xref: /netbsd-src/sys/net/if_tun.c (revision d710132b4b8ce7f7cccaaf660cb16aa16b4077a0)
1 /*	$NetBSD: if_tun.c,v 1.61 2003/05/02 03:15:24 itojun Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5  * Nottingham University 1987.
6  *
7  * This source may be freely distributed, however I would be interested
8  * in any changes that are made.
9  *
10  * This driver takes packets off the IP i/f and hands them up to a
11  * user process to have its wicked way with. This driver has its
12  * roots in a similar driver written by Phil Cockcroft (formerly) at
13  * UCL. This driver is based much more on read/write/poll mode of
14  * operation though.
15  */
16 
17 #include <sys/cdefs.h>
18 __KERNEL_RCSID(0, "$NetBSD: if_tun.c,v 1.61 2003/05/02 03:15:24 itojun Exp $");
19 
20 #include "tun.h"
21 
22 #include "opt_inet.h"
23 #include "opt_ns.h"
24 
25 #include <sys/param.h>
26 #include <sys/proc.h>
27 #include <sys/systm.h>
28 #include <sys/mbuf.h>
29 #include <sys/buf.h>
30 #include <sys/protosw.h>
31 #include <sys/socket.h>
32 #include <sys/ioctl.h>
33 #include <sys/errno.h>
34 #include <sys/syslog.h>
35 #include <sys/select.h>
36 #include <sys/poll.h>
37 #include <sys/file.h>
38 #include <sys/signalvar.h>
39 #include <sys/conf.h>
40 
41 #include <machine/cpu.h>
42 
43 #include <net/if.h>
44 #include <net/if_ether.h>
45 #include <net/netisr.h>
46 #include <net/route.h>
47 
48 
49 #ifdef INET
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/ip.h>
54 #include <netinet/if_inarp.h>
55 #endif
56 
57 #ifdef NS
58 #include <netns/ns.h>
59 #include <netns/ns_if.h>
60 #endif
61 
62 #include "bpfilter.h"
63 #if NBPFILTER > 0
64 #include <sys/time.h>
65 #include <net/bpf.h>
66 #endif
67 
68 #include <net/if_tun.h>
69 
70 #define TUNDEBUG	if (tundebug) printf
71 int	tundebug = 0;
72 
73 extern int ifqmaxlen;
74 void	tunattach __P((int));
75 LIST_HEAD(, tun_softc) tun_softc_list;
76 static struct simplelock tun_softc_lock;
77 
78 int	tun_ioctl __P((struct ifnet *, u_long, caddr_t));
79 int	tun_output __P((struct ifnet *, struct mbuf *, struct sockaddr *,
80 		       struct rtentry *rt));
81 int	tun_clone_create __P((struct if_clone *, int));
82 void	tun_clone_destroy __P((struct ifnet *));
83 
84 struct if_clone tun_cloner =
85     IF_CLONE_INITIALIZER("tun", tun_clone_create, tun_clone_destroy);
86 
87 static void tunattach0 __P((struct tun_softc *));
88 static void tuninit __P((struct tun_softc *));
89 #ifdef ALTQ
90 static void tunstart __P((struct ifnet *));
91 #endif
92 static struct tun_softc *tun_find_unit __P((dev_t));
93 
94 dev_type_open(tunopen);
95 dev_type_close(tunclose);
96 dev_type_read(tunread);
97 dev_type_write(tunwrite);
98 dev_type_ioctl(tunioctl);
99 dev_type_poll(tunpoll);
100 dev_type_kqfilter(tunkqfilter);
101 
102 const struct cdevsw tun_cdevsw = {
103 	tunopen, tunclose, tunread, tunwrite, tunioctl,
104 	nostop, notty, tunpoll, nommap, tunkqfilter,
