xref: /netbsd-src/sys/net/if_tun.c (revision b8c616269f5ebf18ab2e35cb8099d683130a177c)
1 /*	$NetBSD: if_tun.c,v 1.58 2002/12/25 08:40:20 jdolecek Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5  * Nottingham University 1987.
6  *
7  * This source may be freely distributed, however I would be interested
8  * in any changes that are made.
9  *
10  * This driver takes packets off the IP i/f and hands them up to a
11  * user process to have its wicked way with. This driver has its
12  * roots in a similar driver written by Phil Cockcroft (formerly) at
13  * UCL. This driver is based much more on read/write/poll mode of
14  * operation though.
15  */
16 
17 #include <sys/cdefs.h>
18 __KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.58 2002/12/25 08:40:20 jdolecek Exp $");
19 
20 #include "tun.h"
21 
22 #include "opt_inet.h"
23 #include "opt_ns.h"
24 
25 #include <sys/param.h>
26 #include <sys/proc.h>
27 #include <sys/systm.h>
28 #include <sys/mbuf.h>
29 #include <sys/buf.h>
30 #include <sys/protosw.h>
31 #include <sys/socket.h>
32 #include <sys/ioctl.h>
33 #include <sys/errno.h>
34 #include <sys/syslog.h>
35 #include <sys/select.h>
36 #include <sys/poll.h>
37 #include <sys/file.h>
38 #include <sys/signalvar.h>
39 #include <sys/conf.h>
40 
41 #include <machine/cpu.h>
42 
43 #include <net/if.h>
44 #include <net/if_ether.h>
45 #include <net/netisr.h>
46 #include <net/route.h>
47 
48 
49 #ifdef INET
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/ip.h>
54 #include <netinet/if_inarp.h>
55 #endif
56 
57 #ifdef NS
58 #include <netns/ns.h>
59 #include <netns/ns_if.h>
60 #endif
61 
62 #include "bpfilter.h"
63 #if NBPFILTER > 0
64 #include <sys/time.h>
65 #include <net/bpf.h>
66 #endif
67 
68 #include <net/if_tun.h>
69 
70 #define TUNDEBUG	if (tundebug) printf
71 int	tundebug = 0;
72 
73 extern int ifqmaxlen;
74 void	tunattach __P((int));
75 LIST_HEAD(, tun_softc) tun_softc_list;
76 static struct simplelock tun_softc_lock;
77 
78 int	tun_ioctl __P((struct ifnet *, u_long, caddr_t));
79 int	tun_output __P((struct ifnet *, struct mbuf *, struct sockaddr *,
80 		       struct rtentry *rt));
81 int	tun_clone_create __P((struct if_clone *, int));
82 void	tun_clone_destroy __P((struct ifnet *));
83 
84 struct if_clone tun_cloner =
85     IF_CLONE_INITIALIZER("tun", tun_clone_create, tun_clone_destroy);
86 
87 static void tunattach0 __P((struct tun_softc *));
88 static void tuninit __P((struct tun_softc *));
89 #ifdef ALTQ
90 static void tunstart __P((struct ifnet *));
91 #endif
92 static struct tun_softc *tun_find_unit __P((dev_t));
93 
94 dev_type_open(tunopen);
95 dev_type_close(tunclose);
96 dev_type_read(tunread);
97 dev_type_write(tunwrite);
98 dev_type_ioctl(tunioctl);
99 dev_type_poll(tunpoll);
100 dev_type_kqfilter(tunkqfilter);
101 
102 const struct cdevsw tun_cdevsw = {
103 	tunopen, tunclose, tunread, tunwrite, tunioctl,
