17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23
24#include <sys/param.h>
25#include <sys/priv.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/jail.h>
29#include <sys/mbuf.h>
30#include <sys/module.h>
31#include <sys/socket.h>
32#include <sys/fcntl.h>
33#include <sys/filio.h>
34#include <sys/sockio.h>
35#include <sys/ttycom.h>
36#include <sys/poll.h>
37#include <sys/selinfo.h>
38#include <sys/signalvar.h>
39#include <sys/filedesc.h>
40#include <sys/kernel.h>
41#include <sys/sysctl.h>
42#include <sys/conf.h>
43#include <sys/uio.h>
44#include <sys/malloc.h>
45#include <sys/random.h>
46
47#include <net/if.h>
48#include <net/if_clone.h>
49#include <net/if_types.h>
50#include <net/netisr.h>
51#include <net/route.h>
52#include <net/vnet.h>
53#ifdef INET
54#include <netinet/in.h>
55#endif
56#include <net/bpf.h>
57#include <net/if_tun.h>
58
59#include <sys/queue.h>
60#include <sys/condvar.h>
61
62#include <security/mac/mac_framework.h>
63
64/*
65 * tun_list is protected by global tunmtx. Other mutable fields are
66 * protected by tun->tun_mtx, or by their owning subsystem. tun_dev is
67 * static for the duration of a tunnel interface.
68 */
69struct tun_softc {
70 TAILQ_ENTRY(tun_softc) tun_list;
71 struct cdev *tun_dev;
72 u_short tun_flags; /* misc flags */
73#define TUN_OPEN 0x0001
74#define TUN_INITED 0x0002
75#define TUN_RCOLL 0x0004
76#define TUN_IASET 0x0008
77#define TUN_DSTADDR 0x0010
78#define TUN_LMODE 0x0020
79#define TUN_RWAIT 0x0040
80#define TUN_ASYNC 0x0080
81#define TUN_IFHEAD 0x0100
82
83#define TUN_READY (TUN_OPEN | TUN_INITED)
84
85 /*
86 * XXXRW: tun_pid is used to exclusively lock /dev/tun. Is this
87 * actually needed? Can we just return EBUSY if already open?
88 * Problem is that this involved inherent races when a tun device
89 * is handed off from one process to another, as opposed to just
90 * being slightly stale informationally.
91 */
92 pid_t tun_pid; /* owning pid */
93 struct ifnet *tun_ifp; /* the interface */
94 struct sigio *tun_sigio; /* information for async I/O */
95 struct selinfo tun_rsel; /* read select */
96 struct mtx tun_mtx; /* protect mutable softc fields */
97 struct cv tun_cv; /* protect against ref'd dev destroy */
98};
99#define TUN2IFP(sc) ((sc)->tun_ifp)
100
101#define TUNDEBUG if (tundebug) if_printf
102#define TUNNAME "tun"
103
104/*
105 * All mutable global variables in if_tun are locked using tunmtx, with
106 * the exception of tundebug, which is used unlocked, and tunclones,
107 * which is static after setup.
108 */
109static struct mtx tunmtx;
110static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
111static int tundebug = 0;
112static int tundclone = 1;
113static struct clonedevs *tunclones;
114static TAILQ_HEAD(,tun_softc) tunhead = TAILQ_HEAD_INITIALIZER(tunhead);
115SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
116
117SYSCTL_DECL(_net_link);
118SYSCTL_NODE(_net_link, OID_AUTO, tun, CTLFLAG_RW, 0,
119 "IP tunnel software network interface.");
120SYSCTL_INT(_net_link_tun, OID_AUTO, devfs_cloning, CTLFLAG_RW, &tundclone, 0,
121 "Enable legacy devfs interface creation.");
122
123TUNABLE_INT("net.link.tun.devfs_cloning", &tundclone);
124
125static void tunclone(void *arg, struct ucred *cred, char *name,
126 int namelen, struct cdev **dev);
127static void tuncreate(const char *name, struct cdev *dev);
128static int tunifioctl(struct ifnet *, u_long, caddr_t);
129static void tuninit(struct ifnet *);
130static int tunmodevent(module_t, int, void *);
131static int tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
132 struct route *ro);
133static void tunstart(struct ifnet *);
134
135static int tun_clone_create(struct if_clone *, int, caddr_t);
136static void tun_clone_destroy(struct ifnet *);
137
138IFC_SIMPLE_DECLARE(tun, 0);
139
140static d_open_t tunopen;
141static d_close_t tunclose;
142static d_read_t tunread;
143static d_write_t tunwrite;
144static d_ioctl_t tunioctl;
145static d_poll_t tunpoll;
146static d_kqfilter_t tunkqfilter;
147
148static int tunkqread(struct knote *, long);
149static int tunkqwrite(struct knote *, long);
150static void tunkqdetach(struct knote *);
151
152static struct filterops tun_read_filterops = {
153 .f_isfd = 1,
154 .f_attach = NULL,
155 .f_detach = tunkqdetach,
156 .f_event = tunkqread,
157};
158
159static struct filterops tun_write_filterops = {
160 .f_isfd = 1,
161 .f_attach = NULL,
162 .f_detach = tunkqdetach,
163 .f_event = tunkqwrite,
164};
165
166static struct cdevsw tun_cdevsw = {
167 .d_version = D_VERSION,
168 .d_flags = D_PSEUDO | D_NEEDMINOR,
169 .d_open = tunopen,
170 .d_close = tunclose,
171 .d_read = tunread,
172 .d_write = tunwrite,
173 .d_ioctl = tunioctl,
174 .d_poll = tunpoll,
175 .d_kqfilter = tunkqfilter,
176 .d_name = TUNNAME,
177};
178
179static int
180tun_clone_create(struct if_clone *ifc, int unit, caddr_t params)
181{
182 struct cdev *dev;
183 int i;
184
185 /* find any existing device, or allocate new unit number */
186 i = clone_create(&tunclones, &tun_cdevsw, &unit, &dev, 0);
187 if (i) {
188 /* No preexisting struct cdev *, create one */
189 dev = make_dev(&tun_cdevsw, unit,
190 UID_UUCP, GID_DIALER, 0600, "%s%d", ifc->ifc_name, unit);
191 }
192 tuncreate(ifc->ifc_name, dev);
193
194 return (0);
195}
196
197static void
198tunclone(void *arg, struct ucred *cred, char *name, int namelen,
199 struct cdev **dev)
200{
201 char devname[SPECNAMELEN + 1];
202 int u, i, append_unit;
203
204 if (*dev != NULL)
205 return;
206
207 /*
208 * If tun cloning is enabled, only the superuser can create an
209 * interface.
