xref: /netbsd-src/sys/net/if_tun.c (revision 220b5c059a84c51ea44107ea8951a57ffaecdc8c)
1 /*	$NetBSD: if_tun.c,v 1.49 2001/11/13 00:49:36 lukem Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5  * Nottingham University 1987.
6  *
7  * This source may be freely distributed, however I would be interested
8  * in any changes that are made.
9  *
10  * This driver takes packets off the IP i/f and hands them up to a
11  * user process to have its wicked way with. This driver has its
12  * roots in a similar driver written by Phil Cockcroft (formerly) at
13  * UCL. This driver is based much more on read/write/poll mode of
14  * operation though.
15  */
16 
17 #include <sys/cdefs.h>
18 __KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.49 2001/11/13 00:49:36 lukem Exp $");
19 
20 #include "tun.h"
21 
22 #include "opt_inet.h"
23 #include "opt_ns.h"
24 
25 #include <sys/param.h>
26 #include <sys/proc.h>
27 #include <sys/systm.h>
28 #include <sys/mbuf.h>
29 #include <sys/buf.h>
30 #include <sys/protosw.h>
31 #include <sys/socket.h>
32 #include <sys/ioctl.h>
33 #include <sys/errno.h>
34 #include <sys/syslog.h>
35 #include <sys/select.h>
36 #include <sys/poll.h>
37 #include <sys/file.h>
38 #include <sys/signalvar.h>
39 #include <sys/conf.h>
40 
41 #include <machine/cpu.h>
42 
43 #include <net/if.h>
44 #include <net/if_ether.h>
45 #include <net/netisr.h>
46 #include <net/route.h>
47 
48 
49 #ifdef INET
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/ip.h>
54 #include <netinet/if_inarp.h>
55 #endif
56 
57 #ifdef NS
58 #include <netns/ns.h>
59 #include <netns/ns_if.h>
60 #endif
61 
62 #include "bpfilter.h"
63 #if NBPFILTER > 0
64 #include <sys/time.h>
65 #include <net/bpf.h>
66 #endif
67 
68 #include <net/if_tun.h>
69 
70 #define TUNDEBUG	if (tundebug) printf
71 int	tundebug = 0;
72 
73 extern int ifqmaxlen;
74 void	tunattach __P((int));
75 LIST_HEAD(, tun_softc) tun_softc_list;
76 static struct simplelock tun_softc_lock;
77 
78 int	tun_ioctl __P((struct ifnet *, u_long, caddr_t));
79 int	tun_output __P((struct ifnet *, struct mbuf *, struct sockaddr *,
80 		       struct rtentry *rt));
81 int	tun_clone_create __P((struct if_clone *, int));
82 void	tun_clone_destroy __P((struct ifnet *));
83 
84 struct if_clone tun_cloner =
85     IF_CLONE_INITIALIZER("tun", tun_clone_create, tun_clone_destroy);
86 
87 static void tunattach0 __P((struct tun_softc *));
88 static void tuninit __P((struct tun_softc *));
89 static struct tun_softc *tun_find_unit __P((dev_t));
90 
91 void
92 tunattach(unused)
93 	int unused;
94 {
95 
96 	simple_lock_init(&tun_softc_lock);
97 	LIST_INIT(&tun_softc_list);
98 	if_clone_attach(&tun_cloner);
99 }
100 
101 int
102 tun_clone_create(ifc, unit)
103 	struct if_clone *ifc;
104 	int unit;
105 {
106 	struct tun_softc *sc;
107 
108 	sc = malloc(sizeof(struct tun_softc), M_DEVBUF, M_WAITOK);
109 	(void)memset(sc, 0, sizeof(struct tun_softc));
110 
111 	(void)snprintf(sc->tun_if.if_xname, sizeof(sc->tun_if.if_xname),
112 	    "%s%d", ifc->ifc_name, unit);
113 	sc->tun_unit = unit;
114 	simple_lock_init(&sc->tun_lock);
115 
116 	tunattach0(sc);
117 
118 	simple_lock(&tun_softc_lock);
119 	LIST_INSERT_HEAD(&tun_softc_list, sc, tun_list);
120 	simple_unlock(&tun_softc_lock);
