Merge ~rafaeldtinoco/ubuntu/+source/open-iscsi:lp1891374-groovy into ~rafaeldtinoco/ubuntu/+source/open-iscsi:lp1891374-debian_sid

[Rafael David Tinoco]

BUG: https://bugs.launchpad.net/ubuntu/+source/open-iscsi/+bug/1891374
MERGE: https://tinyurl.com/y4n56jtq
PPA: https://launchpad.net/~rafaeldtinoco/+archive/ubuntu/lp1891202

BILETO: https://bileto.ubuntu.com/#/ticket/4211
PPA: https://launchpad.net/~ci-train-ppa-service/+archive/ubuntu/4211

[Rafael David Tinoco (rafaeldtinoco)]

To review this:

~rafaeldtinoco/ubuntu/+source/open-iscsi:lp1891374-debian_sid

is the new pkg/debian/sid, merged by hand with new upstream (debian) 2.1.1-1 source code. Just like if it was imported by git-ubuntu. This way I could do all the git-ubuntu merge approach.

~rafaeldtinoco/ubuntu/+source/open-iscsi:lp1891374-groovy

Is the merge as if it would happen in a git-ubuntu style. I'll keep this repository so when git-ubuntu imports the real 2.1.1-1, in debian [new] right now, I can rebase this in the next merge for a future new version.

[Rafael David Tinoco (rafaeldtinoco)]

Doing the procedure above, you should ignore:

00040fa 2.1.1-1 (patches unapplied)

as it is the manual delta added.

And the git command:

$ git log lp1891374/logical/2.0.874-7.1ubuntu6.1

will give you the logical delta if this would be an git-ubuntu merge (I'm keeping this for future import).

[Rafael David Tinoco (rafaeldtinoco)]

NOTE:

I'm still testing this open-iscsi package but I would like very much for a review to start taking place, so we don't take too much longer to merge this new open-iscsi version.

Thank you

[Rafael David Tinoco (rafaeldtinoco)]

Upgrading existing open-iscsi installations with active iscsi disks:

----

Installing new version of config file /etc/init.d/open-iscsi ...
Installing new version of config file /etc/iscsi/iscsid.conf ...
grep: /lib/modules-load.d/open-iscsi.conf: No such file or directory
open-iscsi postinst: since the check in preinst some iSCSI sessions have
                     failed. -> will wait 30s for automatic recovery
Setting up iscsiuio (2.1.1-1ubuntu1) ...
Created symlink /etc/systemd/system/sysinit.target.wants/iscsiuio.service → /lib/systemd/system/iscsiuio.service.

NOTE: I need to fix this "No such file or directory"

----

(k)rafaeldtinoco@iscsiubu:~/work/sources/ubuntu$ systemctl is-enabled iscsid
disabled

(k)rafaeldtinoco@iscsiubu:~/work/sources/ubuntu$ systemctl is-enabled iscsid.socket
enabled

NOTE: Turned/kept open-iscsi installation "socket" enabled only (this is Ubuntu delta)

----

(k)rafaeldtinoco@iscsiubu:~/work/sources/ubuntu$ ls /dev/sd*
/dev/sda /dev/sdb

$ journalctl _SYSTEMD_UNIT=open-iscsi.service | tail -20
-- Logs begin at Tue 2020-08-11 21:20:41 UTC, end at Thu 2020-08-13 13:42:36 UTC. --
Aug 13 13:40:30 iscsiubu logout-all.sh[2259]: Logging out of session [sid: 1, target: iqn.2003-01.org.linux-iscsi.storage.x8664:sn.245b788cf3e3, portal: 10.250.94.10,3260]
Aug 13 13:40:30 iscsiubu iscsiadm[2260]: iscsiadm: iscsi01: 1 session requested, but 1 already present.
Aug 13 13:40:30 iscsiubu iscsiadm[2260]: iscsiadm: Could not log into all portals

$ journalctl _SYSTEMD_UNIT=iscsid.service | tail -20

Aug 12 17:36:17 iscsiubu iscsid[525]: iSCSI logger with pid=529 started!
Aug 12 17:36:17 iscsiubu iscsid[529]: iSCSI daemon with pid=530 started!
Aug 12 17:36:18 iscsiubu iscsid[529]: Connection1:0 to [target: iqn.2003-01.org.linux-iscsi.storage.x8664:sn.245b788cf3e3, portal: 10.250.94.10,3260] through [iface: iscsi01] is operational now
Aug 13 13:40:30 iscsiubu iscsid[530]: semop down failed 22
Aug 13 13:40:30 iscsiubu iscsid[2142]: iSCSI logger with pid=2143 started!
Aug 13 13:40:31 iscsiubu iscsid[2143]: iSCSI daemon with pid=2144 started!
Aug 13 13:40:31 iscsiubu iscsid[2143]: session cannot be terminated because it's trying to reconnect: try again later
Aug 13 13:40:31 iscsiubu iscsid[2143]: connection1:0 is operational after recovery (1 attempts)
Aug 13 13:40:31 iscsiubu iscsid[2144]: semop down failed 22
Aug 13 13:40:31 iscsiubu iscsid[2282]: iSCSI logger with pid=2283 started!
Aug 13 13:40:32 iscsiubu iscsid[2283]: iSCSI daemon with pid=2284 started!
Aug 13 13:40:34 iscsiubu iscsid[2283]: connection1:0 is operational after recovery (1 attempts)

----

NOTE: iscsi sessions were re-established:

$ sudo iscsiadm --mode session -P3
iSCSI Transport Class version 2.0-870
version 2.1.1
Target: iqn.2003-01.org.linux-iscsi.storage.x8664:sn.245b788cf3e3 (non-flash)
 Current Portal: 10.250.94.10:3260,1
 Persistent Portal: 10.250.94.10:3260,1
  **********
  Interface:
  **********
  Iface Name: tcp.52:54:00:fd:e1:4e
  Iface Transport: tcp
  Iface Initiatorname: iqn.1993-08.org.debian:01:d1ba4c9f7e33
  Iface IPaddress: 10.250.94.172
  Iface HWaddress: 52:54:00:fd:e1:4e
  Iface Netdev: default
  SID: 1
  iSCSI Connection State: LOGGED ...

[Rafael David Tinoco (rafaeldtinoco)]

I am missing this also:

Description: default in iscid.conf to use iscsid.socket

People do not want iscsid to run if not needed.
To do so it is configured to be socket activated.
Internally iscsid code has a fallback if the service is missing to run the
command specified in iscsid.conf as "iscsid.startup".
Set this to ensure the socket is active instead of calling the binary, which
would not be what we want anyway as it would not be from the .service context.

Forwarded: no (Downstream config)
Author: Christian Ehrhardt <email address hidden>
Bug-Ubuntu: https://bugs.launchpad.net/bugs/1755858
Last-Update: 2018-05-23

I removed it and did not put it back yet.

[Rafael David Tinoco (rafaeldtinoco)]

Working in getting a PPA ready.

[Rafael David Tinoco (rafaeldtinoco)]

BUG: https://bugs.launchpad.net/ubuntu/+source/open-iscsi/+bug/1891374
MERGE: https://tinyurl.com/y4n56jtq
PPA: https://launchpad.net/~rafaeldtinoco/+archive/ubuntu/lp1891202

867262d... by Rafael David Tinoco on 2020-08-14

* d/rules: Don't FTBFS due to warnings new in gcc10 regarding bounds and
  initialization, because upstream's gcc10 support is incomplete. This
  change can be dropped when upstream has completed their gcc support.

[Rafael David Tinoco (rafaeldtinoco)]

I think I have finished addressing all compilation (gcc10) issues in all arches (in the PPA). Waiting for all of them to finish compiling.

Good to go (be reviewed).

[Bryce Harrington (bryce)]

The package installs/uninstalls/purges via the PPA cleanly, and it debuilt cleanly.

The autopkgtests skipped for me running in lxc since it lacked 'revert-full-system' support, but I've no doubt if there's any issues they'll be caught by britney.

This change doesn't appear in the changelog and should be added:

  * Make iscsid.socket the default startup method in iscsid.conf
    (a7654ebc10be0aba27ba118114e8031349490d08)

The diff attached to this MP appears to include both the ubuntu delta and the debian delta (at least, it is showing removal of d/docs, d/p/bugfixes/*, etc. that sound like they were part of 2.1.1-1). Apologies if some of my review comments are against the debian delta rather than the ubuntu delta.

I've also flagged typos I spotted (I can't help but notice spelling errors...) but it's not important to me whether they're included or not; none of them are user-visible. I know sometimes it's not worth changing existing delta, so leave them to your call.

Other review comments are inline below. Hopefully they make sense.

review: Needs Fixing

[Rafael David Tinoco (rafaeldtinoco)]

* Make iscsid.socket the default startup method in iscsid.conf is actually:

/d/p/lp1755858-default-iscsid_conf-to-iscsid_socket.patch

and documented in changelog at:

    - make iscsid socket-activated to only activate it as needed
      - d/iscsid.socket: systemd socket file for iscsid
      - d/open-iscsi.service: do not start or check iscsid.service
      - d/rules: install and enable iscsid.socket
      - d/p/lp1755858-default-iscsid_conf-to-iscsid_socket.patch
      - d/open-iscsi.postinst:
        - run restart logic only if service is running on upgrade
        - drop no longer reachable upgrade path that affects iscsid
        - disable iscsid.service on upgrade
        - handle iscsid.socket to be started if the service is not running yet
      - d/iscsi-disk.rules: Add a udev rule so that iscsid.service will be run
        when udev disks are attached.
      - d/iscsid.service: Remove ExecStop= directive.
      - d/tests/install: fix tests to work with socket activation

it was a git log done apart from that change because I had to re-create it due to upstream code modifications. Git log and changelog entry were different so, to be more clear about this, I'm adding:

debian/patches/lp1755858-default-iscsid_conf-to-iscsid_socket.patch to this commit, changing its log to:

* make iscsid socket-activated to only activate it as needed:
  - debian/iscsid.socket: systemd socket file for iscsid
  - debian/open-iscsi.service: do not start or check iscsid.service
  - debian/rules: install and enable iscsid.socket
  - debian/patches/lp1755858-default-iscsid_conf-to-iscsid_socket.patch
  - debian/open-iscsi.postinst:
    - run restart logic only if service is running on upgrade
    - drop no longer reachable upgrade path that affects iscsid
    - disable iscsid.service on upgrade
    - handle iscsid.socket to be started if the service is not running yet
  - d/iscsi-disk.rules: Add a udev rule so that iscsid.service will be
    run when udev disks are attached.
  - d/iscsid.service: Remove ExecStop= directive.
  - debian/tests/install: fix tests to work with socket activation

  Dropped:
  * make iscsid socket-activated to only activate it as needed:
    - debian/patches/iscid-conf-use-systemd.socket-patch: default to the
      socket. This patch was renamed only.
    - debian/open-iscsi.postinst: drop no longer reachable upgrade path
      that affects iscsid
    - d/iscsi-disk.rules: Add a udev rule so that iscsid.service will be
      run when udev disks are attached.

and changing changelog to the same (without the Dropped as these drops were already documented in the Debian version).

[Rafael David Tinoco (rafaeldtinoco)]

I still need to finish some changes...

[Rafael David Tinoco (rafaeldtinoco)]

Okay I think I have addressed all the highlights and, if all good, will submit this to bileto to make sure its all good for migration.

[Christian Ehrhardt  (paelzer)]

"Imported using rafaeldtinoco's hands" is nice one :-)

I can understand that you have
"Note: this suite should be replaced as soon as TGT is replaced by LIO (targetcli-fb) in main archive." in the commit, but it does IMHO not belong into the changelog here.

"else" in "* add IPv6 support" has one space too much for correct indent.

Since we added socket support which we still carry in "* Make iscsid socket-activated to only activate it as needed" upstream has added "etc/systemd/iscsid.socket".
Can we re-use this (identical) file and drop ours. That way we would pick up fixes by upstream in that file.

In a similar fashion (Not for the scope of this merge) it would be great to some day be able to unify ./etc/systemd/iscsid.service && ./debian/iscsid.service. But they are so different that will take a while - yet we can learn a bit.
- Also=iscsid.socket might make sense in ours.
- Type notify, Notify MAIN and -f (foregrund) might work for us as well
Other differences between the to might go vice versa and be suggested upstream.

Typo:
"to be explcit to start" (probably mine)

Ubuntu already has made the transition TO the socket activation.
I think we could loose many special code in e.g. debian/open-iscsi.postinst
e.g. the whole block around "dpkg --compare-versions "$2" le-nl "2.0.874-5ubuntu3"" which is part of "* Make iscsid socket-activated to only activate it as needed:". In the past we needed odd rules for the transition and debhelper couldn't handle service+socket with conflicts on restart.
But in Groovy things are fine now - feel free to take a look and convert much of that into just 1-2 lines of dh_installsystemd - take a look at the libvirt merge if you want.
Note - this is an optimization that can take place later as well, but then note it down for next time.

The gcc-10 changes are fine (ignore the warnings for now).

I was also trying to run the multipath-tools and tgt tests against your PPA but LP api hates my tests today. But when you run yours in bileto we will see the same results - so waiting for those.

[Christian Ehrhardt  (paelzer)]

Since I pointed you to it (fo dh systemd things) but it isn't ready yet (waiting on Debian to upload experimental and one upstream fix) you can find the current state of the libvirt 6.6 merge at https://code.launchpad.net/~paelzer/ubuntu/+source/libvirt/+git/libvirt/+ref/merge-6.6.0-groovy

[Rafael David Tinoco (rafaeldtinoco)]

Replies to @paelzer:

"Imported using rafaeldtinoco's hands" is nice one :-)

I can understand that you have "Note: this suite should be replaced as soon as
TGT is replaced by LIO (targetcli-fb) in main archive." in the commit, but it
does IMHO not belong into the changelog here.

> alright. kept it in git log only.

"else" in "* add IPv6 support" has one space too much for correct indent.

> I could not find what you refer to.

Since we added socket support which we still carry in "* Make iscsid
socket-activated to only activate it as needed" upstream has added
"etc/systemd/iscsid.socket". Can we re-use this (identical) file and drop ours.
That way we would pick up fixes by upstream in that file.

> Okay. FTRO, I will upstream our open-iscsi delta, but I'm planning a
refactoring for the iscsi root support and that would be too much for this
effort.

In a similar fashion (Not for the scope of this merge) it would be great to some
day be able to unify ./etc/systemd/iscsid.service && ./debian/iscsid.service.
But they are so different that will take a while - yet we can learn a bit.

- Also=iscsid.socket might make sense in ours.
- Type notify, Notify MAIN and -f (foregrund) might work for us as well

Other differences between the to might go vice versa and be suggested upstream.

> This is planned for the next work. My final intent for open-iscsi is to take
full iscsi root support to Debian and drop delta (max I can).

Typo:
"to be explcit to start" (probably mine)

> Fixed.

Ubuntu already has made the transition TO the socket activation.
I think we could loose many special code in e.g. debian/open-iscsi.postinst

e.g. the whole block around "dpkg --compare-versions "$2" le-nl
"2.0.874-5ubuntu3"" which is part of "* Make iscsid socket-activated to only
activate it as needed:". In the past we needed odd rules for the transition and
debhelper couldn't handle service+socket with conflicts on restart.

> I got rid of all upgrade paths from Debian for the same reason. I was afraid
of this one because of upgrade paths. BUT, to be honest, this has little
importance over the others as the max side effect would be to have the
daemon enabled, together with the socket... so I guess its okay to remove it.

But in Groovy things are fine now - feel free to take a look and convert much of
that into just 1-2 lines of dh_installsystemd - take a look at the libvirt merge
if you want.

Note - this is an optimization that can take place later as well, but then note
it down for next time.

> I'm taking a note for this one, cause I want to read better what debhelper
can do for situations like this (disabling service, keeping socket enabled
when upgrading, etc).

> Also, this is the part I want to test after Bileto (installing, upgrading
with iscsid enabled / disabled, with and without automatic LUNs, etc). So,
IF something does not work, I'll have to revisit this anyway.

> Added to git log:

  Note:
  * Need to revisit upgrade paths and systemd service/socket activation.
    It is very likely that this part can be optimized.

The gcc-10 changes are fine (ignore the warnings for now).

I was also trying to run the multipath-tools and tgt tests against your PPA but
...

[Bryce Harrington (bryce)]

Sounds like you've addressed the points I've made. I'm glad Christian is adding his suggestions too, so will mark my part approved and you can upload once Christian's happy as well.

review: Approve

[Rafael David Tinoco (rafaeldtinoco)]

@paelzer,

bileto tells me that "install" test failed. That happens because iscsid.socket is enabled but not running after installation. Will fix this and make bileto happy about all tests.

[Rafael David Tinoco (rafaeldtinoco)]

Alright,

autopkgtests have passed. I have made several tests regarding iscsid.{socket,service} start/restart during install/upgrade and fixed the previous issue (iscsid.socket not being started automatically).

I have uploaded it:

$ dput ubuntu open-iscsi_2.1.1-1ubuntu1_source.changes
Checking signature on .changes
gpg: /home/rafaeldtinoco/work/sources/ubuntu/open-iscsi_2.1.1-1ubuntu1_source.changes: Valid signature from A93E0E0AD83C0D0F
Checking signature on .dsc
gpg: /home/rafaeldtinoco/work/sources/ubuntu/open-iscsi_2.1.1-1ubuntu1.dsc: Valid signature from A93E0E0AD83C0D0F
Package includes an .orig.tar.gz file although the debian revision suggests
that it might not be required. Multiple uploads of the .orig.tar.gz may be
rejected by the upload queue management software.
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading open-iscsi_2.1.1-1ubuntu1.dsc: done.
  Uploading open-iscsi_2.1.1.orig.tar.gz: done.
  Uploading open-iscsi_2.1.1-1ubuntu1.debian.tar.xz: done.
  Uploading open-iscsi_2.1.1-1ubuntu1_source.buildinfo: done.
  Uploading open-iscsi_2.1.1-1ubuntu1_source.changes: done.
Successfully uploaded packages.

And will keep git-ubuntu history for future merges (when 2.1.1-1 is imported from Debian).

diff --git a/debian/TODO.Debian b/debian/TODO.Debian
deleted file mode 100644
index 6233bc9..0000000
--- a/debian/TODO.Debian
+++ /dev/null
@@ -1,5 +0,0 @@
-TODO for package open-iscsi
----------------------------
-
- - find a way to make event-based activation work on sysvinit systems
-   and then deprecate the current LVM hacks
diff --git a/debian/changelog b/debian/changelog
index 0b6e4e8..acaa069 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,73 @@
+open-iscsi (2.1.1-1ubuntu1) groovy; urgency=medium
+
+  * New upstream version 2.1.1
+  * d/rules: Don't FTBFS due to warnings new in gcc10 regarding bounds
+    and initialization, because upstream's gcc10 support is incomplete.
+    This change can be dropped when upstream has completed their gcc
+    support.
+  * Merge with Debian unstable (LP: #1891374). Remaining changes:
+    - debian/tests: Add Ubuntu autopkgtest suite:
+      - README-boot-test.md
+      - tgt-boot-test: tests
+      - test-open-iscsi.py
+      - testlib.py
+      - get-image
+      - patch-image
+      - testsuite
+      - xkvm
+    - d/iscsid.service: Let iscsid systemd job run in privileged containers
+      but not in unprivileged ones
+    - d/extra/initramfs.local-top: handle iSCSI iBFT DHCP to correctly
+      run ipconfig to gather all DHCP config info, including DNS search
+      domain, which iBFT can't provide.
+    - Remove initramfs interfaces stamp in case no iscsi devs mounted.
+      If iscsi root was requested, but no iscsi devices were mounted, remove
+      the initramfs interfaces stamp file. Meaning, that on shutdown there is
+      no 30s delay, whilst trying to re-establish iscsi login to perform a
+      logout.
+    - add IPv6 support
+      - Source /run/net6-*.conf when needed.
+      - d/extra/initramfs.local-top: handle IPv6 configs being shipped in
+        DEVICE6 or /run/net6-*.conf in the initramfs, so we can fill in
+        .interface
+    - d/rules, d/open-iscsi.finalrd, d/control: ship the finalrd iscsi logout
+      hook and recommend finalrd and busybox for the logout hook to work.
+    - Make iscsid socket-activated to only activate it as needed:
+      - debian/open-iscsi.service: do not start or check iscsid.service
+      - debian/rules: install and enable iscsid.socket
+      - debian/open-iscsi.postinst:
+        - run restart logic only if service is running on upgrade
+        - drop no longer reachable upgrade path that affects iscsid
+        - disable iscsid.service on upgrade
+        - handle iscsid.socket to be started if the service is not running yet
+      - d/iscsi-disk.rules: Add a udev rule so that iscsid.service will be
+        run when udev disks are attached.
+      - d/iscsid.service: Remove ExecStop= directive.
+      - debian/tests/install: fix tests to work with socket activation
+      - debian/patches/lp1755858-default-iscsid_conf-to-iscsid_socket.patch
+    - debian/open-iscsi.service: Start open-iscsi systemd job when either
+      /etc/iscsi/nodes or /sys/class/iscsi_session have content.
+    - Prevent network interface that contains iscsi root from bouncing
+      during boot or going down during shutdown if the system is using
+      resolvconf or ifupdown:
+      - d/iscsi-network-interface.rules
+      - d/extra/net-interface-handler
+    - d/extra/initramfs.hook: add ib_iser to the list of modules included in
+      the initramfs, so that we can in principle support iscsi root on
+      infiniband.
+    - d/open-iscsi.kmod drop: (LP #1833586)
+      no static module list is needed if we let iscsid load modules itself.
+    - Stop producing udebs on i386 where we no longer have d-i or a kernel.
+    - Use python2 instead of python in the autopkg tests: Next step for
+      open-iscsi is to revist all iscsi-root feature and autopkgtests, so
+      keep python2 to avoid re-work later.
+    - d/extra/initramfs.local-{top,bottom}: move removal of
+      open-iscsi.interface file from local-top to local-bottom, and fix shell
+      quoting issue that would result in /run/initramfs/ open-iscsi.interface
+      always being removed (LP #1872813)
+
+ -- Rafael David Tinoco <[e-mail]>  Thu, 13 Aug 2020 04:29:43 +0000
+
 open-iscsi (2.1.1-1) experimental; urgency=medium
 
   [ Rafael David Tinoco ]
@@ -42,6 +112,98 @@ open-iscsi (2.1.1-1) experimental; urgency=medium
 
  -- Ritesh Raj Sarraf <[e-mail]>  Tue, 23 Jun 2020 20:38:47 +0530
 
+open-iscsi (2.0.874-7.1ubuntu6.1) focal; urgency=medium
+
+   [ Ben Swartzlander ]
+   * allow open-iscsi to disable auto-scan feature (LP: #1877617)
+     - d/p/lp1877617-Allow-disabling-auto-LUN-scans.patch
+     - d/p/lp1877617-Fix-manual-LUN-scans-feature.patch
+
+ -- Rafael David Tinoco <[e-mail]>  Mon, 11 May 2020 02:03:33 +0000
+
+open-iscsi (2.0.874-7.1ubuntu6) focal; urgency=medium
+
+  * d/extra/initramfs.local-{top,bottom}: move removal of open-iscsi.interface
+    file from local-top to local-bottom, and fix shell quoting issue that
+    would result in /run/initramfs/open-iscsi.interface always being removed
+    (LP: #1872813)
+
+ -- Daniel Watkins <[e-mail]>  Tue, 14 Apr 2020 16:54:37 -0400
+
+open-iscsi (2.0.874-7.1ubuntu5) focal; urgency=medium
+
+  * Use python2 instead of python in the autopkg tests.
+
+ -- Matthias Klose <[e-mail]>  Thu, 30 Jan 2020 10:14:16 +0100
+
+open-iscsi (2.0.874-7.1ubuntu3) eoan; urgency=medium
+
+  * Stop producing udebs on i386 where we no longer have d-i or a kernel.
+
+ -- Adam Conrad <[e-mail]>  Wed, 09 Oct 2019 14:10:37 -0600
+
+open-iscsi (2.0.874-7.1ubuntu2) eoan; urgency=medium
+
+  * debian/open-iscsi.kmod: drop; no static module list is needed if we let
+    iscsid load modules itself.  LP: #1833586.
+  * debian/extra/initramfs.hook: add ib_iser to the list of modules
+    included in the initramfs, so that we can in principle support iscsi
+    root on infiniband.
+
+ -- Steve Langasek <[e-mail]>  Thu, 20 Jun 2019 13:48:46 -0700
+
+open-iscsi (2.0.874-7.1ubuntu1) eoan; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/tests: Add Ubuntu autopkgtest.
+    - debian/iscsi-network-interface.rules, debian/net-interface-handler,
+      debian/open-iscsi.install:
+      Prevent network interface that contains iscsi root from bouncing
+      during boot or going down during shutdown if the system is using
+      resolvconf or ifupdown.
+    - Let iscsid systemd job run in privileged containers but not in
+      unprivileged ones
+    - Start open-iscsi systemd job when either /etc/iscsi/nodes or
+      /sys/class/iscsi_session have content
+    - add IPv6 support
+      + Source /run/net6-*.conf when needed.
+      + debian/extra/initramfs.local-top: handle IPv6 configs being
+        shipped in DEVICE6 or /run/net6-*.conf in the initramfs, so we
+        can fill in /run/initramfs/open-iscsi.interface
+    - make iscsid socket-activated to only activate it as needed
+      + debian/iscsid.socket: systemd socket file for iscsid
+      + debian/open-iscsi.service: do not start or check iscsid.service
+      + debian/rules: install and enable iscsid.socket
+      + debian/patches/iscid-conf-use-systemd.socket-patch: default to the
+        socket
+      + debian/open-iscsi.postinst:
+        * run restart logic only if service is running on upgrade
+        * drop no longer reachable upgrade path that affects iscsid
+        * disable iscsid.service on upgrade
+        * handle iscsid.socket to be started if the service is not running
+          yet
+      + d/iscsi-disk.rules: Add a udev rule so that iscsid.service will be
+        run when udev disks are attached.
+      + d/iscsid.service: Remove ExecStop= directive.
+      + debian/tests/install: fix tests to work with socket activation
+    - Ship finalrd logout hook.
+    - debian/extra/initramfs.local-top: handle iSCSI iBFT DHCP to correctly
+      run ipconfig to gather all DHCP config info, including DNS search
+      domain, which iBFT can't provide.
+    - If iscsi root was requested, but no iscsi devices were mounted, remove
+      the initramfs interfaces stamp file. Meaning, that on shutdown there
+      is no 30s delay, whilst trying to re-establish iscsi login to perform
+      a logout.
+  * Dropped changes, included in Debian:
+    - Fix fail to build from source due to undefined reference to
+      minor
+  * Drop breaks on never-released version of finalrd.
+  * debian/net-interface-handler: drop upstart support, unused since bionic.
+  * Drop cleanup of upstart jobs, no longer needed post bionic.
+  * debian/tests/daemon: drop, unused.
+
+ -- Steve Langasek <[e-mail]>  Mon, 29 Apr 2019 16:13:37 -0700
+
 open-iscsi (2.0.874-7) unstable; urgency=medium
 
   * [eeda27c] Enable back pristine-tar as we have now committed it
@@ -57,6 +219,158 @@ open-iscsi (2.0.874-6) unstable; urgency=medium
 
