if_tun.c revision 161103 
1/*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2
3/*-
4 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5 * Nottingham University 1987.
6 *
7 * This source may be freely distributed, however I would be interested
8 * in any changes that are made.
9 *
10 * This driver takes packets off the IP i/f and hands them up to a
11 * user process to have its wicked way with. This driver has it's
12 * roots in a similar driver written by Phil Cockcroft (formerly) at
13 * UCL. This driver is based much more on read/write/poll mode of
14 * operation though.
15 *
16 * $FreeBSD: head/sys/net/if_tun.c 161103 2006-08-08 19:22:25Z rwatson $
17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23#include "opt_mac.h"
24
25#include <sys/param.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/mac.h>
29#include <sys/mbuf.h>
30#include <sys/module.h>
31#include <sys/socket.h>
32#include <sys/fcntl.h>
33#include <sys/filio.h>
34#include <sys/sockio.h>
35#include <sys/ttycom.h>
36#include <sys/poll.h>
37#include <sys/selinfo.h>
38#include <sys/signalvar.h>
39#include <sys/filedesc.h>
40#include <sys/kernel.h>
41#include <sys/sysctl.h>
42#include <sys/conf.h>
43#include <sys/uio.h>
44#include <sys/malloc.h>
45#include <sys/random.h>
46
47#include <net/if.h>
48#include <net/if_types.h>
49#include <net/netisr.h>
50#include <net/route.h>
51#ifdef INET
52#include <netinet/in.h>
53#endif
54#include <net/bpf.h>
55#include <net/if_tun.h>
56
57#include <sys/queue.h>
58
59/*
60 * tun_list is protected by global tunmtx.  Other mutable fields are
61 * protected by tun->tun_mtx, or by their owning subsystem.  tun_dev is
62 * static for the duration of a tunnel interface.
63 */
64struct tun_softc {
65	TAILQ_ENTRY(tun_softc)	tun_list;
66	struct cdev *tun_dev;
67	u_short	tun_flags;		/* misc flags */
68#define	TUN_OPEN	0x0001
69#define	TUN_INITED	0x0002
70#define	TUN_RCOLL	0x0004
71#define	TUN_IASET	0x0008
72#define	TUN_DSTADDR	0x0010
73#define	TUN_LMODE	0x0020
74#define	TUN_RWAIT	0x0040
75#define	TUN_ASYNC	0x0080
76#define	TUN_IFHEAD	0x0100
77
78#define TUN_READY       (TUN_OPEN | TUN_INITED)
79
80	/*
81	 * XXXRW: tun_pid is used to exclusively lock /dev/tun.  Is this
82	 * actually needed?  Can we just return EBUSY if already open?
83	 * Problem is that this involved inherent races when a tun device
84	 * is handed off from one process to another, as opposed to just
85	 * being slightly stale informationally.
86	 */
87	pid_t	tun_pid;		/* owning pid */
88	struct	ifnet *tun_ifp;		/* the interface */
89	struct  sigio *tun_sigio;	/* information for async I/O */
90	struct	selinfo	tun_rsel;	/* read select */
91	struct mtx	tun_mtx;	/* protect mutable softc fields */
92};
93#define TUN2IFP(sc)	((sc)->tun_ifp)
94
95#define TUNDEBUG	if (tundebug) if_printf
96#define	TUNNAME		"tun"
97
98/*
99 * All mutable global variables in if_tun are locked using tunmtx, with
100 * the exception of tundebug, which is used unlocked, and tunclones,
101 * which is static after setup.
