if_tun.c revision 163606 
1/*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2
3/*-
4 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5 * Nottingham University 1987.
6 *
7 * This source may be freely distributed, however I would be interested
8 * in any changes that are made.
9 *
10 * This driver takes packets off the IP i/f and hands them up to a
11 * user process to have its wicked way with. This driver has it's
12 * roots in a similar driver written by Phil Cockcroft (formerly) at
13 * UCL. This driver is based much more on read/write/poll mode of
14 * operation though.
15 *
16 * $FreeBSD: head/sys/net/if_tun.c 163606 2006-10-22 11:52:19Z rwatson $
17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23#include "opt_mac.h"
24
25#include <sys/param.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/mbuf.h>
29#include <sys/module.h>
30#include <sys/socket.h>
31#include <sys/fcntl.h>
32#include <sys/filio.h>
33#include <sys/sockio.h>
34#include <sys/ttycom.h>
35#include <sys/poll.h>
36#include <sys/selinfo.h>
37#include <sys/signalvar.h>
38#include <sys/filedesc.h>
39#include <sys/kernel.h>
40#include <sys/sysctl.h>
41#include <sys/conf.h>
42#include <sys/uio.h>
43#include <sys/malloc.h>
44#include <sys/random.h>
45
46#include <net/if.h>
47#include <net/if_types.h>
48#include <net/netisr.h>
49#include <net/route.h>
50#ifdef INET
51#include <netinet/in.h>
52#endif
53#include <net/bpf.h>
54#include <net/if_tun.h>
55
56#include <sys/queue.h>
57
58#include <security/mac/mac_framework.h>
59
60/*
61 * tun_list is protected by global tunmtx.  Other mutable fields are
62 * protected by tun->tun_mtx, or by their owning subsystem.  tun_dev is
63 * static for the duration of a tunnel interface.
64 */
65struct tun_softc {
66	TAILQ_ENTRY(tun_softc)	tun_list;
67	struct cdev *tun_dev;
68	u_short	tun_flags;		/* misc flags */
69#define	TUN_OPEN	0x0001
70#define	TUN_INITED	0x0002
71#define	TUN_RCOLL	0x0004
72#define	TUN_IASET	0x0008
73#define	TUN_DSTADDR	0x0010
74#define	TUN_LMODE	0x0020
75#define	TUN_RWAIT	0x0040
76#define	TUN_ASYNC	0x0080
77#define	TUN_IFHEAD	0x0100
78
79#define TUN_READY       (TUN_OPEN | TUN_INITED)
80
81	/*
82	 * XXXRW: tun_pid is used to exclusively lock /dev/tun.  Is this
83	 * actually needed?  Can we just return EBUSY if already open?
84	 * Problem is that this involved inherent races when a tun device
85	 * is handed off from one process to another, as opposed to just
86	 * being slightly stale informationally.
87	 */
88	pid_t	tun_pid;		/* owning pid */
89	struct	ifnet *tun_ifp;		/* the interface */
90	struct  sigio *tun_sigio;	/* information for async I/O */
91	struct	selinfo	tun_rsel;	/* read select */
92	struct mtx	tun_mtx;	/* protect mutable softc fields */
93};
94#define TUN2IFP(sc)	((sc)->tun_ifp)
95
96#define TUNDEBUG	if (tundebug) if_printf
97#define	TUNNAME		"tun"
98
99/*
100 * All mutable global variables in if_tun are locked using tunmtx, with
101 * the exception of tundebug, which is used unlocked, and tunclones,
102 * which is static after setup.