121 
122 	return (0);
123 }
124 
125 void
126 tunattach0(sc)
127 	struct tun_softc *sc;
128 {
129 	struct ifnet *ifp = (void *)sc;
130 
131 	sc->tun_flags = TUN_INITED;
132 
133 	ifp = &sc->tun_if;
134 	ifp->if_softc = sc;
135 	ifp->if_mtu = TUNMTU;
136 	ifp->if_ioctl = tun_ioctl;
137 	ifp->if_output = tun_output;
138 	ifp->if_flags = IFF_POINTOPOINT;
139 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
140 	ifp->if_collisions = 0;
141 	ifp->if_ierrors = 0;
142 	ifp->if_oerrors = 0;
143 	ifp->if_ipackets = 0;
144 	ifp->if_opackets = 0;
145 	ifp->if_dlt = DLT_NULL;
146 	if_attach(ifp);
147 	if_alloc_sadl(ifp);
148 #if NBPFILTER > 0
149 	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
150 #endif
151 }
152 
153 void
154 tun_clone_destroy(ifp)
155 	struct ifnet *ifp;
156 {
157 	struct tun_softc *tp = (void *)ifp;
158 	struct proc *p;
159 
160 	simple_lock(&tun_softc_lock);
161 	simple_lock(&tp->tun_lock);
162 	LIST_REMOVE(tp, tun_list);
163 	simple_unlock(&tp->tun_lock);
164 	simple_unlock(&tun_softc_lock);
165 
166 	if (tp->tun_flags & TUN_RWAIT) {
167 		tp->tun_flags &= ~TUN_RWAIT;
168 		wakeup((caddr_t)tp);
169 	}
170 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
171 		if (tp->tun_pgrp > 0)
172 			gsignal(tp->tun_pgrp, SIGIO);
173 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
174 			psignal(p, SIGIO);
175 	}
176 	selwakeup(&tp->tun_rsel);
177 
178 #if NBPFILTER > 0
179 	bpfdetach(ifp);
180 #endif
181 	if_detach(ifp);
182 
183 	free(tp, M_DEVBUF);
184 }
185 
186 static struct tun_softc *
187 tun_find_unit(dev)
188 	dev_t dev;
189 {
190 	struct tun_softc *tp;
191 	int unit = minor(dev);
192 
193 	simple_lock(&tun_softc_lock);
194 	LIST_FOREACH(tp, &tun_softc_list, tun_list)
195 		if (unit == tp->tun_unit)
196 			break;
197 	if (tp)
198 		simple_lock(&tp->tun_lock);
199 	simple_unlock(&tun_softc_lock);
200 
201 	return (tp);
202 }
203 
204 /*
205  * tunnel open - must be superuser & the device must be
206  * configured in
207  */
208 int
209 tunopen(dev, flag, mode, p)
210 	dev_t	dev;
211 	int	flag, mode;
212 	struct proc *p;
213 {
214 	struct ifnet	*ifp;
215 	struct tun_softc *tp;
216 	int	error;
217 
218 	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
219 		return (error);
220 
221 	if (NTUN < 1)
222 		return (ENXIO);
223 
224 	tp = tun_find_unit(dev);
225 
226 	if (!tp)
227 		return (ENXIO);
228 
229 	if (tp->tun_flags & TUN_OPEN) {
230 		simple_unlock(&tp->tun_lock);
231 		return (EBUSY);
232 	}
233 
234 	ifp = &tp->tun_if;
235 	tp->tun_flags |= TUN_OPEN;
236 	TUNDEBUG("%s: open\n", ifp->if_xname);
237 	simple_unlock(&tp->tun_lock);
238 	return (0);
239 }
240 
241 /*
242  * tunclose - close the device - mark i/f down & delete
243  * routing info
244  */
245 int
246 tunclose(dev, flag, mode, p)
247 	dev_t	dev;
248 	int	flag;
249 	int	mode;
250 	struct proc *p;
251 {
252 	int	s;
253 	struct tun_softc *tp;
254 	struct ifnet	*ifp;
255 	struct mbuf	*m;
256 
257 	tp = tun_find_unit(dev);
258 
259 	/* interface was "destroyed" before the close */
260 	if (tp == NULL)
261 		return (0);
262 
263 	ifp = &tp->tun_if;
264 
265 	tp->tun_flags &= ~TUN_OPEN;
266 
267 	/*
268 	 * junk all pending output
269 	 */
270 	do {
271 		s = splnet();
