diff -Nru ppp-2.4.7/debian/changelog ppp-2.4.7/debian/changelog
--- ppp-2.4.7/debian/changelog	2016-01-11 17:04:44.000000000 +0000
+++ ppp-2.4.7/debian/changelog	2016-01-29 09:53:54.000000000 +0000
@@ -1,3 +1,61 @@
+ppp (2.4.7-1+2ubuntu1) xenial; urgency=low
+
+  * Merge from Debian unstable.  Remaining changes:
+    - debian/patches/load_ppp_generic_if_needed: load ppp_generic kernel
+      module if needed.
+    - debian/patches/ppp-2.4.6-eaptls-mppe-0.997.patch: EAP-TLS/MPPE support
+      patch from Jan Just Keijser.
+    - debian/control: add libssl-dev to Build-Depends for the EAP-TLS patch.
+    - debian/ppp.preinst: deal with the change in LSB headers start runlevels
+      of pppd-dns due to dropping our changes (which are no longer necessary
+      since resolvconf is installed in most systems and has been for a while);
+      this should probably be kept until the next LTS.
+  * debian/ppp.symbols:
+    - Update the symbols to include changes from our Ubuntu patches.
+
+ -- Łukasz 'sil2100' Zemczak <lukasz.zemczak@ubuntu.com>  Thu, 28 Jan 2016 10:01:37 +0100
+
+ppp (2.4.7-1+2) unstable; urgency=medium
+
+  * Replace my email address for my debian.org address.
+  * Upload to unstable.
+
+ -- Chris Boot <bootc@debian.org>  Wed, 27 Jan 2016 08:48:40 +0000
+
+ppp (2.4.7-1+2~exp3) experimental; urgency=medium
+
+  * Remove obsolete conffile /etc/bash_completion.d/pon. (Closes: #807238)
+  * Remove redundant full stop in pppd-dns.service systemd unit file.
+    (Closes: #794348)
+  * Ignore $global$ symbol which appears only on hppa.
+
+ -- Chris Boot <bootc@debian.org>  Wed, 30 Dec 2015 18:16:20 +0000
+
+ppp (2.4.7-1+2~exp2) experimental; urgency=medium
+
+  * Update symbols file to ignore "private" symbols (starting with an
+    underscore) which invariably come from static glibc libraries, along with
+    any symbols with a "version" starting GLIBC_. These don't come from pppd
+    and vary between architectures and glibc versions. Fixes FTBFS on i386 and
+    x32.
+
+ -- Chris Boot <debian@bootc.net>  Sun, 06 Dec 2015 15:43:58 +0000
+
+ppp (2.4.7-1+2~exp1) experimental; urgency=medium
+
+  * Enable "pie" hardening flag.
+  * Add a symbols file for ppp and validate it during builds.
+    - debian/patches/pppd-soname-hack.patch: add a SONAME to pppd so that
+      dpkg-gensymbols will inspect it.
+    - debian/rules: override dh_makeshlibs to inspect pppd and fail hard if
+      the symbols change compared to the symbols file.
+    - debian/ppp.symbols: symbols generated for this version of pppd (on
+      amd64).
+    - debian/README.source: document this unusual setup.
+  * Upload to experimental.
+
+ -- Chris Boot <debian@bootc.net>  Sat, 05 Dec 2015 13:35:51 +0000
+
 ppp (2.4.7-1+1ubuntu1) xenial; urgency=low
 
   * Merge from Debian unstable.  Remaining changes:
diff -Nru ppp-2.4.7/debian/control ppp-2.4.7/debian/control
--- ppp-2.4.7/debian/control	2016-01-11 17:09:02.000000000 +0000
+++ ppp-2.4.7/debian/control	2016-01-28 09:00:25.000000000 +0000
@@ -3,7 +3,7 @@
 Priority: optional
 Homepage: http://ppp.samba.org/
 Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
-XSBC-Original-Maintainer: Chris Boot <debian@bootc.net>
+XSBC-Original-Maintainer: Chris Boot <bootc@debian.org>
 Uploaders: Marco d'Itri <md@linux.it>
 Build-Depends: debhelper (>= 9~), libpcap0.8-dev, libpam0g-dev, zlib1g-dev,
  dh-systemd, libssl-dev
diff -Nru ppp-2.4.7/debian/copyright ppp-2.4.7/debian/copyright
--- ppp-2.4.7/debian/copyright	2015-12-04 16:42:22.000000000 +0000
+++ ppp-2.4.7/debian/copyright	2016-01-27 16:19:52.000000000 +0000
@@ -6,7 +6,7 @@
 Russell Coker <russell@coker.com.au>.
 
 It is currently maintained by Marco d'Itri <md@linux.it>
-and Chris Boot <debian@bootc.net>.
+and Chris Boot <bootc@debian.org>.
 
 Original sources were obtained from:
   git://ozlabs.org/~paulus/ppp.git
diff -Nru ppp-2.4.7/debian/extra/dh_ppp ppp-2.4.7/debian/extra/dh_ppp
--- ppp-2.4.7/debian/extra/dh_ppp	2015-12-04 08:23:37.000000000 +0000
+++ ppp-2.4.7/debian/extra/dh_ppp	2016-01-27 16:19:52.000000000 +0000
@@ -189,6 +189,6 @@
 
 =head1 AUTHORS
 
-Chris Boot <debian@bootc.net>
+Chris Boot <bootc@debian.org>
 
 =cut
diff -Nru ppp-2.4.7/debian/patches/cifdefroute.dif ppp-2.4.7/debian/patches/cifdefroute.dif
--- ppp-2.4.7/debian/patches/cifdefroute.dif	2015-12-04 16:42:23.000000000 +0000
+++ ppp-2.4.7/debian/patches/cifdefroute.dif	2016-01-27 16:19:53.000000000 +0000
@@ -9,7 +9,7 @@
 
 Origin: vendor, https://build.opensuse.org/source/network/ppp/ppp-2.4.2-cifdefroute.diff?rev=7a0fdeff0b29437dd7f4581c95c7255a
 Forwarded: no
-Reviewed-by: Chris Boot <debian@bootc.net>
+Reviewed-by: Chris Boot <bootc@debian.org>
 Last-Update: 2014-01-26
 
