xref: /netbsd-src/sys/net/if_tun.c (revision 5e4c038a45edbc7d63b7c2daa76e29f88b64a4e3)
1 /*	$NetBSD: if_tun.c,v 1.51 2002/03/13 06:43:18 itojun Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5  * Nottingham University 1987.
6  *
7  * This source may be freely distributed, however I would be interested
8  * in any changes that are made.
9  *
10  * This driver takes packets off the IP i/f and hands them up to a
11  * user process to have its wicked way with. This driver has its
12  * roots in a similar driver written by Phil Cockcroft (formerly) at
13  * UCL. This driver is based much more on read/write/poll mode of
14  * operation though.
15  */
16 
17 #include <sys/cdefs.h>
18 __KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.51 2002/03/13 06:43:18 itojun Exp $");
19 
20 #include "tun.h"
21 
22 #include "opt_inet.h"
23 #include "opt_ns.h"
24 
25 #include <sys/param.h>
26 #include <sys/proc.h>
27 #include <sys/systm.h>
28 #include <sys/mbuf.h>
29 #include <sys/buf.h>
30 #include <sys/protosw.h>
31 #include <sys/socket.h>
32 #include <sys/ioctl.h>
33 #include <sys/errno.h>
34 #include <sys/syslog.h>
35 #include <sys/select.h>
36 #include <sys/poll.h>
37 #include <sys/file.h>
38 #include <sys/signalvar.h>
39 #include <sys/conf.h>
40 
41 #include <machine/cpu.h>
42 
43 #include <net/if.h>
44 #include <net/if_ether.h>
45 #include <net/netisr.h>
46 #include <net/route.h>
47 
48 
49 #ifdef INET
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/ip.h>
54 #include <netinet/if_inarp.h>
55 #endif
56 
57 #ifdef NS
58 #include <netns/ns.h>
59 #include <netns/ns_if.h>
60 #endif
61 
62 #include "bpfilter.h"
63 #if NBPFILTER > 0
64 #include <sys/time.h>
65 #include <net/bpf.h>
66 #endif
67 
68 #include <net/if_tun.h>
69 
70 #define TUNDEBUG	if (tundebug) printf
71 int	tundebug = 0;
72 
73 extern int ifqmaxlen;
74 void	tunattach __P((int));
75 LIST_HEAD(, tun_softc) tun_softc_list;
76 static struct simplelock tun_softc_lock;
77 
78 int	tun_ioctl __P((struct ifnet *, u_long, caddr_t));
79 int	tun_output __P((struct ifnet *, struct mbuf *, struct sockaddr *,
80 		       struct rtentry *rt));
81 int	tun_clone_create __P((struct if_clone *, int));
82 void	tun_clone_destroy __P((struct ifnet *));
83 
84 struct if_clone tun_cloner =
85     IF_CLONE_INITIALIZER("tun", tun_clone_create, tun_clone_destroy);
86 
87 static void tunattach0 __P((struct tun_softc *));
88 static void tuninit __P((struct tun_softc *));
89 #ifdef ALTQ
90 static void tunstart __P((struct ifnet *));
91 #endif
92 static struct tun_softc *tun_find_unit __P((dev_t));
93 
94 void
95 tunattach(unused)
96 	int unused;
97 {
98 
99 	simple_lock_init(&tun_softc_lock);
100 	LIST_INIT(&tun_softc_list);
101 	if_clone_attach(&tun_cloner);
102 }
103 
104 int
105 tun_clone_create(ifc, unit)
106 	struct if_clone *ifc;
107 	int unit;
108 {
109 	struct tun_softc *sc;
110 
111 	sc = malloc(sizeof(struct tun_softc), M_DEVBUF, M_WAITOK);
112 	(void)memset(sc, 0, sizeof(struct tun_softc));
113 
114 	(void)snprintf(sc->tun_if.if_xname, sizeof(sc->tun_if.if_xname),
115 	    "%s%d", ifc->ifc_name, unit);
116 	sc->tun_unit = unit;
117 	simple_lock_init(&sc->tun_lock);
118 
119 	tunattach0(sc);
120 
121 	simple_lock(&tun_softc_lock);
122 	LIST_INSERT_HEAD(&tun_softc_list, sc, tun_list);