210 */
211 if (!tundclone || priv_check_cred(cred, PRIV_NET_IFCREATE, 0) != 0)
212 return;
213
214 if (strcmp(name, TUNNAME) == 0) {
215 u = -1;
216 } else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
217 return; /* Don't recognise the name */
218 if (u != -1 && u > IF_MAXUNIT)
219 return; /* Unit number too high */
220
221 if (u == -1)
222 append_unit = 1;
223 else
224 append_unit = 0;
225
226 CURVNET_SET(CRED_TO_VNET(cred));
227 /* find any existing device, or allocate new unit number */
228 i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
229 if (i) {
230 if (append_unit) {
231 namelen = snprintf(devname, sizeof(devname), "%s%d",
232 name, u);
233 name = devname;
234 }
235 /* No preexisting struct cdev *, create one */
236 *dev = make_dev_credf(MAKEDEV_REF, &tun_cdevsw, u, cred,
237 UID_UUCP, GID_DIALER, 0600, "%s", name);
238 }
239
240 if_clone_create(name, namelen, NULL);
241 CURVNET_RESTORE();
242}
243
244static void
245tun_destroy(struct tun_softc *tp)
246{
247 struct cdev *dev;
248
249 /* Unlocked read. */
250 mtx_lock(&tp->tun_mtx);
251 if ((tp->tun_flags & TUN_OPEN) != 0)
252 cv_wait_unlock(&tp->tun_cv, &tp->tun_mtx);
253 else
254 mtx_unlock(&tp->tun_mtx);
255
256 CURVNET_SET(TUN2IFP(tp)->if_vnet);
257 dev = tp->tun_dev;
258 bpfdetach(TUN2IFP(tp));
259 if_detach(TUN2IFP(tp));
260 if_free(TUN2IFP(tp));
261 destroy_dev(dev);
262 knlist_destroy(&tp->tun_rsel.si_note);
263 mtx_destroy(&tp->tun_mtx);
264 cv_destroy(&tp->tun_cv);
265 free(tp, M_TUN);
266 CURVNET_RESTORE();
267}
268
269static void
270tun_clone_destroy(struct ifnet *ifp)
271{
272 struct tun_softc *tp = ifp->if_softc;
273
274 mtx_lock(&tunmtx);
275 TAILQ_REMOVE(&tunhead, tp, tun_list);
276 mtx_unlock(&tunmtx);
277 tun_destroy(tp);
278}
279
280static int
281tunmodevent(module_t mod, int type, void *data)
282{
283 static eventhandler_tag tag;
284 struct tun_softc *tp;
285
286 switch (type) {
287 case MOD_LOAD:
288 mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
289 clone_setup(&tunclones);
290 tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
291 if (tag == NULL)
292 return (ENOMEM);
293 if_clone_attach(&tun_cloner);
294 break;
295 case MOD_UNLOAD:
296 if_clone_detach(&tun_cloner);
297 EVENTHANDLER_DEREGISTER(dev_clone, tag);
298 drain_dev_clone_events();
299
300 mtx_lock(&tunmtx);
301 while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
302 TAILQ_REMOVE(&tunhead, tp, tun_list);
303 mtx_unlock(&tunmtx);
304 tun_destroy(tp);
305 mtx_lock(&tunmtx);
306 }
307 mtx_unlock(&tunmtx);
308 clone_cleanup(&tunclones);
309 mtx_destroy(&tunmtx);
310 break;
311 default:
312 return EOPNOTSUPP;
313 }
314 return 0;
315}
316
317static moduledata_t tun_mod = {
318 "if_tun",
319 tunmodevent,
320 0
321};
322
323DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
324
325static void
326tunstart(struct ifnet *ifp)
327{
328 struct tun_softc *tp = ifp->if_softc;
329 struct mbuf *m;
330
331 TUNDEBUG(ifp,"%s starting\n", ifp->if_xname);
332 if (ALTQ_IS_ENABLED(&ifp->if_snd)) {
333 IFQ_LOCK(&ifp->if_snd);
334 IFQ_POLL_NOLOCK(&ifp->if_snd, m);
335 if (m == NULL) {
336 IFQ_UNLOCK(&ifp->if_snd);
337 return;
338 }
339 IFQ_UNLOCK(&ifp->if_snd);
340 }
341
342 mtx_lock(&tp->tun_mtx);
343 if (tp->tun_flags & TUN_RWAIT) {
344 tp->tun_flags &= ~TUN_RWAIT;
345 wakeup(tp);
346 }
347 selwakeuppri(&tp->tun_rsel, PZERO + 1);
348 KNOTE_LOCKED(&tp->tun_rsel.si_note, 0);
349 if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio) {
350 mtx_unlock(&tp->tun_mtx);
351 pgsigio(&tp->tun_sigio, SIGIO, 0);
352 } else
353 mtx_unlock(&tp->tun_mtx);
354}
355
356/* XXX: should return an error code so it can fail. */
357static void
358tuncreate(const char *name, struct cdev *dev)
359{
360 struct tun_softc *sc;
361 struct ifnet *ifp;
362
363 dev->si_flags &= ~SI_CHEAPCLONE;
364
365 sc = malloc(sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
366 mtx_init(&sc->tun_mtx, "tun_mtx", NULL, MTX_DEF);
367 cv_init(&sc->tun_cv, "tun_condvar");
368 sc->tun_flags = TUN_INITED;
369 sc->tun_dev = dev;
370 mtx_lock(&tunmtx);
371 TAILQ_INSERT_TAIL(&tunhead, sc, tun_list);
372 mtx_unlock(&tunmtx);
373
374 ifp = sc->tun_ifp = if_alloc(IFT_PPP);
375 if (ifp == NULL)
376 panic("%s%d: failed to if_alloc() interface.\n",
377 name, dev2unit(dev));
378 if_initname(ifp, name, dev2unit(dev));
379 ifp->if_mtu = TUNMTU;
380 ifp->if_ioctl = tunifioctl;
381 ifp->if_output = tunoutput;
382 ifp->if_start = tunstart;
383 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
384 ifp->if_softc = sc;
385 IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
386 ifp->if_snd.ifq_drv_maxlen = 0;
387 IFQ_SET_READY(&ifp->if_snd);
388 knlist_init_mtx(&sc->tun_rsel.si_note, &sc->tun_mtx);
389 ifp->if_capabilities |= IFCAP_LINKSTATE;
390 ifp->if_capenable |= IFCAP_LINKSTATE;
391
392 if_attach(ifp);
393 bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
394 dev->si_drv1 = sc;
395 TUNDEBUG(ifp, "interface %s is created, minor = %#x\n",
396 ifp->if_xname, dev2unit(dev));
397}
398
399static int
400tunopen(struct cdev *dev, int flag, int mode, struct thread *td)
401{
402 struct ifnet *ifp;
403 struct tun_softc *tp;
404
405 /*
406 * XXXRW: Non-atomic test and set of dev->si_drv1 requires
407 * synchronization.
408 */
409 tp = dev->si_drv1;
410 if (!tp) {
411 tuncreate(TUNNAME, dev);
412 tp = dev->si_drv1;
413 }
414
415 /*
416 * XXXRW: This use of tun_pid is subject to error due to the
417 * fact that a reference to the tunnel can live beyond the
418 * death of the process that created it. Can we replace this
419 * with a simple busy flag?
