Fix stall on PPPOE_STATE_PADR_SENT, suggested by martin@n.o, thanks.

Just drop such large PADO frames, ok'ed by yamaguchi@n.o.

I left if_pppoe.c:r1.182 code because that fixes other issues such as
pppoe(4) stall in PPPOE_STATE_PADR_SENT when the PADO sender never
replys.

Fix stall on PPPOE_STATE_PADR_SENT when received specific PADO, ok'ed by yamaguchi@n.o.

When pppoe receives a PADO frame larger than mbuf cluster size,
pppoe_send_padr() fails forever. So, the pppoe interface stall
on PPPOE_STATE_PADR_SENT until ifconfig down/up.
It should retry from PADI in such case.

s/controll/control/ in comments.

Zeroize the length explicitly when malloc failed. Pointed out by yamaguchi@n.o.

Do not allocate mbuf clusters when the caller (eroneously) asks
for more than MCLBYTES size, instead fail the allocation.

When we have received multiple PADO offer packets in the discovery
phase, do not combine tags from different packets. We are supposed
to pick one PADO packet and continue session establishment with that.

The second bug could cause code to trigger the first and create
invalid response packets and also overwrite data outside of
the allocated mbuf cluster.

Fixes CVE-2022-29867.

Make pktq_rps_hash() pluggable for each interface type. Reviewed by gdt@n.o, thorpej@n.o, and riastradh@n.o, thanks.

if_attach and if_initialize cannot fail, don't test return value

These were originally made failable back in 2017 when if_initialize
allocated a softint in every interface for link state changes, so
that it could fail gracefully instead of panicking:

https://mail-index.NetBSD.org/source-changes/2017/10/23/msg089053.html

However, this spawned many seldom- or never-tested error branches,
which are risky to have around. And that softint in every interface
has since been replaced by a single global workqueue, because link
state changes require thread context but not low latency or high
throughput:

https://mail-index.NetBSD.org/source-changes/2020/02/06/msg113759.html

So there is no longer any reason for if_initialize to fail. (The
subroutine if_stats_init can't fail because percpu_alloc can't fail
either.)

There is a snag: the softint_establish in if_percpuq_create could
fail, potentially leading to bad consequences later on trying to use
the softint. This change doesn't introduce any new bugs because of
the snag -- if_percpuq_attach was already broken. However, the snag
can be better addressed without spawning error branches, either by
using a single softint or making softints less scarce.

(Separate commit will change the signatures of if_attach and
if_initialize to return void, scheduled to ride whatever is the next
convenient kernel bump.)

Patch and testing on amd64 and evbmips64-eb by maya@; commit message
soliloquy, and compile-testing on evbppc/i386/earmv7hf, by me.

Added a kernel option to change the number of processing packets
at one pppoeintr()

Added a limitation of the number of processing packets
because a enqueuing process can not add packets over IFQ_MAXLEN

and removed reschedule at pppoeintr()
because it also scheduled at enqueuing process.

Added missing PPPOE_UNLOCK() on dropping PADS and PADT

Drop PADS and PADT from unknown host for safety

Change reconnect delay after PADT received (15 sec -> 5 sec)

5 sec is the same as minimum PADI resending interval

Accept a frame like a PADT just containing PPPoE header

branches: 1.170.2; 1.170.4;
Added missing free of sc_hunique to prevent memory leak
when using PPPoE server

Stop and destroy timeout after sppp_detach and if_detach
for safety

The functions may use resources of pppoe(4) while detaching,
so the release should move after it.

Remove unnecessaly lock holdings to avoid dead lock

The locks were held while callout_halt() and workqueue_wait()
without reason.
And the locks also were held at callout and workqueue handler
so that the handler kicked by those function couldn't acquire
the lock.

The reasons why those are unneccesary are:
- Items of callout_t are protected by callout_lock
- Items of struct workqueue and struct work are protected
by q_mutex in struct workqueue
- Items of struct sppp_work protected by atomic_cas(3)
- struct pppoe_softc does not free before workqueue_wait() and
callout_halt() even if the locks are not held

Stop ppp layer at first of destroying pppoe interface

Sort initialization sequence in pppoe_clone_create() out
for refactoring

It has no functionality impact

Use kmem_zalloc to allocate pppoe_softc

Move initialization of sc_lock in pppoe_softc to first

The lock may be held in callbacks for ppp layer or other
components so that it should be initialized early.

commonize error handling in pppoe_clone_create()

Reschedule softint to process packets enqueued to ppoediscinq
while doing pppoe_data_input

And added a empty check for ppoeinq, for safety

Added missing counter clear when a pppoe state changes to PADI_SENT

Added a NULL check for parent interface of pppoe

Hold the lock for pppoe while referencing sc_id
that is an item of struct pppoe_softc

branches: 1.158.2;
Fix to reconnect after PADT received

add a logging function used at debugging pppoe(4)

fix to remove trailing garbage

stop callout even when the state is in PPPOE_STATE_INITIAL

Close lcp when the lower layer down if the interface is passive or on-demand

reivewed by knakahara@n.o.

branches: 1.153.2;
Add a function to copy AC-Name and Service-Name

Clear AC-Name and Service-Name if params are not specified

Do pppoe_timeout() in thread context

OKed by knakahara@n.o
fix port-amd64/55661

Use callout_setfunc and callout_schedule

safely extract character sequences from packet for printing.

Adopt <net/if_stats.h>.

branches: 1.147.4; 1.147.6;
s/pakcet/packet/ in comment.

Remove printfs that are too easily reachable, switch to M_REGION_GET,
and simplify the initialization. No real functional change.

style

remove hardcoded bullshit, probably fixes PR/53644

Use a random hunique, instead of sending the pointer of the interface.
Tested via ATF.

Clarify two functions.

branches: 1.141.2;
Implement the BPF direction filter (BIOC[GS]DIRECTION). It provides backward
compatibility with BIOC[GS]SEESENT ioctl. The userland interface is the same
as FreeBSD.

This change also fixes a bug that the direction is misunderstand on some
environment by passing the direction to bpf_mtap*() instead of checking
m->m_pkthdr.rcvif.

Fix to aquire pppoe_softc_list_lock before read and write the list

ok by knakahara@n.o

Fix not to use PPPOE_UNLOCK before acccess to pppoe_softc
to avoid a race condition

According to the locking order of pppoe(4), the access to
pppoe_softc has to follow 5 steps as below.

1. aquire pppoe_softc_list_lock
2. aquire pppoe_softc lock
3. release pppoe_softc_list_lock
4. access to pppoe_softc
5. release pppoe_softc lock

However, pppoe_dispatch_disc_pkt() releases the lock of pppoe_softc
temporarily, and then re-aquires it before step 4 of the adove. So,
it is possible for other contexts to destroy a pppoe_softc in the
interim.
To fix this condition, avoid PPPOE_UNLOCK with the problem.

ok by knakahara@n.o

Ensure to call if_register after interface initializations finish

Drop early if there's no PPPoE interface. Otherwise it is easy for someone
to flood dmesg over the local subnet.

Fix sending PADT to unexpected hosts when net.pppoe.term_unknown is enabled.

net.pppoe.term_unknown can be written safely now.

branches: 1.134.2;
Use m_freem instead of m_free. Otherwise we're leaking the next mbufs in
the chain.

Remove wrong assertions

rw_lock_held() returns true when any context holds the lock. However, in
if_pppoe.c, the function was used wrongly as it returns true only if the lock is
held in the same context.

From s-yamaguchi@IIJ

Provide macros for softnet_lock and KERNEL_LOCK hiding NET_MPSAFE switch

It reduces C&P codes such as "#ifndef NET_MPSAFE KERNEL_LOCK(1, NULL); ..."
scattered all over the source code and makes it easy to identify remaining
KERNEL_LOCK and/or softnet_lock that are held even if NET_MPSAFE.