105 };
106 
107 void
108 tunattach(unused)
109 	int unused;
110 {
111 
112 	simple_lock_init(&tun_softc_lock);
113 	LIST_INIT(&tun_softc_list);
114 	if_clone_attach(&tun_cloner);
115 }
116 
117 int
118 tun_clone_create(ifc, unit)
119 	struct if_clone *ifc;
120 	int unit;
121 {
122 	struct tun_softc *sc;
123 
124 	sc = malloc(sizeof(struct tun_softc), M_DEVBUF, M_WAITOK);
125 	(void)memset(sc, 0, sizeof(struct tun_softc));
126 
127 	(void)snprintf(sc->tun_if.if_xname, sizeof(sc->tun_if.if_xname),
128 	    "%s%d", ifc->ifc_name, unit);
129 	sc->tun_unit = unit;
130 	simple_lock_init(&sc->tun_lock);
131 
132 	tunattach0(sc);
133 
134 	simple_lock(&tun_softc_lock);
135 	LIST_INSERT_HEAD(&tun_softc_list, sc, tun_list);
136 	simple_unlock(&tun_softc_lock);
137 
138 	return (0);
139 }
140 
141 void
142 tunattach0(sc)
143 	struct tun_softc *sc;
144 {
145 	struct ifnet *ifp = (void *)sc;
146 
147 	sc->tun_flags = TUN_INITED;
148 
149 	ifp = &sc->tun_if;
150 	ifp->if_softc = sc;
151 	ifp->if_mtu = TUNMTU;
152 	ifp->if_ioctl = tun_ioctl;
153 	ifp->if_output = tun_output;
154 #ifdef ALTQ
155 	ifp->if_start = tunstart;
156 #endif
157 	ifp->if_flags = IFF_POINTOPOINT;
158 	ifp->if_snd.ifq_maxlen = ifqmaxlen;
159 	ifp->if_collisions = 0;
160 	ifp->if_ierrors = 0;
161 	ifp->if_oerrors = 0;
162 	ifp->if_ipackets = 0;
163 	ifp->if_opackets = 0;
164 	ifp->if_ibytes   = 0;
165 	ifp->if_obytes   = 0;
166 	ifp->if_dlt = DLT_NULL;
167 	IFQ_SET_READY(&ifp->if_snd);
168 	if_attach(ifp);
169 	if_alloc_sadl(ifp);
170 #if NBPFILTER > 0
171 	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
172 #endif
173 }
174 
175 void
176 tun_clone_destroy(ifp)
177 	struct ifnet *ifp;
178 {
179 	struct tun_softc *tp = (void *)ifp;
180 	struct proc *p;
181 
182 	simple_lock(&tun_softc_lock);
183 	simple_lock(&tp->tun_lock);
184 	LIST_REMOVE(tp, tun_list);
185 	simple_unlock(&tp->tun_lock);
186 	simple_unlock(&tun_softc_lock);
187 
188 	if (tp->tun_flags & TUN_RWAIT) {
189 		tp->tun_flags &= ~TUN_RWAIT;
190 		wakeup((caddr_t)tp);
191 	}
192 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
193 		if (tp->tun_pgrp > 0)
194 			gsignal(tp->tun_pgrp, SIGIO);
195 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
196 			psignal(p, SIGIO);
197 	}
198 	selwakeup(&tp->tun_rsel);
199 
200 #if NBPFILTER > 0
201 	bpfdetach(ifp);
202 #endif
203 	if_detach(ifp);
204 
205 	free(tp, M_DEVBUF);
206 }
207 
208 static struct tun_softc *
209 tun_find_unit(dev)
210 	dev_t dev;
211 {
212 	struct tun_softc *tp;
213 	int unit = minor(dev);
214 
215 	simple_lock(&tun_softc_lock);
216 	LIST_FOREACH(tp, &tun_softc_list, tun_list)
217 		if (unit == tp->tun_unit)
218 			break;
219 	if (tp)
220 		simple_lock(&tp->tun_lock);
221 	simple_unlock(&tun_softc_lock);
222 
223 	return (tp);
224 }
225 
226 /*
227  * tunnel open - must be superuser & the device must be
228  * configured in
