xref: /openbsd-src/sys/net/if_tun.c (revision 505ee9ea3b177e2387d907a91ca7da069f3f14d8)
1 /*	$OpenBSD: if_tun.c,v 1.224 2020/07/10 13:26:42 patrick Exp $	*/
2 /*	$NetBSD: if_tun.c,v 1.24 1996/05/07 02:40:48 thorpej Exp $	*/
3 
4 /*
5  * Copyright (c) 1988, Julian Onions <Julian.Onions@nexor.co.uk>
6  * Nottingham University 1987.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 /*
31  * This driver takes packets off the IP i/f and hands them up to a
32  * user process to have its wicked way with. This driver has its
33  * roots in a similar driver written by Phil Cockcroft (formerly) at
34  * UCL. This driver is based much more on read/write/select mode of
35  * operation though.
36  */
37 
38 /* #define	TUN_DEBUG	9 */
39 
40 #include <sys/param.h>
41 #include <sys/kernel.h>
42 #include <sys/proc.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/protosw.h>
46 #include <sys/sigio.h>
47 #include <sys/socket.h>
48 #include <sys/ioctl.h>
49 #include <sys/errno.h>
50 #include <sys/syslog.h>
51 #include <sys/selinfo.h>
52 #include <sys/fcntl.h>
53 #include <sys/time.h>
54 #include <sys/device.h>
55 #include <sys/vnode.h>
56 #include <sys/signalvar.h>
57 #include <sys/poll.h>
58 #include <sys/conf.h>
59 #include <sys/smr.h>
60 
61 #include <net/if.h>
62 #include <net/if_types.h>
63 #include <net/netisr.h>
64 #include <net/rtable.h>
65 
66 #include <netinet/in.h>
67 #include <netinet/if_ether.h>
68 
69 #include "bpfilter.h"
70 #if NBPFILTER > 0
71 #include <net/bpf.h>
72 #endif
73 
74 #ifdef MPLS
75 #include <netmpls/mpls.h>
76 #endif /* MPLS */
77 
78 #include <net/if_tun.h>
79 
80 struct tun_softc {
81 	struct arpcom		sc_ac;		/* ethernet common data */
82 #define sc_if			sc_ac.ac_if
83 	struct selinfo		sc_rsel;	/* read select */
84 	struct selinfo		sc_wsel;	/* write select (not used) */
85 	SMR_LIST_ENTRY(tun_softc)
86 				sc_entry;	/* all tunnel interfaces */
87 	int			sc_unit;
88 	struct sigio_ref	sc_sigio;	/* async I/O registration */
89 	unsigned int		sc_flags;	/* misc flags */
90 #define TUN_DEAD			(1 << 16)
91 
92 	dev_t			sc_dev;
93 	struct refcnt		sc_refs;
94 	unsigned int		sc_reading;
95 };
96 
97 #ifdef	TUN_DEBUG
98 int	tundebug = TUN_DEBUG;
99 #define TUNDEBUG(a)	(tundebug? printf a : 0)
100 #else
101 #define TUNDEBUG(a)	/* (tundebug? printf a : 0) */
102 #endif
103 
104 /* Only these IFF flags are changeable by TUNSIFINFO */
105 #define TUN_IFF_FLAGS (IFF_UP|IFF_POINTOPOINT|IFF_MULTICAST|IFF_BROADCAST)
106 
107 void	tunattach(int);
108 
109 int	tun_dev_open(dev_t, const struct if_clone *, int, struct proc *);
110 int	tun_dev_close(dev_t, struct proc *);
111 int	tun_dev_ioctl(dev_t, u_long, void *);
112 int	tun_dev_read(dev_t, struct uio *, int);
113 int	tun_dev_write(dev_t, struct uio *, int, int);
114 int	tun_dev_poll(dev_t, int, struct proc *);
115 int	tun_dev_kqfilter(dev_t, struct knote *);
116 
117 int	tun_ioctl(struct ifnet *, u_long, caddr_t);
118 int	tun_input(struct ifnet *, struct mbuf *, void *);
119 int	tun_output(struct ifnet *, struct mbuf *, struct sockaddr *,
120 	    struct rtentry *);
121 int	tun_enqueue(struct ifnet *, struct mbuf *);
122 int	tun_clone_create(struct if_clone *, int);
123 int	tap_clone_create(struct if_clone *, int);
124 int	tun_create(struct if_clone *, int, int);
125 int	tun_clone_destroy(struct ifnet *);
126 void	tun_wakeup(struct tun_softc *);
127 int	tun_init(struct tun_softc *);