102 */
103static struct mtx tunmtx;
104static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
105static int tundebug = 0;
106static struct clonedevs *tunclones;
107static TAILQ_HEAD(,tun_softc)	tunhead = TAILQ_HEAD_INITIALIZER(tunhead);
108SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
109
110static void	tunclone(void *arg, struct ucred *cred, char *name,
111		    int namelen, struct cdev **dev);
112static void	tuncreate(struct cdev *dev);
113static int	tunifioctl(struct ifnet *, u_long, caddr_t);
114static int	tuninit(struct ifnet *);
115static int	tunmodevent(module_t, int, void *);
116static int	tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
117		    struct rtentry *rt);
118static void	tunstart(struct ifnet *);
119
120static d_open_t		tunopen;
121static d_close_t	tunclose;
122static d_read_t		tunread;
123static d_write_t	tunwrite;
124static d_ioctl_t	tunioctl;
125static d_poll_t		tunpoll;
126static d_kqfilter_t	tunkqfilter;
127
128static int		tunkqread(struct knote *, long);
129static int		tunkqwrite(struct knote *, long);
130static void		tunkqdetach(struct knote *);
131
132static struct filterops tun_read_filterops = {
133	.f_isfd =	1,
134	.f_attach =	NULL,
135	.f_detach =	tunkqdetach,
136	.f_event =	tunkqread,
137};
138
139static struct filterops tun_write_filterops = {
140	.f_isfd =	1,
141	.f_attach =	NULL,
142	.f_detach =	tunkqdetach,
143	.f_event =	tunkqwrite,
144};
145
146static struct cdevsw tun_cdevsw = {
147	.d_version =	D_VERSION,
148	.d_flags =	D_PSEUDO | D_NEEDGIANT,
149	.d_open =	tunopen,
150	.d_close =	tunclose,
151	.d_read =	tunread,
152	.d_write =	tunwrite,
153	.d_ioctl =	tunioctl,
154	.d_poll =	tunpoll,
155	.d_kqfilter =	tunkqfilter,
156	.d_name =	TUNNAME,
157};
158
159static void
160tunclone(void *arg, struct ucred *cred, char *name, int namelen,
161    struct cdev **dev)
162{
163	int u, i;
164
165	if (*dev != NULL)
166		return;
167
168	if (strcmp(name, TUNNAME) == 0) {
169		u = -1;
170	} else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
171		return;	/* Don't recognise the name */
172	if (u != -1 && u > IF_MAXUNIT)
173		return;	/* Unit number too high */
174
175	/* find any existing device, or allocate new unit number */
176	i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
177	if (i) {
178		/* No preexisting struct cdev *, create one */
179		*dev = make_dev(&tun_cdevsw, unit2minor(u),
180		    UID_UUCP, GID_DIALER, 0600, "tun%d", u);
181		if (*dev != NULL) {
182			dev_ref(*dev);
183			(*dev)->si_flags |= SI_CHEAPCLONE;
184		}
185	}
186}
187
188static void
189tun_destroy(struct tun_softc *tp)
190{
191	struct cdev *dev;
192
193	/* Unlocked read. */
194	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
195	    ("tununits is out of sync - unit %d", TUN2IFP(tp)->if_dunit));
196
197	dev = tp->tun_dev;
198	bpfdetach(TUN2IFP(tp));
199	if_detach(TUN2IFP(tp));
200	if_free(TUN2IFP(tp));
201	destroy_dev(dev);
202	knlist_destroy(&tp->tun_rsel.si_note);
203	mtx_destroy(&tp->tun_mtx);
204	free(tp, M_TUN);
205}
206
207static int
208tunmodevent(module_t mod, int type, void *data)
209{
210	static eventhandler_tag tag;
211	struct tun_softc *tp;
212
213	switch (type) {
214	case MOD_LOAD:
215		mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
216		clone_setup(&tunclones);
217		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