 --- a/pppd/ipcp.c
diff -Nru ppp-2.4.7/debian/patches/ppp-2.4.2-ifname.diff ppp-2.4.7/debian/patches/ppp-2.4.2-ifname.diff
--- ppp-2.4.7/debian/patches/ppp-2.4.2-ifname.diff	2015-12-04 16:42:23.000000000 +0000
+++ ppp-2.4.7/debian/patches/ppp-2.4.2-ifname.diff	2016-01-27 16:19:53.000000000 +0000
@@ -13,7 +13,7 @@
 Origin: vendor, https://build.opensuse.org/source/network/ppp/ppp-2.4.2-ifname.diff?rev=7a0fdeff0b29437dd7f4581c95c7255a
 Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=458646
 Forwarded: no
-Reviewed-by: Chris Boot <debian@bootc.net>
+Reviewed-by: Chris Boot <bootc@debian.org>
 Last-Update: 2014-01-12
 --- a/pppd/main.c
 +++ b/pppd/main.c
diff -Nru ppp-2.4.7/debian/patches/ppp-2.4.4-strncatfix.patch ppp-2.4.7/debian/patches/ppp-2.4.4-strncatfix.patch
--- ppp-2.4.7/debian/patches/ppp-2.4.4-strncatfix.patch	2015-12-04 16:42:23.000000000 +0000
+++ ppp-2.4.7/debian/patches/ppp-2.4.4-strncatfix.patch	2016-01-27 16:19:53.000000000 +0000
@@ -15,7 +15,7 @@
 
 Origin: vendor, https://build.opensuse.org/source/network/ppp/ppp-2.4.4-strncatfix.patch?rev=7a0fdeff0b29437dd7f4581c95c7255a
 Forwarded: no
-Reviewed-by: Chris Boot <debian@bootc.net>
+Reviewed-by: Chris Boot <bootc@debian.org>
 Last-Update: 2014-01-12
 
 --- ppp-2.4.4/pppd/plugins/radius/clientid.c.xx	2006-12-19 10:25:19.000000000 +0100
diff -Nru ppp-2.4.7/debian/patches/pppd-soname-hack.patch ppp-2.4.7/debian/patches/pppd-soname-hack.patch
--- ppp-2.4.7/debian/patches/pppd-soname-hack.patch	1970-01-01 00:00:00.000000000 +0000
+++ ppp-2.4.7/debian/patches/pppd-soname-hack.patch	2015-12-30 18:31:21.000000000 +0000
@@ -0,0 +1,30 @@
+Description: Add a SONAME to the pppd binary
+ This hack inserts a SONAME into the pppd binary, which allows us to
+ run dpkg-gensymbols/dh_makeshlibs over the resulting binary. This is
+ useful so that we can use Debian's standard build infrastructure to
+ help track the ppp binary's ABI, which is used by plugins.
+Author: Chris Boot <bootc@debian.org>
+Forwarded: not-needed
+Last-Update: 2015-12-05
+
+--- ppp-2.4.7.orig/pppd/Makefile.linux
++++ ppp-2.4.7/pppd/Makefile.linux
+@@ -206,6 +206,8 @@ endif
+ 
+ INSTALL= install
+ 
++VERSION = $(shell awk -F '"' '/VERSION/ { print $$2; }' patchlevel.h)
++
+ all: $(TARGETS)
+ 
+ install: pppd
+@@ -217,7 +219,8 @@ install: pppd
+ 	$(INSTALL) -c -m 444 pppd.8 $(MANDIR)
+ 
+ pppd: $(PPPDOBJS)
+-	$(CC) $(LDFLAGS) -o pppd $(PPPDOBJS) $(LIBS)
++	$(CC) $(LDFLAGS) -o pppd $(PPPDOBJS) $(LIBS) \
++		-Wl,-soname,pppd.so.$(VERSION)
+ 
+ srp-entry:	srp-entry.c
+ 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ srp-entry.c $(LIBS)
diff -Nru ppp-2.4.7/debian/patches/radius-config.c-unkown-typo ppp-2.4.7/debian/patches/radius-config.c-unkown-typo
--- ppp-2.4.7/debian/patches/radius-config.c-unkown-typo	2015-12-04 16:42:23.000000000 +0000
+++ ppp-2.4.7/debian/patches/radius-config.c-unkown-typo	2016-01-27 16:19:53.000000000 +0000
@@ -1,5 +1,5 @@
 Description: Correct unkown => unknown typo
-Author: Chris Boot <debian@bootc.net>
+Author: Chris Boot <bootc@debian.org>
 Last-Update: 2013-09-09
 
 --- ppp-2.4.5+git20130610.orig/pppd/plugins/radius/config.c
diff -Nru ppp-2.4.7/debian/patches/secure-card-interpreter-fix ppp-2.4.7/debian/patches/secure-card-interpreter-fix
--- ppp-2.4.7/debian/patches/secure-card-interpreter-fix	2015-12-04 16:42:23.000000000 +0000
+++ ppp-2.4.7/debian/patches/secure-card-interpreter-fix	2016-01-27 16:19:53.000000000 +0000
@@ -5,7 +5,7 @@
   usr/share/doc/ppp/examples/scripts/secure-card
   (#!/usr/local/bin/expect != /usr/bin/expect)
 
-Author: Chris Boot <debian@bootc.net>
+Author: Chris Boot <bootc@debian.org>
 Forwarded: not-needed
 Last-Update: 2013-09-09
 
diff -Nru ppp-2.4.7/debian/patches/series ppp-2.4.7/debian/patches/series
--- ppp-2.4.7/debian/patches/series	2015-12-04 16:42:23.000000000 +0000
+++ ppp-2.4.7/debian/patches/series	2016-01-28 08:53:20.000000000 +0000
@@ -33,6 +33,7 @@
 zzz_config
 secure-card-interpreter-fix
 rc_mksid-no-buffer-overflow
+pppd-soname-hack.patch
 
