if_tun.c revision 121431 
1/*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2
3/*
4 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5 * Nottingham University 1987.
6 *
7 * This source may be freely distributed, however I would be interested
8 * in any changes that are made.
9 *
10 * This driver takes packets off the IP i/f and hands them up to a
11 * user process to have its wicked way with. This driver has it's
12 * roots in a similar driver written by Phil Cockcroft (formerly) at
13 * UCL. This driver is based much more on read/write/poll mode of
14 * operation though.
15 *
16 * $FreeBSD: head/sys/net/if_tun.c 121431 2003-10-23 16:29:20Z brooks $
17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23#include "opt_mac.h"
24
25#include <sys/param.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/mac.h>
29#include <sys/mbuf.h>
30#include <sys/module.h>
31#include <sys/socket.h>
32#include <sys/filio.h>
33#include <sys/sockio.h>
34#include <sys/ttycom.h>
35#include <sys/poll.h>
36#include <sys/signalvar.h>
37#include <sys/filedesc.h>
38#include <sys/kernel.h>
39#include <sys/sysctl.h>
40#include <sys/conf.h>
41#include <sys/uio.h>
42#include <sys/vnode.h>
43#include <sys/malloc.h>
44#include <machine/bus.h>	/* XXX Shouldn't really be required ! */
45#include <sys/random.h>
46#include <sys/rman.h>
47
48#include <net/if.h>
49#include <net/if_types.h>
50#include <net/netisr.h>
51#include <net/route.h>
52#ifdef INET
53#include <netinet/in.h>
54#endif
55#include <net/bpf.h>
56#include <net/if_tunvar.h>
57#include <net/if_tun.h>
58
59#define TUNDEBUG	if (tundebug) printf
60#define	TUNNAME		"tun"
61
62static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
63static int tundebug = 0;
64static struct tun_softc *tunhead = NULL;
65static struct rman tununits;
66static udev_t tunbasedev = NOUDEV;
67SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
68
69static void	tunclone(void *arg, char *name, int namelen, dev_t *dev);
70static void	tuncreate(dev_t dev);
71static int	tunifioctl(struct ifnet *, u_long, caddr_t);
72static int	tuninit(struct ifnet *);
73static int	tunmodevent(module_t, int, void *);
74static int	tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
75		    struct rtentry *rt);
76static void	tunstart(struct ifnet *);
77
78static d_open_t		tunopen;
79static d_close_t	tunclose;
80static d_read_t		tunread;
81static d_write_t	tunwrite;
82static d_ioctl_t	tunioctl;
83static d_poll_t		tunpoll;
84
85#define CDEV_MAJOR 52
86static struct cdevsw tun_cdevsw = {
87	.d_open =	tunopen,
88	.d_close =	tunclose,
89	.d_read =	tunread,
90	.d_write =	tunwrite,
91	.d_ioctl =	tunioctl,
92	.d_poll =	tunpoll,
93	.d_name =	TUNNAME,
94	.d_maj =	CDEV_MAJOR,
95};
96
97static void
98tunclone(void *arg, char *name, int namelen, dev_t *dev)
99{
100	struct resource *r;
101	int err;
102	int u;
103
104	if (*dev != NODEV)
105		return;
106
107	if (strcmp(name, TUNNAME) == 0) {
108		r = rman_reserve_resource(&tununits, 0, IF_MAXUNIT, 1,
109		    RF_ALLOCATED | RF_ACTIVE, NULL);
110		u = rman_get_start(r);
111		err = rman_release_resource(r);
112		KASSERT(err == 0, ("Unexpected failure releasing resource"));
113		*dev = makedev(CDEV_MAJOR, unit2minor(u));
114		if ((*dev)->si_flags & SI_NAMED)
115			return;	/* Already make_dev()d */
116	} else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
117		return;	/* Don't recognise the name */
118
119	*dev = make_dev(&tun_cdevsw, unit2minor(u),
120	    UID_ROOT, GID_WHEEL, 0600, "tun%d", u);
121
122	/*
123	 * All devices depend on tunbasedev so that we can simply
124	 * destroy_dev() this device at module unload time to get
125	 * rid of all our make_dev()d resources.