218		if (tag == NULL)
219			return (ENOMEM);
220		break;
221	case MOD_UNLOAD:
222		EVENTHANDLER_DEREGISTER(dev_clone, tag);
223
224		mtx_lock(&tunmtx);
225		while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
226			TAILQ_REMOVE(&tunhead, tp, tun_list);
227			mtx_unlock(&tunmtx);
228			tun_destroy(tp);
229			mtx_lock(&tunmtx);
230		}
231		mtx_unlock(&tunmtx);
232		clone_cleanup(&tunclones);
233		mtx_destroy(&tunmtx);
234		break;
235	default:
236		return EOPNOTSUPP;
237	}
238	return 0;
239}
240
241static moduledata_t tun_mod = {
242	"if_tun",
243	tunmodevent,
244	0
245};
246
247DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
248
249static void
250tunstart(struct ifnet *ifp)
251{
252	struct tun_softc *tp = ifp->if_softc;
253	struct mbuf *m;
254
255	TUNDEBUG(ifp,"%s starting\n", ifp->if_xname);
256	if (ALTQ_IS_ENABLED(&ifp->if_snd)) {
257		IFQ_LOCK(&ifp->if_snd);
258		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
259		if (m == NULL) {
260			IFQ_UNLOCK(&ifp->if_snd);
261			return;
262		}
263		IFQ_UNLOCK(&ifp->if_snd);
264	}
265
266	mtx_lock(&tp->tun_mtx);
267	if (tp->tun_flags & TUN_RWAIT) {
268		tp->tun_flags &= ~TUN_RWAIT;
269		wakeup(tp);
270	}
271	if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio) {
272		mtx_unlock(&tp->tun_mtx);
273		pgsigio(&tp->tun_sigio, SIGIO, 0);
274	} else
275		mtx_unlock(&tp->tun_mtx);
276	selwakeuppri(&tp->tun_rsel, PZERO + 1);
277	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
278}
279
280/* XXX: should return an error code so it can fail. */
281static void
282tuncreate(struct cdev *dev)
283{
284	struct tun_softc *sc;
285	struct ifnet *ifp;
286
287	dev->si_flags &= ~SI_CHEAPCLONE;
288
289	MALLOC(sc, struct tun_softc *, sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
290	mtx_init(&sc->tun_mtx, "tun_mtx", NULL, MTX_DEF);
291	sc->tun_flags = TUN_INITED;
292	sc->tun_dev = dev;
293	mtx_lock(&tunmtx);
294	TAILQ_INSERT_TAIL(&tunhead, sc, tun_list);
295	mtx_unlock(&tunmtx);
296
297	ifp = sc->tun_ifp = if_alloc(IFT_PPP);
298	if (ifp == NULL)
299		panic("%s%d: failed to if_alloc() interface.\n",
300		    TUNNAME, dev2unit(dev));
301	if_initname(ifp, TUNNAME, dev2unit(dev));
302	ifp->if_mtu = TUNMTU;
303	ifp->if_ioctl = tunifioctl;
304	ifp->if_output = tunoutput;
305	ifp->if_start = tunstart;
306	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
307	ifp->if_softc = sc;
308	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
309	ifp->if_snd.ifq_drv_maxlen = 0;
310	IFQ_SET_READY(&ifp->if_snd);
311	knlist_init(&sc->tun_rsel.si_note, NULL, NULL, NULL, NULL);
312
313	if_attach(ifp);
314	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
315	dev->si_drv1 = sc;
316	TUNDEBUG(ifp, "interface %s is created, minor = %#x\n",
317	    ifp->if_xname, minor(dev));
318}
319
320static int
321tunopen(struct cdev *dev, int flag, int mode, struct thread *td)
322{
323	struct ifnet	*ifp;
324	struct tun_softc *tp;
325
326	/*
327	 * XXXRW: Non-atomic test and set of dev->si_drv1 requires
328	 * synchronization.
329	 */
330	tp = dev->si_drv1;
331	if (!tp) {
332		tuncreate(dev);
333		tp = dev->si_drv1;
334	}
335
336	/*
337	 * XXXRW: This use of tun_pid is subject to error due to the
338	 * fact that a reference to the tunnel can live beyond the
339	 * death of the process that created it.  Can we replace this
340	 * with a simple busy flag?