 # ubuntu
 load_ppp_generic_if_needed
diff -Nru ppp-2.4.7/debian/ppp.maintscript ppp-2.4.7/debian/ppp.maintscript
--- ppp-2.4.7/debian/ppp.maintscript	1970-01-01 00:00:00.000000000 +0000
+++ ppp-2.4.7/debian/ppp.maintscript	2015-12-07 08:34:25.000000000 +0000
@@ -0,0 +1,4 @@
+
+# Has been moved to /usr/share/bash-completion/completions/pon
+rm_conffile /etc/bash_completion.d/pon 2.4.7-1+2~
+
diff -Nru ppp-2.4.7/debian/ppp.pppd-dns.service ppp-2.4.7/debian/ppp.pppd-dns.service
--- ppp-2.4.7/debian/ppp.pppd-dns.service	2015-12-04 16:42:22.000000000 +0000
+++ ppp-2.4.7/debian/ppp.pppd-dns.service	2016-01-27 16:19:52.000000000 +0000
@@ -1,5 +1,5 @@
 [Unit]
-Description=Restore /etc/resolv.conf if the system crashed before the ppp link was shut down.
+Description=Restore /etc/resolv.conf if the system crashed before the ppp link was shut down
 
 [Service]
 Type=oneshot
diff -Nru ppp-2.4.7/debian/ppp.symbols ppp-2.4.7/debian/ppp.symbols
--- ppp-2.4.7/debian/ppp.symbols	1970-01-01 00:00:00.000000000 +0000
+++ ppp-2.4.7/debian/ppp.symbols	2016-01-29 09:22:27.000000000 +0000
@@ -0,0 +1,521 @@
+pppd.so.2.4.7 ppp #MINVER#
+# Ignore all symbols that start with an underscore in the Base module
+ (regex|optional)"^_.*@Base$" 2.4.7-1+2~
+# Ignore $global$ which seems to appear on hppa only
+ (optional)$global$@Base 2.4.7-1+2~
+# Ignore everything that claims it's part of glibc
+ (regex|optional)"@GLIBC_" 2.4.7-1+2~
+# All others should be pppd symbols
+ ChallengeHash@Base 2.4.7-1+2~
+ ChapMS2@Base 2.4.7-1+2~
+ ChapMS@Base 2.4.7-1+2~
+ DesDecrypt@Base 2.4.7-1+2~
+ DesEncrypt@Base 2.4.7-1+2~
+ DesSetkey@Base 2.4.7-1+2~
+ GenerateAuthenticatorResponse@Base 2.4.7-1+2~
+ GetMask@Base 2.4.7-1+2~
+ MD4Final@Base 2.4.7-1+2~
+ MD4Init@Base 2.4.7-1+2~
+ MD4Print@Base 2.4.7-1+2~
+ MD4Update@Base 2.4.7-1+2~
+ SHA1_Final@Base 2.4.7-1+2~
+ SHA1_Init@Base 2.4.7-1+2~
+ SHA1_Update@Base 2.4.7-1+2~
+ active_filter@Base 2.4.7-1+2~
+ add_fd@Base 2.4.7-1+2~
+ add_notifier@Base 2.4.7-1+2~
+ add_options@Base 2.4.7-1+2~
+ allow_any_ip@Base 2.4.7-1+2~
+ allowed_address_hook@Base 2.4.7-1+2~
+ asked_to_quit@Base 2.4.7-1+2~
+ auth_check_options@Base 2.4.7-1+2~
+ auth_done@Base 2.4.7-1+2~
+ auth_ip_addr@Base 2.4.7-1+2~
+ auth_number@Base 2.4.7-1+2~
+ auth_options@Base 2.4.7-1+2~
+ auth_peer_fail@Base 2.4.7-1+2~
+ auth_peer_success@Base 2.4.7-1+2~
+ auth_required@Base 2.4.7-1+2~
+ auth_reset@Base 2.4.7-1+2~
+ auth_up_notifier@Base 2.4.7-1+2~
+ auth_withpeer_fail@Base 2.4.7-1+2~
+ auth_withpeer_success@Base 2.4.7-1+2~
+ bad_ip_adrs@Base 2.4.7-1+2~
+ baud_rate@Base 2.4.7-1+2~
+ blinks_id@Base 2.4.7-1+2~
+ bundle_attach@Base 2.4.7-1+2~
+ bundle_eof@Base 2.4.7-1+2~
+ bundle_id@Base 2.4.7-1+2~
+ bundle_name@Base 2.4.7-1+2~
+ bundle_terminating@Base 2.4.7-1+2~
+ cacert_file@Base 2.4.7-1+2ubuntu1~
+ callback_script@Base 2.4.7-1+2~
+ cbcp@Base 2.4.7-1+2~
+ cbcp_codenames@Base 2.4.7-1+2~
+ cbcp_optionnames@Base 2.4.7-1+2~
+ cbcp_protent@Base 2.4.7-1+2~
+ ccp_allowoptions@Base 2.4.7-1+2~
+ ccp_fatal_error@Base 2.4.7-1+2~
+ ccp_flags_set@Base 2.4.7-1+2~
+ ccp_fsm@Base 2.4.7-1+2~
+ ccp_gotoptions@Base 2.4.7-1+2~
+ ccp_hisoptions@Base 2.4.7-1+2~
+ ccp_protent@Base 2.4.7-1+2~
+ ccp_test@Base 2.4.7-1+2~
+ ccp_wantoptions@Base 2.4.7-1+2~
+ cert_file@Base 2.4.7-1+2ubuntu1~
+ cfg_bundle@Base 2.4.7-1+2~
+ chap_auth_peer@Base 2.4.7-1+2~
+ chap_auth_with_peer@Base 2.4.7-1+2~
+ chap_check_hook@Base 2.4.7-1+2~
+ chap_max_transmits@Base 2.4.7-1+2~
+ chap_md5_init@Base 2.4.7-1+2~
+ chap_mdtype_all@Base 2.4.7-1+2~
+ chap_passwd_hook@Base 2.4.7-1+2~
+ chap_protent@Base 2.4.7-1+2~
+ chap_rechallenge_time@Base 2.4.7-1+2~
+ chap_register_digest@Base 2.4.7-1+2~
+ chap_timeout_time@Base 2.4.7-1+2~
+ chap_verify_hook@Base 2.4.7-1+2~
+ chapms_init@Base 2.4.7-1+2~
+ chapms_strip_domain@Base 2.4.7-1+2~
+ charshunt_pid@Base 2.4.7-1+2~
+ check_options@Base 2.4.7-1+2~
+ check_passwd@Base 2.4.7-1+2~
+ child_wait@Base 2.4.7-1+2~
+ childwait_done@Base 2.4.7-1+2~
+ cif6addr@Base 2.4.7-1+2~
+ cifaddr@Base 2.4.7-1+2~
+ cifdefaultroute@Base 2.4.7-1+2~
+ cifproxyarp@Base 2.4.7-1+2~
+ cipxfaddr@Base 2.4.7-1+2~
+ clean_check@Base 2.4.7-1+2~
+ cleanup_tty@Base 2.4.7-1+2~
+ complete_read@Base 2.4.7-1+2~
+ connect_delay@Base 2.4.7-1+2~
+ connect_script@Base 2.4.7-1+2~
+ connect_tty@Base 2.4.7-1+2~
+ continue_networks@Base 2.4.7-1+2~
+ crl_dir@Base 2.4.7-1+2ubuntu1~
+ crl_file@Base 2.4.7-1+2ubuntu1~
+ crtscts@Base 2.4.7-1+2~
+ cryptpap@Base 2.4.7-1+2~
