+    - debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
+    - debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=20dc4d51a340669c26c446c23b5a84516e82ea74
+  * network: create stacked netdevs after the underlying link is (LP: #2000880)
+    File: debian/patches/lp2000880-network-create-stacked-netdevs-after-the-underlying-link-.patch
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=ab620e709f3f62eda86af26fd66c00d6e5165a25
+  * Enable /dev/sgx_vepc access for the group 'sgx' (LP: #2009502)
+    File: debian/patches/lp2009502-Enable-dev-sgx_vepc-access-for-the-group-sgx.patch
+    https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/systemd/commit/?id=434480ae4059a16ccbde9613be0c26ff1983cc3a
+
+ -- Nick Rosbrook <[e-mail]>  Mon, 06 Mar 2023 14:51:06 -0500
+
 systemd (249.11-0ubuntu3.6) jammy; urgency=medium
 
   * Deny-list TEST-58-REPART on ppc64el (LP: #1988994)
diff --git a/debian/patches/lp2000880-network-create-stacked-netdevs-after-the-underlying-link-.patch b/debian/patches/lp2000880-network-create-stacked-netdevs-after-the-underlying-link-.patch
new file mode 100644
index 0000000..7ff29a1
--- /dev/null
+++ b/debian/patches/lp2000880-network-create-stacked-netdevs-after-the-underlying-link-.patch
@@ -0,0 +1,33 @@
+From: Yu Watanabe <[e-mail]>
+Date: Thu, 24 Feb 2022 08:20:44 +0900
+Subject: network: create stacked netdevs after the underlying link is
+ activated
+
+Origin: upstream, https://github.com/systemd/systemd-stable/commit/e74e1dc8cc339ee7bd6bc5c5a329f75ac5cf4821
+Bug-Ubuntu: https://launchpad.net/bugs/2000880
+
+Otherwise, the activation policy for the netdevs are ignored.
+
+Fixes #22593.
+
+(cherry picked from commit 047b9991a4d0d93d0dfe3d144410c619a8b74699)
+---
+ src/network/netdev/netdev.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/network/netdev/netdev.c b/src/network/netdev/netdev.c
+index 53534d4..2698e36 100644
+--- a/src/network/netdev/netdev.c
++++ b/src/network/netdev/netdev.c
+@@ -557,6 +557,11 @@ static bool netdev_is_ready_to_create(NetDev *netdev, Link *link) {
+         if (ordered_set_contains(link->manager->request_queue, &req))
+                 return false;
+ 
++        /* If stacked netdevs are created before the underlying interface being activated, then
++         * the activation policy for the netdevs are ignored. See issue #22593. */
++        if (!link->activated)
++                return false;
++
+         return true;
+ }
+ 
diff --git a/debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch b/debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
new file mode 100644
index 0000000..d8db683
--- /dev/null
+++ b/debian/patches/lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
@@ -0,0 +1,81 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Tue, 22 Nov 2022 17:01:47 -0500
+Subject: sd-netlink: add a test for rtnl_set_link_name()
+
+Origin: upstream, https://github.com/systemd/systemd/commit/b338a8bb40
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+Add a test that verifies a deleted alternative name is restored on error
+in rtnl_set_link_name().