341	 */
342	mtx_lock(&tp->tun_mtx);
343	if (tp->tun_pid != 0 && tp->tun_pid != td->td_proc->p_pid) {
344		mtx_unlock(&tp->tun_mtx);
345		return (EBUSY);
346	}
347	tp->tun_pid = td->td_proc->p_pid;
348
349	tp->tun_flags |= TUN_OPEN;
350	mtx_unlock(&tp->tun_mtx);
351	ifp = TUN2IFP(tp);
352	TUNDEBUG(ifp, "open\n");
353
354	return (0);
355}
356
357/*
358 * tunclose - close the device - mark i/f down & delete
359 * routing info
360 */
361static	int
362tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
363{
364	struct tun_softc *tp;
365	struct ifnet *ifp;
366	int s;
367
368	tp = dev->si_drv1;
369	ifp = TUN2IFP(tp);
370
371	mtx_lock(&tp->tun_mtx);
372	tp->tun_flags &= ~TUN_OPEN;
373	tp->tun_pid = 0;
374
375	/*
376	 * junk all pending output
377	 */
378	s = splimp();
379	IFQ_PURGE(&ifp->if_snd);
380	splx(s);
381	mtx_unlock(&tp->tun_mtx);
382
383	if (ifp->if_flags & IFF_UP) {
384		s = splimp();
385		if_down(ifp);
386		splx(s);
387	}
388
389	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
390		struct ifaddr *ifa;
391
392		s = splimp();
393		/* find internet addresses and delete routes */
394		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
395			if (ifa->ifa_addr->sa_family == AF_INET)
396				/* Unlocked read. */
397				rtinit(ifa, (int)RTM_DELETE,
398				    tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
399		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
400		splx(s);
401	}
402
403	funsetown(&tp->tun_sigio);
404	selwakeuppri(&tp->tun_rsel, PZERO + 1);
405	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
406	TUNDEBUG (ifp, "closed\n");
407	return (0);
408}
409
410static int
411tuninit(struct ifnet *ifp)
412{
413	struct tun_softc *tp = ifp->if_softc;
414	struct ifaddr *ifa;
415	int error = 0;
416
417	TUNDEBUG(ifp, "tuninit\n");
418
419	ifp->if_flags |= IFF_UP;
420	ifp->if_drv_flags |= IFF_DRV_RUNNING;
421	getmicrotime(&ifp->if_lastchange);
422
423#ifdef INET
424	TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
425		if (ifa->ifa_addr->sa_family == AF_INET) {
426			struct sockaddr_in *si;
427
428			si = (struct sockaddr_in *)ifa->ifa_addr;
429			mtx_lock(&tp->tun_mtx);
430			if (si->sin_addr.s_addr)
431				tp->tun_flags |= TUN_IASET;
432
433			si = (struct sockaddr_in *)ifa->ifa_dstaddr;
434			if (si && si->sin_addr.s_addr)
435				tp->tun_flags |= TUN_DSTADDR;
436			mtx_unlock(&tp->tun_mtx);
437		}
438	}
439#endif
440	return (error);
441}
442
443/*
444 * Process an ioctl request.
445 */
446static int
447tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
448{
449	struct ifreq *ifr = (struct ifreq *)data;
450	struct tun_softc *tp = ifp->if_softc;
451	struct ifstat *ifs;
452	int		error = 0, s;
453
454	s = splimp();
455	switch(cmd) {
456	case SIOCGIFSTATUS:
457		ifs = (struct ifstat *)data;
458		mtx_lock(&tp->tun_mtx);
459		if (tp->tun_pid)
460			sprintf(ifs->ascii + strlen(ifs->ascii),
461			    "\tOpened by PID %d\n", tp->tun_pid);
462		mtx_unlock(&tp->tun_mtx);
463		break;
464	case SIOCSIFADDR:
465		error = tuninit(ifp);
466		TUNDEBUG(ifp, "address set, error=%d\n", error);
467		break;
468	case SIOCSIFDSTADDR:
469		error = tuninit(ifp);
470		TUNDEBUG(ifp, "destination address set, error=%d\n", error);
471		break;
472	case SIOCSIFMTU:
473		ifp->if_mtu = ifr->ifr_mtu;
474		TUNDEBUG(ifp, "mtu set\n");
475		break;
476	case SIOCSIFFLAGS:
477	case SIOCADDMULTI:
478	case SIOCDELMULTI:
479		break;
480	default:
481		error = EINVAL;
482	}
483	splx(s);
484	return (error);
485}
486
487/*
488 * tunoutput - queue packets from higher level ready to put out.
