if_tun.c revision 111815 
1/*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2
3/*
4 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5 * Nottingham University 1987.
6 *
7 * This source may be freely distributed, however I would be interested
8 * in any changes that are made.
9 *
10 * This driver takes packets off the IP i/f and hands them up to a
11 * user process to have its wicked way with. This driver has it's
12 * roots in a similar driver written by Phil Cockcroft (formerly) at
13 * UCL. This driver is based much more on read/write/poll mode of
14 * operation though.
15 *
16 * $FreeBSD: head/sys/net/if_tun.c 111815 2003-03-03 12:15:54Z phk $
17 */
18
19#include "opt_inet.h"
20#include "opt_mac.h"
21
22#include <sys/param.h>
23#include <sys/proc.h>
24#include <sys/systm.h>
25#include <sys/mac.h>
26#include <sys/mbuf.h>
27#include <sys/module.h>
28#include <sys/socket.h>
29#include <sys/filio.h>
30#include <sys/sockio.h>
31#include <sys/ttycom.h>
32#include <sys/poll.h>
33#include <sys/signalvar.h>
34#include <sys/filedesc.h>
35#include <sys/kernel.h>
36#include <sys/sysctl.h>
37#include <sys/conf.h>
38#include <sys/uio.h>
39#include <sys/vnode.h>
40#include <sys/malloc.h>
41#include <machine/bus.h>	/* XXX Shouldn't really be required ! */
42#include <sys/rman.h>
43
44#include <net/if.h>
45#include <net/if_types.h>
46#include <net/route.h>
47#include <net/intrq.h>
48#ifdef INET
49#include <netinet/in.h>
50#endif
51#include <net/bpf.h>
52#include <net/if_tunvar.h>
53#include <net/if_tun.h>
54
55#define TUNDEBUG	if (tundebug) printf
56#define	TUNNAME		"tun"
57#define	TUN_MAXUNIT	0x7fff	/* ifp->if_unit is only 15 bits */
58
59static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
60static int tundebug = 0;
61static struct tun_softc *tunhead = NULL;
62static struct rman tununits;
63static udev_t tunbasedev = NOUDEV;
64SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
65
66static void	tunclone(void *arg, char *name, int namelen, dev_t *dev);
67static void	tuncreate(dev_t dev);
68static int	tunifioctl(struct ifnet *, u_long, caddr_t);
69static int	tuninit(struct ifnet *);
70static int	tunmodevent(module_t, int, void *);
71static int	tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
72		    struct rtentry *rt);
73static void	tunstart(struct ifnet *);
74
75static d_open_t		tunopen;
76static d_close_t	tunclose;
77static d_read_t		tunread;
78static d_write_t	tunwrite;
79static d_ioctl_t	tunioctl;
80static d_poll_t		tunpoll;
81
82#define CDEV_MAJOR 52
83static struct cdevsw tun_cdevsw = {
84	.d_open =	tunopen,
85	.d_close =	tunclose,
86	.d_read =	tunread,
87	.d_write =	tunwrite,
88	.d_ioctl =	tunioctl,
89	.d_poll =	tunpoll,
90	.d_name =	TUNNAME,
91	.d_maj =	CDEV_MAJOR,
92};
93
94static void
95tunclone(void *arg, char *name, int namelen, dev_t *dev)
96{
97	struct resource *r;
98	int err;
99	int u;
100
101	if (*dev != NODEV)
102		return;
103
104	if (strcmp(name, TUNNAME) == 0) {
105		r = rman_reserve_resource(&tununits, 0, TUN_MAXUNIT, 1,
106		    RF_ALLOCATED | RF_ACTIVE, NULL);
107		u = rman_get_start(r);
108		err = rman_release_resource(r);
109		KASSERT(err == 0, ("Unexpected failure releasing resource"));
110		*dev = makedev(CDEV_MAJOR, unit2minor(u));
111		if ((*dev)->si_flags & SI_NAMED)
112			return;	/* Already make_dev()d */
113	} else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
114		return;	/* Don't recognise the name */
115
116	*dev = make_dev(&tun_cdevsw, unit2minor(u),
117	    UID_ROOT, GID_WHEEL, 0600, "tun%d", u);
118
119	/*
120	 * All devices depend on tunbasedev so that we can simply
121	 * destroy_dev() this device at module unload time to get
122	 * rid of all our make_dev()d resources.