420 */
421 mtx_lock(&tp->tun_mtx);
422 if (tp->tun_pid != 0 && tp->tun_pid != td->td_proc->p_pid) {
423 mtx_unlock(&tp->tun_mtx);
424 return (EBUSY);
425 }
426 tp->tun_pid = td->td_proc->p_pid;
427
428 tp->tun_flags |= TUN_OPEN;
429 ifp = TUN2IFP(tp);
430 if_link_state_change(ifp, LINK_STATE_UP);
431 TUNDEBUG(ifp, "open\n");
432 mtx_unlock(&tp->tun_mtx);
433
434 return (0);
435}
436
437/*
438 * tunclose - close the device - mark i/f down & delete
439 * routing info
440 */
441static int
442tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
443{
444 struct tun_softc *tp;
445 struct ifnet *ifp;
446
447 tp = dev->si_drv1;
448 ifp = TUN2IFP(tp);
449
450 mtx_lock(&tp->tun_mtx);
451 tp->tun_flags &= ~TUN_OPEN;
452 tp->tun_pid = 0;
453
454 /*
455 * junk all pending output
456 */
457 CURVNET_SET(ifp->if_vnet);
458 IFQ_PURGE(&ifp->if_snd);
459
460 if (ifp->if_flags & IFF_UP) {
461 mtx_unlock(&tp->tun_mtx);
462 if_down(ifp);
463 mtx_lock(&tp->tun_mtx);
464 }
465
466 /* Delete all addresses and routes which reference this interface. */
467 if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
468 struct ifaddr *ifa;
469
470 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
471 mtx_unlock(&tp->tun_mtx);
472 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
473 /* deal w/IPv4 PtP destination; unlocked read */
474 if (ifa->ifa_addr->sa_family == AF_INET) {
475 rtinit(ifa, (int)RTM_DELETE,
476 tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
477 } else {
478 rtinit(ifa, (int)RTM_DELETE, 0);
479 }
480 }
481 if_purgeaddrs(ifp);
482 mtx_lock(&tp->tun_mtx);
483 }
484 if_link_state_change(ifp, LINK_STATE_DOWN);
485 CURVNET_RESTORE();
486
487 funsetown(&tp->tun_sigio);
488 selwakeuppri(&tp->tun_rsel, PZERO + 1);
489 KNOTE_LOCKED(&tp->tun_rsel.si_note, 0);
490 TUNDEBUG (ifp, "closed\n");
491
492 cv_broadcast(&tp->tun_cv);
493 mtx_unlock(&tp->tun_mtx);
494 return (0);
495}
496
497static void
498tuninit(struct ifnet *ifp)
499{
500 struct tun_softc *tp = ifp->if_softc;
501#ifdef INET
502 struct ifaddr *ifa;
503#endif
504
505 TUNDEBUG(ifp, "tuninit\n");
506
507 mtx_lock(&tp->tun_mtx);
508 ifp->if_flags |= IFF_UP;
509 ifp->if_drv_flags |= IFF_DRV_RUNNING;
510 getmicrotime(&ifp->if_lastchange);
511
512#ifdef INET
513 if_addr_rlock(ifp);
514 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
515 if (ifa->ifa_addr->sa_family == AF_INET) {
516 struct sockaddr_in *si;
517
518 si = (struct sockaddr_in *)ifa->ifa_addr;
519 if (si->sin_addr.s_addr)
520 tp->tun_flags |= TUN_IASET;
521
522 si = (struct sockaddr_in *)ifa->ifa_dstaddr;
523 if (si && si->sin_addr.s_addr)
524 tp->tun_flags |= TUN_DSTADDR;
525 }
526 }
527 if_addr_runlock(ifp);
528#endif
529 mtx_unlock(&tp->tun_mtx);
530}
531
532/*
533 * Process an ioctl request.
534 */
535static int
536tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
537{
538 struct ifreq *ifr = (struct ifreq *)data;
539 struct tun_softc *tp = ifp->if_softc;
540 struct ifstat *ifs;
541 int error = 0;
542
543 switch(cmd) {
544 case SIOCGIFSTATUS:
545 ifs = (struct ifstat *)data;
546 mtx_lock(&tp->tun_mtx);
547 if (tp->tun_pid)
548 sprintf(ifs->ascii + strlen(ifs->ascii),
549 "\tOpened by PID %d\n", tp->tun_pid);
550 mtx_unlock(&tp->tun_mtx);
551 break;
552 case SIOCSIFADDR:
553 tuninit(ifp);
554 TUNDEBUG(ifp, "address set\n");
555 break;
556 case SIOCSIFDSTADDR:
557 tuninit(ifp);
558 TUNDEBUG(ifp, "destination address set\n");
559 break;
560 case SIOCSIFMTU:
561 ifp->if_mtu = ifr->ifr_mtu;
562 TUNDEBUG(ifp, "mtu set\n");
563 break;
564 case SIOCSIFFLAGS:
565 case SIOCADDMULTI:
566 case SIOCDELMULTI:
567 break;
568 default:
569 error = EINVAL;
570 }
571 return (error);
572}
573
574/*
575 * tunoutput - queue packets from higher level ready to put out.
576 */
577static int
578tunoutput(struct ifnet *ifp, struct mbuf *m0, struct sockaddr *dst,
579 struct route *ro)
580{
581 struct tun_softc *tp = ifp->if_softc;
582 u_short cached_tun_flags;
583 int error;
584 u_int32_t af;
585
586 TUNDEBUG (ifp, "tunoutput\n");
587
588#ifdef MAC
589 error = mac_ifnet_check_transmit(ifp, m0);
590 if (error) {
591 m_freem(m0);
592 return (error);
593 }
594#endif
595
596 /* Could be unlocked read? */
597 mtx_lock(&tp->tun_mtx);
598 cached_tun_flags = tp->tun_flags;
599 mtx_unlock(&tp->tun_mtx);
600 if ((cached_tun_flags & TUN_READY) != TUN_READY) {
601 TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
602 m_freem (m0);
603 return (EHOSTDOWN);
604 }
605
606 if ((ifp->if_flags & IFF_UP) != IFF_UP) {
607 m_freem (m0);
608 return (EHOSTDOWN);
609 }
610
611 /* BPF writes need to be handled specially. */
612 if (dst->sa_family == AF_UNSPEC) {
613 bcopy(dst->sa_data, &af, sizeof(af));
614 dst->sa_family = af;
615 }
616
617 if (bpf_peers_present(ifp->if_bpf)) {
618 af = dst->sa_family;
619 bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
620 }
621
622 /* prepend sockaddr? this may abort if the mbuf allocation fails */
623 if (cached_tun_flags & TUN_LMODE) {
624 /* allocate space for sockaddr */
625 M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
626
627 /* if allocation failed drop packet */
628 if (m0 == NULL) {
629 ifp->if_iqdrops++;
630 ifp->if_oerrors++;
631 return (ENOBUFS);
632 } else {
633 bcopy(dst, m0->m_data, dst->sa_len);
634 }
635 }
636
637 if (cached_tun_flags & TUN_IFHEAD) {
638 /* Prepend the address family */
639 M_PREPEND(m0, 4, M_DONTWAIT);
640
641 /* if allocation failed drop packet */
642 if (m0 == NULL) {
643 ifp->if_iqdrops++;
644 ifp->if_oerrors++;
645 return (ENOBUFS);
646 } else
647 *(u_int32_t *)m0->m_data = htonl(dst->sa_family);
648 } else {
649#ifdef INET
650 if (dst->sa_family != AF_INET)
651#endif
652 {
653 m_freem(m0);
654 return (EAFNOSUPPORT);
655 }
656 }
657
658 error = (ifp->if_transmit)(ifp, m0);
659 if (error)
660 return (ENOBUFS);
661 ifp->if_opackets++;
662 return (0);
663}
664
665/*
666 * the cdevsw interface is now pretty minimal.