229  */
230 int
231 tunopen(dev, flag, mode, p)
232 	dev_t	dev;
233 	int	flag, mode;
234 	struct proc *p;
235 {
236 	struct ifnet	*ifp;
237 	struct tun_softc *tp;
238 	int	error;
239 
240 	if ((error = suser(p->p_ucred, &p->p_acflag)) != 0)
241 		return (error);
242 
243 	if (NTUN < 1)
244 		return (ENXIO);
245 
246 	tp = tun_find_unit(dev);
247 
248 	if (!tp) {
249 		(void)tun_clone_create(&tun_cloner, minor(dev));
250 		tp = tun_find_unit(dev);
251 	}
252 
253 	if (!tp)
254 		return (ENXIO);
255 
256 	if (tp->tun_flags & TUN_OPEN) {
257 		simple_unlock(&tp->tun_lock);
258 		return (EBUSY);
259 	}
260 
261 	ifp = &tp->tun_if;
262 	tp->tun_flags |= TUN_OPEN;
263 	TUNDEBUG("%s: open\n", ifp->if_xname);
264 	simple_unlock(&tp->tun_lock);
265 	return (0);
266 }
267 
268 /*
269  * tunclose - close the device - mark i/f down & delete
270  * routing info
271  */
272 int
273 tunclose(dev, flag, mode, p)
274 	dev_t	dev;
275 	int	flag;
276 	int	mode;
277 	struct proc *p;
278 {
279 	int	s;
280 	struct tun_softc *tp;
281 	struct ifnet	*ifp;
282 
283 	tp = tun_find_unit(dev);
284 
285 	/* interface was "destroyed" before the close */
286 	if (tp == NULL)
287 		return (0);
288 
289 	ifp = &tp->tun_if;
290 
291 	tp->tun_flags &= ~TUN_OPEN;
292 
293 	/*
294 	 * junk all pending output
295 	 */
296 	s = splnet();
297 	IFQ_PURGE(&ifp->if_snd);
298 	splx(s);
299 
300 	if (ifp->if_flags & IFF_UP) {
301 		s = splnet();
302 		if_down(ifp);
303 		if (ifp->if_flags & IFF_RUNNING) {
304 			/* find internet addresses and delete routes */
305 			struct ifaddr *ifa;
306 			TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
307 #ifdef INET
308 				if (ifa->ifa_addr->sa_family == AF_INET) {
309 					rtinit(ifa, (int)RTM_DELETE,
310 					       tp->tun_flags & TUN_DSTADDR
311 							? RTF_HOST
312 							: 0);
313 				}
314 #endif
315 			}
316 		}
317 		splx(s);
318 	}
319 	tp->tun_pgrp = 0;
320 	selnotify(&tp->tun_rsel, 0);
321 
322 	TUNDEBUG ("%s: closed\n", ifp->if_xname);
323 	simple_unlock(&tp->tun_lock);
324 	return (0);
325 }
326 
327 static void
328 tuninit(tp)
329 	struct tun_softc *tp;
330 {
331 	struct ifnet	*ifp = &tp->tun_if;
332 	struct ifaddr	*ifa;
333 
334 	TUNDEBUG("%s: tuninit\n", ifp->if_xname);
335 
336 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
337 
338 	tp->tun_flags &= ~(TUN_IASET|TUN_DSTADDR);
339 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
340 #ifdef INET
341 		if (ifa->ifa_addr->sa_family == AF_INET) {
342 			struct sockaddr_in *sin;
343 
344 			sin = satosin(ifa->ifa_addr);
345 			if (sin && sin->sin_addr.s_addr)
346 				tp->tun_flags |= TUN_IASET;
347 
348 			if (ifp->if_flags & IFF_POINTOPOINT) {
349 				sin = satosin(ifa->ifa_dstaddr);
350 				if (sin && sin->sin_addr.s_addr)
351 					tp->tun_flags |= TUN_DSTADDR;
352 			}
353 		}
354 #endif
355 	}
356 
357 	return;
358 }
359 
360 /*
361  * Process an ioctl request.