126	 */
127	if (tunbasedev == NOUDEV)
128		tunbasedev = (*dev)->si_udev;
129	else {
130		(*dev)->si_flags |= SI_CHEAPCLONE;
131		dev_depends(udev2dev(tunbasedev, 0), *dev);
132	}
133}
134
135static int
136tunmodevent(module_t mod, int type, void *data)
137{
138	static eventhandler_tag tag;
139	struct tun_softc *tp;
140	dev_t dev;
141	int err;
142
143	switch (type) {
144	case MOD_LOAD:
145		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
146		if (tag == NULL)
147			return (ENOMEM);
148		tununits.rm_type = RMAN_ARRAY;
149		tununits.rm_descr = "open if_tun units";
150		err = rman_init(&tununits);
151		if (err != 0) {
152			EVENTHANDLER_DEREGISTER(dev_clone, tag);
153			return (err);
154		}
155		err = rman_manage_region(&tununits, 0, IF_MAXUNIT);
156		if (err != 0) {
157			printf("%s: tununits: rman_manage_region: Failed %d\n",
158			    TUNNAME, err);
159			rman_fini(&tununits);
160			EVENTHANDLER_DEREGISTER(dev_clone, tag);
161			return (err);
162		}
163		break;
164	case MOD_UNLOAD:
165		err = rman_fini(&tununits);
166		if (err != 0)
167			return (err);
168		EVENTHANDLER_DEREGISTER(dev_clone, tag);
169
170		while (tunhead != NULL) {
171			KASSERT((tunhead->tun_flags & TUN_OPEN) == 0,
172			    ("tununits is out of sync - unit %d",
173			    tunhead->tun_if.if_unit));
174			tp = tunhead;
175			dev = makedev(tun_cdevsw.d_maj,
176			    unit2minor(tp->tun_if.if_unit));
177			KASSERT(dev->si_drv1 == tp, ("Bad makedev result"));
178			tunhead = tp->next;
179			bpfdetach(&tp->tun_if);
180			if_detach(&tp->tun_if);
181			KASSERT(dev->si_flags & SI_NAMED, ("Missing make_dev"));
182			free(tp, M_TUN);
183		}
184
185		/*
186		 * Destroying tunbasedev results in all of our make_dev()s
187		 * conveniently going away.
188		 */
189		if (tunbasedev != NOUDEV)
190			destroy_dev(udev2dev(tunbasedev, 0));
191
192		break;
193	}
194	return 0;
195}
196
197static moduledata_t tun_mod = {
198	"if_tun",
199	tunmodevent,
200	0
201};
202
203DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
204
205static void
206tunstart(struct ifnet *ifp)
207{
208	struct tun_softc *tp = ifp->if_softc;
209
210	if (tp->tun_flags & TUN_RWAIT) {
211		tp->tun_flags &= ~TUN_RWAIT;
212		wakeup(tp);
213	}
214	if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio)
215		pgsigio(&tp->tun_sigio, SIGIO, 0);
216	selwakeup(&tp->tun_rsel);
217}
218
219static void
220tuncreate(dev_t dev)
221{
222	struct tun_softc *sc;
223	struct ifnet *ifp;
224
225	if (!(dev->si_flags & SI_NAMED))
226		dev = make_dev(&tun_cdevsw, minor(dev),
227		    UID_UUCP, GID_DIALER, 0600, "tun%d", dev2unit(dev));
228
229	MALLOC(sc, struct tun_softc *, sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
230	sc->tun_flags = TUN_INITED;
231	sc->next = tunhead;
232	tunhead = sc;
233
234	ifp = &sc->tun_if;
235	ifp->if_unit = dev2unit(dev);
236	ifp->if_name = TUNNAME;
237	ifp->if_mtu = TUNMTU;
238	ifp->if_ioctl = tunifioctl;
239	ifp->if_output = tunoutput;
240	ifp->if_start = tunstart;
241	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
242	ifp->if_type = IFT_PPP;
243	ifp->if_snd.ifq_maxlen = ifqmaxlen;
244	ifp->if_softc = sc;
245	if_attach(ifp);