104 	nostop, notty, tunpoll, nommap, tunkqfilter,
105 };
106 
107 void
108 tunattach(unused)
109 	int unused;
110 {
111 
112 	simple_lock_init(&tun_softc_lock);
113 	LIST_INIT(&tun_softc_list);
114 	if_clone_attach(&tun_cloner);
115 }
116 
117 int
118 tun_clone_create(ifc, unit)
119 	struct if_clone *ifc;
120 	int unit;
121 {
122 	struct tun_softc *sc;
123 
124 	sc = malloc(sizeof(struct tun_softc), M_DEVBUF, M_WAITOK);
125 	(void)memset(sc, 0, sizeof(struct tun_softc));
126 
127 	(void)snprintf(sc->tun_if.if_xname, sizeof(sc->tun_if.if_xname),
128 	    "%s%d", ifc->ifc_name, unit);
129 	sc->tun_unit = unit;
130 	simple_lock_init(&sc->tun_lock);
131 
132 	tunattach0(sc);
133 
134 	simple_lock(&tun_softc_lock);
135 	LIST_INSERT_HEAD(&tun_softc_list, sc, tun_list);
136 	simple_unlock(&tun_softc_lock);
137 
138 	return (0);
139 }
140 
141 void
142 tunattach0(sc)
143 	struct tun_softc *sc;
144 {
145 	struct ifnet *ifp = (void *)sc;
146 
147 	sc->tun_flags = TUN_INITED;
148 
149 	ifp = &sc->tun_if;
150 	ifp->if_softc = sc;
151 	ifp->if_mtu = TUNMTU;
152 	ifp->if_ioctl = tun_ioctl;
153 	ifp->if_output = tun_output;
154 #ifdef ALTQ
155 	ifp->if_start = tunstart;
156 #endif
157 	ifp->if_flags = IFF_POINTOPOINT;
158 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
159 	ifp->if_collisions = 0;
160 	ifp->if_ierrors = 0;
161 	ifp->if_oerrors = 0;
162 	ifp->if_ipackets = 0;
163 	ifp->if_opackets = 0;
164 	ifp->if_ibytes   = 0;
165 	ifp->if_obytes   = 0;
166 	ifp->if_dlt = DLT_NULL;
167 	IFQ_SET_READY(&ifp->if_snd);
168 	if_attach(ifp);
169 	if_alloc_sadl(ifp);
170 #if NBPFILTER > 0
171 	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
172 #endif
173 }
174 
175 void
176 tun_clone_destroy(ifp)
177 	struct ifnet *ifp;
178 {
179 	struct tun_softc *tp = (void *)ifp;
180 	struct proc *p;
181 
182 	simple_lock(&tun_softc_lock);
183 	simple_lock(&tp->tun_lock);
184 	LIST_REMOVE(tp, tun_list);
185 	simple_unlock(&tp->tun_lock);
186 	simple_unlock(&tun_softc_lock);
187 
188 	if (tp->tun_flags & TUN_RWAIT) {
189 		tp->tun_flags &= ~TUN_RWAIT;
190 		wakeup((caddr_t)tp);
191 	}
192 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
193 		if (tp->tun_pgrp > 0)
194 			gsignal(tp->tun_pgrp, SIGIO);
195 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
196 			psignal(p, SIGIO);
197 	}
198 	selwakeup(&tp->tun_rsel);
199 
200 #if NBPFILTER > 0
201 	bpfdetach(ifp);
202 #endif
203 	if_detach(ifp);
204 
205 	free(tp, M_DEVBUF);
206 }
207 
208 static struct tun_softc *
209 tun_find_unit(dev)
210 	dev_t dev;
211 {
212 	struct tun_softc *tp;
213 	int unit = minor(dev);
214 
215 	simple_lock(&tun_softc_lock);
216 	LIST_FOREACH(tp, &tun_softc_list, tun_list)
217 		if (unit == tp->tun_unit)
218 			break;
219 	if (tp)
220 		simple_lock(&tp->tun_lock);
221 	simple_unlock(&tun_softc_lock);
222 
223 	return (tp);
224 }
225 
226 /*
227  * tunnel open - must be superuser & the device must be
228  * configured in