+ current_option@Base 2.4.7-1+2~
+ data_start@Base 2.4.7-1+2~
+ db_key@Base 2.4.7-1+2~
+ dbglog@Base 2.4.7-1+2~
+ debug@Base 2.4.7-1+2~
+ default_device@Base 2.4.7-1+2~
+ demand@Base 2.4.7-1+2~
+ demand_block@Base 2.4.7-1+2~
+ demand_conf@Base 2.4.7-1+2~
+ demand_discard@Base 2.4.7-1+2~
+ demand_rexmit@Base 2.4.7-1+2~
+ demand_unblock@Base 2.4.7-1+2~
+ destroy_bundle@Base 2.4.7-1+2~
+ detach@Base 2.4.7-1+2~
+ detached@Base 2.4.7-1+2~
+ devfd@Base 2.4.7-1+2~
+ device_script@Base 2.4.7-1+2~
+ devnam@Base 2.4.7-1+2~
+ devnam_fixed@Base 2.4.7-1+2~
+ devstat@Base 2.4.7-1+2~
+ die@Base 2.4.7-1+2~
+ disable_defaultip@Base 2.4.7-1+2~
+ disconnect_script@Base 2.4.7-1+2~
+ disconnect_tty@Base 2.4.7-1+2~
+ do_callback@Base 2.4.7-1+2~
+ doing_callback@Base 2.4.7-1+2~
+ doing_multilink@Base 2.4.7-1+2~
+ domain@Base 2.4.7-1+2~
+ dryrun@Base 2.4.7-1+2~
+ dump_options@Base 2.4.7-1+2~
+ dump_packet@Base 2.4.7-1+2~
+ eap_authpeer@Base 2.4.7-1+2~
+ eap_authwithpeer@Base 2.4.7-1+2~
+ eap_protent@Base 2.4.7-1+2~
+ eap_states@Base 2.4.7-1+2~
+ eaptls_free_session@Base 2.4.7-1+2ubuntu1~
+ eaptls_gen_mppe_keys@Base 2.4.7-1+2ubuntu1~
+ eaptls_get_mtu@Base 2.4.7-1+2ubuntu1~
+ eaptls_init_ssl@Base 2.4.7-1+2ubuntu1~
+ eaptls_init_ssl_client@Base 2.4.7-1+2ubuntu1~
+ eaptls_init_ssl_server@Base 2.4.7-1+2ubuntu1~
+ eaptls_passwd_hook@Base 2.4.7-1+2ubuntu1~
+ eaptls_receive@Base 2.4.7-1+2ubuntu1~
+ eaptls_retransmit@Base 2.4.7-1+2ubuntu1~
+ eaptls_send@Base 2.4.7-1+2ubuntu1~
+ eaptls_ssl_load_config@Base 2.4.7-1+2ubuntu1~
+ eaptls_ssl_load_engine@Base 2.4.7-1+2ubuntu1~
+ ecp_allowoptions@Base 2.4.7-1+2~
+ ecp_fsm@Base 2.4.7-1+2~
+ ecp_gotoptions@Base 2.4.7-1+2~
+ ecp_hisoptions@Base 2.4.7-1+2~
+ ecp_protent@Base 2.4.7-1+2~
+ ecp_wantoptions@Base 2.4.7-1+2~
+ end_pr_log@Base 2.4.7-1+2~
+ endpoint_specified@Base 2.4.7-1+2~
+ epdisc_to_str@Base 2.4.7-1+2~
+ error@Base 2.4.7-1+2~
+ error_count@Base 2.4.7-1+2~
+ escape_flag@Base 2.4.7-1+2~
+ ether_to_eui64@Base 2.4.7-1+2~
+ eui64_ntoa@Base 2.4.7-1+2~
+ exitnotify@Base 2.4.7-1+2~
+ explicit_passwd@Base 2.4.7-1+2~
+ explicit_remote@Base 2.4.7-1+2~
+ explicit_user@Base 2.4.7-1+2~
+ fatal@Base 2.4.7-1+2~
+ fcs@Base 2.4.7-1+2~
+ fd_devnull@Base 2.4.7-1+2~
+ fd_ppp@Base 2.4.7-1+2~
+ flush_flag@Base 2.4.7-1+2~
+ fork_notifier@Base 2.4.7-1+2~
+ frame@Base 2.4.7-1+2~
+ framelen@Base 2.4.7-1+2~
+ framemax@Base 2.4.7-1+2~
+ fsm_close@Base 2.4.7-1+2~
+ fsm_init@Base 2.4.7-1+2~
+ fsm_input@Base 2.4.7-1+2~
+ fsm_lowerdown@Base 2.4.7-1+2~
+ fsm_lowerup@Base 2.4.7-1+2~
+ fsm_open@Base 2.4.7-1+2~
+ fsm_protreject@Base 2.4.7-1+2~
+ fsm_sdata@Base 2.4.7-1+2~
+ general_options@Base 2.4.7-1+2~
+ generic_disestablish_ppp@Base 2.4.7-1+2~
+ generic_establish_ppp@Base 2.4.7-1+2~
+ get_X509_from_file@Base 2.4.7-1+2ubuntu1~
+ get_eaptls_secret@Base 2.4.7-1+2ubuntu1~
+ get_first_ethernet@Base 2.4.7-1+2~
+ get_host_seed@Base 2.4.7-1+2~
+ get_idle_time@Base 2.4.7-1+2~
+ get_if_hwaddr@Base 2.4.7-1+2~
+ get_loop_output@Base 2.4.7-1+2~
+ get_ppp_stats@Base 2.4.7-1+2~
+ get_pty@Base 2.4.7-1+2~
+ get_secret@Base 2.4.7-1+2~
+ get_srp_secret@Base 2.4.7-1+2~
+ getword@Base 2.4.7-1+2~
+ got_sighup@Base 2.4.7-1+2~
+ got_sigterm@Base 2.4.7-1+2~
+ got_sigusr2@Base 2.4.7-1+2~
+ groups@Base 2.4.7-1+2~
+ have_route_to@Base 2.4.7-1+2~
+ holdoff@Base 2.4.7-1+2~
+ holdoff_hook@Base 2.4.7-1+2~
+ holdoff_specified@Base 2.4.7-1+2~
+ hostname@Base 2.4.7-1+2~
+ hungup@Base 2.4.7-1+2~
+ idle_time_hook@Base 2.4.7-1+2~
+ idle_time_limit@Base 2.4.7-1+2~
+ ifname@Base 2.4.7-1+2~
+ ifunit@Base 2.4.7-1+2~
+ info@Base 2.4.7-1+2~
+ init_pr_log@Base 2.4.7-1+2~
+ initializer@Base 2.4.7-1+2~
+ inpacket_buf@Base 2.4.7-1+2~
+ inspeed@Base 2.4.7-1+2~
+ int_option@Base 2.4.7-1+2~
+ ip_choose_hook@Base 2.4.7-1+2~
+ ip_down_hook@Base 2.4.7-1+2~
+ ip_down_notifier@Base 2.4.7-1+2~
+ ip_ntoa@Base 2.4.7-1+2~
+ ip_up_hook@Base 2.4.7-1+2~
+ ip_up_notifier@Base 2.4.7-1+2~
+ ipcp_allowoptions@Base 2.4.7-1+2~
+ ipcp_fsm@Base 2.4.7-1+2~
+ ipcp_gotoptions@Base 2.4.7-1+2~
+ ipcp_hisoptions@Base 2.4.7-1+2~
+ ipcp_protent@Base 2.4.7-1+2~
+ ipcp_wantoptions@Base 2.4.7-1+2~
+ ipparam@Base 2.4.7-1+2~
+ ipv6_down_hook@Base 2.4.7-1+2~
+ ipv6_down_notifier@Base 2.4.7-1+2~
+ ipv6_up_hook@Base 2.4.7-1+2~
+ ipv6_up_notifier@Base 2.4.7-1+2~
+ ipv6cp_allowoptions@Base 2.4.7-1+2~
+ ipv6cp_fsm@Base 2.4.7-1+2~
+ ipv6cp_gotoptions@Base 2.4.7-1+2~
+ ipv6cp_hisoptions@Base 2.4.7-1+2~
+ ipv6cp_protent@Base 2.4.7-1+2~
+ ipv6cp_wantoptions@Base 2.4.7-1+2~