246	bpfattach(ifp, DLT_NULL, sizeof(u_int));
247	dev->si_drv1 = sc;
248}
249
250static int
251tunopen(dev_t dev, int flag, int mode, struct thread *td)
252{
253	struct resource *r;
254	struct ifnet	*ifp;
255	struct tun_softc *tp;
256	int unit;
257
258	unit = dev2unit(dev);
259	if (unit > IF_MAXUNIT)
260		return (ENXIO);
261
262	r = rman_reserve_resource(&tununits, unit, unit, 1,
263	    RF_ALLOCATED | RF_ACTIVE, NULL);
264	if (r == NULL)
265		return (EBUSY);
266
267	dev->si_flags &= ~SI_CHEAPCLONE;
268
269	tp = dev->si_drv1;
270	if (!tp) {
271		tuncreate(dev);
272		tp = dev->si_drv1;
273	}
274	KASSERT(!(tp->tun_flags & TUN_OPEN), ("Resource & flags out-of-sync"));
275	tp->tun_unit = r;
276	tp->tun_pid = td->td_proc->p_pid;
277	ifp = &tp->tun_if;
278	tp->tun_flags |= TUN_OPEN;
279	TUNDEBUG("%s%d: open\n", ifp->if_name, ifp->if_unit);
280
281	return (0);
282}
283
284/*
285 * tunclose - close the device - mark i/f down & delete
286 * routing info
287 */
288static	int
289tunclose(dev_t dev, int foo, int bar, struct thread *td)
290{
291	struct tun_softc *tp;
292	struct ifnet *ifp;
293	int s;
294	int err;
295
296	tp = dev->si_drv1;
297	ifp = &tp->tun_if;
298
299	KASSERT(tp->tun_unit, ("Unit %d not marked open", ifp->if_unit));
300	tp->tun_flags &= ~TUN_OPEN;
301	tp->tun_pid = 0;
302
303	/*
304	 * junk all pending output
305	 */
306	IF_DRAIN(&ifp->if_snd);
307
308	if (ifp->if_flags & IFF_UP) {
309		s = splimp();
310		if_down(ifp);
311		splx(s);
312	}
313
314	if (ifp->if_flags & IFF_RUNNING) {
315		struct ifaddr *ifa;
316
317		s = splimp();
318		/* find internet addresses and delete routes */
319		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
320			if (ifa->ifa_addr->sa_family == AF_INET)
321				rtinit(ifa, (int)RTM_DELETE,
322				    tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
323		ifp->if_flags &= ~IFF_RUNNING;
324		splx(s);
325	}
326
327	funsetown(&tp->tun_sigio);
328	selwakeup(&tp->tun_rsel);
329
330	TUNDEBUG ("%s%d: closed\n", ifp->if_name, ifp->if_unit);
331	err = rman_release_resource(tp->tun_unit);
332	KASSERT(err == 0, ("Unit %d failed to release", ifp->if_unit));
333
334	return (0);
335}
336
337static int
338tuninit(struct ifnet *ifp)
339{
340	struct tun_softc *tp = ifp->if_softc;
341	struct ifaddr *ifa;
342	int error = 0;
343
344	TUNDEBUG("%s%d: tuninit\n", ifp->if_name, ifp->if_unit);
345
346	ifp->if_flags |= IFF_UP | IFF_RUNNING;
347	getmicrotime(&ifp->if_lastchange);
348
349	for (ifa = TAILQ_FIRST(&ifp->if_addrhead); ifa;
350	     ifa = TAILQ_NEXT(ifa, ifa_link)) {
351		if (ifa->ifa_addr == NULL)
352			error = EFAULT;
353			/* XXX: Should maybe return straight off? */
354		else {
355#ifdef INET
356			if (ifa->ifa_addr->sa_family == AF_INET) {
357			    struct sockaddr_in *si;
358
359			    si = (struct sockaddr_in *)ifa->ifa_addr;
360			    if (si->sin_addr.s_addr)
361				    tp->tun_flags |= TUN_IASET;
362
363			    si = (struct sockaddr_in *)ifa->ifa_dstaddr;
364			    if (si && si->sin_addr.s_addr)
365				    tp->tun_flags |= TUN_DSTADDR;
366			}
367#endif
368		}
369	}
370	return (error);
371}
372
373/*
374 * Process an ioctl request.