123 	simple_unlock(&tun_softc_lock);
124 
125 	return (0);
126 }
127 
128 void
129 tunattach0(sc)
130 	struct tun_softc *sc;
131 {
132 	struct ifnet *ifp = (void *)sc;
133 
134 	sc->tun_flags = TUN_INITED;
135 
136 	ifp = &sc->tun_if;
137 	ifp->if_softc = sc;
138 	ifp->if_mtu = TUNMTU;
139 	ifp->if_ioctl = tun_ioctl;
140 	ifp->if_output = tun_output;
141 #ifdef ALTQ
142 	ifp->if_start = tunstart;
143 #endif
144 	ifp->if_flags = IFF_POINTOPOINT;
145 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
146 	ifp->if_collisions = 0;
147 	ifp->if_ierrors = 0;
148 	ifp->if_oerrors = 0;
149 	ifp->if_ipackets = 0;
150 	ifp->if_opackets = 0;
151 	ifp->if_dlt = DLT_NULL;
152 	IFQ_SET_READY(&ifp->if_snd);
153 	if_attach(ifp);
154 	if_alloc_sadl(ifp);
155 #if NBPFILTER > 0
156 	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
157 #endif
158 }
159 
160 void
161 tun_clone_destroy(ifp)
162 	struct ifnet *ifp;
163 {
164 	struct tun_softc *tp = (void *)ifp;
165 	struct proc *p;
166 
167 	simple_lock(&tun_softc_lock);
168 	simple_lock(&tp->tun_lock);
169 	LIST_REMOVE(tp, tun_list);
170 	simple_unlock(&tp->tun_lock);
171 	simple_unlock(&tun_softc_lock);
172 
173 	if (tp->tun_flags & TUN_RWAIT) {
174 		tp->tun_flags &= ~TUN_RWAIT;
175 		wakeup((caddr_t)tp);
176 	}
177 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
178 		if (tp->tun_pgrp > 0)
179 			gsignal(tp->tun_pgrp, SIGIO);
180 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
181 			psignal(p, SIGIO);
182 	}
183 	selwakeup(&tp->tun_rsel);
184 
185 #if NBPFILTER > 0
186 	bpfdetach(ifp);
187 #endif
188 	if_detach(ifp);
189 
190 	free(tp, M_DEVBUF);
191 }
192 
193 static struct tun_softc *
194 tun_find_unit(dev)
195 	dev_t dev;
196 {
197 	struct tun_softc *tp;
198 	int unit = minor(dev);
199 
200 	simple_lock(&tun_softc_lock);
201 	LIST_FOREACH(tp, &tun_softc_list, tun_list)
202 		if (unit == tp->tun_unit)
203 			break;
204 	if (tp)
205 		simple_lock(&tp->tun_lock);
206 	simple_unlock(&tun_softc_lock);
207 
208 	return (tp);
209 }
210 
211 /*
212  * tunnel open - must be superuser & the device must be
213  * configured in
214  */
215 int
216 tunopen(dev, flag, mode, p)
217 	dev_t	dev;
218 	int	flag, mode;
219 	struct proc *p;
220 {
221 	struct ifnet	*ifp;
222 	struct tun_softc *tp;
223 	int	error;
224 
225 	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
226 		return (error);
227 
228 	if (NTUN < 1)
229 		return (ENXIO);
230 
231 	tp = tun_find_unit(dev);
232 
233 	if (!tp)
234 		return (ENXIO);
235 
236 	if (tp->tun_flags & TUN_OPEN) {
237 		simple_unlock(&tp->tun_lock);
238 		return (EBUSY);
239 	}
240 
241 	ifp = &tp->tun_if;
242 	tp->tun_flags |= TUN_OPEN;
243 	TUNDEBUG("%s: open\n", ifp->if_xname);
244 	simple_unlock(&tp->tun_lock);
245 	return (0);
246 }
247 
248 /*
249  * tunclose - close the device - mark i/f down & delete
250  * routing info
251  */
252 int
253 tunclose(dev, flag, mode, p)
254 	dev_t	dev;
255 	int	flag;
256 	int	mode;
257 	struct proc *p;
258 {
259 	int	s;
260 	struct tun_softc *tp;
261 	struct ifnet	*ifp;
262 
263 	tp = tun_find_unit(dev);
264 
265 	/* interface was "destroyed" before the close */
266 	if (tp == NULL)
267 		return (0);
268 
269 	ifp = &tp->tun_if;
270 
271 	tp->tun_flags &= ~TUN_OPEN;