103 */
104static struct mtx tunmtx;
105static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
106static int tundebug = 0;
107static struct clonedevs *tunclones;
108static TAILQ_HEAD(,tun_softc)	tunhead = TAILQ_HEAD_INITIALIZER(tunhead);
109SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
110
111static void	tunclone(void *arg, struct ucred *cred, char *name,
112		    int namelen, struct cdev **dev);
113static void	tuncreate(struct cdev *dev);
114static int	tunifioctl(struct ifnet *, u_long, caddr_t);
115static int	tuninit(struct ifnet *);
116static int	tunmodevent(module_t, int, void *);
117static int	tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
118		    struct rtentry *rt);
119static void	tunstart(struct ifnet *);
120
121static d_open_t		tunopen;
122static d_close_t	tunclose;
123static d_read_t		tunread;
124static d_write_t	tunwrite;
125static d_ioctl_t	tunioctl;
126static d_poll_t		tunpoll;
127static d_kqfilter_t	tunkqfilter;
128
129static int		tunkqread(struct knote *, long);
130static int		tunkqwrite(struct knote *, long);
131static void		tunkqdetach(struct knote *);
132
133static struct filterops tun_read_filterops = {
134	.f_isfd =	1,
135	.f_attach =	NULL,
136	.f_detach =	tunkqdetach,
137	.f_event =	tunkqread,
138};
139
140static struct filterops tun_write_filterops = {
141	.f_isfd =	1,
142	.f_attach =	NULL,
143	.f_detach =	tunkqdetach,
144	.f_event =	tunkqwrite,
145};
146
147static struct cdevsw tun_cdevsw = {
148	.d_version =	D_VERSION,
149	.d_flags =	D_PSEUDO | D_NEEDGIANT,
150	.d_open =	tunopen,
151	.d_close =	tunclose,
152	.d_read =	tunread,
153	.d_write =	tunwrite,
154	.d_ioctl =	tunioctl,
155	.d_poll =	tunpoll,
156	.d_kqfilter =	tunkqfilter,
157	.d_name =	TUNNAME,
158};
159
160static void
161tunclone(void *arg, struct ucred *cred, char *name, int namelen,
162    struct cdev **dev)
163{
164	int u, i;
165
166	if (*dev != NULL)
167		return;
168
169	if (strcmp(name, TUNNAME) == 0) {
170		u = -1;
171	} else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
172		return;	/* Don't recognise the name */
173	if (u != -1 && u > IF_MAXUNIT)
174		return;	/* Unit number too high */
175
176	/* find any existing device, or allocate new unit number */
177	i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
178	if (i) {
179		/* No preexisting struct cdev *, create one */
180		*dev = make_dev(&tun_cdevsw, unit2minor(u),
181		    UID_UUCP, GID_DIALER, 0600, "tun%d", u);
182		if (*dev != NULL) {
183			dev_ref(*dev);
184			(*dev)->si_flags |= SI_CHEAPCLONE;
185		}
186	}
187}
188
189static void
190tun_destroy(struct tun_softc *tp)
191{
192	struct cdev *dev;
193
194	/* Unlocked read. */
195	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
196	    ("tununits is out of sync - unit %d", TUN2IFP(tp)->if_dunit));
197
198	dev = tp->tun_dev;
199	bpfdetach(TUN2IFP(tp));
200	if_detach(TUN2IFP(tp));
201	if_free(TUN2IFP(tp));
202	destroy_dev(dev);
203	knlist_destroy(&tp->tun_rsel.si_note);
204	mtx_destroy(&tp->tun_mtx);
205	free(tp, M_TUN);
206}
207
208static int
209tunmodevent(module_t mod, int type, void *data)
210{
211	static eventhandler_tag tag;
212	struct tun_softc *tp;
213
214	switch (type) {
215	case MOD_LOAD:
216		mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
217		clone_setup(&tunclones);
218		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