229  */
230 int
231 tunopen(dev, flag, mode, p)
232 	dev_t	dev;
233 	int	flag, mode;
234 	struct proc *p;
235 {
236 	struct ifnet	*ifp;
237 	struct tun_softc *tp;
238 	int	error;
239 
240 	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
241 		return (error);
242 
243 	if (NTUN < 1)
244 		return (ENXIO);
245 
246 	tp = tun_find_unit(dev);
247 
248 	if (!tp) {
249 		(void)tun_clone_create(&tun_cloner, minor(dev));
250 		tp = tun_find_unit(dev);
251 	}
252 
253 	if (!tp)
254 		return (ENXIO);
255 
256 	if (tp->tun_flags & TUN_OPEN) {
257 		simple_unlock(&tp->tun_lock);
258 		return (EBUSY);
259 	}
260 
261 	ifp = &tp->tun_if;
262 	tp->tun_flags |= TUN_OPEN;
263 	TUNDEBUG("%s: open\n", ifp->if_xname);
264 	simple_unlock(&tp->tun_lock);
265 	return (0);
266 }
267 
268 /*
269  * tunclose - close the device - mark i/f down & delete
270  * routing info
271  */
272 int
273 tunclose(dev, flag, mode, p)
274 	dev_t	dev;
275 	int	flag;
276 	int	mode;
277 	struct proc *p;
278 {
279 	int	s;
280 	struct tun_softc *tp;
281 	struct ifnet	*ifp;
282 
283 	tp = tun_find_unit(dev);
284 
285 	/* interface was "destroyed" before the close */
286 	if (tp == NULL)
287 		return (0);
288 
289 	ifp = &tp->tun_if;
290 
291 	tp->tun_flags &= ~TUN_OPEN;
292 
293 	/*
294 	 * junk all pending output
295 	 */
296 	s = splnet();
297 	IFQ_PURGE(&ifp->if_snd);
298 	splx(s);
299 
300 	if (ifp->if_flags & IFF_UP) {
301 		s = splnet();
302 		if_down(ifp);
303 		if (ifp->if_flags & IFF_RUNNING) {
304 			/* find internet addresses and delete routes */
305 			struct ifaddr *ifa;
306 			TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
307 #ifdef INET
308 				if (ifa->ifa_addr->sa_family == AF_INET) {
309 					rtinit(ifa, (int)RTM_DELETE,
310 					       tp->tun_flags & TUN_DSTADDR
311 							? RTF_HOST
312 							: 0);
313 				}
314 #endif
315 			}
316 		}
317 		splx(s);
318 	}
319 	tp->tun_pgrp = 0;
320 	selnotify(&tp->tun_rsel, 0);
321 
322 	TUNDEBUG ("%s: closed\n", ifp->if_xname);
323 	simple_unlock(&tp->tun_lock);
324 	return (0);
325 }
326 
327 static void
328 tuninit(tp)
329 	struct tun_softc *tp;
330 {
331 	struct ifnet	*ifp = &tp->tun_if;
332 	struct ifaddr	*ifa;
333 
334 	TUNDEBUG("%s: tuninit\n", ifp->if_xname);
335 
336 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
337 
338 	tp->tun_flags &= ~(TUN_IASET|TUN_DSTADDR);
339 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
340 #ifdef INET
341 		if (ifa->ifa_addr->sa_family == AF_INET) {
342 			struct sockaddr_in *sin;
343 
344 			sin = satosin(ifa->ifa_addr);
345 			if (sin && sin->sin_addr.s_addr)
346 				tp->tun_flags |= TUN_IASET;
347 
348 			if (ifp->if_flags & IFF_POINTOPOINT) {
349 				sin = satosin(ifa->ifa_dstaddr);
350 				if (sin && sin->sin_addr.s_addr)
351 					tp->tun_flags |= TUN_DSTADDR;
352 			}
353 		}
354 #endif
355 	}
356 
357 	return;
358 }
359 
360 /*
361  * Process an ioctl request.