667 */
668static int
669tunioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag,
670 struct thread *td)
671{
672 int error;
673 struct tun_softc *tp = dev->si_drv1;
674 struct tuninfo *tunp;
675
676 switch (cmd) {
677 case TUNSIFINFO:
678 tunp = (struct tuninfo *)data;
679 if (tunp->mtu < IF_MINMTU)
680 return (EINVAL);
681 if (TUN2IFP(tp)->if_mtu != tunp->mtu) {
682 error = priv_check(td, PRIV_NET_SETIFMTU);
683 if (error)
684 return (error);
685 }
686 mtx_lock(&tp->tun_mtx);
687 TUN2IFP(tp)->if_mtu = tunp->mtu;
688 TUN2IFP(tp)->if_type = tunp->type;
689 TUN2IFP(tp)->if_baudrate = tunp->baudrate;
690 mtx_unlock(&tp->tun_mtx);
691 break;
692 case TUNGIFINFO:
693 tunp = (struct tuninfo *)data;
694 mtx_lock(&tp->tun_mtx);
695 tunp->mtu = TUN2IFP(tp)->if_mtu;
696 tunp->type = TUN2IFP(tp)->if_type;
697 tunp->baudrate = TUN2IFP(tp)->if_baudrate;
698 mtx_unlock(&tp->tun_mtx);
699 break;
700 case TUNSDEBUG:
701 tundebug = *(int *)data;
702 break;
703 case TUNGDEBUG:
704 *(int *)data = tundebug;
705 break;
706 case TUNSLMODE:
707 mtx_lock(&tp->tun_mtx);
708 if (*(int *)data) {
709 tp->tun_flags |= TUN_LMODE;
710 tp->tun_flags &= ~TUN_IFHEAD;
711 } else
712 tp->tun_flags &= ~TUN_LMODE;
713 mtx_unlock(&tp->tun_mtx);
714 break;
715 case TUNSIFHEAD:
716 mtx_lock(&tp->tun_mtx);
717 if (*(int *)data) {
718 tp->tun_flags |= TUN_IFHEAD;
719 tp->tun_flags &= ~TUN_LMODE;
720 } else
721 tp->tun_flags &= ~TUN_IFHEAD;
722 mtx_unlock(&tp->tun_mtx);
723 break;
724 case TUNGIFHEAD:
725 mtx_lock(&tp->tun_mtx);
726 *(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
727 mtx_unlock(&tp->tun_mtx);
728 break;
729 case TUNSIFMODE:
730 /* deny this if UP */
731 if (TUN2IFP(tp)->if_flags & IFF_UP)
732 return(EBUSY);
733
734 switch (*(int *)data & ~IFF_MULTICAST) {
735 case IFF_POINTOPOINT:
736 case IFF_BROADCAST:
737 mtx_lock(&tp->tun_mtx);
738 TUN2IFP(tp)->if_flags &=
739 ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
740 TUN2IFP(tp)->if_flags |= *(int *)data;
741 mtx_unlock(&tp->tun_mtx);
742 break;
743 default:
744 return(EINVAL);
745 }
746 break;
747 case TUNSIFPID:
748 mtx_lock(&tp->tun_mtx);
749 tp->tun_pid = curthread->td_proc->p_pid;
750 mtx_unlock(&tp->tun_mtx);
751 break;
752 case FIONBIO:
753 break;
754 case FIOASYNC:
755 mtx_lock(&tp->tun_mtx);
756 if (*(int *)data)
757 tp->tun_flags |= TUN_ASYNC;
758 else
759 tp->tun_flags &= ~TUN_ASYNC;
760 mtx_unlock(&tp->tun_mtx);
761 break;
762 case FIONREAD:
763 if (!IFQ_IS_EMPTY(&TUN2IFP(tp)->if_snd)) {
764 struct mbuf *mb;
765 IFQ_LOCK(&TUN2IFP(tp)->if_snd);
766 IFQ_POLL_NOLOCK(&TUN2IFP(tp)->if_snd, mb);
767 for (*(int *)data = 0; mb != NULL; mb = mb->m_next)
768 *(int *)data += mb->m_len;
769 IFQ_UNLOCK(&TUN2IFP(tp)->if_snd);
770 } else
771 *(int *)data = 0;
772 break;
773 case FIOSETOWN:
774 return (fsetown(*(int *)data, &tp->tun_sigio));
775
776 case FIOGETOWN:
777 *(int *)data = fgetown(&tp->tun_sigio);
778 return (0);
779
780 /* This is deprecated, FIOSETOWN should be used instead. */
781 case TIOCSPGRP:
782 return (fsetown(-(*(int *)data), &tp->tun_sigio));
783
784 /* This is deprecated, FIOGETOWN should be used instead. */
785 case TIOCGPGRP:
786 *(int *)data = -fgetown(&tp->tun_sigio);
787 return (0);
788
789 default:
790 return (ENOTTY);
791 }
792 return (0);
793}
794
795/*
796 * The cdevsw read interface - reads a packet at a time, or at
797 * least as much of a packet as can be read.
798 */
799static int
800tunread(struct cdev *dev, struct uio *uio, int flag)
801{
802 struct tun_softc *tp = dev->si_drv1;
803 struct ifnet *ifp = TUN2IFP(tp);
804 struct mbuf *m;
805 int error=0, len;
806
807 TUNDEBUG (ifp, "read\n");
808 mtx_lock(&tp->tun_mtx);
809 if ((tp->tun_flags & TUN_READY) != TUN_READY) {
810 mtx_unlock(&tp->tun_mtx);
811 TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
812 return (EHOSTDOWN);
813 }
814
815 tp->tun_flags &= ~TUN_RWAIT;
816
817 do {
818 IFQ_DEQUEUE(&ifp->if_snd, m);
819 if (m == NULL) {
820 if (flag & O_NONBLOCK) {
821 mtx_unlock(&tp->tun_mtx);
822 return (EWOULDBLOCK);
823 }
824 tp->tun_flags |= TUN_RWAIT;
825 error = mtx_sleep(tp, &tp->tun_mtx, PCATCH | (PZERO + 1),
826 "tunread", 0);
827 if (error != 0) {
828 mtx_unlock(&tp->tun_mtx);
829 return (error);
830 }
831 }
832 } while (m == NULL);
833 mtx_unlock(&tp->tun_mtx);
834
835 while (m && uio->uio_resid > 0 && error == 0) {
836 len = min(uio->uio_resid, m->m_len);
837 if (len != 0)
838 error = uiomove(mtod(m, void *), len, uio);
839 m = m_free(m);
840 }
841
842 if (m) {
843 TUNDEBUG(ifp, "Dropping mbuf\n");
844 m_freem(m);
845 }
846 return (error);
847}
848
849/*
850 * the cdevsw write interface - an atomic write is a packet - or else!
851 */
852static int
853tunwrite(struct cdev *dev, struct uio *uio, int flag)
854{
855 struct tun_softc *tp = dev->si_drv1;
856 struct ifnet *ifp = TUN2IFP(tp);
857 struct mbuf *m;
858 uint32_t family;
859 int isr;
860
861 TUNDEBUG(ifp, "tunwrite\n");
862
863 if ((ifp->if_flags & IFF_UP) != IFF_UP)
864 /* ignore silently */
865 return (0);
866
867 if (uio->uio_resid == 0)
868 return (0);
869
870 if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
871 TUNDEBUG(ifp, "len=%zd!\n", uio->uio_resid);
872 return (EIO);
873 }
874
875 if ((m = m_uiotombuf(uio, M_DONTWAIT, 0, 0, M_PKTHDR)) == NULL) {
876 ifp->if_ierrors++;
877 return (ENOBUFS);
878 }
879
880 m->m_pkthdr.rcvif = ifp;
881#ifdef MAC
882 mac_ifnet_create_mbuf(ifp, m);
883#endif
884
885 /* Could be unlocked read? */
886 mtx_lock(&tp->tun_mtx);
887 if (tp->tun_flags & TUN_IFHEAD) {
888 mtx_unlock(&tp->tun_mtx);
889 if (m->m_len < sizeof(family) &&
890 (m = m_pullup(m, sizeof(family))) == NULL)
891 return (ENOBUFS);
892 family = ntohl(*mtod(m, u_int32_t *));
893 m_adj(m, sizeof(family));
894 } else {
895 mtx_unlock(&tp->tun_mtx);
896 family = AF_INET;
897 }
898
899 BPF_MTAP2(ifp, &family, sizeof(family), m);
900
901 switch (family) {
902#ifdef INET
903 case AF_INET:
904 isr = NETISR_IP;
905 break;
906#endif
907#ifdef INET6
908 case AF_INET6:
909 isr = NETISR_IPV6;
910 break;
911#endif
912#ifdef IPX
913 case AF_IPX:
914 isr = NETISR_IPX;
915 break;
916#endif
917#ifdef NETATALK
918 case AF_APPLETALK:
919 isr = NETISR_ATALK2;
920 break;
921#endif
922 default:
923 m_freem(m);
924 return (EAFNOSUPPORT);
925 }
926 /* First chunk of an mbuf contains good junk */
927 if (harvest.point_to_point)
928 random_harvest(m, 16, 3, 0, RANDOM_NET);
929 ifp->if_ibytes += m->m_pkthdr.len;
930 ifp->if_ipackets++;
931 CURVNET_SET(ifp->if_vnet);
| 17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23
24#include <sys/param.h>
25#include <sys/priv.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/jail.h>
29#include <sys/mbuf.h>
30#include <sys/module.h>
31#include <sys/socket.h>
32#include <sys/fcntl.h>
33#include <sys/filio.h>
34#include <sys/sockio.h>
35#include <sys/ttycom.h>
36#include <sys/poll.h>
37#include <sys/selinfo.h>
38#include <sys/signalvar.h>
39#include <sys/filedesc.h>
40#include <sys/kernel.h>
41#include <sys/sysctl.h>
42#include <sys/conf.h>
43#include <sys/uio.h>
44#include <sys/malloc.h>
45#include <sys/random.h>
46
47#include <net/if.h>
48#include <net/if_clone.h>
49#include <net/if_types.h>
50#include <net/netisr.h>
51#include <net/route.h>
52#include <net/vnet.h>
53#ifdef INET
54#include <netinet/in.h>
55#endif
56#include <net/bpf.h>
57#include <net/if_tun.h>
58
59#include <sys/queue.h>
60#include <sys/condvar.h>
61
62#include <security/mac/mac_framework.h>
63
64/*
65 * tun_list is protected by global tunmtx. Other mutable fields are
66 * protected by tun->tun_mtx, or by their owning subsystem. tun_dev is
67 * static for the duration of a tunnel interface.