+ ipxcp_allowoptions@Base 2.4.7-1+2~
+ ipxcp_fsm@Base 2.4.7-1+2~
+ ipxcp_gotoptions@Base 2.4.7-1+2~
+ ipxcp_hisoptions@Base 2.4.7-1+2~
+ ipxcp_protent@Base 2.4.7-1+2~
+ ipxcp_wantoptions@Base 2.4.7-1+2~
+ kdebugflag@Base 2.4.7-1+2~
+ kill_link@Base 2.4.7-1+2~
+ lax_recv@Base 2.4.7-1+2~
+ lcp_allowoptions@Base 2.4.7-1+2~
+ lcp_close@Base 2.4.7-1+2~
+ lcp_echo_adaptive@Base 2.4.7-1+2~
+ lcp_echo_fails@Base 2.4.7-1+2~
+ lcp_echo_interval@Base 2.4.7-1+2~
+ lcp_fsm@Base 2.4.7-1+2~
+ lcp_gotoptions@Base 2.4.7-1+2~
+ lcp_hisoptions@Base 2.4.7-1+2~
+ lcp_loopbackfail@Base 2.4.7-1+2~
+ lcp_lowerdown@Base 2.4.7-1+2~
+ lcp_lowerup@Base 2.4.7-1+2~
+ lcp_open@Base 2.4.7-1+2~
+ lcp_protent@Base 2.4.7-1+2~
+ lcp_sprotrej@Base 2.4.7-1+2~
+ lcp_wantoptions@Base 2.4.7-1+2~
+ link_connect_time@Base 2.4.7-1+2~
+ link_down@Base 2.4.7-1+2~
+ link_down_notifier@Base 2.4.7-1+2~
+ link_established@Base 2.4.7-1+2~
+ link_required@Base 2.4.7-1+2~
+ link_stats@Base 2.4.7-1+2~
+ link_stats_valid@Base 2.4.7-1+2~
+ link_terminated@Base 2.4.7-1+2~
+ linkname@Base 2.4.7-1+2~
+ listen_time@Base 2.4.7-1+2~
+ llv6_ntoa@Base 2.4.7-1+2~
+ lock@Base 2.4.7-1+2~
+ lock_db@Base 2.4.7-1+2~
+ locked@Base 2.4.7-1+2~
+ lockflag@Base 2.4.7-1+2~
+ log_default@Base 2.4.7-1+2~
+ log_ssl_errors@Base 2.4.7-1+2ubuntu1~
+ log_to_fd@Base 2.4.7-1+2~
+ loop_chars@Base 2.4.7-1+2~
+ loop_frame@Base 2.4.7-1+2~
+ magic@Base 2.4.7-1+2~
+ magic_init@Base 2.4.7-1+2~
+ main@Base 2.4.7-1+2~
+ make_new_bundle@Base 2.4.7-1+2~
+ master_detach@Base 2.4.7-1+2~
+ max_data_rate@Base 2.4.7-1+2~
+ maxconnect@Base 2.4.7-1+2~
+ maxfail@Base 2.4.7-1+2~
+ maxoctets@Base 2.4.7-1+2~
+ maxoctets_dir@Base 2.4.7-1+2~
+ maxoctets_timeout@Base 2.4.7-1+2~
+ modem@Base 2.4.7-1+2~
+ mp_bundle_terminated@Base 2.4.7-1+2~
+ mp_check_options@Base 2.4.7-1+2~
+ mp_exit_bundle@Base 2.4.7-1+2~
+ mp_join_bundle@Base 2.4.7-1+2~
+ mppe_keys_set@Base 2.4.7-1+2~
+ mppe_recv_key@Base 2.4.7-1+2~
+ mppe_send_key@Base 2.4.7-1+2~
+ mppe_set_keys2@Base 2.4.7-1+2~
+ mppe_set_keys@Base 2.4.7-1+2~
+ multilink@Base 2.4.7-1+2~
+ multilink_join_hook@Base 2.4.7-1+2~
+ multilink_master@Base 2.4.7-1+2~
+ need_holdoff@Base 2.4.7-1+2~
+ need_peer_eap@Base 2.4.7-1+2ubuntu1~
+ netif_get_mtu@Base 2.4.7-1+2~
+ netif_set_mtu@Base 2.4.7-1+2~
+ netmask@Base 2.4.7-1+2~
+ new_phase@Base 2.4.7-1+2~
+ new_phase_hook@Base 2.4.7-1+2~
+ new_style_driver@Base 2.4.7-1+2~
+ ngroups@Base 2.4.7-1+2~
+ no_ifaceid_neg@Base 2.4.7-1+2~
+ no_ppp_msg@Base 2.4.7-1+2~
+ nodetach@Base 2.4.7-1+2~
+ noendpoint@Base 2.4.7-1+2~
+ noremoteip@Base 2.4.7-1+2~
+ notice@Base 2.4.7-1+2~
+ notify@Base 2.4.7-1+2~
+ notty@Base 2.4.7-1+2~
+ novm@Base 2.4.7-1+2~
+ np_down@Base 2.4.7-1+2~
+ np_finished@Base 2.4.7-1+2~
+ np_up@Base 2.4.7-1+2~
+ null_auth_hook@Base 2.4.7-1+2~
+ open_ccp_flag@Base 2.4.7-1+2~
+ open_ppp_loopback@Base 2.4.7-1+2~
+ option_error@Base 2.4.7-1+2~
+ option_priority@Base 2.4.7-1+2~
+ option_source@Base 2.4.7-1+2~
+ options_for_tty@Base 2.4.7-1+2~
+ options_from_file@Base 2.4.7-1+2~
+ options_from_list@Base 2.4.7-1+2~
+ options_from_user@Base 2.4.7-1+2~
+ our_name@Base 2.4.7-1+2~
+ outpacket_buf@Base 2.4.7-1+2~
+ output@Base 2.4.7-1+2~
+ override_value@Base 2.4.7-1+2~
+ pap_auth_hook@Base 2.4.7-1+2~
+ pap_check_hook@Base 2.4.7-1+2~
+ pap_logout_hook@Base 2.4.7-1+2~
+ pap_passwd_hook@Base 2.4.7-1+2~
+ pap_protent@Base 2.4.7-1+2~
+ parse_args@Base 2.4.7-1+2~
+ parse_dotted_ip@Base 2.4.7-1+2~
+ pass_filter@Base 2.4.7-1+2~
+ passwd@Base 2.4.7-1+2~
+ password_callback@Base 2.4.7-1+2ubuntu1~
+ path_ipdown@Base 2.4.7-1+2~
+ path_ipup@Base 2.4.7-1+2~
+ peer_authname@Base 2.4.7-1+2~
+ peer_mru@Base 2.4.7-1+2~
+ pend_q@Base 2.4.7-1+2~
+ pend_qtail@Base 2.4.7-1+2~
+ persist@Base 2.4.7-1+2~
+ phase@Base 2.4.7-1+2~
+ phasechange@Base 2.4.7-1+2~
+ pidchange@Base 2.4.7-1+2~
+ ppp_available@Base 2.4.7-1+2~
+ ppp_dev_fd@Base 2.4.7-1+2~
+ ppp_devnam@Base 2.4.7-1+2~
+ ppp_recv_config@Base 2.4.7-1+2~
+ ppp_send_config@Base 2.4.7-1+2~
+ ppp_session_number@Base 2.4.7-1+2~
+ pppdb@Base 2.4.7-1+2~
+ pr_log@Base 2.4.7-1+2~
+ print_link_stats@Base 2.4.7-1+2~
+ print_options@Base 2.4.7-1+2~
+ print_string@Base 2.4.7-1+2~
+ privileged@Base 2.4.7-1+2~
+ privileged_option@Base 2.4.7-1+2~
+ privkey_file@Base 2.4.7-1+2ubuntu1~
+ privopen@Base 2.4.7-1+2~
+ progname@Base 2.4.7-1+2~
+ protocol_list@Base 2.4.7-1+2~
+ protocol_name@Base 2.4.7-1+2~
+ protocols@Base 2.4.7-1+2~
+ pty_socket@Base 2.4.7-1+2~
+ ptycommand@Base 2.4.7-1+2~