  -- Ritesh Raj Sarraf <[e-mail]>  Fri, 05 Oct 2018 11:31:19 +0530
 
+open-iscsi (2.0.874-5ubuntu15) disco; urgency=medium
+
+  * d/iscsid.service: Remove ExecStop= directive. Letting systemd
+    handle termination prevents restart failures. (LP: #1821255)
+
+ -- Heitor R. Alves de Siqueira <[e-mail]>  Thu, 28 Mar 2019 10:21:24 -0300
+
+open-iscsi (2.0.874-5ubuntu14) disco; urgency=medium
+
+  * debian/iscsi-disk.rules: Fix bug with LVM on top of iscsi devices.
+    (LP: #1807978)
+
+ -- Scott Moser <[e-mail]>  Tue, 11 Dec 2018 19:01:14 -0500
+
+open-iscsi (2.0.874-5ubuntu13) disco; urgency=medium
+
+  [ Robert C Jennings & Dimitri John Ledkov ]
+  * If iscsi root was requested, but no iscsi devices were mounted, remove
+    the initramfs interfaces stamp file. Meaning, that on shutdown there
+    is no 30s delay, whilst trying to re-establish iscsi login to perform
+    a logout. LP: #1800681
+
+ -- Dimitri John Ledkov <[e-mail]>  Sun, 09 Dec 2018 22:29:20 +0000
+
+open-iscsi (2.0.874-5ubuntu12) disco; urgency=medium
+
+  [Scott Moser]
+  * debian/extra/initramfs.local-top: handle iSCSI iBFT DHCP to correctly
+    run ipconfig to gather all DHCP config info, including DNS search
+    domain, which iBFT can't provide.  (LP: #1806777)
+
+ -- Dan Streetman <[e-mail]>  Wed, 05 Dec 2018 11:28:12 -0500
+
+open-iscsi (2.0.874-5ubuntu11) disco; urgency=medium
+
+  * debian/tests/test-open-iscsi.py: Fix called process error.
+    If no image was available for a release, a NameError exception would be
+    raised.
+
+ -- Scott Moser <[e-mail]>  Wed, 14 Nov 2018 16:50:29 -0500
+
+open-iscsi (2.0.874-5ubuntu10) disco; urgency=medium
+
+  * d/iscsi-disk.rules, d/tests: Add a udev rule so that iscsid.service
+    will be run when udev disks are attached.  (LP: #1802354)
+  * debian/tests: improve tgt boot test
+     - disable snapd and snap.seeded services to avoid unnecessary
+       resource consumption during tests.
+     - save artifacts from the test run.
+
+ -- Scott Moser <[e-mail]>  Wed, 14 Nov 2018 16:05:46 -0500
+
+open-iscsi (2.0.874-5ubuntu9) cosmic; urgency=medium
+
+  * d/net-interface-handler: replace 'domainsearch' with the correct
+    configuration option 'search' in net-interface-handler (LP: #1791108)
+
+ -- Victor Tapia <[e-mail]>  Mon, 17 Sep 2018 15:58:34 +0200
+
+open-iscsi (2.0.874-5ubuntu8) cosmic; urgency=medium
+
+  * d/tests: insert some debug units in an attempt to diagnose any
+    occurences of bug 1788188.
+  * Fix fail to build from source due to undefined reference to
+    minor (LP: #1791154)
+
+ -- Scott Moser <[e-mail]>  Tue, 21 Aug 2018 13:33:06 -0400
+
+open-iscsi (2.0.874-5ubuntu7) cosmic; urgency=medium
+
+  * d/tests: make interactive use of tgt-boot-test more usable by
+    only using 'timeout' from the test harness.
+  * debian/tests/README-boot-test.md: minor doc fixes and whitespace.
+  * d/net-interface-handler: Apply changes only for the iscsi-root interface.
+    (LP: #1785108)
+
+ -- Scott Moser <[e-mail]>  Tue, 07 Aug 2018 16:37:13 -0400
+
+open-iscsi (2.0.874-5ubuntu6) cosmic; urgency=medium
+
+  * Ship finalrd logout hook.
+
+ -- Dimitri John Ledkov <[e-mail]>  Fri, 03 Aug 2018 15:03:51 +0100
+
+open-iscsi (2.0.874-5ubuntu5) cosmic; urgency=medium
+
+  * Harden dep8 tests against effects due to slow execution on Launchpad
+    infrastructure (LP: #1732028).
+    - debian/tests/patch-image: remove problematic fstab entries
+    - debian/tests/tgt-boot-test: ran xkvm in verbose mode
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 19 Jul 2018 18:22:39 +0200
+
+open-iscsi (2.0.874-5ubuntu4) cosmic; urgency=medium
+
+  * debian/tests/install: ignore the potential stderr of the probing command
+    that is meant to activate iscsid indirectly via the socket.
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 30 May 2018 15:42:12 +0200
+
+open-iscsi (2.0.874-5ubuntu3) cosmic; urgency=medium
+
+  * make iscsid socket activated to only activate it as-needed (LP: #1755858)
+    - debian/iscsid.socket: systemd socket file for iscsid
+    - debian/open-iscsi.service: do not start or check iscsid.service
+    - debian/rules: install and enable iscsid.socket
+    - debian/patches/iscid-conf-use-systemd.socket-patch: default to the socket
+    - debian/open-iscsi.postinst:
+      + run restart logic only if service is running on upgrade
+      + drop no more reachable upgrade path that affects iscsid
+      + disable iscsid.service on upgrade
+      + handle iscsid.socket to be started if the service is not running yet
+    - debian/tests/install: fix tests to work with socket activation
+
+ -- Christian Ehrhardt <[e-mail]>  Wed, 23 May 2018 15:50:01 +0200
+
+open-iscsi (2.0.874-5ubuntu2) bionic; urgency=medium
+
+  * debian/tests:
+     - tgt-boot-test: Use 'timeout' to force a 60m timeout of the boot test.
+     - README-boot-test.md: document environment variables BOOT_TIMEOUT
+       and _USE_KVM.
+
+ -- Scott Moser <[e-mail]>  Wed, 21 Feb 2018 13:19:17 -0500
+
+open-iscsi (2.0.874-5ubuntu1) bionic; urgency=low
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/tests: Add Ubuntu autopkgtests.
+    - debian/iscsi-network-interface.rules, debian/net-interface-handler,
+      debian/open-iscsi.install:
+      Prevent network interface that contains iscsi root from bouncing
+      during boot or going down during shutdown.
+      Integrates with resolvconf and initramfs code that writes
+      /run/initramfs/open-iscsi.interface
+    - debian/open-iscsi.maintscript: clean up the obsolete
+      iscsi-network-interface upstart job, file on upgrade.
+    - Let iscsid systemd job run in privileged containers but not in
+      unprivileged ones
+    - Start open-iscsi systemd job when either /etc/iscsi/nodes or
+      /sys/class/iscsi_session have content
+      Based on patch by Nish Aravamudan, thanks! (LP #1576341)
+    - add IPv6 support
+      + add support for IPV6{DOMAINSEARCH,DNS0,DNS1} to net-interface-handler
+        LP #1621507
+      + Source /run/net6-*.conf when needed.
+      + debian/extra/initramfs.local-top: handle IPv6 configs being
+        shipped in DEVICE6 or /run/net6-*.conf in the initramfs, so we
+        can fill in /run/initramfs/open-iscsi.interface (LP #1621507)
+
+ -- Dimitri John Ledkov <[e-mail]>  Fri, 12 Jan 2018 14:00:59 +0000
+
 open-iscsi (2.0.874-5) unstable; urgency=high
 
   * [aeb86f7] Fix multiple security issues in iscsiuio. (CVE-2017-17840)
@@ -64,6 +378,74 @@ open-iscsi (2.0.874-5) unstable; urgency=high
 
  -- Christian Seiler <[e-mail]>  Sat, 23 Dec 2017 11:30:44 +0100
 
+open-iscsi (2.0.874-4ubuntu5) bionic; urgency=medium
+
+  * debian/tests/patch-image: mount auxilary filesystems before upgrading
+    packages. Fixes ADT tests, when triggered by packages, that need
+    /proc, /dev, etc mounted to complete the upgrade.
+
+ -- Dimitri John Ledkov <[e-mail]>  Wed, 03 Jan 2018 12:21:05 +0000
+
+open-iscsi (2.0.874-4ubuntu4) bionic; urgency=medium
+
+  * debian/tests/test-open-iscsi.py: skip test if cloud image is unavailable.
+    This solves flaky tests in restricted network environments as well as in
+    the short period after opening a new release (LP: #1731907).
+
+ -- Christian Ehrhardt <[e-mail]>  Thu, 16 Nov 2017 12:06:34 +0100
+
+open-iscsi (2.0.874-4ubuntu3) artful; urgency=medium
+
+  * debian/tests/xkvm: do not use kvm (-enable-kvm) by default if
+    operating inside a vm.  nested kvm is finicky.
+
+ -- Scott Moser <[e-mail]>  Wed, 11 Oct 2017 18:14:08 -0400
+
+open-iscsi (2.0.874-4ubuntu2) artful; urgency=medium
+
+  * debian/tests/test-open-iscsi.py: query systemd-resolved if present.
+    Ubuntu images now have systemd-resolved managing /etc/resolv.conf
+    so support test if that is the case (LP: #1715468).
+
+ -- Scott Moser <[e-mail]>  Wed, 06 Sep 2017 16:20:16 -0400
+
+open-iscsi (2.0.874-4ubuntu1) artful; urgency=medium
+
+  * Merge with Debian unstable. Remaining changes:
+    - debian/tests: Add Ubuntu autopkgtests.
+    - debian/iscsi-network-interface.rules, debian/net-interface-handler,
+      debian/open-iscsi.install:
+      Prevent network interface that contains iscsi root from bouncing
+      during boot or going down during shutdown.
+      Integrates with resolvconf and initramfs code that writes
+      /run/initramfs/open-iscsi.interface
+    - debian/open-iscsi.maintscript: clean up the obsolete
+      iscsi-network-interface upstart job, file on upgrade.
+    - Let iscsid systemd job run in privileged containers but not in
+      unprivileged ones
+    - Start open-iscsi systemd job when either /etc/iscsi/nodes or
+      /sys/class/iscsi_session have content
+      Based on patch by Nish Aravamudan, thanks! (LP #1576341)
+    - add IPv6 support
+      + add support for IPV6{DOMAINSEARCH,DNS0,DNS1} to net-interface-handler
+        LP #1621507
+      + Source /run/net6-*.conf when needed.
+      + debian/extra/initramfs.local-top: handle IPv6 configs being
+        shipped in DEVICE6 or /run/net6-*.conf in the initramfs, so we
+        can fill in /run/initramfs/open-iscsi.interface (LP #1621507)
+  * Drop:
+    - d/extra/initramfs.local-top: When booting from iBFT,
+      set the PROTO= entry in /run/net-*.conf accordingly,
+      so that other tools, such as cloud-init, can use that
+      information. (cloud-init fails if the current PROTO=none
+      is used.) (LP: #1684039) (Closes: #866213)
+      [ Fixed in Debian 2.0.874-4 ]
+  * d/t/test-open-iscsi.py: drop test_daemon test
+    - With the updates to the systemd units, the services do not run
+      unless iSCSI is configured.
+
+ -- Nishanth Aravamudan <[e-mail]>  Tue, 08 Aug 2017 16:16:27 -0700
+
 open-iscsi (2.0.874-4) unstable; urgency=medium
 
   * [0347300] initramfs: populate PROTO= entry in /run/net-*.conf from iBFT
@@ -78,6 +460,64 @@ open-iscsi (2.0.874-3) unstable; urgency=medium
 
  -- Christian Seiler <[e-mail]>  Sun, 18 Jun 2017 22:01:22 +0200
 
+open-iscsi (2.0.874-2ubuntu3) artful; urgency=medium
+
+  * d/t/test-open-iscsi.py: drop test_daemon test
+    - With the updates to the systemd units, the services do not run
+      unless iSCSI is configured.
+
+ -- Nishanth Aravamudan <[e-mail]>  Tue, 08 Aug 2017 16:05:29 -0700
+
+open-iscsi (2.0.874-2ubuntu2) artful; urgency=medium
+
+  * d/extra/initramfs.local-top: When booting from iBFT,
+    set the PROTO= entry in /run/net-*.conf accordingly,
+    so that other tools, such as cloud-init, can use that
+    information. (cloud-init fails if the current PROTO=none
+    is used.) (LP: #1684039) (Closes: #866213)
+
+ -- Eric Desrochers <[e-mail]>  Wed, 05 Jul 2017 09:02:12 -0400
+
+open-iscsi (2.0.874-2ubuntu1) artful; urgency=medium
+
+  [ Nishanth Aravamudan ]
+  * Merge with Debian unstable. Remaining changes:
+    - debian/tests: Add Ubuntu autopkgtests.
+    - debian/iscsi-network-interface.rules, debian/net-interface-handler,
+      debian/open-iscsi.install:
+      Prevent network interface that contains iscsi root from bouncing
+      during boot or going down during shutdown.
+      Integrates with resolvconf and initramfs code that writes
+      /run/initramfs/open-iscsi.interface
+    - debian/open-iscsi.maintscript: clean up the obsolete
+      iscsi-network-interface upstart job, file on upgrade.
+    - add IPv6 support
+      + add support for IPV6{DOMAINSEARCH,DNS0,DNS1} to net-interface-handler
+        LP #1621507
+      + Source /run/net6-*.conf when needed.
+      + debian/extra/initramfs.local-top: handle IPv6 configs being
+        shipped in DEVICE6 or /run/net6-*.conf in the initramfs, so we
+        can fill in /run/initramfs/open-iscsi.interface (LP #1621507)
+  * Drop:
+    - Make systemd job not run in containers (LP #1576341)
+      [ This prevents running iscsi in privileged containers.
+        Fixed differently in this upload. ]
+    - Cherry-pick from Debian git repository (Christian Seiler):
+      + open-iscsi-udeb: drop Depends: libnss-files-udeb
+        (Closes #819685)
+      [ Fixed in Debian ]
+     - d/extra/initramfs.local-top whitespace change
+     [ previously undocumented ]
+
+  [ Balint Reczey ]
+  * Let iscsid systemd job run in privileged containers but not in
+    unprivileged ones
+  * Start open-iscsi systemd job when either /etc/iscsi/nodes or
+    /sys/class/iscsi_session have content
+    Based on patch by Nish Aravamudan, thanks! (LP #1576341)
+
+ -- Nishanth Aravamudan <[e-mail]>  Tue, 09 May 2017 09:24:23 -0700
+
 open-iscsi (2.0.874-2) unstable; urgency=medium
 
   [ Christian Seiler ]
@@ -217,6 +657,155 @@ open-iscsi (2.0.873+git0.3b4b4500-15) unstable; urgency=medium
 
  -- Christian Seiler <[e-mail]>  Fri, 20 May 2016 09:52:46 +0200
 
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu17) zesty; urgency=medium
+
+  * debian/tests:
+    - README-boot-test.md: mention limited space caveat.
+    - patch-image: fix handling of ADT_TEST_TRIGGERS if source package
+      built more than one binary package.
+    - test-open-iscsi.py: change to rely on patch-image
+      adding package 'open-iscsi' rather than passing it in itself.
+
+ -- Scott Moser <[e-mail]>  Thu, 16 Feb 2017 15:47:58 -0500
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu16) zesty; urgency=medium
+
+  * debian/tests: many improvements to the open-iscsi and tgt boot test.
+    - only run test on amd64. just avoid timeout errors or other unrelated
+      issues causing failure.
+    - debian/tests/README-boot-test.md: add doc describing the tgt-boot-test
+    - rename get-maas-eph to get-image
+    - use a cloud image instead of a maas image for booting.  The value in
+      this is that we can then install open-iscsi inside the image and get an
+      updated initramfs.
+    - use subprocess.check_call rather than subprocess.call so that we
+      actually catch errors.
+    - update xkvm to what is in curtin/tools/xkvm
+    - improve updating of images to consider ADT_TEST_TRIGGERS if set.
+
+ -- Scott Moser <[e-mail]>  Tue, 14 Feb 2017 17:07:00 -0500
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu15) zesty; urgency=medium
+
+  * debian/tests/tgt-boot-test: set HOST_IP harder for the testsuite test.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Sun, 29 Jan 2017 13:05:47 -0500
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu14) zesty; urgency=medium
+
+  * Make systemd job not run in containers (LP: #1576341)
+
+ -- Serge Hallyn <[e-mail]>  Sun, 15 Jan 2017 23:08:29 -0600
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu13) zesty; urgency=medium
+
+  * Fix syntax error in previous changes. LP: #1621507
+
+ -- LaMont Jones <[e-mail]>  Fri, 09 Dec 2016 12:35:45 +0100
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu12) zesty; urgency=medium
+
+  * debian/tests/tgt-boot-test: set HOST_IP to 10.0.2.2; it's suboptimal but
+    given the test setup this will allow the right IPs to be used to bring up
+    the iscsi target in the xkvm.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Thu, 08 Dec 2016 11:00:12 +0100
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu11) zesty; urgency=medium
+
+  * debian/tests/tgt-boot-test: drop -serial stdio altogether since running
+    the VM in -nographics mode will already output to stdout.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Tue, 22 Nov 2016 11:27:55 -0500
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu10) zesty; urgency=medium
+
+  * debian/tests/tgt-boot-test: always log qemu serial to stdio so we can
+    actually see what is going on during the tests.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Thu, 17 Nov 2016 11:01:27 -0500
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu9) zesty; urgency=medium
+
+  [ LaMont Jones ]
+  * Clean up net-interface-handler
+  * Source /run/net6-*.conf when needed.
+
+  [ Mathieu Trudel-Lapierre ]
+  * debian/extra/initramfs.local-top: handle IPv6 configs being shipped in
+    DEVICE6 or /run/net6-*.conf in the initramfs, so we can fill in
+    /run/initramfs/open-iscsi.interface (LP: #1621507)
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Thu, 03 Nov 2016 16:30:37 -0600
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu8) yakkety; urgency=medium
+
+  * debian/tests/xkvm: don't --enable-kvm.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Wed, 05 Oct 2016 12:58:21 -0400
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu7) yakkety; urgency=medium
+
+  * debian/tests/test-open-iscsi.py: glob to pick up open-iscsi.deb, which may
+    be named differently depending on how autopkgtests are run.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Wed, 05 Oct 2016 09:56:25 -0400
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu6) yakkety; urgency=medium
+
+  * debian/tests/test-open-iscsi.py: install the open-iscsi binary into a test
+    MAAS image, so we can check bootability. Download the open-iscsi explicitly
+    to /tmp before trying to copy it; so that we don't need to depend on ugly
+    internal autopkgtest paths.
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Tue, 04 Oct 2016 09:05:56 -0400
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu5) yakkety; urgency=medium
+
+  * debian/tests/control: add build-needed since some of the new tests
+    appear to require that (so they can reach open-iscsi.deb which is a build
+    artifact from building in autopkgtest).
+
+ -- Mathieu Trudel-Lapierre <[e-mail]>  Mon, 03 Oct 2016 16:10:54 -0400
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu4) yakkety; urgency=medium
+
+  * add support for IPV6{DOMAINSEARCH,DNS0,DNS1} to net-interface-handler
+    LP: #1621507
+
+ -- LaMont Jones <[e-mail]>  Tue, 20 Sep 2016 08:05:41 -0600
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu3) xenial; urgency=medium
+
+  * Cherry-pick from Debian git repository (Christian Seiler):
+    - open-iscsi-udeb: drop Depends: libnss-files-udeb (Closes: #819685)
+
+ -- Colin Watson <[e-mail]>  Fri, 15 Apr 2016 16:54:26 +0100
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu2) xenial; urgency=medium
+
+  * debian/tests: add two new tests.  One to verify net-interface-handler is
+    installed executable, and one to actually test that /etc/resolv.conf is
+    updated with dhcp dns responses.
+
+ -- Diogo Matsubara <[e-mail]>  Wed, 09 Mar 2016 12:56:42 -0300
+
+open-iscsi (2.0.873+git0.3b4b4500-14ubuntu1) xenial; urgency=medium
+
+  * Merge from debian. Remaining changes:
+    - debian/tests: Add Ubuntu autopkgtest.
+    - debian/iscsi-network-interface.rules, debian/net-interface-handler,
+      debian/open-iscsi.install:
+      Prevent network interface that contains iscsi root from bouncing
+      during boot or going down during shutdown.
+      Integrates with resolvconf and initramfs code that writes
+      /run/initramfs/open-iscsi.interface
+    - debian/open-iscsi.maintscript: clean up the obsolete
+      iscsi-network-interface upstart job, file on upgrade.
+  * make debian/net-interface-handler executable (LP: #1553017)
+
+ -- Scott Moser <[e-mail]>  Fri, 04 Mar 2016 13:17:45 -0500
+
 open-iscsi (2.0.873+git0.3b4b4500-14) unstable; urgency=medium
 
   [ Christian Seiler ]
@@ -229,6 +818,21 @@ open-iscsi (2.0.873+git0.3b4b4500-14) unstable; urgency=medium
 
  -- Christian Seiler <[e-mail]>  Thu, 03 Mar 2016 18:47:46 +0100
 
+open-iscsi (2.0.873+git0.3b4b4500-13ubuntu1) xenial; urgency=medium
+
+  * Merge from Debian (LP: #1546877). Remaining changes:
+    - debian/tests: Add Ubuntu autopkgtest.
+    - debian/iscsi-network-interface.rules, debian/net-interface-handler,
+      debian/open-iscsi.install:
+      Prevent network interface that contains iscsi root from bouncing
+      during boot or going down during shutdown.
+      Integrates with resolvconf and initramfs code that writes
+      /run/initramfs/open-iscsi.interface
+    - debian/open-iscsi.maintscript: clean up the obsolete
+      iscsi-network-interface upstart job, file on upgrade.
+
+ -- Scott Moser <[e-mail]>  Thu, 18 Feb 2016 00:53:37 -0500
+
 open-iscsi (2.0.873+git0.3b4b4500-13) unstable; urgency=medium
 
   [ Christian Seiler ]
@@ -450,6 +1054,115 @@ open-iscsi (2.0.873+git0.3b4b4500-1) unstable; urgency=low
 
  -- Ritesh Raj Sarraf <[e-mail]>  Tue, 05 Nov 2013 21:45:47 +0530
 
+open-iscsi (2.0.873-3ubuntu13) wily; urgency=medium
+
+  * debian/net-interface-handler: Create the resolvconf dir, to avoid failure
+    when resolvconf did not start yet; the udev rules run in parallel with
+    it. (LP: #1501033)
+
+ -- Martin Pitt <[e-mail]>  Tue, 06 Oct 2015 07:05:48 +0200
+
+open-iscsi (2.0.873-3ubuntu12) wily; urgency=medium
+
+  * Drop debian/ifup@.service.conf again, it ceased to work with net.agent in
+    wily and the whole idea of net-interface-handler is to *stop* ifupdown
+    from fiddling with the iscsi interface. Replace with udev rules
+    (debian/iscsi-network-interface.rules) which achieves this without relying
+    on ifupdown or a particular init system. (LP: #1463461)
+  * Drop debian/open-iscsi.iscsi-network-interface.upstart as well, obsolete
+    now. Also clean it up on upgrades.
+
+ -- Martin Pitt <[e-mail]>  Thu, 11 Jun 2015 11:58:29 +0200
+
+open-iscsi (2.0.873-3ubuntu11) vivid; urgency=medium
+
+  * Factor out logic from debian/open-iscsi.iscsi-network-interface.upstart
+    into debian/net-interface-handler, and install the latter in debian/rules.
+  * Add debian/ifup@.service.conf: Drop-in for ifup@.service to run
+    net-interface-handler under systemd. (LP: #1432829)
+
+ -- Martin Pitt <[e-mail]>  Fri, 27 Mar 2015 09:51:05 +0100
+
+open-iscsi (2.0.873-3ubuntu10) vivid; urgency=medium
+
+  * Start open-iscsi after installation and make sure initiatorname is
+    generated. (Patch backported from Debian)
+  * debian/tests/daemon: Stop calling the init.d script as we expect the
+    daemon to start automatically now.
+
+ -- Martin Pitt <[e-mail]>  Fri, 06 Mar 2015 13:17:26 +0100
+
+open-iscsi (2.0.873-3ubuntu9) trusty; urgency=medium
+
+  * Add missing python test dependency.
+
+ -- Martin Pitt <[e-mail]>  Wed, 26 Feb 2014 16:07:37 +0100
+
+open-iscsi (2.0.873-3ubuntu8) trusty; urgency=medium
+
+  * open-iscsi-udeb: Enable builds on armhf, arm64, ppc64el, x32 (LP: #1274203)
+
+ -- dann frazier <[e-mail]>  Wed, 29 Jan 2014 12:34:45 -0700
+
+open-iscsi (2.0.873-3ubuntu7) saucy; urgency=low
+
+  * Use dh_autotools-dev to update config.sub|guess.
+
+ -- Dmitrijs Ledkovs <[e-mail]>  Fri, 11 Oct 2013 17:03:37 +0100
+
+open-iscsi (2.0.873-3ubuntu6) saucy; urgency=low
+
+  * debian/tests: Add autopkgtest.
+
+ -- Yolanda <[e-mail]>  Mon, 27 May 2013 10:39:35 +0200
+
+open-iscsi (2.0.873-3ubuntu5) quantal-proposed; urgency=low
+
+  * Ensure all udev events have been processed before trying to configure
+    iscsi networking in the initramfs (LP: #1066945): 
+    - debian/extra/initramfs.local-top: Restore wait_for_udev call before
+      configure_networking to ensure network devices are present.
+
+ -- James Page <[e-mail]>  Wed, 17 Oct 2012 12:37:43 +0100
+
+open-iscsi (2.0.873-3ubuntu4) quantal-proposed; urgency=low
+
+  * Generate initiator name on install, not first boot, ensuring that the
+    initramfs built during install contains a valid iSCSI initiator name
+    resulting in a iSCSI based root volume that will actually boot
+    (LP: #1057635):
+    - debian/{rules,initiatorname.iscsi}: Don't install a default
+      initiatorname.iscsi.
+    - debian/open-iscsi.postinst: Generate initiatorname.iscsi on install.
+
+ -- James Page <[e-mail]>  Mon, 15 Oct 2012 12:42:53 +0100
+
+open-iscsi (2.0.873-3ubuntu3) quantal; urgency=low
+
+  * debian/open-iscsi.iscsi-network-interface.upstart: fix bad syntax
+    in 'post-stop'
+
+ -- Scott Moser <[e-mail]>  Mon, 17 Sep 2012 16:50:22 -0400
+
+open-iscsi (2.0.873-3ubuntu2) quantal; urgency=low
+
+  * debian/extra/initramfs.local-top: start writing
+    /run/initramfs/open-iscsi.interface file again (LP: #1050480)
+  * debian/open-iscsi.iscsi-network-interface.upstart: integrate with
+    resolvconf (LP: #1050487)
+
+ -- Scott Moser <[e-mail]>  Mon, 17 Sep 2012 15:46:26 -0400
+
+open-iscsi (2.0.873-3ubuntu1) quantal; urgency=low
+
+  * Merge from Debian. Remaining changes: (LP: #961114, LP: #677333)
+    - Add upstart job iscsi-network-interface
+    - Migrate from /var/run and /lib/init/rw to /run, from /var/lock to
+      /run/lock.
+  * Turn open-iscsi-utils into a transitional package
+
+ -- Stéphane Graber <[e-mail]>  Tue, 10 Jul 2012 13:53:52 -0400
+
 open-iscsi (2.0.873-3) unstable; urgency=low
 
   * [4939401] Fix build to install udeb stuff only on supported architectures
@@ -624,6 +1337,239 @@ open-iscsi (2.0.871-1) unstable; urgency=low
 