128 void	tun_start(struct ifnet *);
129 int	filt_tunread(struct knote *, long);
130 int	filt_tunwrite(struct knote *, long);
131 void	filt_tunrdetach(struct knote *);
132 void	filt_tunwdetach(struct knote *);
133 void	tun_link_state(struct tun_softc *, int);
134 
135 const struct filterops tunread_filtops = {
136 	.f_flags	= FILTEROP_ISFD,
137 	.f_attach	= NULL,
138 	.f_detach	= filt_tunrdetach,
139 	.f_event	= filt_tunread,
140 };
141 
142 const struct filterops tunwrite_filtops = {
143 	.f_flags	= FILTEROP_ISFD,
144 	.f_attach	= NULL,
145 	.f_detach	= filt_tunwdetach,
146 	.f_event	= filt_tunwrite,
147 };
148 
149 SMR_LIST_HEAD(tun_list, tun_softc);
150 
151 struct if_clone tun_cloner =
152     IF_CLONE_INITIALIZER("tun", tun_clone_create, tun_clone_destroy);
153 
154 struct if_clone tap_cloner =
155     IF_CLONE_INITIALIZER("tap", tap_clone_create, tun_clone_destroy);
156 
157 void
158 tunattach(int n)
159 {
160 	if_clone_attach(&tun_cloner);
161 	if_clone_attach(&tap_cloner);
162 }
163 
164 int
165 tun_clone_create(struct if_clone *ifc, int unit)
166 {
167 	return (tun_create(ifc, unit, 0));
168 }
169 
170 int
171 tap_clone_create(struct if_clone *ifc, int unit)
172 {
173 	return (tun_create(ifc, unit, TUN_LAYER2));
174 }
175 
176 struct tun_list tun_devs_list = SMR_LIST_HEAD_INITIALIZER(tun_list);
177 
178 struct tun_softc *
179 tun_name_lookup(const char *name)
180 {
181 	struct tun_softc *sc;
182 
183 	KERNEL_ASSERT_LOCKED();
184 
185 	SMR_LIST_FOREACH_LOCKED(sc, &tun_devs_list, sc_entry) {
186 		if (strcmp(sc->sc_if.if_xname, name) == 0)
187 			return (sc);
188 	}
189 
190 	return (NULL);
191 }
192 
193 int
194 tun_insert(struct tun_softc *sc)
195 {
196 	int error = 0;
197 
198 	/* check for a race */
199 	if (tun_name_lookup(sc->sc_if.if_xname) != NULL)
200 		error = EEXIST;
201 	else {
202 		/* tun_name_lookup checks for the right lock already */
203 		SMR_LIST_INSERT_HEAD_LOCKED(&tun_devs_list, sc, sc_entry);
204 	}
205 
206 	return (error);
207 }
208 
209 int
210 tun_create(struct if_clone *ifc, int unit, int flags)
211 {
212 	struct tun_softc	*sc;
213 	struct ifnet		*ifp;
214 
215 	if (unit > minor(~0U))
216 		return (ENXIO);
217 
218 	KERNEL_ASSERT_LOCKED();
219 
220 	sc = malloc(sizeof(*sc), M_DEVBUF, M_WAITOK|M_ZERO);
221 	ifp = &sc->sc_if;
222 	snprintf(ifp->if_xname, sizeof(ifp->if_xname),
223 	    "%s%d", ifc->ifc_name, unit);
224 	ifp->if_softc = sc;
225 
226 	/* this is enough state for tun_dev_open to work with */
227 
228 	if (tun_insert(sc) != 0)
229 		goto exists;
230 
231 	/* build the interface */
232 
233 	ifp->if_ioctl = tun_ioctl;
234 	ifp->if_enqueue = tun_enqueue;
235 	ifp->if_start = tun_start;
236 	ifp->if_hardmtu = TUNMRU;
237 	ifp->if_link_state = LINK_STATE_DOWN;
238 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
239 
240 	if_counters_alloc(ifp);
241 
242 	if ((flags & TUN_LAYER2) == 0) {
243 		ifp->if_output = tun_output;
244 		ifp->if_mtu = ETHERMTU;
245 		ifp->if_flags = (IFF_POINTOPOINT|IFF_MULTICAST);
246 		ifp->if_type = IFT_TUNNEL;
247 		ifp->if_hdrlen = sizeof(u_int32_t);
248 		ifp->if_rtrequest = p2p_rtrequest;
249 
250 		if_attach(ifp);
251 		if_alloc_sadl(ifp);
252 
253 #if NBPFILTER > 0
254 		bpfattach(&ifp->if_bpf, ifp, DLT_LOOP, sizeof(u_int32_t));
255 #endif
256 
257 		if_ih_insert(ifp, tun_input, NULL);
258 	} else {
259 		sc->sc_flags |= TUN_LAYER2;
260 		ether_fakeaddr(ifp);
261 		ifp->if_flags =