68 */
69struct tun_softc {
70 TAILQ_ENTRY(tun_softc) tun_list;
71 struct cdev *tun_dev;
72 u_short tun_flags; /* misc flags */
73#define TUN_OPEN 0x0001
74#define TUN_INITED 0x0002
75#define TUN_RCOLL 0x0004
76#define TUN_IASET 0x0008
77#define TUN_DSTADDR 0x0010
78#define TUN_LMODE 0x0020
79#define TUN_RWAIT 0x0040
80#define TUN_ASYNC 0x0080
81#define TUN_IFHEAD 0x0100
82
83#define TUN_READY (TUN_OPEN | TUN_INITED)
84
85 /*
86 * XXXRW: tun_pid is used to exclusively lock /dev/tun. Is this
87 * actually needed? Can we just return EBUSY if already open?
88 * Problem is that this involved inherent races when a tun device
89 * is handed off from one process to another, as opposed to just
90 * being slightly stale informationally.
91 */
92 pid_t tun_pid; /* owning pid */
93 struct ifnet *tun_ifp; /* the interface */
94 struct sigio *tun_sigio; /* information for async I/O */
95 struct selinfo tun_rsel; /* read select */
96 struct mtx tun_mtx; /* protect mutable softc fields */
97 struct cv tun_cv; /* protect against ref'd dev destroy */
98};
99#define TUN2IFP(sc) ((sc)->tun_ifp)
100
101#define TUNDEBUG if (tundebug) if_printf
102#define TUNNAME "tun"
103
104/*
105 * All mutable global variables in if_tun are locked using tunmtx, with
106 * the exception of tundebug, which is used unlocked, and tunclones,
107 * which is static after setup.
108 */
109static struct mtx tunmtx;
110static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
111static int tundebug = 0;
112static int tundclone = 1;
113static struct clonedevs *tunclones;
114static TAILQ_HEAD(,tun_softc) tunhead = TAILQ_HEAD_INITIALIZER(tunhead);
115SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
116
117SYSCTL_DECL(_net_link);
118SYSCTL_NODE(_net_link, OID_AUTO, tun, CTLFLAG_RW, 0,
119 "IP tunnel software network interface.");
120SYSCTL_INT(_net_link_tun, OID_AUTO, devfs_cloning, CTLFLAG_RW, &tundclone, 0,
121 "Enable legacy devfs interface creation.");
122
123TUNABLE_INT("net.link.tun.devfs_cloning", &tundclone);
124
125static void tunclone(void *arg, struct ucred *cred, char *name,
126 int namelen, struct cdev **dev);
127static void tuncreate(const char *name, struct cdev *dev);
128static int tunifioctl(struct ifnet *, u_long, caddr_t);
129static void tuninit(struct ifnet *);
130static int tunmodevent(module_t, int, void *);
131static int tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
132 struct route *ro);
133static void tunstart(struct ifnet *);
134
135static int tun_clone_create(struct if_clone *, int, caddr_t);
136static void tun_clone_destroy(struct ifnet *);
137
138IFC_SIMPLE_DECLARE(tun, 0);
139
140static d_open_t tunopen;
141static d_close_t tunclose;
142static d_read_t tunread;
143static d_write_t tunwrite;
144static d_ioctl_t tunioctl;
145static d_poll_t tunpoll;
146static d_kqfilter_t tunkqfilter;
147
148static int tunkqread(struct knote *, long);
149static int tunkqwrite(struct knote *, long);
150static void tunkqdetach(struct knote *);
151
152static struct filterops tun_read_filterops = {
153 .f_isfd = 1,
154 .f_attach = NULL,
155 .f_detach = tunkqdetach,
156 .f_event = tunkqread,
157};
158
159static struct filterops tun_write_filterops = {
160 .f_isfd = 1,
161 .f_attach = NULL,
162 .f_detach = tunkqdetach,
163 .f_event = tunkqwrite,
164};
165
166static struct cdevsw tun_cdevsw = {
167 .d_version = D_VERSION,
168 .d_flags = D_PSEUDO | D_NEEDMINOR,
169 .d_open = tunopen,
170 .d_close = tunclose,
171 .d_read = tunread,
172 .d_write = tunwrite,
173 .d_ioctl = tunioctl,
174 .d_poll = tunpoll,
175 .d_kqfilter = tunkqfilter,
176 .d_name = TUNNAME,
177};
178
179static int
180tun_clone_create(struct if_clone *ifc, int unit, caddr_t params)
181{
182 struct cdev *dev;
183 int i;
184
185 /* find any existing device, or allocate new unit number */
186 i = clone_create(&tunclones, &tun_cdevsw, &unit, &dev, 0);
187 if (i) {
188 /* No preexisting struct cdev *, create one */
189 dev = make_dev(&tun_cdevsw, unit,
190 UID_UUCP, GID_DIALER, 0600, "%s%d", ifc->ifc_name, unit);
191 }
192 tuncreate(ifc->ifc_name, dev);
193
194 return (0);
195}
196
197static void
198tunclone(void *arg, struct ucred *cred, char *name, int namelen,
199 struct cdev **dev)
200{
201 char devname[SPECNAMELEN + 1];
202 int u, i, append_unit;
203
204 if (*dev != NULL)
205 return;
206
207 /*
208 * If tun cloning is enabled, only the superuser can create an
209 * interface.
