xref: /openbsd-src/sys/net/if_tun.c (revision 7350f337b9e3eb4461d99580e625c7ef148d107c)
1 /*	$OpenBSD: if_tun.c,v 1.187 2019/06/10 21:55:16 dlg Exp $	*/
2 /*	$NetBSD: if_tun.c,v 1.24 1996/05/07 02:40:48 thorpej Exp $	*/
3 
4 /*
5  * Copyright (c) 1988, Julian Onions <Julian.Onions@nexor.co.uk>
6  * Nottingham University 1987.
7  * All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28  */
29 
30 /*
31  * This driver takes packets off the IP i/f and hands them up to a
32  * user process to have its wicked way with. This driver has its
33  * roots in a similar driver written by Phil Cockcroft (formerly) at
34  * UCL. This driver is based much more on read/write/select mode of
35  * operation though.
36  */
37 
38 /* #define	TUN_DEBUG	9 */
39 
40 #include <sys/param.h>
41 #include <sys/kernel.h>
42 #include <sys/proc.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/protosw.h>
46 #include <sys/socket.h>
47 #include <sys/ioctl.h>
48 #include <sys/errno.h>
49 #include <sys/syslog.h>
50 #include <sys/selinfo.h>
51 #include <sys/fcntl.h>
52 #include <sys/time.h>
53 #include <sys/device.h>
54 #include <sys/vnode.h>
55 #include <sys/signalvar.h>
56 #include <sys/poll.h>
57 #include <sys/conf.h>
58 
59 
60 #include <net/if.h>
61 #include <net/if_types.h>
62 #include <net/netisr.h>
63 #include <net/rtable.h>
64 
65 #include <netinet/in.h>
66 #include <netinet/if_ether.h>
67 
68 #ifdef PIPEX
69 #include <net/pipex.h>
70 #endif
71 
72 #include "bpfilter.h"
73 #if NBPFILTER > 0
74 #include <net/bpf.h>
75 #endif
76 
77 #ifdef MPLS
78 #include <netmpls/mpls.h>
79 #endif /* MPLS */
80 
81 #include <net/if_tun.h>
82 
83 struct tun_softc {
84 	struct arpcom	arpcom;		/* ethernet common data */
85 	struct selinfo	tun_rsel;	/* read select */
86 	struct selinfo	tun_wsel;	/* write select (not used) */
87 	LIST_ENTRY(tun_softc) entry;	/* all tunnel interfaces */
88 	int		tun_unit;
89 	uid_t		tun_siguid;	/* uid for process that set tun_pgid */
90 	uid_t		tun_sigeuid;	/* euid for process that set tun_pgid */
91 	pid_t		tun_pgid;	/* the process group - if any */
92 	u_short		tun_flags;	/* misc flags */
93 #define tun_if	arpcom.ac_if
94 #ifdef PIPEX
95 	struct pipex_iface_context pipex_iface; /* pipex context */
96 #endif
97 };
98 
99 #ifdef	TUN_DEBUG
100 int	tundebug = TUN_DEBUG;
101 #define TUNDEBUG(a)	(tundebug? printf a : 0)
102 #else
103 #define TUNDEBUG(a)	/* (tundebug? printf a : 0) */
104 #endif
105 
106 /* Only these IFF flags are changeable by TUNSIFINFO */
107 #define TUN_IFF_FLAGS (IFF_UP|IFF_POINTOPOINT|IFF_MULTICAST|IFF_BROADCAST)
108 
109 void	tunattach(int);
110 
111 /* cdev functions */
112 int	tunopen(dev_t, int, int, struct proc *);
113 int	tunclose(dev_t, int, int, struct proc *);
114 int	tunioctl(dev_t, u_long, caddr_t, int, struct proc *);
115 int	tunread(dev_t, struct uio *, int);
116 int	tunwrite(dev_t, struct uio *, int);
117 int	tunpoll(dev_t, int, struct proc *);
118 int	tunkqfilter(dev_t, struct knote *);
119 
120 int	tapopen(dev_t, int, int, struct proc *);
121 int	tapclose(dev_t, int, int, struct proc *);
122 int	tapioctl(dev_t, u_long, caddr_t, int, struct proc *);
123 int	tapread(dev_t, struct uio *, int);
124 int	tapwrite(dev_t, struct uio *, int);
125 int	tappoll(dev_t, int, struct proc *);
126 int	tapkqfilter(dev_t, struct knote *);
127 
128 int	tun_dev_open(struct tun_softc *, int, int, struct proc *);
129 int	tun_dev_close(struct tun_softc *, int, int, struct proc *);
130 int	tun_dev_ioctl(struct tun_softc *, u_long, caddr_t, int, struct proc *);
131 int	tun_dev_read(struct tun_softc *, struct uio *, int);
132 int	tun_dev_write(struct tun_softc *, struct uio *, int);
133 int	tun_dev_poll(struct tun_softc *, int, struct proc *);
134 int	tun_dev_kqfilter(struct tun_softc *, struct knote *);
135 
136 
137 int	tun_ioctl(struct ifnet *, u_long, caddr_t);
138 int	tun_output(struct ifnet *, struct mbuf *, struct sockaddr *,
139 	    struct rtentry *);