272 
273 	/*
274 	 * junk all pending output
275 	 */
276 	s = splnet();
277 	IFQ_PURGE(&ifp->if_snd);
278 	splx(s);
279 
280 	if (ifp->if_flags & IFF_UP) {
281 		s = splnet();
282 		if_down(ifp);
283 		if (ifp->if_flags & IFF_RUNNING) {
284 			/* find internet addresses and delete routes */
285 			struct ifaddr *ifa;
286 			TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
287 #ifdef INET
288 				if (ifa->ifa_addr->sa_family == AF_INET) {
289 					rtinit(ifa, (int)RTM_DELETE,
290 					       tp->tun_flags & TUN_DSTADDR
291 							? RTF_HOST
292 							: 0);
293 				}
294 #endif
295 			}
296 		}
297 		splx(s);
298 	}
299 	tp->tun_pgrp = 0;
300 	selwakeup(&tp->tun_rsel);
301 
302 	TUNDEBUG ("%s: closed\n", ifp->if_xname);
303 	simple_unlock(&tp->tun_lock);
304 	return (0);
305 }
306 
307 static void
308 tuninit(tp)
309 	struct tun_softc *tp;
310 {
311 	struct ifnet	*ifp = &tp->tun_if;
312 	struct ifaddr	*ifa;
313 
314 	TUNDEBUG("%s: tuninit\n", ifp->if_xname);
315 
316 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
317 
318 	tp->tun_flags &= ~(TUN_IASET|TUN_DSTADDR);
319 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
320 #ifdef INET
321 		if (ifa->ifa_addr->sa_family == AF_INET) {
322 			struct sockaddr_in *sin;
323 
324 			sin = satosin(ifa->ifa_addr);
325 			if (sin && sin->sin_addr.s_addr)
326 				tp->tun_flags |= TUN_IASET;
327 
328 			if (ifp->if_flags & IFF_POINTOPOINT) {
329 				sin = satosin(ifa->ifa_dstaddr);
330 				if (sin && sin->sin_addr.s_addr)
331 					tp->tun_flags |= TUN_DSTADDR;
332 			}
333 		}
334 #endif
335 	}
336 
337 	return;
338 }
339 
340 /*
341  * Process an ioctl request.
342  */
343 int
344 tun_ioctl(ifp, cmd, data)
345 	struct ifnet *ifp;
346 	u_long cmd;
347 	caddr_t	data;
348 {
349 	int		error = 0, s;
350 	struct tun_softc *tp = (struct tun_softc *)(ifp->if_softc);
351 
352 	simple_lock(&tp->tun_lock);
353 
354 	s = splnet();
355 	switch(cmd) {
356 	case SIOCSIFADDR:
357 		tuninit((struct tun_softc *)(ifp->if_softc));
358 		TUNDEBUG("%s: address set\n", ifp->if_xname);
359 		break;
360 	case SIOCSIFDSTADDR:
361 		tuninit((struct tun_softc *)(ifp->if_softc));
362 		TUNDEBUG("%s: destination address set\n", ifp->if_xname);
363 		break;
364 	case SIOCSIFBRDADDR:
365 		TUNDEBUG("%s: broadcast address set\n", ifp->if_xname);
366 		break;
367 	case SIOCSIFMTU: {
368 		struct ifreq *ifr = (struct ifreq *) data;
369 		if (ifr->ifr_mtu > TUNMTU || ifr->ifr_mtu < 576) {
370 		    error = EINVAL;
371 		    break;
372 		}
373 		TUNDEBUG("%s: interface mtu set\n", ifp->if_xname);
374 		ifp->if_mtu = ifr->ifr_mtu;
375 		break;
376 	}
377 	case SIOCADDMULTI:
378 	case SIOCDELMULTI: {
379 		struct ifreq *ifr = (struct ifreq *) data;
380 		if (ifr == 0) {
381 	        	error = EAFNOSUPPORT;           /* XXX */
382 			break;
383 		}
384 		switch (ifr->ifr_addr.sa_family) {
385 
386 #ifdef INET
387 		case AF_INET:
388 			break;
389 #endif
390 
391 		default:
392 			error = EAFNOSUPPORT;
393 			break;
394 		}
395 		break;
396 	}
397 	case SIOCSIFFLAGS:
398 		break;
399 	default:
400 		error = EINVAL;
401 	}
402 	splx(s);
403 	simple_unlock(&tp->tun_lock);
404 	return (error);
405 }
406 
407 /*
408  * tun_output - queue packets from higher level ready to put out.