210 */
211 if (!tundclone || priv_check_cred(cred, PRIV_NET_IFCREATE, 0) != 0)
212 return;
213
214 if (strcmp(name, TUNNAME) == 0) {
215 u = -1;
216 } else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
217 return; /* Don't recognise the name */
218 if (u != -1 && u > IF_MAXUNIT)
219 return; /* Unit number too high */
220
221 if (u == -1)
222 append_unit = 1;
223 else
224 append_unit = 0;
225
226 CURVNET_SET(CRED_TO_VNET(cred));
227 /* find any existing device, or allocate new unit number */
228 i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
229 if (i) {
230 if (append_unit) {
231 namelen = snprintf(devname, sizeof(devname), "%s%d",
232 name, u);
233 name = devname;
234 }
235 /* No preexisting struct cdev *, create one */
236 *dev = make_dev_credf(MAKEDEV_REF, &tun_cdevsw, u, cred,
237 UID_UUCP, GID_DIALER, 0600, "%s", name);
238 }
239
240 if_clone_create(name, namelen, NULL);
241 CURVNET_RESTORE();
242}
243
244static void
245tun_destroy(struct tun_softc *tp)
246{
247 struct cdev *dev;
248
249 /* Unlocked read. */
250 mtx_lock(&tp->tun_mtx);
251 if ((tp->tun_flags & TUN_OPEN) != 0)
252 cv_wait_unlock(&tp->tun_cv, &tp->tun_mtx);
253 else
254 mtx_unlock(&tp->tun_mtx);
255
256 CURVNET_SET(TUN2IFP(tp)->if_vnet);
257 dev = tp->tun_dev;
258 bpfdetach(TUN2IFP(tp));
259 if_detach(TUN2IFP(tp));
260 if_free(TUN2IFP(tp));
261 destroy_dev(dev);
262 knlist_destroy(&tp->tun_rsel.si_note);
263 mtx_destroy(&tp->tun_mtx);
264 cv_destroy(&tp->tun_cv);
265 free(tp, M_TUN);
266 CURVNET_RESTORE();
267}
268
269static void
270tun_clone_destroy(struct ifnet *ifp)
271{
272 struct tun_softc *tp = ifp->if_softc;
273
274 mtx_lock(&tunmtx);
275 TAILQ_REMOVE(&tunhead, tp, tun_list);
276 mtx_unlock(&tunmtx);
277 tun_destroy(tp);
278}
279
280static int
281tunmodevent(module_t mod, int type, void *data)
282{
283 static eventhandler_tag tag;
284 struct tun_softc *tp;
285
286 switch (type) {
287 case MOD_LOAD:
288 mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
289 clone_setup(&tunclones);
290 tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
291 if (tag == NULL)
292 return (ENOMEM);
293 if_clone_attach(&tun_cloner);
294 break;
295 case MOD_UNLOAD:
296 if_clone_detach(&tun_cloner);
297 EVENTHANDLER_DEREGISTER(dev_clone, tag);
298 drain_dev_clone_events();
299
300 mtx_lock(&tunmtx);
301 while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
302 TAILQ_REMOVE(&tunhead, tp, tun_list);
303 mtx_unlock(&tunmtx);
304 tun_destroy(tp);
305 mtx_lock(&tunmtx);
306 }
307 mtx_unlock(&tunmtx);
308 clone_cleanup(&tunclones);
309 mtx_destroy(&tunmtx);
310 break;
311 default:
312 return EOPNOTSUPP;
313 }
314 return 0;
315}
316
317static moduledata_t tun_mod = {
318 "if_tun",
319 tunmodevent,
320 0
321};
322
323DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
324
325static void
326tunstart(struct ifnet *ifp)
327{
328 struct tun_softc *tp = ifp->if_softc;
329 struct mbuf *m;
330
331 TUNDEBUG(ifp,"%s starting\n", ifp->if_xname);
332 if (ALTQ_IS_ENABLED(&ifp->if_snd)) {
333 IFQ_LOCK(&ifp->if_snd);
334 IFQ_POLL_NOLOCK(&ifp->if_snd, m);
335 if (m == NULL) {
336 IFQ_UNLOCK(&ifp->if_snd);
337 return;
338 }
339 IFQ_UNLOCK(&ifp->if_snd);
340 }
341
342 mtx_lock(&tp->tun_mtx);
343 if (tp->tun_flags & TUN_RWAIT) {
344 tp->tun_flags &= ~TUN_RWAIT;
345 wakeup(tp);
346 }
347 selwakeuppri(&tp->tun_rsel, PZERO + 1);
348 KNOTE_LOCKED(&tp->tun_rsel.si_note, 0);
349 if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio) {
350 mtx_unlock(&tp->tun_mtx);
351 pgsigio(&tp->tun_sigio, SIGIO, 0);
352 } else
353 mtx_unlock(&tp->tun_mtx);
354}
355
356/* XXX: should return an error code so it can fail. */
357static void
358tuncreate(const char *name, struct cdev *dev)
359{
360 struct tun_softc *sc;
361 struct ifnet *ifp;
362
363 dev->si_flags &= ~SI_CHEAPCLONE;
364
365 sc = malloc(sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
366 mtx_init(&sc->tun_mtx, "tun_mtx", NULL, MTX_DEF);
367 cv_init(&sc->tun_cv, "tun_condvar");
368 sc->tun_flags = TUN_INITED;
369 sc->tun_dev = dev;
370 mtx_lock(&tunmtx);
371 TAILQ_INSERT_TAIL(&tunhead, sc, tun_list);
372 mtx_unlock(&tunmtx);
373
374 ifp = sc->tun_ifp = if_alloc(IFT_PPP);
375 if (ifp == NULL)
376 panic("%s%d: failed to if_alloc() interface.\n",
377 name, dev2unit(dev));
378 if_initname(ifp, name, dev2unit(dev));
379 ifp->if_mtu = TUNMTU;
380 ifp->if_ioctl = tunifioctl;
381 ifp->if_output = tunoutput;
382 ifp->if_start = tunstart;
383 ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
384 ifp->if_softc = sc;
385 IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
386 ifp->if_snd.ifq_drv_maxlen = 0;
387 IFQ_SET_READY(&ifp->if_snd);
388 knlist_init_mtx(&sc->tun_rsel.si_note, &sc->tun_mtx);
389 ifp->if_capabilities |= IFCAP_LINKSTATE;
390 ifp->if_capenable |= IFCAP_LINKSTATE;
391
392 if_attach(ifp);
393 bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
394 dev->si_drv1 = sc;
395 TUNDEBUG(ifp, "interface %s is created, minor = %#x\n",
396 ifp->if_xname, dev2unit(dev));
397}
398
399static int
400tunopen(struct cdev *dev, int flag, int mode, struct thread *td)
401{
402 struct ifnet *ifp;
403 struct tun_softc *tp;
404
405 /*
406 * XXXRW: Non-atomic test and set of dev->si_drv1 requires
407 * synchronization.
408 */
409 tp = dev->si_drv1;
410 if (!tp) {
411 tuncreate(TUNNAME, dev);
412 tp = dev->si_drv1;
413 }
414
415 /*
416 * XXXRW: This use of tun_pid is subject to error due to the
417 * fact that a reference to the tunnel can live beyond the
418 * death of the process that created it. Can we replace this
419 * with a simple busy flag?