123	 */
124	if (tunbasedev == NOUDEV)
125		tunbasedev = (*dev)->si_udev;
126	else {
127		(*dev)->si_flags |= SI_CHEAPCLONE;
128		dev_depends(udev2dev(tunbasedev, 0), *dev);
129	}
130}
131
132static int
133tunmodevent(module_t mod, int type, void *data)
134{
135	static eventhandler_tag tag;
136	struct tun_softc *tp;
137	dev_t dev;
138	int err;
139
140	switch (type) {
141	case MOD_LOAD:
142		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
143		if (tag == NULL)
144			return (ENOMEM);
145		tununits.rm_type = RMAN_ARRAY;
146		tununits.rm_descr = "open if_tun units";
147		err = rman_init(&tununits);
148		if (err != 0) {
149			EVENTHANDLER_DEREGISTER(dev_clone, tag);
150			return (err);
151		}
152		err = rman_manage_region(&tununits, 0, TUN_MAXUNIT);
153		if (err != 0) {
154			printf("%s: tununits: rman_manage_region: Failed %d\n",
155			    TUNNAME, err);
156			rman_fini(&tununits);
157			EVENTHANDLER_DEREGISTER(dev_clone, tag);
158			return (err);
159		}
160		break;
161	case MOD_UNLOAD:
162		err = rman_fini(&tununits);
163		if (err != 0)
164			return (err);
165		EVENTHANDLER_DEREGISTER(dev_clone, tag);
166
167		while (tunhead != NULL) {
168			KASSERT((tunhead->tun_flags & TUN_OPEN) == 0,
169			    ("tununits is out of sync - unit %d",
170			    tunhead->tun_if.if_unit));
171			tp = tunhead;
172			dev = makedev(tun_cdevsw.d_maj,
173			    unit2minor(tp->tun_if.if_unit));
174			KASSERT(dev->si_drv1 == tp, ("Bad makedev result"));
175			tunhead = tp->next;
176			bpfdetach(&tp->tun_if);
177			if_detach(&tp->tun_if);
178			KASSERT(dev->si_flags & SI_NAMED, ("Missing make_dev"));
179			free(tp, M_TUN);
180		}
181
182		/*
183		 * Destroying tunbasedev results in all of our make_dev()s
184		 * conveniently going away.
185		 */
186		if (tunbasedev != NOUDEV)
187			destroy_dev(udev2dev(tunbasedev, 0));
188
189		break;
190	}
191	return 0;
192}
193
194static moduledata_t tun_mod = {
195	"if_tun",
196	tunmodevent,
197	0
198};
199
200DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
201
202static void
203tunstart(struct ifnet *ifp)
204{
205	struct tun_softc *tp = ifp->if_softc;
206
207	if (tp->tun_flags & TUN_RWAIT) {
208		tp->tun_flags &= ~TUN_RWAIT;
209		wakeup(tp);
210	}
211	if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio)
212		pgsigio(&tp->tun_sigio, SIGIO, 0);
213	selwakeup(&tp->tun_rsel);
214}
215
216static void
217tuncreate(dev_t dev)
218{
219	struct tun_softc *sc;
220	struct ifnet *ifp;
221
222	if (!(dev->si_flags & SI_NAMED))
223		dev = make_dev(&tun_cdevsw, minor(dev),
224		    UID_UUCP, GID_DIALER, 0600, "tun%d", dev2unit(dev));
225
226	MALLOC(sc, struct tun_softc *, sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
227	sc->tun_flags = TUN_INITED;
228	sc->next = tunhead;
229	tunhead = sc;
230
231	ifp = &sc->tun_if;
232	ifp->if_unit = dev2unit(dev);
233	ifp->if_name = TUNNAME;
234	ifp->if_mtu = TUNMTU;
235	ifp->if_ioctl = tunifioctl;
236	ifp->if_output = tunoutput;
237	ifp->if_start = tunstart;
238	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
239	ifp->if_type = IFT_PPP;
240	ifp->if_snd.ifq_maxlen = ifqmaxlen;
241	ifp->if_softc = sc;