  -- Ritesh Raj Sarraf <[e-mail]>  Sat, 06 Feb 2010 20:28:23 +0530
 
+open-iscsi (2.0.871-0ubuntu9) oneiric-proposed; urgency=low
+
+  * Make sure the upstart job triggers ifupdown's upstart script to avoid
+    waiting 2 minutes at boot time for network to come up. (LP: #870214)
+
+ -- Stéphane Graber <[e-mail]>  Tue, 11 Oct 2011 22:31:39 +0100
+
+open-iscsi (2.0.871-0ubuntu8) oneiric; urgency=low
+
+  * Disable open-iscsi init script when root is on iscsi (LP: #838809)
+
+ -- Stéphane Graber <[e-mail]>  Thu, 15 Sep 2011 10:01:12 -0400
+
+open-iscsi (2.0.871-0ubuntu7) oneiric; urgency=low
+
+  * Migrate from /var/run and /lib/init/rw to /run, from /var/lock to
+    /run/lock, and from /dev/.initramfs to /run/initramfs.
+
+ -- Colin Watson <[e-mail]>  Thu, 14 Jul 2011 17:01:42 +0100
+
+open-iscsi (2.0.871-0ubuntu6) oneiric; urgency=low
+
+  * Fix initramfs iSCSI login (many thanks to Amos Hayes for lending me a
+    test system; LP: #728088):
+    - Write out /dev/.initramfs/open-iscsi.interface in the same subshell as
+      configure_networking, so that we can get at the value of DEVICE.
+    - Wait for udev to settle before attempting to configure networking.
+
+ -- Colin Watson <[e-mail]>  Fri, 27 May 2011 23:27:31 +0100
+
+open-iscsi (2.0.871-0ubuntu5) maverick; urgency=low
+
+  * Include <sys/types.h> and <sys/stat.h> in usr/iscsi_sysfs.c for S_*
+    macros (LP: #600953).
+
+ -- Colin Watson <[e-mail]>  Fri, 02 Jul 2010 17:08:14 +0100
+
+open-iscsi (2.0.871-0ubuntu4) lucid; urgency=low
+
+  * Revert ISCSI_NETDEVICE change; it's normally better to select the
+    interface by MAC address (LP: #473036).
+
+ -- Colin Watson <[e-mail]>  Fri, 05 Feb 2010 12:06:06 -0800
+
+open-iscsi (2.0.871-0ubuntu3) lucid; urgency=low
+
+  * If ISCSI_NETDEVICE is set, configure that interface in the initramfs
+    (LP: #473036).
+
+ -- Colin Watson <[e-mail]>  Fri, 22 Jan 2010 17:01:17 +0000
+
+open-iscsi (2.0.871-0ubuntu2) lucid; urgency=low
+
+  * Fix handling of ISCSI_USERNAME, ISCSI_PASSWORD, ISCSI_IN_USERNAME, and
+    ISCSI_IN_PASSWORD in iscsi.initramfs (closes: #525053).
+
+ -- Colin Watson <[e-mail]>  Mon, 14 Dec 2009 12:24:42 +0000
+
+open-iscsi (2.0.871-0ubuntu1) lucid; urgency=low
+
+  * New upstream release.
+  * If the root filesystem is on iSCSI, prevent the network interface used
+    for it from being brought up or down automatically (LP: #457767).
+  * Backport from upstream:
+    - Allow updating of discovery records (Hannes Reinecke).
+    - Fix discovery record use, rather than always using iscsid.conf
+      settings (Mike Christie).
+
+ -- Colin Watson <[e-mail]>  Thu, 10 Dec 2009 18:19:20 +0000
+
+open-iscsi (2.0.870.1-0ubuntu12) karmic; urgency=low
+
+  * debian/open-iscsi-udeb.finish-install: Stop checking
+    disk-detect/iscsi/enable, as that template doesn't exist any more.
+
+ -- Colin Watson <[e-mail]>  Fri, 02 Oct 2009 18:49:18 +0100
+
+open-iscsi (2.0.870.1-0ubuntu11) karmic; urgency=low
+
+  * open-iscsi-utils Replaces: old versions of open-iscsi.
+  * SECURITY UPDATE: temporary file vulnerability (LP: #408915)
+    - utils/iscsi_discovery: store iscsiadm -m discovery result in a
+      variable rather than writing it to an insecurely-created temporary
+      file
+    - CVE-2009-1297
+
+ -- Colin Watson <[e-mail]>  Mon, 24 Aug 2009 23:42:10 +0100
+
+open-iscsi (2.0.870.1-0ubuntu10) karmic; urgency=low
+
+  * debian/control, debian/open-iscsi-utils.install,
+    open-iscsi-utils.manpages : create a new binary package which
+    contains /sbin/iscsiadm, needed for some packages to build against
+    (eg, libvirt), but not containing the init script, LP: #414986
+
+ -- Dustin Kirkland <[e-mail]>  Tue, 18 Aug 2009 08:11:34 -0500
+
+open-iscsi (2.0.870.1-0ubuntu9) karmic; urgency=low
+
+  * debian/open-iscsi.init: don't exit with error if
+    /lib/init/rw/sendsigs.omit.d/ doesn't exist (LP: #414986)
+
+ -- Jamie Strandboge <[e-mail]>  Mon, 17 Aug 2009 14:12:01 -0500
+
+open-iscsi (2.0.870.1-0ubuntu8) karmic; urgency=low
+
+  * Make sure network devices are always included in the initramfs if
+    booting with / on iSCSI.
+  * Retry initramfs network configuration for a while until it works (LP:
+    #237460).
+
+ -- Colin Watson <[e-mail]>  Tue, 11 Aug 2009 13:05:43 +0100
+
+open-iscsi (2.0.870.1-0ubuntu7) karmic; urgency=low
+
+  [ Colin Watson ]
+  * debian/open-iscsi-udeb.postinst, debian/open-iscsi-udeb.templates:
+    Remove; this is being taken over by disk-detect and partman-iscsi.
+  * debian/control: Remove XB-Installer-Menu-Item.
+
+  [ Mathias Gug ]
+  * debian/open-iscsi.postinst: Fix backwards use of update-rc.d (LP:
+    #306678).
+  * debian/open-iscsi.init: Overwrite existing pid file symlinks in
+    /lib/init/rw/sendsigs.omit.d/.
+
+ -- Colin Watson <[e-mail]>  Mon, 10 Aug 2009 13:28:41 +0100
+
+open-iscsi (2.0.870.1-0ubuntu6) karmic; urgency=low
+
+  * utils/iscsi_discovery: Fix several bashisms (test ==, &> redirection,
+    trap with numeric signals).
+
+ -- Colin Watson <[e-mail]>  Tue, 04 Aug 2009 12:30:44 +0100
+
+open-iscsi (2.0.870.1-0ubuntu5) karmic; urgency=low
+
+  * utils/iscsi_discovery: replace uses of awk with other shell voodoo, so
+    that this works in the installer.  LP: #236640.
+  * debian/rules, debian/open-iscsi-udeb.dirs: install the open-isci-udeb
+    finish script to /usr/lib/finish-install.d, not to /lib/finish-install.d.
+  * debian/open-iscsi-udeb.finish-install: copy the config from the root
+    to the correct directory in the target.
+
+ -- Steve Langasek <[e-mail]>  Tue, 07 Jul 2009 22:10:17 -0700
+
+open-iscsi (2.0.870.1-0ubuntu4) karmic; urgency=low
+
+  * debian/extra/initramfs.hook: iscsistart is in /sbin, not /usr/sbin (LP:
+    #364616).
+
+ -- Colin Watson <[e-mail]>  Thu, 02 Jul 2009 14:12:25 +0100
+
+open-iscsi (2.0.870.1-0ubuntu3) jaunty; urgency=low
+
+  * Invoke iscsi-iname using normal $PATH lookup rather than using an
+    incorrect explicit path (see LP #236640).
+
+ -- Colin Watson <[e-mail]>  Thu, 09 Apr 2009 16:49:08 +0100
+
+open-iscsi (2.0.870.1-0ubuntu2) jaunty; urgency=low
+
+  * debian/control: Drop udeb dependency on crypto-modules; as best as I can
+    tell, this is required for crc32c support, which is now built-in to the
+    Ubuntu kernels.
+
+ -- Dustin Kirkland <[e-mail]>  Tue, 03 Feb 2009 11:20:35 +0100
+
+open-iscsi (2.0.870.1-0ubuntu1) jaunty; urgency=low
+
+  * New upstream release:
+   - Support 2.6.26/27 kernels (LP: #289470).
+   - Fix iscsid shutdown (LP: #181188).
+  * Merge from Debian. Remaining Ubuntu changes:
+   - Note: Debian version isn't 870~rc3 but 869.2 which leads to a big
+     .diff.gz file. Only files in debian/ have been considered for this merge
+     since debian hasn't patched the source.
+   - debian/control, debian/rules, debian/open-iscsi-udeb*:
+     + Add open-iscsi-udeb.
+   - debian/open-iscsi.dirs:
+     + rename dirs to open-iscsi.dirs because of open-iscsi-udeb addition.
+     + drop network/if-up.d/ directory since we're using symlinks instead.
+     + utilities installed in /bin,/sbin rather than /usr/bin,/usr/sbin.
+   - debian/open-iscsi.init:
+     + utilities installed in /bin,/sbin rather than /usr/bin,/usr/sbin.
+     + lsb log messages.
+     + Don't generate initiatorname name (moved to postinst).
+     + Support for being called from ifup/ifdown scripts.
+     + Refactor start functions:
+       - move daemon start to startdaemon function.
+       - call udevadm settle rather then udevsettle (which doesn't do anything
+         useful).
+       - don't exit if the daemon is already running during sanitychecks.
+         Instead check in startdaemon if the daemon needs to be started.
+       - only start automatic targets if necessary.
+       - add waitfordevices function: called during rcS, waits for all 
+         automatic targets to be ready. Iscsi targets are considered as
+         local block devices - they don't need to be marked with _netdev in
+         fstab. (LP: #227848) 
+       - start targets if not run from rcS.
+     + Check status of iscsid daemon in addition to listing the iscsi sessions 
+       when status action is called.  
+     + Add iscsid to the list of processes that should not be killed by
+       sendsigs during shutdown (LP: #192080).
+     + Add starttargets, stoptargets and restarttargets to usage message.
+   - debian/rules:
+     + Install utilities /bin,/sbin rather than /usr/bin,/usr/sbin.
+     + Start open-iscsi at S25 (waiting for devices created by ifupdown
+       calls and before local filesystems are checked and mounted)
+     + stop at S41 (after local filesystems are unmounted). Don't use 
+       umountiscsi.sh script from debian. (LP: #192080).
+   - debian/initiatorname.iscsi, debian/open-iscsi.postinst:
+     + Generate the random initiatorname during postinstall rather than in the
+     init script.
+     + Don't ship a default initiatorname.iscsi file.
+   - debian/open-iscsi.postinst:
+     + fix init script ordering on upgrades.
+   - debian/open-iscsi.links:
+     + symlink open-iscsi init script in if-up.d and if-down.d directory so
+       that the iscsi subsystem is started/stopped when network interfaces 
+       are configured.
+   - debian/open-iscsi.postrm:
+     + delete iscsi configuration when the package is purged.
+   - utils/iscsi_discovery: De-bashify iscsi_discovery.
+   - usr/idbm.c: Fix build failure with new glibc. LP: #299843.
+  * Dropped:
+   - Exit without error if /sys is not available. Otherwise, it's not possible
+     to use this package as a build-dependency (in Debian).
+   - Drop upstream url in long description now that it's in the Homepage
+     field (in Debian).
+
+ -- Mathias Gug <[e-mail]>  Mon, 01 Dec 2008 10:45:03 -0500
+
 open-iscsi (2.0.870~rc3-0.6) unstable; urgency=low
 
   * Non-maintainer upload.
@@ -723,6 +1669,47 @@ open-iscsi (2.0.869~rc4-1) experimental; urgency=low
 
  -- Philipp Hug <[e-mail]>  Sat, 12 Apr 2008 15:53:12 +0200
 
+open-iscsi (2.0.865-1ubuntu5) jaunty; urgency=low
+
+  * Fix build failure with new glibc. LP: #299843.
+
+ -- Matthias Klose <[e-mail]>  Thu, 27 Nov 2008 15:58:15 +0100
+
+open-iscsi (2.0.865-1ubuntu4) intrepid; urgency=low
+
+  * Exit without error if /sys is not available. Otherwise, it's not possible
+    to use this package as a build-dependency.
+
+ -- Soren Hansen <[e-mail]>  Fri, 02 May 2008 00:57:02 +0200
+
+open-iscsi (2.0.865-1ubuntu3) hardy; urgency=low
+
+  * Migration of /usr/{bin,sbin,lib} -> to /{bin,sbin,lib}. 
+    (LP: #208441)
+  * Push the shutdown scripts back. (LP: #196748)
+  * Update control to 3.7.3.
+  * Updated the maintainer according to spec. 
+
+ -- Chuck Short <[e-mail]>  Wed, 09 Apr 2008 18:09:28 -0400
+
+open-iscsi (2.0.865-1ubuntu2) hardy; urgency=low
+
+  * Fixed init script to point to the right iscsiadm. (LP: #206520) 
+
+ -- Chuck Short <[e-mail]>  Tue, 25 Mar 2008 09:53:08 -0400
+
+open-iscsi (2.0.865-1ubuntu1) hardy; urgency=low
+
+  * Add open-iscsi-udeb.
+  * Include iscsi_discovery.
+  * De-bashify iscsi_discovery.
+  * Start open-iscsi in single user mode.
+  * Properly lsb-ify init script.
+  * Modify Maintainer value to match the DebianMaintainerField
+    specification.
+
+ -- Soren Hansen <[e-mail]>  Fri, 08 Feb 2008 11:56:11 +0100
+
 open-iscsi (2.0.865-1) unstable; urgency=low
 
   * New upstream release
diff --git a/debian/control b/debian/control
index 66645ef..70565f2 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: open-iscsi
 Section: net
 Priority: optional
-Maintainer: Debian iSCSI Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian iSCSI Maintainers <[e-mail]>
 Uploaders: Ritesh Raj Sarraf <[e-mail]>,
            Christian Seiler <[e-mail]>
 Build-Depends: bison,
@@ -29,6 +30,7 @@ Depends: ${misc:Depends},
          ${shlibs:Depends},
          libopeniscsiusr,
          udev
+Recommends: ${busybox:Recommends}, finalrd (>= 3)
 Pre-Depends: debconf | debconf-2.0
 Description: iSCSI initiator tools
  The Open-iSCSI project is a high-performance, transport independent,
@@ -136,7 +138,7 @@ Package: open-iscsi-udeb
 #       linux kernel udebs) must exist for these architectures - so
 #       check that before adding them to this list; the other
 #       scsi-(core|common|...)-modules are NOT sufficient!
-Architecture: amd64 arm64 armhf i386 ia64 mips mipsel powerpc ppc64 ppc64el s390x
+Architecture: amd64 arm64 armhf ia64 mips mipsel powerpc ppc64 ppc64el s390x
 Section: debian-installer
 Package-Type: udeb
 Depends: ${misc:Depends},
diff --git a/debian/dirs b/debian/dirs
deleted file mode 100644
index 0f7e9be..0000000
--- a/debian/dirs
+++ /dev/null
@@ -1,8 +0,0 @@
-etc/default
-etc/init.d
-etc/iscsi
-etc/network/if-up.d
-lib/modules-load.d
-lib/open-iscsi
-usr/share/initramfs-tools/hooks/
-usr/share/initramfs-tools/scripts/local-top/
diff --git a/debian/docs b/debian/docs
deleted file mode 100644
index dde07eb..0000000
--- a/debian/docs
+++ /dev/null
@@ -1,3 +0,0 @@
-README
-sysfs-documentation
-THANKS
diff --git a/debian/extra/initramfs.hook b/debian/extra/initramfs.hook
index 6a430eb..7458571 100755
--- a/debian/extra/initramfs.hook
+++ b/debian/extra/initramfs.hook
@@ -32,7 +32,7 @@ if [ -r /etc/iscsi/iscsi.initramfs ] ; then
 	cp /etc/iscsi/iscsi.initramfs $DESTDIR/etc
 fi
 
-for x in crc32c libcrc32c iscsi_tcp libiscsi scsi_transport_iscsi iscsi_ibft; do
+for x in crc32c libcrc32c ib_iser iscsi_tcp libiscsi scsi_transport_iscsi iscsi_ibft; do
 	manual_add_modules ${x}
 done
 for x in cxgb3i cxgb4i; do
diff --git a/debian/extra/initramfs.local-bottom b/debian/extra/initramfs.local-bottom
index c32e5fe..06ddc56 100755
--- a/debian/extra/initramfs.local-bottom
+++ b/debian/extra/initramfs.local-bottom
@@ -7,4 +7,24 @@ if [ -x /sbin/iscsiuio ] && [ -e /run/initramfs/iscsiuio.pid ] ; then
 		--name iscsiuio --exec /sbin/iscsiuio || :
 fi
 
+# Remove the interface file if no disks are present
+if [ -f /run/initramfs/open-iscsi.interface ] ; then
+	found=0
+	for disk in /dev/disk/by-path/*-iscsi-*; do
+		if [ ! -e "$disk" ] ; then
+			# If we have no matches, we stil go through the for loop once with
+			# the pattern as a string
+			continue
+		fi
+		if ! readlink -f "$disk" > /dev/null ; then
+			continue
+		fi
+		found=1
+		break;
+	done
+	if [ $found = 0 ] ; then
+		rm /run/initramfs/open-iscsi.interface
+	fi
+fi
+
 exit 0
diff --git a/debian/extra/initramfs.local-top b/debian/extra/initramfs.local-top
index 1045c50..9f3af32 100755
--- a/debian/extra/initramfs.local-top
+++ b/debian/extra/initramfs.local-top
@@ -93,6 +93,7 @@ do_iscsi_login ()
 	. /scripts/functions
 
 	udevadm settle
+	IBFT_DHCP_DEVICE=""
 
 	if [ -n "$ISCSI_AUTO" ] ; then
 		# try to auto-configure network interface based
@@ -136,7 +137,13 @@ do_iscsi_login ()
 					echo "UPTIME='${UPTIME}'"
 					echo "DHCPLEASETIME='${DHCPLEASETIME}'"
 					echo "DOMAINSEARCH=''"
-				} > "/run/net-${DEVICE}.conf"
+				} > "/run/net-${DEVICE}.conf.ibft"
+				if [ "$PROTO" != "dhcp" -a "$DHCPLEASETIME" = "0" ]; then
+					# this is static ibft configuration.
+					mv "/run/net-${DEVICE}.conf.ibft" "/run/net-${DEVICE}.conf"
+				else
+					IBFT_DHCP_DEVICE="$DEVICE"
+				fi
 				echo "${DEVICE}" > /run/initramfs/open-iscsi.interface
 				# iscsistart -N doesn't set the default gateway. Therefore,
 				# we need to add it ourselves. However, the ip command is
@@ -172,9 +179,23 @@ do_iscsi_login ()
 
 	# run configure_networking even if we have iscsi_auto, because there
 	# could be other network interfaces that need to be configured
-	# manually
+	# also, if we set up DHCP iBFT, we need ipconfig to run so it creates
+	# a proper /run/net-${DEVICE}.conf file that includes the DNS search
+	# domain, which we don't get in our iBFT data (see LP: #1806777)
 	configure_networking
 
+	if [ -n "$IBFT_DHCP_DEVICE" ]; then
+		if ! [ -e "/run/net-${DEVICE}.conf" ] ; then
+			echo "WARN: ipconfig dhcp failed, using iSCSI iBFT config - DNS search domain may be missing at runtime" >&2
+			# We have DHCP iBFT, but ipconfig DHCP failed;
+			# so we should fallback to just using the iBFT config,
+			# though that will not include the DNS search domain
+			mv "/run/net-${DEVICE}.conf.ibft" "/run/net-${DEVICE}.conf"
+			# need to re-run configure_networking to process conf file
+			configure_networking
+		fi
+	fi
+
 	# Save network device we configured via configure_networking, but only
 	# if we didn't already get one from autoconfiguration (then we always
 	# prefer that).
@@ -186,6 +207,13 @@ do_iscsi_login ()
 		fi
 		if [ -n "${DEVICE}" ] ; then
 			echo "${DEVICE}" > /run/initramfs/open-iscsi.interface
+                else
+			for i in /run/net6-*.conf; do
+				[ -e "${i}" ] && { . "${i}" ; break ; }
+			done
+		fi
+		if [ -z "${DEVICE}" ] && [ -n "${DEVICE6}" ] ; then
+			echo "${DEVICE6}" > /run/initramfs/open-iscsi.interface
 		fi
 	fi
 
diff --git a/debian/extra/net-interface-handler b/debian/extra/net-interface-handler
new file mode 100755
index 0000000..9cd6e1e
--- /dev/null
+++ b/debian/extra/net-interface-handler
@@ -0,0 +1,80 @@
+#!/bin/sh -e
+# suppress configuration of network interface used
+# by iSCSI root device
+#
+# If the root filesystem is on iSCSI, then we must take care to avoid
+# changing the state of its network interface. To this end, the initramfs
+# leaves a note for us which interface was used, and we mangle
+# /run/network/ifstate manually to stop it being brought up or down
+# automatically. This is a slight layering violation, but, unfortunately,
+# ifupdown appears to have no way to do this without also running
+# /etc/network/*.d/ scripts.
+
+assert_interface() {
+    # udev sets INTERFACE to the name of the currently-processed nic.
+    [ -n "$INTERFACE" ] && return 0
+    echo "environment variable INTERFACE not set." 1>&2;
+    return 1
+}
+
+start() {
+    CR="
+"
+    assert_interface || return
+    ifile=/run/initramfs/open-iscsi.interface
+
+    [ -f "$ifile" ] && read iface < "$ifile" || return 0
+    [ "$INTERFACE" = "$iface" ] || return
+
+    if ! grep -qs "^$iface=" /run/network/ifstate; then
+        mkdir -p /run/network
+        echo "$iface=$iface" >>/run/network/ifstate
+
+        if [ -f /run/net-$iface.conf ]; then
+            conf=/run/net-$iface.conf
+        elif [ -f /run/net6-$iface.conf ]; then
+            conf=/run/net6-$iface.conf
+        else
+            conf=""
+        fi
+        if command -v resolvconf >/dev/null &&
+           [ -n "$conf" ]; then
+            . "$conf"
+            R=""
+            [ -n "$DOMAINSEARCH" ] && R="$R${CR}search $DOMAINSEARCH"
+            [ -n "$IPV6DOMAINSEARCH" ] && R="$R${CR}search $IPV6DOMAINSEARCH"
+            for ns in "$IPV4DNS0" "$IPV4DNS1" "$IPV6DNS0" "$IPV6DNS1"; do
+                [ -n "$ns" -a "$ns" != "0.0.0.0" ] && R="$R${CR}nameserver $ns"
+            done
+            if [ -n "$R" ]; then
+                # create the dir in case resolvconf did not start yet
+                mkdir -p /run/resolvconf/interface
+                resolvconf -a $iface.iscsi-network <<EOF
+${R#${CR}}
+EOF
+            fi
+        fi
+    fi
+}
+
+stop() {
+    assert_interface || return
+    ifile=/run/initramfs/open-iscsi.interface
+    [ -f "$ifile" ] && read iface < "$ifile" || return 0
+    [ "$INTERFACE" = "$iface" ] || return
+
+    if grep -qs "^$iface=" /run/network/ifstate; then
+        grep -v "^$iface=" /run/network/ifstate >/run/network/.ifstate.tmp || true
+        mv /run/network/.ifstate.tmp /run/network/ifstate
+
+        if command -v resolvconf >/dev/null; then
+            resolvconf -d $iface.iscsi-network
+        fi
+    fi
+}
+
+case "$1" in
+    start) start ;;
+    stop) stop ;;
+    *) echo "ERROR: must be called with 'start' or 'stop'" >&2; exit 1 ;;
+esac
diff --git a/debian/iscsi-network-interface.rules b/debian/iscsi-network-interface.rules
new file mode 100644
index 0000000..e0408d7
--- /dev/null
+++ b/debian/iscsi-network-interface.rules
@@ -0,0 +1,3 @@
+# run before 80-networking.rules to run before ifupdown
+SUBSYSTEM=="net", ACTION=="add", RUN+="/lib/open-iscsi/net-interface-handler start"
+SUBSYSTEM=="net", ACTION=="remove", RUN+="/lib/open-iscsi/net-interface-handler stop"
diff --git a/debian/iscsid.service b/debian/iscsid.service
index d05953d..c98fd7e 100644
--- a/debian/iscsid.service
+++ b/debian/iscsid.service
@@ -7,13 +7,13 @@ After=network.target network-online.target
 DefaultDependencies=no
 Conflicts=shutdown.target
 Before=shutdown.target
+ConditionVirtualization=!private-users
 
 [Service]
 Type=forking
 PIDFile=/run/iscsid.pid
 ExecStartPre=/lib/open-iscsi/startup-checks.sh
 ExecStart=/sbin/iscsid
-ExecStop=/sbin/iscsiadm -k 0 2
 
 [Install]
 WantedBy=sysinit.target
diff --git a/debian/iscsiuio.docs b/debian/iscsiuio.docs
deleted file mode 100644
index 1067403..0000000
--- a/debian/iscsiuio.docs
+++ /dev/null
@@ -1,2 +0,0 @@
-iscsiuio/RELEASE.TXT
-iscsiuio/README
diff --git a/debian/iscsiuio.install b/debian/iscsiuio.install
deleted file mode 100755
index ecd9f4a..0000000
--- a/debian/iscsiuio.install
+++ /dev/null
@@ -1,3 +0,0 @@
-#!/usr/bin/dh-exec
-iscsiuio/src/unix/iscsiuio                /sbin
-debian/extra/iscsiuio.initramfs.hook   => /usr/share/initramfs-tools/hooks/iscsiuio
diff --git a/debian/iscsiuio.manpages b/debian/iscsiuio.manpages
deleted file mode 100644
index 788a438..0000000
--- a/debian/iscsiuio.manpages
+++ /dev/null
@@ -1 +0,0 @@
-iscsiuio/docs/iscsiuio.8
diff --git a/debian/manpages b/debian/manpages
deleted file mode 100644
index a01cd9a..0000000
--- a/debian/manpages
+++ /dev/null
@@ -1,5 +0,0 @@
-doc/iscsi-iname.8
-doc/iscsi_discovery.8
-doc/iscsiadm.8
-doc/iscsid.8
-doc/iscsistart.8
diff --git a/debian/open-iscsi-udeb.dirs b/debian/open-iscsi-udeb.dirs
deleted file mode 100644
index f094192..0000000
--- a/debian/open-iscsi-udeb.dirs
+++ /dev/null
@@ -1,4 +0,0 @@
-bin
-etc/iscsi
-sbin
-usr/lib/finish-install.d
diff --git a/debian/open-iscsi-udeb.install b/debian/open-iscsi-udeb.install
deleted file mode 100755
index 9847b88..0000000
--- a/debian/open-iscsi-udeb.install
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/usr/bin/dh-exec
-usr/iscsiadm                                 /bin
-utils/iscsi-iname                            /sbin
-utils/iscsi_discovery                        /sbin
-usr/iscsid                                   /sbin
-usr/iscsistart                               /sbin
-etc/iscsid.conf                              /etc/iscsi
-debian/open-iscsi-udeb.start              => /sbin/iscsi-start
-debian/open-iscsi-udeb.finish-install     => /usr/lib/finish-install.d/10open-iscsi
-# dh_lintian ignores udebs, force installation
-debian/open-iscsi-udeb.lintian-overrides  => /usr/share/lintian/overrides/open-iscsi-udeb
diff --git a/debian/open-iscsi-udeb.lintian-overrides b/debian/open-iscsi-udeb.lintian-overrides
deleted file mode 100644
index a76bddf..0000000
--- a/debian/open-iscsi-udeb.lintian-overrides
+++ /dev/null
@@ -1 +0,0 @@
-open-iscsi-udeb udeb: non-standard-file-perm etc/iscsi/iscsid.conf 0600 != 0644
diff --git a/debian/open-iscsi.finalrd b/debian/open-iscsi.finalrd
new file mode 100755
index 0000000..d8c8a21
--- /dev/null
+++ b/debian/open-iscsi.finalrd
@@ -0,0 +1,40 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-3.0-only
+
+set -e
+
+if [ "$1" = "setup" ]
+then
+    . /usr/share/initramfs-tools/hook-functions
+    copy_exec /bin/grep
+    copy_exec /bin/sleep
+    copy_exec /sbin/iscsiadm
+    copy_exec /sbin/iscsid
+    # hm, not sure why expr is copied
+    copy_exec /usr/bin/expr
+    copy_file config /etc/iscsi/iscsid.conf
+    copy_file config /etc/iscsi/initiatorname.iscsi
+    exit 0
+fi
+
+# re-establish connection and logout during shutdown
+# if initramfs did bring up open-iscsi on boot
+[ -f /open-iscsi.interface ] || exit 0
+
+iscsid
+
+# After restarting iscsid, wait for an active connection.
+# Limit the wait time in case of unexpected failure of iscsid.
+MAX_RETRIES=30
+RETRY=0
+while ! iscsiadm -m session -P 1 | grep -q "iSCSI Connection State: LOGGED IN"; do
+    RETRY=$(($RETRY + 1))
+    if [ $RETRY -gt $MAX_RETRIES ]; then
+        echo "Unexpected iSCSI Connection State, forcing iSCSI logout."
+        break
+    fi
+    sleep 1
+done
+
+# Issue an iSCSI logout.
+iscsiadm -m node -u
diff --git a/debian/open-iscsi.install b/debian/open-iscsi.install
deleted file mode 100755
index 8e2a7d6..0000000
--- a/debian/open-iscsi.install
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/usr/bin/dh-exec
-usr/iscsiadm                           /sbin
-build.deb/iscsid                       /sbin
-build.deb/iscsistart                   /sbin
-utils/iscsi_discovery                  /sbin
-utils/iscsi-iname                      /sbin
-etc/iscsid.conf                        /etc/iscsi
-debian/extra/initramfs.hook         => /usr/share/initramfs-tools/hooks/iscsi
-debian/extra/initramfs.local-top    => /usr/share/initramfs-tools/scripts/local-top/iscsi
-debian/extra/initramfs.local-bottom => /usr/share/initramfs-tools/scripts/local-bottom/iscsi
-debian/extra/umountiscsi.sh            /lib/open-iscsi
-debian/extra/logout-all.sh             /lib/open-iscsi
-debian/extra/startup-checks.sh         /lib/open-iscsi
-debian/extra/activate-storage.sh       /lib/open-iscsi
-debian/open-iscsi.kmod              => /lib/modules-load.d/open-iscsi.conf
diff --git a/debian/open-iscsi.kmod b/debian/open-iscsi.kmod
deleted file mode 100644
index c5f90f3..0000000
--- a/debian/open-iscsi.kmod
+++ /dev/null
@@ -1,2 +0,0 @@
-iscsi_tcp
-ib_iser
diff --git a/debian/open-iscsi.links b/debian/open-iscsi.links
deleted file mode 100644
index 96e050d..0000000
--- a/debian/open-iscsi.links
+++ /dev/null
@@ -1 +0,0 @@
-sbin/iscsiadm usr/bin/iscsiadm
diff --git a/debian/open-iscsi.lintian-overrides b/debian/open-iscsi.lintian-overrides
deleted file mode 100644
index 80b7911..0000000
--- a/debian/open-iscsi.lintian-overrides
+++ /dev/null
@@ -1,5 +0,0 @@
-open-iscsi: non-standard-file-perm etc/iscsi/iscsid.conf 0600 != 0644
-open-iscsi: postinst-uses-db-input
-
-# See discussion in Bug #797860
-open-iscsi: too-long-extended-description-in-templates open-iscsi/remove_even_with_active_sessions
diff --git a/debian/open-iscsi.maintscript b/debian/open-iscsi.maintscript
deleted file mode 100644
index c079324..0000000
--- a/debian/open-iscsi.maintscript
+++ /dev/null
@@ -1 +0,0 @@
-rm_conffile /etc/init.d/umountiscsi.sh 2.0.873+git0.3b4b4500-9
diff --git a/debian/open-iscsi.postinst b/debian/open-iscsi.postinst
index f9867d4..505f7c1 100644
--- a/debian/open-iscsi.postinst
+++ b/debian/open-iscsi.postinst
@@ -17,16 +17,6 @@ restore_old_timeouts()
 case "$1" in
     configure)
 