272 		IF_DEQUEUE(&ifp->if_snd, m);
273 		splx(s);
274 		if (m)
275 			m_freem(m);
276 	} while (m);
277 
278 	if (ifp->if_flags & IFF_UP) {
279 		s = splnet();
280 		if_down(ifp);
281 		if (ifp->if_flags & IFF_RUNNING) {
282 			/* find internet addresses and delete routes */
283 			struct ifaddr *ifa;
284 			TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
285 #ifdef INET
286 				if (ifa->ifa_addr->sa_family == AF_INET) {
287 					rtinit(ifa, (int)RTM_DELETE,
288 					       tp->tun_flags & TUN_DSTADDR
289 							? RTF_HOST
290 							: 0);
291 				}
292 #endif
293 			}
294 		}
295 		splx(s);
296 	}
297 	tp->tun_pgrp = 0;
298 	selwakeup(&tp->tun_rsel);
299 
300 	TUNDEBUG ("%s: closed\n", ifp->if_xname);
301 	simple_unlock(&tp->tun_lock);
302 	return (0);
303 }
304 
305 static void
306 tuninit(tp)
307 	struct tun_softc *tp;
308 {
309 	struct ifnet	*ifp = &tp->tun_if;
310 	struct ifaddr	*ifa;
311 
312 	TUNDEBUG("%s: tuninit\n", ifp->if_xname);
313 
314 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
315 
316 	tp->tun_flags &= ~(TUN_IASET|TUN_DSTADDR);
317 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
318 #ifdef INET
319 		if (ifa->ifa_addr->sa_family == AF_INET) {
320 			struct sockaddr_in *sin;
321 
322 			sin = satosin(ifa->ifa_addr);
323 			if (sin && sin->sin_addr.s_addr)
324 				tp->tun_flags |= TUN_IASET;
325 
326 			if (ifp->if_flags & IFF_POINTOPOINT) {
327 				sin = satosin(ifa->ifa_dstaddr);
328 				if (sin && sin->sin_addr.s_addr)
329 					tp->tun_flags |= TUN_DSTADDR;
330 			}
331 		}
332 #endif
333 	}
334 
335 	return;
336 }
337 
338 /*
339  * Process an ioctl request.
340  */
341 int
342 tun_ioctl(ifp, cmd, data)
343 	struct ifnet *ifp;
344 	u_long cmd;
345 	caddr_t	data;
346 {
347 	int		error = 0, s;
348 	struct tun_softc *tp = (struct tun_softc *)(ifp->if_softc);
349 
350 	simple_lock(&tp->tun_lock);
351 
352 	s = splnet();
353 	switch(cmd) {
354 	case SIOCSIFADDR:
355 		tuninit((struct tun_softc *)(ifp->if_softc));
356 		TUNDEBUG("%s: address set\n", ifp->if_xname);
357 		break;
358 	case SIOCSIFDSTADDR:
359 		tuninit((struct tun_softc *)(ifp->if_softc));
360 		TUNDEBUG("%s: destination address set\n", ifp->if_xname);
361 		break;
362 	case SIOCSIFBRDADDR:
363 		TUNDEBUG("%s: broadcast address set\n", ifp->if_xname);
364 		break;
365 	case SIOCSIFMTU: {
366 		struct ifreq *ifr = (struct ifreq *) data;
367 		if (ifr->ifr_mtu > TUNMTU || ifr->ifr_mtu < 576) {
368 		    error = EINVAL;
369 		    break;
370 		}
371 		TUNDEBUG("%s: interface mtu set\n", ifp->if_xname);
372 		ifp->if_mtu = ifr->ifr_mtu;
373 		break;
374 	}
375 	case SIOCADDMULTI:
376 	case SIOCDELMULTI: {
377 		struct ifreq *ifr = (struct ifreq *) data;
378 		if (ifr == 0) {
379 	        	error = EAFNOSUPPORT;           /* XXX */
380 			break;
381 		}
382 		switch (ifr->ifr_addr.sa_family) {
383 
384 #ifdef INET
385 		case AF_INET:
386 			break;
387 #endif
388 
389 		default:
390 			error = EAFNOSUPPORT;
391 			break;
392 		}
393 		break;
394 	}
395 	case SIOCSIFFLAGS:
396 		break;
397 	default:
398 		error = EINVAL;
399 	}
400 	splx(s);
401 	simple_unlock(&tp->tun_lock);
402 	return (error);
403 }
404 
405 /*
406  * tun_output - queue packets from higher level ready to put out.