No functional change

Unify IFEF_*_MPSAFE into IFEF_MPSAFE

There are already two flags for if_output and if_start, however, it seems such
MPSAFE flags are eventually needed for all if_XXX operations. Having discrete
flags for each operation is wasteful of if_extflags bits. So let's unify
the flags into one: IFEF_MPSAFE.

Fortunately IFEF_*_MPSAFE flags have never been included in any releases, so
we can change them without breaking backward compatibility of the releases
(though the kernel version of -current should be bumped).

Note that if an interface have both MP-safe and non-MP-safe operations at a
time, we have to set the IFEF_MPSAFE flag and let callees of non-MP-safe
opeartions take the kernel lock.

Proposed on tech-kern@ and tech-net@

Mark callouts of pppoe(4) CALLOUT_MPSAFE. Suggested by ozaki-r@n.o.

- If if_initialize() failed in the attach function, free resources and return.
- KNF

sppp_lock is changed from mutex to rwlock now. Contributed by s-yamaguchi@IIJ.

Add locking notes later.

Integrate two locks used to protect PPPoE softc. Contributed by s-yamaguchi@IIJ.

PPPOE_SESSION_LOCK protects variables used in PPP packet
processing, on the other hand PPPOE_PARAM_LOCK protects
the other variables used to establish a PPPoE session id.

Those locks isn't acquired in the same time because the
PPP packet processing doesn't work without PPPoE session id.
By the reason, the locks can be integrated into PPPOE_LOCK.

Add locking notes later.

fix panic when PPPOE_DEBUG enabled. implemented by s-yamaguchi@IIJ, thanks.

XXX need pullup to -8 branch

branches: 1.125.6;
Use m_get_rcvif_psref instead of m_get_rcvif

Because the critical sections are now sleepable.

Reviewed by knakahara@

Not sure what we are trying to achieve here, but there are two issues;
error can be printed while it is not initialized, and if m_pulldown fails
m is freed and reused.

Quickly reviewed by christos and martin

branches: 1.123.2;
fix merge conflict.

pfil(9) improvements to handle address changes:

Add:
PFIL_IFADDR call on interface reconfig (mbuf is ioctl #)
PFIL_IFNET call on interface attach/detach (mbuf is PFIL_IFNET_*)

from rmind@

fix unlock and splx inversion. Currently, this doesn't cause problem because either one is used.

MP-safe pppoe(4).

Nearly all parts is implemented by Shoichi YAMAGUCHI<s-yamaguchi@IIJ>, thanks.

if_register() must be called after ifp->if_dl initialized.

There may be similar problems. I will fix step by step...

Fix race condition on ifqueue used by traditional netisr

If a underlying network device driver supports MSI/MSI-X, RX interrupts
can be delivered to arbitrary CPUs. This means that Layer 2 subroutines
such as ether_input (softint) and subsequent Layer 3 subroutines (softint)
which are called via traditional netisr can be dispatched on an arbitrary
CPU. Layer 2 subroutines now run without any locks (expected) and so a
Layer 2 subroutine and a Layer 3 subroutine can run in parallel.

There is a shared data between a Layer 2 routine and a Layer 3 routine,
that is ifqueue and IF_ENQUEUE (from L2) and IF_DEQUEUE (from L3) on it
are racy now.

To fix the race condition, use ifqueue#ifq_lock to protect ifqueue
instead of splnet that is meaningless now.

The same race condition exists in route_intr. Fix it as well.

Reviewed by knakahara@

kill unknown sessions ifdef, link set for sysctl.

Fix compile without modules.

Don't try to set-up our sysctl sub-tree if we're built-in - this will
happen automatically (via "registration" of the setup function in a
link-set), and if we're not a module, the SYSCTL_SETUP_PROTO() will
not have declared a function prototype!

modularize some more drivers and merge the module glue

For modular configurations, always build with PPPOE_TERM_UNKNOWN_SESSIONS
defined, and provide a sysctl variable for enabling/disabling the option.

Update man page accordingly.

Modularize the pppoe driver

branches: 1.111.2;
KNF. Remove extra spaces. No functional change.

Add missing NULL checks for m_get_rcvif_psref

apply if_output_lock() to L3 callers which call ifp->if_output() of L2(or L3 tunneling).

Avoid storing a pointer of an interface in a mbuf

Having a pointer of an interface in a mbuf isn't safe if we remove big
kernel locks; an interface object (ifnet) can be destroyed anytime in any
packet processing and accessing such object via a pointer is racy. Instead
we have to get an object from the interface collection (ifindex2ifnet) via
an interface index (if_index) that is stored to a mbuf instead of an
pointer.

The change provides two APIs: m_{get,put}_rcvif_psref that use psref(9)
for sleep-able critical sections and m_{get,put}_rcvif that use
pserialize(9) for other critical sections. The change also adds another
API called m_get_rcvif_NOMPSAFE, that is NOT MP-safe and for transition
moratorium, i.e., it is intended to be used for places where are not
planned to be MP-ified soon.

The change adds some overhead due to psref to performance sensitive paths,
however the overhead is not serious, 2% down at worst.

Proposed on tech-kern and tech-net.

Introduce m_set_rcvif and m_reset_rcvif

The API is used to set (or reset) a received interface of a mbuf.
They are counterpart of m_get_rcvif, which will come in another
commit, hide internal of rcvif operation, and reduce the diff of
the upcoming change.

No functional change.

CID 980057, 980058, use strlcpy()

Hide PPPoE variables from if_ethersubr.c

This improves modularity of if_pppoe.

From s-yamaguchi@IIJ

sprinkle _KERNEL_OPT

include "ioconf.h" to get the 'void <driver>attach(int count);' prototype.

branches: 1.102.2;
src is too big these days to tolerate superfluous apostrophes. It's
"its", people!

Remove unused variable

if received PADT, get correct sc related with session id.
RFC2516 5.5 says, no tags required in PADT packet.

- Rewrite parts of pfil(9): use array to store hooks and thus be more cache
friendly (there are only few hooks in the system). Make the structures
opaque and the interface more strict.
- Remove PFIL_HOOKS option by making pfil(9) mandatory.

branches: 1.98.2; 1.98.12; 1.98.16;
Add support for RFC 4638 to pppoe(4).

The change to if_spppsubr.c moves the test for whether LCP should
request a mru change until after the pppoe device has picked up the
mtu of the underlying ethernet device.

Typo in comment.

Push the bpf_ops usage back into bpf.h. Push the common ifp->if_bpf
check into the inline functions as well the fourth argument for
bpf_attach.

branches: 1.95.2; 1.95.4;
Redefine bpf linkage through an always present op vector, i.e.
#if NBPFILTER is no longer required in the client. This change
doesn't yet add support for loading bpf as a module, since drivers
can register before bpf is attached. However, callers of bpf can
now be modularized.

Dynamically loadable bpf could probably be done fairly easily with
coordination from the stub driver and the real driver by registering
attachments in the stub before the real driver is loaded and doing
a handoff. ... and I'm not going to ponder the depths of unload
here.

Tested with i386/MONOLITHIC, modified MONOLITHIC without bpf and rump.

PR/40690: Jordan Gordeev: pppoe(4) doesn't work when PPPoE relays are present
Add support for sending the session id tag back.

branches: 1.93.2; 1.93.4; 1.93.8;
Reduce the scope of PPPoE session IDs from globally unique to per-interface
unique. Some brands of ADSL modems pick a hard-coded session ID which
would otherwise make it impossible to use two of them in the same system
simultaneously.

Simplify auth failure reconnect a bit and make it more similar to the
session establishment timeout handling.

Fix a tyop in a comment and a few #define<tab> nits while here.