219		if (tag == NULL)
220			return (ENOMEM);
221		break;
222	case MOD_UNLOAD:
223		EVENTHANDLER_DEREGISTER(dev_clone, tag);
224
225		mtx_lock(&tunmtx);
226		while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
227			TAILQ_REMOVE(&tunhead, tp, tun_list);
228			mtx_unlock(&tunmtx);
229			tun_destroy(tp);
230			mtx_lock(&tunmtx);
231		}
232		mtx_unlock(&tunmtx);
233		clone_cleanup(&tunclones);
234		mtx_destroy(&tunmtx);
235		break;
236	default:
237		return EOPNOTSUPP;
238	}
239	return 0;
240}
241
242static moduledata_t tun_mod = {
243	"if_tun",
244	tunmodevent,
245	0
246};
247
248DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
249
250static void
251tunstart(struct ifnet *ifp)
252{
253	struct tun_softc *tp = ifp->if_softc;
254	struct mbuf *m;
255
256	TUNDEBUG(ifp,"%s starting\n", ifp->if_xname);
257	if (ALTQ_IS_ENABLED(&ifp->if_snd)) {
258		IFQ_LOCK(&ifp->if_snd);
259		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
260		if (m == NULL) {
261			IFQ_UNLOCK(&ifp->if_snd);
262			return;
263		}
264		IFQ_UNLOCK(&ifp->if_snd);
265	}
266
267	mtx_lock(&tp->tun_mtx);
268	if (tp->tun_flags & TUN_RWAIT) {
269		tp->tun_flags &= ~TUN_RWAIT;
270		wakeup(tp);
271	}
272	if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio) {
273		mtx_unlock(&tp->tun_mtx);
274		pgsigio(&tp->tun_sigio, SIGIO, 0);
275	} else
276		mtx_unlock(&tp->tun_mtx);
277	selwakeuppri(&tp->tun_rsel, PZERO + 1);
278	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
279}
280
281/* XXX: should return an error code so it can fail. */
282static void
283tuncreate(struct cdev *dev)
284{
285	struct tun_softc *sc;
286	struct ifnet *ifp;
287
288	dev->si_flags &= ~SI_CHEAPCLONE;
289
290	MALLOC(sc, struct tun_softc *, sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
291	mtx_init(&sc->tun_mtx, "tun_mtx", NULL, MTX_DEF);
292	sc->tun_flags = TUN_INITED;
293	sc->tun_dev = dev;
294	mtx_lock(&tunmtx);
295	TAILQ_INSERT_TAIL(&tunhead, sc, tun_list);
296	mtx_unlock(&tunmtx);
297
298	ifp = sc->tun_ifp = if_alloc(IFT_PPP);
299	if (ifp == NULL)
300		panic("%s%d: failed to if_alloc() interface.\n",
301		    TUNNAME, dev2unit(dev));
302	if_initname(ifp, TUNNAME, dev2unit(dev));
303	ifp->if_mtu = TUNMTU;
304	ifp->if_ioctl = tunifioctl;
305	ifp->if_output = tunoutput;
306	ifp->if_start = tunstart;
307	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
308	ifp->if_softc = sc;
309	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
310	ifp->if_snd.ifq_drv_maxlen = 0;
311	IFQ_SET_READY(&ifp->if_snd);
312	knlist_init(&sc->tun_rsel.si_note, NULL, NULL, NULL, NULL);
313
314	if_attach(ifp);
315	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
316	dev->si_drv1 = sc;
317	TUNDEBUG(ifp, "interface %s is created, minor = %#x\n",
318	    ifp->if_xname, minor(dev));
319}
320
321static int
322tunopen(struct cdev *dev, int flag, int mode, struct thread *td)
323{
324	struct ifnet	*ifp;
325	struct tun_softc *tp;
326
327	/*
328	 * XXXRW: Non-atomic test and set of dev->si_drv1 requires
329	 * synchronization.
330	 */
331	tp = dev->si_drv1;
332	if (!tp) {
333		tuncreate(dev);
334		tp = dev->si_drv1;
335	}
336
337	/*
338	 * XXXRW: This use of tun_pid is subject to error due to the
339	 * fact that a reference to the tunnel can live beyond the
340	 * death of the process that created it.  Can we replace this
341	 * with a simple busy flag?