362  */
363 int
364 tun_ioctl(ifp, cmd, data)
365 	struct ifnet *ifp;
366 	u_long cmd;
367 	caddr_t	data;
368 {
369 	int		error = 0, s;
370 	struct tun_softc *tp = (struct tun_softc *)(ifp->if_softc);
371 
372 	simple_lock(&tp->tun_lock);
373 
374 	s = splnet();
375 	switch(cmd) {
376 	case SIOCSIFADDR:
377 		tuninit((struct tun_softc *)(ifp->if_softc));
378 		TUNDEBUG("%s: address set\n", ifp->if_xname);
379 		break;
380 	case SIOCSIFDSTADDR:
381 		tuninit((struct tun_softc *)(ifp->if_softc));
382 		TUNDEBUG("%s: destination address set\n", ifp->if_xname);
383 		break;
384 	case SIOCSIFBRDADDR:
385 		TUNDEBUG("%s: broadcast address set\n", ifp->if_xname);
386 		break;
387 	case SIOCSIFMTU: {
388 		struct ifreq *ifr = (struct ifreq *) data;
389 		if (ifr->ifr_mtu > TUNMTU || ifr->ifr_mtu < 576) {
390 		    error = EINVAL;
391 		    break;
392 		}
393 		TUNDEBUG("%s: interface mtu set\n", ifp->if_xname);
394 		ifp->if_mtu = ifr->ifr_mtu;
395 		break;
396 	}
397 	case SIOCADDMULTI:
398 	case SIOCDELMULTI: {
399 		struct ifreq *ifr = (struct ifreq *) data;
400 		if (ifr == 0) {
401 	        	error = EAFNOSUPPORT;           /* XXX */
402 			break;
403 		}
404 		switch (ifr->ifr_addr.sa_family) {
405 
406 #ifdef INET
407 		case AF_INET:
408 			break;
409 #endif
410 
411 		default:
412 			error = EAFNOSUPPORT;
413 			break;
414 		}
415 		break;
416 	}
417 	case SIOCSIFFLAGS:
418 		break;
419 	default:
420 		error = EINVAL;
421 	}
422 	splx(s);
423 	simple_unlock(&tp->tun_lock);
424 	return (error);
425 }
426 
427 /*
428  * tun_output - queue packets from higher level ready to put out.
429  */
430 int
431 tun_output(ifp, m0, dst, rt)
432 	struct ifnet   *ifp;
433 	struct mbuf    *m0;
434 	struct sockaddr *dst;
435 	struct rtentry *rt;
436 {
437 	struct tun_softc *tp = ifp->if_softc;
438 	struct proc	*p;
439 #ifdef INET
440 	int		s;
441 	int		error;
442 #endif
443 	int		mlen;
444 	ALTQ_DECL(struct altq_pktattr pktattr;)
445 
446 	simple_lock(&tp->tun_lock);
447 	TUNDEBUG ("%s: tun_output\n", ifp->if_xname);
448 
449 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
450 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname,
451 			  tp->tun_flags);
452 		m_freem (m0);
453 		simple_unlock(&tp->tun_lock);
454 		return (EHOSTDOWN);
455 	}
456 
457 	/*
458 	 * if the queueing discipline needs packet classification,
459 	 * do it before prepending link headers.
460 	 */
461 	IFQ_CLASSIFY(&ifp->if_snd, m0, dst->sa_family, &pktattr);
462 
463 #if NBPFILTER > 0
464 	if (ifp->if_bpf) {
465 		/*
466 		 * We need to prepend the address family as
467 		 * a four byte field.  Cons up a dummy header
468 		 * to pacify bpf.  This is safe because bpf
469 		 * will only read from the mbuf (i.e., it won't
470 		 * try to free it or keep a pointer to it).