When upper layer asks us to re-establish a connection, don't do so
synchronously, but insert a (varying) delay. Before we have only been
decoupled from the peer via network latency - now we introduce some
explicit delay. This, at least, creates batter serialized debug output.

However, if we have to reconnect because of an authentication failure,
the peer may have just been unable to access it's radius server. (I have
a setup where this seems to happen every now and then, depending on time
of day.) Backoff reconnect in this cases seriously longer - this is better
than hitting the max-auth-failure limit within a few seconds.

Test and handle memory allocation failure for the access concentrator
cookie.

Apply patch from Yasuoka Masahiko in PR kern/39321: fix length check
when parsing pppoe discovery phase packets.

branches: 1.87.2;
- add if_alloc (ours just mallocs), and if_initname and use them (from FreeBSD)
- kill memsets where M_ZERO can be used.

branches: 1.86.2; 1.86.4;
Remove clause 3 and 4 from TNF licenses

branches: 1.85.2;
Merge the socket locking patch:

- Socket layer becomes MP safe.
- Unix protocols become MP safe.
- Allows protocol processing interrupts to safely block on locks.
- Fixes a number of race conditions.

With much feedback from matt@ and plunky@.

branches: 1.84.6; 1.84.8;
s/u_\(int[0-9]*_t\)/u\1/g
(change u_int*_t to uint*_t)

Start patching up the kernel so that a network driver always has
the opportunity to handle an ioctl before generic ifioctl handling
occurs. This will ease extending the kernel and sharing of code
between drivers.

First steps: Make the signature of ifioctl_common() match struct
ifinet->if_ioctl. Convert SIOCSIFCAP and SIOCSIFMTU to the new
ifioctl() regime, throughout the kernel.

Convert many of the uses of __attribute__ to equivalent
__packed, __unused and __dead macros from cdefs.h

branches: 1.81.4; 1.81.6; 1.81.10;
Use the softint API.

branches: 1.80.2;
Print the access concentrator name when a session is established.
This seems to be usefull to identify peers with known broken firmware
(e.g. that can only do IPv4 reliably).

branches: 1.79.2; 1.79.6; 1.79.8;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

caddr_t fallout (only visible with options PPPOE_SERVER)

branches: 1.77.2; 1.77.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.76.2; 1.76.4; 1.76.8;
__unused removal on arguments; approved by core.

Do not truncate the last char from a remote error message

Kill some KAUTH_GENERIC_ISSUSER uses.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.72.2; 1.72.4;
Fix initializers.

defflag PPPOE_SERVER and PPPOE_TERM_UNKNOWN_SESSIONS.

Use the LWP cached credentials where sane.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

branches: 1.68.2;
integrate kauth.

Adapt maximum MTU permitted on pppoe(4) interfaces to the MTU of the
connected ethernet interface.

Don't allow to connect a non ethernet interface to a PPPoE interface.

Don't try to free a NULL mbuf.

branches: 1.64.2; 1.64.4; 1.64.6; 1.64.8; 1.64.10;
Make sure error messages (received from the access concentrator) are
zero terminated.

branches: 1.63.2;
ANSI function decls and application of static.

merge ktrace-lwp.

Fix bogus uninitialized variable warning ifdef PPPOE_SERVER.
Noticed by Marcin Jessa on current-users.

branches: 1.60.2;
- sprinkle const
- remove unneeded casts
- use more mem*() instead of b*() funcs.

branches: 1.59.2; 1.59.4;
nuke trailing whitespace

branches: 1.58.2;
Remove deleted interfaces from the instance list (inspired by an OpenBSD
change). While there, fix a comment.

branches: 1.57.2;
Factor out softc cleanup after loss of session into pppoe_clear_softc.
Use this when loosing the ethernet interface (when it deataches).
Fixes PR kern/28375.

Change ifc_destroy to return an int instead of void, so that it
can pass back errors to ifconfig.

Re-order the inclusion of opt_pfil_hooks so PFIL_HOOKS gets set properly.

Add a pfil(9) hook to get notified when interfaces detach.
When the ethernet interface of a pppoe pseudo-interface detaches, remove
the association and mark the pppoe interface down.
This should fix PR kern/28375.

kill sprintf, use snprintf

fixed mbuf leak if up pppoe but not connected an ether i/f.

branches: 1.51.4;
s/netbsd.org/NetBSD.org/g

Remove some assigned-to but otherwise unused variables.

Fix uninitialized variable warnings

Process has only one c. From miod@openbsd.

Tell copyinstr about the real buffer size (not one byte to few). Add more
error checking. Noticed by Quentin Garnier.

If the peer cares to send us error messages, actually display them.

When trying to (re-)establish a session cope with intermediate output
failures of the underlying ethernet interface - just keep trying.

branches: 1.44.2;
Put correct dest ether address on PPPoE server mode.

Add support in-kernel PPPoE server.
This may work with one PPPoE session.
If you want to use it, #define PPPOE_SERVER in somewhere,
or add options PPPOE_SERVER in kernel config file.

This is experimental code, and good start point for future development.

Backout previous, I'm on crack obviously.

Initialize sc to NULL, it could be used uninitialized otherwise when
searching for our sc by host unique tag.

when looking up a Host-Uniq tag, do not consider NULL as a valid
(struct pppoe_softc *). Although we do not generate such tags, other hosts
could and some actually do.

PADT is always send with ethertype PPPOE_DISCOVERY, no matter if we
have reached session state or not.

Fixes PR kern/20203 by Shoichi Miyake.

Test callout_pending(), not callout_active(), and eliminate now-unnecessary
callout_deactivate() calls.

Fix broken error handling in case M_PREPEND fails.
Noticed by Matthias Scheeler.

In do not call pppoe_abort_connect if we fail to send the initial PADI
packet - there is nothing to abort.
In pppoe_abort_connect rearange state handling slightly to avoid calls
to the PPP LCP state machine get into an infinite recursion.

This should fix the symptoms of PR kern/19500, but does not touch the
real cause for the lossage described there.

Apply patch from Todd Vierling in PR kern/17665:

remove a test that has been obsoleted by the authentication failure
counter - enter slow retry mode always, not only if we already transfered
data successfully (the test was designed to disable retries when the
initial authentication setting was not correct, the auth failure counter
does this job better).

Add an option PPPOE_TERM_UNKNOWN_SESSIONS to forcefully disconnect sessions
we don't know anything about with a PADT packet.

Use with care, this is pretty dangerous and will kill all userland PPPoE
implementations. Therefore it is not enabled by default nor added as
a commented out option to GENERIC kernels.

But it is highly usefull if you have a fixed IP, an ISP that does not use
LCP echo requests for link monitoring and you want to recover quickly after
a crash or otherwise ungracefull disconnect.

Fix typo in a comment.

- free buf when unneeded.
- pass a consistent type to free(9).

fix loop condition.
(don't skip last tag)

avoid unneeded call to m_pullup

do not require PPPoE control packet to be put into a single mbuf.
reviewed/tested by ymmt

more style

style

more KNF. warn about mbuf misuse (passing pointer outside of mbuf is dangerous)

tabify. minor KNF

branches: 1.24.2; 1.24.4;
Fix copyright notice.

Avoid noise from the kernel if we have pseudo-device pppoe configured
but not used and a userland PPPoE pkg sends/receives PPPoE packets.

Clear M_BCAST and M_MCAST flags on mbufs before passing them down to the
ethernet driver - just in case it would look at them and do the wrong
thing.

Fix typo in comment.

Avoid any non-error output for normal operations, only print those
messages if the interface is set to debug.

Tweak the slow-but-persistent connection reestablishment timeout, retrying
is not realy expensive - do it once every minute.

Prevent the MTU from being set bigger than what we can handle.

As discussed with Aymeric, <machine/intr.h> is always required, so don't
make its inclusion conditional.