420 */
421 mtx_lock(&tp->tun_mtx);
422 if (tp->tun_pid != 0 && tp->tun_pid != td->td_proc->p_pid) {
423 mtx_unlock(&tp->tun_mtx);
424 return (EBUSY);
425 }
426 tp->tun_pid = td->td_proc->p_pid;
427
428 tp->tun_flags |= TUN_OPEN;
429 ifp = TUN2IFP(tp);
430 if_link_state_change(ifp, LINK_STATE_UP);
431 TUNDEBUG(ifp, "open\n");
432 mtx_unlock(&tp->tun_mtx);
433
434 return (0);
435}
436
437/*
438 * tunclose - close the device - mark i/f down & delete
439 * routing info
440 */
441static int
442tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
443{
444 struct tun_softc *tp;
445 struct ifnet *ifp;
446
447 tp = dev->si_drv1;
448 ifp = TUN2IFP(tp);
449
450 mtx_lock(&tp->tun_mtx);
451 tp->tun_flags &= ~TUN_OPEN;
452 tp->tun_pid = 0;
453
454 /*
455 * junk all pending output
456 */
457 CURVNET_SET(ifp->if_vnet);
458 IFQ_PURGE(&ifp->if_snd);
459
460 if (ifp->if_flags & IFF_UP) {
461 mtx_unlock(&tp->tun_mtx);
462 if_down(ifp);
463 mtx_lock(&tp->tun_mtx);
464 }
465
466 /* Delete all addresses and routes which reference this interface. */
467 if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
468 struct ifaddr *ifa;
469
470 ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
471 mtx_unlock(&tp->tun_mtx);
472 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
473 /* deal w/IPv4 PtP destination; unlocked read */
474 if (ifa->ifa_addr->sa_family == AF_INET) {
475 rtinit(ifa, (int)RTM_DELETE,
476 tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
477 } else {
478 rtinit(ifa, (int)RTM_DELETE, 0);
479 }
480 }
481 if_purgeaddrs(ifp);
482 mtx_lock(&tp->tun_mtx);
483 }
484 if_link_state_change(ifp, LINK_STATE_DOWN);
485 CURVNET_RESTORE();
486
487 funsetown(&tp->tun_sigio);
488 selwakeuppri(&tp->tun_rsel, PZERO + 1);
489 KNOTE_LOCKED(&tp->tun_rsel.si_note, 0);
490 TUNDEBUG (ifp, "closed\n");
491
492 cv_broadcast(&tp->tun_cv);
493 mtx_unlock(&tp->tun_mtx);
494 return (0);
495}
496
497static void
498tuninit(struct ifnet *ifp)
499{
500 struct tun_softc *tp = ifp->if_softc;
501#ifdef INET
502 struct ifaddr *ifa;
503#endif
504
505 TUNDEBUG(ifp, "tuninit\n");
506
507 mtx_lock(&tp->tun_mtx);
508 ifp->if_flags |= IFF_UP;
509 ifp->if_drv_flags |= IFF_DRV_RUNNING;
510 getmicrotime(&ifp->if_lastchange);
511
512#ifdef INET
513 if_addr_rlock(ifp);
514 TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
515 if (ifa->ifa_addr->sa_family == AF_INET) {
516 struct sockaddr_in *si;
517
518 si = (struct sockaddr_in *)ifa->ifa_addr;
519 if (si->sin_addr.s_addr)
520 tp->tun_flags |= TUN_IASET;
521
522 si = (struct sockaddr_in *)ifa->ifa_dstaddr;
523 if (si && si->sin_addr.s_addr)
524 tp->tun_flags |= TUN_DSTADDR;
525 }
526 }
527 if_addr_runlock(ifp);
528#endif
529 mtx_unlock(&tp->tun_mtx);
530}
531
532/*
533 * Process an ioctl request.
534 */
535static int
536tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
537{
538 struct ifreq *ifr = (struct ifreq *)data;
539 struct tun_softc *tp = ifp->if_softc;
540 struct ifstat *ifs;
541 int error = 0;
542
543 switch(cmd) {
544 case SIOCGIFSTATUS:
545 ifs = (struct ifstat *)data;
546 mtx_lock(&tp->tun_mtx);
547 if (tp->tun_pid)
548 sprintf(ifs->ascii + strlen(ifs->ascii),
549 "\tOpened by PID %d\n", tp->tun_pid);
550 mtx_unlock(&tp->tun_mtx);
551 break;
552 case SIOCSIFADDR:
553 tuninit(ifp);
554 TUNDEBUG(ifp, "address set\n");
555 break;
556 case SIOCSIFDSTADDR:
557 tuninit(ifp);
558 TUNDEBUG(ifp, "destination address set\n");
559 break;
560 case SIOCSIFMTU:
561 ifp->if_mtu = ifr->ifr_mtu;
562 TUNDEBUG(ifp, "mtu set\n");
563 break;
564 case SIOCSIFFLAGS:
565 case SIOCADDMULTI:
566 case SIOCDELMULTI:
567 break;
568 default:
569 error = EINVAL;
570 }
571 return (error);
572}
573
574/*
575 * tunoutput - queue packets from higher level ready to put out.
576 */
577static int
578tunoutput(struct ifnet *ifp, struct mbuf *m0, struct sockaddr *dst,
579 struct route *ro)
580{
581 struct tun_softc *tp = ifp->if_softc;
582 u_short cached_tun_flags;
583 int error;
584 u_int32_t af;
585
586 TUNDEBUG (ifp, "tunoutput\n");
587
588#ifdef MAC
589 error = mac_ifnet_check_transmit(ifp, m0);
590 if (error) {
591 m_freem(m0);
592 return (error);
593 }
594#endif
595
596 /* Could be unlocked read? */
597 mtx_lock(&tp->tun_mtx);
598 cached_tun_flags = tp->tun_flags;
599 mtx_unlock(&tp->tun_mtx);
600 if ((cached_tun_flags & TUN_READY) != TUN_READY) {
601 TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
602 m_freem (m0);
603 return (EHOSTDOWN);
604 }
605
606 if ((ifp->if_flags & IFF_UP) != IFF_UP) {
607 m_freem (m0);
608 return (EHOSTDOWN);
609 }
610
611 /* BPF writes need to be handled specially. */
612 if (dst->sa_family == AF_UNSPEC) {
613 bcopy(dst->sa_data, &af, sizeof(af));
614 dst->sa_family = af;
615 }
616
617 if (bpf_peers_present(ifp->if_bpf)) {
618 af = dst->sa_family;
619 bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
620 }
621
622 /* prepend sockaddr? this may abort if the mbuf allocation fails */
623 if (cached_tun_flags & TUN_LMODE) {
624 /* allocate space for sockaddr */
625 M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
626
627 /* if allocation failed drop packet */
628 if (m0 == NULL) {
629 ifp->if_iqdrops++;
630 ifp->if_oerrors++;
631 return (ENOBUFS);
632 } else {
633 bcopy(dst, m0->m_data, dst->sa_len);
634 }
635 }
636
637 if (cached_tun_flags & TUN_IFHEAD) {
638 /* Prepend the address family */
639 M_PREPEND(m0, 4, M_DONTWAIT);
640
641 /* if allocation failed drop packet */
642 if (m0 == NULL) {
643 ifp->if_iqdrops++;
644 ifp->if_oerrors++;
645 return (ENOBUFS);
646 } else
647 *(u_int32_t *)m0->m_data = htonl(dst->sa_family);
648 } else {
649#ifdef INET
650 if (dst->sa_family != AF_INET)
651#endif
652 {
653 m_freem(m0);
654 return (EAFNOSUPPORT);
655 }
656 }
657
658 error = (ifp->if_transmit)(ifp, m0);
659 if (error)
660 return (ENOBUFS);
661 ifp->if_opackets++;
662 return (0);
663}
664
665/*
666 * the cdevsw interface is now pretty minimal.