342	 */
343	mtx_lock(&tp->tun_mtx);
344	if (tp->tun_pid != 0 && tp->tun_pid != td->td_proc->p_pid) {
345		mtx_unlock(&tp->tun_mtx);
346		return (EBUSY);
347	}
348	tp->tun_pid = td->td_proc->p_pid;
349
350	tp->tun_flags |= TUN_OPEN;
351	mtx_unlock(&tp->tun_mtx);
352	ifp = TUN2IFP(tp);
353	TUNDEBUG(ifp, "open\n");
354
355	return (0);
356}
357
358/*
359 * tunclose - close the device - mark i/f down & delete
360 * routing info
361 */
362static	int
363tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
364{
365	struct tun_softc *tp;
366	struct ifnet *ifp;
367	int s;
368
369	tp = dev->si_drv1;
370	ifp = TUN2IFP(tp);
371
372	mtx_lock(&tp->tun_mtx);
373	tp->tun_flags &= ~TUN_OPEN;
374	tp->tun_pid = 0;
375
376	/*
377	 * junk all pending output
378	 */
379	s = splimp();
380	IFQ_PURGE(&ifp->if_snd);
381	splx(s);
382	mtx_unlock(&tp->tun_mtx);
383
384	if (ifp->if_flags & IFF_UP) {
385		s = splimp();
386		if_down(ifp);
387		splx(s);
388	}
389
390	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
391		struct ifaddr *ifa;
392
393		s = splimp();
394		/* find internet addresses and delete routes */
395		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
396			if (ifa->ifa_addr->sa_family == AF_INET)
397				/* Unlocked read. */
398				rtinit(ifa, (int)RTM_DELETE,
399				    tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
400		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
401		splx(s);
402	}
403
404	funsetown(&tp->tun_sigio);
405	selwakeuppri(&tp->tun_rsel, PZERO + 1);
406	KNOTE_UNLOCKED(&tp->tun_rsel.si_note, 0);
407	TUNDEBUG (ifp, "closed\n");
408	return (0);
409}
410
411static int
412tuninit(struct ifnet *ifp)
413{
414	struct tun_softc *tp = ifp->if_softc;
415	struct ifaddr *ifa;
416	int error = 0;
417
418	TUNDEBUG(ifp, "tuninit\n");
419
420	ifp->if_flags |= IFF_UP;
421	ifp->if_drv_flags |= IFF_DRV_RUNNING;
422	getmicrotime(&ifp->if_lastchange);
423
424#ifdef INET
425	TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
426		if (ifa->ifa_addr->sa_family == AF_INET) {
427			struct sockaddr_in *si;
428
429			si = (struct sockaddr_in *)ifa->ifa_addr;
430			mtx_lock(&tp->tun_mtx);
431			if (si->sin_addr.s_addr)
432				tp->tun_flags |= TUN_IASET;
433
434			si = (struct sockaddr_in *)ifa->ifa_dstaddr;
435			if (si && si->sin_addr.s_addr)
436				tp->tun_flags |= TUN_DSTADDR;
437			mtx_unlock(&tp->tun_mtx);
438		}
439	}
440#endif
441	return (error);
442}
443
444/*
445 * Process an ioctl request.
446 */
447static int
448tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
449{
450	struct ifreq *ifr = (struct ifreq *)data;
451	struct tun_softc *tp = ifp->if_softc;
452	struct ifstat *ifs;
453	int		error = 0, s;
454
455	s = splimp();
456	switch(cmd) {
457	case SIOCGIFSTATUS:
458		ifs = (struct ifstat *)data;
459		mtx_lock(&tp->tun_mtx);
460		if (tp->tun_pid)
461			sprintf(ifs->ascii + strlen(ifs->ascii),
462			    "\tOpened by PID %d\n", tp->tun_pid);
463		mtx_unlock(&tp->tun_mtx);
464		break;
465	case SIOCSIFADDR:
466		error = tuninit(ifp);
467		TUNDEBUG(ifp, "address set, error=%d\n", error);
468		break;
469	case SIOCSIFDSTADDR:
470		error = tuninit(ifp);
471		TUNDEBUG(ifp, "destination address set, error=%d\n", error);
472		break;
473	case SIOCSIFMTU:
474		ifp->if_mtu = ifr->ifr_mtu;
475		TUNDEBUG(ifp, "mtu set\n");
476		break;
477	case SIOCSIFFLAGS:
478	case SIOCADDMULTI:
479	case SIOCDELMULTI:
480		break;
481	default:
482		error = EINVAL;
483	}
484	splx(s);
485	return (error);
486}
487
488/*
489 * tunoutput - queue packets from higher level ready to put out.