+ random_bytes@Base 2.4.7-1+2~
+ read_packet@Base 2.4.7-1+2~
+ record_child@Base 2.4.7-1+2~
+ record_file@Base 2.4.7-1+2~
+ refuse_chap@Base 2.4.7-1+2~
+ refuse_eap@Base 2.4.7-1+2~
+ refuse_mppe_stateful@Base 2.4.7-1+2~
+ refuse_mschap@Base 2.4.7-1+2~
+ refuse_mschap_v2@Base 2.4.7-1+2~
+ refuse_pap@Base 2.4.7-1+2~
+ relock@Base 2.4.7-1+2~
+ remote_name@Base 2.4.7-1+2~
+ remote_number@Base 2.4.7-1+2~
+ remove_fd@Base 2.4.7-1+2~
+ remove_notifier@Base 2.4.7-1+2~
+ remove_pidfiles@Base 2.4.7-1+2~
+ reopen_log@Base 2.4.7-1+2~
+ req_ifname@Base 2.4.7-1+2~
+ req_unit@Base 2.4.7-1+2~
+ reset_link_stats@Base 2.4.7-1+2~
+ restore_tty@Base 2.4.7-1+2~
+ route_fd@Base 2.4.7-1+2~
+ run_program@Base 2.4.7-1+2~
+ s_env_nalloc@Base 2.4.7-1+2~
+ safe_fork@Base 2.4.7-1+2~
+ script_env@Base 2.4.7-1+2~
+ script_setenv@Base 2.4.7-1+2~
+ script_unsetenv@Base 2.4.7-1+2~
+ session_end@Base 2.4.7-1+2~
+ session_mgmt@Base 2.4.7-1+2~
+ session_start@Base 2.4.7-1+2~
+ set_filters@Base 2.4.7-1+2~
+ set_ifunit@Base 2.4.7-1+2~
+ set_mppe_enc_types@Base 2.4.7-1+2~
+ set_up_tty@Base 2.4.7-1+2~
+ setdtr@Base 2.4.7-1+2~
+ setipaddr@Base 2.4.7-1+2~
+ sif6addr@Base 2.4.7-1+2~
+ sif6down@Base 2.4.7-1+2~
+ sif6up@Base 2.4.7-1+2~
+ sifaddr@Base 2.4.7-1+2~
+ sifdefaultroute@Base 2.4.7-1+2~
+ sifdown@Base 2.4.7-1+2~
+ sifnpmode@Base 2.4.7-1+2~
+ sifproxyarp@Base 2.4.7-1+2~
+ sifup@Base 2.4.7-1+2~
+ sifvjcomp@Base 2.4.7-1+2~
+ sigreceived@Base 2.4.7-1+2~
+ sipxfaddr@Base 2.4.7-1+2~
+ slprintf@Base 2.4.7-1+2~
+ snoop_recv_hook@Base 2.4.7-1+2~
+ snoop_send_hook@Base 2.4.7-1+2~
+ speeds@Base 2.4.7-1+2~
+ ssl_cmp_certs@Base 2.4.7-1+2ubuntu1~
+ ssl_msg_callback@Base 2.4.7-1+2ubuntu1~
+ ssl_verify_callback@Base 2.4.7-1+2ubuntu1~
+ start_link@Base 2.4.7-1+2~
+ start_networks@Base 2.4.7-1+2~
+ status@Base 2.4.7-1+2~
+ stop_bits@Base 2.4.7-1+2~
+ str_to_epdisc@Base 2.4.7-1+2~
+ strlcat@Base 2.4.7-1+2~
+ strlcpy@Base 2.4.7-1+2~
+ sync_serial@Base 2.4.7-1+2~
+ sys_check_options@Base 2.4.7-1+2~
+ sys_cleanup@Base 2.4.7-1+2~
+ sys_close@Base 2.4.7-1+2~
+ sys_init@Base 2.4.7-1+2~
+ tdb_append@Base 2.4.7-1+2~
+ tdb_chainlock@Base 2.4.7-1+2~
+ tdb_chainlock_read@Base 2.4.7-1+2~
+ tdb_chainunlock@Base 2.4.7-1+2~
+ tdb_chainunlock_read@Base 2.4.7-1+2~
+ tdb_clear_spinlocks@Base 2.4.7-1+2~
+ tdb_close@Base 2.4.7-1+2~
+ tdb_create_rwlocks@Base 2.4.7-1+2~
+ tdb_delete@Base 2.4.7-1+2~
+ tdb_dump_all@Base 2.4.7-1+2~
+ tdb_error@Base 2.4.7-1+2~
+ tdb_errorstr@Base 2.4.7-1+2~
+ tdb_exists@Base 2.4.7-1+2~
+ tdb_fetch@Base 2.4.7-1+2~
+ tdb_firstkey@Base 2.4.7-1+2~
+ tdb_lockall@Base 2.4.7-1+2~
+ tdb_logging_function@Base 2.4.7-1+2~
+ tdb_nextkey@Base 2.4.7-1+2~
+ tdb_null@Base 2.4.7-1+2~
+ tdb_open@Base 2.4.7-1+2~
+ tdb_open_ex@Base 2.4.7-1+2~
+ tdb_printfreelist@Base 2.4.7-1+2~
+ tdb_reopen@Base 2.4.7-1+2~
+ tdb_reopen_all@Base 2.4.7-1+2~
+ tdb_set_lock_alarm@Base 2.4.7-1+2~
+ tdb_spinlock@Base 2.4.7-1+2~
+ tdb_spinunlock@Base 2.4.7-1+2~
+ tdb_store@Base 2.4.7-1+2~
+ tdb_traverse@Base 2.4.7-1+2~
+ tdb_unlockall@Base 2.4.7-1+2~
+ the_channel@Base 2.4.7-1+2~
+ timeout@Base 2.4.7-1+2~
+ tty_channel@Base 2.4.7-1+2~
+ tty_check_options@Base 2.4.7-1+2~
+ tty_close_fds@Base 2.4.7-1+2~
+ tty_disestablish_ppp@Base 2.4.7-1+2~
+ tty_do_send_config@Base 2.4.7-1+2~
+ tty_establish_ppp@Base 2.4.7-1+2~
+ tty_init@Base 2.4.7-1+2~
+ tty_mode@Base 2.4.7-1+2~
+ tty_options@Base 2.4.7-1+2~
+ tty_process_extra_options@Base 2.4.7-1+2~
+ tty_recv_config@Base 2.4.7-1+2~
+ tty_send_config@Base 2.4.7-1+2~
+ tty_set_xaccm@Base 2.4.7-1+2~
+ tune_kernel@Base 2.4.7-1+2~
+ uid@Base 2.4.7-1+2~
+ unlock@Base 2.4.7-1+2~
+ unlock_db@Base 2.4.7-1+2~
+ unsuccess@Base 2.4.7-1+2~
+ untimeout@Base 2.4.7-1+2~
+ upap@Base 2.4.7-1+2~
+ upap_authpeer@Base 2.4.7-1+2~
+ upap_authwithpeer@Base 2.4.7-1+2~
+ update_link_stats@Base 2.4.7-1+2~
+ updetach@Base 2.4.7-1+2~
+ upper_layers_down@Base 2.4.7-1+2~
+ usehostname@Base 2.4.7-1+2~
+ uselogin@Base 2.4.7-1+2~
+ user@Base 2.4.7-1+2~
+ userenv_list@Base 2.4.7-1+2~
+ using_pty@Base 2.4.7-1+2~
+ vslprintf@Base 2.4.7-1+2~
+ wait_input@Base 2.4.7-1+2~
+ warn@Base 2.4.7-1+2~
+ welcomer@Base 2.4.7-1+2~
+ xmit_accm@Base 2.4.7-1+2~
diff -Nru ppp-2.4.7/debian/README.source ppp-2.4.7/debian/README.source
--- ppp-2.4.7/debian/README.source	2015-12-04 16:42:22.000000000 +0000
+++ ppp-2.4.7/debian/README.source	2016-01-27 16:19:52.000000000 +0000
@@ -8,6 +8,10 @@
 - The package's version number must follow a particular format. See *Version
   Number* below.
 