Don't include machine/types.h (my fault in previous commit)
Reported by Klaus Klein.

include machine/types.h
include machine/intr.h if defined(__HAVE_GENERIC_SOFT_INTERRUPTS)
It makes this file compile for the amiga.

Move net/if_sppp.h to net/if_spppvar.h, create a new net/if_sppp.h
containing the userland visible thinks (i.e. ioctl definitions).

Remove all (both) old ioctls, as they had a brain dead API and made keeping
binary compatibility more or less impossible.

Replace by several new ioctls. While there, remove any arbitrary limits
(resulting from the old, broken ioctls) and allow any length of names
and passwords.

Cleanup softc more completely on "ifconfig down", but only if we are
currently in a connection reestablishement state.

The previouse (incomplete/unconditional) cleanup confused the state machine.

Fix packet accounting (now netstat -i and netstat -ib show reasonable
values).

Implement a secondary connection-reestablishement mode, which is only
entered after (1) we have successfully transfered payload data over this
connection and (2) if initial retries did not reestablish a session.
In this mode we retry (infrequently) forever, until adminstrator stops
us (by "ifconfig ppppoe0 down"). XXX - need to display this mode in
pppoectl.

It is now possible to pull the DSL modems plug for say 15 minutes, plug
it back in again and just wait. The connection will be reestablished within
three minutes.

Enable additional error messages for the discovery phase, clarify some
others. Change one timeout slightly - we need to make all others user
settable.

Enable active LCP keepalive handling in the PPP layer, the PPPoE layer
itself has no means to detect broken connections.

Now that everything works without LINK1 set, do not set it by default.
While here, remove an unnecessary splnet()/splx() pair.

Fail early when trying to identify a pppoe interface softc (from a
HOST UNIQUE token) and our list of interfaces is empty. Without this
test an unitinalized pointer may be dereferenced.

remove unnecessary #if NFOO > 0 .... #endif wrappers

add RCSIDs

Don't call if_alloc_sadl when creating the pppoe interface, it's called
from sppp_attach.
When destroying the interface, call sppp_detach for proper cleanup.
This avoids a crash from the slow timeout handler for no longer existing
interfaces (spotted by R�mi Zara).

branches: 1.5.4;
Make this interface cloning.

branches: 1.4.2;
Take into account the two byte PPP protocol discrimator following the PPPoE
header when calculating the MTU. Ooops...

Thanks to Mario Kemper for noting this.

branches: 1.3.2;
Protect interface queue manipulations by splnet(). Splsoftnet() is not
enough.

change the meaning of ifnet.if_lastchange to meet RFC1573 ifLastChange.
follows BSD/OS practice and ucd-snmp code (FreeBSD does it for specific
interfaces only).

was: if_lastchange get updated on every packet transmission/receipt.
now: if_lastchange get updated when IFF_UP is changed.

Add an in-kernel PPPoE (ppp over ethernet, RFC 2516) implementation,
based on the existing net/if_spppsubr.c stuff.

While there are completely userland (bpf based) implementations available,
those have a vastly larger per packet overhead thus causing major CPU
overhead and higher latency. On an i386 base router, running a 486DX at 50MHz
my line (768kBit/s downstream) was limited to something (varying) between 10
and 20 kByte/s effective download rate. With this implementation I get full
bandwidth (~85kByte/s).

This is client side only. Arguably the right way to add full PPPoE support
(including server side) would be a variation of the ppp line discipline and
appropriate modifications to pppd. I promise every help I can give to anyone
doing that - but I needed this realy fast. Besids, on low memory NAT boxes
with typically a single PPPoE connection, this implementation is more
lightweight than a pppd based one, which nicely fits my needs.

Fix stall on PPPOE_STATE_PADR_SENT when received specific PADO, ok'ed by yamaguchi@n.o.

When pppoe receives a PADO frame larger than mbuf cluster size,
pppoe_send_padr() fails forever. So, the pppoe interface stall
on PPPOE_STATE_PADR_SENT until ifconfig down/up.
It should retry from PADI in such case.

s/controll/control/ in comments.

Zeroize the length explicitly when malloc failed. Pointed out by yamaguchi@n.o.

Do not allocate mbuf clusters when the caller (eroneously) asks
for more than MCLBYTES size, instead fail the allocation.

When we have received multiple PADO offer packets in the discovery
phase, do not combine tags from different packets. We are supposed
to pick one PADO packet and continue session establishment with that.

The second bug could cause code to trigger the first and create
invalid response packets and also overwrite data outside of
the allocated mbuf cluster.

Fixes CVE-2022-29867.

Make pktq_rps_hash() pluggable for each interface type. Reviewed by gdt@n.o, thorpej@n.o, and riastradh@n.o, thanks.

if_attach and if_initialize cannot fail, don't test return value

These were originally made failable back in 2017 when if_initialize
allocated a softint in every interface for link state changes, so
that it could fail gracefully instead of panicking:

https://mail-index.NetBSD.org/source-changes/2017/10/23/msg089053.html

However, this spawned many seldom- or never-tested error branches,
which are risky to have around. And that softint in every interface
has since been replaced by a single global workqueue, because link
state changes require thread context but not low latency or high
throughput:

https://mail-index.NetBSD.org/source-changes/2020/02/06/msg113759.html

So there is no longer any reason for if_initialize to fail. (The
subroutine if_stats_init can't fail because percpu_alloc can't fail
either.)

There is a snag: the softint_establish in if_percpuq_create could
fail, potentially leading to bad consequences later on trying to use
the softint. This change doesn't introduce any new bugs because of
the snag -- if_percpuq_attach was already broken. However, the snag
can be better addressed without spawning error branches, either by
using a single softint or making softints less scarce.

(Separate commit will change the signatures of if_attach and
if_initialize to return void, scheduled to ride whatever is the next
convenient kernel bump.)

Patch and testing on amd64 and evbmips64-eb by maya@; commit message
soliloquy, and compile-testing on evbppc/i386/earmv7hf, by me.

Added a kernel option to change the number of processing packets
at one pppoeintr()

Added a limitation of the number of processing packets
because a enqueuing process can not add packets over IFQ_MAXLEN

and removed reschedule at pppoeintr()
because it also scheduled at enqueuing process.

Added missing PPPOE_UNLOCK() on dropping PADS and PADT

Drop PADS and PADT from unknown host for safety

Change reconnect delay after PADT received (15 sec -> 5 sec)

5 sec is the same as minimum PADI resending interval

Accept a frame like a PADT just containing PPPoE header

branches: 1.170.2; 1.170.4;
Added missing free of sc_hunique to prevent memory leak
when using PPPoE server

Stop and destroy timeout after sppp_detach and if_detach
for safety

The functions may use resources of pppoe(4) while detaching,
so the release should move after it.

Remove unnecessaly lock holdings to avoid dead lock

The locks were held while callout_halt() and workqueue_wait()
without reason.
And the locks also were held at callout and workqueue handler
so that the handler kicked by those function couldn't acquire
the lock.

The reasons why those are unneccesary are:
- Items of callout_t are protected by callout_lock
- Items of struct workqueue and struct work are protected
by q_mutex in struct workqueue
- Items of struct sppp_work protected by atomic_cas(3)
- struct pppoe_softc does not free before workqueue_wait() and
callout_halt() even if the locks are not held

Stop ppp layer at first of destroying pppoe interface

Sort initialization sequence in pppoe_clone_create() out
for refactoring

It has no functionality impact

Use kmem_zalloc to allocate pppoe_softc

Move initialization of sc_lock in pppoe_softc to first

The lock may be held in callbacks for ppp layer or other
components so that it should be initialized early.

commonize error handling in pppoe_clone_create()

Reschedule softint to process packets enqueued to ppoediscinq
while doing pppoe_data_input

And added a empty check for ppoeinq, for safety

Added missing counter clear when a pppoe state changes to PADI_SENT

Added a NULL check for parent interface of pppoe

Hold the lock for pppoe while referencing sc_id
that is an item of struct pppoe_softc

branches: 1.158.2;
Fix to reconnect after PADT received

add a logging function used at debugging pppoe(4)

fix to remove trailing garbage

stop callout even when the state is in PPPOE_STATE_INITIAL

Close lcp when the lower layer down if the interface is passive or on-demand

reivewed by knakahara@n.o.

branches: 1.153.2;
Add a function to copy AC-Name and Service-Name

Clear AC-Name and Service-Name if params are not specified

Do pppoe_timeout() in thread context

OKed by knakahara@n.o
fix port-amd64/55661

Use callout_setfunc and callout_schedule

safely extract character sequences from packet for printing.