140 int	tun_clone_create(struct if_clone *, int);
141 int	tap_clone_create(struct if_clone *, int);
142 int	tun_create(struct if_clone *, int, int);
143 int	tun_clone_destroy(struct ifnet *);
144 static inline struct	tun_softc *tun_lookup(int);
145 static inline struct	tun_softc *tap_lookup(int);
146 void	tun_wakeup(struct tun_softc *);
147 int	tun_init(struct tun_softc *);
148 void	tun_start(struct ifnet *);
149 int	filt_tunread(struct knote *, long);
150 int	filt_tunwrite(struct knote *, long);
151 void	filt_tunrdetach(struct knote *);
152 void	filt_tunwdetach(struct knote *);
153 void	tun_link_state(struct tun_softc *);
154 
155 struct filterops tunread_filtops =
156 	{ 1, NULL, filt_tunrdetach, filt_tunread};
157 
158 struct filterops tunwrite_filtops =
159 	{ 1, NULL, filt_tunwdetach, filt_tunwrite};
160 
161 LIST_HEAD(, tun_softc) tun_softc_list;
162 LIST_HEAD(, tun_softc) tap_softc_list;
163 
164 struct if_clone tun_cloner =
165     IF_CLONE_INITIALIZER("tun", tun_clone_create, tun_clone_destroy);
166 
167 struct if_clone tap_cloner =
168     IF_CLONE_INITIALIZER("tap", tap_clone_create, tun_clone_destroy);
169 
170 void
171 tunattach(int n)
172 {
173 	LIST_INIT(&tun_softc_list);
174 	LIST_INIT(&tap_softc_list);
175 	if_clone_attach(&tun_cloner);
176 	if_clone_attach(&tap_cloner);
177 #ifdef PIPEX
178 	pipex_init();
179 #endif
180 }
181 
182 int
183 tun_clone_create(struct if_clone *ifc, int unit)
184 {
185 	return (tun_create(ifc, unit, 0));
186 }
187 
188 int
189 tap_clone_create(struct if_clone *ifc, int unit)
190 {
191 	return (tun_create(ifc, unit, TUN_LAYER2));
192 }
193 
194 int
195 tun_create(struct if_clone *ifc, int unit, int flags)
196 {
197 	struct tun_softc	*tp;
198 	struct ifnet		*ifp;
199 
200 	if (unit > minor(~0U))
201 		return (ENXIO);
202 
203 	tp = malloc(sizeof(*tp), M_DEVBUF, M_WAITOK|M_ZERO);
204 	tp->tun_unit = unit;
205 	tp->tun_flags = TUN_INITED|TUN_STAYUP;
206 
207 	ifp = &tp->tun_if;
208 	snprintf(ifp->if_xname, sizeof(ifp->if_xname), "%s%d", ifc->ifc_name,
209 	    unit);
210 	ifp->if_softc = tp;
211 
212 	ifp->if_ioctl = tun_ioctl;
213 	ifp->if_output = tun_output;
214 	ifp->if_start = tun_start;
215 	ifp->if_hardmtu = TUNMRU;
216 	ifp->if_link_state = LINK_STATE_DOWN;
217 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
218 
219 	if ((flags & TUN_LAYER2) == 0) {
220 		tp->tun_flags &= ~TUN_LAYER2;
221 		ifp->if_mtu = ETHERMTU;
222 		ifp->if_flags = (IFF_POINTOPOINT|IFF_MULTICAST);
223 		ifp->if_type = IFT_TUNNEL;
224 		ifp->if_hdrlen = sizeof(u_int32_t);
225 		ifp->if_rtrequest = p2p_rtrequest;
226 
227 		if_attach(ifp);
228 		if_alloc_sadl(ifp);
229 #if NBPFILTER > 0
230 		bpfattach(&ifp->if_bpf, ifp, DLT_LOOP, sizeof(u_int32_t));
231 #endif
232 		LIST_INSERT_HEAD(&tun_softc_list, tp, entry);
233 	} else {
234 		tp->tun_flags |= TUN_LAYER2;
235 		ether_fakeaddr(ifp);
236 		ifp->if_flags =
237 		    (IFF_BROADCAST|IFF_SIMPLEX|IFF_MULTICAST);
238 		ifp->if_capabilities = IFCAP_VLAN_MTU;
239 
240 		if_attach(ifp);
241 		ether_ifattach(ifp);
242 
243 		LIST_INSERT_HEAD(&tap_softc_list, tp, entry);
244 	}
245 
246 #ifdef PIPEX
247 	if ((tp->tun_flags & TUN_LAYER2) == 0)
248 		pipex_iface_init(&tp->pipex_iface, ifp);
249 #endif
250 
251 	return (0);
252 }
253 
254 int
255 tun_clone_destroy(struct ifnet *ifp)
256 {
257 	struct tun_softc	*tp = ifp->if_softc;
258 	int			 s;
259 
260 #ifdef PIPEX
261 	if ((tp->tun_flags & TUN_LAYER2) == 0)
262 		pipex_iface_fini(&tp->pipex_iface);
263 #endif
264 	tun_wakeup(tp);
265 
266 	s = splhigh();
267 	klist_invalidate(&tp->tun_rsel.si_note);
268 	klist_invalidate(&tp->tun_wsel.si_note);
269 	splx(s);
270 
271 	LIST_REMOVE(tp, entry);
272 
273 	if (tp->tun_flags & TUN_LAYER2)
274 		ether_ifdetach(ifp);
275 
276 	if_detach(ifp);
277 
278 	free(tp, M_DEVBUF, sizeof *tp);
279 	return (0);
280 }
281 
282 static inline struct tun_softc *
283 tun_lookup(int unit)
284 {