262 		    (IFF_BROADCAST|IFF_SIMPLEX|IFF_MULTICAST);
263 
264 		if_attach(ifp);
265 		ether_ifattach(ifp);
266 	}
267 
268 	sigio_init(&sc->sc_sigio);
269 	refcnt_init(&sc->sc_refs);
270 
271 	/* tell tun_dev_open we're initialised */
272 
273 	sc->sc_flags |= TUN_INITED|TUN_STAYUP;
274 	wakeup(sc);
275 
276 	return (0);
277 
278 exists:
279 	free(sc, M_DEVBUF, sizeof(*sc));
280 	return (EEXIST);
281 }
282 
283 int
284 tun_clone_destroy(struct ifnet *ifp)
285 {
286 	struct tun_softc	*sc = ifp->if_softc;
287 	dev_t			 dev;
288 	int			 s;
289 
290 	KERNEL_ASSERT_LOCKED();
291 
292 	if (ISSET(sc->sc_flags, TUN_DEAD))
293 		return (ENXIO);
294 	SET(sc->sc_flags, TUN_DEAD);
295 
296 	/* kick userland off the device */
297 	dev = sc->sc_dev;
298 	if (dev) {
299 		struct vnode *vp;
300 
301 		if (vfinddev(dev, VCHR, &vp))
302                         VOP_REVOKE(vp, REVOKEALL);
303 
304 		KASSERT(sc->sc_dev == 0);
305 	}
306 
307 	/* prevent userland from getting to the device again */
308 	SMR_LIST_REMOVE_LOCKED(sc, sc_entry);
309 	smr_barrier();
310 
311 	/* help read() give up */
312 	if (sc->sc_reading)
313 		wakeup(&ifp->if_snd);
314 
315 	/* wait for device entrypoints to finish */
316 	refcnt_finalize(&sc->sc_refs, "tundtor");
317 
318 	s = splhigh();
319 	klist_invalidate(&sc->sc_rsel.si_note);
320 	klist_invalidate(&sc->sc_wsel.si_note);
321 	splx(s);
322 
323 	if (!ISSET(sc->sc_flags, TUN_LAYER2))
324 		if_ih_remove(ifp, tun_input, NULL);
325 	else
326 		ether_ifdetach(ifp);
327 
328 	if_detach(ifp);
329 	sigio_free(&sc->sc_sigio);
330 
331 	free(sc, M_DEVBUF, sizeof *sc);
332 	return (0);
333 }
334 
335 static struct tun_softc *
336 tun_get(dev_t dev)
337 {
338 	struct tun_softc *sc;
339 
340 	smr_read_enter();
341 	SMR_LIST_FOREACH(sc, &tun_devs_list, sc_entry) {
342 		if (sc->sc_dev == dev) {
343 			refcnt_take(&sc->sc_refs);
344 			break;
345 		}
346 	}
347 	smr_read_leave();
348 
349 	return (sc);
350 }
351 
352 static inline void
353 tun_put(struct tun_softc *sc)
354 {
355 	refcnt_rele_wake(&sc->sc_refs);
356 }
357 
358 int
359 tunopen(dev_t dev, int flag, int mode, struct proc *p)
360 {
361 	return (tun_dev_open(dev, &tun_cloner, mode, p));
362 }
363 
364 int
365 tapopen(dev_t dev, int flag, int mode, struct proc *p)
366 {
367 	return (tun_dev_open(dev, &tap_cloner, mode, p));
368 }
369 
370 int
371 tun_dev_open(dev_t dev, const struct if_clone *ifc, int mode, struct proc *p)
372 {
373 	struct tun_softc *sc;
374 	struct ifnet *ifp;
375 	int error;
376 	u_short stayup = 0;
377 
378 	char name[IFNAMSIZ];
379 	unsigned int rdomain;
380 
381 	snprintf(name, sizeof(name), "%s%u", ifc->ifc_name, minor(dev));
382 	rdomain = rtable_l2(p->p_p->ps_rtableid);
383 
384 	/* let's find or make an interface to work with */
385 	while ((ifp = ifunit(name)) == NULL) {
386 		error = if_clone_create(name, rdomain);
387 		switch (error) {
388 		case 0: /* it's probably ours */
389 			stayup = TUN_STAYUP;
390 			/* FALLTHROUGH */
391 		case EEXIST: /* we may have lost a race with someone else */
392 			break;
393 		default:
394 			return (error);
395 		}
396 	}
397 
398 	sc = ifp->if_softc;
399 	/* wait for it to be fully constructed before we use it */
400 	while (!ISSET(sc->sc_flags, TUN_INITED)) {
401 		error = tsleep_nsec(sc, PCATCH, "tuninit", INFSLP);
402 		if (error != 0) {
403 			/* XXX if_clone_destroy if stayup? */
404 			return (error);
405 		}
406 	}
407 