Adopt <net/if_stats.h>.

branches: 1.147.4; 1.147.6;
s/pakcet/packet/ in comment.

Remove printfs that are too easily reachable, switch to M_REGION_GET,
and simplify the initialization. No real functional change.

style

remove hardcoded bullshit, probably fixes PR/53644

Use a random hunique, instead of sending the pointer of the interface.
Tested via ATF.

Clarify two functions.

branches: 1.141.2;
Implement the BPF direction filter (BIOC[GS]DIRECTION). It provides backward
compatibility with BIOC[GS]SEESENT ioctl. The userland interface is the same
as FreeBSD.

This change also fixes a bug that the direction is misunderstand on some
environment by passing the direction to bpf_mtap*() instead of checking
m->m_pkthdr.rcvif.

Fix to aquire pppoe_softc_list_lock before read and write the list

ok by knakahara@n.o

Fix not to use PPPOE_UNLOCK before acccess to pppoe_softc
to avoid a race condition

According to the locking order of pppoe(4), the access to
pppoe_softc has to follow 5 steps as below.

1. aquire pppoe_softc_list_lock
2. aquire pppoe_softc lock
3. release pppoe_softc_list_lock
4. access to pppoe_softc
5. release pppoe_softc lock

However, pppoe_dispatch_disc_pkt() releases the lock of pppoe_softc
temporarily, and then re-aquires it before step 4 of the adove. So,
it is possible for other contexts to destroy a pppoe_softc in the
interim.
To fix this condition, avoid PPPOE_UNLOCK with the problem.

ok by knakahara@n.o

Ensure to call if_register after interface initializations finish

Drop early if there's no PPPoE interface. Otherwise it is easy for someone
to flood dmesg over the local subnet.

Fix sending PADT to unexpected hosts when net.pppoe.term_unknown is enabled.

net.pppoe.term_unknown can be written safely now.

branches: 1.134.2;
Use m_freem instead of m_free. Otherwise we're leaking the next mbufs in
the chain.

Remove wrong assertions

rw_lock_held() returns true when any context holds the lock. However, in
if_pppoe.c, the function was used wrongly as it returns true only if the lock is
held in the same context.

From s-yamaguchi@IIJ

Provide macros for softnet_lock and KERNEL_LOCK hiding NET_MPSAFE switch

It reduces C&P codes such as "#ifndef NET_MPSAFE KERNEL_LOCK(1, NULL); ..."
scattered all over the source code and makes it easy to identify remaining
KERNEL_LOCK and/or softnet_lock that are held even if NET_MPSAFE.

No functional change

Unify IFEF_*_MPSAFE into IFEF_MPSAFE

There are already two flags for if_output and if_start, however, it seems such
MPSAFE flags are eventually needed for all if_XXX operations. Having discrete
flags for each operation is wasteful of if_extflags bits. So let's unify
the flags into one: IFEF_MPSAFE.

Fortunately IFEF_*_MPSAFE flags have never been included in any releases, so
we can change them without breaking backward compatibility of the releases
(though the kernel version of -current should be bumped).

Note that if an interface have both MP-safe and non-MP-safe operations at a
time, we have to set the IFEF_MPSAFE flag and let callees of non-MP-safe
opeartions take the kernel lock.

Proposed on tech-kern@ and tech-net@

Mark callouts of pppoe(4) CALLOUT_MPSAFE. Suggested by ozaki-r@n.o.

- If if_initialize() failed in the attach function, free resources and return.
- KNF

sppp_lock is changed from mutex to rwlock now. Contributed by s-yamaguchi@IIJ.

Add locking notes later.

Integrate two locks used to protect PPPoE softc. Contributed by s-yamaguchi@IIJ.

PPPOE_SESSION_LOCK protects variables used in PPP packet
processing, on the other hand PPPOE_PARAM_LOCK protects
the other variables used to establish a PPPoE session id.

Those locks isn't acquired in the same time because the
PPP packet processing doesn't work without PPPoE session id.
By the reason, the locks can be integrated into PPPOE_LOCK.

Add locking notes later.

fix panic when PPPOE_DEBUG enabled. implemented by s-yamaguchi@IIJ, thanks.

XXX need pullup to -8 branch

branches: 1.125.6;
Use m_get_rcvif_psref instead of m_get_rcvif

Because the critical sections are now sleepable.

Reviewed by knakahara@

Not sure what we are trying to achieve here, but there are two issues;
error can be printed while it is not initialized, and if m_pulldown fails
m is freed and reused.

Quickly reviewed by christos and martin

branches: 1.123.2;
fix merge conflict.

pfil(9) improvements to handle address changes:

Add:
PFIL_IFADDR call on interface reconfig (mbuf is ioctl #)
PFIL_IFNET call on interface attach/detach (mbuf is PFIL_IFNET_*)

from rmind@

fix unlock and splx inversion. Currently, this doesn't cause problem because either one is used.

MP-safe pppoe(4).

Nearly all parts is implemented by Shoichi YAMAGUCHI<s-yamaguchi@IIJ>, thanks.

if_register() must be called after ifp->if_dl initialized.

There may be similar problems. I will fix step by step...

Fix race condition on ifqueue used by traditional netisr

If a underlying network device driver supports MSI/MSI-X, RX interrupts
can be delivered to arbitrary CPUs. This means that Layer 2 subroutines
such as ether_input (softint) and subsequent Layer 3 subroutines (softint)
which are called via traditional netisr can be dispatched on an arbitrary
CPU. Layer 2 subroutines now run without any locks (expected) and so a
Layer 2 subroutine and a Layer 3 subroutine can run in parallel.

There is a shared data between a Layer 2 routine and a Layer 3 routine,
that is ifqueue and IF_ENQUEUE (from L2) and IF_DEQUEUE (from L3) on it
are racy now.

To fix the race condition, use ifqueue#ifq_lock to protect ifqueue
instead of splnet that is meaningless now.

The same race condition exists in route_intr. Fix it as well.

Reviewed by knakahara@

kill unknown sessions ifdef, link set for sysctl.

Fix compile without modules.

Don't try to set-up our sysctl sub-tree if we're built-in - this will
happen automatically (via "registration" of the setup function in a
link-set), and if we're not a module, the SYSCTL_SETUP_PROTO() will
not have declared a function prototype!

modularize some more drivers and merge the module glue

For modular configurations, always build with PPPOE_TERM_UNKNOWN_SESSIONS
defined, and provide a sysctl variable for enabling/disabling the option.

Update man page accordingly.

Modularize the pppoe driver

branches: 1.111.2;
KNF. Remove extra spaces. No functional change.

Add missing NULL checks for m_get_rcvif_psref

apply if_output_lock() to L3 callers which call ifp->if_output() of L2(or L3 tunneling).

Avoid storing a pointer of an interface in a mbuf

Having a pointer of an interface in a mbuf isn't safe if we remove big
kernel locks; an interface object (ifnet) can be destroyed anytime in any
packet processing and accessing such object via a pointer is racy. Instead
we have to get an object from the interface collection (ifindex2ifnet) via
an interface index (if_index) that is stored to a mbuf instead of an
pointer.