242	if_attach(ifp);
243	bpfattach(ifp, DLT_NULL, sizeof(u_int));
244	dev->si_drv1 = sc;
245}
246
247static int
248tunopen(dev_t dev, int flag, int mode, struct thread *td)
249{
250	struct resource *r;
251	struct ifnet	*ifp;
252	struct tun_softc *tp;
253	int unit;
254
255	unit = dev2unit(dev);
256	if (unit > TUN_MAXUNIT)
257		return (ENXIO);
258
259	r = rman_reserve_resource(&tununits, unit, unit, 1,
260	    RF_ALLOCATED | RF_ACTIVE, NULL);
261	if (r == NULL)
262		return (EBUSY);
263
264	dev->si_flags &= ~SI_CHEAPCLONE;
265
266	tp = dev->si_drv1;
267	if (!tp) {
268		tuncreate(dev);
269		tp = dev->si_drv1;
270	}
271	KASSERT(!(tp->tun_flags & TUN_OPEN), ("Resource & flags out-of-sync"));
272	tp->r_unit = r;
273	tp->tun_pid = td->td_proc->p_pid;
274	ifp = &tp->tun_if;
275	tp->tun_flags |= TUN_OPEN;
276	TUNDEBUG("%s%d: open\n", ifp->if_name, ifp->if_unit);
277
278	return (0);
279}
280
281/*
282 * tunclose - close the device - mark i/f down & delete
283 * routing info
284 */
285static	int
286tunclose(dev_t dev, int foo, int bar, struct thread *td)
287{
288	struct tun_softc *tp;
289	struct ifnet *ifp;
290	int s;
291	int err;
292
293	tp = dev->si_drv1;
294	ifp = &tp->tun_if;
295
296	KASSERT(tp->r_unit, ("Unit %d not marked open", ifp->if_unit));
297	tp->tun_flags &= ~TUN_OPEN;
298	tp->tun_pid = 0;
299
300	/*
301	 * junk all pending output
302	 */
303	IF_DRAIN(&ifp->if_snd);
304
305	if (ifp->if_flags & IFF_UP) {
306		s = splimp();
307		if_down(ifp);
308		splx(s);
309	}
310
311	if (ifp->if_flags & IFF_RUNNING) {
312		struct ifaddr *ifa;
313
314		s = splimp();
315		/* find internet addresses and delete routes */
316		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
317			if (ifa->ifa_addr->sa_family == AF_INET)
318				rtinit(ifa, (int)RTM_DELETE,
319				    tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
320		ifp->if_flags &= ~IFF_RUNNING;
321		splx(s);
322	}
323
324	funsetown(&tp->tun_sigio);
325	selwakeup(&tp->tun_rsel);
326
327	TUNDEBUG ("%s%d: closed\n", ifp->if_name, ifp->if_unit);
328	err = rman_release_resource(tp->r_unit);
329	KASSERT(err == 0, ("Unit %d failed to release", ifp->if_unit));
330
331	return (0);
332}
333
334static int
335tuninit(struct ifnet *ifp)
336{
337	struct tun_softc *tp = ifp->if_softc;
338	struct ifaddr *ifa;
339	int error = 0;
340
341	TUNDEBUG("%s%d: tuninit\n", ifp->if_name, ifp->if_unit);
342
343	ifp->if_flags |= IFF_UP | IFF_RUNNING;
344	getmicrotime(&ifp->if_lastchange);
345
346	for (ifa = TAILQ_FIRST(&ifp->if_addrhead); ifa;
347	     ifa = TAILQ_NEXT(ifa, ifa_link)) {
348		if (ifa->ifa_addr == NULL)
349			error = EFAULT;
350			/* XXX: Should maybe return straight off? */
351		else {
352#ifdef INET
353			if (ifa->ifa_addr->sa_family == AF_INET) {
354			    struct sockaddr_in *si;
355
356			    si = (struct sockaddr_in *)ifa->ifa_addr;
357			    if (si->sin_addr.s_addr)
358				    tp->tun_flags |= TUN_IASET;
359
360			    si = (struct sockaddr_in *)ifa->ifa_dstaddr;
361			    if (si && si->sin_addr.s_addr)
362				    tp->tun_flags |= TUN_DSTADDR;
363			}
364#endif
365		}
366	}
367	return (error);
368}
369
370/*
371 * Process an ioctl request.