-        # We switched over to modules-load.d logic, this is needed
-        MODULES_FILE=/lib/modules-load.d/open-iscsi.conf
-        if [ -f /etc/modules-load.d/open-iscsi.conf ] ; then
-            MODULES_FILE=/etc/modules-load.d/open-iscsi.conf
-        fi
-        grep '^[^#]' $MODULES_FILE | while read module args ; do
-            [ "$module" ] || continue
-            modprobe $module $args >/dev/null 2>&1 || true
-        done
-
         # Compatibility symlinks
         for file in iscsid iscsi_discovery iscsi-iname iscsistart; do
             if [ ! -e /usr/sbin/$file ]; then
@@ -65,7 +55,9 @@ esac
 
 #DEBHELPER#
 
-if [ "$1" = configure ] ; then
+if [ "$1" = configure ] && [ -n "$2" ] && [ -d /run/systemd/system ] &&
+    systemctl is-active iscsid.service > /dev/null
+then
     # There already is a check in preinst with a debconf prompt that
     # allows the administrator to abort. Don't abort here, because
     # leaving the package in a half-configured state is probably worse.
@@ -109,25 +101,9 @@ if [ "$1" = configure ] ; then
     # Just in case something goes wrong:
     sync
 
-    # Note: 3>&- is required because iscsid doesn't close unused
-    #       FDs, but debconf/confmodule will make the fd 3 point to
-    #       the original stdout (and stdout to stderr) to make sure
-    #       no program accidentally issues a command on stdout. On
-    #       sysvinit systems this combination (iscsid not closing
-    #       fds, fd 3 remaining open) will cause dpkg to wait
-    #       forever for the maintscript to finish. (iscsid keeps
-    #       this end of the pipe open even though the maintscript
-    #       is finished, so dpkg will never receive a POLLHUP on
-    #       its end of the pipe, waiting forever.) Closing fd 3
-    #       here is the simplest solution. This issue does not
-    #       occur with other init systems, since they start
-    #       services in a clean environment without any extraneous
-    #       open fds.
-    if [ -n "$2" ]; then
-        invoke-rc.d iscsid restart 3>&-
-    else
-        invoke-rc.d iscsid start 3>&-
-    fi
+    # we want to be able to be explicit to start .service, but follow policy.d
+    # therefore use deb-systemd-invoke
+    deb-systemd-invoke restart iscsid.service || true
 
     RETRIES=0
     while cat /sys/class/iscsi_session/session*/state 2>/dev/null | grep -qv LOGGED_IN ; do
@@ -149,17 +125,26 @@ if [ "$1" = configure ] ; then
 
     restore_old_timeouts
     trap - EXIT
+fi
 
-    # Don't restart (and therefore stop) open-iscsi, because we don't
-    # want to logout from targets during a simple upgrade. But also,
-    # if for some reason there's some misconfigured target in the
-    # config that couldn't be activated, don't break postinst, so
-    # ignore the exit code.
-    # See above for why 3>&- is here. (Technically it's not required
-    # for postinst to work, but vgchange likes to complain about leaked
-    # file descriptors, and we don't need to show that message to the
-    # user.)
-    invoke-rc.d open-iscsi start 3>&- || true
+if [ "$1" = configure ]; then
+    # With socket based activation one wants iscsid.socket to be active
+    # But on upgrades the iscsid.service might already be active
+    # Due to that directly starting iscsid.socket might fail:
+    #   systemd[1]: iscsid.socket: Socket service iscsid.service already active, refusing.
+    # Therefore check if iscsid.service is:
+    # - active:
+    #    - ok for now, do not start iscsid.socket as it would conflict
+    #    - on a reboot .socket will be started as it is enabled
+    # - inactive:
+    #    - start iscsid.socket - to be ready
+    # In both cases:
+    #    - disable iscsid.service so it only starts by the socket after reboot
+    if [ -d /run/systemd/system ]; then
+        if ! systemctl is-active iscsid.service > /dev/null; then
+            deb-systemd-invoke start iscsid.socket || true
+        fi
+    fi
 fi
 
 exit 0
diff --git a/debian/open-iscsi.service b/debian/open-iscsi.service
index a62825e..06f83fe 100644
--- a/debian/open-iscsi.service
+++ b/debian/open-iscsi.service
@@ -1,12 +1,16 @@
 [Unit]
 Description=Login to default iSCSI targets
 Documentation=man:iscsiadm(8) man:iscsid(8)
-Wants=network-online.target remote-fs-pre.target iscsid.service
+Wants=network-online.target remote-fs-pre.target
 After=network-online.target iscsid.service
 Before=remote-fs-pre.target
 DefaultDependencies=no
 Conflicts=shutdown.target
 Before=shutdown.target
+# Must have some pre-defined targets to login to
+ConditionDirectoryNotEmpty=|/etc/iscsi/nodes
+# or have a session to use via iscsid
+ConditionDirectoryNotEmpty=|/sys/class/iscsi_session
 