375 */
376static int
377tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
378{
379	struct ifreq *ifr = (struct ifreq *)data;
380	struct tun_softc *tp = ifp->if_softc;
381	struct ifstat *ifs;
382	int		error = 0, s;
383
384	s = splimp();
385	switch(cmd) {
386	case SIOCGIFSTATUS:
387		ifs = (struct ifstat *)data;
388		if (tp->tun_pid)
389			sprintf(ifs->ascii + strlen(ifs->ascii),
390			    "\tOpened by PID %d\n", tp->tun_pid);
391		break;
392	case SIOCSIFADDR:
393		error = tuninit(ifp);
394		TUNDEBUG("%s%d: address set, error=%d\n",
395			 ifp->if_name, ifp->if_unit, error);
396		break;
397	case SIOCSIFDSTADDR:
398		error = tuninit(ifp);
399		TUNDEBUG("%s%d: destination address set, error=%d\n",
400			 ifp->if_name, ifp->if_unit, error);
401		break;
402	case SIOCSIFMTU:
403		ifp->if_mtu = ifr->ifr_mtu;
404		TUNDEBUG("%s%d: mtu set\n", ifp->if_name, ifp->if_unit);
405		break;
406	case SIOCSIFFLAGS:
407	case SIOCADDMULTI:
408	case SIOCDELMULTI:
409		break;
410	default:
411		error = EINVAL;
412	}
413	splx(s);
414	return (error);
415}
416
417/*
418 * tunoutput - queue packets from higher level ready to put out.
419 */
420static int
421tunoutput(
422	struct ifnet *ifp,
423	struct mbuf *m0,
424	struct sockaddr *dst,
425	struct rtentry *rt)
426{
427	struct tun_softc *tp = ifp->if_softc;
428#ifdef MAC
429	int error;
430#endif
431
432	TUNDEBUG ("%s%d: tunoutput\n", ifp->if_name, ifp->if_unit);
433
434#ifdef MAC
435	error = mac_check_ifnet_transmit(ifp, m0);
436	if (error) {
437		m_freem(m0);
438		return (error);
439	}
440#endif
441
442	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
443		TUNDEBUG ("%s%d: not ready 0%o\n", ifp->if_name,
444			  ifp->if_unit, tp->tun_flags);
445		m_freem (m0);
446		return (EHOSTDOWN);
447	}
448
449	if ((ifp->if_flags & IFF_UP) != IFF_UP) {
450		m_freem (m0);
451		return (EHOSTDOWN);
452	}
453
454	/* BPF write needs to be handled specially */
455	if (dst->sa_family == AF_UNSPEC) {
456		dst->sa_family = *(mtod(m0, int *));
457		m0->m_len -= sizeof(int);
458		m0->m_pkthdr.len -= sizeof(int);
459		m0->m_data += sizeof(int);
460	}
461
462	if (ifp->if_bpf) {
463		/*
464		 * We need to prepend the address family as
465		 * a four byte field.  Cons up a dummy header
466		 * to pacify bpf.  This is safe because bpf
467		 * will only read from the mbuf (i.e., it won't
468		 * try to free it or keep a pointer to it).