362  */
363 int
364 tun_ioctl(ifp, cmd, data)
365 	struct ifnet *ifp;
366 	u_long cmd;
367 	caddr_t	data;
368 {
369 	int		error = 0, s;
370 	struct tun_softc *tp = (struct tun_softc *)(ifp->if_softc);
371 
372 	simple_lock(&tp->tun_lock);
373 
374 	s = splnet();
375 	switch (cmd) {
376 	case SIOCSIFADDR:
377 		tuninit((struct tun_softc *)(ifp->if_softc));
378 		TUNDEBUG("%s: address set\n", ifp->if_xname);
379 		break;
380 	case SIOCSIFDSTADDR:
381 		tuninit((struct tun_softc *)(ifp->if_softc));
382 		TUNDEBUG("%s: destination address set\n", ifp->if_xname);
383 		break;
384 	case SIOCSIFBRDADDR:
385 		TUNDEBUG("%s: broadcast address set\n", ifp->if_xname);
386 		break;
387 	case SIOCSIFMTU: {
388 		struct ifreq *ifr = (struct ifreq *) data;
389 		if (ifr->ifr_mtu > TUNMTU || ifr->ifr_mtu < 576) {
390 		    error = EINVAL;
391 		    break;
392 		}
393 		TUNDEBUG("%s: interface mtu set\n", ifp->if_xname);
394 		ifp->if_mtu = ifr->ifr_mtu;
395 		break;
396 	}
397 	case SIOCADDMULTI:
398 	case SIOCDELMULTI: {
399 		struct ifreq *ifr = (struct ifreq *) data;
400 		if (ifr == 0) {
401 	        	error = EAFNOSUPPORT;           /* XXX */
402 			break;
403 		}
404 		switch (ifr->ifr_addr.sa_family) {
405 
406 #ifdef INET
407 		case AF_INET:
408 			break;
409 #endif
410 
411 		default:
412 			error = EAFNOSUPPORT;
413 			break;
414 		}
415 		break;
416 	}
417 	case SIOCSIFFLAGS:
418 		break;
419 	default:
420 		error = EINVAL;
421 	}
422 	splx(s);
423 	simple_unlock(&tp->tun_lock);
424 	return (error);
425 }
426 
427 /*
428  * tun_output - queue packets from higher level ready to put out.
429  */
430 int
431 tun_output(ifp, m0, dst, rt)
432 	struct ifnet   *ifp;
433 	struct mbuf    *m0;
434 	struct sockaddr *dst;
435 	struct rtentry *rt;
436 {
437 	struct tun_softc *tp = ifp->if_softc;
438 	struct proc	*p;
439 #ifdef INET
440 	int		s;
441 	int		error;
442 #endif
443 	int		mlen;
444 	ALTQ_DECL(struct altq_pktattr pktattr;)
445 
446 	simple_lock(&tp->tun_lock);
447 	TUNDEBUG ("%s: tun_output\n", ifp->if_xname);
448 
449 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
450 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname,
451 			  tp->tun_flags);
452 		m_freem (m0);
453 		simple_unlock(&tp->tun_lock);
454 		return (EHOSTDOWN);
455 	}
456 
457 	/*
458 	 * if the queueing discipline needs packet classification,
459 	 * do it before prepending link headers.
460 	 */
461 	IFQ_CLASSIFY(&ifp->if_snd, m0, dst->sa_family, &pktattr);
462 
463 #if NBPFILTER > 0
464 	if (ifp->if_bpf) {
465 		/*
466 		 * We need to prepend the address family as
467 		 * a four byte field.  Cons up a dummy header
468 		 * to pacify bpf.  This is safe because bpf
469 		 * will only read from the mbuf (i.e., it won't
470 		 * try to free it or keep a pointer to it).
471 		 */
472 		struct mbuf m;
473 		u_int32_t af = dst->sa_family;
474 
475 		m.m_flags = 0;
476 		m.m_next = m0;
477 		m.m_len = sizeof(af);
478 		m.m_data = (char *)&af;
479 
480 		bpf_mtap(ifp->if_bpf, &m);
481 	}
482 #endif
483 
484 	switch(dst->sa_family) {
485 #ifdef INET
486 	case AF_INET:
487 		if (tp->tun_flags & TUN_PREPADDR) {
488 			/* Simple link-layer header */
489 			M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
490 			if (m0 == NULL) {
491 				IF_DROP(&ifp->if_snd);
492 				simple_unlock(&tp->tun_lock);
493 				return (ENOBUFS);
494 			}
495 			bcopy(dst, mtod(m0, char *), dst->sa_len);
496 		}
497 		/* FALLTHROUGH */
498 	case AF_UNSPEC:
499 		s = splnet();
500 		IFQ_ENQUEUE(&ifp->if_snd, m0, &pktattr, error);
501 		if (error) {
502 			splx(s);
503 			ifp->if_collisions++;
504 			return (error);
505 		}
506 		mlen = m0->m_pkthdr.len;
507 		splx(s);
508 		ifp->if_opackets++;
509 		ifp->if_obytes += mlen;
510 		break;
511 #endif
512 	default:
513 		m_freem(m0);
514 		simple_unlock(&tp->tun_lock);
515 		return (EAFNOSUPPORT);
516 	}
517 
518 	if (tp->tun_flags & TUN_RWAIT) {
519 		tp->tun_flags &= ~TUN_RWAIT;
520 		wakeup((caddr_t)tp);
521 	}
522 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
523 		if (tp->tun_pgrp > 0)
524 			gsignal(tp->tun_pgrp, SIGIO);
525 		else if ((p = pfind(-tp->tun_pgrp)) != NULL)
526 			psignal(p, SIGIO);
527 	}
528 	selnotify(&tp->tun_rsel, 0);
529 	simple_unlock(&tp->tun_lock);
530 	return (0);
531 }
532 
533 /*
534  * the cdevsw interface is now pretty minimal.