 [Service]
 Type=oneshot
@@ -15,11 +19,7 @@ RemainAfterExit=true
 # and 15 if a session is alread logged in (which we do not
 # consider an error)
 SuccessExitStatus=15 21
-# iscsiadm will only work if iscsid is running. But we can't use a
-# Requires= dependency, since restarts of iscsid would then be
-# propagated to this service - and that would cause all sorts of
-# mayhem. Therefore, check it in ExecStartPre.
-ExecStartPre=/bin/systemctl --quiet is-active iscsid.service
+# Note: iscsid will be socket activated by iscsiadm
 ExecStart=/sbin/iscsiadm -m node --loginall=automatic
 ExecStart=/lib/open-iscsi/activate-storage.sh
 ExecStop=/lib/open-iscsi/umountiscsi.sh
diff --git a/debian/patches/bugfixes/fix_iscsiuio_long_options.patch b/debian/patches/bugfixes/fix_iscsiuio_long_options.patch
deleted file mode 100644
index 6d01e4e..0000000
--- a/debian/patches/bugfixes/fix_iscsiuio_long_options.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-Description: Fix iscsiuio long options
-Author: Andrew Patterson <[e-mail]>
-Bug: https://groups.google.com/forum/?_escaped_fragment_=msg/open-iscsi/PsT65Z4$
-Bug-Debian: https://bugs.debian.org/850057
-Last-Update: 2017-01-24
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- a/iscsiuio/src/unix/main.c
-+++ b/iscsiuio/src/unix/main.c
-@@ -82,10 +82,12 @@
-  *  Global Variables
-  ******************************************************************************/
- static const struct option long_options[] = {
--	{"debug", 0, 0, 0},
--	{"version", 0, 0, 0},
--	{"help", 0, 0, 0},
--	{0, 0, 0, 0}
-+	{"foreground", no_argument, NULL, 'f'},
-+	{"debug", required_argument, NULL, 'd'},
-+	{"pid", required_argument, NULL, 'p'},
-+	{"version", no_argument, NULL, 'v'},
-+	{"help", no_argument, NULL, 'h'},
-+	{NULL, no_argument, NULL, 0}
- };
- 
- struct options opt = {
-@@ -172,7 +174,7 @@
- 	printf("iscsiuio daemon.\n"
- 	       "-f, --foreground        make the program run in the foreground\n"
- 	       "-d, --debug debuglevel  print debugging information\n"
--	       "-p, --pid=pidfile       use pid file (default  %s).\n"
-+	       "-p, --pid pidfile       use pid file (default  %s).\n"
- 	       "-h, --help              display this help and exit\n"
- 	       "-v, --version           display version and exit\n",
- 	       default_pid_filepath);
---- a/iscsiuio/docs/iscsiuio.8
-+++ b/iscsiuio/docs/iscsiuio.8
-@@ -45,7 +45,7 @@
- .SH PARAMETERS
- There are very few parameters when running this application.
- .TP
--.BI -d <debug level>
-+.BI -d|--debug <debug level>
- This is to enable debug mode where debug messages will be sent to stdout
- The following debug modes are supported
- .P
-@@ -61,20 +61,20 @@
- .PP
- .TP
- .TP
--.BI -f
-+.BI -f|--foreground
- This is to enable foreground mode so that this application doesn't get sent
- into the background.
- .PP
- .TP
--.BI -v
-+.BI -v|--version
- This is to print the version.
- .PP
- .TP
--.BI -p <pidfile>
-+.BI -p|--pid <pidfile>
- Use pidfile (default  /var/run/iscsiuio.pid )
- .PP
- .TP
--.BI -h
-+.BI -h|--help
- Display this help and exit.
- 
- 
diff --git a/debian/patches/bugfixes/move_offload_discovery_to_fw_get_targets.patch b/debian/patches/bugfixes/move_offload_discovery_to_fw_get_targets.patch
deleted file mode 100644
index 135db12..0000000
--- a/debian/patches/bugfixes/move_offload_discovery_to_fw_get_targets.patch
+++ /dev/null
@@ -1,91 +0,0 @@
-Description: Move iscsistart offload discovery/setup to fw_get_targets()
-Author: Andrew Patterson <[e-mail]>
-Bug: https://groups.google.com/forum/?_escaped_fragment_=msg/open-iscsi/PsT65Z4$
-Bug-Debian: https://bugs.debian.org/850057
-Last-Update: 2017-01-24
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- a/utils/fwparam_ibft/fw_entry.c
-+++ b/utils/fwparam_ibft/fw_entry.c
-@@ -64,26 +64,40 @@
- 	 * For each target in iBFT bring up required NIC and use routing
- 	 * to force iSCSI traffic through correct NIC
- 	 */
--	list_for_each_entry(context, &targets, list) {			
--		/* if it is a offload nic ignore it */
--		if (!net_get_transport_name_from_netdev(context->iface,
--							transport))
--			continue;
--
-+	list_for_each_entry(context, &targets, list) {
- 		if (iface_prev == NULL || strcmp(context->iface, iface_prev)) {
--			/* Note: test above works because there is a
--			 * maximum of two targets in the iBFT
--			 */
--			iface_prev = context->iface;
--			needs_bringup = 1;
-+				/* Note: test above works because there is a
-+				 * maximum of two targets in the iBFT
-+				 */
-+				iface_prev = context->iface;
-+				needs_bringup = 1;
- 		}
-+		if (net_get_transport_name_from_netdev(context->iface, transport)) {
-+			/* Setup software NIC, */
-+			printf("Setting up software interface %s\n", context->iface);
-+			err = net_setup_netdev(context->iface, context->ipaddr,
-+								   context->mask, context->gateway,
-+								   context->vlan,
-+								   context->target_ipaddr, needs_bringup);
-+			if (err) {
-+				printf("Setting up software interface %s failed\n",
-+						   context->iface);
-+				ret = err;
-+			}
-+		} else {
-+			/* Setup offload NIC. */
-+			struct iface_rec iface;
-+
-+			memset(&iface, 0, sizeof(iface));
-+			iface_setup_defaults(&iface);
-+			printf("Setting up offload interface %s\n", context->iface);
-+			if (!iface_setup_from_boot_context(&iface, context)) {
-+					printf("Setting up offload interface %s failed\n",
-+						   context->iface);
- 
--		err = net_setup_netdev(context->iface, context->ipaddr,
--				       context->mask, context->gateway,
--				       context->vlan,
--				       context->target_ipaddr, needs_bringup);
--		if (err)
--			ret = err;
-+					ret = ISCSI_ERR;
-+			}
-+		}
- 	}
- 
- 	fw_free_targets(&targets);
-@@ -147,11 +161,7 @@
- 
- static void dump_initiator(struct boot_context *context)
- {
--	struct iface_rec iface;
--
--	memset(&iface, 0, sizeof(iface));
--	iface_setup_defaults(&iface);
--	iface_setup_from_boot_context(&iface, context);
-+	char transport_name[ISCSI_TRANSPORT_NAME_MAXLEN];
- 
- 	if (strlen(context->initiatorname))
- 		printf("%s = %s\n", IFACE_INAME, context->initiatorname);
-@@ -159,7 +169,9 @@
- 	if (strlen(context->isid))
- 		printf("%s = %s\n", IFACE_ISID, context->isid);
- 
--	printf("%s = %s\n", IFACE_TRANSPORTNAME, iface.transport_name);
-+	memset(transport_name, 0, ISCSI_TRANSPORT_NAME_MAXLEN);
-+	if (!net_get_transport_name_from_netdev(context->iface, transport_name))
-+		printf("%s = %s\n", IFACE_TRANSPORTNAME, transport_name);
- }
- 
- static void dump_target(struct boot_context *context)
diff --git a/debian/patches/bugfixes/need_iscsiuio_for_hardware_offload.patch b/debian/patches/bugfixes/need_iscsiuio_for_hardware_offload.patch
deleted file mode 100644
index c8a1d6f..0000000
--- a/debian/patches/bugfixes/need_iscsiuio_for_hardware_offload.patch
+++ /dev/null
@@ -1,50 +0,0 @@
-Description: iscsiuio must be present to use hardware offload for bnx2x
-Author: Andrew Patterson <[e-mail]>
-Bug: https://groups.google.com/forum/?_escaped_fragment_=msg/open-iscsi/PsT65Z4Gx3I/GUObdlVvCQAJ#!msg/open-iscsi/PsT65Z4Gx3I/GUObdlVvCQAJ
-Bug-Debian: https://bugs.debian.org/850057
-Last-Update: 2017-01-24
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- a/include/iscsi_net_util.h
-+++ b/include/iscsi_net_util.h
-@@ -2,6 +2,7 @@
- #define __ISCSI_NET_UTIL_h__
- 
- #define ISCSI_HWADDRESS_BUF_SIZE 18
-+#define ISCSIUIO_PATH "/sbin/iscsiuio"
- 
- extern int net_get_transport_name_from_netdev(char *netdev, char *transport);
- extern int net_get_netdev_from_hwaddress(char *hwaddress, char *netdev);
---- a/usr/iscsi_net_util.c
-+++ b/usr/iscsi_net_util.c
-@@ -27,6 +27,7 @@
- #include <sys/socket.h>
- #include <sys/ioctl.h>
- #include <sys/socket.h>
-+#include <sys/stat.h>
- #include <linux/sockios.h>
- #include <linux/if_vlan.h>
- #include <net/if_arp.h>
-@@ -81,6 +82,22 @@ int net_get_transport_name_from_netdev(c
- 		goto close_sock;
- 	}
- 
-+	/*
-+	 * iSCSI hardware offload for bnx2{,x} is only supported if the
-+	 * iscsiuio executable is available.
-+	 */
-+	if (!strcmp(drvinfo.driver, "bnx2x") ||
-+	    !strcmp(drvinfo.driver, "bnx2")) {
-+		struct stat buf;
-+
-+		if (stat(ISCSIUIO_PATH, &buf) < 0) {
-+			log_debug(1, "ISCSI offload not supported "
-+			             "(%s not found).", ISCSIUIO_PATH);
-+			err = ENODEV;
-+			goto close_sock;
-+		}
-+	}
-+
- 	for (i = 0; net_drivers[i].net_drv_name != NULL; i++) {
- 		struct iscsi_net_driver *net_driver = &net_drivers[i];
- 
diff --git a/debian/patches/bugfixes/no-make-clean-kernel.patch b/debian/patches/bugfixes/no-make-clean-kernel.patch
deleted file mode 100644
index 0d55dca..0000000
--- a/debian/patches/bugfixes/no-make-clean-kernel.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-Description: Don't run make -C kernel clean
- The kernel modules are no longer built (part of mainline), so don't
- run make -C kernel clean on make clean.
-Author: Christian Seiler <[e-mail]>
-Forwarded: not-yet
-Last-Update: 2016-07-27
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- a/Makefile
-+++ b/Makefile
-@@ -75,7 +75,6 @@ clean:
- 	$(MAKE) -C utils/fwparam_ibft clean
- 	$(MAKE) -C utils clean
- 	$(MAKE) -C usr clean
--	$(MAKE) -C kernel clean
- 	[ ! -f iscsiuio/Makefile ] || $(MAKE) -C iscsiuio clean
- 	[ ! -f iscsiuio/Makefile ] || $(MAKE) -C iscsiuio distclean
- 
diff --git a/debian/patches/debian/dont-link-against-openssl.patch b/debian/patches/debian/dont-link-against-openssl.patch
deleted file mode 100644
index 446ebf8..0000000
--- a/debian/patches/debian/dont-link-against-openssl.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-Description: Don't link against OpenSSL
- GPL programs are legally not allowed to be linked against OpenSSL in
- Debian. Link against libisns-nocrypto instead of libisns, and don't
- link against libcrypto.
- .
- As the iSNS functionality in open-iscsi does not use the cryptographic
- capabilities of open-isns anyway, this has no impact on functionality.
-Author: Christian Seiler <[e-mail]>
-Forwarded: not-needed (Debian-specific)
-Last-Update: 2016-07-27
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- a/usr/Makefile
-+++ b/usr/Makefile
-@@ -54,10 +54,10 @@ all: $(PROGRAMS)
- 
- iscsid: $(ISCSI_LIB_SRCS) $(INITIATOR_SRCS) $(DISCOVERY_SRCS) \
- 	iscsid.o session_mgmt.o discoveryd.o mntcheck.o
--	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@  -lisns -lcrypto -lrt -lmount
-+	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@  -lisns-nocrypto -lrt -lmount
- 
- iscsiadm: $(ISCSI_LIB_SRCS) $(DISCOVERY_SRCS) iscsiadm.o session_mgmt.o mntcheck.o
--	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@ -lisns -lcrypto -lmount
-+	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@ -lisns-nocrypto -lmount
- 
- iscsistart: $(ISCSI_LIB_SRCS) $(INITIATOR_SRCS) $(FW_BOOT_SRCS) \
- 		iscsistart.o statics.o
diff --git a/debian/patches/debian/udeb-without-libmount.patch b/debian/patches/debian/udeb-without-libmount.patch
deleted file mode 100644
index de5b3fb..0000000
--- a/debian/patches/debian/udeb-without-libmount.patch
+++ /dev/null
@@ -1,115 +0,0 @@
-Description: Temporarily support builds without libmount
- libmount is not available as an udeb at the moment, so in order for
- the udeb not to break, temporarily support builds without libmount
- for d-i environments (removing the safety check at session shutdown).
- This is not intended for upstream, only as a stop-gap measure until
- a libmount udeb is available again.
-Forwarded: no
-Author: Christian Seiler <[e-mail]>
-Bug-Debian: https://bugs.debian.org/834241
-Last-Update: 2016-08-14
----
-This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
---- a/usr/Makefile
-+++ b/usr/Makefile
-@@ -33,6 +33,8 @@ WARNFLAGS ?= -Wall -Wstrict-prototypes
- CFLAGS += $(WARNFLAGS) -I../include -I. -D$(OSNAME) $(IPC_CFLAGS)
- PROGRAMS = iscsid iscsiadm iscsistart
- 
-+LIBMOUNT_LIB = -lmount
-+
- # libc compat files
- SYSDEPS_SRCS = $(sort $(wildcard ../utils/sysdeps/*.o))
- # sources shared between iscsid, iscsiadm and iscsistart
-@@ -54,10 +56,10 @@ all: $(PROGRAMS)
- 
- iscsid: $(ISCSI_LIB_SRCS) $(INITIATOR_SRCS) $(DISCOVERY_SRCS) \
- 	iscsid.o session_mgmt.o discoveryd.o mntcheck.o
--	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@  -lisns-nocrypto -lrt -lmount
-+	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@  -lisns-nocrypto -lrt $(LIBMOUNT_LIB)
- 
- iscsiadm: $(ISCSI_LIB_SRCS) $(DISCOVERY_SRCS) iscsiadm.o session_mgmt.o mntcheck.o
--	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@ -lisns-nocrypto -lmount
-+	$(CC) $(CFLAGS) $(LDFLAGS) $^ -o $@ -lisns-nocrypto $(LIBMOUNT_LIB)
- 
- iscsistart: $(ISCSI_LIB_SRCS) $(INITIATOR_SRCS) $(FW_BOOT_SRCS) \
- 		iscsistart.o statics.o
---- a/usr/initiator_common.c
-+++ b/usr/initiator_common.c
-@@ -24,7 +24,9 @@
- #include <stdlib.h>
- #include <errno.h>
- #include <dirent.h>
-+#ifndef NO_LIBMOUNT
- #include <libmount/libmount.h>
-+#endif
- 
- #include "initiator.h"
- #include "transport.h"
---- a/usr/mntcheck.c
-+++ b/usr/mntcheck.c
-@@ -22,7 +22,9 @@
- #include <stdlib.h>
- #include <errno.h>
- #include <dirent.h>
-+#ifndef NO_LIBMOUNT
- #include <libmount/libmount.h>
-+#endif
- 
- #include "initiator.h"
- #include "transport.h"
-@@ -37,6 +39,7 @@
- #include "iscsi_err.h"
- #include "iscsi_net_util.h"
- 
-+#ifndef NO_LIBMOUNT
- static struct libmnt_table *mtab, *swaps;
- static struct libmnt_cache *mntcache;
- 
-@@ -66,6 +69,7 @@ static int libmount_init(void)
- 	mnt_table_parse_swaps(swaps, NULL);
- 	return 0;
- }
-+#endif
- 
- static int trans_filter(const struct dirent *d)
- {
-@@ -97,6 +101,7 @@ static int is_partition(const char *path
- 
- static int blockdev_check_mnts(char *syspath)
- {
-+#ifndef NO_LIBMOUNT
- 	struct libmnt_fs *fs;
- 	char *devname = NULL;
- 	char *_devname = NULL;
-@@ -123,6 +128,9 @@ out:
- 	free(devname);
- 	free(_devname);
- 	return rc;
-+#else
-+	return 0;
-+#endif
- }
- 
- static int count_device_users(char *syspath);
-@@ -218,16 +226,20 @@ int session_in_use(int sid)
- 	int host_no = -1, err = 0;
- 	int count = 0;
- 
-+#ifndef NO_LIBMOUNT
- 	if (libmount_init()) {
- 		log_error("Failed to initialize libmount, "
- 			  "not checking for active mounts on session [%d].", sid);
- 		return 0;
- 	}
-+#endif
- 
- 	host_no = iscsi_sysfs_get_host_no_from_sid(sid, &err);
- 	if (!err)
- 		iscsi_sysfs_for_each_device(&count, host_no, sid, device_in_use);
- 
-+#ifndef NO_LIBMOUNT
- 	libmount_cleanup();
-+#endif
- 	return count;
- }
diff --git a/debian/patches/debian/var-run-lock.patch b/debian/patches/debian/var-run-lock.patch
deleted file mode 100644
index 69e756c..0000000
--- a/debian/patches/debian/var-run-lock.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-Description: Move from /var/lock and /var/run to /run/lock and /run
-Author: Stéphane Graber <[e-mail]>
-
---- a/doc/iscsid.8
-+++ b/doc/iscsid.8
-@@ -40,7 +40,7 @@ do not write a process ID file.
- .TP
- .BI [-p|--pid=]\fIpid\-file\fP
- write process ID to \fIpid\-file\fR rather than the default
--\fI/var/run/iscsid.pid\fR
-+\fI/run/iscsid.pid\fR
- .TP
- .BI [-h|--help]
- display this help and exit
---- a/usr/initiator.h
-+++ b/usr/initiator.h
-@@ -38,9 +38,9 @@
- #define CONFIG_FILE		ISCSI_CONFIG_ROOT"iscsid.conf"
- #define INITIATOR_NAME_FILE	ISCSI_CONFIG_ROOT"initiatorname.iscsi"
- 
--#define PID_FILE		"/var/run/iscsid.pid"
-+#define PID_FILE		"/run/iscsid.pid"
- #ifndef LOCK_DIR
--#define LOCK_DIR		"/var/lock/iscsi"
-+#define LOCK_DIR		"/run/lock/iscsi"
- #endif
- #define LOCK_FILE		LOCK_DIR"/lock"
- #define LOCK_WRITE_FILE		LOCK_DIR"/lock.write"
---- a/iscsiuio/src/unix/main.c
-+++ b/iscsiuio/src/unix/main.c
-@@ -76,7 +76,7 @@
-  ******************************************************************************/
- #define PFX "main "
- 
--static const char default_pid_filepath[] = "/var/run/iscsiuio.pid";
-+static const char default_pid_filepath[] = "/run/iscsiuio.pid";
- 
- /*******************************************************************************
-  *  Global Variables
diff --git a/debian/patches/include-sys-sysmacros.h-to-properly-define-minor.patch b/debian/patches/include-sys-sysmacros.h-to-properly-define-minor.patch
deleted file mode 100644
index 857acd2..0000000
--- a/debian/patches/include-sys-sysmacros.h-to-properly-define-minor.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-Description: Include <sys/sysmacros.h> to properly define minor()
-Origin: upstream, https://github.com/open-iscsi/open-iscsi/commit/6d68ef5871c94c6ebbbe6e6b1fe0bc2dce711052
-
-Index: open-iscsi/iscsiuio/src/unix/libs/bnx2x.c
-===================================================================
---- open-iscsi.orig/iscsiuio/src/unix/libs/bnx2x.c
-+++ open-iscsi/iscsiuio/src/unix/libs/bnx2x.c
-@@ -50,6 +50,7 @@
- #include <sys/user.h>
- #include <fcntl.h>
- #include <unistd.h>
-+#include <sys/sysmacros.h>
- 
- #include "config.h"
- 
-Index: open-iscsi/iscsiuio/src/unix/libs/bnx2.c
-===================================================================
---- open-iscsi.orig/iscsiuio/src/unix/libs/bnx2.c
-+++ open-iscsi/iscsiuio/src/unix/libs/bnx2.c
-@@ -46,6 +46,7 @@
- #include <sys/user.h>
- #include <fcntl.h>
- #include <unistd.h>
-+#include <sys/sysmacros.h>
- 
- #include "config.h"
- 
diff --git a/debian/patches/lp1755858-default-iscsid_conf-to-iscsid_socket.patch b/debian/patches/lp1755858-default-iscsid_conf-to-iscsid_socket.patch
new file mode 100644
index 0000000..af236fd
--- /dev/null
+++ b/debian/patches/lp1755858-default-iscsid_conf-to-iscsid_socket.patch
@@ -0,0 +1,30 @@
+Description: default in iscid.conf to use iscsid.socket
+
+People do not want iscsid to run if not needed.
+To do so it is configured to be socket activated.
+Internally iscsid code has a fallback if the service is missing to run the
+command specified in iscsid.conf as "iscsid.startup".
+Set this to ensure the socket is active instead of calling the binary, which
+would not be what we want anyway as it would not be from the .service context.
+
+Forwarded: no (Downstream config)
+Author: Christian Ehrhardt <[e-mail]>
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1755858
+Reviewed-by: Rafael David Tinoco <[e-mail]>
+Last-Update: 2020-08-13
+
+--- open-iscsi-2.1.1.orig/etc/iscsid.conf
++++ open-iscsi-2.1.1/etc/iscsid.conf
+@@ -18,9 +18,9 @@
+ # maintainers. If you leave the iscsid daemon running all
+ # the time then leave this attribute commented out.
+ #
+-# Default for Fedora and RHEL. (uncomment to activate).
+-# iscsid.startup = /bin/systemctl start iscsid.socket iscsiuio.soccket
+-# 
++# iscsid.startup = /bin/systemctl start iscsid.socket iscsiuio.socket
++iscsid.startup = /bin/systemctl start iscsid.socket
++#
+ # Default if you are not using systemd (uncomment to activate)
+ # iscsid.startup = /usr/bin/service start iscsid
+ 
diff --git a/debian/patches/security/Check-for-root-peer-user-for-iscsiuio-IPC.patch b/debian/patches/security/Check-for-root-peer-user-for-iscsiuio-IPC.patch
deleted file mode 100644
index c484703..0000000
--- a/debian/patches/security/Check-for-root-peer-user-for-iscsiuio-IPC.patch
+++ /dev/null
@@ -1,122 +0,0 @@
-From e313bd648a4c8a9526421e270eb597a5de1e0c7f Mon Sep 17 00:00:00 2001
-From: Lee Duncan <[e-mail]>
-Date: Fri, 15 Dec 2017 10:36:11 -0800
-Subject: [PATCH 1/8] Check for root peer user for iscsiuio IPC
-
-This fixes a possible vulnerability where a non-root
-process could connect with iscsiuio. Fouund by Qualsys.
----
- iscsiuio/src/unix/Makefile.am  |  3 ++-
- iscsiuio/src/unix/iscsid_ipc.c | 47 ++++++++++++++++++++++++++++++++++++++++++
- 2 files changed, 49 insertions(+), 1 deletion(-)
-
---- a/iscsiuio/src/unix/Makefile.am
-+++ b/iscsiuio/src/unix/Makefile.am
-@@ -20,7 +20,8 @@ iscsiuio_SOURCES =	build_date.c		\
- 			nic_utils.c		\
- 			packet.c		\
- 			iscsid_ipc.c		\
--			ping.c
-+			ping.c			\
-+			${top_srcdir}/../utils/sysdeps/sysdeps.c
- 
- iscsiuio_CFLAGS = 	$(AM_CFLAGS)		\
- 			$(LIBNL_CFLAGS)		\
---- a/iscsiuio/src/unix/iscsid_ipc.c
-+++ b/iscsiuio/src/unix/iscsid_ipc.c
-@@ -37,6 +37,8 @@
-  *
-  */
- 
-+#define _GNU_SOURCE
-+
- #include <errno.h>
- #include <pthread.h>
- #include <signal.h>
-@@ -47,6 +49,8 @@
- #include <sys/socket.h>
- #include <sys/time.h>
- #include <sys/un.h>
-+#include <sys/types.h>
-+#include <pwd.h>
- 
- #define PFX "iscsi_ipc "
- 
-@@ -61,6 +65,7 @@
- #include "iscsid_ipc.h"
- #include "uip.h"
- #include "uip_mgmt_ipc.h"
-+#include "sysdeps.h"
- 
- #include "logger.h"
- #include "uip.h"
-@@ -102,6 +107,7 @@ struct iface_rec_decode {
- 	uint16_t		mtu;
- };
- 
-+#define PEERUSER_MAX	64
- 
- /******************************************************************************
-  *  iscsid_ipc Constants
-@@ -1029,6 +1035,40 @@ static void iscsid_loop_close(void *arg)
- 	LOG_INFO(PFX "iSCSI daemon socket closed");
- }
- 
-+/*
-+ * check that the peer user is privilidged
-+ *
-+ * return 1 if peer is ok else 0
-+ *
-+ * XXX: this function is copied from iscsid_ipc.c and should be
-+ * moved into a common library
-+ */
-+static int
-+mgmt_peeruser(int sock, char *user)
-+{
-+	struct ucred peercred;
-+	socklen_t so_len = sizeof(peercred);
-+	struct passwd *pass;
-+
-+	errno = 0;
-+	if (getsockopt(sock, SOL_SOCKET, SO_PEERCRED, &peercred,
-+		&so_len) != 0 || so_len != sizeof(peercred)) {
-+		/* We didn't get a valid credentials struct. */
-+		LOG_ERR(PFX "peeruser_unux: error receiving credentials: %m");
-+		return 0;
-+	}
-+
-+	pass = getpwuid(peercred.uid);
-+	if (pass == NULL) {
-+		LOG_ERR(PFX "peeruser_unix: unknown local user with uid %d",
-+				(int) peercred.uid);
-+		return 0;
-+	}
-+
-+	strlcpy(user, pass->pw_name, PEERUSER_MAX);
-+	return 1;
-+}
-+
- /**
-  *  iscsid_loop() - This is the function which will process the broadcast
-  *                  messages from iscsid
-@@ -1038,6 +1078,7 @@ static void *iscsid_loop(void *arg)
- {
- 	int rc;
- 	sigset_t set;
-+	char user[PEERUSER_MAX];
- 
- 	pthread_cleanup_push(iscsid_loop_close, arg);
- 
-@@ -1077,6 +1118,12 @@ static void *iscsid_loop(void *arg)
- 			continue;
- 		}
- 
-+		if (!mgmt_peeruser(iscsid_opts.fd, user) || strncmp(user, "root", PEERUSER_MAX)) {
-+			close(s2);
-+			LOG_ERR(PFX "Access error: non-administrative connection rejected");
-+			break;
-+		}
-+
- 		process_iscsid_broadcast(s2);
- 		close(s2);
- 	}
diff --git a/debian/patches/security/Check-iscsiuio-ping-data-length-for-validity.patch b/debian/patches/security/Check-iscsiuio-ping-data-length-for-validity.patch
deleted file mode 100644
index 170f8a5..0000000
--- a/debian/patches/security/Check-iscsiuio-ping-data-length-for-validity.patch
+++ /dev/null
@@ -1,49 +0,0 @@
-From 59ede2cf4eee8729a4221000a5d1ecdd312a31ac Mon Sep 17 00:00:00 2001
-From: Lee Duncan <[e-mail]>
-Date: Fri, 15 Dec 2017 11:21:15 -0800
-Subject: [PATCH 7/8] Check iscsiuio ping data length for validity
-
-We do not trust that the received ping packet data length
-is correct, so sanity check it. Found by Qualsys.
----
- iscsiuio/src/unix/iscsid_ipc.c | 5 +++++
- iscsiuio/src/unix/packet.c     | 2 +-
- iscsiuio/src/unix/packet.h     | 2 ++
- 3 files changed, 8 insertions(+), 1 deletion(-)
-
---- a/iscsiuio/src/unix/iscsid_ipc.c
-+++ b/iscsiuio/src/unix/iscsid_ipc.c
-@@ -333,6 +333,11 @@ static void *perform_ping(void *arg)
- 
- 	data = (iscsid_uip_broadcast_t *)png_c->data;
- 	datalen = data->u.ping_rec.datalen;
-+	if ((datalen > STD_MTU_SIZE) || (datalen < 0)) {
-+		LOG_ERR(PFX "Ping datalen invalid: %d", datalen);
-+		rc = -EINVAL;
-+		goto ping_done;
-+	}
- 
- 	memset(dst_addr, 0, sizeof(uip_ip6addr_t));
- 	if (nic_iface->protocol == AF_INET) {
---- a/iscsiuio/src/unix/packet.c
-+++ b/iscsiuio/src/unix/packet.c
-@@ -112,7 +112,7 @@ int alloc_free_queue(nic_t *nic, size_t
- 	for (i = 0; i < num_of_packets; i++) {
- 		packet_t *pkt;
- 
--		pkt = alloc_packet(1500, 1500);
-+		pkt = alloc_packet(STD_MTU_SIZE, STD_MTU_SIZE);
- 		if (pkt == NULL) {
- 			goto done;
- 		}
---- a/iscsiuio/src/unix/packet.h
-+++ b/iscsiuio/src/unix/packet.h
-@@ -43,6 +43,8 @@
- 
- #include "nic.h"
- 
-+#define	STD_MTU_SIZE	1500
-+
- struct nic;
- struct nic_interface;
- 
diff --git a/debian/patches/security/Do-not-double-close-IPC-file-stream-to-iscsid.patch b/debian/patches/security/Do-not-double-close-IPC-file-stream-to-iscsid.patch
deleted file mode 100644
index 68f1ea4..0000000
--- a/debian/patches/security/Do-not-double-close-IPC-file-stream-to-iscsid.patch
+++ /dev/null
@@ -1,51 +0,0 @@
-From 5504053cc08df38d8d85032fa1691e363dfcfb92 Mon Sep 17 00:00:00 2001
-From: Lee Duncan <[e-mail]>
-Date: Fri, 15 Dec 2017 11:13:29 -0800
-Subject: [PATCH 4/8] Do not double-close IPC file stream to iscsid
-
-A double-close of a file descriptor and its associated FILE stream
-can be an issue in multi-threaded cases. Found by Qualsys.
----
- iscsiuio/src/unix/iscsid_ipc.c | 9 +++++++--
- 1 file changed, 7 insertions(+), 2 deletions(-)
-
---- a/iscsiuio/src/unix/iscsid_ipc.c
-+++ b/iscsiuio/src/unix/iscsid_ipc.c
-@@ -913,6 +913,9 @@ early_exit:
- /**
-  *  process_iscsid_broadcast() - This function is used to process the
-  *                               broadcast messages from iscsid
-+ *
-+ *                               s2 is an open file descriptor, which
-+ *                               must not be left open upon return
-  */
- int process_iscsid_broadcast(int s2)
- {
-@@ -928,6 +931,7 @@ int process_iscsid_broadcast(int s2)
- 	if (fd == NULL) {
- 		LOG_ERR(PFX "Couldn't open file descriptor: %d(%s)",
- 			errno, strerror(errno));
-+		close(s2);
- 		return -EIO;
- 	}
- 
-@@ -1030,7 +1034,8 @@ int process_iscsid_broadcast(int s2)
- 	}
- 
- error:
--	free(data);
-+	if (data)
-+		free(data);
- 	fclose(fd);
- 
- 	return rc;
-@@ -1132,8 +1137,8 @@ static void *iscsid_loop(void *arg)
- 			break;
- 		}
- 
-+		/* this closes the file descriptor s2 */
- 		process_iscsid_broadcast(s2);
--		close(s2);
- 	}
- 
- 	pthread_cleanup_pop(0);
diff --git a/debian/patches/security/Ensure-all-fields-in-iscsiuio-IPC-response-are-set.patch b/debian/patches/security/Ensure-all-fields-in-iscsiuio-IPC-response-are-set.patch
deleted file mode 100644
index 50884d0..0000000
--- a/debian/patches/security/Ensure-all-fields-in-iscsiuio-IPC-response-are-set.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-From be58eed849f5457bb49b79e94aa6a26971ba6deb Mon Sep 17 00:00:00 2001
-From: Lee Duncan <[e-mail]>
-Date: Fri, 15 Dec 2017 11:11:17 -0800
-Subject: [PATCH 3/8] Ensure all fields in iscsiuio IPC response are set
-
-Make sure all fields in the response strcuture are set,
-or info from the stack can be leaked to our caller.
-Found by Qualsys.
----
- iscsiuio/src/unix/iscsid_ipc.c | 2 ++
- 1 file changed, 2 insertions(+)
-
---- a/iscsiuio/src/unix/iscsid_ipc.c
-+++ b/iscsiuio/src/unix/iscsid_ipc.c
-@@ -960,6 +960,8 @@ int process_iscsid_broadcast(int s2)
- 	LOG_DEBUG(PFX "recv iscsid request: cmd: %d, payload_len: %d",
- 		  cmd, payload_len);
- 
-+	memset(&rsp, 0, sizeof(rsp));
-+
- 	switch (cmd) {
- 	case ISCSID_UIP_IPC_GET_IFACE:
- 		size = fread(&data->u.iface_rec, payload_len, 1, fd);
diff --git a/debian/patches/security/Ensure-strings-from-peer-are-copied-correctly.patch b/debian/patches/security/Ensure-strings-from-peer-are-copied-correctly.patch
deleted file mode 100644
index a1e04d3..0000000
--- a/debian/patches/security/Ensure-strings-from-peer-are-copied-correctly.patch
+++ /dev/null
@@ -1,67 +0,0 @@
-From 85f647c4300a888bb6cbc27f33138549cab617e3 Mon Sep 17 00:00:00 2001
-From: Lee Duncan <[e-mail]>
-Date: Fri, 15 Dec 2017 11:15:26 -0800
-Subject: [PATCH 5/8] Ensure strings from peer are copied correctly.
-
-The method of using strlen() and strcpy()/strncpy() has
-a couple of holes. Do not try to measure the length of
-strings supplied from peer, and ensure copied strings are
-NULL-terminated. Use the new strlcpy() instead.
-Found by Qualsys.
----
- iscsiuio/src/unix/iscsid_ipc.c | 24 ++++++------------------
- 1 file changed, 6 insertions(+), 18 deletions(-)
-
---- a/iscsiuio/src/unix/iscsid_ipc.c
-+++ b/iscsiuio/src/unix/iscsid_ipc.c
-@@ -152,10 +152,7 @@ static int decode_cidr(char *in_ipaddr_s
- 	struct in_addr ia;
- 	struct in6_addr ia6;
- 
--	if (strlen(in_ipaddr_str) > NI_MAXHOST)
--		strncpy(ipaddr_str, in_ipaddr_str, NI_MAXHOST);
--	else
--		strcpy(ipaddr_str, in_ipaddr_str);
-+	strlcpy(ipaddr_str, in_ipaddr_str, NI_MAXHOST);
- 
- 	/* Find the CIDR if any */
- 	tmp = strchr(ipaddr_str, '/');
-@@ -287,22 +284,16 @@ static int decode_iface(struct iface_rec
- 
- 			/* For LL on, ignore the IPv6 addr in the iface */
- 			if (ird->linklocal_autocfg == IPV6_LL_AUTOCFG_OFF) {
--				if (strlen(rec->ipv6_linklocal) > NI_MAXHOST)
--					strncpy(ipaddr_str, rec->ipv6_linklocal,
--						NI_MAXHOST);
--				else
--					strcpy(ipaddr_str, rec->ipv6_linklocal);
-+				strlcpy(ipaddr_str, rec->ipv6_linklocal,
-+					NI_MAXHOST);
- 				inet_pton(AF_INET6, ipaddr_str,
- 					  &ird->ipv6_linklocal);
- 			}
- 
- 			/* For RTR on, ignore the IPv6 addr in the iface */
- 			if (ird->router_autocfg == IPV6_RTR_AUTOCFG_OFF) {
--				if (strlen(rec->ipv6_router) > NI_MAXHOST)
--					strncpy(ipaddr_str, rec->ipv6_router,
--						NI_MAXHOST);
--				else
--					strcpy(ipaddr_str, rec->ipv6_router);
-+				strlcpy(ipaddr_str, rec->ipv6_router,
-+					NI_MAXHOST);
- 				inet_pton(AF_INET6, ipaddr_str,
- 					  &ird->ipv6_router);
- 			}
-@@ -316,10 +307,7 @@ static int decode_iface(struct iface_rec
- 					calculate_default_netmask(
- 							ird->ipv4_addr.s_addr);
- 
--			if (strlen(rec->gateway) > NI_MAXHOST)
--				strncpy(ipaddr_str, rec->gateway, NI_MAXHOST);
--			else
--				strcpy(ipaddr_str, rec->gateway);
-+			strlcpy(ipaddr_str, rec->gateway, NI_MAXHOST);
- 			inet_pton(AF_INET, ipaddr_str, &ird->ipv4_gateway);
- 		}
- 	} else {
diff --git a/debian/patches/security/Skip-useless-strcopy-and-validate-CIDR-length.patch b/debian/patches/security/Skip-useless-strcopy-and-validate-CIDR-length.patch
deleted file mode 100644
index 26efcf1..0000000
--- a/debian/patches/security/Skip-useless-strcopy-and-validate-CIDR-length.patch
+++ /dev/null
@@ -1,33 +0,0 @@
-From a7a96131bd2ea342f6def0e46be514baf8037ae8 Mon Sep 17 00:00:00 2001
-From: Lee Duncan <[e-mail]>
-Date: Fri, 15 Dec 2017 11:18:35 -0800
-Subject: [PATCH 6/8] Skip useless strcopy, and validate CIDR length
-
-Remove a useless strcpy() that copies a string onto itself,
-and ensure the CIDR length "keepbits" is not negative.
-Found by Qualsys.
----
- iscsiuio/src/unix/iscsid_ipc.c | 5 ++---
- 1 file changed, 2 insertions(+), 3 deletions(-)
-
---- a/iscsiuio/src/unix/iscsid_ipc.c
-+++ b/iscsiuio/src/unix/iscsid_ipc.c
-@@ -148,7 +148,7 @@ static int decode_cidr(char *in_ipaddr_s
- 	char *tmp, *tok;
- 	char ipaddr_str[NI_MAXHOST];
- 	char str[INET6_ADDRSTRLEN];
--	int keepbits = 0;
-+	unsigned long keepbits = 0;
- 	struct in_addr ia;
- 	struct in6_addr ia6;
- 
-@@ -161,8 +161,7 @@ static int decode_cidr(char *in_ipaddr_s
- 		tmp = ipaddr_str;
- 		tok = strsep(&tmp, "/");
- 		LOG_INFO(PFX "in cidr: bitmask '%s' ip '%s'", tmp, tok);
--		keepbits = atoi(tmp);
--		strcpy(ipaddr_str, tok);
-+		keepbits = strtoull(tmp, NULL, 10);
- 	}
- 
- 	/*  Determine if the IP address passed from the iface file is
diff --git a/debian/patches/security/iscsiuio-should-ignore-bogus-iscsid-broadcast-packet.patch b/debian/patches/security/iscsiuio-should-ignore-bogus-iscsid-broadcast-packet.patch
deleted file mode 100644
index 46a9ea5..0000000
--- a/debian/patches/security/iscsiuio-should-ignore-bogus-iscsid-broadcast-packet.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-From b9c33683bdc0aed28ffe31c3f3d50bf5cdf519ea Mon Sep 17 00:00:00 2001
-From: Lee Duncan <[e-mail]>
-Date: Fri, 15 Dec 2017 10:37:56 -0800
-Subject: [PATCH 2/8] iscsiuio should ignore bogus iscsid broadcast packets
-
-When iscsiuio is receiving broadcast packets from iscsid,
-if the 'payload_len', carried in the packet, is too
-large then ignore the packet and print a message.
-Found by Qualsys.
----
- iscsiuio/src/unix/iscsid_ipc.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/iscsiuio/src/unix/iscsid_ipc.c
-+++ b/iscsiuio/src/unix/iscsid_ipc.c
-@@ -950,6 +950,12 @@ int process_iscsid_broadcast(int s2)
- 
- 	cmd = data->header.command;
- 	payload_len = data->header.payload_len;
-+	if (payload_len > sizeof(data->u)) {
-+		LOG_ERR(PFX "Data payload length too large (%d). Corrupt payload?",
-+				payload_len);
-+		rc = -EINVAL;
-+		goto error;
-+	}
- 
- 	LOG_DEBUG(PFX "recv iscsid request: cmd: %d, payload_len: %d",
- 		  cmd, payload_len);
diff --git a/debian/patches/series b/debian/patches/series
index a38505a..e33871b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -1 +1,2 @@
 adapt-chap-auth-algorithms-to-debian.patch
+lp1755858-default-iscsid_conf-to-iscsid_socket.patch
diff --git a/debian/rules b/debian/rules
index 7d7cbfe..c4f553c 100755
--- a/debian/rules
+++ b/debian/rules
@@ -10,6 +10,10 @@ VERSION_DEBIAN := $(shell echo "$(VERSION_COMPLETE)" | sed -e 's,^[^-]*-,,')
 DPKG_EXPORT_BUILDFLAGS = 1
 include /usr/share/dpkg/buildflags.mk
 
+# Fix gcc10 warnings as errors while upstream doesn't catch up
+export DEB_CFLAGS_PREPEND=-Wno-error=zero-length-bounds -Wno-error=format-overflow= -Wno-error=format-truncation= -Wno-error=maybe-uninitialized
+export DEB_CXXFLAGS_PREPEND=${DEB_CFLAGS_PREPEND}
+
 %:
 	dh $@
 
@@ -39,6 +43,9 @@ override_dh_auto_install:
 	dh_install -p open-iscsi debian/extra/logout-all.sh lib/open-iscsi/
 	dh_install -p open-iscsi debian/extra/startup-checks.sh lib/open-iscsi/
 	dh_install -p open-iscsi debian/extra/activate-storage.sh lib/open-iscsi/
+	dh_install -p open-iscsi debian/extra/net-interface-handler lib/open-iscsi/
+	dh_install -p open-iscsi debian/open-iscsi.finalrd usr/share/finalrd/
+	dh_install -p open-iscsi etc/systemd/iscsid.socket lib/systemd/system/
 	mkdir -p debian/open-iscsi/usr/bin
 	ln -s /sbin/iscsiadm debian/open-iscsi/usr/bin/iscsiadm
 	mkdir -p debian/open-iscsi/usr/share/initramfs-tools/hooks
@@ -47,10 +54,9 @@ override_dh_auto_install:
 	cp -p debian/extra/initramfs.hook debian/open-iscsi/usr/share/initramfs-tools/hooks/iscsi
 	cp -p debian/extra/initramfs.local-top debian/open-iscsi/usr/share/initramfs-tools/scripts/local-top/iscsi
 	cp -p debian/extra/initramfs.local-bottom debian/open-iscsi/usr/share/initramfs-tools/scripts/local-bottom/iscsi
-	mkdir -p debian/open-iscsi/lib/modules-load.d/
-	cp -p debian/open-iscsi.kmod debian/open-iscsi/lib/modules-load.d/open-iscsi.conf
 	mkdir -p debian/open-iscsi/lib/udev/rules.d/
 	cp -p debian/open-iscsi.rules debian/open-iscsi/lib/udev/rules.d/70-open-iscsi.rules
+	cp -p debian/iscsi-network-interface.rules debian/open-iscsi/lib/udev/rules.d/70-iscsi-network-interface.rules
 
 	@# iscsiuio
 	dh_install -p iscsiuio iscsiuio/src/unix/iscsiuio /sbin
@@ -68,17 +74,19 @@ override_dh_auto_install:
 	dh_install -p open-iscsi-udeb debian/open-iscsi-udeb.finish-install usr/lib/finish-install.d/10open-iscsi
 
 override_dh_installinit:
-	dh_installinit -p open-iscsi --name=iscsid
-	dh_installinit -p open-iscsi
-	dh_installinit -p iscsiuio
+	dh_installinit -p open-iscsi --no-start --no-enable --no-restart-on-upgrade --name=iscsid
+	dh_installinit -p open-iscsi --no-start --no-enable --no-restart-on-upgrade
+	dh_installinit -p iscsiuio --no-start --no-enable --no-restart-on-upgrade
 
 override_dh_systemd_enable:
-	dh_systemd_enable -p open-iscsi --name=iscsid
-	dh_systemd_enable -p open-iscsi
+	dh_systemd_enable -p open-iscsi --name=iscsid --no-enable iscsid.service
+	dh_systemd_enable -p open-iscsi --name=iscsid iscsid.socket
+	dh_systemd_enable -p open-iscsi open-iscsi.service
 	dh_systemd_enable -p iscsiuio
 
 override_dh_systemd_start:
-	dh_systemd_start -p open-iscsi --no-restart-on-upgrade iscsid.service open-iscsi.service
+	dh_systemd_start -p open-iscsi --no-restart-on-upgrade iscsid.socket
+	dh_systemd_start -p open-iscsi --no-restart-on-upgrade open-iscsi.service
 	dh_systemd_start -p iscsiuio --no-restart-on-upgrade iscsiuio.service
 
 override_dh_installman:
@@ -94,3 +102,14 @@ override_dh_installdocs:
 
 override_dh_missing:
 	dh_missing --fail-missing
+
+# The following is taken from the initramfs-tools package. (We recommend
+# busybox in the initramfs because otherwise we don't have access to the
+# ip utility to set the default gateway after iscsistart -N is done.)
+# On Debian we can use either busybox or busybox-static, but on Ubuntu
+# and derivatives only busybox-initramfs will work.
+BUSYBOX_PACKAGES := $(shell if dpkg-vendor --derives-from ubuntu; then echo busybox-initramfs; else echo busybox busybox-static; fi)
+
+override_dh_gencontrol:
+	echo >> debian/open-iscsi.substvars "busybox:Recommends=$(wordlist 2,100,$(BUSYBOX_PACKAGES:%=| %))"
+	dh_gencontrol
diff --git a/debian/tests/README-boot-test.md b/debian/tests/README-boot-test.md
new file mode 100644
index 0000000..e45bbf0
--- /dev/null
+++ b/debian/tests/README-boot-test.md
@@ -0,0 +1,139 @@
+## open-iscsi boot test
+The purpose of this test (`CloudImageTest`) is to test the boot of a system
+using an iscsi root target.  In order to accomplish that, the tests does
+
+  1. Download Ubuntu cloud image
+  2. installs the open-iscsi deb inside
+  3. collect kernel and initramfs from inside
+  4. register the image as a read-only iscsi target served by tgt
+  5. boot kernel and initramfs with a command line to use the image as root.
+     And additionally attach a local disk for collecting output.
+  6. provide user-data that executes commands, colects files and writes them
+     to the output disk and then shuts the system down.
+  7. extract the collected files from the output disk and inspect them.
+
+The `CloudImageTest` uses qemu user networking.
+
+
+## Caveats
+
+  1. It depends on a cloud-image being present.
+
+     Cloud-images are often not available for the first few weeks of a cycle.
+     If no cloud-image of 'REL' is available, then boot-test will skip.
+     If 'REL' is not known in distro-info-data, then test will fail.
+
+     This means that uploads of open-iscsi (or its dependencies) will not
+     be properly tested until a cloud-image is available, and will fail
+     until distro-info-data is uploaded.
+
+  2. Installation of large packages via patch-image may fail.
+     An ubuntu image downloaded has only a small amount of extra space.
+     Installation of a new kernel into the target would probably fail.
+
+     If this becomes a problem, we could grow the disk like done at
+       https://gist.github.com/smoser/6a048a0e2795b48221fc44962202fa14
+
+
+### testing manually ###
+The test case in `debian/tests/test-open-iscsi.py` uses some helper tools.
+
+  * **patch-image**: this is used to install packages into the pristine image
+     and collect the kernel and initramfs out of the image.  This allows us to
+     test the portions of open-iscsi that update the initramfs.  Without
+     using the updated initramfs we wouldn't really be testing the new
+     open-iscsi.
+
+     It will upgrade any packages inside that are mentioned in
+     ADT_TEST_TRIGGERS environment.  It will also install open-iscsi if
+     it is not in that list.
+
+     It installs packages into the target by copying the host system's
+     /etc/apt content in, and also includes copying local (file://) apt
+     repos into the target.  This is necessary for the autopackage test
+     environment that adds local package repositories to sources.list.d.
+
+     It may also make other changes to the image to workaround bugs.
+     See --help output for list of bugs.
+
+  * **get-image**: This downloads an image from cloud-images.ubuntu.com.  See
+     its Usage for more information.  it downloads via stream data and verifies
+     download.  One thing to note is that it does not overwrite existing files.
+
+  * **tgt-boot-test**: this registers an image in tgt locally, and then boots
+     kernel and initramfs to mount that.  It knows how to build iscsi kernel
+     command lines.
+
+     By default, the xkvm process that is started will be allowed `60m` to
+     complete.  This can be adjusted by setting `BOOT_TIMEOUT` in the
+     environment.
+
+  * **xkvm**: this is a helper/wrapper around qemu.  It is taken from the curtin
+     projects tools/ directory.  It allows some simplified command lines, and
+     most usefully, the '--netdev=<bridge>' argument will create a tun/tap
+     device and attach it to the bridge.
+
+     If the host system is not bare metal, kvm will not be
+     enabled in the guest that is lauched.  To force use of kvm, set
+     _USE_KVM=1 in the environment.  See 'should_try_kvm' in xkvm for details.
+
+Testing manually looks like this:
+
+    ## set up path to include debian/tests directory.
+    $ PATH=$PWD/debian/tests:$PATH
+
+    ## Get the image you want.  This creates out.d/disk.img and disk.img.dist
+    $ get-image xenial.d xenial
+
+    ## patch the image with an open-iscsi, which creates xenial.d/kernel
+    ## and xenial.d/initrd from the kernel and initramfs inside the image.
+    $ apt-get download open-iscsi
+    $ deb=$(ls open-iscsi_*.deb | tail -n 1)
+    $ sudo ./debian/tests/patch-image \
+         --kernel=xenial.d/kernel --initrd=xenial.d/initrd
+         xenial.d/disk.img "$deb"
+
+    ## Boot the system, log in, look around.
+    $ tgt-boot-test -v xenial.d/disk.img xenial.d/kernel xenial.d/initrd
+
+
+### Features of tgt-boot-test ###
+
+tgt-boot-test does a number of useful things.
+
+ * determines the host address that the guest will use.
+   This should support ipv6 and ipv4 addresses on bridges, and
+   knows values that qemu's user networking uses.  Flags passed to `--netdev`
+   are read intelligently.  This can be overriden with `--host-addr`, but
+   it does a good job of determining what the right values are.
+
+ * provides a nocloud metadata service with a python web server that
+   supports ipv4 and ipv6.
+
+ * provides the ability to provide additional kernel command line options
+   or to provide a 'template' that references variables it knows such as
+   {iserver} (iscsi server) or {seed_url}.
+
+ * Sets ubuntu (passw0rd) and root password (root) and imports users
+   ssh keys to the ubuntu user.
+
+One thing to note is that yakkety's version of qemu does not run an ipv6
+dhcp server on its user-network, so a stateful dhclient request will not
+work.
+
+In order to create a bridge easily with a ipv6 dhcp server, you can use
+lxd at sufficent version (https://github.com/lxc/lxd/issues/2481).
+Assuming that bug is fixed, to create an ipv6 only bridge:
+
+    $ netname="ipv6-only"
+    $ lxc network create $netname
+    $ lxc network unset $netname ipv4.address
+    $ lxc network unset $netname ipv4.nat
+    $ lxc network set $netname ipv6.dhcp.stateful true
+
+Then, you can use tgt-boot-test with that:
+
+    $ PATH=$PWD/debian/tests:$PATH
+    $ ./debian/tests/tgt-boot-test -vv --netdev=ipv6-only \
+       --cmdline-ip="ip=off ip6=dhcp" \
+       disk.img kernel initramfs
diff --git a/debian/tests/control b/debian/tests/control
index 7b3c9e2..026cfc9 100644
--- a/debian/tests/control
+++ b/debian/tests/control
@@ -1,6 +1,10 @@
 Tests: install
 Restrictions: needs-root, isolation-machine, breaks-testbed
 