409  */
410 int
411 tun_output(ifp, m0, dst, rt)
412 	struct ifnet   *ifp;
413 	struct mbuf    *m0;
414 	struct sockaddr *dst;
415 	struct rtentry *rt;
416 {
417 	struct tun_softc *tp = ifp->if_softc;
418 	struct proc	*p;
419 #ifdef INET
420 	int		s;
421 	int		error;
422 #endif
423 	ALTQ_DECL(struct altq_pktattr pktattr;)
424 
425 	simple_lock(&tp->tun_lock);
426 	TUNDEBUG ("%s: tun_output\n", ifp->if_xname);
427 
428 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
429 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname,
430 			  tp->tun_flags);
431 		m_freem (m0);
432 		simple_unlock(&tp->tun_lock);
433 		return (EHOSTDOWN);
434 	}
435 
436 	/*
437 	 * if the queueing discipline needs packet classification,
438 	 * do it before prepending link headers.
439 	 */
440 	IFQ_CLASSIFY(&ifp->if_snd, m0, dst->sa_family, &pktattr);
441 
442 #if NBPFILTER > 0
443 	if (ifp->if_bpf) {
444 		/*
445 		 * We need to prepend the address family as
446 		 * a four byte field.  Cons up a dummy header
447 		 * to pacify bpf.  This is safe because bpf
448 		 * will only read from the mbuf (i.e., it won't
449 		 * try to free it or keep a pointer to it).
450 		 */
451 		struct mbuf m;
452 		u_int32_t af = dst->sa_family;
453 
454 		m.m_next = m0;
455 		m.m_len = sizeof(af);
456 		m.m_data = (char *)&af;
457 
458 		bpf_mtap(ifp->if_bpf, &m);
459 	}
460 #endif
461 
462 	switch(dst->sa_family) {
463 #ifdef INET
464 	case AF_INET:
465 		if (tp->tun_flags & TUN_PREPADDR) {
466 			/* Simple link-layer header */
467 			M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
468 			if (m0 == NULL) {
469 				IF_DROP(&ifp->if_snd);
470 				simple_unlock(&tp->tun_lock);
471 				return (ENOBUFS);
472 			}
473 			bcopy(dst, mtod(m0, char *), dst->sa_len);
474 		}
475 		/* FALLTHROUGH */
476 	case AF_UNSPEC:
477 		s = splnet();
478 		IFQ_ENQUEUE(&ifp->if_snd, m0, &pktattr, error);
479 		if (error) {
480 			splx(s);
481 			ifp->if_collisions++;
482 			return (error);
483 		}
484 		splx(s);
485 		ifp->if_opackets++;
486 		break;
487 #endif
488 	default:
489 		m_freem(m0);
490 		simple_unlock(&tp->tun_lock);
491 		return (EAFNOSUPPORT);
492 	}
493 
494 	if (tp->tun_flags & TUN_RWAIT) {
495 		tp->tun_flags &= ~TUN_RWAIT;
496 		wakeup((caddr_t)tp);
497 	}
498 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
499 		if (tp->tun_pgrp > 0)
500 			gsignal(tp->tun_pgrp, SIGIO);
501 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
502 			psignal(p, SIGIO);
503 	}
504 	selwakeup(&tp->tun_rsel);
505 	simple_unlock(&tp->tun_lock);
506 	return (0);
507 }
508 
509 /*
510  * the cdevsw interface is now pretty minimal.