408 	if (sc->sc_dev != 0) {
409 		/* aww, we lost */
410 		return (EBUSY);
411 	}
412 	/* it's ours now */
413 	sc->sc_dev = dev;
414 	CLR(sc->sc_flags, stayup);
415 
416 	/* automatically mark the interface running on open */
417 	SET(ifp->if_flags, IFF_UP | IFF_RUNNING);
418 	tun_link_state(sc, LINK_STATE_FULL_DUPLEX);
419 
420 	return (0);
421 }
422 
423 /*
424  * tunclose - close the device; if closing the real device, flush pending
425  *  output and unless STAYUP bring down and destroy the interface.
426  */
427 int
428 tunclose(dev_t dev, int flag, int mode, struct proc *p)
429 {
430 	return (tun_dev_close(dev, p));
431 }
432 
433 int
434 tapclose(dev_t dev, int flag, int mode, struct proc *p)
435 {
436 	return (tun_dev_close(dev, p));
437 }
438 
439 int
440 tun_dev_close(dev_t dev, struct proc *p)
441 {
442 	struct tun_softc	*sc;
443 	struct ifnet		*ifp;
444 	int			 error = 0;
445 	char			 name[IFNAMSIZ];
446 	int			 destroy = 0;
447 
448 	sc = tun_get(dev);
449 	if (sc == NULL)
450 		return (ENXIO);
451 
452 	ifp = &sc->sc_if;
453 
454 	/*
455 	 * junk all pending output
456 	 */
457 	CLR(ifp->if_flags, IFF_UP | IFF_RUNNING);
458 	ifq_purge(&ifp->if_snd);
459 
460 	CLR(sc->sc_flags, TUN_ASYNC);
461 	selwakeup(&sc->sc_rsel);
462 	sigio_free(&sc->sc_sigio);
463 
464 	if (!ISSET(sc->sc_flags, TUN_DEAD)) {
465 		/* we can't hold a reference to sc before we start a dtor */
466 		if (!ISSET(sc->sc_flags, TUN_STAYUP)) {
467 			destroy = 1;
468 			strlcpy(name, ifp->if_xname, sizeof(name));
469 		} else {
470 			CLR(ifp->if_flags, IFF_UP | IFF_RUNNING);
471 			tun_link_state(sc, LINK_STATE_DOWN);
472 		}
473 	}
474 
475 	sc->sc_dev = 0;
476 
477 	tun_put(sc);
478 
479 	if (destroy)
480 		if_clone_destroy(name);
481 
482 	return (error);
483 }
484 
485 int
486 tun_init(struct tun_softc *sc)
487 {
488 	struct ifnet	*ifp = &sc->sc_if;
489 	struct ifaddr	*ifa;
490 
491 	TUNDEBUG(("%s: tun_init\n", ifp->if_xname));
492 
493 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
494 
495 	sc->sc_flags &= ~(TUN_IASET|TUN_DSTADDR|TUN_BRDADDR);
496 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
497 		if (ifa->ifa_addr->sa_family == AF_INET) {
498 			struct sockaddr_in *sin;
499 
500 			sin = satosin(ifa->ifa_addr);
501 			if (sin && sin->sin_addr.s_addr)
502 				sc->sc_flags |= TUN_IASET;
503 
504 			if (ifp->if_flags & IFF_POINTOPOINT) {
505 				sin = satosin(ifa->ifa_dstaddr);
506 				if (sin && sin->sin_addr.s_addr)
507 					sc->sc_flags |= TUN_DSTADDR;
508 			} else
509 				sc->sc_flags &= ~TUN_DSTADDR;
510 
511 			if (ifp->if_flags & IFF_BROADCAST) {
512 				sin = satosin(ifa->ifa_broadaddr);
513 				if (sin && sin->sin_addr.s_addr)
514 					sc->sc_flags |= TUN_BRDADDR;
515 			} else
516 				sc->sc_flags &= ~TUN_BRDADDR;
517 		}
518 #ifdef INET6
519 		if (ifa->ifa_addr->sa_family == AF_INET6) {
520 			struct sockaddr_in6 *sin6;
521 
522 			sin6 = satosin6(ifa->ifa_addr);
523 			if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
524 				sc->sc_flags |= TUN_IASET;
525 
526 			if (ifp->if_flags & IFF_POINTOPOINT) {
527 				sin6 = satosin6(ifa->ifa_dstaddr);
528 				if (sin6 &&
529 				    !IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
530 					sc->sc_flags |= TUN_DSTADDR;
531 			} else
532 				sc->sc_flags &= ~TUN_DSTADDR;
533 		}
534 #endif /* INET6 */
535 	}
536 
537 	return (0);
538 }
539 
540 /*
541  * Process an ioctl request.