285 	struct tun_softc *tp;
286 
287 	LIST_FOREACH(tp, &tun_softc_list, entry)
288 		if (tp->tun_unit == unit)
289 			return (tp);
290 	return (NULL);
291 }
292 
293 static inline struct tun_softc *
294 tap_lookup(int unit)
295 {
296 	struct tun_softc *tp;
297 
298 	LIST_FOREACH(tp, &tap_softc_list, entry)
299 		if (tp->tun_unit == unit)
300 			return (tp);
301 	return (NULL);
302 }
303 
304 /*
305  * tunnel open - must be superuser & the device must be
306  * configured in
307  */
308 int
309 tunopen(dev_t dev, int flag, int mode, struct proc *p)
310 {
311 	struct tun_softc *tp;
312 	unsigned int rdomain = rtable_l2(p->p_p->ps_rtableid);
313 
314 	if ((tp = tun_lookup(minor(dev))) == NULL) {	/* create on demand */
315 		char	xname[IFNAMSIZ];
316 		int	error;
317 
318 		snprintf(xname, sizeof(xname), "%s%d", "tun", minor(dev));
319 		error = if_clone_create(xname, rdomain);
320 		if (error != 0)
321 			return (error);
322 
323 		if ((tp = tun_lookup(minor(dev))) == NULL)
324 			return (ENXIO);
325 		tp->tun_flags &= ~TUN_STAYUP;
326 	}
327 
328 	return (tun_dev_open(tp, flag, mode, p));
329 }
330 
331 int
332 tapopen(dev_t dev, int flag, int mode, struct proc *p)
333 {
334 	struct tun_softc *tp;
335 	unsigned int rdomain = rtable_l2(p->p_p->ps_rtableid);
336 
337 	if ((tp = tap_lookup(minor(dev))) == NULL) {	/* create on demand */
338 		char	xname[IFNAMSIZ];
339 		int	error;
340 
341 		snprintf(xname, sizeof(xname), "%s%d", "tap", minor(dev));
342 		error = if_clone_create(xname, rdomain);
343 		if (error != 0)
344 			return (error);
345 
346 		if ((tp = tap_lookup(minor(dev))) == NULL)
347 			return (ENXIO);
348 		tp->tun_flags &= ~TUN_STAYUP;
349 	}
350 
351 	return (tun_dev_open(tp, flag, mode, p));
352 }
353 
354 int
355 tun_dev_open(struct tun_softc *tp, int flag, int mode, struct proc *p)
356 {
357 	struct ifnet *ifp;
358 
359 	if (tp->tun_flags & TUN_OPEN)
360 		return (EBUSY);
361 
362 	ifp = &tp->tun_if;
363 	tp->tun_flags |= TUN_OPEN;
364 	if (flag & FNONBLOCK)
365 		tp->tun_flags |= TUN_NBIO;
366 
367 	/* automatically mark the interface running on open */
368 	ifp->if_flags |= IFF_RUNNING;
369 	tun_link_state(tp);
370 
371 	TUNDEBUG(("%s: open\n", ifp->if_xname));
372 	return (0);
373 }
374 
375 /*
376  * tunclose - close the device; if closing the real device, flush pending
377  *  output and unless STAYUP bring down and destroy the interface.
378  */
379 int
380 tunclose(dev_t dev, int flag, int mode, struct proc *p)
381 {
382 	struct tun_softc	*tp;
383 
384 	if ((tp = tun_lookup(minor(dev))) == NULL)
385 		return (ENXIO);
386 	return (tun_dev_close(tp, flag, mode, p));
387 }
388 
389 int
390 tapclose(dev_t dev, int flag, int mode, struct proc *p)
391 {
392 	struct tun_softc	*tp;
393 
394 	if ((tp = tap_lookup(minor(dev))) == NULL)
395 		return (ENXIO);
396 	return (tun_dev_close(tp, flag, mode, p));
397 }
398 
399 int
400 tun_dev_close(struct tun_softc *tp, int flag, int mode, struct proc *p)
401 {
402 	int			 error = 0;
403 	struct ifnet		*ifp;
404 
405 	ifp = &tp->tun_if;
406 	tp->tun_flags &= ~(TUN_OPEN|TUN_NBIO|TUN_ASYNC);
407 
408 	/*
409 	 * junk all pending output
410 	 */
411 	ifp->if_flags &= ~IFF_RUNNING;
412 	tun_link_state(tp);
413 	IFQ_PURGE(&ifp->if_snd);
414 
415 	TUNDEBUG(("%s: closed\n", ifp->if_xname));
416 
417 	if (!(tp->tun_flags & TUN_STAYUP))
418 		error = if_clone_destroy(ifp->if_xname);
419 	else {
420 		tp->tun_pgid = 0;
421 		selwakeup(&tp->tun_rsel);
422 	}
423 
424 	return (error);
425 }
426 
427 int
428 tun_init(struct tun_softc *tp)
429 {
430 	struct ifnet	*ifp = &tp->tun_if;
431 	struct ifaddr	*ifa;
432 
433 	TUNDEBUG(("%s: tun_init\n", ifp->if_xname));
434 
435 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
436 
437 	tp->tun_flags &= ~(TUN_IASET|TUN_DSTADDR|TUN_BRDADDR);
438 	TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list) {
439 		if (ifa->ifa_addr->sa_family == AF_INET) {