407  */
408 int
409 tun_output(ifp, m0, dst, rt)
410 	struct ifnet   *ifp;
411 	struct mbuf    *m0;
412 	struct sockaddr *dst;
413 	struct rtentry *rt;
414 {
415 	struct tun_softc *tp = ifp->if_softc;
416 	struct proc	*p;
417 #ifdef INET
418 	int		s;
419 #endif
420 
421 	simple_lock(&tp->tun_lock);
422 	TUNDEBUG ("%s: tun_output\n", ifp->if_xname);
423 
424 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
425 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname,
426 			  tp->tun_flags);
427 		m_freem (m0);
428 		simple_unlock(&tp->tun_lock);
429 		return (EHOSTDOWN);
430 	}
431 
432 #if NBPFILTER > 0
433 	if (ifp->if_bpf) {
434 		/*
435 		 * We need to prepend the address family as
436 		 * a four byte field.  Cons up a dummy header
437 		 * to pacify bpf.  This is safe because bpf
438 		 * will only read from the mbuf (i.e., it won't
439 		 * try to free it or keep a pointer to it).
440 		 */
441 		struct mbuf m;
442 		u_int32_t af = dst->sa_family;
443 
444 		m.m_next = m0;
445 		m.m_len = sizeof(af);
446 		m.m_data = (char *)&af;
447 
448 		bpf_mtap(ifp->if_bpf, &m);
449 	}
450 #endif
451 
452 	switch(dst->sa_family) {
453 #ifdef INET
454 	case AF_INET:
455 		if (tp->tun_flags & TUN_PREPADDR) {
456 			/* Simple link-layer header */
457 			M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
458 			if (m0 == NULL) {
459 				IF_DROP(&ifp->if_snd);
460 				simple_unlock(&tp->tun_lock);
461 				return (ENOBUFS);
462 			}
463 			bcopy(dst, mtod(m0, char *), dst->sa_len);
464 		}
465 		/* FALLTHROUGH */
466 	case AF_UNSPEC:
467 		s = splnet();
468 		if (IF_QFULL(&ifp->if_snd)) {
469 			IF_DROP(&ifp->if_snd);
470 			m_freem(m0);
471 			splx(s);
472 			ifp->if_collisions++;
473 			simple_unlock(&tp->tun_lock);
474 			return (ENOBUFS);
475 		}
476 		IF_ENQUEUE(&ifp->if_snd, m0);
477 		splx(s);
478 		ifp->if_opackets++;
479 		break;
480 #endif
481 	default:
482 		m_freem(m0);
483 		simple_unlock(&tp->tun_lock);
484 		return (EAFNOSUPPORT);
485 	}
486 
487 	if (tp->tun_flags & TUN_RWAIT) {
488 		tp->tun_flags &= ~TUN_RWAIT;
489 		wakeup((caddr_t)tp);
490 	}
491 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
492 		if (tp->tun_pgrp > 0)
493 			gsignal(tp->tun_pgrp, SIGIO);
494 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
495 			psignal(p, SIGIO);
496 	}
497 	selwakeup(&tp->tun_rsel);
498 	simple_unlock(&tp->tun_lock);
499 	return (0);
500 }
501 
502 /*
503  * the cdevsw interface is now pretty minimal.