542  */
543 int
544 tun_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
545 {
546 	struct tun_softc	*sc = (struct tun_softc *)(ifp->if_softc);
547 	struct ifreq		*ifr = (struct ifreq *)data;
548 	int			 error = 0;
549 
550 	switch (cmd) {
551 	case SIOCSIFADDR:
552 		tun_init(sc);
553 		break;
554 	case SIOCSIFFLAGS:
555 		if (ISSET(ifp->if_flags, IFF_UP))
556 			SET(ifp->if_flags, IFF_RUNNING);
557 		else
558 			CLR(ifp->if_flags, IFF_RUNNING);
559 		break;
560 
561 	case SIOCSIFDSTADDR:
562 		tun_init(sc);
563 		TUNDEBUG(("%s: destination address set\n", ifp->if_xname));
564 		break;
565 	case SIOCSIFMTU:
566 		if (ifr->ifr_mtu < ETHERMIN || ifr->ifr_mtu > TUNMRU)
567 			error = EINVAL;
568 		else
569 			ifp->if_mtu = ifr->ifr_mtu;
570 		break;
571 	case SIOCADDMULTI:
572 	case SIOCDELMULTI:
573 		break;
574 	default:
575 		if (sc->sc_flags & TUN_LAYER2)
576 			error = ether_ioctl(ifp, &sc->sc_ac, cmd, data);
577 		else
578 			error = ENOTTY;
579 	}
580 
581 	return (error);
582 }
583 
584 /*
585  * tun_output - queue packets from higher level ready to put out.
586  */
587 int
588 tun_output(struct ifnet *ifp, struct mbuf *m0, struct sockaddr *dst,
589     struct rtentry *rt)
590 {
591 	u_int32_t		*af;
592 
593 	if (!ISSET(ifp->if_flags, IFF_RUNNING)) {
594 		m_freem(m0);
595 		return (EHOSTDOWN);
596 	}
597 
598 	M_PREPEND(m0, sizeof(*af), M_DONTWAIT);
599 	if (m0 == NULL)
600 		return (ENOBUFS);
601 	af = mtod(m0, u_int32_t *);
602 	*af = htonl(dst->sa_family);
603 
604 	return (if_enqueue(ifp, m0));
605 }
606 
607 int
608 tun_enqueue(struct ifnet *ifp, struct mbuf *m0)
609 {
610 	struct tun_softc	*sc = ifp->if_softc;
611 	int			 error;
612 
613 	error = ifq_enqueue(&ifp->if_snd, m0);
614 	if (error != 0)
615 		return (error);
616 
617 	tun_wakeup(sc);
618 
619 	return (0);
620 }
621 
622 void
623 tun_wakeup(struct tun_softc *sc)
624 {
625 	if (sc->sc_reading)
626 		wakeup(&sc->sc_if.if_snd);
627 
628 	selwakeup(&sc->sc_rsel);
629 	if (sc->sc_flags & TUN_ASYNC)
630 		pgsigio(&sc->sc_sigio, SIGIO, 0);
631 }
632 
633 /*
634  * the cdevsw interface is now pretty minimal.