469		 */
470		struct mbuf m;
471		uint32_t af = dst->sa_family;
472
473		m.m_next = m0;
474		m.m_len = 4;
475		m.m_data = (char *)&af;
476
477		BPF_MTAP(ifp, &m);
478	}
479
480	/* prepend sockaddr? this may abort if the mbuf allocation fails */
481	if (tp->tun_flags & TUN_LMODE) {
482		/* allocate space for sockaddr */
483		M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
484
485		/* if allocation failed drop packet */
486		if (m0 == NULL) {
487			ifp->if_iqdrops++;
488			ifp->if_oerrors++;
489			return (ENOBUFS);
490		} else {
491			bcopy(dst, m0->m_data, dst->sa_len);
492		}
493	}
494
495	if (tp->tun_flags & TUN_IFHEAD) {
496		/* Prepend the address family */
497		M_PREPEND(m0, 4, M_DONTWAIT);
498
499		/* if allocation failed drop packet */
500		if (m0 == NULL) {
501			ifp->if_iqdrops++;
502			ifp->if_oerrors++;
503			return (ENOBUFS);
504		} else
505			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
506	} else {
507#ifdef INET
508		if (dst->sa_family != AF_INET)
509#endif
510		{
511			m_freem(m0);
512			return (EAFNOSUPPORT);
513		}
514	}
515
516	if (! IF_HANDOFF(&ifp->if_snd, m0, ifp)) {
517		ifp->if_collisions++;
518		return (ENOBUFS);
519	}
520	ifp->if_opackets++;
521	return (0);
522}
523
524/*
525 * the cdevsw interface is now pretty minimal.
526 */
527static	int
528tunioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct thread *td)
529{
530	int		s;
531	int		error;
532	struct tun_softc *tp = dev->si_drv1;
533	struct tuninfo *tunp;
534
535	switch (cmd) {
536	case TUNSIFINFO:
537		tunp = (struct tuninfo *)data;
538		if (tunp->mtu < IF_MINMTU)
539			return (EINVAL);
540		if (tp->tun_if.if_mtu != tunp->mtu
541		&& (error = suser(td)) != 0)
542			return (error);
543		tp->tun_if.if_mtu = tunp->mtu;
544		tp->tun_if.if_type = tunp->type;
545		tp->tun_if.if_baudrate = tunp->baudrate;
546		break;
547	case TUNGIFINFO:
548		tunp = (struct tuninfo *)data;
549		tunp->mtu = tp->tun_if.if_mtu;
550		tunp->type = tp->tun_if.if_type;
551		tunp->baudrate = tp->tun_if.if_baudrate;
552		break;
553	case TUNSDEBUG:
554		tundebug = *(int *)data;
555		break;
556	case TUNGDEBUG:
557		*(int *)data = tundebug;
558		break;
559	case TUNSLMODE:
560		if (*(int *)data) {
561			tp->tun_flags |= TUN_LMODE;
562			tp->tun_flags &= ~TUN_IFHEAD;
563		} else
564			tp->tun_flags &= ~TUN_LMODE;
565		break;
566	case TUNSIFHEAD:
567		if (*(int *)data) {
568			tp->tun_flags |= TUN_IFHEAD;
569			tp->tun_flags &= ~TUN_LMODE;
570		} else
571			tp->tun_flags &= ~TUN_IFHEAD;
572		break;
573	case TUNGIFHEAD:
574		*(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
575		break;
576	case TUNSIFMODE:
577		/* deny this if UP */
578		if (tp->tun_if.if_flags & IFF_UP)
579			return(EBUSY);
580
581		switch (*(int *)data & ~IFF_MULTICAST) {
582		case IFF_POINTOPOINT:
583		case IFF_BROADCAST:
584			tp->tun_if.if_flags &=
585			    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
586			tp->tun_if.if_flags |= *(int *)data;
587			break;
588		default:
589			return(EINVAL);
590		}
591		break;
592	case TUNSIFPID:
593		tp->tun_pid = curthread->td_proc->p_pid;
594		break;
595	case FIONBIO:
596		break;
597	case FIOASYNC:
598		if (*(int *)data)
599			tp->tun_flags |= TUN_ASYNC;
600		else
601			tp->tun_flags &= ~TUN_ASYNC;
602		break;
603	case FIONREAD:
604		s = splimp();
605		if (tp->tun_if.if_snd.ifq_head) {
606			struct mbuf *mb = tp->tun_if.if_snd.ifq_head;
607			for( *(int *)data = 0; mb != 0; mb = mb->m_next)
608				*(int *)data += mb->m_len;
609		} else
610			*(int *)data = 0;
611		splx(s);
612		break;
613	case FIOSETOWN:
614		return (fsetown(*(int *)data, &tp->tun_sigio));
615
616	case FIOGETOWN:
617		*(int *)data = fgetown(&tp->tun_sigio);
618		return (0);
619
620	/* This is deprecated, FIOSETOWN should be used instead. */
621	case TIOCSPGRP:
622		return (fsetown(-(*(int *)data), &tp->tun_sigio));
623
624	/* This is deprecated, FIOGETOWN should be used instead. */
625	case TIOCGPGRP:
626		*(int *)data = -fgetown(&tp->tun_sigio);
627		return (0);
628
629	default:
630		return (ENOTTY);
631	}
632	return (0);
633}
634
635/*
636 * The cdevsw read interface - reads a packet at a time, or at
637 * least as much of a packet as can be read.