535  */
536 int
537 tunioctl(dev, cmd, data, flag, p)
538 	dev_t		dev;
539 	u_long		cmd;
540 	caddr_t		data;
541 	int		flag;
542 	struct proc	*p;
543 {
544 	int		s;
545 	struct tun_softc *tp;
546 	pid_t pgid;
547 	int error;
548 
549 	tp = tun_find_unit(dev);
550 
551 	/* interface was "destroyed" already */
552 	if (tp == NULL)
553 		return (ENXIO);
554 
555 	switch (cmd) {
556 	case TUNSDEBUG:
557 		tundebug = *(int *)data;
558 		break;
559 
560 	case TUNGDEBUG:
561 		*(int *)data = tundebug;
562 		break;
563 
564 	case TUNSIFMODE:
565 		switch (*(int *)data & (IFF_POINTOPOINT|IFF_BROADCAST)) {
566 		case IFF_POINTOPOINT:
567 		case IFF_BROADCAST:
568 			s = splnet();
569 			if (tp->tun_if.if_flags & IFF_UP) {
570 				splx(s);
571 				simple_unlock(&tp->tun_lock);
572 				return (EBUSY);
573 			}
574 			tp->tun_if.if_flags &=
575 				~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
576 			tp->tun_if.if_flags |= *(int *)data;
577 			splx(s);
578 			break;
579 		default:
580 			simple_unlock(&tp->tun_lock);
581 			return (EINVAL);
582 		}
583 		break;
584 
585 	case TUNSLMODE:
586 		if (*(int *)data)
587 			tp->tun_flags |= TUN_PREPADDR;
588 		else
589 			tp->tun_flags &= ~TUN_PREPADDR;
590 		break;
591 
592 	case FIONBIO:
593 		if (*(int *)data)
594 			tp->tun_flags |= TUN_NBIO;
595 		else
596 			tp->tun_flags &= ~TUN_NBIO;
597 		break;
598 
599 	case FIOASYNC:
600 		if (*(int *)data)
601 			tp->tun_flags |= TUN_ASYNC;
602 		else
603 			tp->tun_flags &= ~TUN_ASYNC;
604 		break;
605 
606 	case FIONREAD:
607 		s = splnet();
608 		if (tp->tun_if.if_snd.ifq_head)
609 			*(int *)data = tp->tun_if.if_snd.ifq_head->m_pkthdr.len;
610 		else
611 			*(int *)data = 0;
612 		splx(s);
613 		break;
614 
615 	case TIOCSPGRP:
616 		pgid = *(int *)data;
617 		if (pgid != 0) {
618 			error = pgid_in_session(p, pgid);
619 			if (error != 0)
620 				return error;
621 		}
622 		tp->tun_pgrp = pgid;
623 		break;
624 
625 	case TIOCGPGRP:
626 		*(int *)data = tp->tun_pgrp;
627 		break;
628 
629 	default:
630 		simple_unlock(&tp->tun_lock);
631 		return (ENOTTY);
632 	}
633 	simple_unlock(&tp->tun_lock);
634 	return (0);
635 }
636 
637 /*
638  * The cdevsw read interface - reads a packet at a time, or at
639  * least as much of a packet as can be read.