471 		 */
472 		struct mbuf m;
473 		u_int32_t af = dst->sa_family;
474 
475 		m.m_next = m0;
476 		m.m_len = sizeof(af);
477 		m.m_data = (char *)&af;
478 
479 		bpf_mtap(ifp->if_bpf, &m);
480 	}
481 #endif
482 
483 	switch(dst->sa_family) {
484 #ifdef INET
485 	case AF_INET:
486 		if (tp->tun_flags & TUN_PREPADDR) {
487 			/* Simple link-layer header */
488 			M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
489 			if (m0 == NULL) {
490 				IF_DROP(&ifp->if_snd);
491 				simple_unlock(&tp->tun_lock);
492 				return (ENOBUFS);
493 			}
494 			bcopy(dst, mtod(m0, char *), dst->sa_len);
495 		}
496 		/* FALLTHROUGH */
497 	case AF_UNSPEC:
498 		s = splnet();
499 		IFQ_ENQUEUE(&ifp->if_snd, m0, &pktattr, error);
500 		if (error) {
501 			splx(s);
502 			ifp->if_collisions++;
503 			return (error);
504 		}
505 		mlen = m0->m_pkthdr.len;
506 		splx(s);
507 		ifp->if_opackets++;
508 		ifp->if_obytes += mlen;
509 		break;
510 #endif
511 	default:
512 		m_freem(m0);
513 		simple_unlock(&tp->tun_lock);
514 		return (EAFNOSUPPORT);
515 	}
516 
517 	if (tp->tun_flags & TUN_RWAIT) {
518 		tp->tun_flags &= ~TUN_RWAIT;
519 		wakeup((caddr_t)tp);
520 	}
521 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
522 		if (tp->tun_pgrp > 0)
523 			gsignal(tp->tun_pgrp, SIGIO);
524 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
525 			psignal(p, SIGIO);
526 	}
527 	selnotify(&tp->tun_rsel, 0);
528 	simple_unlock(&tp->tun_lock);
529 	return (0);
530 }
531 
532 /*
533  * the cdevsw interface is now pretty minimal.
534  */
535 int
536 tunioctl(dev, cmd, data, flag, p)
537 	dev_t		dev;
538 	u_long		cmd;
539 	caddr_t		data;
540 	int		flag;
541 	struct proc	*p;
542 {
543 	int		s;
544 	struct tun_softc *tp;
545 
546 	tp = tun_find_unit(dev);
547 
548 	/* interface was "destroyed" already */
549 	if (tp == NULL)
550 		return (ENXIO);
551 
552 	switch (cmd) {
553 	case TUNSDEBUG:
554 		tundebug = *(int *)data;
555 		break;
556 
557 	case TUNGDEBUG:
558 		*(int *)data = tundebug;
559 		break;
560 
561 	case TUNSIFMODE:
562 		switch (*(int *)data & (IFF_POINTOPOINT|IFF_BROADCAST)) {
563 		case IFF_POINTOPOINT:
564 		case IFF_BROADCAST:
565 			s = splnet();
566 			if (tp->tun_if.if_flags & IFF_UP) {
567 				splx(s);
568 				simple_unlock(&tp->tun_lock);
569 				return (EBUSY);
570 			}
571 			tp->tun_if.if_flags &=
572 				~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
573 			tp->tun_if.if_flags |= *(int *)data;
574 			splx(s);
575 			break;
576 		default:
577 			simple_unlock(&tp->tun_lock);
578 			return (EINVAL);
579 		}
580 		break;
581 
582 	case TUNSLMODE:
583 		if (*(int *)data)
584 			tp->tun_flags |= TUN_PREPADDR;
585 		else
586 			tp->tun_flags &= ~TUN_PREPADDR;
587 		break;
588 
589 	case FIONBIO:
590 		if (*(int *)data)
591 			tp->tun_flags |= TUN_NBIO;
592 		else
593 			tp->tun_flags &= ~TUN_NBIO;
594 		break;
595 
596 	case FIOASYNC:
597 		if (*(int *)data)
598 			tp->tun_flags |= TUN_ASYNC;
599 		else
600 			tp->tun_flags &= ~TUN_ASYNC;
601 		break;
602 
603 	case FIONREAD:
604 		s = splnet();
605 		if (tp->tun_if.if_snd.ifq_head)
606 			*(int *)data = tp->tun_if.if_snd.ifq_head->m_pkthdr.len;
607 		else
608 			*(int *)data = 0;
609 		splx(s);
610 		break;
611 
612 	case TIOCSPGRP:
613 		tp->tun_pgrp = *(int *)data;
614 		break;
615 
616 	case TIOCGPGRP:
617 		*(int *)data = tp->tun_pgrp;
618 		break;
619 
620 	default:
621 		simple_unlock(&tp->tun_lock);
622 		return (ENOTTY);
623 	}
624 	simple_unlock(&tp->tun_lock);
625 	return (0);
626 }
627 
628 /*
629  * The cdevsw read interface - reads a packet at a time, or at
630  * least as much of a packet as can be read.