490 */
491static int
492tunoutput(
493	struct ifnet *ifp,
494	struct mbuf *m0,
495	struct sockaddr *dst,
496	struct rtentry *rt)
497{
498	struct tun_softc *tp = ifp->if_softc;
499	u_short cached_tun_flags;
500	int error;
501	u_int32_t af;
502
503	TUNDEBUG (ifp, "tunoutput\n");
504
505#ifdef MAC
506	error = mac_check_ifnet_transmit(ifp, m0);
507	if (error) {
508		m_freem(m0);
509		return (error);
510	}
511#endif
512
513	/* Could be unlocked read? */
514	mtx_lock(&tp->tun_mtx);
515	cached_tun_flags = tp->tun_flags;
516	mtx_unlock(&tp->tun_mtx);
517	if ((cached_tun_flags & TUN_READY) != TUN_READY) {
518		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
519		m_freem (m0);
520		return (EHOSTDOWN);
521	}
522
523	if ((ifp->if_flags & IFF_UP) != IFF_UP) {
524		m_freem (m0);
525		return (EHOSTDOWN);
526	}
527
528	/* BPF writes need to be handled specially. */
529	if (dst->sa_family == AF_UNSPEC) {
530		bcopy(dst->sa_data, &af, sizeof(af));
531		dst->sa_family = af;
532	}
533
534	if (bpf_peers_present(ifp->if_bpf)) {
535		af = dst->sa_family;
536		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
537	}
538
539	/* prepend sockaddr? this may abort if the mbuf allocation fails */
540	if (cached_tun_flags & TUN_LMODE) {
541		/* allocate space for sockaddr */
542		M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
543
544		/* if allocation failed drop packet */
545		if (m0 == NULL) {
546			ifp->if_iqdrops++;
547			ifp->if_oerrors++;
548			return (ENOBUFS);
549		} else {
550			bcopy(dst, m0->m_data, dst->sa_len);
551		}
552	}
553
554	if (cached_tun_flags & TUN_IFHEAD) {
555		/* Prepend the address family */
556		M_PREPEND(m0, 4, M_DONTWAIT);
557
558		/* if allocation failed drop packet */
559		if (m0 == NULL) {
560			ifp->if_iqdrops++;
561			ifp->if_oerrors++;
562			return (ENOBUFS);
563		} else
564			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
565	} else {
566#ifdef INET
567		if (dst->sa_family != AF_INET)
568#endif
569		{
570			m_freem(m0);
571			return (EAFNOSUPPORT);
572		}
573	}
574
575	IFQ_HANDOFF(ifp, m0, error);
576	if (error) {
577		ifp->if_collisions++;
578		return (ENOBUFS);
579	}
580	ifp->if_opackets++;
581	return (0);
582}
583
584/*
585 * the cdevsw interface is now pretty minimal.
586 */
587static	int
588tunioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
589{
590	int		s;
591	int		error;
592	struct tun_softc *tp = dev->si_drv1;
593	struct tuninfo *tunp;
594
595	switch (cmd) {
596	case TUNSIFINFO:
597		tunp = (struct tuninfo *)data;
598		if (tunp->mtu < IF_MINMTU)
599			return (EINVAL);
600		if (TUN2IFP(tp)->if_mtu != tunp->mtu
601		&& (error = suser(td)) != 0)
602			return (error);
603		TUN2IFP(tp)->if_mtu = tunp->mtu;
604		TUN2IFP(tp)->if_type = tunp->type;
605		TUN2IFP(tp)->if_baudrate = tunp->baudrate;
606		break;