The change provides two APIs: m_{get,put}_rcvif_psref that use psref(9)
for sleep-able critical sections and m_{get,put}_rcvif that use
pserialize(9) for other critical sections. The change also adds another
API called m_get_rcvif_NOMPSAFE, that is NOT MP-safe and for transition
moratorium, i.e., it is intended to be used for places where are not
planned to be MP-ified soon.

The change adds some overhead due to psref to performance sensitive paths,
however the overhead is not serious, 2% down at worst.

Proposed on tech-kern and tech-net.

Introduce m_set_rcvif and m_reset_rcvif

The API is used to set (or reset) a received interface of a mbuf.
They are counterpart of m_get_rcvif, which will come in another
commit, hide internal of rcvif operation, and reduce the diff of
the upcoming change.

No functional change.

CID 980057, 980058, use strlcpy()

Hide PPPoE variables from if_ethersubr.c

This improves modularity of if_pppoe.

From s-yamaguchi@IIJ

sprinkle _KERNEL_OPT

include "ioconf.h" to get the 'void <driver>attach(int count);' prototype.

branches: 1.102.2;
src is too big these days to tolerate superfluous apostrophes. It's
"its", people!

Remove unused variable

if received PADT, get correct sc related with session id.
RFC2516 5.5 says, no tags required in PADT packet.

- Rewrite parts of pfil(9): use array to store hooks and thus be more cache
friendly (there are only few hooks in the system). Make the structures
opaque and the interface more strict.
- Remove PFIL_HOOKS option by making pfil(9) mandatory.

branches: 1.98.2; 1.98.12; 1.98.16;
Add support for RFC 4638 to pppoe(4).

The change to if_spppsubr.c moves the test for whether LCP should
request a mru change until after the pppoe device has picked up the
mtu of the underlying ethernet device.

Typo in comment.

Push the bpf_ops usage back into bpf.h. Push the common ifp->if_bpf
check into the inline functions as well the fourth argument for
bpf_attach.

branches: 1.95.2; 1.95.4;
Redefine bpf linkage through an always present op vector, i.e.
#if NBPFILTER is no longer required in the client. This change
doesn't yet add support for loading bpf as a module, since drivers
can register before bpf is attached. However, callers of bpf can
now be modularized.

Dynamically loadable bpf could probably be done fairly easily with
coordination from the stub driver and the real driver by registering
attachments in the stub before the real driver is loaded and doing
a handoff. ... and I'm not going to ponder the depths of unload
here.

Tested with i386/MONOLITHIC, modified MONOLITHIC without bpf and rump.

PR/40690: Jordan Gordeev: pppoe(4) doesn't work when PPPoE relays are present
Add support for sending the session id tag back.

branches: 1.93.2; 1.93.4; 1.93.8;
Reduce the scope of PPPoE session IDs from globally unique to per-interface
unique. Some brands of ADSL modems pick a hard-coded session ID which
would otherwise make it impossible to use two of them in the same system
simultaneously.

Simplify auth failure reconnect a bit and make it more similar to the
session establishment timeout handling.

Fix a tyop in a comment and a few #define<tab> nits while here.

When upper layer asks us to re-establish a connection, don't do so
synchronously, but insert a (varying) delay. Before we have only been
decoupled from the peer via network latency - now we introduce some
explicit delay. This, at least, creates batter serialized debug output.

However, if we have to reconnect because of an authentication failure,
the peer may have just been unable to access it's radius server. (I have
a setup where this seems to happen every now and then, depending on time
of day.) Backoff reconnect in this cases seriously longer - this is better
than hitting the max-auth-failure limit within a few seconds.

Test and handle memory allocation failure for the access concentrator
cookie.

Apply patch from Yasuoka Masahiko in PR kern/39321: fix length check
when parsing pppoe discovery phase packets.

branches: 1.87.2;
- add if_alloc (ours just mallocs), and if_initname and use them (from FreeBSD)
- kill memsets where M_ZERO can be used.

branches: 1.86.2; 1.86.4;
Remove clause 3 and 4 from TNF licenses

branches: 1.85.2;
Merge the socket locking patch:

- Socket layer becomes MP safe.
- Unix protocols become MP safe.
- Allows protocol processing interrupts to safely block on locks.
- Fixes a number of race conditions.

With much feedback from matt@ and plunky@.

branches: 1.84.6; 1.84.8;
s/u_\(int[0-9]*_t\)/u\1/g
(change u_int*_t to uint*_t)

Start patching up the kernel so that a network driver always has
the opportunity to handle an ioctl before generic ifioctl handling
occurs. This will ease extending the kernel and sharing of code
between drivers.

First steps: Make the signature of ifioctl_common() match struct
ifinet->if_ioctl. Convert SIOCSIFCAP and SIOCSIFMTU to the new
ifioctl() regime, throughout the kernel.

Convert many of the uses of __attribute__ to equivalent
__packed, __unused and __dead macros from cdefs.h

branches: 1.81.4; 1.81.6; 1.81.10;
Use the softint API.

branches: 1.80.2;
Print the access concentrator name when a session is established.
This seems to be usefull to identify peers with known broken firmware
(e.g. that can only do IPv4 reliably).

branches: 1.79.2; 1.79.6; 1.79.8;
Merge some of the less invasive changes from the vmlocking branch:

- kthread, callout, devsw API changes
- select()/poll() improvements
- miscellaneous MT safety improvements

caddr_t fallout (only visible with options PPPOE_SERVER)

branches: 1.77.2; 1.77.4;
Kill caddr_t; there will be some MI fallout, but it will be fixed shortly.

branches: 1.76.2; 1.76.4; 1.76.8;
__unused removal on arguments; approved by core.

Do not truncate the last char from a remote error message

Kill some KAUTH_GENERIC_ISSUSER uses.

- sprinkle __unused on function decls.
- fix a couple of unused bugs
- no more -Wno-unused for i386

branches: 1.72.2; 1.72.4;
Fix initializers.

defflag PPPOE_SERVER and PPPOE_TERM_UNKNOWN_SESSIONS.

Use the LWP cached credentials where sane.

merge FreeBSD timecounters from branch simonb-timecounters
- struct timeval time is gone
time.tv_sec -> time_second
- struct timeval mono_time is gone
mono_time.tv_sec -> time_uptime
- access to time via
{get,}{micro,nano,bin}time()
get* versions are fast but less precise
- support NTP nanokernel implementation (NTP API 4)
- further reading:
Timecounter Paper: http://phk.freebsd.dk/pubs/timecounter.pdf
NTP Nanokernel: http://www.eecis.udel.edu/~mills/ntp/html/kern.html

branches: 1.68.2;
integrate kauth.

Adapt maximum MTU permitted on pppoe(4) interfaces to the MTU of the
connected ethernet interface.

Don't allow to connect a non ethernet interface to a PPPoE interface.

Don't try to free a NULL mbuf.

branches: 1.64.2; 1.64.4; 1.64.6; 1.64.8; 1.64.10;
Make sure error messages (received from the access concentrator) are
zero terminated.

branches: 1.63.2;
ANSI function decls and application of static.

merge ktrace-lwp.

Fix bogus uninitialized variable warning ifdef PPPOE_SERVER.
Noticed by Marcin Jessa on current-users.

branches: 1.60.2;
- sprinkle const
- remove unneeded casts
- use more mem*() instead of b*() funcs.

branches: 1.59.2; 1.59.4;
nuke trailing whitespace

branches: 1.58.2;
Remove deleted interfaces from the instance list (inspired by an OpenBSD
change). While there, fix a comment.

branches: 1.57.2;
Factor out softc cleanup after loss of session into pppoe_clear_softc.
Use this when loosing the ethernet interface (when it deataches).
Fixes PR kern/28375.