372 */
373static int
374tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
375{
376	struct ifreq *ifr = (struct ifreq *)data;
377	struct tun_softc *tp = ifp->if_softc;
378	struct ifstat *ifs;
379	int		error = 0, s;
380
381	s = splimp();
382	switch(cmd) {
383	case SIOCGIFSTATUS:
384		ifs = (struct ifstat *)data;
385		if (tp->tun_pid)
386			sprintf(ifs->ascii + strlen(ifs->ascii),
387			    "\tOpened by PID %d\n", tp->tun_pid);
388		break;
389	case SIOCSIFADDR:
390		error = tuninit(ifp);
391		TUNDEBUG("%s%d: address set, error=%d\n",
392			 ifp->if_name, ifp->if_unit, error);
393		break;
394	case SIOCSIFDSTADDR:
395		error = tuninit(ifp);
396		TUNDEBUG("%s%d: destination address set, error=%d\n",
397			 ifp->if_name, ifp->if_unit, error);
398		break;
399	case SIOCSIFMTU:
400		ifp->if_mtu = ifr->ifr_mtu;
401		TUNDEBUG("%s%d: mtu set\n", ifp->if_name, ifp->if_unit);
402		break;
403	case SIOCSIFFLAGS:
404	case SIOCADDMULTI:
405	case SIOCDELMULTI:
406		break;
407	default:
408		error = EINVAL;
409	}
410	splx(s);
411	return (error);
412}
413
414/*
415 * tunoutput - queue packets from higher level ready to put out.
416 */
417static int
418tunoutput(
419	struct ifnet *ifp,
420	struct mbuf *m0,
421	struct sockaddr *dst,
422	struct rtentry *rt)
423{
424	struct tun_softc *tp = ifp->if_softc;
425#ifdef MAC
426	int error;
427#endif
428
429	TUNDEBUG ("%s%d: tunoutput\n", ifp->if_name, ifp->if_unit);
430
431#ifdef MAC
432	error = mac_check_ifnet_transmit(ifp, m0);
433	if (error) {
434		m_freem(m0);
435		return (error);
436	}
437#endif
438
439	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
440		TUNDEBUG ("%s%d: not ready 0%o\n", ifp->if_name,
441			  ifp->if_unit, tp->tun_flags);
442		m_freem (m0);
443		return (EHOSTDOWN);
444	}
445
446	if ((ifp->if_flags & IFF_UP) != IFF_UP) {
447		m_freem (m0);
448		return (EHOSTDOWN);
449	}
450
451	/* BPF write needs to be handled specially */
452	if (dst->sa_family == AF_UNSPEC) {
453		dst->sa_family = *(mtod(m0, int *));
454		m0->m_len -= sizeof(int);
455		m0->m_pkthdr.len -= sizeof(int);
456		m0->m_data += sizeof(int);
457	}
458
459	if (ifp->if_bpf) {
460		/*
461		 * We need to prepend the address family as
462		 * a four byte field.  Cons up a dummy header
463		 * to pacify bpf.  This is safe because bpf
464		 * will only read from the mbuf (i.e., it won't
465		 * try to free it or keep a pointer to it).