607	case TUNGIFINFO:
608		tunp = (struct tuninfo *)data;
609		tunp->mtu = TUN2IFP(tp)->if_mtu;
610		tunp->type = TUN2IFP(tp)->if_type;
611		tunp->baudrate = TUN2IFP(tp)->if_baudrate;
612		break;
613	case TUNSDEBUG:
614		tundebug = *(int *)data;
615		break;
616	case TUNGDEBUG:
617		*(int *)data = tundebug;
618		break;
619	case TUNSLMODE:
620		mtx_lock(&tp->tun_mtx);
621		if (*(int *)data) {
622			tp->tun_flags |= TUN_LMODE;
623			tp->tun_flags &= ~TUN_IFHEAD;
624		} else
625			tp->tun_flags &= ~TUN_LMODE;
626		mtx_unlock(&tp->tun_mtx);
627		break;
628	case TUNSIFHEAD:
629		mtx_lock(&tp->tun_mtx);
630		if (*(int *)data) {
631			tp->tun_flags |= TUN_IFHEAD;
632			tp->tun_flags &= ~TUN_LMODE;
633		} else
634			tp->tun_flags &= ~TUN_IFHEAD;
635		mtx_unlock(&tp->tun_mtx);
636		break;
637	case TUNGIFHEAD:
638		/* Could be unlocked read? */
639		mtx_lock(&tp->tun_mtx);
640		*(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
641		mtx_unlock(&tp->tun_mtx);
642		break;
643	case TUNSIFMODE:
644		/* deny this if UP */
645		if (TUN2IFP(tp)->if_flags & IFF_UP)
646			return(EBUSY);
647
648		switch (*(int *)data & ~IFF_MULTICAST) {
649		case IFF_POINTOPOINT:
650		case IFF_BROADCAST:
651			TUN2IFP(tp)->if_flags &=
652			    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
653			TUN2IFP(tp)->if_flags |= *(int *)data;
654			break;
655		default:
656			return(EINVAL);
657		}
658		break;
659	case TUNSIFPID:
660		mtx_lock(&tp->tun_mtx);
661		tp->tun_pid = curthread->td_proc->p_pid;
662		mtx_unlock(&tp->tun_mtx);
663		break;
664	case FIONBIO:
665		break;
666	case FIOASYNC:
667		mtx_lock(&tp->tun_mtx);
668		if (*(int *)data)
669			tp->tun_flags |= TUN_ASYNC;
670		else
671			tp->tun_flags &= ~TUN_ASYNC;
672		mtx_unlock(&tp->tun_mtx);
673		break;
674	case FIONREAD:
675		s = splimp();
676		if (!IFQ_IS_EMPTY(&TUN2IFP(tp)->if_snd)) {
677			struct mbuf *mb;
678			IFQ_LOCK(&TUN2IFP(tp)->if_snd);
679			IFQ_POLL_NOLOCK(&TUN2IFP(tp)->if_snd, mb);
680			for( *(int *)data = 0; mb != 0; mb = mb->m_next)
681				*(int *)data += mb->m_len;
682			IFQ_UNLOCK(&TUN2IFP(tp)->if_snd);
683		} else
684			*(int *)data = 0;
685		splx(s);
686		break;
687	case FIOSETOWN:
688		return (fsetown(*(int *)data, &tp->tun_sigio));
689
690	case FIOGETOWN:
691		*(int *)data = fgetown(&tp->tun_sigio);
692		return (0);
693
694	/* This is deprecated, FIOSETOWN should be used instead. */
695	case TIOCSPGRP:
696		return (fsetown(-(*(int *)data), &tp->tun_sigio));
697
698	/* This is deprecated, FIOGETOWN should be used instead. */
699	case TIOCGPGRP:
700		*(int *)data = -fgetown(&tp->tun_sigio);
701		return (0);
702
703	default:
704		return (ENOTTY);
705	}
706	return (0);
707}
708
709/*
710 * The cdevsw read interface - reads a packet at a time, or at
711 * least as much of a packet as can be read.