640  */
641 int
642 tunread(dev, uio, ioflag)
643 	dev_t		dev;
644 	struct uio	*uio;
645 	int		ioflag;
646 {
647 	struct tun_softc *tp;
648 	struct ifnet	*ifp;
649 	struct mbuf	*m, *m0;
650 	int		error=0, len, s, index;
651 
652 	tp = tun_find_unit(dev);
653 
654 	/* interface was "destroyed" already */
655 	if (tp == NULL)
656 		return (ENXIO);
657 
658 	index = tp->tun_if.if_index;
659 	ifp = &tp->tun_if;
660 
661 	TUNDEBUG ("%s: read\n", ifp->if_xname);
662 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
663 		TUNDEBUG ("%s: not ready 0%o\n", ifp->if_xname, tp->tun_flags);
664 		simple_unlock(&tp->tun_lock);
665 		return EHOSTDOWN;
666 	}
667 
668 	tp->tun_flags &= ~TUN_RWAIT;
669 
670 	s = splnet();
671 	do {
672 		IFQ_DEQUEUE(&ifp->if_snd, m0);
673 		if (m0 == 0) {
674 			if (tp->tun_flags & TUN_NBIO) {
675 				splx(s);
676 				simple_unlock(&tp->tun_lock);
677 				return (EWOULDBLOCK);
678 			}
679 			tp->tun_flags |= TUN_RWAIT;
680 			simple_unlock(&tp->tun_lock);
681 			if (tsleep((caddr_t)tp, PZERO|PCATCH, "tunread", 0)) {
682 				splx(s);
683 				return (EINTR);
684 			} else {
685 				/*
686 				 * Maybe the interface was destroyed while
687 				 * we were sleeping, so let's ensure that
688 				 * we're looking at the same (valid) tun
689 				 * interface before looping.
690 				 */
691 				tp = tun_find_unit(dev);
692 				if (tp == NULL ||
693 				    tp->tun_if.if_index != index) {
694 					splx(s);
695 					if (tp)
696 						simple_unlock(&tp->tun_lock);
697 					return (ENXIO);
698 				}
699 			}
700 		}
701 	} while (m0 == 0);
702 	splx(s);
703 
704 	while (m0 && uio->uio_resid > 0 && error == 0) {
705 		len = min(uio->uio_resid, m0->m_len);
706 		if (len != 0)
707 			error = uiomove(mtod(m0, caddr_t), len, uio);
708 		MFREE(m0, m);
709 		m0 = m;
710 	}
711 
712 	if (m0) {
713 		TUNDEBUG("Dropping mbuf\n");
714 		m_freem(m0);
715 	}
716 	if (error)
717 		ifp->if_ierrors++;
718 	simple_unlock(&tp->tun_lock);
719 	return (error);
720 }
721 
722 /*
723  * the cdevsw write interface - an atomic write is a packet - or else!
724  */
725 int
726 tunwrite(dev, uio, ioflag)
727 	dev_t		dev;
728 	struct uio	*uio;
729 	int		ioflag;
730 {
731 	struct tun_softc *tp;
732 	struct ifnet	*ifp;
733 	struct mbuf	*top, **mp, *m;
734 	struct ifqueue	*ifq;
735 	struct sockaddr	dst;
736 	int		isr, error=0, s, tlen, mlen;
737 
738 	tp = tun_find_unit(dev);
739 
740 	/* interface was "destroyed" already */
741 	if (tp == NULL)
742 		return (ENXIO);
743 
744 	ifp = &tp->tun_if;
745 
746 	TUNDEBUG("%s: tunwrite\n", ifp->if_xname);
747 
748 	if (tp->tun_flags & TUN_PREPADDR) {
749 		if (uio->uio_resid < sizeof(dst)) {
750 			simple_unlock(&tp->tun_lock);
751 			return (EIO);
752 		}
753 		error = uiomove((caddr_t)&dst, sizeof(dst), uio);