635  */
636 int
637 tunioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
638 {
639 	return (tun_dev_ioctl(dev, cmd, data));
640 }
641 
642 int
643 tapioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
644 {
645 	return (tun_dev_ioctl(dev, cmd, data));
646 }
647 
648 int
649 tun_dev_ioctl(dev_t dev, u_long cmd, void *data)
650 {
651 	struct tun_softc	*sc;
652 	struct tuninfo		*tunp;
653 	int			 error = 0;
654 
655 	sc = tun_get(dev);
656 	if (sc == NULL)
657 		return (ENXIO);
658 
659 	switch (cmd) {
660 	case TUNSIFINFO:
661 		tunp = (struct tuninfo *)data;
662 		if (tunp->mtu < ETHERMIN || tunp->mtu > TUNMRU) {
663 			error = EINVAL;
664 			break;
665 		}
666 		if (tunp->type != sc->sc_if.if_type) {
667 			error = EINVAL;
668 			break;
669 		}
670 		sc->sc_if.if_mtu = tunp->mtu;
671 		sc->sc_if.if_flags =
672 		    (tunp->flags & TUN_IFF_FLAGS) |
673 		    (sc->sc_if.if_flags & ~TUN_IFF_FLAGS);
674 		sc->sc_if.if_baudrate = tunp->baudrate;
675 		break;
676 	case TUNGIFINFO:
677 		tunp = (struct tuninfo *)data;
678 		tunp->mtu = sc->sc_if.if_mtu;
679 		tunp->type = sc->sc_if.if_type;
680 		tunp->flags = sc->sc_if.if_flags;
681 		tunp->baudrate = sc->sc_if.if_baudrate;
682 		break;
683 #ifdef TUN_DEBUG
684 	case TUNSDEBUG:
685 		tundebug = *(int *)data;
686 		break;
687 	case TUNGDEBUG:
688 		*(int *)data = tundebug;
689 		break;
690 #endif
691 	case TUNSIFMODE:
692 		switch (*(int *)data & (IFF_POINTOPOINT|IFF_BROADCAST)) {
693 		case IFF_POINTOPOINT:
694 		case IFF_BROADCAST:
695 			sc->sc_if.if_flags &= ~TUN_IFF_FLAGS;
696 			sc->sc_if.if_flags |= *(int *)data & TUN_IFF_FLAGS;
697 			break;
698 		default:
699 			error = EINVAL;
700 			break;
701 		}
702 		break;
703 
704 	case FIONBIO:
705 		break;
706 	case FIOASYNC:
707 		if (*(int *)data)
708 			sc->sc_flags |= TUN_ASYNC;
709 		else
710 			sc->sc_flags &= ~TUN_ASYNC;
711 		break;
712 	case FIONREAD:
713 		*(int *)data = ifq_hdatalen(&sc->sc_if.if_snd);
714 		break;
715 	case FIOSETOWN:
716 	case TIOCSPGRP:
717 		return (sigio_setown(&sc->sc_sigio, cmd, data));
718 	case FIOGETOWN:
719 	case TIOCGPGRP:
720 		sigio_getown(&sc->sc_sigio, cmd, data);
721 		break;
722 	case SIOCGIFADDR:
723 		if (!(sc->sc_flags & TUN_LAYER2)) {
724 			error = EINVAL;
725 			break;
726 		}
727 		bcopy(sc->sc_ac.ac_enaddr, data,
728 		    sizeof(sc->sc_ac.ac_enaddr));
729 		break;
730 
731 	case SIOCSIFADDR:
732 		if (!(sc->sc_flags & TUN_LAYER2)) {
733 			error = EINVAL;
734 			break;
735 		}
736 		bcopy(data, sc->sc_ac.ac_enaddr,
737 		    sizeof(sc->sc_ac.ac_enaddr));
738 		break;
739 	default:
740 		error = ENOTTY;
741 		break;
742 	}
743 
744 	tun_put(sc);
745 	return (error);
746 }
747 
748 /*
749  * The cdevsw read interface - reads a packet at a time, or at
750  * least as much of a packet as can be read.