631  */
632 int
633 tunread(dev, uio, ioflag)
634 	dev_t		dev;
635 	struct uio	*uio;
636 	int		ioflag;
637 {
638 	struct tun_softc *tp;
639 	struct ifnet	*ifp;
640 	struct mbuf	*m, *m0;
641 	int		error=0, len, s, index;
642 
643 	tp = tun_find_unit(dev);
644 
645 	/* interface was "destroyed" already */
646 	if (tp == NULL)
647 		return (ENXIO);
648 
649 	index = tp->tun_if.if_index;
650 	ifp = &tp->tun_if;
651 
652 	TUNDEBUG ("%s: read\n", ifp->if_xname);
653 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
654 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname, tp->tun_flags);
655 		simple_unlock(&tp->tun_lock);
656 		return EHOSTDOWN;
657 	}
658 
659 	tp->tun_flags &= ~TUN_RWAIT;
660 
661 	s = splnet();
662 	do {
663 		IFQ_DEQUEUE(&ifp->if_snd, m0);
664 		if (m0 == 0) {
665 			if (tp->tun_flags & TUN_NBIO) {
666 				splx(s);
667 				simple_unlock(&tp->tun_lock);
668 				return (EWOULDBLOCK);
669 			}
670 			tp->tun_flags |= TUN_RWAIT;
671 			simple_unlock(&tp->tun_lock);
672 			if (tsleep((caddr_t)tp, PZERO|PCATCH, "tunread", 0)) {
673 				splx(s);
674 				return (EINTR);
675 			} else {
676 				/*
677 				 * Maybe the interface was destroyed while
678 				 * we were sleeping, so let's ensure that
679 				 * we're looking at the same (valid) tun
680 				 * interface before looping.
681 				 */
682 				tp = tun_find_unit(dev);
683 				if (tp == NULL ||
684 				    tp->tun_if.if_index != index) {
685 					splx(s);
686 					if (tp)
687 						simple_unlock(&tp->tun_lock);
688 					return (ENXIO);
689 				}
690 			}
691 		}
692 	} while (m0 == 0);
693 	splx(s);
694 
695 	while (m0 && uio->uio_resid > 0 && error == 0) {
696 		len = min(uio->uio_resid, m0->m_len);
697 		if (len != 0)
698 			error = uiomove(mtod(m0, caddr_t), len, uio);
699 		MFREE(m0, m);
700 		m0 = m;
701 	}
702 
703 	if (m0) {
704 		TUNDEBUG("Dropping mbuf\n");
705 		m_freem(m0);
706 	}
707 	if (error)
708 		ifp->if_ierrors++;
709 	simple_unlock(&tp->tun_lock);
710 	return (error);
711 }
712 
713 /*
714  * the cdevsw write interface - an atomic write is a packet - or else!
715  */
716 int
717 tunwrite(dev, uio, ioflag)
718 	dev_t		dev;
719 	struct uio	*uio;
720 	int		ioflag;
721 {
722 	struct tun_softc *tp;
723 	struct ifnet	*ifp;
724 	struct mbuf	*top, **mp, *m;
725 	struct ifqueue	*ifq;
726 	struct sockaddr	dst;
727 	int		isr, error=0, s, tlen, mlen;
728 
729 	tp = tun_find_unit(dev);
730 
731 	/* interface was "destroyed" already */
732 	if (tp == NULL)
733 		return (ENXIO);
734 
735 	ifp = &tp->tun_if;
736 
737 	TUNDEBUG("%s: tunwrite\n", ifp->if_xname);
738 
739 	if (tp->tun_flags & TUN_PREPADDR) {
740 		if (uio->uio_resid < sizeof(dst)) {
741 			simple_unlock(&tp->tun_lock);
742 			return (EIO);
743 		}
744 		error = uiomove((caddr_t)&dst, sizeof(dst), uio);