511  */
512 int
513 tunioctl(dev, cmd, data, flag, p)
514 	dev_t		dev;
515 	u_long		cmd;
516 	caddr_t		data;
517 	int		flag;
518 	struct proc	*p;
519 {
520 	int		s;
521 	struct tun_softc *tp;
522 
523 	tp = tun_find_unit(dev);
524 
525 	/* interface was "destroyed" already */
526 	if (tp == NULL)
527 		return (ENXIO);
528 
529 	switch (cmd) {
530 	case TUNSDEBUG:
531 		tundebug = *(int *)data;
532 		break;
533 
534 	case TUNGDEBUG:
535 		*(int *)data = tundebug;
536 		break;
537 
538 	case TUNSIFMODE:
539 		switch (*(int *)data & (IFF_POINTOPOINT|IFF_BROADCAST)) {
540 		case IFF_POINTOPOINT:
541 		case IFF_BROADCAST:
542 			s = splnet();
543 			if (tp->tun_if.if_flags & IFF_UP) {
544 				splx(s);
545 				simple_unlock(&tp->tun_lock);
546 				return (EBUSY);
547 			}
548 			tp->tun_if.if_flags &=
549 				~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
550 			tp->tun_if.if_flags |= *(int *)data;
551 			splx(s);
552 			break;
553 		default:
554 			simple_unlock(&tp->tun_lock);
555 			return (EINVAL);
556 			break;
557 		}
558 		break;
559 
560 	case TUNSLMODE:
561 		if (*(int *)data)
562 			tp->tun_flags |= TUN_PREPADDR;
563 		else
564 			tp->tun_flags &= ~TUN_PREPADDR;
565 		break;
566 
567 	case FIONBIO:
568 		if (*(int *)data)
569 			tp->tun_flags |= TUN_NBIO;
570 		else
571 			tp->tun_flags &= ~TUN_NBIO;
572 		break;
573 
574 	case FIOASYNC:
575 		if (*(int *)data)
576 			tp->tun_flags |= TUN_ASYNC;
577 		else
578 			tp->tun_flags &= ~TUN_ASYNC;
579 		break;
580 
581 	case FIONREAD:
582 		s = splnet();
583 		if (tp->tun_if.if_snd.ifq_head)
584 			*(int *)data = tp->tun_if.if_snd.ifq_head->m_pkthdr.len;
585 		else
586 			*(int *)data = 0;
587 		splx(s);
588 		break;
589 
590 	case TIOCSPGRP:
591 		tp->tun_pgrp = *(int *)data;
592 		break;
593 
594 	case TIOCGPGRP:
595 		*(int *)data = tp->tun_pgrp;
596 		break;
597 
598 	default:
599 		simple_unlock(&tp->tun_lock);
600 		return (ENOTTY);
601 	}
602 	simple_unlock(&tp->tun_lock);
603 	return (0);
604 }
605 
606 /*
607  * The cdevsw read interface - reads a packet at a time, or at
608  * least as much of a packet as can be read.
609  */
610 int
611 tunread(dev, uio, ioflag)
612 	dev_t		dev;
613 	struct uio	*uio;
614 	int		ioflag;
615 {
616 	struct tun_softc *tp;
617 	struct ifnet	*ifp;
618 	struct mbuf	*m, *m0;
619 	int		error=0, len, s, index;
620 
621 	tp = tun_find_unit(dev);
622 
623 	/* interface was "destroyed" already */
624 	if (tp == NULL)
625 		return (ENXIO);
626 
627 	index = tp->tun_if.if_index;
628 	ifp = &tp->tun_if;
629 
630 	TUNDEBUG ("%s: read\n", ifp->if_xname);
631 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
632 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname, tp->tun_flags);
633 		simple_unlock(&tp->tun_lock);
634 		return EHOSTDOWN;
635 	}
636 
637 	tp->tun_flags &= ~TUN_RWAIT;
638 
639 	s = splnet();
640 	do {
641 		IFQ_DEQUEUE(&ifp->if_snd, m0);
642 		if (m0 == 0) {
643 			if (tp->tun_flags & TUN_NBIO) {
644 				splx(s);
645 				simple_unlock(&tp->tun_lock);
646 				return (EWOULDBLOCK);
647 			}
648 			tp->tun_flags |= TUN_RWAIT;
649 			simple_unlock(&tp->tun_lock);
650 			if (tsleep((caddr_t)tp, PZERO|PCATCH, "tunread", 0)) {
651 				splx(s);
652 				return (EINTR);
653 			} else {
654 				/*
655 				 * Maybe the interface was destroyed while
656 				 * we were sleeping, so let's ensure that
657 				 * we're looking at the same (valid) tun
658 				 * interface before looping.