+Tests: testsuite
+Restrictions: needs-root isolation-machine breaks-testbed
+Depends: open-iscsi, python2, tgt, qemu-system, ubuntu-cloudimage-keyring, simplestreams, python-netifaces, distro-info, cloud-image-utils, dctrl-tools, rsync
+
 Tests: nested
 Restrictions: needs-root, isolation-machine, breaks-testbed, allow-stderr
 Depends: targetcli-fb, qemu-system, qemu-utils, python3, python3-netifaces
diff --git a/debian/tests/get-image b/debian/tests/get-image
new file mode 100755
index 0000000..41b903c
--- /dev/null
+++ b/debian/tests/get-image
@@ -0,0 +1,227 @@
+#!/bin/bash
+Usage() {
+   cat <<EOF
+${0##*/} out-directory release
+
+By default, the cloud image for 'release' is downloaded from the
+daily cloud image stream.
+
+Additional arguments can change behavior of what is downloaded.
+Some supported arguments:
+   * cloud-daily: use daily stream [default]
+   * cloud-release: use release stream rather than daily stream.
+   * maas-release, maas-daily: download maas images instead of cloud-image
+   * hwe-N: download the hwe kernel from release 'N' instead of default
+     this is only respected if maas stream is used.
+   * YYYYMMDD[.X] : download the specific build version
+
+example:
+ ${0##*/} xenial_dir xenial cloud-daily
+EOF
+}
+TEMP_D=""
+
+NO_IMAGE_AVAILABLE_RC=3
+
+cleanup() {
+   [ ! -d "${TEMP_D}" ] || rm -Rf "${TEMP_D}"
+}
+VERBOSITY=1
+inargs() {
+  local n=$1 x="";
+  shift;
+  for x in "$@"; do [ "$n" = "$x" ] && return 0; done;
+  return 1
+}
+debug() { [ $1 -ge $VERBOSITY ] || return 0; shift; echo "$@" 1>&2; }
+error() { echo "$@" 1>&2; }
+fail() { [ $# -eq 0 ] || error "$@"; exit 1; }
+
+VERBOSITY=0
+TEMP_D=$(mktemp -d ${TMPDIR:-/tmp}/${0##*/}.XXXXXX) || exit 1
+trap cleanup EXIT
+
+arches=( ppc64el i386 amd64 )
+releases=( $(ubuntu-distro-info --all) )
+mbase="http://maas.ubuntu.com/images/ephemeral-v2"
+cbase="http://cloud-images.ubuntu.com"
+def_stream_type="cloud"
+stream_src=""
+curbase="$mbase"
+def_rel="xenial"
+vername=""
+
+[ "$1" = "-h" -o "$1" = "--help" ] && { Usage; exit 0; }
+[ $# -lt 2 ] && { Usage 1>&2; exit 1; }
+out_d="$1"
+shift
+
+myarch=$(uname -m)
+case "$myarch" in
+   ppc64*) def_arch="ppc64el";;
+   i?86) def_arch="i386";;
+   x86_64) def_arch="amd64";;
+   arm*) def_arch="armel";;
+esac
+
+pt=( )
+for x in "$@"; do
+   inargs "$x" "${arches[@]}" && pt[${#pt[@]}]=arch=$x && arch="$x" && continue
+   inargs "$x" "${releases[@]}" && pt[${#pt[@]}]="release=$x" && release=$x && continue
+   [ "$x" = "released" -o "$x" = "release" ] && x="releases"
+   case "$x" in
+      cloud-released|cloud-release) x="cloud-releases";;
+      maas-released|maas-release) x="maas-releases";;
+   esac
+
+   case "$x" in
+      maas|cloud) stream_type="$x";;
+      cloud-daily|maas-daily|cloud-releases|maas-releases)
+          stream_type="${x%-*}"
+          stream_sub=${x#*-};;
+      http://*) stream=$x;;
+      hwe-*) subarch="$x";;
+      subarch=*) subarch=${x#*=};;
+      *=*) pt[${#pt[@]}]="$x";;
+      *~*) pt[${#pt[@]}]="$x";;
+      [0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]|[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9].[0-9])
+         pt[${#pt[@]}]="version_name=$x"
+         vername="$x";;
+      *) fail "Confused by input token '$x'";;
+   esac
+done
+
+[ -n "$stream_type" ] || stream_type="${def_stream_type}"
+if [ -z "$stream" ]; then
+    stream_sub=${stream_sub:-daily}
+    case "$stream_type" in
+        maas) stream="$mbase/$stream_sub";;
+        cloud) stream="$cbase/$stream_sub";;
+        *) fail "unknown stream_type '$stream_type'";;
+    esac
+fi
+
+[ -n "$arch" ] || pt[${#pt[@]}]="arch=$def_arch"
+
+if [ "$stream_type" = "maas" ]; then
+    if [ -z "$subarch" ]; then
+        t=${release#?}
+        first_letter=${release%${t}}
+        subarch="hwe-${first_letter}"
+        error "selected subarch=${subarch} for $release"
+    fi
+    pt[${#pt[@]}]="subarch=$subarch"
+    ofmt="%(sha256)s %(ftype)s %(subarch)s %(item_url)s"
+else
+    ofmt="%(sha256)s %(ftype)s %(item_url)s"
+fi
+
+OIFS="$IFS"
+mkdir -p "$out_d"
+case "$stream" in
+   *.json) :;;
+   *) keyring="/usr/share/keyrings/ubuntu-cloudimage-keyring.gpg";;
+esac
+
+needs=""
+[ -n "$keyring" -a ! -f "$keyring" ] &&
+   needs="${needs} ubuntu-cloudimage-keyring"
+
+for pair in sstream-query:simplestreams tgt-admin:tgt; do
+   cmd=${pair%:*}
+   pkg=${pair#*:}
+   command -v "$cmd" >/dev/null 2>&1 || needs="$needs $pkg"
+done
+
+if [ -n "${needs# }" ]; then
+   error "missing dependencies"
+   fail "sudo apt-get install -qy ${needs# }"
+fi
+
+qcmd=( sstream-query ${keyring:+"--keyring=$keyring"} ${vername:---max=1}
+       --output-format="$ofmt" "${stream}" datatype="image-downloads" 
+       "${pt[@]}" )
+echo "${qcmd[@]}"
+"${qcmd[@]}" > "${TEMP_D}/qout"
+roots=$(awk '$2 == "root-image.gz" || $2 == "disk1.img" { print $2 }' \
+        "${TEMP_D}/qout" | sort -u | wc -l)
+if [ "$roots" = "0" ]; then
+   error "No image available for $release in $stream${pt:+ (${pt[*]})}"
+   exit ${NO_IMAGE_AVAILABLE_RC}
+elif [ "$roots" != "1" ]; then
+   error "query resulted in '$roots' root images. expect 1 and only 1"
+   error "cmd was ${qcmd[*]}"
+   cat "${TEMP_D}/qout"
+   fail
+fi
+
+set -f
+while read line; do
+    set -- $line
+    if [ "$stream_type" = "maas" ]; then
+        sha256="$1"; ftype="$2"; subarch="$3"; url="$4"
+    else
+        sha256="$1"; ftype="$2"; url="$3"
+    fi
+    case "$ftype" in
+        boot-kernel|boot-initrd|root-image.gz|disk1.img) :;;
+        *) continue
+    esac
+    if [ "$ftype" = "root-image.gz" ]; then
+       fname="$ftype"
+       image_src="$out_d/$fname"
+       image="$out_d/root-image"
+    elif [ "$ftype" = "disk1.img" ]; then
+       fname="disk.img.dist"
+       image_src="$out_d/$fname"
+       image="$out_d/disk.img"
+    else
+       fname="$subarch/$ftype"
+    fi
+    out_f="${out_d}/$fname"
+    if [ -f "$out_f" ]; then
+        debug 1 "reusing existing '$out_f' rather than downloading $url."
+        continue
+    fi
+    [ -d "${out_f%/*}" ] || mkdir -p "${out_f%/*}"
+    tmp="${out_f}.tmp"
+    wget --progress=dot:mega -O "$tmp" "$url" || {
+        error "Failed to download $url to $tmp."
+        rm -f "$tmp"
+        exit 3
+    }
+    debug 1 "checksumming $tmp from $url"
+    out=$(sha256sum "$tmp") || {
+        error "Failed to checksum $tmp"
+        rm -f "$tmp"
+        exit 3;
+    }
+    found=${out%  *}
+    if [ "$found" != "$sha256" ]; then
+        error "$tmp from $url found sha256 of $found. expected $sha256."
+        ls -l "$tmp" 1>&2
+        rm -f "$tmp"
+        exit 3
+    fi
+    mv "$tmp" "$out_f" || fail "failed renaming $tmp to $out_f"
+    echo "$fname" "$url" >> "$out_d/contents"
+done < "${TEMP_D}/qout"
+
+if [ ! -f "$image" ]; then
+    case "$image_src" in
+        */root-image.gz)
+           debug 1 "decompressing $image_src"
+           zcat "$image_src" > "$image.tmp" &&
+             mv "$image.tmp" "$image" ||
+             { rm -f "$image.tmp"; exit 1; }
+           ;;
+        */disk.img.dist)
+           debug 1 "converting qcow2 in $image_src -> raw in $image"
+           qemu-img convert -O raw "$image_src" "$image.tmp" &&
+               mv "$image.tmp" "$image" ||
+               { rm -f "$image.tmp"; exit 1; }
+           ;;
+    esac
+fi
+
+# vi: ts=4 expandtab
diff --git a/debian/tests/install b/debian/tests/install
index ae2fe79..5077b7b 100755
--- a/debian/tests/install
+++ b/debian/tests/install
@@ -28,5 +28,8 @@ grep -vq '^GenerateName=yes' /etc/iscsi/initiatorname.iscsi || die_with_file /et
 grep -q '^InitiatorName=' /etc/iscsi/initiatorname.iscsi || die_with_file /etc/iscsi/initiatorname.iscsi "InitiatorName is not set"
 