Change ifc_destroy to return an int instead of void, so that it
can pass back errors to ifconfig.

Re-order the inclusion of opt_pfil_hooks so PFIL_HOOKS gets set properly.

Add a pfil(9) hook to get notified when interfaces detach.
When the ethernet interface of a pppoe pseudo-interface detaches, remove
the association and mark the pppoe interface down.
This should fix PR kern/28375.

kill sprintf, use snprintf

fixed mbuf leak if up pppoe but not connected an ether i/f.

branches: 1.51.4;
s/netbsd.org/NetBSD.org/g

Remove some assigned-to but otherwise unused variables.

Fix uninitialized variable warnings

Process has only one c. From miod@openbsd.

Tell copyinstr about the real buffer size (not one byte to few). Add more
error checking. Noticed by Quentin Garnier.

If the peer cares to send us error messages, actually display them.

When trying to (re-)establish a session cope with intermediate output
failures of the underlying ethernet interface - just keep trying.

branches: 1.44.2;
Put correct dest ether address on PPPoE server mode.

Add support in-kernel PPPoE server.
This may work with one PPPoE session.
If you want to use it, #define PPPOE_SERVER in somewhere,
or add options PPPOE_SERVER in kernel config file.

This is experimental code, and good start point for future development.

Backout previous, I'm on crack obviously.

Initialize sc to NULL, it could be used uninitialized otherwise when
searching for our sc by host unique tag.

when looking up a Host-Uniq tag, do not consider NULL as a valid
(struct pppoe_softc *). Although we do not generate such tags, other hosts
could and some actually do.

PADT is always send with ethertype PPPOE_DISCOVERY, no matter if we
have reached session state or not.

Fixes PR kern/20203 by Shoichi Miyake.

Test callout_pending(), not callout_active(), and eliminate now-unnecessary
callout_deactivate() calls.

Fix broken error handling in case M_PREPEND fails.
Noticed by Matthias Scheeler.

In do not call pppoe_abort_connect if we fail to send the initial PADI
packet - there is nothing to abort.
In pppoe_abort_connect rearange state handling slightly to avoid calls
to the PPP LCP state machine get into an infinite recursion.

This should fix the symptoms of PR kern/19500, but does not touch the
real cause for the lossage described there.

Apply patch from Todd Vierling in PR kern/17665:

remove a test that has been obsoleted by the authentication failure
counter - enter slow retry mode always, not only if we already transfered
data successfully (the test was designed to disable retries when the
initial authentication setting was not correct, the auth failure counter
does this job better).

Add an option PPPOE_TERM_UNKNOWN_SESSIONS to forcefully disconnect sessions
we don't know anything about with a PADT packet.

Use with care, this is pretty dangerous and will kill all userland PPPoE
implementations. Therefore it is not enabled by default nor added as
a commented out option to GENERIC kernels.

But it is highly usefull if you have a fixed IP, an ISP that does not use
LCP echo requests for link monitoring and you want to recover quickly after
a crash or otherwise ungracefull disconnect.

Fix typo in a comment.

- free buf when unneeded.
- pass a consistent type to free(9).

fix loop condition.
(don't skip last tag)

avoid unneeded call to m_pullup

do not require PPPoE control packet to be put into a single mbuf.
reviewed/tested by ymmt

more style

style

more KNF. warn about mbuf misuse (passing pointer outside of mbuf is dangerous)

tabify. minor KNF

branches: 1.24.2; 1.24.4;
Fix copyright notice.

Avoid noise from the kernel if we have pseudo-device pppoe configured
but not used and a userland PPPoE pkg sends/receives PPPoE packets.

Clear M_BCAST and M_MCAST flags on mbufs before passing them down to the
ethernet driver - just in case it would look at them and do the wrong
thing.

Fix typo in comment.

Avoid any non-error output for normal operations, only print those
messages if the interface is set to debug.

Tweak the slow-but-persistent connection reestablishment timeout, retrying
is not realy expensive - do it once every minute.

Prevent the MTU from being set bigger than what we can handle.

As discussed with Aymeric, <machine/intr.h> is always required, so don't
make its inclusion conditional.

Don't include machine/types.h (my fault in previous commit)
Reported by Klaus Klein.

include machine/types.h
include machine/intr.h if defined(__HAVE_GENERIC_SOFT_INTERRUPTS)
It makes this file compile for the amiga.

Move net/if_sppp.h to net/if_spppvar.h, create a new net/if_sppp.h
containing the userland visible thinks (i.e. ioctl definitions).

Remove all (both) old ioctls, as they had a brain dead API and made keeping
binary compatibility more or less impossible.

Replace by several new ioctls. While there, remove any arbitrary limits
(resulting from the old, broken ioctls) and allow any length of names
and passwords.

Cleanup softc more completely on "ifconfig down", but only if we are
currently in a connection reestablishement state.

The previouse (incomplete/unconditional) cleanup confused the state machine.

Fix packet accounting (now netstat -i and netstat -ib show reasonable
values).

Implement a secondary connection-reestablishement mode, which is only
entered after (1) we have successfully transfered payload data over this
connection and (2) if initial retries did not reestablish a session.
In this mode we retry (infrequently) forever, until adminstrator stops
us (by "ifconfig ppppoe0 down"). XXX - need to display this mode in
pppoectl.

It is now possible to pull the DSL modems plug for say 15 minutes, plug
it back in again and just wait. The connection will be reestablished within
three minutes.

Enable additional error messages for the discovery phase, clarify some
others. Change one timeout slightly - we need to make all others user
settable.

Enable active LCP keepalive handling in the PPP layer, the PPPoE layer
itself has no means to detect broken connections.

Now that everything works without LINK1 set, do not set it by default.
While here, remove an unnecessary splnet()/splx() pair.

Fail early when trying to identify a pppoe interface softc (from a
HOST UNIQUE token) and our list of interfaces is empty. Without this
test an unitinalized pointer may be dereferenced.

remove unnecessary #if NFOO > 0 .... #endif wrappers

add RCSIDs

Don't call if_alloc_sadl when creating the pppoe interface, it's called
from sppp_attach.
When destroying the interface, call sppp_detach for proper cleanup.
This avoids a crash from the slow timeout handler for no longer existing
interfaces (spotted by R�mi Zara).

branches: 1.5.4;
Make this interface cloning.

branches: 1.4.2;
Take into account the two byte PPP protocol discrimator following the PPPoE
header when calculating the MTU. Ooops...

Thanks to Mario Kemper for noting this.

branches: 1.3.2;
Protect interface queue manipulations by splnet(). Splsoftnet() is not
enough.

change the meaning of ifnet.if_lastchange to meet RFC1573 ifLastChange.
follows BSD/OS practice and ucd-snmp code (FreeBSD does it for specific
interfaces only).

was: if_lastchange get updated on every packet transmission/receipt.
now: if_lastchange get updated when IFF_UP is changed.

Add an in-kernel PPPoE (ppp over ethernet, RFC 2516) implementation,
based on the existing net/if_spppsubr.c stuff.

While there are completely userland (bpf based) implementations available,
those have a vastly larger per packet overhead thus causing major CPU
overhead and higher latency. On an i386 base router, running a 486DX at 50MHz
my line (768kBit/s downstream) was limited to something (varying) between 10
and 20 kByte/s effective download rate. With this implementation I get full
bandwidth (~85kByte/s).

This is client side only. Arguably the right way to add full PPPoE support
(including server side) would be a variation of the ppp line discipline and
appropriate modifications to pppd. I promise every help I can give to anyone
doing that - but I needed this realy fast. Besids, on low memory NAT boxes
with typically a single PPPoE connection, this implementation is more
lightweight than a pppd based one, which nicely fits my needs.

s/controll/control/ in comments.