504  */
505 int
506 tunioctl(dev, cmd, data, flag, p)
507 	dev_t		dev;
508 	u_long		cmd;
509 	caddr_t		data;
510 	int		flag;
511 	struct proc	*p;
512 {
513 	int		s;
514 	struct tun_softc *tp;
515 
516 	tp = tun_find_unit(dev);
517 
518 	/* interface was "destroyed" already */
519 	if (tp == NULL)
520 		return (ENXIO);
521 
522 	switch (cmd) {
523 	case TUNSDEBUG:
524 		tundebug = *(int *)data;
525 		break;
526 
527 	case TUNGDEBUG:
528 		*(int *)data = tundebug;
529 		break;
530 
531 	case TUNSIFMODE:
532 		switch (*(int *)data & (IFF_POINTOPOINT|IFF_BROADCAST)) {
533 		case IFF_POINTOPOINT:
534 		case IFF_BROADCAST:
535 			s = splnet();
536 			if (tp->tun_if.if_flags & IFF_UP) {
537 				splx(s);
538 				simple_unlock(&tp->tun_lock);
539 				return (EBUSY);
540 			}
541 			tp->tun_if.if_flags &=
542 				~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
543 			tp->tun_if.if_flags |= *(int *)data;
544 			splx(s);
545 			break;
546 		default:
547 			simple_unlock(&tp->tun_lock);
548 			return (EINVAL);
549 			break;
550 		}
551 		break;
552 
553 	case TUNSLMODE:
554 		if (*(int *)data)
555 			tp->tun_flags |= TUN_PREPADDR;
556 		else
557 			tp->tun_flags &= ~TUN_PREPADDR;
558 		break;
559 
560 	case FIONBIO:
561 		if (*(int *)data)
562 			tp->tun_flags |= TUN_NBIO;
563 		else
564 			tp->tun_flags &= ~TUN_NBIO;
565 		break;
566 
567 	case FIOASYNC:
568 		if (*(int *)data)
569 			tp->tun_flags |= TUN_ASYNC;
570 		else
571 			tp->tun_flags &= ~TUN_ASYNC;
572 		break;
573 
574 	case FIONREAD:
575 		s = splnet();
576 		if (tp->tun_if.if_snd.ifq_head)
577 			*(int *)data = tp->tun_if.if_snd.ifq_head->m_pkthdr.len;
578 		else
579 			*(int *)data = 0;
580 		splx(s);
581 		break;
582 
583 	case TIOCSPGRP:
584 		tp->tun_pgrp = *(int *)data;
585 		break;
586 
587 	case TIOCGPGRP:
588 		*(int *)data = tp->tun_pgrp;
589 		break;
590 
591 	default:
592 		simple_unlock(&tp->tun_lock);
593 		return (ENOTTY);
594 	}
595 	simple_unlock(&tp->tun_lock);
596 	return (0);
597 }
598 
599 /*
600  * The cdevsw read interface - reads a packet at a time, or at
601  * least as much of a packet as can be read.
602  */
603 int
604 tunread(dev, uio, ioflag)
605 	dev_t		dev;
606 	struct uio	*uio;
607 	int		ioflag;
608 {
609 	struct tun_softc *tp;
610 	struct ifnet	*ifp;
611 	struct mbuf	*m, *m0;
612 	int		error=0, len, s, index;
613 
614 	tp = tun_find_unit(dev);
615 
616 	/* interface was "destroyed" already */
617 	if (tp == NULL)
618 		return (ENXIO);
619 
620 	index = tp->tun_if.if_index;
621 	ifp = &tp->tun_if;
622 
623 	TUNDEBUG ("%s: read\n", ifp->if_xname);
624 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
625 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname, tp->tun_flags);
626 		simple_unlock(&tp->tun_lock);
627 		return EHOSTDOWN;
628 	}
629 
630 	tp->tun_flags &= ~TUN_RWAIT;
631 
632 	s = splnet();
633 	do {
634 		IF_DEQUEUE(&ifp->if_snd, m0);
635 		if (m0 == 0) {
636 			if (tp->tun_flags & TUN_NBIO) {
637 				splx(s);
638 				simple_unlock(&tp->tun_lock);
639 				return (EWOULDBLOCK);
640 			}
641 			tp->tun_flags |= TUN_RWAIT;
642 			simple_unlock(&tp->tun_lock);
643 			if (tsleep((caddr_t)tp, PZERO|PCATCH, "tunread", 0)) {
644 				splx(s);
645 				return (EINTR);
646 			} else {
647 				/*
648 				 * Maybe the interface was destroyed while
649 				 * we were sleeping, so let's ensure that
650 				 * we're looking at the same (valid) tun
651 				 * interface before looping.