 # Make sure the daemon is started
-service iscsid status || die "iscsid not running"
-pgrep -c iscsid >/dev/null || die "iscsid not running"
+systemctl is-active iscsid.socket || die "iscsid socket not running"
+# no-op discovery to socket activate service
+iscsiadm -m discovery -t sendtargets -p 127.0.0.1 >/dev/null 2>&1|| /bin/true
+systemctl is-active iscsid.service || die "iscsid service not running"
+pgrep -c iscsid >/dev/null || die "iscsid process not running"
diff --git a/debian/tests/patch-image b/debian/tests/patch-image
new file mode 100755
index 0000000..0688912
--- /dev/null
+++ b/debian/tests/patch-image
@@ -0,0 +1,374 @@
+#!/bin/bash
+
+VERBOSITY=1
+TEMP_D=""
+
+error() { echo "$@" 1>&2; }
+fail() { local r=$?;  [ $r -eq 0 ] && r=1; failrc "$r" "$@"; }
+failrc() { local r=$1; shift; [ $# -eq 0 ] || error "$@"; exit $r; }
+
+Usage() {
+    cat <<EOF
+Usage: ${0##*/} [options] image [packages]
+  Patch image, upgrading [packages].
+    --kernel FILE             copy kernel out to FILE
+    --initrd FILE             copy initrd out to FILE
+
+    --krd-only                only copy out kernel/initrd do not change image.
+                              this is incompatible with 'packages'
+                              it is a short-cut to specifying all the '--no-*'
+                              options below.
+
+    --no-copy-apt             do not copy host's apt repos in.
+
+  image modifications:
+    --no-update-fstab         do not modify fstab (LP: #1732028)
+
+  if no packages are provided, and ADT_TEST_TRIGGERS is set
+  in environment, then it will be read for the list of packages.
+  to override that behavior pass package 'none'.
+EOF
+
+}
+
+bad_Usage() { Usage 1>&2; [ $# -eq 0 ] || error "$@"; return 1; }
+cleanup() {
+    [ -z "${TEMP_D}" -o ! -d "${TEMP_D}" ] || rm -Rf "${TEMP_D}"
+}
+
+debug() {
+    local level=${1}; shift;
+    [ "${level}" -gt "${VERBOSITY}" ] && return
+    error "${@}"
+}
+
+adt_test_triggers_to_bin_pkgs() {
+    # ADT_TEST_TRIGGERS is space delimited <src>/version
+    # returns a scalar '_RET', caller has to expand
+    local tok src="" ver="" binpkgs=""
+    for tok in "$@"; do
+        src=${tok%/*}
+        ver=${tok#*/}
+        bin_packages_from_source_pkg "$src" "$ver" || return
+        if [ -z "${_RET}" ]; then
+            error "$tok: (source=$src ver=$ver) No packages available!"
+            return 1
+        fi
+        binpkgs="${binpkgs} ${_RET}"
+    done
+    _RET=${binpkgs# }
+}
+
+bin_packages_from_source_pkg() {
+    local pkg=$1 ver=${2} cmd="" out="" p="" ret=""
+    if ! command -v grep-aptavail >/dev/null; then
+        error "No command grep-aptavail: apt-get install dctrl-tools"
+        return 1
+    fi
+    cmd=( grep-aptavail --show-field=Package
+        --exact-match --field=Source:Package "$pkg" )
+    if [ -n "$ver" ]; then
+       cmd=( "${cmd[@]}" --and --field=Version "$ver" )
+    fi
+    out=$("${cmd[@]}" | sed 's,Package: ,,')
+    ret=""
+    for p in $out; do
+        ret="$ret ${p#Package: }${ver:+=${ver}}"
+    done
+    # if no version was provided, we could have multiple results
+    _RET=$(set -f; for i in ${ret}; do echo "$i"; done | sort -u)
+}
+
+update_fstab() {
+    # update_fstab(path) modify the fstab at path
+    # to remove problematic entries (LP: #1732028)
+    local fstab="$1"
+    if [ ! -e "$fstab.patch-image-dist" ]; then
+        cp "$fstab" "$fstab.patch-image-dist" ||
+            { error "failed backing up $fstab to $fstab.dist"; return 1; }
+    fi
+    sed -i '/^LABEL=UEFI/s/^/#/' "$fstab"
+}
+
+cat_debug_script() {
+    cat <<"EOF"
+#!/bin/sh
+set -f
+NAME=${1:-debug-pid-$$}
+[ "$(id -u)" = "0" ] && log="/run/${NAME}.log" || log="/tmp/${NAME}.log"
+
+msg() {
+   echo "===" "$@" "===" 1>&2
+}
+showcmd() {
+    msg "showcmd$" "$@"
+    "$@"
+}
+
+main() {
+    issues=$(journalctl | egrep "[.]mount: ")
+    if [ -z "$issues" ]; then
+        msg "$NAME:" "MOUNT ISSUES FOUND: NO"
+    else
+        msg "$NAME:" "MOUNT ISSUES FOUND: YES"
+    fi
+    showcmd systemctl list-units --no-pager --all --full "*.mount"
+    showcmd systemctl cat --no-pager --all --full "*.mount"
+    showcmd systemctl status --no-pager --all --full "*.mount"
+    showcmd cat /etc/fstab
+    showcmd cat /proc/1/mountinfo
+}
+
+main > "$log" 2>&1
+echo "============ $NAME ============="
+cat "$log"
+EOF
+}
+
+add_systemd_job() {
+    local target="$1" name="$2" after="$3" start="$4"
+    local spath="lib/systemd/system/xdebug-$name.service"
+    debug 1 "writing $name to $target/$spath"
+    cat > "$target/$spath" <<EOF
+[Unit]
+Description=Execute xdebug ${name}
+After=${after}
+
+[Service]
+Type=oneshot
+ExecStart=${start} ${name}
+RemainAfterExit=yes
+StandardOutput=journal+console
+
+[Install]
+WantedBy=multi-user.target
+EOF
+    [ $? -eq 0 ] || { error "failed writing $target/$spath"; return 1; }
+    local wantsdir="$target/etc/systemd/system/multi-user.target.wants"
+    ln -s "/$spath" "$wantsdir/" ||
+        { error "failed ln -s '/$spath' '$wantsdir/'"; return 1; }
+}
+
+insert_debug_1788188() {
+    # This is an attempt to collect more debug information in the
+    # event that the tests trigger LP: #1788188.
+    local target="$1"
+    [ "$target" = "/" -o -z "$target" ] &&
+        { error "target was / in insert_debug"; return 1; }
+    local script="usr/local/bin/debug-mounts"
+    cat_debug_script > "$target/$script" &&
+        chmod 755 "$target/$script" ||
+       { error "failed writing $target/script"; return 1; }
+    local name=""
+    ( set +f;
+      rm -f "$target/lib/systemd/system/xdebug"-*.service \
+            "$target/etc/systemd/system/"*.wants/xdebug*.service )
+    add_systemd_job "$target" network network-online.target "/$script" &&
+        add_systemd_job "$target" local-fs local-fs.target "/$script" ||
+        { error "failed adding systemd jobs"; return 1; }
+}
+
+main() {
+    local short_opts="hv"
+    local long_opts="help,no-copy-apt,initrd:,kernel:,verbose"
+    local getopt_out="" orig_args=""
+    orig_args=( "$@" )
+    getopt_out=$(getopt --name "${0##*/}" \
+        --options "${short_opts}" --long "${long_opts}" -- "$@") &&
+        eval set -- "${getopt_out}" ||
+        { bad_Usage; return; }
+
+    local cur="" next=""
+    local kernel="" initrd="" copy_apt=true krd_only=false
+    local update_fstab=true
+
+    while [ $# -ne 0 ]; do
+        cur="$1"; next="$2";
+        case "$cur" in
+            -h|--help) Usage ; exit 0;;
+               --krd-only) krd_only=true; shift;;
+               --no-copy-apt) copy_apt=false; shift;;
+               --no-update-fstab) update_fstab=false; shift;;
+               --kernel) kernel=$next; shift;;
+               --initrd) initrd=$next; shift;;
+            -v|--verbose) VERBOSITY=$((${VERBOSITY}+1));;
+            --) shift; break;;
+        esac
+        shift;
+    done
+
+    [ $# -ne 0 ] || { bad_Usage "must provide at least image"; return; }
+
+    [ "$(id -u)" = "0" ] || fail "not root"
+    target="$1"
+    shift
+    if [ -f "$target" ]; then
+        local nargs=""
+        nargs=( "${orig_args[@]}" )
+        # replace the first occurance of target in orig args with _MOUNTPOINT_
+        for((i=0;i<${#nargs[@]};i++)); do
+            [ "${nargs[$i]}" = "$target" ] && nargs[$i]=_MOUNTPOINT_ && break
+        done
+        debug 1 "mic $target -- $0 ${nargs[*]}"
+        IMAGE="$target" exec mount-image-callback \
+            --system-resolvconf "$target" -- "$0" "${nargs[@]}"
+    fi
+
+    if [ ! -d "$target" ]; then
+        fail "$target: not a directory or file"
+    fi
+
+    local tsrc=${IMAGE:-${target}}
+    local packages=( )
+    packages=( "$@" )
+
+    if $krd_only; then
+        if [ "${#packages[@]}" != 0 -a "${packages[*]}" != "none" ]; then
+            error "--krd-only is incompatible with packages."
+            return 1
+        fi
+        debug 1 "--krd-only provided no changes will be done."
+        copy_apt=false
+        update_fstab=false
+        packages=( "none" )
+    fi
+
+    if [ "${#packages[@]}" = "1" -a "${packages[0]}" = "none" ]; then
+        packages=( )
+    elif [ "${#packages[@]}" -eq 0 -a -n "${ADT_TEST_TRIGGERS}" ]; then
+        adt_test_triggers_to_bin_pkgs ${ADT_TEST_TRIGGERS} ||
+            fail "failed to find binary packages " \
+                "from ADT_TEST_TRIGGERS=$ADT_TEST_TRIGGERS"
+        packages=( $_RET )
+        debug 1 "read ADT_TEST_TRIGGERS=$ADT_TEST_TRIGGERS to set" \
+            "packages=${packages[*]}"
+    else
+        local opackages="" debs="" pkg=""
+        opackages=( "${packages[@]}" )
+        packages=( )
+        debs=( )
+        for pkg in "${opackages[@]}"; do
+            [ -f "${pkg}" ] && debs[${#debs[@]}]="$pkg" ||
+                packages[${packages[@]}]="$pkg"
+        done
+        if [ "${#packages[@]}" -eq 0 -a "${#debs[@]}" -eq 0 ]; then
+            packages=( open-iscsi )
+            debug 1 "no packages or debs given, using packages=${packages[*]}"
+        fi
+    fi
+
+    # if open-iscsi is not in the packages list above, we handle it specifically
+    # so that even if the image did not have open-iscsi, it will get it.
+    local pkg="" mypkg="open-iscsi"
+    for pkg in "${packages[@]}"; do
+        case "$pkg" in
+            open-iscsi|open-iscsi/*) mypkg="none";;
+        esac
+    done
+
+    TEMP_D=$(mktemp -d "${TMPDIR:-/tmp}/${0##*/}.XXXXXX") ||
+        fail "failed to make tempdir"
+    trap cleanup EXIT
+
+    if $copy_apt; then
+        local distdir="${target}/etc/apt.dist.${0##*/}"
+        if [ ! -d "$distdir" ]; then
+            mv "$target/etc/apt" "$distdir" ||
+                fail "failed to backup /etc/apt in $tsrc"
+        fi
+        cp -a /etc/apt "$target/etc/" ||
+            fail "failed to replace /etc/apt in $tsrc"
+
+        # find file:// repos in apt sources and copy them in
+        local file_repos=""
+        file_repos=$(
+            fm='s,.*[[:space:]]file:///*\([^[[:space:]]*\).*,/\1,p'
+            shopt -s nullglob
+            for f in /etc/apt/sources.list /etc/apt/sources.list.d/*.list; do
+                sed -n -e 's/#.*//' -e "$fm" "$f"
+            done
+        )
+        local dir="" bdir="" tdir=""
+        for dir in ${file_repos}; do
+            tdir="${target}$(dirname $dir)/$(basename ${dir})"
+            if [ -d "$dir" ]; then
+                debug 1 "copying $dir -> $tdir"
+                mkdir -p "$tdir" ||
+                    fail "failed to create $tdir"
+                rsync --delete -a "$dir/" "$tdir" ||
+                    fail "failed copy from $dir/ to $tdir"
+            fi
+        done
+    fi
+
+    if $update_fstab; then
+        update_fstab "$target/etc/fstab" ||
+            { error "failed updating /etc/fstab in target"; return 1; }
+    fi
+
+    insert_debug_1788188 "$target" || return 1
+
+    mount -o bind /sys "$target"/sys || :
+    mount -o bind /proc "$target"/proc || :
+    mount -o bind /dev "$target"/dev || :
+    mount -o bind /dev/pts "$target"/dev/pts || :
+
+    debug 1 "${#packages[@]} packages: ${packages[*]}"
+    if [ "${#packages[@]}" != "0" ]; then
+        DEBIAN_FRONTEND=noninteractive chroot "$target" sh -exc '
+            mypkg=$1
+            shift
+            apt-get update -q
+            if [ "$mypkg" != "none" ]; then
+                apt-get install -qy "$mypkg"
+            fi
+            apt-get install -qy --only-upgrade "$@"' \
+                chroot-inst "$mypkg" "${packages[@]}" ||
+            fail "failed to install ${packages[*]} in $target"
+    fi
+
+    debug 1 "${#debs[@]} debs: ${debs[*]}"
+    if [ "${#debs[@]}" != "0" ]; then
+        local tmpd=""
+        tmpd=$(mktemp -d "${target}/tmp/${0##*/}.XXXXXX")
+        cp "${debs[@]}" "$tmpd"
+        DEBIAN_FRONTEND=noninteractive chroot "$target" sh -exc \
+            'cd "$1"; shift; dpkg -i *.deb' debinstalls "${tmpd#${target}}"
+        rm -Rf "${tmpd}"
+    fi
+
+    umount "$target"/dev/pts || :
+    umount "$target"/dev || :
+    umount "$target"/proc || :
+    umount "$target"/sys || :
+
+    local kpath="" ipath=""
+    for f in "$target/boot/"*; do
+        case "${f##*/}" in
+            *.signed) continue;;
+            vmlinu?-*) kpath="$f";;
+            initrd.img-*) ipath="$f";;
+        esac
+    done
+
+    if [ -n "$kernel" ]; then
+        [ -n "$kpath" ] || fail "unable to find kernel in $tsrc"
+        debug 1 "using kernel ${kpath#${target}}"
+        cp "$kpath" "$kernel" ||
+            fail "failed copy $kpath to $kernel"
+        [ -z "$IMAGE" ] || chown "--reference=$IMAGE" "$kernel"
+    fi
+
+    if [ -n "$initrd" ]; then
+        [ -n "$ipath" ] || fail "unable to find initrd in $tsrc"
+        debug 1 "using initrd ${ipath#${target}}"
+        cp "$ipath" "$initrd" ||
+            fail "failed copy $ipath to $initrd"
+        [ -z "$IMAGE" ] || chown "--reference=$IMAGE" "$initrd"
+    fi
+
+}
+
+main "$@"
+
+# vi: ts=4 expandtab
diff --git a/debian/tests/test-open-iscsi.py b/debian/tests/test-open-iscsi.py
new file mode 100644
index 0000000..cce02fb
--- /dev/null
+++ b/debian/tests/test-open-iscsi.py
@@ -0,0 +1,426 @@
+#!/usr/bin/python2
+#
+#    test-open-iscsi.py quality assurance test script for open-iscsi
+#    Copyright (C) 2011 Canonical Ltd.
+#    Author: Jamie Strandboge <[e-mail]>
+#
+#    This program is free software: you can redistribute it and/or modify
+#    it under the terms of the GNU General Public License version 3,
+#    as published by the Free Software Foundation.
+#
+#    This program is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+#    GNU General Public License for more details.
+#
+#    You should have received a copy of the GNU General Public License
+#    along with this program. If not, see <http://www.gnu.org/licenses/>.
+#
+# packages required for test to run:
+# QRT-Packages: open-iscsi
+# packages where more than one package can satisfy a runtime requirement:
+# QRT-Alternates: 
+# files and directories required for the test to run:
+# QRT-Depends: 
+# privilege required for the test to run (remove line if running as user is okay):
+# QRT-Privilege: root
+
+'''
+    In general, this test should be run in a virtual machine (VM) or possibly
+    a chroot and not on a production machine. While efforts are made to make
+    these tests non-destructive, there is no guarantee this script will not
+    alter the machine. You have been warned.
+
+    How to run in a clean VM:
+    $ sudo apt-get -y install python-unit <QRT-Packages> && sudo ./test-PKG.py -v'
+
+    How to run in a clean schroot named 'lucid':
+    $ schroot -c lucid -u root -- sh -c 'apt-get -y install python-unit <QRT-Packages> && ./test-PKG.py -v'
+
+
+    NOTES:
+    - currently only tested on Ubuntu 8.04
+'''
+
+
+from netifaces import gateways, AF_INET
+import unittest, subprocess, sys, os, glob
+import shutil
+import testlib
+import textwrap
+from tempfile import mkdtemp
+import time
+
+# There are setup based on README.multipurpose-vm. Feel free to override.
+remote_server = ''
+username = 'ubuntu'
+password = 'passwd'
+username_in = 'ubuntu'
+password_in = 'ubuntupasswd'
+initiatorname = 'iqn.2009-10.com.example.hardy-multi:iscsi-01'
+
+COLLECT_USER_DATA = """\
+#cloud-config
+bukket:
+ - &get_resolved_status |
+   if [ "${1:--}" != "-" ]; then
+      exec >"$1" 2>&1
+   fi
+   if ! command -v systemd-resolve >/dev/null 2>&1; then
+       echo "systemd-resolve: not available."
+       exit
+   fi
+   if ! ( systemd-resolve --help | grep -q -- --status ); then
+       echo "systemd-resolve: no --status."
+       exit
+   fi
+   systemd-resolve --status --no-pager
+
+ - &get_iscsid_status |
+   [ "${1:--}" != "-" ] && exec >"$1" 2>&1
+   udevadm settle
+   systemctl is-active iscsid.service
+   systemctl status --no-pager --full iscsid.service
+
+ - &add_and_remove_tuntap |
+   #!/bin/sh
+   # LP: #1785108 would break dns when any device was removed.
+   tapdev="mytap0"
+   echo ==== Adding $tapdev ====
+   ip tuntap add mode tap user root $tapdev
+   udevadm settle
+   echo ==== Removing $tapdev ====
+   ip tuntap del mode tap $tapdev
+   udevadm settle
+
+ - &collect_debug_mounts |
+   [ "${1:--}" != "-" ] && exec >"$1" 2>&1
+   [ -x /usr/local/bin/debug-mounts ] || exit 0
+   /usr/local/bin/debug-mounts
+
+runcmd:
+ - [ sh, -c, *add_and_remove_tuntap ]
+ - [ mkdir, -p, /output ]
+ - [ cp, /etc/resolv.conf, /output ]
+ - [ sh, -c, *get_resolved_status, --, /output/systemd-resolve-status.txt ]
+ - [ sh, -c, *get_iscsid_status, --, /output/iscsid-status.txt ]
+ - [ sh, -c, *collect_debug_mounts, --, /output/debug-mounts.txt ]
+ - [ sh, -c, 'journalctl --boot=0 --output=short-monotonic > /output/journal.txt' ]
+ - [ sh, -c, 'dpkg-query --show > /output/manifest.txt' ]
+ - [ tar, -C, /output, -cf, /dev/disk/by-id/virtio-output-disk, . ]
+
+power_state:
+ mode: poweroff
+ message: cloud-init finished. Shutting down.
+ timeout: 60
+"""
+
+try:
+    from private.qrt.OpenIscsi import PrivateOpenIscsiTest
+except ImportError:
+    class PrivateOpenIscsiTest(object):
+        '''Empty class'''
+    print >>sys.stdout, "Skipping private tests"
+
+class OpenIscsiTest(testlib.TestlibCase, PrivateOpenIscsiTest):
+    '''Test my thing.'''
+
+    def setUp(self):
+        '''Set up prior to each test_* function'''
+        self.pidfile = "/var/run/iscsid.pid"
+        self.exe = "/sbin/iscsid"
+        self.daemon = testlib.TestDaemon(["service", "open-iscsi"])
+        self.initiatorname_iscsi = '/etc/iscsi/initiatorname.iscsi'
+        self.iscsid_conf = '/etc/iscsi/iscsid.conf'
+
+    def tearDown(self):
+        '''Clean up after each test_* function'''
+        global remote_server
+        global initiatorname
+
+        # If remote server is setup, convert back to manual, logout, remove
+        # testlib configs and restart (in that order)
+        if remote_server != '':
+            testlib.cmd(['iscsiadm', '-m', 'node', '--targetname', initiatorname, '-p', '%s:3260' % remote_server, '--op=update', '--name', 'node.startup', '--value=manual'])
+            testlib.cmd(['iscsiadm', '-m', 'node', '--targetname', initiatorname, '-p', '%s:3260' % remote_server, '--op=update', '--name',  'node.conn[0].startup', '--value=manual'])
+            testlib.cmd(['iscsiadm', '-m', 'node', '--targetname', initiatorname, '-p', '%s:3260' % remote_server, '--logout'])
+
+        testlib.config_restore(self.initiatorname_iscsi)
+        testlib.config_restore(self.iscsid_conf)
+        self.daemon.restart()
+
+    def test_discovery_with_server(self):
+        '''Test iscsi_discovery to remote server'''
+        global remote_server
+        global username
+        global password
+        global username_in
+        global password_in
+        global initiatorname
+
+        if remote_server == '':
+            return self._skipped("--remote-server not specified")
+
+        contents = '''
+InitiatorName=%s
+InitiatorAlias=ubuntu
+''' % (initiatorname)
+        testlib.config_replace(self.initiatorname_iscsi, contents, True)
+
+        contents = '''
+node.session.auth.authmethod = CHAP
+node.session.auth.username = %s
+node.session.auth.password = %s
+node.session.auth.username_in = %s
+node.session.auth.password_in = %s
+
+discovery.sendtargets.auth.authmethod = CHAP
+discovery.sendtargets.auth.username = %s
+discovery.sendtargets.auth.password = %s
+discovery.sendtargets.auth.username_in = %s
+discovery.sendtargets.auth.password_in = %s
+''' % (username, password, username_in, password_in, username, password, username_in, password_in)
+        testlib.config_replace(self.iscsid_conf, contents, True)
+
+        self.assertTrue(self.daemon.restart())
+        time.sleep(2)
+        self.assertTrue(self.daemon.status()[0])
+
+        rc, report = testlib.cmd(["/sbin/iscsi_discovery", remote_server])
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEquals(expected, rc, result + report)
+        for i in ['starting discovery to %s' % remote_server,
+                  'Testing iser-login to target %s portal %s' % (initiatorname, remote_server),
+                  'starting to test tcp-login to target %s portal %s' % (initiatorname, remote_server),
+                  'discovered 1 targets at %s, connected to 1' % remote_server]:
+            result = "Could not find '%s' in report:\n" % i
+            self.assertTrue(i in report, result + report)
+
+    def test_net_interface_handler_execute_bit(self):
+        '''Test /lib/open-iscsi/net-interface-handler is executable.'''
+        nih_path = '/lib/open-iscsi/net-interface-handler'
+        self.assertTrue(os.access(nih_path, os.X_OK))
+
+class CloudImageTest(testlib.TestlibCase, PrivateOpenIscsiTest):
+    '''Test the cloud image can boot on iscsi root.
+
+    See README-boot-test.md for more information.
+    '''
+
+    @classmethod
+    def setUpClass(cls):
+        reason = (
+            "Skipped Cloud Image test on {arch}. whitelisted are: {whitelist}")
+        whitelisted = os.environ.get('WHITELIST_ARCHES', 'amd64').split(",")
+        curarch = testlib.manager.dpkg_arch
+        if testlib.manager.dpkg_arch not in whitelisted:
+            raise unittest.SkipTest(
+                reason.format(arch=curarch, whitelist=whitelisted))
+
+        here = os.path.dirname(os.path.abspath(__file__))
+        os.environ['PATH'] = "%s:%s" % (here, os.environ['PATH'])
+        release = os.environ.get(
+            "ISCSI_TEST_RELEASE", testlib.ubuntu_release())
+        image_d = os.path.join(here, '{}.d'.format(release))
+        # Download MAAS ephemeral image.
+        info = {'release': release,
+                'image_d': image_d,
+                'root_image': os.path.join(image_d, 'disk.img'),
+                'kernel': os.path.join(image_d, 'kernel'),
+                'initrd': os.path.join(image_d, 'initrd')}
+        try:
+            get_image(info['image_d'], release)
+        except subprocess.CalledProcessError as e:
+            if e.return_code != 3:
+                raise e
+            raise unittest.SkipTest(
+                "Cloud Image not available for release '%s'." % release)
+        if os.environ.get("NO_PATCH_IMAGE", "0") == "0":
+            patch_image(info['root_image'],
+                        kernel=info['kernel'], initrd=info['initrd'])
+        cls.info = info
+        cls.here = here
+
+    def tearDown(self):
+        super(CloudImageTest, self).tearDown()
+        if os.path.exists(self.tmpdir):
+            shutil.rmtree(self.tmpdir)
+
+    def setUp(self):
+        super(CloudImageTest, self).setUp()
+        self.tmpdir = mkdtemp()
+        udp = os.path.join(self.tmpdir, 'user-data')
+        with open(udp, "w") as fp:
+            fp.write(COLLECT_USER_DATA)
+        self.info['user-data'] = udp
+
+    def create_output_disk(self):
+        path = os.path.join(self.tmpdir, 'output-disk.img')
+        subprocess.check_call([
+            'qemu-img', 'create', '-f',  'raw', path, '10M'])
+        return path
+
+    def extract_files(self, path):
+        # get contents in a dictionary of tarball at 'path'
+        tmpdir = mkdtemp()
+        try:
+            subprocess.check_call(['tar', '-C', tmpdir, '-xf', path])
+            flist = {}
+            prefix = len(tmpdir) + 1
+            for root, dirs, files in os.walk(tmpdir):
+                for fname in files:
+                    fpath = os.path.join(root, fname)
+                    key = fpath[prefix:]
+                    with open(fpath, "r") as fp:
+                        flist[key] = fp.read()
+            return flist
+        finally:
+            shutil.rmtree(tmpdir)
+
+    def test_tgt_boot(self):
+        tgt_boot_cmd = os.path.join(self.here, 'tgt-boot-test')
+        # Add self.here to PATH so xkvm will be available to tgt-boot-test
+        dns_addr = '10.1.1.4'
+        rel_dir = '{}.d'.format(self.info['release'])
+        dns_search = 'example.com'
+        info = {'host': '10.1.1.2', 'dns': dns_addr,
+                'dnssearch': dns_search, 'network': '10.1.1.0/24'}
+        netdev = ("--netdev=user,net={network},host={host},dns={dns},"
+                  "dnssearch={dnssearch}").format(**info)
+
+        artifacts_dir = os.environ.get('AUTOPKGTEST_ARTIFACTS')
+        if artifacts_dir and not os.path.isdir(artifacts_dir):
+            os.makedirs(artifacts_dir)
+
+        output_disk = self.create_output_disk()
+        cmd = [
+            tgt_boot_cmd, '-v', netdev,
+            '--disk=%s,serial=output-disk' % output_disk,
+            '--user-data-add=%s' % self.info['user-data'],
+            self.info['root_image'], self.info['kernel'],
+            self.info['initrd']]
+        sys.stderr.write(' '.join(cmd) + "\n")
+
+        env = os.environ.copy()
+        env['BOOT_TIMEOUT'] = env.get('BOOT_TIMEOUT', '60m')
+        subprocess.check_call(cmd, env=env)
+
+        if artifacts_dir:
+            tgz = os.path.join(artifacts_dir, "tgt-collected.tar.gz")
+            shutil.copy(output_disk, tgz)
+            print("Copied output_disk '%s' to artifacts dir '%s'" %
+                  (output_disk, tgz))
+
+        files = self.extract_files(output_disk)
+        print("collected files: %s" % files.keys())
+        resolvconf = files.get('resolv.conf', "NO_RESOLVCONF_FOUND")
+        resolve_status = files.get('systemd-resolve-status.txt')
+
+        resolvconf_id = 'generated by resolvconf'
+        resolved_addr = "127.0.0.53"
+        if resolvconf_id in resolvconf:
+            print("resolvconf manages resolvconf.\n")
+            self.assertIn(
+                dns_addr, resolvconf,
+                msg = ("%s not in resolvconf contents: \n%s" %
+                       (dns_addr, resolvconf)))
+            if dns_search in resolvconf:
+                print("%s was found in resolv.conf." % dns_search)
+            elif resolved_addr in resolvconf and dns_search in resolve_status:
+                # zesty has resolvconf and systemd-resolved.
+                print("%s was in resolve_status and %s in resolv.conf" %
+                      (resolved_addr, dns_search))
+            else:
+                raise AssertionError(
+                    "%s domain is not being searched." % dns_search)
+
+        else:
+            print("systemd-resolved managing resolve.conf\n")
+            self.assertIn(
+                resolved_addr, resolvconf,
+                msg="%s not in resolved resolv.conf: %s" % (resolved_addr,
+                                                            resolvconf))
+            self.assertIn(dns_addr, resolve_status,
+                msg=("%s not in systemd-resolve status: %s" %
+                     (dns_addr, resolve_status)))
+            self.assertIn(dns_search, resolve_status,
+                msg=("search addr '%s' not in systemd-resolve status: %s" %
+                     (dns_search, resolve_status)))
+
+        # iscsid-status.txt has first line output from
+        # 'systemctl is-active iscsid.service' and then 'systemcl status'
+        iscsid_status = files.get('iscsid-status.txt')
+        is_active = iscsid_status.splitlines()[0]
+        self.assertEqual(
+            "active", is_active,
+            msg=("Expected iscsid.service active, found '%s'.\n%s\n" %
+                 (is_active, iscsid_status)))
+
+
+def get_image(top_d, release):
+    cmd = ['get-image', top_d, 'cloud-daily', release]
+    subprocess.check_call(cmd)
+
+
+def patch_image(image, packages=None, kernel=None, initrd=None):
+    '''Patch root-image with dep8 built open-iscsi package.'''
+
+    if packages is None:
+        # an empty 'packages' to patch-image still installs open-iscsi
+        packages = []
+
+    cmd = ['patch-image', image]
+    if kernel:
+        cmd.append('--kernel=%s' % kernel)
+    if initrd:
+        cmd.append('--initrd=%s' % initrd)
+    cmd.extend(packages)
+
+    subprocess.check_call(cmd)
+
+
+if __name__ == '__main__':
+    import optparse
+    parser = optparse.OptionParser()
+    parser.add_option("-v", "--verbose", dest="verbose", help="Verbose", action="store_true")
+    parser.add_option("-s", "--remote-server", dest="remote_server", help="Specify host with available iSCSI volumes", metavar="HOST")
+
+    parser.add_option("-n", "--initiatorname", dest="initiatorname", help="Specify initiatorname for use with --remote-server", metavar="NAME")
+
+    parser.add_option("--password", dest="password", help="Specify password for use with --remote-server", metavar="PASS")
+    parser.add_option("--password-in", dest="password_in", help="Specify password_in for use with --remote-server", metavar="PASS")
+
+    parser.add_option("--username", dest="username", help="Specify username for use with --remote-server", metavar="USER")
+    parser.add_option("--username-in", dest="username_in", help="Specify username_in for use with --remote-server", metavar="USER")
+
+    (options, args) = parser.parse_args()
+
+    if options.remote_server:
+        remote_server = options.remote_server
+
+        if options.username:
+            username = options.username
+        if options.password:
+            password = options.password
+        if options.username_in:
+            username_in = options.username_in
+        if options.password_in:
+            password_in = options.password_in
+        if options.initiatorname:
+            initiatorname = options.initiatorname
+        print "Connecting to remote server with:"
+        print " host = %s " % remote_server
+        print ' initiatorname = %s' % initiatorname
+        print ' username = %s' % username
+        print ' password = %s' % password
+        print ' username_in = %s' % username_in
+        print ' password_in = %s' % password_in
+
+    suite = unittest.TestSuite()
+    suite.addTest(unittest.TestLoader().loadTestsFromTestCase(OpenIscsiTest))
+    suite.addTest(unittest.TestLoader().loadTestsFromTestCase(
+        CloudImageTest))
+    rc = unittest.TextTestRunner(verbosity=2).run(suite)
+    if not rc.wasSuccessful():
+        sys.exit(1)
diff --git a/debian/tests/testlib.py b/debian/tests/testlib.py
new file mode 100644
index 0000000..b17c3fc
--- /dev/null
+++ b/debian/tests/testlib.py
@@ -0,0 +1,1153 @@
+#
+#    testlib.py quality assurance test script
+#    Copyright (C) 2008-2011 Canonical Ltd.
+#
+#    This library is free software; you can redistribute it and/or
+#    modify it under the terms of the GNU Library General Public
+#    License as published by the Free Software Foundation; either
+#    version 2 of the License.
+#
+#    This library is distributed in the hope that it will be useful,
+#    but WITHOUT ANY WARRANTY; without even the implied warranty of
+#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+#    Library General Public License for more details.
+#
+#    You should have received a copy of the GNU Library General Public
+#    License along with this program.  If not, see
+#    <http://www.gnu.org/licenses/>.
+#
+
+'''Common classes and functions for package tests.'''
+
+import string, random, crypt, subprocess, pwd, grp,  signal, time, unittest, tempfile, shutil, os, os.path, re, glob
+import sys, socket, gzip
+from stat import *
+from encodings import string_escape
+
+import warnings
+warnings.filterwarnings('ignore', message=r'.*apt_pkg\.TagFile.*', category=DeprecationWarning)
+try:
+    import apt_pkg
+    apt_pkg.InitSystem();
+except:
+    # On non-Debian system, fall back to simple comparison without debianisms
+    class apt_pkg(object):
+        def VersionCompare(one, two):
+            list_one = one.split('.')
+            list_two = two.split('.')
+            while len(list_one)>0 and len(list_two)>0:
+                if list_one[0] > list_two[0]:
+                    return 1
+                if list_one[0] < list_two[0]:
+                    return -1
+                list_one.pop(0)
+                list_two.pop(0)
+            return 0
+
+bogus_nxdomain = "208.69.32.132"
+
+# http://www.chiark.greenend.org.uk/ucgi/~cjwatson/blosxom/2009-07-02-python-sigpipe.html
+# This is needed so that the subprocesses that produce endless output
+# actually quit when the reader goes away.
+import signal
+def subprocess_setup():
+    # Python installs a SIGPIPE handler by default. This is usually not what
+    # non-Python subprocesses expect.
+    signal.signal(signal.SIGPIPE, signal.SIG_DFL)
+
+class TimedOutException(Exception):
+    def __init__(self, value = "Timed Out"):
+        self.value = value
+    def __str__(self):
+        return repr(self.value)
+
+def _restore_backup(path):
+    pathbackup = path + '.autotest'
+    if os.path.exists(pathbackup):
+        shutil.move(pathbackup, path)
+
+def _save_backup(path):
+    pathbackup = path + '.autotest'
+    if os.path.exists(path) and not os.path.exists(pathbackup):
+        shutil.copy2(path, pathbackup)
+        # copy2 does not copy ownership, so do it here.
+        # Reference: http://docs.python.org/library/shutil.html
+        a = os.stat(path)
+        os.chown(pathbackup, a[4], a[5])
+
+def config_copydir(path):
+    if os.path.exists(path) and not os.path.isdir(path):
+        raise OSError, "'%s' is not a directory" % (path)
+    _restore_backup(path)
+
+    pathbackup = path + '.autotest'
+    if os.path.exists(path):
+        shutil.copytree(path, pathbackup, symlinks=True)
+
+def config_replace(path,contents,append=False):
+    '''Replace (or append) to a config file'''
+    _restore_backup(path)
+    if os.path.exists(path):
+        _save_backup(path)
+        if append:
+            contents = file(path).read() + contents
+    open(path, 'w').write(contents)
+
+def config_comment(path, field):
+    _save_backup(path)
+    contents = ""
+    for line in file(path):
+        if re.search("^\s*%s\s*=" % (field), line):
+            line = "#" + line
+        contents += line
+
+    open(path+'.new', 'w').write(contents)
+    os.rename(path+'.new', path)
+
+def config_set(path, field, value, spaces=True):
+    _save_backup(path)
+    contents = ""
+    if spaces==True:
+        setting = '%s = %s\n' % (field, value)
+    else:
+        setting = '%s=%s\n' % (field, value)
+    found = False
+    for line in file(path):
+        if re.search("^\s*%s\s*=" % (field), line):
+            found = True
+            line = setting
+        contents += line
+    if not found:
+        contents += setting
+
+    open(path+'.new', 'w').write(contents)
+    os.rename(path+'.new', path)
+
+def config_patch(path, patch, depth=1):
+    '''Patch a config file'''
+    _restore_backup(path)
+    _save_backup(path)
+
+    handle, name = mkstemp_fill(patch)
+    rc = subprocess.call(['/usr/bin/patch', '-p%s' %(depth), path], stdin=handle, stdout=subprocess.PIPE)
