opnsense-src/sys
Marko Zec d461deeaa4 VNET: Revert "ifnet: make if_index global"
This reverts commit 91f44749c6.

Devirtualization of V_if_index and V_ifindex_table was rushed into
the tree lacking proper context, discussion, and declaration of intent,
so I'm backing it out as harmful to VNET on the following grounds:

1) The change repurposed the decades-old and stable if_index KBI for
new, unclear goals which were omitted from the commit note.

2) The change opened up a new resource exhaustion vector where any vnet
could starve the system of ifnet indices, including vnet0.

3) To circumvent the newly introduced problem of separating ifnets
belonging to different vnets from the globalized ifindex_table, the
author introduced sysctl_ifcount() which does a linear traversal over
the (potentially huge) global ifnet list just to return a simple upper
bound on existing ifnet indices.

4) The change effectively led to nonuniform ifnet index allocation
among vnets.

5) The commit note clearly stated that the patch changed the implicit
if_index ABI contract where ifnet indices were assumed to be starting
from one.  The commit note also included a correct observation that
holes in interface indices were always allowed, but failed to declare
that the userland-observable ifindex tables could now include huge
empty spans even under modest operating conditions.

6) The author had an earlier proposal in the works which did not
affect per-vnet ifnet lists (D33265) but which he abandoned without
providing the rationale behind his decision to do so, at the expense
of sacrificing the vnet isolation contract and if_index ABI / KBI.

Furthermore, the author agreed to back out his changes himself and
to follow up with a proposal for a less intrusive alternative, but
later silently declined to act.  Therefore, I decided to resolve the
status-quo by backing this out myself.  This in no way precludes a
future proposal aiming to mitigate ifnet-removal related system
crashes or panics to be accepted, provided it would not unnecessarily
compromise the goal of as strict as possible isolation between vnets.

Obtained from: github.com/glebius/FreeBSD/commits/backout-ifindex
2022-05-03 19:27:57 +02:00
..
amd64 Remove dead code. 2022-04-26 19:40:59 +03:00
arm busdma_bounce: Add free_bounce_pages helper function. 2022-04-21 10:42:14 -07:00
arm64 Map the ACPI tables into the DMAP 2022-04-29 13:11:02 +01:00
bsm
cam cam: Remove redunant static __inline forward decls 2022-05-02 09:30:07 -06:00
cddl zfs: merge openzfs/zfs@a86e08941 (master) into main 2022-03-08 18:53:02 +01:00
compat LinuxKPI: 802.11: fill in two more TODOs 2022-04-30 08:00:04 +00:00
conf FB_INSTALL_CDEV: Remove this option and related code. 2022-04-21 10:29:14 -07:00
contrib rtw88: deal with debug messages 2022-04-27 15:20:34 +00:00
crypto ccp: Use devclass_find to lookup devclass in db_show_ccp. 2022-04-21 10:29:14 -07:00
ddb
dev xhci(4): Always add and evaluate the slot context. 2022-05-03 18:13:53 +02:00
dts
fs nfscl: Acquire a refcount on "cred" for mirrored pNFS RPCs 2022-05-03 07:22:15 -07:00
gdb
geom geom_dev: extend kevent support for geom dev 2022-04-28 08:40:13 -08:00
gnu
i386 Remove dead code. 2022-04-26 19:40:59 +03:00
isa vgapm: Use devclass_find to lookup the vga devclass in suspend and resume. 2022-04-21 10:29:15 -07:00
kern Revert "mbuf: do not restore dying interfaces" 2022-05-03 19:11:40 +02:00
kgssapi kgssapi krb5: Remove unused variables. 2022-04-06 16:45:29 -07:00
libkern libkern: Fix two typos in source code comments 2022-04-09 09:36:34 +02:00
modules linux(4): Add a simple rseq syscall implementation. 2022-04-26 19:35:56 +03:00
net VNET: Revert "ifnet: make if_index global" 2022-05-03 19:27:57 +02:00
net80211 net80211: Fix traffic hang on STA/AP VAPs on a multi-VAP interface 2022-04-21 22:49:01 -07:00
netgraph ng_pppoe: introduce new sysctl net.graph.pppoe.lcp_pcp 2022-05-02 21:57:12 +07:00
netinet sctp: improve locking 2022-04-27 16:07:31 +02:00
netinet6 udp6: allow udp_tun_func_t() to indicate it did not eat the packet 2022-04-22 16:55:23 +02:00
netipsec ipsec_encap: setdf is only used for INET. 2022-04-13 16:08:21 -07:00
netpfil Revert "dummynet: use m_rcvif_serialize/restore when queueing packets" 2022-05-03 19:11:40 +02:00
netsmb smb_smb_treedisconnect: eliminate write only variable mbp 2022-04-04 22:30:57 -06:00
nfs nfs: do not panic on bootpc_init when no interfaces are found 2022-04-07 19:33:26 -03:00
nfsclient
nfsserver
nlm
ofed ibcore: Allow passing NULL-pointers to ib_umem_release() 2022-05-02 13:11:06 +02:00
opencrypto KTLS: Add a new recrypt operation to the software backend. 2022-04-22 15:52:50 -07:00
powerpc powerpc: enable wlan and ath modules in GENERIC64* 2022-04-28 11:42:39 +02:00
riscv busdma_bounce: Add free_bounce_pages helper function. 2022-04-21 10:42:14 -07:00
rpc svc_vc_rendezvous_stat: eliminiate write only variable stat 2022-04-04 22:31:04 -06:00
security mac_pimd: Support for privilege drop in pimd 2022-04-20 08:07:37 +02:00
sys Revert "mbuf: do not restore dying interfaces" 2022-05-03 19:11:40 +02:00
teken teken: color #3 is yellow not brown - use TC_YELLOW as the name 2022-03-12 09:17:29 -05:00
tests
tools syscallarg_t: Add a type for system call arguments 2022-03-28 19:43:03 +01:00
ufs ffs: plug a set-but-not-used var 2022-04-19 16:51:12 +02:00
vm vm_phys: avoid waste in multipage allocation 2022-04-26 02:56:23 -05:00
x86 Remove dead code. 2022-04-26 19:40:59 +03:00
xdr
xen xen: Use __diagused for a variable only used in KASSERT(). 2022-04-13 16:08:20 -07:00
Makefile