466		 */
467		struct mbuf m;
468		uint32_t af = dst->sa_family;
469
470		m.m_next = m0;
471		m.m_len = 4;
472		m.m_data = (char *)&af;
473
474		BPF_MTAP(ifp, &m);
475	}
476
477	/* prepend sockaddr? this may abort if the mbuf allocation fails */
478	if (tp->tun_flags & TUN_LMODE) {
479		/* allocate space for sockaddr */
480		M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
481
482		/* if allocation failed drop packet */
483		if (m0 == NULL) {
484			ifp->if_iqdrops++;
485			ifp->if_oerrors++;
486			return (ENOBUFS);
487		} else {
488			bcopy(dst, m0->m_data, dst->sa_len);
489		}
490	}
491
492	if (tp->tun_flags & TUN_IFHEAD) {
493		/* Prepend the address family */
494		M_PREPEND(m0, 4, M_DONTWAIT);
495
496		/* if allocation failed drop packet */
497		if (m0 == NULL) {
498			ifp->if_iqdrops++;
499			ifp->if_oerrors++;
500			return (ENOBUFS);
501		} else
502			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
503	} else {
504#ifdef INET
505		if (dst->sa_family != AF_INET)
506#endif
507		{
508			m_freem(m0);
509			return (EAFNOSUPPORT);
510		}
511	}
512
513	if (! IF_HANDOFF(&ifp->if_snd, m0, ifp)) {
514		ifp->if_collisions++;
515		return (ENOBUFS);
516	}
517	ifp->if_opackets++;
518	return (0);
519}
520
521/*
522 * the cdevsw interface is now pretty minimal.
523 */
524static	int
525tunioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct thread *td)
526{
527	int		s;
528	int		error;
529	struct tun_softc *tp = dev->si_drv1;
530	struct tuninfo *tunp;
531
532	switch (cmd) {
533	case TUNSIFINFO:
534		tunp = (struct tuninfo *)data;
535		if (tunp->mtu < IF_MINMTU)
536			return (EINVAL);
537		if (tp->tun_if.if_mtu != tunp->mtu
538		&& (error = suser(td)) != 0)
539			return (error);
540		tp->tun_if.if_mtu = tunp->mtu;
541		tp->tun_if.if_type = tunp->type;
542		tp->tun_if.if_baudrate = tunp->baudrate;
543		break;
544	case TUNGIFINFO:
545		tunp = (struct tuninfo *)data;
546		tunp->mtu = tp->tun_if.if_mtu;
547		tunp->type = tp->tun_if.if_type;
548		tunp->baudrate = tp->tun_if.if_baudrate;
549		break;
550	case TUNSDEBUG:
551		tundebug = *(int *)data;
552		break;
553	case TUNGDEBUG:
554		*(int *)data = tundebug;
555		break;
556	case TUNSLMODE:
557		if (*(int *)data) {
558			tp->tun_flags |= TUN_LMODE;
559			tp->tun_flags &= ~TUN_IFHEAD;
560		} else
561			tp->tun_flags &= ~TUN_LMODE;
562		break;
563	case TUNSIFHEAD:
564		if (*(int *)data) {
565			tp->tun_flags |= TUN_IFHEAD;
566			tp->tun_flags &= ~TUN_LMODE;
567		} else
568			tp->tun_flags &= ~TUN_IFHEAD;
569		break;
570	case TUNGIFHEAD:
571		*(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
572		break;
573	case TUNSIFMODE:
574		/* deny this if UP */
575		if (tp->tun_if.if_flags & IFF_UP)
576			return(EBUSY);
577