489 */
490static int
491tunoutput(
492	struct ifnet *ifp,
493	struct mbuf *m0,
494	struct sockaddr *dst,
495	struct rtentry *rt)
496{
497	struct tun_softc *tp = ifp->if_softc;
498	u_short cached_tun_flags;
499	int error;
500	u_int32_t af;
501
502	TUNDEBUG (ifp, "tunoutput\n");
503
504#ifdef MAC
505	error = mac_check_ifnet_transmit(ifp, m0);
506	if (error) {
507		m_freem(m0);
508		return (error);
509	}
510#endif
511
512	/* Could be unlocked read? */
513	mtx_lock(&tp->tun_mtx);
514	cached_tun_flags = tp->tun_flags;
515	mtx_unlock(&tp->tun_mtx);
516	if ((cached_tun_flags & TUN_READY) != TUN_READY) {
517		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
518		m_freem (m0);
519		return (EHOSTDOWN);
520	}
521
522	if ((ifp->if_flags & IFF_UP) != IFF_UP) {
523		m_freem (m0);
524		return (EHOSTDOWN);
525	}
526
527	/* BPF writes need to be handled specially. */
528	if (dst->sa_family == AF_UNSPEC) {
529		bcopy(dst->sa_data, &af, sizeof(af));
530		dst->sa_family = af;
531	}
532
533	if (bpf_peers_present(ifp->if_bpf)) {
534		af = dst->sa_family;
535		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
536	}
537
538	/* prepend sockaddr? this may abort if the mbuf allocation fails */
539	if (cached_tun_flags & TUN_LMODE) {
540		/* allocate space for sockaddr */
541		M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
542
543		/* if allocation failed drop packet */
544		if (m0 == NULL) {
545			ifp->if_iqdrops++;
546			ifp->if_oerrors++;
547			return (ENOBUFS);
548		} else {
549			bcopy(dst, m0->m_data, dst->sa_len);
550		}
551	}
552
553	if (cached_tun_flags & TUN_IFHEAD) {
554		/* Prepend the address family */
555		M_PREPEND(m0, 4, M_DONTWAIT);
556
557		/* if allocation failed drop packet */
558		if (m0 == NULL) {
559			ifp->if_iqdrops++;
560			ifp->if_oerrors++;
561			return (ENOBUFS);
562		} else
563			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
564	} else {
565#ifdef INET
566		if (dst->sa_family != AF_INET)
567#endif
568		{
569			m_freem(m0);
570			return (EAFNOSUPPORT);
571		}
572	}
573
574	IFQ_HANDOFF(ifp, m0, error);
575	if (error) {
576		ifp->if_collisions++;
577		return (ENOBUFS);
578	}
579	ifp->if_opackets++;
580	return (0);
581}
582
583/*
584 * the cdevsw interface is now pretty minimal.
585 */
586static	int
587tunioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
588{
589	int		s;
590	int		error;
591	struct tun_softc *tp = dev->si_drv1;
592	struct tuninfo *tunp;
593
594	switch (cmd) {
595	case TUNSIFINFO:
596		tunp = (struct tuninfo *)data;
597		if (tunp->mtu < IF_MINMTU)
598			return (EINVAL);
599		if (TUN2IFP(tp)->if_mtu != tunp->mtu
600		&& (error = suser(td)) != 0)
601			return (error);
602		TUN2IFP(tp)->if_mtu = tunp->mtu;
603		TUN2IFP(tp)->if_type = tunp->type;
604		TUN2IFP(tp)->if_baudrate = tunp->baudrate;
605		break;