+    os.unlink(name)
+    if rc != 0:
+        raise Exception("Patch failed")
+
+def config_restore(path):
+    '''Rename a replaced config file back to its initial state'''
+    _restore_backup(path)
+
+def timeout(secs, f, *args):
+    def handler(signum, frame):
+        raise TimedOutException()
+
+    old = signal.signal(signal.SIGALRM, handler)
+    result = None
+    signal.alarm(secs)
+    try:
+        result = f(*args)
+    finally:
+        signal.alarm(0)
+        signal.signal(signal.SIGALRM, old)
+
+    return result
+
+def require_nonroot():
+    if os.geteuid() == 0:
+        print >>sys.stderr, "This series of tests should be run as a regular user with sudo access, not as root."
+        sys.exit(1)
+
+def require_root():
+    if os.geteuid() != 0:
+        print >>sys.stderr, "This series of tests should be run with root privileges (e.g. via sudo)."
+        sys.exit(1)
+
+def require_sudo():
+    if os.geteuid() != 0 or os.environ.get('SUDO_USER', None) == None:
+        print >>sys.stderr, "This series of tests must be run under sudo."
+        sys.exit(1)
+    if os.environ['SUDO_USER'] == 'root':
+        print >>sys.stderr, 'Please run this test using sudo from a regular user. (You ran sudo from root.)'
+        sys.exit(1)
+
+def random_string(length,lower=False):
+    '''Return a random string, consisting of ASCII letters, with given
+    length.'''
+
+    s = ''
+    selection = string.letters
+    if lower:
+        selection = string.lowercase
+    maxind = len(selection)-1
+    for l in range(length):
+        s += selection[random.randint(0, maxind)]
+    return s
+
+def mkstemp_fill(contents,suffix='',prefix='testlib-',dir=None):
+    '''As tempfile.mkstemp does, return a (file, name) pair, but with
+    prefilled contents.'''
+
+    handle, name = tempfile.mkstemp(suffix=suffix,prefix=prefix,dir=dir)
+    os.close(handle)
+    handle = file(name,"w+")
+    handle.write(contents)
+    handle.flush()
+    handle.seek(0)
+
+    return handle, name
+
+def create_fill(path, contents, mode=0644):
+    '''Safely create a page'''
+    # make the temp file in the same dir as the destination file so we
+    # don't get invalid cross-device link errors when we rename
+    handle, name = mkstemp_fill(contents, dir=os.path.dirname(path))
+    handle.close()
+    os.rename(name, path)
+    os.chmod(path, mode)
+
+def login_exists(login):
+    '''Checks whether the given login exists on the system.'''
+
+    try:
+        pwd.getpwnam(login)
+        return True
+    except KeyError:
+        return False
+
+def group_exists(group):
+    '''Checks whether the given login exists on the system.'''
+
+    try:
+        grp.getgrnam(group)
+        return True
+    except KeyError:
+        return False
+
+def recursive_rm(dirPath, contents_only=False):
+    '''recursively remove directory'''
+    names = os.listdir(dirPath)
+    for name in names:
+        path = os.path.join(dirPath, name)
+        if os.path.islink(path) or not os.path.isdir(path):
+            os.unlink(path)
+        else:
+            recursive_rm(path)
+    if contents_only == False:
+        os.rmdir(dirPath)
+
+def check_pidfile(exe, pidfile):
+    '''Checks if pid in pidfile is running'''
+    if not os.path.exists(pidfile):
+        return False
+
+    # get the pid
+    try:
+        fd = open(pidfile, 'r')
+        pid = fd.readline().rstrip('\n')
+        fd.close()
+    except:
+        return False
+
+    return check_pid(exe, pid)
+
+def check_pid(exe, pid):
+    '''Checks if pid is running'''
+    cmdline = "/proc/%s/cmdline" % (str(pid))
+    if not os.path.exists(cmdline):
+        return False
+
+    # get the command line
+    try:
+        fd = open(cmdline, 'r')
+        tmp = fd.readline().split('\0')
+        fd.close()
+    except:
+        return False
+
+    # this allows us to match absolute paths or just the executable name
+    if re.match('^' + exe + '$', tmp[0]) or \
+       re.match('.*/' + exe + '$', tmp[0]) or \
+       re.match('^' + exe + ': ', tmp[0]) or \
+       re.match('^\(' + exe + '\)', tmp[0]):
+        return True
+
+    return False
+
+def check_port(port, proto, ver=4):
+    '''Check if something is listening on the specified port.
+       WARNING: for some reason this does not work with a bind mounted /proc
+    '''
+    assert (port >= 1)
+    assert (port <= 65535)
+    assert (proto.lower() == "tcp" or proto.lower() == "udp")
+    assert (ver == 4 or ver == 6)
+
+    fn = "/proc/net/%s" % (proto)
+    if ver == 6:
+        fn += str(ver)
+
+    rc, report = cmd(['cat', fn])
+    assert (rc == 0)
+
+    hport = "%0.4x" % port
+
+    if re.search(': [0-9a-f]{8}:%s [0-9a-f]' % str(hport).lower(), report.lower()):
+        return True
+    return False
+
+def get_arch():
+    '''Get the current architecture'''
+    rc, report = cmd(['uname', '-m'])
+    assert (rc == 0)
+    return report.strip()
+
+def get_memory():
+    '''Gets total ram and swap'''
+    meminfo = "/proc/meminfo"
+    memtotal = 0
+    swaptotal = 0
+    if not os.path.exists(meminfo):
+        return (False, False)
+
+    try:
+        fd = open(meminfo, 'r')
+        for line in fd.readlines():
+            splitline = line.split()
+            if splitline[0] == 'MemTotal:':
+                memtotal = int(splitline[1])
+            elif splitline[0] == 'SwapTotal:':
+                swaptotal = int(splitline[1])
+        fd.close()
+    except:
+        return (False, False)
+
+    return (memtotal,swaptotal)
+
+def is_running_in_vm():
+    '''Check if running under a VM'''
+    # add other virtualization environments here
+    for search in ['QEMU Virtual CPU']:
+        rc, report = cmd_pipe(['dmesg'], ['grep', search])
+        if rc == 0:
+            return True
+    return False
+
+def ubuntu_release():
+    '''Get the Ubuntu release'''
+    f = "/etc/lsb-release"
+    try:
+        size = os.stat(f)[ST_SIZE]
+    except:
+        return "UNKNOWN"
+
+    if size > 1024*1024:
+        raise IOError, 'Could not open "%s" (too big)' % f
+
+    try:
+        fh = open("/etc/lsb-release", 'r')
+    except:
+        raise
+
+    lines = fh.readlines()
+    fh.close()
+
+    pat = re.compile(r'DISTRIB_CODENAME')
+    for line in lines:
+        if pat.search(line):
+            return line.split('=')[1].rstrip('\n').rstrip('\r')
+
+    return "UNKNOWN"
+
+def cmd(command, input = None, stderr = subprocess.STDOUT, stdout = subprocess.PIPE, stdin = None, timeout = None):
+    '''Try to execute given command (array) and return its stdout, or return
+    a textual error if it failed.'''
+
+    try:
+        sp = subprocess.Popen(command, stdin=stdin, stdout=stdout, stderr=stderr, close_fds=True, preexec_fn=subprocess_setup)
+    except OSError, e:
+        return [127, str(e)]
+
+    out, outerr = sp.communicate(input)
+    # Handle redirection of stdout
+    if out == None:
+        out = ''
+    # Handle redirection of stderr
+    if outerr == None:
+        outerr = ''
+    return [sp.returncode,out+outerr]
+
+def cmd_pipe(command1, command2, input = None, stderr = subprocess.STDOUT, stdin = None):
+    '''Try to pipe command1 into command2.'''
+    try:
+        sp1 = subprocess.Popen(command1, stdin=stdin, stdout=subprocess.PIPE, stderr=stderr, close_fds=True)
+        sp2 = subprocess.Popen(command2, stdin=sp1.stdout, stdout=subprocess.PIPE, stderr=stderr, close_fds=True)
+    except OSError, e:
+        return [127, str(e)]
+
+    out = sp2.communicate(input)[0]
+    return [sp2.returncode,out]
+
+def cwd_has_enough_space(cdir, total_bytes):
+    '''Determine if the partition of the current working directory has 'bytes'
+       free.'''
+    rc, df_output = cmd(['df'])
+    result = 'Got exit code %d, expected %d\n' % (rc, 0)
+    if rc != 0:
+        return False
+
+    kb = total_bytes / 1024
+
+    mounts = dict()
+    for line in df_output.splitlines():
+        if '/' not in line:
+            continue
+        tmp = line.split()
+        mounts[tmp[5]] = int(tmp[3])
+
+    cdir = os.getcwd()
+    while cdir != '/':
+        if not mounts.has_key(cdir):
+            cdir = os.path.dirname(cdir)
+            continue
+        if kb < mounts[cdir]:
+            return True
+        else:
+            return False
+
+    if kb < mounts['/']:
+        return True
+
+    return False
+
+def get_md5(filename):
+    '''Gets the md5sum of the file specified'''
+
+    (rc, report) = cmd(["/usr/bin/md5sum", "-b", filename])
+    expected = 0
+    assert (expected == rc)
+
+    return report.split(' ')[0]
+
+def dpkg_compare_installed_version(pkg, check, version):
+    '''Gets the version for the installed package, and compares it to the
+       specified version.
+    '''
+    (rc, report) = cmd(["/usr/bin/dpkg", "-s", pkg])
+    assert (rc == 0)
+    assert ("Status: install ok installed" in report)
+    installed_version = ""
+    for line in report.splitlines():
+        if line.startswith("Version: "):
+            installed_version = line.split()[1]
+
+    assert (installed_version != "")
+
+    (rc, report) = cmd(["/usr/bin/dpkg", "--compare-versions", installed_version, check, version])
+    assert (rc == 0 or rc == 1)
+    if rc == 0:
+        return True
+    return False
+
+def prepare_source(source, builder, cached_src, build_src, patch_system):
+    '''Download and unpack source package, installing necessary build depends,
+       adjusting the permissions for the 'builder' user, and returning the
+       directory of the unpacked source. Patch system can be one of:
+       - cdbs
+       - dpatch
+       - quilt
+       - quiltv3
+       - None (not the string)
+
+       This is normally used like this:
+
+       def setUp(self):
+           ...
+           self.topdir = os.getcwd()
+           self.cached_src = os.path.join(os.getcwd(), "source")
+           self.tmpdir = tempfile.mkdtemp(prefix='testlib', dir='/tmp')
+           self.builder = testlib.TestUser()
+           testlib.cmd(['chgrp', self.builder.login, self.tmpdir])
+           os.chmod(self.tmpdir, 0775)
+
+       def tearDown(self):
+           ...
+           self.builder = None
+           self.topdir = os.getcwd()
+           if os.path.exists(self.tmpdir):
+               testlib.recursive_rm(self.tmpdir)
+
+       def test_suite_build(self):
+           ...
+           build_dir = testlib.prepare_source('foo', \
+                                         self.builder, \
+                                         self.cached_src, \
+                                         os.path.join(self.tmpdir, \
+                                           os.path.basename(self.cached_src)),
+                                         "quilt")
+           os.chdir(build_dir)
+
+           # Example for typical build, adjust as necessary
+           print ""
+           print "  make clean"
+           rc, report = testlib.cmd(['sudo', '-u', self.builder.login, 'make', 'clean'])
+
+           print "  configure"
+           rc, report = testlib.cmd(['sudo', '-u', self.builder.login, './configure', '--prefix=%s' % self.tmpdir, '--enable-debug'])
+
+           print "  make (will take a while)"
+           rc, report = testlib.cmd(['sudo', '-u', self.builder.login, 'make'])
+
+           print "  make check (will take a while)",
+           rc, report = testlib.cmd(['sudo', '-u', self.builder.login, 'make', 'check'])
+           expected = 0
+           result = 'Got exit code %d, expected %d\n' % (rc, expected)
+           self.assertEquals(expected, rc, result + report)
+
+        def test_suite_cleanup(self):
+            ...
+            if os.path.exists(self.cached_src):
+                testlib.recursive_rm(self.cached_src)
+
+       It is up to the caller to clean up cached_src and build_src (as in the
+       above example, often the build_src is in a tmpdir that is cleaned in
+       tearDown() and the cached_src is cleaned in a one time clean-up
+       operation (eg 'test_suite_cleanup()) which must be run after the build
+       suite test (obviously).
+       '''
+
+    # Make sure we have a clean slate
+    assert (os.path.exists(os.path.dirname(build_src)))
+    assert (not os.path.exists(build_src))
+
+    cdir = os.getcwd()
+    if os.path.exists(cached_src):
+        shutil.copytree(cached_src, build_src)
+        os.chdir(build_src)
+    else:
+        # Only install the build dependencies on the initial setup
+        rc, report = cmd(['apt-get','-y','--force-yes','build-dep',source])
+        assert (rc == 0)
+
+        os.makedirs(build_src)
+        os.chdir(build_src)
+
+        # These are always needed
+        pkgs = ['build-essential', 'dpkg-dev', 'fakeroot']
+        rc, report = cmd(['apt-get','-y','--force-yes','install'] + pkgs)
+        assert (rc == 0)
+
+        rc, report = cmd(['apt-get','source',source])
+        assert (rc == 0)
+        shutil.copytree(build_src, cached_src)
+
+    unpacked_dir = os.path.join(build_src, glob.glob('%s-*' % source)[0])
+
+    # Now apply the patches. Do it here so that we don't mess up our cached
+    # sources.
+    os.chdir(unpacked_dir)
+    assert (patch_system in ['cdbs', 'dpatch', 'quilt', 'quiltv3', None])
+    if patch_system != None and patch_system != "quiltv3":
+        if patch_system == "quilt":
+            os.environ.setdefault('QUILT_PATCHES','debian/patches')
+            rc, report = cmd(['quilt', 'push', '-a'])
+            assert (rc == 0)
+        elif patch_system == "cdbs":
+            rc, report = cmd(['./debian/rules', 'apply-patches'])
+            assert (rc == 0)
+        elif patch_system == "dpatch":
+            rc, report = cmd(['dpatch', 'apply-all'])
+            assert (rc == 0)
+
+    cmd(['chown', '-R', '%s:%s' % (builder.uid, builder.gid), build_src])
+    os.chdir(cdir)
+
+    return unpacked_dir
+
+def _aa_status():
+    '''Get aa-status output'''
+    exe = "/usr/sbin/aa-status"
+    assert (os.path.exists(exe))
+    if os.geteuid() == 0:
+        return cmd([exe])
+    return cmd(['sudo', exe])
+
+def is_apparmor_loaded(path):
+    '''Check if profile is loaded'''
+    rc, report = _aa_status()
+    if rc != 0:
+        return False
+
+    for line in report.splitlines():
+        if line.endswith(path):
+            return True
+    return False
+
+def is_apparmor_confined(path):
+    '''Check if application is confined'''
+    rc, report = _aa_status()
+    if rc != 0:
+        return False
+
+    for line in report.splitlines():
+        if re.search('%s \(' % path, line):
+            return True
+    return False
+
+def check_apparmor(path, first_ubuntu_release, is_running=True):
+    '''Check if path is loaded and confined for everything higher than the
+       first Ubuntu release specified.
+
+       Usage:
+        rc, report = testlib.check_apparmor('/usr/sbin/foo', 8.04, is_running=True)
+        if rc < 0:
+            return self._skipped(report)
+
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEquals(expected, rc, result + report)
+     '''
+    global manager
+    rc = -1
+
+    if manager.lsb_release["Release"] < first_ubuntu_release:
+        return (rc, "Skipped apparmor check")
+
+    if not os.path.exists('/sbin/apparmor_parser'):
+        return (rc, "Skipped (couldn't find apparmor_parser)")
+
+    rc = 0
+    msg = ""
+    if not is_apparmor_loaded(path):
+        rc = 1
+        msg = "Profile not loaded for '%s'" % path
+
+    # this check only makes sense it the 'path' is currently executing
+    if is_running and rc == 0 and not is_apparmor_confined(path):
+        rc = 1
+        msg = "'%s' is not running in enforce mode" % path
+
+    return (rc, msg)
+
+def get_gcc_version(gcc, full=True):
+    gcc_version = 'none'
+    if not gcc.startswith('/'):
+        gcc = '/usr/bin/%s' % (gcc)
+    if os.path.exists(gcc):
+        gcc_version = 'unknown'
+        lines = cmd([gcc,'-v'])[1].strip().splitlines()
+        version_lines = [x for x in lines if x.startswith('gcc version')]
+        if len(version_lines) == 1:
+            gcc_version = " ".join(version_lines[0].split()[2:])
+    if not full:
+        return gcc_version.split()[0]
+    return gcc_version
+
+def is_kdeinit_running():
+    '''Test if kdeinit is running'''
+    # applications that use kdeinit will spawn it if it isn't running in the
+    # test. This is a problem because it does not exit. This is a helper to
+    # check for it.
+    rc, report = cmd(['ps', 'x'])
+    if 'kdeinit4 Running' not in report:
+        print >>sys.stderr, ("kdeinit not running (you may start/stop any KDE application then run this script again)")
+        return False
+    return True
+
+def get_pkgconfig_flags(libs=[]):
+    '''Find pkg-config flags for libraries'''
+    assert (len(libs) > 0)
+    rc, pkg_config = cmd(['pkg-config', '--cflags', '--libs'] + libs)
+    expected = 0
+    if rc != expected:
+        print >>sys.stderr, 'Got exit code %d, expected %d\n' % (rc, expected)
+    assert(rc == expected)
+    return pkg_config.split()
+
+class TestDaemon:
+    '''Helper class to manage daemons consistently'''
+    def __init__(self, init):
+        '''Setup daemon attributes'''
+        self.initscript = init
+
+    def _build_command(self, suffix):
+        command = []
+        if isinstance(self.initscript, list):
+            command.extend(self.initscript)
+        else:
+            command.append(self.initscript)
+        command.append(suffix)
+        return command
+
+    def start(self):
+        '''Start daemon'''
+        rc, report = cmd(self._build_command('start'))
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        time.sleep(2)
+        if expected != rc:
+            return (False, result + report)
+
+        if "fail" in report:
+            return (False, "Found 'fail' in report\n" + report)
+
+        return (True, "")
+
+    def stop(self):
+        '''Stop daemon'''
+        rc, report = cmd(self._build_command('stop'))
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        if expected != rc:
+            return (False, result + report)
+
+        if "fail" in report:
+            return (False, "Found 'fail' in report\n" + report)
+
+        return (True, "")
+
+    def reload(self):
+        '''Reload daemon'''
+        rc, report = cmd(self._build_command('force-reload'))
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        if expected != rc:
+            return (False, result + report)
+
+        if "fail" in report:
+            return (False, "Found 'fail' in report\n" + report)
+
+        return (True, "")
+
+    def restart(self):
+        '''Restart daemon'''
+        (res, str) = self.stop()
+        if not res:
+            return (res, str)
+
+        (res, str) = self.start()
+        if not res:
+            return (res, str)
+
+        return (True, "")
+
+    def status(self):
+        '''Check daemon status'''
+        rc, report = cmd(self._build_command('status'))
+        expected = 0
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        if expected != rc:
+            return (False, result + report)
+
+        if "fail" in report:
+            return (False, "Found 'fail' in report\n" + report)
+
+        return (True, "")
+
+class TestlibManager(object):
+    '''Singleton class used to set up per-test-run information'''
+    def __init__(self):
+        # Set glibc aborts to dump to stderr instead of the tty so test output
+        # is more sane.
+        os.environ.setdefault('LIBC_FATAL_STDERR_','1')
+
+        # check verbosity
+        self.verbosity = False
+        if (len(sys.argv) > 1 and '-v' in sys.argv[1:]):
+            self.verbosity = True
+
+        # Load LSB release file
+        self.lsb_release = dict()
+        if not os.path.exists('/usr/bin/lsb_release') and not os.path.exists('/bin/lsb_release'):
+            raise OSError, "Please install 'lsb-release'"
+        for line in subprocess.Popen(['lsb_release','-a'],stdout=subprocess.PIPE,stderr=subprocess.PIPE).communicate()[0].splitlines():
+            field, value = line.split(':',1)
+            value=value.strip()
+            field=field.strip()
+            # Convert numerics
+            try:
+                value = float(value)
+            except:
+                pass
+            self.lsb_release.setdefault(field,value)
+
+        # FIXME: hack OEM releases into known-Ubuntu versions
+        if self.lsb_release['Distributor ID'] == "HP MIE (Mobile Internet Experience)":
+            if self.lsb_release['Release'] == 1.0:
+                self.lsb_release['Distributor ID'] = "Ubuntu"
+                self.lsb_release['Release'] = 8.04
+            else:
+                raise OSError, "Unknown version of HP MIE"
+
+        # FIXME: hack to assume a most-recent release if we're not
+        # running under Ubuntu.
+        if self.lsb_release['Distributor ID'] not in ["Ubuntu","Linaro"]:
+            self.lsb_release['Release'] = 10000
+        # Adjust Linaro release to pretend to be Ubuntu
+        if self.lsb_release['Distributor ID'] in ["Linaro"]:
+       	    self.lsb_release['Distributor ID'] = "Ubuntu"
+            self.lsb_release['Release'] -= 0.01
+
+        # Load arch
+        if not os.path.exists('/usr/bin/dpkg'):
+            machine = cmd(['uname','-m'])[1].strip()
+            if machine.endswith('86'):
+                self.dpkg_arch = 'i386'
+            elif machine.endswith('_64'):
+                self.dpkg_arch = 'amd64'
+            elif machine.startswith('arm'):
+                self.dpkg_arch = 'armel'
+            else:
+                raise ValueError, "Unknown machine type '%s'" % (machine)
+        else:
+            self.dpkg_arch = cmd(['dpkg','--print-architecture'])[1].strip()
+
+        # Find kernel version
+        self.kernel_is_ubuntu = False
+        self.kernel_version_signature = None
+        self.kernel_version = cmd(["uname","-r"])[1].strip()
+        versig = '/proc/version_signature'
+        if os.path.exists(versig):
+            self.kernel_is_ubuntu = True
+            self.kernel_version_signature = file(versig).read().strip()
+            self.kernel_version_ubuntu = self.kernel_version
+        elif os.path.exists('/usr/bin/dpkg'):
+            # this can easily be inaccurate but is only an issue for Dapper
+            rc, out = cmd(['dpkg','-l','linux-image-%s' % (self.kernel_version)])
+            if rc == 0:
+                self.kernel_version_signature = out.strip().split('\n').pop().split()[2]
+                self.kernel_version_ubuntu = self.kernel_version_signature
+        if self.kernel_version_signature == None:
+            # Attempt to fall back to something for non-Debian-based
+            self.kernel_version_signature = self.kernel_version
+            self.kernel_version_ubuntu = self.kernel_version
+        # Build ubuntu version without hardware suffix
+        try:
+            self.kernel_version_ubuntu = "-".join([x for x in self.kernel_version_signature.split(' ')[1].split('-') if re.search('^[0-9]', x)])
+        except:
+            pass
+
+        # Find gcc version
+        self.gcc_version = get_gcc_version('gcc')
+
+        # Find libc
+        self.path_libc = [x.split()[2] for x in cmd(['ldd','/bin/ls'])[1].splitlines() if x.startswith('\tlibc.so.')][0]
+
+        # Report self
+        if self.verbosity:
+            kernel = self.kernel_version_ubuntu
+            if kernel != self.kernel_version_signature:
+                kernel += " (%s)" % (self.kernel_version_signature)
+            print >>sys.stdout, "Running test: '%s' distro: '%s %.2f' kernel: '%s' arch: '%s' uid: %d/%d SUDO_USER: '%s')" % ( \
+                sys.argv[0],
+                self.lsb_release['Distributor ID'],
+                self.lsb_release['Release'],
+                kernel,
+                self.dpkg_arch,
+                os.geteuid(), os.getuid(),
+                os.environ.get('SUDO_USER', ''))
+            sys.stdout.flush()
+
+        # Additional heuristics
+        #if os.environ.get('SUDO_USER', os.environ.get('USER', '')) in ['mdeslaur']:
+        #    sys.stdout.write("Replying to Marc Deslauriers in http://launchpad.net/bugs/%d: " % random.randint(600000, 980000))
+        #    sys.stdout.flush()
+        #    time.sleep(0.5)
+        #    sys.stdout.write("destroyed\n")
+        #    time.sleep(0.5)
+
+    def hello(self, msg):
+        print >>sys.stderr, "Hello from %s" % (msg)
+# The central instance
+manager = TestlibManager()
+
+class TestlibCase(unittest.TestCase):
+    def __init__(self, *args):
+        '''This is called for each TestCase test instance, which isn't much better
+           than SetUp.'''
+
+        unittest.TestCase.__init__(self, *args)
+
+        # Attach to and duplicate dicts from manager singleton
+        self.manager = manager
+        #self.manager.hello(repr(self) + repr(*args))
+        self.my_verbosity = self.manager.verbosity
+        self.lsb_release = self.manager.lsb_release
+        self.dpkg_arch = self.manager.dpkg_arch
+        self.kernel_version = self.manager.kernel_version
+        self.kernel_version_signature = self.manager.kernel_version_signature
+        self.kernel_version_ubuntu = self.manager.kernel_version_ubuntu
+        self.kernel_is_ubuntu = self.manager.kernel_is_ubuntu
+        self.gcc_version = self.manager.gcc_version
+        self.path_libc = self.manager.path_libc
+
+    def version_compare(self, one, two):
+        return apt_pkg.VersionCompare(one,two)
+
+    def assertFileType(self, filename, filetype):
+        '''Checks the file type of the file specified'''
+
+        (rc, report, out) = self._testlib_shell_cmd(["/usr/bin/file", "-b", filename])
+        out = out.strip()
+        expected = 0
+        # Absolutely no idea why this happens on Hardy
+        if self.lsb_release['Release'] == 8.04 and rc == 255 and len(out) > 0:
+            rc = 0
+        result = 'Got exit code %d, expected %d:\n%s\n' % (rc, expected, report)
+        self.assertEquals(expected, rc, result)
+
+        filetype = '^%s$' % (filetype)
+        result = 'File type reported by file: [%s], expected regex: [%s]\n' % (out, filetype)
+        self.assertNotEquals(None, re.search(filetype, out), result)
+
+    def yank_commonname_from_cert(self, certfile):
+        '''Extract the commonName from a given PEM'''
+        rc, out = cmd(['openssl','asn1parse','-in',certfile])
+        if rc == 0:
+            ready = False
+            for line in out.splitlines():
+                if ready:
+                    return line.split(':')[-1]
+                if ':commonName' in line:
+                    ready = True
+        return socket.getfqdn()
+
+    def announce(self, text):
+        if self.my_verbosity:
+            print >>sys.stdout, "(%s) " % (text),
+            sys.stdout.flush()
+
+    def make_clean(self):
+        rc, output = self.shell_cmd(['make','clean'])
+        self.assertEquals(rc, 0, output)
+
+    def get_makefile_compiler(self):
+        # Find potential compiler name
+        compiler = 'gcc'
+        if os.path.exists('Makefile'):
+            for line in open('Makefile'):
+                if line.startswith('CC') and '=' in line:
+                    items = [x.strip() for x in line.split('=')]
+                    if items[0] == 'CC':
+                        compiler = items[1]
+                        break
+        return compiler
+
+    def make_target(self, target, expected=0):
+        '''Compile a target and report output'''
+
+        compiler = self.get_makefile_compiler()
+        rc, output = self.shell_cmd(['make',target])
+        self.assertEquals(rc, expected, 'rc(%d)!=%d:\n' % (rc, expected) + output)
+        self.assertTrue('%s ' % (compiler) in output, 'Expected "%s":' % (compiler) + output)
+        return output
+
+    # call as   return testlib.skipped()
+    def _skipped(self, reason=""):
+        '''Provide a visible way to indicate that a test was skipped'''
+        if reason != "":
+            reason = ': %s' % (reason)
+        self.announce("skipped%s" % (reason))
+        return False
+
+    def _testlib_shell_cmd(self,args,stdin=None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT):
+        argstr = "'" + "', '".join(args).strip() + "'"
+        rc, out = cmd(args,stdin=stdin,stdout=stdout,stderr=stderr)
+        report = 'Command: ' + argstr + '\nOutput:\n' + out
+        return rc, report, out
+
+    def shell_cmd(self, args, stdin=None):
+        return cmd(args,stdin=stdin)
+
+    def assertShellExitEquals(self, expected, args, stdin=None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, msg=""):
+        '''Test a shell command matches a specific exit code'''
+        rc, report, out = self._testlib_shell_cmd(args, stdin=stdin, stdout=stdout, stderr=stderr)
+        result = 'Got exit code %d, expected %d\n' % (rc, expected)
+        self.assertEquals(expected, rc, msg + result + report)
+
+    def assertShellExitNotEquals(self, unwanted, args, stdin=None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, msg=""):
+        '''Test a shell command doesn't match a specific exit code'''
+        rc, report, out = self._testlib_shell_cmd(args, stdin=stdin, stdout=stdout, stderr=stderr)
+        result = 'Got (unwanted) exit code %d\n' % rc
+        self.assertNotEquals(unwanted, rc, msg + result + report)
+
+    def assertShellOutputContains(self, text, args, stdin=None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, msg="", invert=False):
+        '''Test a shell command contains a specific output'''
+        rc, report, out = self._testlib_shell_cmd(args, stdin=stdin, stdout=stdout, stderr=stderr)
+        result = 'Got exit code %d.  Looking for text "%s"\n' % (rc, text)
+        if not invert:
+            self.assertTrue(text in out, msg + result + report)
+        else:
+            self.assertFalse(text in out, msg + result + report)
+
+    def assertShellOutputEquals(self, text, args, stdin=None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, msg="", invert=False, expected=None):
+        '''Test a shell command matches a specific output'''
+        rc, report, out = self._testlib_shell_cmd(args, stdin=stdin, stdout=stdout, stderr=stderr)
+        result = 'Got exit code %d. Looking for exact text "%s" (%s)\n' % (rc, text, " ".join(args))
+        if not invert:
+            self.assertEquals(text, out, msg + result + report)
+        else:
+            self.assertNotEquals(text, out, msg + result + report)
+        if expected != None:
+            result = 'Got exit code %d. Expected %d (%s)\n' % (rc, expected, " ".join(args))
+            self.assertEquals(rc, expected, msg + result + report)
+
+    def _word_find(self, report, content, invert=False):
+        '''Check for a specific string'''
+        if invert:
+            warning = 'Found "%s"\n' % content
+            self.assertTrue(content not in report, warning + report)
+        else:
+            warning = 'Could not find "%s"\n' % content
+            self.assertTrue(content in report, warning + report)
+
+    def _test_sysctl_value(self, path, expected, msg=None, exists=True):
+        sysctl = '/proc/sys/%s' % (path)
+        self.assertEquals(exists, os.path.exists(sysctl), sysctl)
+        value = None
+        if exists:
+            value = int(file(sysctl).read())
+            report = "%s is not %d: %d" % (sysctl, expected, value)
+            if msg:
+                report += " (%s)" % (msg)
+            self.assertEquals(value, expected, report)
+        return value
+
+    def set_sysctl_value(self, path, desired):
+        sysctl = '/proc/sys/%s' % (path)
+        self.assertTrue(os.path.exists(sysctl),"%s does not exist" % (sysctl))
+        file(sysctl,'w').write(str(desired))
+        self._test_sysctl_value(path, desired)
+
+    def kernel_at_least(self, introduced):
+        return self.version_compare(self.kernel_version_ubuntu,
+                                    introduced) >= 0
+
+    def kernel_claims_cve_fixed(self, cve):
+        changelog = "/usr/share/doc/linux-image-%s/changelog.Debian.gz" % (self.kernel_version)
+        if os.path.exists(changelog):
+            for line in gzip.open(changelog):
+                if cve in line and not "revert" in line and not "Revert" in line:
+                    return True
+        return False
+
+class TestGroup:
+    '''Create a temporary test group and remove it again in the dtor.'''
+
+    def __init__(self, group=None, lower=False):
+        '''Create a new group'''
+
+        self.group = None
+        if group:
+            if group_exists(group):
+                raise ValueError, 'group name already exists'
+        else:
+            while(True):
+                group = random_string(7,lower=lower)
+                if not group_exists(group):
+                    break
+
+        assert subprocess.call(['groupadd',group]) == 0
+        self.group = group
+        g = grp.getgrnam(self.group)
+        self.gid = g[2]
+
+    def __del__(self):
+        '''Remove the created group.'''
+
+        if self.group:
+            rc, report = cmd(['groupdel', self.group])
+            assert rc == 0
+
+class TestUser:
+    '''Create a temporary test user and remove it again in the dtor.'''
+
+    def __init__(self, login=None, home=True, group=None, uidmin=None, lower=False, shell=None):
+        '''Create a new user account with a random password.
+
+        By default, the login name is random, too, but can be explicitly
+        specified with 'login'. By default, a home directory is created, this
+        can be suppressed with 'home=False'.'''
+
+        self.login = None
+
+        if os.geteuid() != 0:
+            raise ValueError, "You must be root to run this test"
+
+        if login:
+            if login_exists(login):
+                raise ValueError, 'login name already exists'
+        else:
+            while(True):
+                login = 't' + random_string(7,lower=lower)
+                if not login_exists(login):
+                    break
+
+        self.salt = random_string(2)
+        self.password = random_string(8,lower=lower)
+        self.crypted = crypt.crypt(self.password, self.salt)
+
+        creation = ['useradd', '-p', self.crypted]
+        if home:
+            creation += ['-m']
+        if group:
+            creation += ['-G',group]
+        if uidmin:
+            creation += ['-K','UID_MIN=%d'%uidmin]
+        if shell:
+            creation += ['-s',shell]
+        creation += [login]
+        assert subprocess.call(creation) == 0
+        # Set GECOS
+        assert subprocess.call(['usermod','-c','Buddy %s' % (login),login]) == 0
+
+        self.login = login
+        p = pwd.getpwnam(self.login)