PPPoE client, DHCPv6 via netd, misc. fixes

.github/workflows/coverity.yml

@@ -11,6 +11,7 @@ env:
   LIBYANG_VERSION: 4.2.2
   SYSREPO_VERSION: 4.2.10
   SYSKLOGD_VERSION: 2.7.2
+  WATCHDOGD_VERSION: '4.0'
 
 jobs:
   coverity:
@@ -58,7 +59,7 @@ jobs:
           sudo apt-get -y update
           sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                        libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev libavahi-client-dev
+                       libuev-dev libavahi-client-dev libconfuse-dev
 
       - name: Build dependencies
         run: |
@@ -82,6 +83,10 @@ jobs:
           git clone -b v${SYSKLOGD_VERSION} --depth 1 https://github.com/troglobit/sysklogd.git
           (cd sysklogd && ./autogen.sh && ./configure --without-logger --without-systemd \
                        && make && sudo make install)
+
+          git clone -b ${WATCHDOGD_VERSION} --depth 1 https://github.com/troglobit/watchdogd.git
+          (cd watchdogd && ./autogen.sh && ./configure --without-systemd \
+                       && make && sudo make install)
           make dep
 
       - name: Build applications for Coverity

README.md

@@ -1,6 +1,6 @@
 [![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Discord][discord-badge]][discord-url]
 
-<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=380 padding=10>
+<img align="right" src="doc/logo.png" alt="Jacky, a penguin living in an RJ45 jack, next to the Infix logo: Immutable. Friendly. Secure." width=380 padding=10>
 
 Infix turns an ARM or x86 device into a managed network appliance.  The
 same OS runs on a $35 Raspberry Pi and on enterprise switching hardware,

board/aarch64/linux_defconfig

@@ -397,6 +397,8 @@ CONFIG_MDIO_BITBANG=y
 CONFIG_MDIO_MVUSB=m
 CONFIG_MDIO_MSCC_MIIM=y
 CONFIG_MDIO_BUS_MUX_MMIOREG=y
+CONFIG_PPP=m
+CONFIG_PPPOE=m
 CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=m
 CONFIG_USB_LAN78XX=m

board/arm/linux_defconfig

@@ -299,6 +299,8 @@ CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
+CONFIG_PPP=m
+CONFIG_PPPOE=m
 CONFIG_USB_USBNET=y
 CONFIG_INPUT_EVDEV=y
 # CONFIG_LEGACY_PTYS is not set

board/common/rootfs/usr/libexec/odhcp6c.sh

@@ -8,6 +8,8 @@ interface="$1"
 state="$2"
 RESOLV_CONF="/run/resolvconf/interfaces/${interface}-ipv6.conf"
 NTPFILE="/run/chrony/dhcp-sources.d/${interface}-ipv6.sources"
+NAME="/etc/net.d/${interface}-dhcpv6.conf"
+NEXT="/run/odhcp6c-${interface}.conf"   # outside of netd's watched dir
 
 [ -n "$metric" ] || metric=5
 
@@ -28,10 +30,64 @@ err()
 
 teardown_interface()
 {
-	ip -6 route flush dev "$interface"
 	ip -6 address flush dev "$interface" scope global
 }
 