606	case TUNGIFINFO:
607		tunp = (struct tuninfo *)data;
608		tunp->mtu = TUN2IFP(tp)->if_mtu;
609		tunp->type = TUN2IFP(tp)->if_type;
610		tunp->baudrate = TUN2IFP(tp)->if_baudrate;
611		break;
612	case TUNSDEBUG:
613		tundebug = *(int *)data;
614		break;
615	case TUNGDEBUG:
616		*(int *)data = tundebug;
617		break;
618	case TUNSLMODE:
619		mtx_lock(&tp->tun_mtx);
620		if (*(int *)data) {
621			tp->tun_flags |= TUN_LMODE;
622			tp->tun_flags &= ~TUN_IFHEAD;
623		} else
624			tp->tun_flags &= ~TUN_LMODE;
625		mtx_unlock(&tp->tun_mtx);
626		break;
627	case TUNSIFHEAD:
628		mtx_lock(&tp->tun_mtx);
629		if (*(int *)data) {
630			tp->tun_flags |= TUN_IFHEAD;
631			tp->tun_flags &= ~TUN_LMODE;
632		} else
633			tp->tun_flags &= ~TUN_IFHEAD;
634		mtx_unlock(&tp->tun_mtx);
635		break;
636	case TUNGIFHEAD:
637		/* Could be unlocked read? */
638		mtx_lock(&tp->tun_mtx);
639		*(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
640		mtx_unlock(&tp->tun_mtx);
641		break;
642	case TUNSIFMODE:
643		/* deny this if UP */
644		if (TUN2IFP(tp)->if_flags & IFF_UP)
645			return(EBUSY);
646
647		switch (*(int *)data & ~IFF_MULTICAST) {
648		case IFF_POINTOPOINT:
649		case IFF_BROADCAST:
650			TUN2IFP(tp)->if_flags &=
651			    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
652			TUN2IFP(tp)->if_flags |= *(int *)data;
653			break;
654		default:
655			return(EINVAL);
656		}
657		break;
658	case TUNSIFPID:
659		mtx_lock(&tp->tun_mtx);
660		tp->tun_pid = curthread->td_proc->p_pid;
661		mtx_unlock(&tp->tun_mtx);
662		break;
663	case FIONBIO:
664		break;
665	case FIOASYNC:
666		mtx_lock(&tp->tun_mtx);
667		if (*(int *)data)
668			tp->tun_flags |= TUN_ASYNC;
669		else
670			tp->tun_flags &= ~TUN_ASYNC;
671		mtx_unlock(&tp->tun_mtx);
672		break;
673	case FIONREAD:
674		s = splimp();
675		if (!IFQ_IS_EMPTY(&TUN2IFP(tp)->if_snd)) {
676			struct mbuf *mb;
677			IFQ_LOCK(&TUN2IFP(tp)->if_snd);
678			IFQ_POLL_NOLOCK(&TUN2IFP(tp)->if_snd, mb);
679			for( *(int *)data = 0; mb != 0; mb = mb->m_next)
680				*(int *)data += mb->m_len;
681			IFQ_UNLOCK(&TUN2IFP(tp)->if_snd);
682		} else
683			*(int *)data = 0;
684		splx(s);
685		break;
686	case FIOSETOWN:
687		return (fsetown(*(int *)data, &tp->tun_sigio));
688
689	case FIOGETOWN:
690		*(int *)data = fgetown(&tp->tun_sigio);
691		return (0);
692
693	/* This is deprecated, FIOSETOWN should be used instead. */
694	case TIOCSPGRP:
695		return (fsetown(-(*(int *)data), &tp->tun_sigio));
696
697	/* This is deprecated, FIOGETOWN should be used instead. */
698	case TIOCGPGRP:
699		*(int *)data = -fgetown(&tp->tun_sigio);
700		return (0);
701
702	default:
703		return (ENOTTY);
704	}
705	return (0);
706}
707
708/*
709 * The cdevsw read interface - reads a packet at a time, or at
710 * least as much of a packet as can be read.