751  */
752 int
753 tunread(dev_t dev, struct uio *uio, int ioflag)
754 {
755 	return (tun_dev_read(dev, uio, ioflag));
756 }
757 
758 int
759 tapread(dev_t dev, struct uio *uio, int ioflag)
760 {
761 	return (tun_dev_read(dev, uio, ioflag));
762 }
763 
764 int
765 tun_dev_read(dev_t dev, struct uio *uio, int ioflag)
766 {
767 	struct tun_softc	*sc;
768 	struct ifnet		*ifp;
769 	struct mbuf		*m, *m0;
770 	int			 error = 0;
771 
772 	sc = tun_get(dev);
773 	if (sc == NULL)
774 		return (ENXIO);
775 
776 	ifp = &sc->sc_if;
777 
778 	error = ifq_deq_sleep(&ifp->if_snd, &m0, ISSET(ioflag, IO_NDELAY),
779 	    (PZERO + 1)|PCATCH, "tunread", &sc->sc_reading, &sc->sc_dev);
780 	if (error != 0)
781 		goto put;
782 
783 #if NBPFILTER > 0
784 	if (ifp->if_bpf)
785 		bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
786 #endif
787 
788 	m = m0;
789 	while (uio->uio_resid > 0) {
790 		size_t len = ulmin(uio->uio_resid, m->m_len);
791 		if (len > 0) {
792 			error = uiomove(mtod(m, void *), len, uio);
793 			if (error != 0)
794 				break;
795 		}
796 
797 		m = m->m_next;
798 		if (m == NULL)
799 			break;
800 	}
801 
802 	m_freem(m0);
803 
804 put:
805 	tun_put(sc);
806 	return (error);
807 }
808 
809 /*
810  * the cdevsw write interface - an atomic write is a packet - or else!
811  */
812 int
813 tunwrite(dev_t dev, struct uio *uio, int ioflag)
814 {
815 	return (tun_dev_write(dev, uio, ioflag, 0));
816 }
817 
818 int
819 tapwrite(dev_t dev, struct uio *uio, int ioflag)
820 {
821 	return (tun_dev_write(dev, uio, ioflag, ETHER_ALIGN));
822 }
823 
824 int
825 tun_dev_write(dev_t dev, struct uio *uio, int ioflag, int align)
826 {
827 	struct tun_softc	*sc;
828 	struct ifnet		*ifp;
829 	struct mbuf		*m0;
830 	int			error = 0;
831 	size_t			mlen;
832 
833 	sc = tun_get(dev);
834 	if (sc == NULL)
835 		return (ENXIO);
836 
837 	ifp = &sc->sc_if;
838 
839 	if (uio->uio_resid < ifp->if_hdrlen ||
840 	    uio->uio_resid > (ifp->if_hdrlen + ifp->if_hardmtu)) {
841 		error = EMSGSIZE;
842 		goto put;
843 	}
844 
845 	align += max_linkhdr;
846 	mlen = align + uio->uio_resid;
847 
848 	m0 = m_gethdr(M_DONTWAIT, MT_DATA);
849 	if (m0 == NULL) {
850 		error = ENOMEM;
851 		goto put;
852 	}
853 	if (mlen > MHLEN) {
854 		m_clget(m0, M_DONTWAIT, mlen);
855 		if (!ISSET(m0->m_flags, M_EXT)) {
856 			error = ENOMEM;
857 			goto drop;
858 		}
859 	}
860 
861 	m_align(m0, mlen);
862 	m0->m_pkthdr.len = m0->m_len = mlen;
863 	m_adj(m0, align);
864 
865 	error = uiomove(mtod(m0, void *), m0->m_len, uio);
866 	if (error != 0)
867 		goto drop;
868 
869 	NET_LOCK();
870 	if_vinput(ifp, m0);
871 	NET_UNLOCK();
872 
873 	tun_put(sc);
874 	return (0);
875 
876 drop:
877 	m_freem(m0);
878 put:
879 	tun_put(sc);
880 	return (error);
881 }
882 
883 int
884 tun_input(struct ifnet *ifp, struct mbuf *m0, void *cookie)
885 {
886 	uint32_t		af;
887 
888 	KASSERT(m0->m_len >= sizeof(af));
889 
890 	af = *mtod(m0, uint32_t *);
891 	/* strip the tunnel header */
892 	m_adj(m0, sizeof(af));
893 
894 	switch (ntohl(af)) {
895 	case AF_INET:
896 		ipv4_input(ifp, m0);
897 		break;
898 #ifdef INET6
899 	case AF_INET6:
900 		ipv6_input(ifp, m0);
901 		break;
902 #endif
903 #ifdef MPLS
904 	case AF_MPLS:
905 		mpls_input(ifp, m0);
906 		break;
907 #endif
908 	default:
909 		m_freem(m0);
910 		break;
911 	}
912 
913 	return (1);
914 }
915 
916 /*
917  * tunpoll - the poll interface, this is only useful on reads
918  * really. The write detect always returns true, write never blocks
919  * anyway, it either accepts the packet or drops it.