+
+(modified to apply to v249.11)
+---
+ src/libsystemd/sd-netlink/test-netlink.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+diff --git a/src/libsystemd/sd-netlink/test-netlink.c b/src/libsystemd/sd-netlink/test-netlink.c
+index 41a7280..6ee7f2d 100644
+--- a/src/libsystemd/sd-netlink/test-netlink.c
++++ b/src/libsystemd/sd-netlink/test-netlink.c
+@@ -3,17 +3,20 @@
+ #include <net/if.h>
+ #include <netinet/ether.h>
+ #include <linux/genetlink.h>
++#include <unistd.h>
+ 
+ #include "sd-netlink.h"
+ 
+ #include "alloc-util.h"
+ #include "ether-addr-util.h"
+ #include "macro.h"
++#include "netlink-internal.h"
+ #include "netlink-util.h"
+ #include "socket-util.h"
+ #include "stdio-util.h"
+ #include "string-util.h"
+ #include "strv.h"
++#include "tests.h"
+ #include "util.h"
+ 
+ static void test_message_link_bridge(sd_netlink *rtnl) {
+@@ -547,6 +550,32 @@ static void test_strv(sd_netlink *rtnl) {
+         assert_se(sd_netlink_message_exit_container(m) >= 0);
+ }
+ 
++static void test_rtnl_set_link_name(sd_netlink *rtnl, int ifindex) {
++        _cleanup_strv_free_ char **alternative_names = NULL;
++        int r;
++
++        log_debug("/* %s */", __func__);
++
++        if (geteuid() != 0)
++                return (void) log_tests_skipped("not root");
++
++        /* Test that the new name (which is currently an alternative name) is
++         * restored as an alternative name on error. Create an error by using
++         * an invalid device name, namely one that exceeds IFNAMSIZ
++         * (alternative names can exceed IFNAMSIZ, but not regular names). */
++        r = rtnl_set_link_alternative_names(&rtnl, ifindex, STRV_MAKE("testlongalternativename"));
++        if (r == -EPERM)
++                return (void) log_tests_skipped("missing required capabilities");
++        if (r == -EOPNOTSUPP)
++                return (void) log_tests_skipped("alternative name is not supported");
++
++        assert_se(r >= 0);
++        assert_se(rtnl_set_link_name(&rtnl, ifindex, "testlongalternativename") == -EINVAL);
++        assert_se(rtnl_get_link_alternative_names(&rtnl, ifindex, &alternative_names) >= 0);
++        assert_se(strv_contains(alternative_names, "testlongalternativename"));
++        assert_se(rtnl_delete_link_alternative_names(&rtnl, ifindex, STRV_MAKE("testlongalternativename")) >= 0);
++}
++
+ int main(void) {
+         sd_netlink *rtnl;
+         sd_netlink_message *m;
+@@ -576,6 +605,7 @@ int main(void) {
+         test_pipe(if_loopback);
+         test_event_loop(if_loopback);
+         test_link_configure(rtnl, if_loopback);
++        test_rtnl_set_link_name(rtnl, if_loopback);
+ 
+         test_get_addresses(rtnl);
+         test_message_link_bridge(rtnl);
diff --git a/debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch b/debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
new file mode 100644
index 0000000..83ba680
--- /dev/null
+++ b/debian/patches/lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
@@ -0,0 +1,54 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Fri, 2 Dec 2022 15:26:18 -0500
+Subject: sd-netlink: do not swap old name and alternative name
+
+Origin: upstream, https://github.com/systemd/systemd/commit/080afbb57c
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+Commit 434a348380 ("netlink: do not fail when new interface name is
+already used as an alternative name") added logic to set the old
+interface name as an alternative name, but only when the new name is
+currently an alternative name. This is not the desired outcome in most
+cases, and the important part of this commit was to delete the new name
+from the list of alternative names if necessary.
+
+(modified to apply to v249.11)
+---
+ src/libsystemd/sd-netlink/netlink-util.c | 10 ----------
+ 1 file changed, 10 deletions(-)
+
+diff --git a/src/libsystemd/sd-netlink/netlink-util.c b/src/libsystemd/sd-netlink/netlink-util.c
+index 1211145..14eb2e9 100644
+--- a/src/libsystemd/sd-netlink/netlink-util.c
++++ b/src/libsystemd/sd-netlink/netlink-util.c
+@@ -12,7 +12,6 @@
+ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL;
+         _cleanup_strv_free_ char **alternative_names = NULL;
+-        char old_name[IF_NAMESIZE + 1] = {};
+         int r;
+ 
+         assert(rtnl);
+@@ -32,8 +31,6 @@ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+                 if (r < 0)
+                         return log_debug_errno(r, "Failed to remove '%s' from alternative names on network interface %i: %m",
+                                                name, ifindex);
+-
+-                format_ifname(ifindex, old_name);
+         }
+ 
+         r = sd_rtnl_message_new_link(*rtnl, &message, RTM_SETLINK, ifindex);
+@@ -48,13 +45,6 @@ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+         if (r < 0)
+                 return r;
+ 
+-        if (!isempty(old_name)) {
+-                r = rtnl_set_link_alternative_names(rtnl, ifindex, STRV_MAKE(old_name));
+-                if (r < 0)
+-                        log_debug_errno(r, "Failed to set '%s' as an alternative name on network interface %i, ignoring: %m",
+-                                        old_name, ifindex);
+-        }
+-
+         return 0;
+ }
+ 
diff --git a/debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch b/debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
new file mode 100644
index 0000000..1619e97
--- /dev/null
+++ b/debian/patches/lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
@@ -0,0 +1,64 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Wed, 2 Nov 2022 05:36:14 -0400
+Subject: sd-netlink: restore altname on error in rtnl_set_link_name
+
+Origin: upstream, https://github.com/systemd/systemd/commit/4d600667f8
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+If a current alternative name is to be used to rename a network
+interface, the alternative name must be removed first. If interface
+renaming fails, restore the alternative name that was deleted if
+necessary.