667 */
668static int
669tunioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag,
670 struct thread *td)
671{
672 int error;
673 struct tun_softc *tp = dev->si_drv1;
674 struct tuninfo *tunp;
675
676 switch (cmd) {
677 case TUNSIFINFO:
678 tunp = (struct tuninfo *)data;
679 if (tunp->mtu < IF_MINMTU)
680 return (EINVAL);
681 if (TUN2IFP(tp)->if_mtu != tunp->mtu) {
682 error = priv_check(td, PRIV_NET_SETIFMTU);
683 if (error)
684 return (error);
685 }
686 mtx_lock(&tp->tun_mtx);
687 TUN2IFP(tp)->if_mtu = tunp->mtu;
688 TUN2IFP(tp)->if_type = tunp->type;
689 TUN2IFP(tp)->if_baudrate = tunp->baudrate;
690 mtx_unlock(&tp->tun_mtx);
691 break;
692 case TUNGIFINFO:
693 tunp = (struct tuninfo *)data;
694 mtx_lock(&tp->tun_mtx);
695 tunp->mtu = TUN2IFP(tp)->if_mtu;
696 tunp->type = TUN2IFP(tp)->if_type;
697 tunp->baudrate = TUN2IFP(tp)->if_baudrate;
698 mtx_unlock(&tp->tun_mtx);
699 break;
700 case TUNSDEBUG:
701 tundebug = *(int *)data;
702 break;
703 case TUNGDEBUG:
704 *(int *)data = tundebug;
705 break;
706 case TUNSLMODE:
707 mtx_lock(&tp->tun_mtx);
708 if (*(int *)data) {
709 tp->tun_flags |= TUN_LMODE;
710 tp->tun_flags &= ~TUN_IFHEAD;
711 } else
712 tp->tun_flags &= ~TUN_LMODE;
713 mtx_unlock(&tp->tun_mtx);
714 break;
715 case TUNSIFHEAD:
716 mtx_lock(&tp->tun_mtx);
717 if (*(int *)data) {
718 tp->tun_flags |= TUN_IFHEAD;
719 tp->tun_flags &= ~TUN_LMODE;
720 } else
721 tp->tun_flags &= ~TUN_IFHEAD;
722 mtx_unlock(&tp->tun_mtx);
723 break;
724 case TUNGIFHEAD:
725 mtx_lock(&tp->tun_mtx);
726 *(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
727 mtx_unlock(&tp->tun_mtx);
728 break;
729 case TUNSIFMODE:
730 /* deny this if UP */
731 if (TUN2IFP(tp)->if_flags & IFF_UP)
732 return(EBUSY);
733
734 switch (*(int *)data & ~IFF_MULTICAST) {
735 case IFF_POINTOPOINT:
736 case IFF_BROADCAST:
737 mtx_lock(&tp->tun_mtx);
738 TUN2IFP(tp)->if_flags &=
739 ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
740 TUN2IFP(tp)->if_flags |= *(int *)data;
741 mtx_unlock(&tp->tun_mtx);
742 break;
743 default:
744 return(EINVAL);
745 }
746 break;
747 case TUNSIFPID:
748 mtx_lock(&tp->tun_mtx);
749 tp->tun_pid = curthread->td_proc->p_pid;
750 mtx_unlock(&tp->tun_mtx);
751 break;
752 case FIONBIO:
753 break;
754 case FIOASYNC:
755 mtx_lock(&tp->tun_mtx);
756 if (*(int *)data)
757 tp->tun_flags |= TUN_ASYNC;
758 else
759 tp->tun_flags &= ~TUN_ASYNC;
760 mtx_unlock(&tp->tun_mtx);
761 break;
762 case FIONREAD:
763 if (!IFQ_IS_EMPTY(&TUN2IFP(tp)->if_snd)) {
764 struct mbuf *mb;
765 IFQ_LOCK(&TUN2IFP(tp)->if_snd);
766 IFQ_POLL_NOLOCK(&TUN2IFP(tp)->if_snd, mb);
767 for (*(int *)data = 0; mb != NULL; mb = mb->m_next)
768 *(int *)data += mb->m_len;
769 IFQ_UNLOCK(&TUN2IFP(tp)->if_snd);
770 } else
771 *(int *)data = 0;
772 break;
773 case FIOSETOWN:
774 return (fsetown(*(int *)data, &tp->tun_sigio));
775
776 case FIOGETOWN:
777 *(int *)data = fgetown(&tp->tun_sigio);
778 return (0);
779
780 /* This is deprecated, FIOSETOWN should be used instead. */
781 case TIOCSPGRP:
782 return (fsetown(-(*(int *)data), &tp->tun_sigio));
783
784 /* This is deprecated, FIOGETOWN should be used instead. */
785 case TIOCGPGRP:
786 *(int *)data = -fgetown(&tp->tun_sigio);
787 return (0);
788
789 default:
790 return (ENOTTY);
791 }
792 return (0);
793}
794
795/*
796 * The cdevsw read interface - reads a packet at a time, or at
797 * least as much of a packet as can be read.
798 */
799static int
800tunread(struct cdev *dev, struct uio *uio, int flag)
801{
802 struct tun_softc *tp = dev->si_drv1;
803 struct ifnet *ifp = TUN2IFP(tp);
804 struct mbuf *m;
805 int error=0, len;
806
807 TUNDEBUG (ifp, "read\n");
808 mtx_lock(&tp->tun_mtx);
809 if ((tp->tun_flags & TUN_READY) != TUN_READY) {
810 mtx_unlock(&tp->tun_mtx);
811 TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
812 return (EHOSTDOWN);
813 }
814
815 tp->tun_flags &= ~TUN_RWAIT;
816
817 do {
818 IFQ_DEQUEUE(&ifp->if_snd, m);
819 if (m == NULL) {
820 if (flag & O_NONBLOCK) {
821 mtx_unlock(&tp->tun_mtx);
822 return (EWOULDBLOCK);
823 }
824 tp->tun_flags |= TUN_RWAIT;
825 error = mtx_sleep(tp, &tp->tun_mtx, PCATCH | (PZERO + 1),
826 "tunread", 0);
827 if (error != 0) {
828 mtx_unlock(&tp->tun_mtx);
829 return (error);
830 }
831 }
832 } while (m == NULL);
833 mtx_unlock(&tp->tun_mtx);
834
835 while (m && uio->uio_resid > 0 && error == 0) {
836 len = min(uio->uio_resid, m->m_len);
837 if (len != 0)
838 error = uiomove(mtod(m, void *), len, uio);
839 m = m_free(m);
840 }
841
842 if (m) {
843 TUNDEBUG(ifp, "Dropping mbuf\n");
844 m_freem(m);
845 }
846 return (error);
847}
848
849/*
850 * the cdevsw write interface - an atomic write is a packet - or else!
851 */
852static int
853tunwrite(struct cdev *dev, struct uio *uio, int flag)
854{
855 struct tun_softc *tp = dev->si_drv1;
856 struct ifnet *ifp = TUN2IFP(tp);
857 struct mbuf *m;
858 uint32_t family;
859 int isr;
860
861 TUNDEBUG(ifp, "tunwrite\n");
862
863 if ((ifp->if_flags & IFF_UP) != IFF_UP)
864 /* ignore silently */
865 return (0);
866
867 if (uio->uio_resid == 0)
868 return (0);
869
870 if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
871 TUNDEBUG(ifp, "len=%zd!\n", uio->uio_resid);
872 return (EIO);
873 }
874
875 if ((m = m_uiotombuf(uio, M_DONTWAIT, 0, 0, M_PKTHDR)) == NULL) {
876 ifp->if_ierrors++;
877 return (ENOBUFS);
878 }
879
880 m->m_pkthdr.rcvif = ifp;
881#ifdef MAC
882 mac_ifnet_create_mbuf(ifp, m);
883#endif
884
885 /* Could be unlocked read? */
886 mtx_lock(&tp->tun_mtx);
887 if (tp->tun_flags & TUN_IFHEAD) {
888 mtx_unlock(&tp->tun_mtx);
889 if (m->m_len < sizeof(family) &&
890 (m = m_pullup(m, sizeof(family))) == NULL)
891 return (ENOBUFS);
892 family = ntohl(*mtod(m, u_int32_t *));
893 m_adj(m, sizeof(family));
894 } else {
895 mtx_unlock(&tp->tun_mtx);
896 family = AF_INET;
897 }
898
899 BPF_MTAP2(ifp, &family, sizeof(family), m);
900
901 switch (family) {
902#ifdef INET
903 case AF_INET:
904 isr = NETISR_IP;
905 break;
906#endif
907#ifdef INET6
908 case AF_INET6:
909 isr = NETISR_IPV6;
910 break;
911#endif
912#ifdef IPX
913 case AF_IPX:
914 isr = NETISR_IPX;
915 break;
916#endif
917#ifdef NETATALK
918 case AF_APPLETALK:
919 isr = NETISR_ATALK2;
920 break;
921#endif
922 default:
923 m_freem(m);
924 return (EAFNOSUPPORT);
925 }
926 /* First chunk of an mbuf contains good junk */
927 if (harvest.point_to_point)
928 random_harvest(m, 16, 3, 0, RANDOM_NET);
929 ifp->if_ibytes += m->m_pkthdr.len;
930 ifp->if_ipackets++;
931 CURVNET_SET(ifp->if_vnet);
|