711 */
712static	int
713tunread(struct cdev *dev, struct uio *uio, int flag)
714{
715	struct tun_softc *tp = dev->si_drv1;
716	struct ifnet	*ifp = TUN2IFP(tp);
717	struct mbuf	*m;
718	int		error=0, len, s;
719
720	TUNDEBUG (ifp, "read\n");
721	mtx_lock(&tp->tun_mtx);
722	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
723		mtx_unlock(&tp->tun_mtx);
724		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
725		return (EHOSTDOWN);
726	}
727
728	tp->tun_flags &= ~TUN_RWAIT;
729	mtx_unlock(&tp->tun_mtx);
730
731	s = splimp();
732	do {
733		IFQ_DEQUEUE(&ifp->if_snd, m);
734		if (m == NULL) {
735			if (flag & O_NONBLOCK) {
736				splx(s);
737				return (EWOULDBLOCK);
738			}
739			mtx_lock(&tp->tun_mtx);
740			tp->tun_flags |= TUN_RWAIT;
741			mtx_unlock(&tp->tun_mtx);
742			if ((error = tsleep(tp, PCATCH | (PZERO + 1),
743					"tunread", 0)) != 0) {
744				splx(s);
745				return (error);
746			}
747		}
748	} while (m == NULL);
749	splx(s);
750
751	while (m && uio->uio_resid > 0 && error == 0) {
752		len = min(uio->uio_resid, m->m_len);
753		if (len != 0)
754			error = uiomove(mtod(m, void *), len, uio);
755		m = m_free(m);
756	}
757
758	if (m) {
759		TUNDEBUG(ifp, "Dropping mbuf\n");
760		m_freem(m);
761	}
762	return (error);
763}
764
765/*
766 * the cdevsw write interface - an atomic write is a packet - or else!
767 */
768static	int
769tunwrite(struct cdev *dev, struct uio *uio, int flag)
770{
771	struct tun_softc *tp = dev->si_drv1;
772	struct ifnet	*ifp = TUN2IFP(tp);
773	struct mbuf	*m;
774	int		error = 0;
775	uint32_t	family;
776	int 		isr;
777
778	TUNDEBUG(ifp, "tunwrite\n");
779
780	if ((ifp->if_flags & IFF_UP) != IFF_UP)
781		/* ignore silently */
782		return (0);
783
784	if (uio->uio_resid == 0)
785		return (0);
786
787	if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
788		TUNDEBUG(ifp, "len=%d!\n", uio->uio_resid);
789		return (EIO);
790	}
791
792	if ((m = m_uiotombuf(uio, M_DONTWAIT, 0, 0)) == NULL) {
793		ifp->if_ierrors++;
794		return (error);
795	}
796
797	m->m_pkthdr.rcvif = ifp;
798#ifdef MAC
799	mac_create_mbuf_from_ifnet(ifp, m);
800#endif
801
802	/* Could be unlocked read? */
803	mtx_lock(&tp->tun_mtx);
804	if (tp->tun_flags & TUN_IFHEAD) {
805		mtx_unlock(&tp->tun_mtx);
806		if (m->m_len < sizeof(family) &&
807		    (m = m_pullup(m, sizeof(family))) == NULL)
808			return (ENOBUFS);
809		family = ntohl(*mtod(m, u_int32_t *));
810		m_adj(m, sizeof(family));
811	} else {
812		mtx_unlock(&tp->tun_mtx);
813		family = AF_INET;
814	}
815
816	BPF_MTAP2(ifp, &family, sizeof(family), m);
817
818	switch (family) {
819#ifdef INET
820	case AF_INET:
821		isr = NETISR_IP;
822		break;
823#endif
824#ifdef INET6
825	case AF_INET6:
826		isr = NETISR_IPV6;
827		break;
828#endif
829#ifdef IPX
830	case AF_IPX:
831		isr = NETISR_IPX;
832		break;
833#endif
834#ifdef NETATALK
835	case AF_APPLETALK:
836		isr = NETISR_ATALK2;
837		break;
838#endif
839	default:
840		m_freem(m);
841		return (EAFNOSUPPORT);
842	}
843	/* First chunk of an mbuf contains good junk */
844	if (harvest.point_to_point)
845		random_harvest(m, 16, 3, 0, RANDOM_NET);
846	ifp->if_ibytes += m->m_pkthdr.len;
847	ifp->if_ipackets++;
848	netisr_dispatch(isr, m);
849	return (0);
850}
851
852/*
853 * tunpoll - the poll interface, this is only useful on reads
854 * really. The write detect always returns true, write never blocks
855 * anyway, it either accepts the packet or drops it.