652 				 */
653 				tp = tun_find_unit(dev);
654 				if (tp == NULL ||
655 				    tp->tun_if.if_index != index) {
656 					splx(s);
657 					if (tp)
658 						simple_unlock(&tp->tun_lock);
659 					return (ENXIO);
660 				}
661 			}
662 		}
663 	} while (m0 == 0);
664 	splx(s);
665 
666 	while (m0 && uio->uio_resid > 0 && error == 0) {
667 		len = min(uio->uio_resid, m0->m_len);
668 		if (len != 0)
669 			error = uiomove(mtod(m0, caddr_t), len, uio);
670 		MFREE(m0, m);
671 		m0 = m;
672 	}
673 
674 	if (m0) {
675 		TUNDEBUG("Dropping mbuf\n");
676 		m_freem(m0);
677 	}
678 	if (error)
679 		ifp->if_ierrors++;
680 	simple_unlock(&tp->tun_lock);
681 	return (error);
682 }
683 
684 /*
685  * the cdevsw write interface - an atomic write is a packet - or else!
686  */
687 int
688 tunwrite(dev, uio, ioflag)
689 	dev_t		dev;
690 	struct uio	*uio;
691 	int		ioflag;
692 {
693 	struct tun_softc *tp;
694 	struct ifnet	*ifp;
695 	struct mbuf	*top, **mp, *m;
696 	struct ifqueue	*ifq;
697 	struct sockaddr	dst;
698 	int		isr, error=0, s, tlen, mlen;
699 
700 	tp = tun_find_unit(dev);
701 
702 	/* interface was "destroyed" already */
703 	if (tp == NULL)
704 		return (ENXIO);
705 
706 	ifp = &tp->tun_if;
707 
708 	TUNDEBUG("%s: tunwrite\n", ifp->if_xname);
709 
710 	if (tp->tun_flags & TUN_PREPADDR) {
711 		if (uio->uio_resid < sizeof(dst)) {
712 			simple_unlock(&tp->tun_lock);
713 			return (EIO);
714 		}
715 		error = uiomove((caddr_t)&dst, sizeof(dst), uio);
716 		if (dst.sa_len > sizeof(dst)) {
717 			/* Duh.. */
718 			char discard;
719 			int n = dst.sa_len - sizeof(dst);
720 			while (n--)
721 				if ((error = uiomove(&discard, 1, uio)) != 0) {
722 					simple_unlock(&tp->tun_lock);
723 					return (error);
724 				}
725 		}
726 	} else {
727 #ifdef INET
728 		dst.sa_family = AF_INET;
729 #endif
730 	}
731 
732 	if (uio->uio_resid < 0 || uio->uio_resid > TUNMTU) {
733 		TUNDEBUG("%s: len=%lu!\n", ifp->if_xname,
734 		    (unsigned long)uio->uio_resid);
735 		simple_unlock(&tp->tun_lock);
736 		return (EIO);
737 	}
738 
739 	switch (dst.sa_family) {
740 #ifdef INET
741 	case AF_INET:
742 		ifq = &ipintrq;
743 		isr = NETISR_IP;
744 		break;
745 #endif
746 	default:
747 		simple_unlock(&tp->tun_lock);
748 		return (EAFNOSUPPORT);
749 	}
750 
751 	tlen = uio->uio_resid;
752 
753 	/* get a header mbuf */
754 	MGETHDR(m, M_DONTWAIT, MT_DATA);
755 	if (m == NULL) {
756 		simple_unlock(&tp->tun_lock);
757 		return (ENOBUFS);
758 	}
759 	mlen = MHLEN;
760 
761 	top = 0;
762 	mp = &top;
763 	while (error == 0 && uio->uio_resid > 0) {