745 		if (dst.sa_len > sizeof(dst)) {
746 			/* Duh.. */
747 			char discard;
748 			int n = dst.sa_len - sizeof(dst);
749 			while (n--)
750 				if ((error = uiomove(&discard, 1, uio)) != 0) {
751 					simple_unlock(&tp->tun_lock);
752 					return (error);
753 				}
754 		}
755 	} else {
756 #ifdef INET
757 		dst.sa_family = AF_INET;
758 #endif
759 	}
760 
761 	if (uio->uio_resid > TUNMTU) {
762 		TUNDEBUG("%s: len=%lu!\n", ifp->if_xname,
763 		    (unsigned long)uio->uio_resid);
764 		simple_unlock(&tp->tun_lock);
765 		return (EIO);
766 	}
767 
768 	switch (dst.sa_family) {
769 #ifdef INET
770 	case AF_INET:
771 		ifq = &ipintrq;
772 		isr = NETISR_IP;
773 		break;
774 #endif
775 	default:
776 		simple_unlock(&tp->tun_lock);
777 		return (EAFNOSUPPORT);
778 	}
779 
780 	tlen = uio->uio_resid;
781 
782 	/* get a header mbuf */
783 	MGETHDR(m, M_DONTWAIT, MT_DATA);
784 	if (m == NULL) {
785 		simple_unlock(&tp->tun_lock);
786 		return (ENOBUFS);
787 	}
788 	mlen = MHLEN;
789 
790 	top = 0;
791 	mp = &top;
792 	while (error == 0 && uio->uio_resid > 0) {
793 		m->m_len = min(mlen, uio->uio_resid);
794 		error = uiomove(mtod (m, caddr_t), m->m_len, uio);
795 		*mp = m;
796 		mp = &m->m_next;
797 		if (uio->uio_resid > 0) {
798 			MGET (m, M_DONTWAIT, MT_DATA);
799 			if (m == 0) {
800 				error = ENOBUFS;
801 				break;
802 			}
803 			mlen = MLEN;
804 		}
805 	}
806 	if (error) {
807 		if (top)
808 			m_freem (top);
809 		ifp->if_ierrors++;
810 		simple_unlock(&tp->tun_lock);
811 		return (error);
812 	}
813 
814 	top->m_pkthdr.len = tlen;
815 	top->m_pkthdr.rcvif = ifp;
816 
817 #if NBPFILTER > 0
818 	if (ifp->if_bpf) {
819 		/*
820 		 * We need to prepend the address family as
821 		 * a four byte field.  Cons up a dummy header
822 		 * to pacify bpf.  This is safe because bpf
823 		 * will only read from the mbuf (i.e., it won't
824 		 * try to free it or keep a pointer to it).
825 		 */
826 		struct mbuf m;
827 		u_int32_t af = AF_INET;
828 
829 		m.m_next = top;
830 		m.m_len = sizeof(af);
831 		m.m_data = (char *)&af;
832 
833 		bpf_mtap(ifp->if_bpf, &m);
834 	}
835 #endif
836 
837 	s = splnet();
838 	if (IF_QFULL(ifq)) {
839 		IF_DROP(ifq);
840 		splx(s);
841 		ifp->if_collisions++;
842 		m_freem(top);
843 		simple_unlock(&tp->tun_lock);
844 		return (ENOBUFS);
845 	}
846 	IF_ENQUEUE(ifq, top);
847 	splx(s);
848 	ifp->if_ipackets++;
849 	ifp->if_ibytes += tlen;
850 	schednetisr(isr);
851 	simple_unlock(&tp->tun_lock);
852 	return (error);
853 }
854 
855 #ifdef ALTQ
856 /*
857  * Start packet transmission on the interface.
858  * when the interface queue is rate-limited by ALTQ or TBR,
859  * if_start is needed to drain packets from the queue in order
860  * to notify readers when outgoing packets become ready.