+# Routes go to netd, like DHCPv4 routes, so they are static routes with
+# the configured route preference ($metric) as distance.  The kernel
+# metric from the RA is not used.
+#
+#    add_route PREFIX NEXTHOP [INTERFACE] [SOURCE]
+add_route()
+{
+	{
+		echo "route {"
+		echo "    prefix = \"$1\""
+		echo "    nexthop = \"$2\""
+		[ -n "$3" ] && echo "    interface = \"$3\""
+		[ -n "$4" ] && echo "    source = \"$4\""
+		echo "    distance = $metric"
+		echo "    tag = 100"
+		echo "}"
+	} >> "$NEXT"
+}
+
+set_routes()
+{
+	echo "# Generated by odhcp6c" > "$NEXT"
+
+	# $RA_ROUTES format: "prefix/len,gateway,valid,metric ..."
+	for entry in $RA_ROUTES; do
+		addr="${entry%%,*}"
+		entry="${entry#*,}"
+		gw="${entry%%,*}"
+
+		if [ -z "$gw" ]; then
+			add_route "$addr" "$interface"
+			continue
+		fi
+
+		add_route "$addr" "$gw" "$interface"
+
+		# Same route for traffic sourced from each delegated prefix
+		for prefix in $PREFIXES; do
+			add_route "$addr" "$gw" "$interface" "${prefix%%,*}"
+		done
+	done
+
+	# Unreachable route for delegated prefixes, prevents routing loops
+	for entry in $PREFIXES; do
+		add_route "${entry%%,*}" reject
+	done
+
+	# Only touch netd's config when the routes changed
+	if cmp -s "$NAME" "$NEXT"; then
+		rm -f "$NEXT"
+	else
+		mv "$NEXT" "$NAME"
+	fi
+}
+
 setup_interface()
 {
 	# Merge RA addresses with DHCP addresses
@@ -57,28 +113,7 @@ setup_interface()
 		log "assigned address $addr (preferred=$preferred, valid=$valid)"
 	done
 
-	# Add routes from RA
-	for entry in $RA_ROUTES; do
-		addr="${entry%%,*}"
-		entry="${entry#*,}"
-		gw="${entry%%,*}"
-		entry="${entry#*,}"
-		valid="${entry%%,*}"
-		entry="${entry#*,}"
-		metric="${entry%%,*}"
-
-		if [ -n "$gw" ]; then
-			ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "::/128"
-		else
-			ip -6 route add "$addr" metric "$metric" dev "$interface"
-		fi
-
-		# Add routes for delegated prefixes
-		for prefix in $PREFIXES; do
-			paddr="${prefix%%,*}"
-			[ -n "$gw" ] && ip -6 route add "$addr" via "$gw" metric "$metric" dev "$interface" from "$paddr"
-		done
-	done
+	set_routes
 }
 
 handle_prefixes()
@@ -93,9 +128,6 @@ handle_prefixes()
 
 		log "received delegated prefix $addr (preferred=$preferred, valid=$valid)"
 
-		# Add unreachable route to prevent routing loops
-		ip -6 route add unreachable "$addr" 2>/dev/null
-
 		# Future: Distribute to downstream interfaces
 	done
 }
@@ -199,7 +231,13 @@ log "state: $state"
 	flock 9
 	case "$state" in
 		started)
-			# Initial state - clean up any stale config
+			# Initial state - clean up any stale config.  Our
+			# routes go through netd with the configured route
+			# preference, so the kernel must not add its own
+			# default route from router advertisements as well.
+			rm -f "$NAME"
+			sysctl -w "net.ipv6.conf.$interface.accept_ra_defrtr=0" >/dev/null
+			ip -6 route flush dev "$interface" proto ra
 			teardown_interface
 			;;
 
@@ -222,6 +260,7 @@ log "state: $state"
 
 		unbound|stopped)
 			# Lost server or client stopped
+			rm -f "$NAME"
 			teardown_interface
 			rm -f "$RESOLV_CONF"
 			rm -f "$NTPFILE"

board/riscv64/linux_defconfig

@@ -278,6 +278,8 @@ CONFIG_DWMAC_DWC_QOS_ETH=y
 CONFIG_DWMAC_STARFIVE=y
 CONFIG_MICROCHIP_PHY=y
 CONFIG_MOTORCOMM_PHY=y
+CONFIG_PPP=m
+CONFIG_PPPOE=m
 CONFIG_USB_RTL8150=m
 CONFIG_USB_RTL8152=m
 CONFIG_USB_LAN78XX=m

board/x86_64/linux_defconfig

@@ -275,6 +275,8 @@ CONFIG_E1000=y
 CONFIG_NE2K_PCI=y
 CONFIG_8139CP=y
 CONFIG_ROCKER=y
+CONFIG_PPP=m
+CONFIG_PPPOE=m
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 CONFIG_SERIAL_8250=y