+---
+ src/libsystemd/sd-netlink/netlink-util.c | 19 ++++++++++++++++---
+ 1 file changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/src/libsystemd/sd-netlink/netlink-util.c b/src/libsystemd/sd-netlink/netlink-util.c
+index 88128d9..8a4c14c 100644
+--- a/src/libsystemd/sd-netlink/netlink-util.c
++++ b/src/libsystemd/sd-netlink/netlink-util.c
+@@ -11,6 +11,7 @@
+ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+         _cleanup_(sd_netlink_message_unrefp) sd_netlink_message *message = NULL;
+         _cleanup_strv_free_ char **alternative_names = NULL;
++        bool altname_deleted = false;
+         int r;
+ 
+         assert(rtnl);
+@@ -30,21 +31,33 @@ int rtnl_set_link_name(sd_netlink **rtnl, int ifindex, const char *name) {
+                 if (r < 0)
+                         return log_debug_errno(r, "Failed to remove '%s' from alternative names on network interface %i: %m",
+                                                name, ifindex);
++
++                altname_deleted = true;
+         }
+ 
+         r = sd_rtnl_message_new_link(*rtnl, &message, RTM_SETLINK, ifindex);
+         if (r < 0)
+-                return r;
++                goto fail;
+ 
+         r = sd_netlink_message_append_string(message, IFLA_IFNAME, name);
+         if (r < 0)
+-                return r;
++                goto fail;
+ 
+         r = sd_netlink_call(*rtnl, message, 0, NULL);
+         if (r < 0)
+-                return r;
++                goto fail;
+ 
+         return 0;
++
++fail:
++        if (altname_deleted) {
++                int q = rtnl_set_link_alternative_names(rtnl, ifindex, STRV_MAKE(name));
++                if (q < 0)
++                        log_debug_errno(q, "Failed to restore '%s' as an alternative name on network interface %i, ignoring: %m",
++                                        name, ifindex);
++        }
++
++        return r;
+ }
+ 
+ int rtnl_set_link_properties(
diff --git a/debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch b/debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
new file mode 100644
index 0000000..4d007cd
--- /dev/null
+++ b/debian/patches/lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
@@ -0,0 +1,63 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Fri, 2 Dec 2022 15:35:25 -0500
+Subject: udev: attempt device rename even if interface is up
+
+Origin: upstream, https://github.com/systemd/systemd/commit/53584e7b61
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+Currently rename_netif() will not attempt to rename a device if it is
+already up, because the kernel will return -EBUSY unless live renaming
+is allowed on the device. This restriction will be removed in a future
+kernel version [1].
+
+To cover both cases, always attempt to rename the interface and return 0
+if we get -EBUSY.
+
+[1] https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=bd039b5ea2a9
+
+(modified to apply to v249.11)
+---
+ src/udev/udev-event.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+diff --git a/src/udev/udev-event.c b/src/udev/udev-event.c
+index 56fe0a4..84822d9 100644
+--- a/src/udev/udev-event.c
++++ b/src/udev/udev-event.c
+@@ -828,7 +828,6 @@ int udev_event_spawn(UdevEvent *event,
+ static int rename_netif(UdevEvent *event) {
+         sd_device *dev = event->dev;
+         const char *oldname;
+-        unsigned flags;
+         int ifindex, r;
+ 
+         if (!event->name)
+@@ -856,16 +855,6 @@ static int rename_netif(UdevEvent *event) {
+                 return 0;
+         }
+ 
+-        r = rtnl_get_link_info(&event->rtnl, ifindex, NULL, &flags);
+-        if (r < 0)
+-                return log_device_warning_errno(dev, r, "Failed to get link flags: %m");
+-
+-        if (FLAGS_SET(flags, IFF_UP)) {
+-                log_device_info(dev, "Network interface '%s' is already up, refusing to rename to '%s'.",