659 				 */
660 				tp = tun_find_unit(dev);
661 				if (tp == NULL ||
662 				    tp->tun_if.if_index != index) {
663 					splx(s);
664 					if (tp)
665 						simple_unlock(&tp->tun_lock);
666 					return (ENXIO);
667 				}
668 			}
669 		}
670 	} while (m0 == 0);
671 	splx(s);
672 
673 	while (m0 && uio->uio_resid > 0 && error == 0) {
674 		len = min(uio->uio_resid, m0->m_len);
675 		if (len != 0)
676 			error = uiomove(mtod(m0, caddr_t), len, uio);
677 		MFREE(m0, m);
678 		m0 = m;
679 	}
680 
681 	if (m0) {
682 		TUNDEBUG("Dropping mbuf\n");
683 		m_freem(m0);
684 	}
685 	if (error)
686 		ifp->if_ierrors++;
687 	simple_unlock(&tp->tun_lock);
688 	return (error);
689 }
690 
691 /*
692  * the cdevsw write interface - an atomic write is a packet - or else!
693  */
694 int
695 tunwrite(dev, uio, ioflag)
696 	dev_t		dev;
697 	struct uio	*uio;
698 	int		ioflag;
699 {
700 	struct tun_softc *tp;
701 	struct ifnet	*ifp;
702 	struct mbuf	*top, **mp, *m;
703 	struct ifqueue	*ifq;
704 	struct sockaddr	dst;
705 	int		isr, error=0, s, tlen, mlen;
706 
707 	tp = tun_find_unit(dev);
708 
709 	/* interface was "destroyed" already */
710 	if (tp == NULL)
711 		return (ENXIO);
712 
713 	ifp = &tp->tun_if;
714 
715 	TUNDEBUG("%s: tunwrite\n", ifp->if_xname);
716 
717 	if (tp->tun_flags & TUN_PREPADDR) {
718 		if (uio->uio_resid < sizeof(dst)) {
719 			simple_unlock(&tp->tun_lock);
720 			return (EIO);
721 		}
722 		error = uiomove((caddr_t)&dst, sizeof(dst), uio);
723 		if (dst.sa_len > sizeof(dst)) {
724 			/* Duh.. */
725 			char discard;
726 			int n = dst.sa_len - sizeof(dst);
727 			while (n--)
728 				if ((error = uiomove(&discard, 1, uio)) != 0) {
729 					simple_unlock(&tp->tun_lock);
730 					return (error);
731 				}
732 		}
733 	} else {
734 #ifdef INET
735 		dst.sa_family = AF_INET;
736 #endif
737 	}
738 
739 	if (uio->uio_resid < 0 || uio->uio_resid > TUNMTU) {
740 		TUNDEBUG("%s: len=%lu!\n", ifp->if_xname,
741 		    (unsigned long)uio->uio_resid);
742 		simple_unlock(&tp->tun_lock);
743 		return (EIO);
744 	}
745 
746 	switch (dst.sa_family) {
747 #ifdef INET
748 	case AF_INET:
749 		ifq = &ipintrq;
750 		isr = NETISR_IP;
751 		break;
752 #endif
753 	default:
754 		simple_unlock(&tp->tun_lock);
755 		return (EAFNOSUPPORT);
756 	}
757 
758 	tlen = uio->uio_resid;
759 
760 	/* get a header mbuf */
761 	MGETHDR(m, M_DONTWAIT, MT_DATA);
762 	if (m == NULL) {
763 		simple_unlock(&tp->tun_lock);
764 		return (ENOBUFS);
765 	}
766 	mlen = MHLEN;
767 
768 	top = 0;
769 	mp = &top;
770 	while (error == 0 && uio->uio_resid > 0) {
771 		m->m_len = min(mlen, uio->uio_resid);
772 		error = uiomove(mtod (m, caddr_t), m->m_len, uio);
773 		*mp = m;
774 		mp = &m->m_next;
775 		if (uio->uio_resid > 0) {
776 			MGET (m, M_DONTWAIT, MT_DATA);
777 			if (m == 0) {
778 				error = ENOBUFS;
779 				break;
780 			}
781 			mlen = MLEN;
782 		}
783 	}
784 	if (error) {
785 		if (top)
786 			m_freem (top);
787 		ifp->if_ierrors++;
788 		simple_unlock(&tp->tun_lock);
789 		return (error);
790 	}
791 
792 	top->m_pkthdr.len = tlen;
793 	top->m_pkthdr.rcvif = ifp;
794 
795 #if NBPFILTER > 0
796 	if (ifp->if_bpf) {
797 		/*
798 		 * We need to prepend the address family as
799 		 * a four byte field.  Cons up a dummy header
800 		 * to pacify bpf.  This is safe because bpf
801 		 * will only read from the mbuf (i.e., it won't
802 		 * try to free it or keep a pointer to it).