578		switch (*(int *)data & ~IFF_MULTICAST) {
579		case IFF_POINTOPOINT:
580		case IFF_BROADCAST:
581			tp->tun_if.if_flags &=
582			    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
583			tp->tun_if.if_flags |= *(int *)data;
584			break;
585		default:
586			return(EINVAL);
587		}
588		break;
589	case TUNSIFPID:
590		tp->tun_pid = curthread->td_proc->p_pid;
591		break;
592	case FIONBIO:
593		break;
594	case FIOASYNC:
595		if (*(int *)data)
596			tp->tun_flags |= TUN_ASYNC;
597		else
598			tp->tun_flags &= ~TUN_ASYNC;
599		break;
600	case FIONREAD:
601		s = splimp();
602		if (tp->tun_if.if_snd.ifq_head) {
603			struct mbuf *mb = tp->tun_if.if_snd.ifq_head;
604			for( *(int *)data = 0; mb != 0; mb = mb->m_next)
605				*(int *)data += mb->m_len;
606		} else
607			*(int *)data = 0;
608		splx(s);
609		break;
610	case FIOSETOWN:
611		return (fsetown(*(int *)data, &tp->tun_sigio));
612
613	case FIOGETOWN:
614		*(int *)data = fgetown(&tp->tun_sigio);
615		return (0);
616
617	/* This is deprecated, FIOSETOWN should be used instead. */
618	case TIOCSPGRP:
619		return (fsetown(-(*(int *)data), &tp->tun_sigio));
620
621	/* This is deprecated, FIOGETOWN should be used instead. */
622	case TIOCGPGRP:
623		*(int *)data = -fgetown(&tp->tun_sigio);
624		return (0);
625
626	default:
627		return (ENOTTY);
628	}
629	return (0);
630}
631
632/*
633 * The cdevsw read interface - reads a packet at a time, or at
634 * least as much of a packet as can be read.
635 */
636static	int
637tunread(dev_t dev, struct uio *uio, int flag)
638{
639	struct tun_softc *tp = dev->si_drv1;
640	struct ifnet	*ifp = &tp->tun_if;
641	struct mbuf	*m;
642	int		error=0, len, s;
643
644	TUNDEBUG ("%s%d: read\n", ifp->if_name, ifp->if_unit);
645	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
646		TUNDEBUG ("%s%d: not ready 0%o\n", ifp->if_name,
647			  ifp->if_unit, tp->tun_flags);
648		return (EHOSTDOWN);
649	}
650
651	tp->tun_flags &= ~TUN_RWAIT;
652
653	s = splimp();
654	do {
655		IF_DEQUEUE(&ifp->if_snd, m);
656		if (m == NULL) {
657			if (flag & IO_NDELAY) {
658				splx(s);
659				return (EWOULDBLOCK);
660			}
661			tp->tun_flags |= TUN_RWAIT;
662			if((error = tsleep(tp, PCATCH | (PZERO + 1),
663					"tunread", 0)) != 0) {
664				splx(s);
665				return (error);
666			}
667		}
668	} while (m == NULL);
669	splx(s);
670
671	while (m && uio->uio_resid > 0 && error == 0) {
672		len = min(uio->uio_resid, m->m_len);
673		if (len != 0)
674			error = uiomove(mtod(m, void *), len, uio);
675		m = m_free(m);
676	}
677
678	if (m) {
679		TUNDEBUG("%s%d: Dropping mbuf\n", ifp->if_name, ifp->if_unit);
680		m_freem(m);
681	}
682	return (error);
683}
684
685/*
686 * the cdevsw write interface - an atomic write is a packet - or else!