712 */
713static	int
714tunread(struct cdev *dev, struct uio *uio, int flag)
715{
716	struct tun_softc *tp = dev->si_drv1;
717	struct ifnet	*ifp = TUN2IFP(tp);
718	struct mbuf	*m;
719	int		error=0, len, s;
720
721	TUNDEBUG (ifp, "read\n");
722	mtx_lock(&tp->tun_mtx);
723	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
724		mtx_unlock(&tp->tun_mtx);
725		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
726		return (EHOSTDOWN);
727	}
728
729	tp->tun_flags &= ~TUN_RWAIT;
730	mtx_unlock(&tp->tun_mtx);
731
732	s = splimp();
733	do {
734		IFQ_DEQUEUE(&ifp->if_snd, m);
735		if (m == NULL) {
736			if (flag & O_NONBLOCK) {
737				splx(s);
738				return (EWOULDBLOCK);
739			}
740			mtx_lock(&tp->tun_mtx);
741			tp->tun_flags |= TUN_RWAIT;
742			mtx_unlock(&tp->tun_mtx);
743			if ((error = tsleep(tp, PCATCH | (PZERO + 1),
744					"tunread", 0)) != 0) {
745				splx(s);
746				return (error);
747			}
748		}
749	} while (m == NULL);
750	splx(s);
751
752	while (m && uio->uio_resid > 0 && error == 0) {
753		len = min(uio->uio_resid, m->m_len);
754		if (len != 0)
755			error = uiomove(mtod(m, void *), len, uio);
756		m = m_free(m);
757	}
758
759	if (m) {
760		TUNDEBUG(ifp, "Dropping mbuf\n");
761		m_freem(m);
762	}
763	return (error);
764}
765
766/*
767 * the cdevsw write interface - an atomic write is a packet - or else!
768 */
769static	int
770tunwrite(struct cdev *dev, struct uio *uio, int flag)
771{
772	struct tun_softc *tp = dev->si_drv1;
773	struct ifnet	*ifp = TUN2IFP(tp);
774	struct mbuf	*m;
775	int		error = 0;
776	uint32_t	family;
777	int 		isr;
778
779	TUNDEBUG(ifp, "tunwrite\n");
780
781	if ((ifp->if_flags & IFF_UP) != IFF_UP)
782		/* ignore silently */
783		return (0);
784
785	if (uio->uio_resid == 0)
786		return (0);
787
788	if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
789		TUNDEBUG(ifp, "len=%d!\n", uio->uio_resid);
790		return (EIO);
791	}
792
793	if ((m = m_uiotombuf(uio, M_DONTWAIT, 0, 0)) == NULL) {
794		ifp->if_ierrors++;
795		return (error);
796	}
797
798	m->m_pkthdr.rcvif = ifp;
799#ifdef MAC
800	mac_create_mbuf_from_ifnet(ifp, m);
801#endif
802
803	/* Could be unlocked read? */
804	mtx_lock(&tp->tun_mtx);
805	if (tp->tun_flags & TUN_IFHEAD) {
806		mtx_unlock(&tp->tun_mtx);
807		if (m->m_len < sizeof(family) &&
808		    (m = m_pullup(m, sizeof(family))) == NULL)
809			return (ENOBUFS);
810		family = ntohl(*mtod(m, u_int32_t *));
811		m_adj(m, sizeof(family));
812	} else {
813		mtx_unlock(&tp->tun_mtx);
814		family = AF_INET;
815	}
816
817	BPF_MTAP2(ifp, &family, sizeof(family), m);
818
819	switch (family) {
820#ifdef INET
821	case AF_INET:
822		isr = NETISR_IP;
823		break;
824#endif
825#ifdef INET6
826	case AF_INET6:
827		isr = NETISR_IPV6;
828		break;
829#endif
830#ifdef IPX
831	case AF_IPX:
832		isr = NETISR_IPX;
833		break;
834#endif
835#ifdef NETATALK
836	case AF_APPLETALK:
837		isr = NETISR_ATALK2;
838		break;
839#endif
840	default:
841		m_freem(m);
842		return (EAFNOSUPPORT);
843	}
844	/* First chunk of an mbuf contains good junk */
845	if (harvest.point_to_point)
846		random_harvest(m, 16, 3, 0, RANDOM_NET);
847	ifp->if_ibytes += m->m_pkthdr.len;
848	ifp->if_ipackets++;
849	netisr_dispatch(isr, m);
850	return (0);
851}
852
853/*
854 * tunpoll - the poll interface, this is only useful on reads
855 * really. The write detect always returns true, write never blocks
856 * anyway, it either accepts the packet or drops it.