+-                                oldname, event->name);
+-                return 0;
+-        }
+-
+         /* Set ID_RENAMING boolean property here, and drop it in the corresponding move uevent later. */
+         r = device_add_property(dev, "ID_RENAMING", "1");
+         if (r < 0)
+@@ -887,6 +876,11 @@ static int rename_netif(UdevEvent *event) {
+                 return log_device_debug_errno(event->dev_db_clone, r, "Failed to update database under /run/udev/data/: %m");
+ 
+         r = rtnl_set_link_name(&event->rtnl, ifindex, event->name);
++        if (r == -EBUSY) {
++                log_device_info(dev, "Network interface '%s' is already up, cannot rename to '%s'.",
++                                oldname, event->name);
++                return 0;
++        }
+         if (r < 0)
+                 return log_device_error_errno(dev, r, "Failed to rename network interface %i from '%s' to '%s': %m",
+                                               ifindex, oldname, event->name);
diff --git a/debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch b/debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
new file mode 100644
index 0000000..2b00cd7
--- /dev/null
+++ b/debian/patches/lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
@@ -0,0 +1,36 @@
+From: Nick Rosbrook <[e-mail]>
+Date: Wed, 2 Nov 2022 11:05:01 -0400
+Subject: udev/net: allow new link name as an altname before renaming happens
+
+Origin: upstream, https://github.com/systemd/systemd/commit/d0b31efc1a
+Bug-Ubuntu: https://launchpad.net/bugs/2002445
+
+When configuring a link's alternative names, the link's new name to-be
+is not allowed to be included because interface renaming will fail if
+the new name is already present as an alternative name. However,
+rtnl_set_link_name will delete the conflicting alternative name before
+renaming the device, if necessary.
+
+Allow the new link name to be set as an alternative name before the
+device is renamed. This means that if the rename is later skipped (i.e.
+because the link is already up), then the name can at least still be
+present as an alternative name.
+
+(modified to apply to v249.11)
+---
+ src/udev/net/link-config.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/src/udev/net/link-config.c b/src/udev/net/link-config.c
+index 8dfe236..bb9bd37 100644
+--- a/src/udev/net/link-config.c
++++ b/src/udev/net/link-config.c
+@@ -578,8 +578,6 @@ static int link_config_apply_alternative_names(sd_netlink **rtnl, const LinkConf
+                         }
+                 }
+ 
+-        if (new_name)
+-                strv_remove(altnames, new_name);
+         strv_remove(altnames, current_name);
+ 
+         r = rtnl_get_link_alternative_names(rtnl, ifindex, &current_altnames);
diff --git a/debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch b/debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
new file mode 100644
index 0000000..344fdd7
--- /dev/null
+++ b/debian/patches/lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
@@ -0,0 +1,54 @@
+From: Tuetuopay <[e-mail]>
+Date: Fri, 27 Jan 2023 15:10:49 +0100
+Subject: network/dhcp4: accept local subnet routes from DHCP
+
+Origin: upstream, https://github.com/systemd/systemd/commit/1d84a3c7792a8910b05904937c703307ca19740f
+Bug-Ubuntu: https://launchpad.net/bugs/2004478
+
+RFC3442 specifies option 121 (Classless Static Routes) that allow a DHCP
+server to push arbitrary routes to a client. It has a Local Subnet
+Routes section expliciting the behavior of routes with a null (0.0.0.0)
+gateway.
+
+Such routes are to be installed on the interface with a Link scope, to
+mark them as directly available on the link without any gateway.
+
+Networkd currently drops those routes, which is against the RFC, as
+Linux has proper support for such routes.