754 		if (dst.sa_len > sizeof(dst)) {
755 			/* Duh.. */
756 			char discard;
757 			int n = dst.sa_len - sizeof(dst);
758 			while (n--)
759 				if ((error = uiomove(&discard, 1, uio)) != 0) {
760 					simple_unlock(&tp->tun_lock);
761 					return (error);
762 				}
763 		}
764 	} else {
765 #ifdef INET
766 		dst.sa_family = AF_INET;
767 #endif
768 	}
769 
770 	if (uio->uio_resid > TUNMTU) {
771 		TUNDEBUG("%s: len=%lu!\n", ifp->if_xname,
772 		    (unsigned long)uio->uio_resid);
773 		simple_unlock(&tp->tun_lock);
774 		return (EIO);
775 	}
776 
777 	switch (dst.sa_family) {
778 #ifdef INET
779 	case AF_INET:
780 		ifq = &ipintrq;
781 		isr = NETISR_IP;
782 		break;
783 #endif
784 	default:
785 		simple_unlock(&tp->tun_lock);
786 		return (EAFNOSUPPORT);
787 	}
788 
789 	tlen = uio->uio_resid;
790 
791 	/* get a header mbuf */
792 	MGETHDR(m, M_DONTWAIT, MT_DATA);
793 	if (m == NULL) {
794 		simple_unlock(&tp->tun_lock);
795 		return (ENOBUFS);
796 	}
797 	mlen = MHLEN;
798 
799 	top = 0;
800 	mp = &top;
801 	while (error == 0 && uio->uio_resid > 0) {
802 		m->m_len = min(mlen, uio->uio_resid);
803 		error = uiomove(mtod (m, caddr_t), m->m_len, uio);
804 		*mp = m;
805 		mp = &m->m_next;
806 		if (uio->uio_resid > 0) {
807 			MGET (m, M_DONTWAIT, MT_DATA);
808 			if (m == 0) {
809 				error = ENOBUFS;
810 				break;
811 			}
812 			mlen = MLEN;
813 		}
814 	}
815 	if (error) {
816 		if (top)
817 			m_freem (top);
818 		ifp->if_ierrors++;
819 		simple_unlock(&tp->tun_lock);
820 		return (error);
821 	}
822 
823 	top->m_pkthdr.len = tlen;
824 	top->m_pkthdr.rcvif = ifp;
825 
826 #if NBPFILTER > 0
827 	if (ifp->if_bpf) {
828 		/*
829 		 * We need to prepend the address family as
830 		 * a four byte field.  Cons up a dummy header
831 		 * to pacify bpf.  This is safe because bpf
832 		 * will only read from the mbuf (i.e., it won't
833 		 * try to free it or keep a pointer to it).
834 		 */
835 		struct mbuf m;
836 		u_int32_t af = AF_INET;
837 
838 		m.m_flags = 0;
839 		m.m_next = top;
840 		m.m_len = sizeof(af);
841 		m.m_data = (char *)&af;
842 
843 		bpf_mtap(ifp->if_bpf, &m);
844 	}
845 #endif
846 
847 	s = splnet();
848 	if (IF_QFULL(ifq)) {
849 		IF_DROP(ifq);
850 		splx(s);
851 		ifp->if_collisions++;
852 		m_freem(top);
853 		simple_unlock(&tp->tun_lock);
854 		return (ENOBUFS);
855 	}
856 	IF_ENQUEUE(ifq, top);
857 	splx(s);
858 	ifp->if_ipackets++;
859 	ifp->if_ibytes += tlen;
860 	schednetisr(isr);
861 	simple_unlock(&tp->tun_lock);
862 	return (error);
863 }
864 
865 #ifdef ALTQ
866 /*
867  * Start packet transmission on the interface.
868  * when the interface queue is rate-limited by ALTQ or TBR,
869  * if_start is needed to drain packets from the queue in order
870  * to notify readers when outgoing packets become ready.