857 */
858static	int
859tunpoll(struct cdev *dev, int events, struct thread *td)
860{
861	int		s;
862	struct tun_softc *tp = dev->si_drv1;
863	struct ifnet	*ifp = TUN2IFP(tp);
864	int		revents = 0;
865	struct mbuf	*m;
866
867	s = splimp();
868	TUNDEBUG(ifp, "tunpoll\n");
869
870	if (events & (POLLIN | POLLRDNORM)) {
871		IFQ_LOCK(&ifp->if_snd);
872		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
873		if (m != NULL) {
874			TUNDEBUG(ifp, "tunpoll q=%d\n", ifp->if_snd.ifq_len);
875			revents |= events & (POLLIN | POLLRDNORM);
876		} else {
877			TUNDEBUG(ifp, "tunpoll waiting\n");
878			selrecord(td, &tp->tun_rsel);
879		}
880		IFQ_UNLOCK(&ifp->if_snd);
881	}
882	if (events & (POLLOUT | POLLWRNORM))
883		revents |= events & (POLLOUT | POLLWRNORM);
884
885	splx(s);
886	return (revents);
887}
888
889/*
890 * tunkqfilter - support for the kevent() system call.
891 */
892static int
893tunkqfilter(struct cdev *dev, struct knote *kn)
894{
895	int			s;
896	struct tun_softc	*tp = dev->si_drv1;
897	struct ifnet	*ifp = TUN2IFP(tp);
898
899	s = splimp();
900	switch(kn->kn_filter) {
901	case EVFILT_READ:
902		TUNDEBUG(ifp, "%s kqfilter: EVFILT_READ, minor = %#x\n",
903		    ifp->if_xname, minor(dev));
904		kn->kn_fop = &tun_read_filterops;
905		break;
906
907	case EVFILT_WRITE:
908		TUNDEBUG(ifp, "%s kqfilter: EVFILT_WRITE, minor = %#x\n",
909		    ifp->if_xname, minor(dev));
910		kn->kn_fop = &tun_write_filterops;
911		break;
912
913	default:
914		TUNDEBUG(ifp, "%s kqfilter: invalid filter, minor = %#x\n",
915		    ifp->if_xname, minor(dev));
916		splx(s);
917		return(EINVAL);
918	}
919	splx(s);
920
921	kn->kn_hook = (caddr_t) dev;
922	knlist_add(&tp->tun_rsel.si_note, kn, 0);
923
924	return (0);
925}
926
927/*
928 * Return true of there is data in the interface queue.
929 */
930static int
931tunkqread(struct knote *kn, long hint)
932{
933	int			ret, s;
934	struct cdev		*dev = (struct cdev *)(kn->kn_hook);
935	struct tun_softc	*tp = dev->si_drv1;
936	struct ifnet	*ifp = TUN2IFP(tp);
937
938	s = splimp();
939	if ((kn->kn_data = ifp->if_snd.ifq_len) > 0) {
940		TUNDEBUG(ifp,
941		    "%s have data in the queue.  Len = %d, minor = %#x\n",
942		    ifp->if_xname, ifp->if_snd.ifq_len, minor(dev));
943		ret = 1;
944	} else {
945		TUNDEBUG(ifp,
946		    "%s waiting for data, minor = %#x\n", ifp->if_xname,
947		    minor(dev));
948		ret = 0;
949	}
950	splx(s);
951
952	return (ret);
953}
954
955/*
956 * Always can write, always return MTU in kn->data.
957 */
958static int
959tunkqwrite(struct knote *kn, long hint)
960{
961	int			s;
962	struct tun_softc	*tp = ((struct cdev *)kn->kn_hook)->si_drv1;
963	struct ifnet	*ifp = TUN2IFP(tp);
964
965	s = splimp();
966	kn->kn_data = ifp->if_mtu;
967	splx(s);
968
969	return (1);
970}
971
972static void
973tunkqdetach(struct knote *kn)
974{
975	struct tun_softc	*tp = ((struct cdev *)kn->kn_hook)->si_drv1;
976
977	knlist_remove(&tp->tun_rsel.si_note, kn, 0);
978}
979