764 		m->m_len = min(mlen, uio->uio_resid);
765 		error = uiomove(mtod (m, caddr_t), m->m_len, uio);
766 		*mp = m;
767 		mp = &m->m_next;
768 		if (uio->uio_resid > 0) {
769 			MGET (m, M_DONTWAIT, MT_DATA);
770 			if (m == 0) {
771 				error = ENOBUFS;
772 				break;
773 			}
774 			mlen = MLEN;
775 		}
776 	}
777 	if (error) {
778 		if (top)
779 			m_freem (top);
780 		ifp->if_ierrors++;
781 		simple_unlock(&tp->tun_lock);
782 		return (error);
783 	}
784 
785 	top->m_pkthdr.len = tlen;
786 	top->m_pkthdr.rcvif = ifp;
787 
788 #if NBPFILTER > 0
789 	if (ifp->if_bpf) {
790 		/*
791 		 * We need to prepend the address family as
792 		 * a four byte field.  Cons up a dummy header
793 		 * to pacify bpf.  This is safe because bpf
794 		 * will only read from the mbuf (i.e., it won't
795 		 * try to free it or keep a pointer to it).
796 		 */
797 		struct mbuf m;
798 		u_int32_t af = AF_INET;
799 
800 		m.m_next = top;
801 		m.m_len = sizeof(af);
802 		m.m_data = (char *)&af;
803 
804 		bpf_mtap(ifp->if_bpf, &m);
805 	}
806 #endif
807 
808 	s = splnet();
809 	if (IF_QFULL(ifq)) {
810 		IF_DROP(ifq);
811 		splx(s);
812 		ifp->if_collisions++;
813 		m_freem(top);
814 		simple_unlock(&tp->tun_lock);
815 		return (ENOBUFS);
816 	}
817 	IF_ENQUEUE(ifq, top);
818 	splx(s);
819 	ifp->if_ipackets++;
820 	schednetisr(isr);
821 	simple_unlock(&tp->tun_lock);
822 	return (error);
823 }
824 
825 /*
826  * tunpoll - the poll interface, this is only useful on reads
827  * really. The write detect always returns true, write never blocks
828  * anyway, it either accepts the packet or drops it.
829  */
830 int
831 tunpoll(dev, events, p)
832 	dev_t		dev;
833 	int		events;
834 	struct proc	*p;
835 {
836 	struct tun_softc *tp;
837 	struct ifnet	*ifp;
838 	int		s, revents = 0;
839 
840 	tp = tun_find_unit(dev);
841 
842 	/* interface was "destroyed" already */
843 	if (tp == NULL)
844 		return (0);
845 
846 	ifp = &tp->tun_if;
847 
848 	s = splnet();
849 	TUNDEBUG("%s: tunpoll\n", ifp->if_xname);
850 
851 	if (events & (POLLIN | POLLRDNORM)) {
852 		if (ifp->if_snd.ifq_len > 0) {
853 			TUNDEBUG("%s: tunpoll q=%d\n", ifp->if_xname,
854 			    ifp->if_snd.ifq_len);
855 			revents |= events & (POLLIN | POLLRDNORM);
856 		} else {
857 			TUNDEBUG("%s: tunpoll waiting\n", ifp->if_xname);
858 			selrecord(p, &tp->tun_rsel);
859 		}
860 	}
861 
862 	if (events & (POLLOUT | POLLWRNORM))
863 		revents |= events & (POLLOUT | POLLWRNORM);
864 
865 	splx(s);
866 	simple_unlock(&tp->tun_lock);
867 	return (revents);
868 }
869