871  */
872 static void
873 tunstart(ifp)
874 	struct ifnet *ifp;
875 {
876 	struct tun_softc *tp = ifp->if_softc;
877 	struct mbuf *m;
878 	struct proc	*p;
879 
880 	if (!ALTQ_IS_ENABLED(&ifp->if_snd) && !TBR_IS_ENABLED(&ifp->if_snd))
881 		return;
882 
883 	IFQ_POLL(&ifp->if_snd, m);
884 	if (m != NULL) {
885 		if (tp->tun_flags & TUN_RWAIT) {
886 			tp->tun_flags &= ~TUN_RWAIT;
887 			wakeup((caddr_t)tp);
888 		}
889 		if (tp->tun_flags & TUN_ASYNC && tp->tun_pgrp) {
890 			if (tp->tun_pgrp > 0)
891 				gsignal(tp->tun_pgrp, SIGIO);
892 			else if ((p = pfind(-tp->tun_pgrp)) != NULL)
893 				psignal(p, SIGIO);
894 		}
895 		selwakeup(&tp->tun_rsel);
896 	}
897 }
898 #endif /* ALTQ */
899 /*
900  * tunpoll - the poll interface, this is only useful on reads
901  * really. The write detect always returns true, write never blocks
902  * anyway, it either accepts the packet or drops it.
903  */
904 int
905 tunpoll(dev, events, p)
906 	dev_t		dev;
907 	int		events;
908 	struct proc	*p;
909 {
910 	struct tun_softc *tp;
911 	struct ifnet	*ifp;
912 	int		s, revents = 0;
913 
914 	tp = tun_find_unit(dev);
915 
916 	/* interface was "destroyed" already */
917 	if (tp == NULL)
918 		return (0);
919 
920 	ifp = &tp->tun_if;
921 
922 	s = splnet();
923 	TUNDEBUG("%s: tunpoll\n", ifp->if_xname);
924 
925 	if (events & (POLLIN | POLLRDNORM)) {
926 		if (IFQ_IS_EMPTY(&ifp->if_snd) == 0) {
927 			TUNDEBUG("%s: tunpoll q=%d\n", ifp->if_xname,
928 			    ifp->if_snd.ifq_len);
929 			revents |= events & (POLLIN | POLLRDNORM);
930 		} else {
931 			TUNDEBUG("%s: tunpoll waiting\n", ifp->if_xname);
932 			selrecord(p, &tp->tun_rsel);
933 		}
934 	}
935 
936 	if (events & (POLLOUT | POLLWRNORM))
937 		revents |= events & (POLLOUT | POLLWRNORM);
938 
939 	splx(s);
940 	simple_unlock(&tp->tun_lock);
941 	return (revents);
942 }
943 
944 static void
945 filt_tunrdetach(struct knote *kn)
946 {
947 	struct tun_softc *tp = kn->kn_hook;
948 	int s;
949 
950 	s = splnet();
951 	SLIST_REMOVE(&tp->tun_rsel.sel_klist, kn, knote, kn_selnext);
952 	splx(s);
953 }
954 
955 static int
956 filt_tunread(struct knote *kn, long hint)
957 {
958 	struct tun_softc *tp = kn->kn_hook;
959 	struct ifnet *ifp = &tp->tun_if;
960 	struct mbuf *m;
961 	int s;
962 
963 	s = splnet();
964 	IF_POLL(&ifp->if_snd, m);
965 	if (m == NULL) {
966 		splx(s);
967 		return (0);
968 	}
969 
970 	for (kn->kn_data = 0; m != NULL; m = m->m_next)
971 		kn->kn_data += m->m_len;
972 
973 	splx(s);
974 	return (1);
975 }
976 
977 static const struct filterops tunread_filtops =
978 	{ 1, NULL, filt_tunrdetach, filt_tunread };
979 
980 static const struct filterops tun_seltrue_filtops =
981 	{ 1, NULL, filt_tunrdetach, filt_seltrue };
982 
983 int
984 tunkqfilter(dev_t dev, struct knote *kn)
985 {
986 	struct tun_softc *tp = tun_find_unit(dev);
987 	struct klist *klist;
988 	int s;
989 
990 	switch (kn->kn_filter) {
991 	case EVFILT_READ:
992 		klist = &tp->tun_rsel.sel_klist;
993 		kn->kn_fop = &tunread_filtops;
994 		break;
995 
996 	case EVFILT_WRITE:
997 		klist = &tp->tun_rsel.sel_klist;
998 		kn->kn_fop = &tun_seltrue_filtops;
999 		break;
1000 
1001 	default:
1002 		return (1);
1003 	}
1004 
1005 	kn->kn_hook = tp;
1006 
1007 	s = splnet();
1008 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1009 	splx(s);
1010 
1011 	return (0);
1012 }
1013