440 			struct sockaddr_in *sin;
441 
442 			sin = satosin(ifa->ifa_addr);
443 			if (sin && sin->sin_addr.s_addr)
444 				tp->tun_flags |= TUN_IASET;
445 
446 			if (ifp->if_flags & IFF_POINTOPOINT) {
447 				sin = satosin(ifa->ifa_dstaddr);
448 				if (sin && sin->sin_addr.s_addr)
449 					tp->tun_flags |= TUN_DSTADDR;
450 			} else
451 				tp->tun_flags &= ~TUN_DSTADDR;
452 
453 			if (ifp->if_flags & IFF_BROADCAST) {
454 				sin = satosin(ifa->ifa_broadaddr);
455 				if (sin && sin->sin_addr.s_addr)
456 					tp->tun_flags |= TUN_BRDADDR;
457 			} else
458 				tp->tun_flags &= ~TUN_BRDADDR;
459 		}
460 #ifdef INET6
461 		if (ifa->ifa_addr->sa_family == AF_INET6) {
462 			struct sockaddr_in6 *sin6;
463 
464 			sin6 = satosin6(ifa->ifa_addr);
465 			if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
466 				tp->tun_flags |= TUN_IASET;
467 
468 			if (ifp->if_flags & IFF_POINTOPOINT) {
469 				sin6 = satosin6(ifa->ifa_dstaddr);
470 				if (sin6 &&
471 				    !IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
472 					tp->tun_flags |= TUN_DSTADDR;
473 			} else
474 				tp->tun_flags &= ~TUN_DSTADDR;
475 		}
476 #endif /* INET6 */
477 	}
478 
479 	return (0);
480 }
481 
482 /*
483  * Process an ioctl request.
484  */
485 int
486 tun_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
487 {
488 	struct tun_softc	*tp = (struct tun_softc *)(ifp->if_softc);
489 	struct ifreq		*ifr = (struct ifreq *)data;
490 	int			 error = 0;
491 
492 	switch (cmd) {
493 	case SIOCSIFADDR:
494 		tun_init(tp);
495 		break;
496 	case SIOCSIFDSTADDR:
497 		tun_init(tp);
498 		TUNDEBUG(("%s: destination address set\n", ifp->if_xname));
499 		break;
500 	case SIOCSIFMTU:
501 		if (ifr->ifr_mtu < ETHERMIN || ifr->ifr_mtu > TUNMRU)
502 			error = EINVAL;
503 		else
504 			ifp->if_mtu = ifr->ifr_mtu;
505 		break;
506 	case SIOCADDMULTI:
507 	case SIOCDELMULTI:
508 		break;
509 	case SIOCSIFFLAGS:
510 		break;
511 	default:
512 		if (tp->tun_flags & TUN_LAYER2)
513 			error = ether_ioctl(ifp, &tp->arpcom, cmd, data);
514 		else
515 			error = ENOTTY;
516 	}
517 
518 	return (error);
519 }
520 
521 /*
522  * tun_output - queue packets from higher level ready to put out.
523  */
524 int
525 tun_output(struct ifnet *ifp, struct mbuf *m0, struct sockaddr *dst,
526     struct rtentry *rt)
527 {
528 	struct tun_softc	*tp = ifp->if_softc;
529 	int			 error;
530 	u_int32_t		*af;
531 
532 	if ((ifp->if_flags & (IFF_UP|IFF_RUNNING)) != (IFF_UP|IFF_RUNNING)) {
533 		m_freem(m0);
534 		return (EHOSTDOWN);
535 	}
536 
537 	TUNDEBUG(("%s: tun_output\n", ifp->if_xname));
538 
539 	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
540 		TUNDEBUG(("%s: not ready %#x\n", ifp->if_xname,
541 		     tp->tun_flags));
542 		m_freem(m0);
543 		return (EHOSTDOWN);
544 	}
545 
546 	if (tp->tun_flags & TUN_LAYER2)
547 		return (ether_output(ifp, m0, dst, rt));
548 
549 	M_PREPEND(m0, sizeof(*af), M_DONTWAIT);
550 	if (m0 == NULL)
551 		return (ENOBUFS);
552 	af = mtod(m0, u_int32_t *);
553 	*af = htonl(dst->sa_family);
554 
555 #if NBPFILTER > 0
556 	if (ifp->if_bpf)
557 		bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
558 #endif
559 #ifdef PIPEX
560 	if (pipex_enable && (m0 = pipex_output(m0, dst->sa_family,
561 	    sizeof(u_int32_t), &tp->pipex_iface)) == NULL) {
562 		return (0);
563 	}
564 #endif
565 
566 	error = if_enqueue(ifp, m0);
567 
568 	if (error) {
569 		ifp->if_collisions++;
570 		return (error);
571 	}
572 
573 	tun_wakeup(tp);
574 	return (0);
575 }
576 
577 void
578 tun_wakeup(struct tun_softc *tp)
579 {
580 	KERNEL_LOCK();
581 	if (tp->tun_flags & TUN_RWAIT) {
582 		tp->tun_flags &= ~TUN_RWAIT;
583 		wakeup((caddr_t)tp);
584 	}
585 	if (tp->tun_flags & TUN_ASYNC && tp->tun_pgid)
586 		csignal(tp->tun_pgid, SIGIO,
587 		    tp->tun_siguid, tp->tun_sigeuid);
588 	selwakeup(&tp->tun_rsel);
589 	KERNEL_UNLOCK();
590 }
591 
592 /*
593  * the cdevsw interface is now pretty minimal.