920  */
921 int
922 tunpoll(dev_t dev, int events, struct proc *p)
923 {
924 	return (tun_dev_poll(dev, events, p));
925 }
926 
927 int
928 tappoll(dev_t dev, int events, struct proc *p)
929 {
930 	return (tun_dev_poll(dev, events, p));
931 }
932 
933 int
934 tun_dev_poll(dev_t dev, int events, struct proc *p)
935 {
936 	struct tun_softc	*sc;
937 	struct ifnet		*ifp;
938 	int			 revents;
939 
940 	sc = tun_get(dev);
941 	if (sc == NULL)
942 		return (POLLERR);
943 
944 	ifp = &sc->sc_if;
945 	revents = 0;
946 
947 	if (events & (POLLIN | POLLRDNORM)) {
948 		if (!ifq_empty(&ifp->if_snd))
949 			revents |= events & (POLLIN | POLLRDNORM);
950 		else
951 			selrecord(p, &sc->sc_rsel);
952 	}
953 	if (events & (POLLOUT | POLLWRNORM))
954 		revents |= events & (POLLOUT | POLLWRNORM);
955 
956 	tun_put(sc);
957 	return (revents);
958 }
959 
960 int
961 tunkqfilter(dev_t dev, struct knote *kn)
962 {
963 	return (tun_dev_kqfilter(dev, kn));
964 }
965 
966 int
967 tapkqfilter(dev_t dev, struct knote *kn)
968 {
969 	return (tun_dev_kqfilter(dev, kn));
970 }
971 
972 int
973 tun_dev_kqfilter(dev_t dev, struct knote *kn)
974 {
975 	struct tun_softc	*sc;
976 	struct ifnet		*ifp;
977 	struct klist		*klist;
978 	int			 error = 0;
979 	int			 s;
980 
981 	sc = tun_get(dev);
982 	if (sc == NULL)
983 		return (ENXIO);
984 
985 	ifp = &sc->sc_if;
986 
987 	switch (kn->kn_filter) {
988 	case EVFILT_READ:
989 		klist = &sc->sc_rsel.si_note;
990 		kn->kn_fop = &tunread_filtops;
991 		break;
992 	case EVFILT_WRITE:
993 		klist = &sc->sc_wsel.si_note;
994 		kn->kn_fop = &tunwrite_filtops;
995 		break;
996 	default:
997 		error = EINVAL;
998 		goto put;
999 	}
1000 
1001 	kn->kn_hook = (caddr_t)sc; /* XXX give the sc_ref to the hook? */
1002 
1003 	s = splhigh();
1004 	klist_insert(klist, kn);
1005 	splx(s);
1006 
1007 put:
1008 	tun_put(sc);
1009 	return (error);
1010 }
1011 
1012 void
1013 filt_tunrdetach(struct knote *kn)
1014 {
1015 	int			 s;
1016 	struct tun_softc	*sc = kn->kn_hook;
1017 
1018 	s = splhigh();
1019 	klist_remove(&sc->sc_rsel.si_note, kn);
1020 	splx(s);
1021 }
1022 
1023 int
1024 filt_tunread(struct knote *kn, long hint)
1025 {
1026 	struct tun_softc	*sc = kn->kn_hook;
1027 	struct ifnet		*ifp = &sc->sc_if;
1028 
1029 	kn->kn_data = ifq_hdatalen(&ifp->if_snd);
1030 
1031 	return (kn->kn_data > 0);
1032 }
1033 
1034 void
1035 filt_tunwdetach(struct knote *kn)
1036 {
1037 	int			 s;
1038 	struct tun_softc	*sc = kn->kn_hook;
1039 
1040 	s = splhigh();
1041 	klist_remove(&sc->sc_wsel.si_note, kn);
1042 	splx(s);
1043 }
1044 
1045 int
1046 filt_tunwrite(struct knote *kn, long hint)
1047 {
1048 	struct tun_softc	*sc = kn->kn_hook;
1049 	struct ifnet		*ifp = &sc->sc_if;
1050 
1051 	kn->kn_data = ifp->if_hdrlen + ifp->if_hardmtu;
1052 
1053 	return (1);
1054 }
1055 
1056 void
1057 tun_start(struct ifnet *ifp)
1058 {
1059 	struct tun_softc	*sc = ifp->if_softc;
1060 
1061 	splassert(IPL_NET);
1062 
1063 	if (ifq_len(&ifp->if_snd))
1064 		tun_wakeup(sc);
1065 }
1066 
1067 void
1068 tun_link_state(struct tun_softc *sc, int link_state)
1069 {
1070 	struct ifnet *ifp = &sc->sc_if;
1071 
1072 	if (ifp->if_link_state != link_state) {
1073 		ifp->if_link_state = link_state;
1074 		if_link_state_change(ifp);
1075 	}
1076 }
1077