+- There is a symbols file used for tracking the pppd binary's ABI. See *Symbols
+  File* for more information. The build process is strict about checking the
+  ABI using the symbols file.
+
 - There are several packages that use ppp-dev to build plugins that may be
   loaded into pppd. When adding patches you must be very careful about not
   breaking ABI compatibility unnecessarily.
@@ -63,3 +67,40 @@
 If you are uploading an NMU and are confident you are not changing the ABI,
 simply add your tag to the end of the version number as usual. The same applies
 for security/stable updates and backports, too.
+
+Symbols File
+------------
+
+In order to help keep track of the ABI offered to external plugins, this
+package uses a symbols file. This is very unconvential for an executable but is
+normally considered a requirement for shared libraries. The symbols file is not
+currently used beyond the ppp package itself (e.g. plugins have no way of using
+the symbols file to generate dependencies at the moment).
+
+This is consulted during the build process and if there are any changes in the
+symbols in the binary compared to the symbols file the build will fail. This is
+deliberate and helps to indicate that the ABI has changed and an ABI bump is
+probably required.
+
+Note that just because there are no changes compared to the symbol file this
+does not mean an ABI change has not happened: a patch may well change things
+that cannot be tracked using dpkg-gensymbols, for example a C struct may have
+members changed which would also change the ABI.
+
+The symbols file is generated using standard unmodified Debian tools. There are
+two changes required in order for this to work, though:
+
+1. The pppd binary is built with -Wl,-soname,pppd.so.$(VERSION) to add the
+   SONAME field to the ELF headers. This is done by patching the Makefile in
+   debian/patches/pppd-soname-hack.patch.
+
+2. dh_makeshlibs is overridden in debian/rules to force dpkg-gensymbols to
+   inspect pppd: it normally only looks at files ending ``.so``. The ``-c2``
+   option is also added to ensure that any added/removed symbols cause the
+   build to fail.
+
+If the build fails due to changed symbols, you will most likely need to update
+the symbols file and bump the ABI revision (see *Version Number*), thus leading
+to a transition and rebuilds of any packages that build ppp plugins.
+
+# vim: ft=rst
diff -Nru ppp-2.4.7/debian/rules ppp-2.4.7/debian/rules
--- ppp-2.4.7/debian/rules	2015-12-04 16:42:22.000000000 +0000
+++ ppp-2.4.7/debian/rules	2016-01-27 16:19:52.000000000 +0000
@@ -4,8 +4,8 @@
 # Uncomment this to turn on verbose mode.
 #export DH_VERBOSE=1
 