594  */
595 int
596 tunioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
597 {
598 	struct tun_softc *tp;
599 
600 	if ((tp = tun_lookup(minor(dev))) == NULL)
601 		return (ENXIO);
602 	return (tun_dev_ioctl(tp, cmd, data, flag, p));
603 }
604 
605 int
606 tapioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct proc *p)
607 {
608 	struct tun_softc *tp;
609 
610 	if ((tp = tap_lookup(minor(dev))) == NULL)
611 		return (ENXIO);
612 	return (tun_dev_ioctl(tp, cmd, data, flag, p));
613 }
614 
615 int
616 tun_dev_ioctl(struct tun_softc *tp, u_long cmd, caddr_t data, int flag,
617     struct proc *p)
618 {
619 	struct tuninfo		*tunp;
620 
621 	switch (cmd) {
622 	case TUNSIFINFO:
623 		tunp = (struct tuninfo *)data;
624 		if (tunp->mtu < ETHERMIN || tunp->mtu > TUNMRU)
625 			return (EINVAL);
626 		if (tunp->type != tp->tun_if.if_type)
627 			return (EINVAL);
628 		tp->tun_if.if_mtu = tunp->mtu;
629 		tp->tun_if.if_flags =
630 		    (tunp->flags & TUN_IFF_FLAGS) |
631 		    (tp->tun_if.if_flags & ~TUN_IFF_FLAGS);
632 		tp->tun_if.if_baudrate = tunp->baudrate;
633 		break;
634 	case TUNGIFINFO:
635 		tunp = (struct tuninfo *)data;
636 		tunp->mtu = tp->tun_if.if_mtu;
637 		tunp->type = tp->tun_if.if_type;
638 		tunp->flags = tp->tun_if.if_flags;
639 		tunp->baudrate = tp->tun_if.if_baudrate;
640 		break;
641 #ifdef TUN_DEBUG
642 	case TUNSDEBUG:
643 		tundebug = *(int *)data;
644 		break;
645 	case TUNGDEBUG:
646 		*(int *)data = tundebug;
647 		break;
648 #endif
649 	case TUNSIFMODE:
650 		switch (*(int *)data & (IFF_POINTOPOINT|IFF_BROADCAST)) {
651 		case IFF_POINTOPOINT:
652 		case IFF_BROADCAST:
653 			tp->tun_if.if_flags &= ~TUN_IFF_FLAGS;
654 			tp->tun_if.if_flags |= *(int *)data & TUN_IFF_FLAGS;
655 			break;
656 		default:
657 			return (EINVAL);
658 		}
659 		break;
660 
661 	case FIONBIO:
662 		if (*(int *)data)
663 			tp->tun_flags |= TUN_NBIO;
664 		else
665 			tp->tun_flags &= ~TUN_NBIO;
666 		break;
667 	case FIOASYNC:
668 		if (*(int *)data)
669 			tp->tun_flags |= TUN_ASYNC;
670 		else
671 			tp->tun_flags &= ~TUN_ASYNC;
672 		break;
673 	case FIONREAD:
674 		*(int *)data = ifq_hdatalen(&tp->tun_if.if_snd);
675 		break;
676 	case TIOCSPGRP:
677 		tp->tun_pgid = *(int *)data;
678 		tp->tun_siguid = p->p_ucred->cr_ruid;
679 		tp->tun_sigeuid = p->p_ucred->cr_uid;
680 		break;
681 	case TIOCGPGRP:
682 		*(int *)data = tp->tun_pgid;
683 		break;
684 	case SIOCGIFADDR:
685 		if (!(tp->tun_flags & TUN_LAYER2))
686 			return (EINVAL);
687 		bcopy(tp->arpcom.ac_enaddr, data,
688 		    sizeof(tp->arpcom.ac_enaddr));
689 		break;
690 
691 	case SIOCSIFADDR:
692 		if (!(tp->tun_flags & TUN_LAYER2))
693 			return (EINVAL);
694 		bcopy(data, tp->arpcom.ac_enaddr,
695 		    sizeof(tp->arpcom.ac_enaddr));
696 		break;
697 	default:
698 #ifdef PIPEX
699 		if (!(tp->tun_flags & TUN_LAYER2)) {
700 			int ret;
701 			ret = pipex_ioctl(&tp->pipex_iface, cmd, data);
702 			return (ret);
703 		}
704 #endif
705 		return (ENOTTY);
706 	}
707 	return (0);
708 }
709 
710 /*
711  * The cdevsw read interface - reads a packet at a time, or at
712  * least as much of a packet as can be read.