638 */
639static	int
640tunread(dev_t dev, struct uio *uio, int flag)
641{
642	struct tun_softc *tp = dev->si_drv1;
643	struct ifnet	*ifp = &tp->tun_if;
644	struct mbuf	*m;
645	int		error=0, len, s;
646
647	TUNDEBUG ("%s%d: read\n", ifp->if_name, ifp->if_unit);
648	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
649		TUNDEBUG ("%s%d: not ready 0%o\n", ifp->if_name,
650			  ifp->if_unit, tp->tun_flags);
651		return (EHOSTDOWN);
652	}
653
654	tp->tun_flags &= ~TUN_RWAIT;
655
656	s = splimp();
657	do {
658		IF_DEQUEUE(&ifp->if_snd, m);
659		if (m == NULL) {
660			if (flag & IO_NDELAY) {
661				splx(s);
662				return (EWOULDBLOCK);
663			}
664			tp->tun_flags |= TUN_RWAIT;
665			if((error = tsleep(tp, PCATCH | (PZERO + 1),
666					"tunread", 0)) != 0) {
667				splx(s);
668				return (error);
669			}
670		}
671	} while (m == NULL);
672	splx(s);
673
674	while (m && uio->uio_resid > 0 && error == 0) {
675		len = min(uio->uio_resid, m->m_len);
676		if (len != 0)
677			error = uiomove(mtod(m, void *), len, uio);
678		m = m_free(m);
679	}
680
681	if (m) {
682		TUNDEBUG("%s%d: Dropping mbuf\n", ifp->if_name, ifp->if_unit);
683		m_freem(m);
684	}
685	return (error);
686}
687
688/*
689 * the cdevsw write interface - an atomic write is a packet - or else!
690 */
691static	int
692tunwrite(dev_t dev, struct uio *uio, int flag)
693{
694	struct tun_softc *tp = dev->si_drv1;
695	struct ifnet	*ifp = &tp->tun_if;
696	struct mbuf	*top, **mp, *m;
697	int		error=0, tlen, mlen;
698	uint32_t	family;
699	int 		isr;
700
701	TUNDEBUG("%s%d: tunwrite\n", ifp->if_name, ifp->if_unit);
702
703	if ((ifp->if_flags & IFF_UP) != IFF_UP)
704		/* ignore silently */
705		return (0);
706
707	if (uio->uio_resid == 0)
708		return (0);
709
710	if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
711		TUNDEBUG("%s%d: len=%d!\n", ifp->if_name, ifp->if_unit,
712		    uio->uio_resid);
713		return (EIO);
714	}
715	tlen = uio->uio_resid;
716
717	/* get a header mbuf */
718	MGETHDR(m, M_DONTWAIT, MT_DATA);
719	if (m == NULL)
720		return (ENOBUFS);
721	mlen = MHLEN;
722
723	top = 0;
724	mp = &top;
725	while (error == 0 && uio->uio_resid > 0) {
726		m->m_len = min(mlen, uio->uio_resid);
727		error = uiomove(mtod(m, void *), m->m_len, uio);
728		*mp = m;
729		mp = &m->m_next;
730		if (uio->uio_resid > 0) {
731			MGET (m, M_DONTWAIT, MT_DATA);
732			if (m == 0) {
733				error = ENOBUFS;
734				break;
735			}
736			mlen = MLEN;
737		}
738	}
739	if (error) {
740		if (top)
741			m_freem (top);
742		ifp->if_ierrors++;
743		return (error);
744	}
745
746	top->m_pkthdr.len = tlen;
747	top->m_pkthdr.rcvif = ifp;
748#ifdef MAC
749	mac_create_mbuf_from_ifnet(ifp, top);
750#endif
751
752	if (ifp->if_bpf) {
753		if (tp->tun_flags & TUN_IFHEAD) {
754			/*
755			 * Conveniently, we already have a 4-byte address
756			 * family prepended to our packet !