Zeroize the length explicitly when malloc failed. Pointed out by yamaguchi@n.o.

Do not allocate mbuf clusters when the caller (eroneously) asks
for more than MCLBYTES size, instead fail the allocation.

When we have received multiple PADO offer packets in the discovery
phase, do not combine tags from different packets. We are supposed
to pick one PADO packet and continue session establishment with that.

The second bug could cause code to trigger the first and create
invalid response packets and also overwrite data outside of
the allocated mbuf cluster.

Fixes CVE-2022-29867.

Make pktq_rps_hash() pluggable for each interface type. Reviewed by gdt@n.o, thorpej@n.o, and riastradh@n.o, thanks.

if_attach and if_initialize cannot fail, don't test return value

These were originally made failable back in 2017 when if_initialize
allocated a softint in every interface for link state changes, so
that it could fail gracefully instead of panicking:

https://mail-index.NetBSD.org/source-changes/2017/10/23/msg089053.html

However, this spawned many seldom- or never-tested error branches,
which are risky to have around. And that softint in every interface
has since been replaced by a single global workqueue, because link
state changes require thread context but not low latency or high
throughput:

https://mail-index.NetBSD.org/source-changes/2020/02/06/msg113759.html

So there is no longer any reason for if_initialize to fail. (The
subroutine if_stats_init can't fail because percpu_alloc can't fail
either.)

There is a snag: the softint_establish in if_percpuq_create could
fail, potentially leading to bad consequences later on trying to use
the softint. This change doesn't introduce any new bugs because of
the snag -- if_percpuq_attach was already broken. However, the snag
can be better addressed without spawning error branches, either by
using a single softint or making softints less scarce.

(Separate commit will change the signatures of if_attach and
if_initialize to return void, scheduled to ride whatever is the next
convenient kernel bump.)

Patch and testing on amd64 and evbmips64-eb by maya@; commit message
soliloquy, and compile-testing on evbppc/i386/earmv7hf, by me.

Added a kernel option to change the number of processing packets
at one pppoeintr()

Added a limitation of the number of processing packets
because a enqueuing process can not add packets over IFQ_MAXLEN

and removed reschedule at pppoeintr()
because it also scheduled at enqueuing process.

Added missing PPPOE_UNLOCK() on dropping PADS and PADT

Drop PADS and PADT from unknown host for safety

Change reconnect delay after PADT received (15 sec -> 5 sec)

5 sec is the same as minimum PADI resending interval

Accept a frame like a PADT just containing PPPoE header

branches: 1.170.2; 1.170.4;
Added missing free of sc_hunique to prevent memory leak
when using PPPoE server

Stop and destroy timeout after sppp_detach and if_detach
for safety

The functions may use resources of pppoe(4) while detaching,
so the release should move after it.

Remove unnecessaly lock holdings to avoid dead lock

The locks were held while callout_halt() and workqueue_wait()
without reason.
And the locks also were held at callout and workqueue handler
so that the handler kicked by those function couldn't acquire
the lock.

The reasons why those are unneccesary are:
- Items of callout_t are protected by callout_lock
- Items of struct workqueue and struct work are protected
by q_mutex in struct workqueue
- Items of struct sppp_work protected by atomic_cas(3)
- struct pppoe_softc does not free before workqueue_wait() and
callout_halt() even if the locks are not held

Stop ppp layer at first of destroying pppoe interface

Sort initialization sequence in pppoe_clone_create() out
for refactoring

It has no functionality impact

Use kmem_zalloc to allocate pppoe_softc

Move initialization of sc_lock in pppoe_softc to first

The lock may be held in callbacks for ppp layer or other
components so that it should be initialized early.

commonize error handling in pppoe_clone_create()

Reschedule softint to process packets enqueued to ppoediscinq
while doing pppoe_data_input

And added a empty check for ppoeinq, for safety

Added missing counter clear when a pppoe state changes to PADI_SENT

Added a NULL check for parent interface of pppoe

Hold the lock for pppoe while referencing sc_id
that is an item of struct pppoe_softc

branches: 1.158.2;
Fix to reconnect after PADT received

add a logging function used at debugging pppoe(4)

fix to remove trailing garbage

stop callout even when the state is in PPPOE_STATE_INITIAL

Close lcp when the lower layer down if the interface is passive or on-demand

reivewed by knakahara@n.o.

branches: 1.153.2;
Add a function to copy AC-Name and Service-Name

Clear AC-Name and Service-Name if params are not specified

Do pppoe_timeout() in thread context

OKed by knakahara@n.o
fix port-amd64/55661

Use callout_setfunc and callout_schedule

safely extract character sequences from packet for printing.

Adopt <net/if_stats.h>.

branches: 1.147.4; 1.147.6;
s/pakcet/packet/ in comment.

Remove printfs that are too easily reachable, switch to M_REGION_GET,
and simplify the initialization. No real functional change.

style

remove hardcoded bullshit, probably fixes PR/53644

Use a random hunique, instead of sending the pointer of the interface.
Tested via ATF.

Clarify two functions.

branches: 1.141.2;
Implement the BPF direction filter (BIOC[GS]DIRECTION). It provides backward
compatibility with BIOC[GS]SEESENT ioctl. The userland interface is the same
as FreeBSD.

This change also fixes a bug that the direction is misunderstand on some
environment by passing the direction to bpf_mtap*() instead of checking
m->m_pkthdr.rcvif.

Fix to aquire pppoe_softc_list_lock before read and write the list

ok by knakahara@n.o

Fix not to use PPPOE_UNLOCK before acccess to pppoe_softc
to avoid a race condition

According to the locking order of pppoe(4), the access to
pppoe_softc has to follow 5 steps as below.

1. aquire pppoe_softc_list_lock
2. aquire pppoe_softc lock
3. release pppoe_softc_list_lock
4. access to pppoe_softc
5. release pppoe_softc lock

However, pppoe_dispatch_disc_pkt() releases the lock of pppoe_softc
temporarily, and then re-aquires it before step 4 of the adove. So,
it is possible for other contexts to destroy a pppoe_softc in the
interim.
To fix this condition, avoid PPPOE_UNLOCK with the problem.

ok by knakahara@n.o

Ensure to call if_register after interface initializations finish

Drop early if there's no PPPoE interface. Otherwise it is easy for someone
to flood dmesg over the local subnet.

Fix sending PADT to unexpected hosts when net.pppoe.term_unknown is enabled.

net.pppoe.term_unknown can be written safely now.

branches: 1.134.2;
Use m_freem instead of m_free. Otherwise we're leaking the next mbufs in
the chain.

Remove wrong assertions

rw_lock_held() returns true when any context holds the lock. However, in
if_pppoe.c, the function was used wrongly as it returns true only if the lock is
held in the same context.

From s-yamaguchi@IIJ

Provide macros for softnet_lock and KERNEL_LOCK hiding NET_MPSAFE switch

It reduces C&P codes such as "#ifndef NET_MPSAFE KERNEL_LOCK(1, NULL); ..."
scattered all over the source code and makes it easy to identify remaining
KERNEL_LOCK and/or softnet_lock that are held even if NET_MPSAFE.

No functional change

Unify IFEF_*_MPSAFE into IFEF_MPSAFE

There are already two flags for if_output and if_start, however, it seems such
MPSAFE flags are eventually needed for all if_XXX operations. Having discrete
flags for each operation is wasteful of if_extflags bits. So let's unify
the flags into one: IFEF_MPSAFE.

Fortunately IFEF_*_MPSAFE flags have never been included in any releases, so
we can change them without breaking backward compatibility of the releases
(though the kernel version of -current should be bumped).

Note that if an interface have both MP-safe and non-MP-safe operations at a
time, we have to set the IFEF_MPSAFE flag and let callees of non-MP-safe
opeartions take the kernel lock.

Proposed on tech-kern@ and tech-net@