687 */
688static	int
689tunwrite(dev_t dev, struct uio *uio, int flag)
690{
691	struct tun_softc *tp = dev->si_drv1;
692	struct ifnet	*ifp = &tp->tun_if;
693	struct mbuf	*top, **mp, *m;
694	int		error=0, tlen, mlen;
695	uint32_t	family;
696
697	TUNDEBUG("%s%d: tunwrite\n", ifp->if_name, ifp->if_unit);
698
699	if ((ifp->if_flags & IFF_UP) != IFF_UP)
700		/* ignore silently */
701		return (0);
702
703	if (uio->uio_resid == 0)
704		return (0);
705
706	if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
707		TUNDEBUG("%s%d: len=%d!\n", ifp->if_name, ifp->if_unit,
708		    uio->uio_resid);
709		return (EIO);
710	}
711	tlen = uio->uio_resid;
712
713	/* get a header mbuf */
714	MGETHDR(m, M_DONTWAIT, MT_DATA);
715	if (m == NULL)
716		return (ENOBUFS);
717	mlen = MHLEN;
718
719	top = 0;
720	mp = &top;
721	while (error == 0 && uio->uio_resid > 0) {
722		m->m_len = min(mlen, uio->uio_resid);
723		error = uiomove(mtod(m, void *), m->m_len, uio);
724		*mp = m;
725		mp = &m->m_next;
726		if (uio->uio_resid > 0) {
727			MGET (m, M_DONTWAIT, MT_DATA);
728			if (m == 0) {
729				error = ENOBUFS;
730				break;
731			}
732			mlen = MLEN;
733		}
734	}
735	if (error) {
736		if (top)
737			m_freem (top);
738		ifp->if_ierrors++;
739		return (error);
740	}
741
742	top->m_pkthdr.len = tlen;
743	top->m_pkthdr.rcvif = ifp;
744#ifdef MAC
745	mac_create_mbuf_from_ifnet(ifp, top);
746#endif
747
748	if (ifp->if_bpf) {
749		if (tp->tun_flags & TUN_IFHEAD) {
750			/*
751			 * Conveniently, we already have a 4-byte address
752			 * family prepended to our packet !
753			 * Inconveniently, it's in the wrong byte order !
754			 */
755			if ((top = m_pullup(top, sizeof(family))) == NULL)
756				return (ENOBUFS);
757			*mtod(top, u_int32_t *) =
758			    ntohl(*mtod(top, u_int32_t *));
759			BPF_MTAP(ifp, top);
760			*mtod(top, u_int32_t *) =
761			    htonl(*mtod(top, u_int32_t *));
762		} else {
763			/*
764			 * We need to prepend the address family as
765			 * a four byte field.  Cons up a dummy header
766			 * to pacify bpf.  This is safe because bpf
767			 * will only read from the mbuf (i.e., it won't
768			 * try to free it or keep a pointer to it).
769			 */
770			struct mbuf m;
771			uint32_t af = AF_INET;
772
773			m.m_next = top;
774			m.m_len = 4;
775			m.m_data = (char *)&af;
776
777			BPF_MTAP(ifp, &m);
778		}
779	}
780
781	if (tp->tun_flags & TUN_IFHEAD) {
782		if (top->m_len < sizeof(family) &&
783		    (top = m_pullup(top, sizeof(family))) == NULL)
784			return (ENOBUFS);
785		family = ntohl(*mtod(top, u_int32_t *));
786		m_adj(top, sizeof(family));
787	} else
788		family = AF_INET;
789
790	ifp->if_ibytes += top->m_pkthdr.len;
791	ifp->if_ipackets++;
792
793	return (family_enqueue(family, top));
794}
795
796/*
797 * tunpoll - the poll interface, this is only useful on reads
798 * really. The write detect always returns true, write never blocks
799 * anyway, it either accepts the packet or drops it.
800 */
801static	int
802tunpoll(dev_t dev, int events, struct thread *td)
803{
804	int		s;
805	struct tun_softc *tp = dev->si_drv1;
806	struct ifnet	*ifp = &tp->tun_if;
807	int		revents = 0;
808
809	s = splimp();
810	TUNDEBUG("%s%d: tunpoll\n", ifp->if_name, ifp->if_unit);
811
812	if (events & (POLLIN | POLLRDNORM)) {
813		if (ifp->if_snd.ifq_len > 0) {
814			TUNDEBUG("%s%d: tunpoll q=%d\n", ifp->if_name,
815			    ifp->if_unit, ifp->if_snd.ifq_len);
816			revents |= events & (POLLIN | POLLRDNORM);
817		} else {
818			TUNDEBUG("%s%d: tunpoll waiting\n", ifp->if_name,
819			    ifp->if_unit);
820			selrecord(td, &tp->tun_rsel);
821		}
822	}
823	if (events & (POLLOUT | POLLWRNORM))
824		revents |= events & (POLLOUT | POLLWRNORM);
825
826	splx(s);
827	return (revents);
828}
829