757			 * Inconveniently, it's in the wrong byte order !
758			 */
759			if ((top = m_pullup(top, sizeof(family))) == NULL)
760				return (ENOBUFS);
761			*mtod(top, u_int32_t *) =
762			    ntohl(*mtod(top, u_int32_t *));
763			BPF_MTAP(ifp, top);
764			*mtod(top, u_int32_t *) =
765			    htonl(*mtod(top, u_int32_t *));
766		} else {
767			/*
768			 * We need to prepend the address family as
769			 * a four byte field.  Cons up a dummy header
770			 * to pacify bpf.  This is safe because bpf
771			 * will only read from the mbuf (i.e., it won't
772			 * try to free it or keep a pointer to it).
773			 */
774			struct mbuf m;
775			uint32_t af = AF_INET;
776
777			m.m_next = top;
778			m.m_len = 4;
779			m.m_data = (char *)&af;
780
781			BPF_MTAP(ifp, &m);
782		}
783	}
784
785	if (tp->tun_flags & TUN_IFHEAD) {
786		if (top->m_len < sizeof(family) &&
787		    (top = m_pullup(top, sizeof(family))) == NULL)
788			return (ENOBUFS);
789		family = ntohl(*mtod(top, u_int32_t *));
790		m_adj(top, sizeof(family));
791	} else
792		family = AF_INET;
793
794	switch (family) {
795#ifdef INET
796	case AF_INET:
797		isr = NETISR_IP;
798		break;
799#endif
800#ifdef INET6
801	case AF_INET6:
802		isr = NETISR_IPV6;
803		break;
804#endif
805#ifdef IPX
806	case AF_IPX:
807		isr = NETISR_IPX;
808		break;
809#endif
810#ifdef NETATALK
811	case AF_APPLETALK:
812		isr = NETISR_ATALK2;
813		break;
814#endif
815	default:
816		m_freem(m);
817		return (EAFNOSUPPORT);
818	}
819	/* First chunk of an mbuf contains good junk */
820	if (harvest.point_to_point)
821		random_harvest(m, 16, 3, 0, RANDOM_NET);
822	ifp->if_ibytes += top->m_pkthdr.len;
823	ifp->if_ipackets++;
824	netisr_dispatch(isr, top);
825	return (0);
826}
827
828/*
829 * tunpoll - the poll interface, this is only useful on reads
830 * really. The write detect always returns true, write never blocks
831 * anyway, it either accepts the packet or drops it.
832 */
833static	int
834tunpoll(dev_t dev, int events, struct thread *td)
835{
836	int		s;
837	struct tun_softc *tp = dev->si_drv1;
838	struct ifnet	*ifp = &tp->tun_if;
839	int		revents = 0;
840
841	s = splimp();
842	TUNDEBUG("%s%d: tunpoll\n", ifp->if_name, ifp->if_unit);
843
844	if (events & (POLLIN | POLLRDNORM)) {
845		if (ifp->if_snd.ifq_len > 0) {
846			TUNDEBUG("%s%d: tunpoll q=%d\n", ifp->if_name,
847			    ifp->if_unit, ifp->if_snd.ifq_len);
848			revents |= events & (POLLIN | POLLRDNORM);
849		} else {
850			TUNDEBUG("%s%d: tunpoll waiting\n", ifp->if_name,
851			    ifp->if_unit);
852			selrecord(td, &tp->tun_rsel);
853		}
854	}
855	if (events & (POLLOUT | POLLWRNORM))
856		revents |= events & (POLLOUT | POLLWRNORM);
857
858	splx(s);
859	return (revents);
860}
861