713  */
714 int
715 tunread(dev_t dev, struct uio *uio, int ioflag)
716 {
717 	struct tun_softc *tp;
718 
719 	if ((tp = tun_lookup(minor(dev))) == NULL)
720 		return (ENXIO);
721 	return (tun_dev_read(tp, uio, ioflag));
722 }
723 
724 int
725 tapread(dev_t dev, struct uio *uio, int ioflag)
726 {
727 	struct tun_softc *tp;
728 
729 	if ((tp = tap_lookup(minor(dev))) == NULL)
730 		return (ENXIO);
731 	return (tun_dev_read(tp, uio, ioflag));
732 }
733 
734 int
735 tun_dev_read(struct tun_softc *tp, struct uio *uio, int ioflag)
736 {
737 	struct ifnet		*ifp = &tp->tun_if;
738 	struct mbuf		*m, *m0;
739 	unsigned int		 ifidx;
740 	int			 error = 0;
741 	size_t			 len;
742 
743 	if ((tp->tun_flags & TUN_READY) != TUN_READY)
744 		return (EHOSTDOWN);
745 
746 	ifidx = ifp->if_index;
747 	tp->tun_flags &= ~TUN_RWAIT;
748 
749 	do {
750 		struct ifnet *ifp1;
751 		int destroyed;
752 
753 		while ((tp->tun_flags & TUN_READY) != TUN_READY) {
754 			if ((error = tsleep((caddr_t)tp,
755 			    (PZERO + 1)|PCATCH, "tunread", 0)) != 0)
756 				return (error);
757 			/* Make sure the interface still exists. */
758 			ifp1 = if_get(ifidx);
759 			destroyed = (ifp1 == NULL);
760 			if_put(ifp1);
761 			if (destroyed)
762 				return (ENXIO);
763 		}
764 		IFQ_DEQUEUE(&ifp->if_snd, m0);
765 		if (m0 == NULL) {
766 			if (tp->tun_flags & TUN_NBIO && ioflag & IO_NDELAY)
767 				return (EWOULDBLOCK);
768 			tp->tun_flags |= TUN_RWAIT;
769 			if ((error = tsleep((caddr_t)tp,
770 			    (PZERO + 1)|PCATCH, "tunread", 0)) != 0)
771 				return (error);
772 			/* Make sure the interface still exists. */
773 			ifp1 = if_get(ifidx);
774 			destroyed = (ifp1 == NULL);
775 			if_put(ifp1);
776 			if (destroyed)
777 				return (ENXIO);
778 		}
779 	} while (m0 == NULL);
780 
781 	if (tp->tun_flags & TUN_LAYER2) {
782 #if NBPFILTER > 0
783 		if (ifp->if_bpf)
784 			bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
785 #endif
786 	}
787 
788 	while (m0 != NULL && uio->uio_resid > 0 && error == 0) {
789 		len = ulmin(uio->uio_resid, m0->m_len);
790 		if (len != 0)
791 			error = uiomove(mtod(m0, caddr_t), len, uio);
792 		m = m_free(m0);
793 		m0 = m;
794 	}
795 
796 	if (m0 != NULL) {
797 		TUNDEBUG(("Dropping mbuf\n"));
798 		m_freem(m0);
799 	}
800 	if (error)
801 		ifp->if_oerrors++;
802 
803 	return (error);
804 }
805 
806 /*
807  * the cdevsw write interface - an atomic write is a packet - or else!
808  */
809 int
810 tunwrite(dev_t dev, struct uio *uio, int ioflag)
811 {
812 	struct tun_softc *tp;
813 
814 	if ((tp = tun_lookup(minor(dev))) == NULL)
815 		return (ENXIO);
816 	return (tun_dev_write(tp, uio, ioflag));
817 }
818 
819 int
820 tapwrite(dev_t dev, struct uio *uio, int ioflag)
821 {
822 	struct tun_softc *tp;
823 
824 	if ((tp = tap_lookup(minor(dev))) == NULL)
825 		return (ENXIO);
826 	return (tun_dev_write(tp, uio, ioflag));
827 }
828 
829 int
830 tun_dev_write(struct tun_softc *tp, struct uio *uio, int ioflag)
831 {
832 	struct ifnet		*ifp;
833 	u_int32_t		*th;
834 	struct mbuf		*top, **mp, *m;
835 	int			error = 0, tlen;
836 	size_t			mlen;
837 
838 	ifp = &tp->tun_if;
839 	TUNDEBUG(("%s: tunwrite\n", ifp->if_xname));
840 
841 	if (uio->uio_resid == 0 || uio->uio_resid > ifp->if_mtu +
842 	    (tp->tun_flags & TUN_LAYER2 ? ETHER_HDR_LEN : sizeof(*th))) {
843 		TUNDEBUG(("%s: len=%d!\n", ifp->if_xname, uio->uio_resid));
844 		return (EMSGSIZE);
845 	}
846 	tlen = uio->uio_resid;
847 
848 	/* get a header mbuf */
849 	MGETHDR(m, M_DONTWAIT, MT_DATA);
850 	if (m == NULL)
851 		return (ENOBUFS);
852 	mlen = MHLEN;
853 	if (uio->uio_resid >= MINCLSIZE) {
854 		MCLGET(m, M_DONTWAIT);
855 		if (!(m->m_flags & M_EXT)) {
856 			m_free(m);
857 			return (ENOBUFS);
858 		}
859 		mlen = MCLBYTES;
860 	}
861 
862 	top = NULL;
863 	mp = &top;
864 	if (tp->tun_flags & TUN_LAYER2) {
865 		/*
866 		 * Pad so that IP header is correctly aligned
867 		 * this is necessary for all strict aligned architectures.