configs/aarch64_defconfig

@@ -92,6 +92,7 @@ BR2_PACKAGE_NMAP_NPING=y
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_PPPD=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y

configs/aarch64_minimal_defconfig

@@ -77,6 +77,7 @@ BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_PPPD=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y

configs/arm_defconfig

@@ -93,6 +93,7 @@ BR2_PACKAGE_NMAP_NPING=y
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_PPPD=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y

configs/arm_minimal_defconfig

@@ -80,6 +80,7 @@ BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_PPPD=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y

configs/riscv64_defconfig

@@ -102,6 +102,7 @@ BR2_PACKAGE_NMAP_NPING=y
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_PPPD=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y

configs/x86_64_defconfig

@@ -91,6 +91,7 @@ BR2_PACKAGE_NMAP_NPING=y
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_PPPD=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y

configs/x86_64_minimal_defconfig

@@ -76,6 +76,7 @@ BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
+BR2_PACKAGE_PPPD=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y

doc/ChangeLog.md

@@ -33,6 +33,11 @@ All notable changes to the project are documented in this file.
   identify the chassis, by default for 60 seconds.  Available from the
   CLI, `locate`, and the Hardware page in the web interface.  Not allowed
   for guest users
+- Add PPPoE client, issue #1569.  A PPPoE session is an interface of type
+  `pppoe` on top of the interface facing the provider, with the password in
+  the keystore.  Its default route and DNS servers are used like those from
+  a DHCP server, and the TCP MSS of forwarded connections is clamped to the
+  session MTU, see [PPPoE Client][pppoe]
 
 ### Fixes
 
@@ -51,6 +56,11 @@ All notable changes to the project are documented in this file.
   off after boot
 - Fix missing hardware status when a sensor label has characters not
   allowed in a sensor name, e.g., "SoC temperature" on the Allwinner A20
+- Fix #1423: the default route from a DHCPv6 client, learned from router
+  advertisements, is now a static route with the DHCPv6 route preference,
+  like a DHCPv4 route.  Before, the route preference setting was ignored
+
+[pppoe]: https://www.kernelkit.org/infix/latest/pppoe/
 
 [v26.09.0][] - 2026-09-30
 -------------------------

doc/iface.md

@@ -41,6 +41,7 @@ Available types can be listed from the CLI:
   lag        IEEE link aggregate interface.
   loopback   Linux loopback interface.
   other      Other interface, i.e., unknown.
+  pppoe      PPP over Ethernet (PPPoE) client session.
   veth       Linux virtual Ethernet pair.
   vlan       Layer 2 Virtual LAN using 802.1Q.
   vxlan      Virtual eXtensible LAN tunnel interface.

doc/keystore.md

@@ -31,7 +31,7 @@ managed via CLI, NETCONF, or RESTCONF.
 
 | **Symmetric Key Format**        | **Use Case**                          |
 |-----------------------------|-----------------------------------|
-| `passphrase-key-format`     | Human-readable passphrases (WiFi) |
+| `passphrase-key-format`     | Human-readable passphrases (WiFi, PPPoE) |
 | `octet-string-key-format`   | Raw symmetric keys (WireGuard)    |
 
 ## Asymmetric Keys

doc/networking.md

@@ -53,6 +53,7 @@ other traffic would be bridged as usual.
 | [eth](ethernet.md#physical-ethernet-interfaces) | ieee802-ethernet-interface | Physical Ethernet device/port |
 |                         | infix-ethernet-interface   |                                                     |
 | [veth](ethernet.md#veth-pairs) | infix-if-veth       | Virtual Ethernet pair, typically one end is in a container |
+| [pppoe](pppoe.md)       | infix-if-ppp               | PPPoE client session on an Ethernet or VLAN interface |
 | [*common*](iface.md)    | ietf-interfaces,           | Properties common to all interface types            |
 |                         | infix-interfaces           |                                                     |