856 */
857static	int
858tunpoll(struct cdev *dev, int events, struct thread *td)
859{
860	int		s;
861	struct tun_softc *tp = dev->si_drv1;
862	struct ifnet	*ifp = TUN2IFP(tp);
863	int		revents = 0;
864	struct mbuf	*m;
865
866	s = splimp();
867	TUNDEBUG(ifp, "tunpoll\n");
868
869	if (events & (POLLIN | POLLRDNORM)) {
870		IFQ_LOCK(&ifp->if_snd);
871		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
872		if (m != NULL) {
873			TUNDEBUG(ifp, "tunpoll q=%d\n", ifp->if_snd.ifq_len);
874			revents |= events & (POLLIN | POLLRDNORM);
875		} else {
876			TUNDEBUG(ifp, "tunpoll waiting\n");
877			selrecord(td, &tp->tun_rsel);
878		}
879		IFQ_UNLOCK(&ifp->if_snd);
880	}
881	if (events & (POLLOUT | POLLWRNORM))
882		revents |= events & (POLLOUT | POLLWRNORM);
883
884	splx(s);
885	return (revents);
886}
887
888/*
889 * tunkqfilter - support for the kevent() system call.
890 */
891static int
892tunkqfilter(struct cdev *dev, struct knote *kn)
893{
894	int			s;
895	struct tun_softc	*tp = dev->si_drv1;
896	struct ifnet	*ifp = TUN2IFP(tp);
897
898	s = splimp();
899	switch(kn->kn_filter) {
900	case EVFILT_READ:
901		TUNDEBUG(ifp, "%s kqfilter: EVFILT_READ, minor = %#x\n",
902		    ifp->if_xname, minor(dev));
903		kn->kn_fop = &tun_read_filterops;
904		break;
905
906	case EVFILT_WRITE:
907		TUNDEBUG(ifp, "%s kqfilter: EVFILT_WRITE, minor = %#x\n",
908		    ifp->if_xname, minor(dev));
909		kn->kn_fop = &tun_write_filterops;
910		break;
911
912	default:
913		TUNDEBUG(ifp, "%s kqfilter: invalid filter, minor = %#x\n",
914		    ifp->if_xname, minor(dev));
915		splx(s);
916		return(EINVAL);
917	}
918	splx(s);
919
920	kn->kn_hook = (caddr_t) dev;
921	knlist_add(&tp->tun_rsel.si_note, kn, 0);
922
923	return (0);
924}
925
926/*
927 * Return true of there is data in the interface queue.
928 */
929static int
930tunkqread(struct knote *kn, long hint)
931{
932	int			ret, s;
933	struct cdev		*dev = (struct cdev *)(kn->kn_hook);
934	struct tun_softc	*tp = dev->si_drv1;
935	struct ifnet	*ifp = TUN2IFP(tp);
936
937	s = splimp();
938	if ((kn->kn_data = ifp->if_snd.ifq_len) > 0) {
939		TUNDEBUG(ifp,
940		    "%s have data in the queue.  Len = %d, minor = %#x\n",
941		    ifp->if_xname, ifp->if_snd.ifq_len, minor(dev));
942		ret = 1;
943	} else {
944		TUNDEBUG(ifp,
945		    "%s waiting for data, minor = %#x\n", ifp->if_xname,
946		    minor(dev));
947		ret = 0;
948	}
949	splx(s);
950
951	return (ret);
952}
953
954/*
955 * Always can write, always return MTU in kn->data.
956 */
957static int
958tunkqwrite(struct knote *kn, long hint)
959{
960	int			s;
961	struct tun_softc	*tp = ((struct cdev *)kn->kn_hook)->si_drv1;
962	struct ifnet	*ifp = TUN2IFP(tp);
963
964	s = splimp();
965	kn->kn_data = ifp->if_mtu;
966	splx(s);
967
968	return (1);
969}
970
971static void
972tunkqdetach(struct knote *kn)
973{
974	struct tun_softc	*tp = ((struct cdev *)kn->kn_hook)->si_drv1;
975
976	knlist_remove(&tp->tun_rsel.si_note, kn, 0);
977}
978