+
+Fixes: 7f20627 ("network: dhcp4: ignore gateway in static routes if destination is link-local or in the same network")
+---
+ src/network/networkd-dhcp4.c | 19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+diff --git a/src/network/networkd-dhcp4.c b/src/network/networkd-dhcp4.c
+index f80adcd..9b06edc 100644
+--- a/src/network/networkd-dhcp4.c
++++ b/src/network/networkd-dhcp4.c
+@@ -349,15 +349,18 @@ static int dhcp4_request_route_auto(
+                 route->gw = IN_ADDR_NULL;
+                 route->prefsrc.in = address;
+ 
+-        } else {
+-                if (in4_addr_is_null(gw)) {
+-                        log_link_debug(link, "DHCP: requested route destination "IPV4_ADDRESS_FMT_STR"/%u is not in the assigned network "
+-                                       IPV4_ADDRESS_FMT_STR"/%u, but no gateway is specified, ignoring.",
+-                                       IPV4_ADDRESS_FMT_VAL(route->dst.in), route->dst_prefixlen,
+-                                       IPV4_ADDRESS_FMT_VAL(prefix), prefixlen);
+-                        return 0;
+-                }
++        } else if (in4_addr_is_null(gw)) {
++                log_link_debug(link, "DHCP: requested route destination "IPV4_ADDRESS_FMT_STR"/%u is not in the assigned network "
++                               IPV4_ADDRESS_FMT_STR"/%u, but no gateway is specified, using 'link' scope.",
++                               IPV4_ADDRESS_FMT_VAL(route->dst.in), route->dst_prefixlen,
++                               IPV4_ADDRESS_FMT_VAL(prefix), prefixlen);
++
++                route->scope = RT_SCOPE_LINK;
++                route->gw_family = AF_UNSPEC;
++                route->gw = IN_ADDR_NULL;
++                route->prefsrc.in = address;
+ 
++        } else {
+                 r = dhcp4_request_route_to_gateway(link, gw);
+                 if (r < 0)
+                         return r;
diff --git a/debian/patches/lp2009502-Enable-dev-sgx_vepc-access-for-the-group-sgx.patch b/debian/patches/lp2009502-Enable-dev-sgx_vepc-access-for-the-group-sgx.patch
new file mode 100644
index 0000000..2f5adf2
--- /dev/null
+++ b/debian/patches/lp2009502-Enable-dev-sgx_vepc-access-for-the-group-sgx.patch
@@ -0,0 +1,27 @@
+From: Jarkko Sakkinen <[e-mail]>
+Date: Sat, 11 Dec 2021 06:39:59 +0200
+Subject: Enable /dev/sgx_vepc access for the group 'sgx'
+
+Origin: upstream, https://github.com/systemd/systemd/commit/b5d3138f9177bbc3505f42ba073d08d4f90b4888
+Bug-Ubuntu: https://launchpad.net/bugs/2009502
+
+Enable /dev/sgx_vepc access for the group 'sgx', which allows KVM-backed VMs
+to host Intel Software Guard eXtension (SGX) enclaves. The upcoming QEMU
+6.2 uses /dev/sgx_vepc to reserve portions of Enclave Page Cache (EPC) for
+VMs. EPC is the reserved physical memory used for hosting enclaves.
+---
+ rules.d/50-udev-default.rules.in | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/rules.d/50-udev-default.rules.in b/rules.d/50-udev-default.rules.in
+index 18a3cf4..685b59a 100644
+--- a/rules.d/50-udev-default.rules.in
++++ b/rules.d/50-udev-default.rules.in
+@@ -40,6 +40,7 @@ SUBSYSTEM=="drm", KERNEL=="renderD*", GROUP="render", MODE="{{GROUP_RENDER_MODE}
+ SUBSYSTEM=="kfd", GROUP="render", MODE="{{GROUP_RENDER_MODE}}"
+ 
+ SUBSYSTEM=="misc", KERNEL=="sgx_enclave", GROUP="sgx", MODE="0660"
++SUBSYSTEM=="misc", KERNEL=="sgx_vepc", GROUP="sgx", MODE="0660"
+ 
+ # When using static_node= with non-default permissions, also update
+ # tmpfiles.d/static-nodes-permissions.conf.in to keep permissions synchronized.
diff --git a/debian/patches/series b/debian/patches/series
index 8bbe6c3..fb23adf 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -99,3 +99,11 @@ lp1988078-sd-hwdb-include-sys-stat.h-in-hwdb-internal.h.patch
 lp1988078-sd-hwdb-add-sd_hwdb_new_from_path.patch
 lp1988078-hwdb-implement-root-option-for-systemd-hwdb-query.patch
 lp1988994-Deny-list-TEST-58-REPART-on-ppc64el.patch
+lp2004478-network-dhcp4-accept-local-subnet-routes-from-DHCP.patch
+lp2002445/udev-net-allow-new-link-name-as-an-altname-before-renamin.patch
+lp2002445/sd-netlink-do-not-swap-old-name-and-alternative-name.patch
+lp2002445/sd-netlink-restore-altname-on-error-in-rtnl_set_link_name.patch
+lp2002445/udev-attempt-device-rename-even-if-interface-is-up.patch
+lp2002445/sd-netlink-add-a-test-for-rtnl_set_link_name.patch
+lp2000880-network-create-stacked-netdevs-after-the-underlying-link-.patch
+lp2009502-Enable-dev-sgx_vepc-access-for-the-group-sgx.patch