-# Activate full hardening build flags minus PIE which breaks plugins
-export DEB_BUILD_MAINT_OPTIONS := hardening=+all,-pie
+# Activate full hardening build flags
+export DEB_BUILD_MAINT_OPTIONS := hardening=+all
 
 ## http://wiki.debian.org/onlyjob/get-orig-source
 PKD  = $(abspath $(dir $(MAKEFILE_LIST)))
@@ -150,6 +150,15 @@
 	chmod 4754 $(DIR_PPP)/usr/sbin/pppd
 	chmod 2750 $(DIR_PPP)/etc/ppp/peers/ $(DIR_PPP)/etc/chatscripts/
 
+# Force dpkg-gensymbols to inspect pppd (it doesn't end .so) so that the
+# symbols file is generated. This needs the SONAME hack that gets applied in
+# debian/patches/pppd-soname-hack.patch to work. The -c2 below makes sure that
+# the build fails if there are any discrepancies in the symbols file in order
+# to catch ABI changes.
+override_dh_makeshlibs:
+	dh_makeshlibs --package=ppp -- -c2 -edebian/ppp/usr/sbin/pppd -V
+	dh_makeshlibs --no-package=ppp
+
 ## http://wiki.debian.org/onlyjob/get-orig-source
 get-orig-source: $(info I: $(PKG)_$(VER))
 	@echo "# Downloading..."