861  */
862 static void
863 tunstart(ifp)
864 	struct ifnet *ifp;
865 {
866 	struct tun_softc *tp = ifp->if_softc;
867 	struct mbuf *m;
868 	struct proc	*p;
869 
870 	if (!ALTQ_IS_ENABLED(&ifp->if_snd) && !TBR_IS_ENABLED(&ifp->if_snd))
871 		return;
872 
873 	IFQ_POLL(&ifp->if_snd, m);
874 	if (m != NULL) {
875 		if (tp->tun_flags & TUN_RWAIT) {
876 			tp->tun_flags &= ~TUN_RWAIT;
877 			wakeup((caddr_t)tp);
878 		}
879 		if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
880 			if (tp->tun_pgrp > 0)
881 				gsignal(tp->tun_pgrp, SIGIO);
882 			else if ((p = pfind(-tp->tun_pgrp)) != NULL)
883 				psignal(p, SIGIO);
884 		}
885 		selwakeup(&tp->tun_rsel);
886 	}
887 }
888 #endif /* ALTQ */
889 /*
890  * tunpoll - the poll interface, this is only useful on reads
891  * really. The write detect always returns true, write never blocks
892  * anyway, it either accepts the packet or drops it.
893  */
894 int
895 tunpoll(dev, events, p)
896 	dev_t		dev;
897 	int		events;
898 	struct proc	*p;
899 {
900 	struct tun_softc *tp;
901 	struct ifnet	*ifp;
902 	int		s, revents = 0;
903 
904 	tp = tun_find_unit(dev);
905 
906 	/* interface was "destroyed" already */
907 	if (tp == NULL)
908 		return (0);
909 
910 	ifp = &tp->tun_if;
911 
912 	s = splnet();
913 	TUNDEBUG("%s: tunpoll\n", ifp->if_xname);
914 
915 	if (events & (POLLIN | POLLRDNORM)) {
916 		if (IFQ_IS_EMPTY(&ifp->if_snd) == 0) {
917 			TUNDEBUG("%s: tunpoll q=%d\n", ifp->if_xname,
918 			    ifp->if_snd.ifq_len);
919 			revents |= events & (POLLIN | POLLRDNORM);
920 		} else {
921 			TUNDEBUG("%s: tunpoll waiting\n", ifp->if_xname);
922 			selrecord(p, &tp->tun_rsel);
923 		}
924 	}
925 
926 	if (events & (POLLOUT | POLLWRNORM))
927 		revents |= events & (POLLOUT | POLLWRNORM);
928 
929 	splx(s);
930 	simple_unlock(&tp->tun_lock);
931 	return (revents);
932 }
933 
934 static void
935 filt_tunrdetach(struct knote *kn)
936 {
937 	struct tun_softc *tp = kn->kn_hook;
938 	int s;
939 
940 	s = splnet();
941 	SLIST_REMOVE(&tp->tun_rsel.sel_klist, kn, knote, kn_selnext);
942 	splx(s);
943 }
944 
945 static int
946 filt_tunread(struct knote *kn, long hint)
947 {
948 	struct tun_softc *tp = kn->kn_hook;
949 	struct ifnet *ifp = &tp->tun_if;
950 	struct mbuf *m;
951 	int s;
952 
953 	s = splnet();
954 	IF_POLL(&ifp->if_snd, m);
955 	if (m == NULL) {
956 		splx(s);
957 		return (0);
958 	}
959 
960 	for (kn->kn_data = 0; m != NULL; m = m->m_next)
961 		kn->kn_data += m->m_len;
962 
963 	splx(s);
964 	return (1);
965 }
966 
967 static const struct filterops tunread_filtops =
968 	{ 1, NULL, filt_tunrdetach, filt_tunread };
969 
970 static const struct filterops tun_seltrue_filtops =
971 	{ 1, NULL, filt_tunrdetach, filt_seltrue };
972 
973 int
974 tunkqfilter(dev_t dev, struct knote *kn)
975 {
976 	struct tun_softc *tp = tun_find_unit(dev);
977 	struct klist *klist;
978 	int s;
979 
980 	switch (kn->kn_filter) {
981 	case EVFILT_READ:
982 		klist = &tp->tun_rsel.sel_klist;
983 		kn->kn_fop = &tunread_filtops;
984 		break;
985 
986 	case EVFILT_WRITE:
987 		klist = &tp->tun_rsel.sel_klist;
988 		kn->kn_fop = &tun_seltrue_filtops;
989 		break;
990 
991 	default:
992 		return (1);
993 	}
994 
995 	kn->kn_hook = tp;
996 
997 	s = splnet();
998 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
999 	splx(s);
1000 
1001 	return (0);
1002 }
1003