803 		 */
804 		struct mbuf m;
805 		u_int32_t af = AF_INET;
806 
807 		m.m_next = top;
808 		m.m_len = sizeof(af);
809 		m.m_data = (char *)&af;
810 
811 		bpf_mtap(ifp->if_bpf, &m);
812 	}
813 #endif
814 
815 	s = splnet();
816 	if (IF_QFULL(ifq)) {
817 		IF_DROP(ifq);
818 		splx(s);
819 		ifp->if_collisions++;
820 		m_freem(top);
821 		simple_unlock(&tp->tun_lock);
822 		return (ENOBUFS);
823 	}
824 	IF_ENQUEUE(ifq, top);
825 	splx(s);
826 	ifp->if_ipackets++;
827 	schednetisr(isr);
828 	simple_unlock(&tp->tun_lock);
829 	return (error);
830 }
831 
832 #ifdef ALTQ
833 /*
834  * Start packet transmission on the interface.
835  * when the interface queue is rate-limited by ALTQ or TBR,
836  * if_start is needed to drain packets from the queue in order
837  * to notify readers when outgoing packets become ready.
838  */
839 static void
840 tunstart(ifp)
841 	struct ifnet *ifp;
842 {
843 	struct tun_softc *tp = ifp->if_softc;
844 	struct mbuf *m;
845 	struct proc	*p;
846 
847 	if (!ALTQ_IS_ENABLED(&ifp->if_snd) && !TBR_IS_ENABLED(&ifp->if_snd))
848 		return;
849 
850 	IFQ_POLL(&ifp->if_snd, m);
851 	if (m != NULL) {
852 		if (tp->tun_flags & TUN_RWAIT) {
853 			tp->tun_flags &= ~TUN_RWAIT;
854 			wakeup((caddr_t)tp);
855 		}
856 		if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
857 			if (tp->tun_pgrp > 0)
858 				gsignal(tp->tun_pgrp, SIGIO);
859 			else if ((p = pfind(-tp->tun_pgrp)) != NULL)
860 				psignal(p, SIGIO);
861 		}
862 		selwakeup(&tp->tun_rsel);
863 	}
864 }
865 #endif /* ALTQ */
866 /*
867  * tunpoll - the poll interface, this is only useful on reads
868  * really. The write detect always returns true, write never blocks
869  * anyway, it either accepts the packet or drops it.
870  */
871 int
872 tunpoll(dev, events, p)
873 	dev_t		dev;
874 	int		events;
875 	struct proc	*p;
876 {
877 	struct tun_softc *tp;
878 	struct ifnet	*ifp;
879 	int		s, revents = 0;
880 
881 	tp = tun_find_unit(dev);
882 
883 	/* interface was "destroyed" already */
884 	if (tp == NULL)
885 		return (0);
886 
887 	ifp = &tp->tun_if;
888 
889 	s = splnet();
890 	TUNDEBUG("%s: tunpoll\n", ifp->if_xname);
891 
892 	if (events & (POLLIN | POLLRDNORM)) {
893 		if (IFQ_IS_EMPTY(&ifp->if_snd) == 0) {
894 			TUNDEBUG("%s: tunpoll q=%d\n", ifp->if_xname,
895 			    ifp->if_snd.ifq_len);
896 			revents |= events & (POLLIN | POLLRDNORM);
897 		} else {
898 			TUNDEBUG("%s: tunpoll waiting\n", ifp->if_xname);
899 			selrecord(p, &tp->tun_rsel);
900 		}
901 	}
902 
903 	if (events & (POLLOUT | POLLWRNORM))
904 		revents |= events & (POLLOUT | POLLWRNORM);
905 
906 	splx(s);
907 	simple_unlock(&tp->tun_lock);
908 	return (revents);
909 }
910