868 		 */
869 		mlen -= ETHER_ALIGN;
870 		m->m_data += ETHER_ALIGN;
871 	}
872 	while (error == 0 && uio->uio_resid > 0) {
873 		m->m_len = ulmin(mlen, uio->uio_resid);
874 		error = uiomove(mtod (m, caddr_t), m->m_len, uio);
875 		*mp = m;
876 		mp = &m->m_next;
877 		if (error == 0 && uio->uio_resid > 0) {
878 			MGET(m, M_DONTWAIT, MT_DATA);
879 			if (m == NULL) {
880 				error = ENOBUFS;
881 				break;
882 			}
883 			mlen = MLEN;
884 			if (uio->uio_resid >= MINCLSIZE) {
885 				MCLGET(m, M_DONTWAIT);
886 				if (!(m->m_flags & M_EXT)) {
887 					error = ENOBUFS;
888 					m_free(m);
889 					break;
890 				}
891 				mlen = MCLBYTES;
892 			}
893 		}
894 	}
895 	if (error) {
896 		m_freem(top);
897 		ifp->if_ierrors++;
898 		return (error);
899 	}
900 
901 	top->m_pkthdr.len = tlen;
902 
903 	if (tp->tun_flags & TUN_LAYER2) {
904 		struct mbuf_list ml = MBUF_LIST_INITIALIZER();
905 
906 		ml_enqueue(&ml, top);
907 		if_input(ifp, &ml);
908 		return (0);
909 	}
910 
911 #if NBPFILTER > 0
912 	if (ifp->if_bpf) {
913 		bpf_mtap(ifp->if_bpf, top, BPF_DIRECTION_IN);
914 	}
915 #endif
916 
917 	th = mtod(top, u_int32_t *);
918 	/* strip the tunnel header */
919 	top->m_data += sizeof(*th);
920 	top->m_len  -= sizeof(*th);
921 	top->m_pkthdr.len -= sizeof(*th);
922 	top->m_pkthdr.ph_rtableid = ifp->if_rdomain;
923 	top->m_pkthdr.ph_ifidx = ifp->if_index;
924 
925 	ifp->if_ipackets++;
926 	ifp->if_ibytes += top->m_pkthdr.len;
927 
928 	NET_LOCK();
929 
930 	switch (ntohl(*th)) {
931 	case AF_INET:
932 		ipv4_input(ifp, top);
933 		break;
934 #ifdef INET6
935 	case AF_INET6:
936 		ipv6_input(ifp, top);
937 		break;
938 #endif
939 #ifdef MPLS
940 	case AF_MPLS:
941 		mpls_input(ifp, top);
942 		break;
943 #endif
944 	default:
945 		m_freem(top);
946 		error = EAFNOSUPPORT;
947 		break;
948 	}
949 
950 	NET_UNLOCK();
951 
952 	return (error);
953 }
954 
955 /*
956  * tunpoll - the poll interface, this is only useful on reads
957  * really. The write detect always returns true, write never blocks
958  * anyway, it either accepts the packet or drops it.
959  */
960 int
961 tunpoll(dev_t dev, int events, struct proc *p)
962 {
963 	struct tun_softc *tp;
964 
965 	if ((tp = tun_lookup(minor(dev))) == NULL)
966 		return (POLLERR);
967 	return (tun_dev_poll(tp, events, p));
968 }
969 
970 int
971 tappoll(dev_t dev, int events, struct proc *p)
972 {
973 	struct tun_softc *tp;
974 
975 	if ((tp = tap_lookup(minor(dev))) == NULL)
976 		return (POLLERR);
977 	return (tun_dev_poll(tp, events, p));
978 }
979 
980 int
981 tun_dev_poll(struct tun_softc *tp, int events, struct proc *p)
982 {
983 	int			 revents;
984 	struct ifnet		*ifp;
985 	unsigned int		 len;
986 
987 	ifp = &tp->tun_if;
988 	revents = 0;
989 	TUNDEBUG(("%s: tunpoll\n", ifp->if_xname));
990 
991 	if (events & (POLLIN | POLLRDNORM)) {
992 		len = IFQ_LEN(&ifp->if_snd);
993 		if (len > 0) {
994 			TUNDEBUG(("%s: tunselect q=%d\n", ifp->if_xname, len));
995 			revents |= events & (POLLIN | POLLRDNORM);
996 		} else {
997 			TUNDEBUG(("%s: tunpoll waiting\n", ifp->if_xname));
998 			selrecord(p, &tp->tun_rsel);
999 		}
1000 	}
1001 	if (events & (POLLOUT | POLLWRNORM))
1002 		revents |= events & (POLLOUT | POLLWRNORM);
1003 	return (revents);
1004 }
1005 
1006 /*
1007  * kqueue(2) support.
1008  *
1009  * The tun driver uses an array of tun_softc's based on the minor number
1010  * of the device.  kn->kn_hook gets set to the specific tun_softc.
1011  *
1012  * filt_tunread() sets kn->kn_data to the iface qsize
1013  * filt_tunwrite() sets kn->kn_data to the MTU size
1014  */
1015 int
1016 tunkqfilter(dev_t dev, struct knote *kn)
1017 {
1018 	struct tun_softc *tp;
1019 
1020 	if ((tp = tun_lookup(minor(dev))) == NULL)
1021 		return (ENXIO);
1022 	return (tun_dev_kqfilter(tp, kn));
1023 }
1024 
1025 int
1026 tapkqfilter(dev_t dev, struct knote *kn)
1027 {
1028 	struct tun_softc *tp;
1029 
1030 	if ((tp = tap_lookup(minor(dev))) == NULL)
1031 		return (ENXIO);
1032 	return (tun_dev_kqfilter(tp, kn));
1033 }
1034 
1035 int
1036 tun_dev_kqfilter(struct tun_softc *tp, struct knote *kn)
1037 {
1038 	int			 s;
1039 	struct klist		*klist;
1040 	struct ifnet		*ifp;
1041 
1042 	ifp = &tp->tun_if;
1043 	TUNDEBUG(("%s: tunkqfilter\n", ifp->if_xname));
1044 
1045 	switch (kn->kn_filter) {
1046 		case EVFILT_READ:
1047 			klist = &tp->tun_rsel.si_note;
1048 			kn->kn_fop = &tunread_filtops;
1049 			break;
1050 		case EVFILT_WRITE:
1051 			klist = &tp->tun_wsel.si_note;
1052 			kn->kn_fop = &tunwrite_filtops;
1053 			break;
1054 		default:
1055 			return (EINVAL);
1056 	}
1057 
1058 	kn->kn_hook = (caddr_t)tp;
1059 
1060 	s = splhigh();
1061 	SLIST_INSERT_HEAD(klist, kn, kn_selnext);
1062 	splx(s);
1063 
1064 	return (0);
1065 }
1066 
1067 void
1068 filt_tunrdetach(struct knote *kn)
1069 {
1070 	int			 s;
1071 	struct tun_softc	*tp;
1072 
1073 	tp = (struct tun_softc *)kn->kn_hook;
1074 	s = splhigh();
1075 	if (!(kn->kn_status & KN_DETACHED))
1076 		SLIST_REMOVE(&tp->tun_rsel.si_note, kn, knote, kn_selnext);
1077 	splx(s);
1078 }
1079 
1080 int
1081 filt_tunread(struct knote *kn, long hint)
1082 {
1083 	struct tun_softc	*tp;
1084 	struct ifnet		*ifp;
1085 	unsigned int		 len;
1086 
1087 	if (kn->kn_status & KN_DETACHED) {
1088 		kn->kn_data = 0;
1089 		return (1);
1090 	}
1091 
1092 	tp = (struct tun_softc *)kn->kn_hook;
1093 	ifp = &tp->tun_if;
1094 
1095 	len = IFQ_LEN(&ifp->if_snd);
1096 	if (len > 0) {
1097 		kn->kn_data = len;
1098 
1099 		TUNDEBUG(("%s: tunkqread q=%d\n", ifp->if_xname,
1100 		    IFQ_LEN(&ifp->if_snd)));
1101 		return (1);
1102 	}
1103 	TUNDEBUG(("%s: tunkqread waiting\n", ifp->if_xname));
1104 	return (0);
1105 }
1106 
1107 void
1108 filt_tunwdetach(struct knote *kn)
1109 {
1110 	int			 s;
1111 	struct tun_softc	*tp;
1112 
1113 	tp = (struct tun_softc *)kn->kn_hook;
1114 	s = splhigh();
1115 	if (!(kn->kn_status & KN_DETACHED))
1116 		SLIST_REMOVE(&tp->tun_wsel.si_note, kn, knote, kn_selnext);
1117 	splx(s);
1118 }
1119 
1120 int
1121 filt_tunwrite(struct knote *kn, long hint)
1122 {
1123 	struct tun_softc	*tp;
1124 	struct ifnet		*ifp;
1125 
1126 	if (kn->kn_status & KN_DETACHED) {
1127 		kn->kn_data = 0;
1128 		return (1);
1129 	}
1130 
1131 	tp = (struct tun_softc *)kn->kn_hook;
1132 	ifp = &tp->tun_if;
1133 
1134 	kn->kn_data = ifp->if_mtu;
1135 
1136 	return (1);
1137 }
1138 
1139 void
1140 tun_start(struct ifnet *ifp)
1141 {
1142 	struct tun_softc	*tp = ifp->if_softc;
1143 
1144 	splassert(IPL_NET);
1145 
1146 	if (IFQ_LEN(&ifp->if_snd))
1147 		tun_wakeup(tp);
1148 }
1149 
1150 void
1151 tun_link_state(struct tun_softc *tp)
1152 {
1153 	struct ifnet *ifp = &tp->tun_if;
1154 	int link_state = LINK_STATE_DOWN;
1155 
1156 	if (tp->tun_flags & TUN_OPEN) {
1157 		if (tp->tun_flags & TUN_LAYER2)
1158 			link_state = LINK_STATE_FULL_DUPLEX;
1159 		else
1160 			link_state = LINK_STATE_UP;
1161 	}
1162 	if (ifp->if_link_state != link_state) {
1163 		ifp->if_link_state = link_state;
1164 		if_link_state_change(ifp);
1165 	}
1166 }
1167