if_tun.c revision 127591 
1/*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2
3/*
4 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5 * Nottingham University 1987.
6 *
7 * This source may be freely distributed, however I would be interested
8 * in any changes that are made.
9 *
10 * This driver takes packets off the IP i/f and hands them up to a
11 * user process to have its wicked way with. This driver has it's
12 * roots in a similar driver written by Phil Cockcroft (formerly) at
13 * UCL. This driver is based much more on read/write/poll mode of
14 * operation though.
15 *
16 * $FreeBSD: head/sys/net/if_tun.c 127591 2004-03-29 22:16:39Z rwatson $
17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23#include "opt_mac.h"
24
25#include <sys/param.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/mac.h>
29#include <sys/mbuf.h>
30#include <sys/module.h>
31#include <sys/socket.h>
32#include <sys/filio.h>
33#include <sys/sockio.h>
34#include <sys/ttycom.h>
35#include <sys/poll.h>
36#include <sys/signalvar.h>
37#include <sys/filedesc.h>
38#include <sys/kernel.h>
39#include <sys/sysctl.h>
40#include <sys/conf.h>
41#include <sys/uio.h>
42#include <sys/vnode.h>
43#include <sys/malloc.h>
44#include <sys/random.h>
45
46#include <net/if.h>
47#include <net/if_types.h>
48#include <net/netisr.h>
49#include <net/route.h>
50#ifdef INET
51#include <netinet/in.h>
52#endif
53#include <net/bpf.h>
54#include <net/if_tun.h>
55
56#include <sys/queue.h>
57
58/*
59 * tun_list is protected by global tunmtx.  Other mutable fields are
60 * protected by tun->tun_mtx, or by their owning subsystem.  tun_dev is
61 * static for the duration of a tunnel interface.
62 */
63struct tun_softc {
64	TAILQ_ENTRY(tun_softc)	tun_list;
65	dev_t			tun_dev;
66	u_short	tun_flags;		/* misc flags */
67#define	TUN_OPEN	0x0001
68#define	TUN_INITED	0x0002
69#define	TUN_RCOLL	0x0004
70#define	TUN_IASET	0x0008
71#define	TUN_DSTADDR	0x0010
72#define	TUN_LMODE	0x0020
73#define	TUN_RWAIT	0x0040
74#define	TUN_ASYNC	0x0080
75#define	TUN_IFHEAD	0x0100
76
77#define TUN_READY       (TUN_OPEN | TUN_INITED)
78
79	/*
80	 * XXXRW: tun_pid is used to exclusively lock /dev/tun.  Is this
81	 * actually needed?  Can we just return EBUSY if already open?
82	 * Problem is that this involved inherent races when a tun device
83	 * is handed off from one process to another, as opposed to just
84	 * being slightly stale informationally.
85	 */
86	pid_t	tun_pid;		/* owning pid */
87	struct	ifnet tun_if;		/* the interface */
88	struct  sigio *tun_sigio;	/* information for async I/O */
89	struct	selinfo	tun_rsel;	/* read select */
90	struct mtx	tun_mtx;	/* protect mutable softc fields */
91};
92
93#define TUNDEBUG	if (tundebug) if_printf
94#define	TUNNAME		"tun"
95
96/*
97 * All mutable global variables in if_tun are locked using tunmtx, with
98 * the exception of tundebug, which is used unlocked, and tunclones,
99 * which is static after setup.
100 */
101static struct mtx tunmtx;
102static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
103static int tundebug = 0;
104static struct clonedevs *tunclones;
105static TAILQ_HEAD(,tun_softc)	tunhead = TAILQ_HEAD_INITIALIZER(tunhead);
106SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
107
108static void	tunclone(void *arg, char *name, int namelen, dev_t *dev);
109static void	tuncreate(dev_t dev);
110static int	tunifioctl(struct ifnet *, u_long, caddr_t);
111static int	tuninit(struct ifnet *);
112static int	tunmodevent(module_t, int, void *);
113static int	tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
114		    struct rtentry *rt);
115static void	tunstart(struct ifnet *);
116
117static d_open_t		tunopen;
118static d_close_t	tunclose;
119static d_read_t		tunread;
120static d_write_t	tunwrite;
121static d_ioctl_t	tunioctl;
122static d_poll_t		tunpoll;
123
124static struct cdevsw tun_cdevsw = {
125	.d_version =	D_VERSION,
126	.d_flags =	D_PSEUDO | D_NEEDGIANT,
127	.d_open =	tunopen,
128	.d_close =	tunclose,
129	.d_read =	tunread,
130	.d_write =	tunwrite,
131	.d_ioctl =	tunioctl,
132	.d_poll =	tunpoll,
133	.d_name =	TUNNAME,
134};
135
136static void
137tunclone(void *arg, char *name, int namelen, dev_t *dev)
138{
139	int u, i;
140
141	if (*dev != NODEV)
142		return;
143
144	if (strcmp(name, TUNNAME) == 0) {
145		u = -1;
146	} else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
147		return;	/* Don't recognise the name */
148	if (u != -1 && u > IF_MAXUNIT)
149		return;	/* Unit number too high */
150
151	/* find any existing device, or allocate new unit number */
152	i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
153	if (i) {
154		/* No preexisting dev_t, create one */
155		*dev = make_dev(&tun_cdevsw, unit2minor(u),
156		    UID_UUCP, GID_DIALER, 0600, "tun%d", u);
157		if (*dev != NULL)
158			(*dev)->si_flags |= SI_CHEAPCLONE;
159	}
160}
161
162static void
163tun_destroy(struct tun_softc *tp)
164{
165	dev_t dev;
166
167	/* Unlocked read. */
168	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
169	    ("tununits is out of sync - unit %d", tp->tun_if.if_dunit));
170
171	dev = tp->tun_dev;
172	bpfdetach(&tp->tun_if);
173	if_detach(&tp->tun_if);
174	destroy_dev(dev);
175	mtx_destroy(&tp->tun_mtx);
176	free(tp, M_TUN);
177}
178
179static int
180tunmodevent(module_t mod, int type, void *data)
181{
182	static eventhandler_tag tag;
183	struct tun_softc *tp;
184
185	switch (type) {
186	case MOD_LOAD:
187		mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
188		clone_setup(&tunclones);
189		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
190		if (tag == NULL)
191			return (ENOMEM);
192		break;
193	case MOD_UNLOAD:
194		EVENTHANDLER_DEREGISTER(dev_clone, tag);
195
196		mtx_lock(&tunmtx);
197		while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
198			TAILQ_REMOVE(&tunhead, tp, tun_list);
199			mtx_unlock(&tunmtx);
200			tun_destroy(tp);
201			mtx_lock(&tunmtx);
202		}
203		mtx_unlock(&tunmtx);
204		clone_cleanup(&tunclones);
205		mtx_destroy(&tunmtx);
206		break;
207	}
208	return 0;
209}
210
211static moduledata_t tun_mod = {
212	"if_tun",
213	tunmodevent,
214	0
215};
216
217DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
218
219static void
220tunstart(struct ifnet *ifp)
221{
222	struct tun_softc *tp = ifp->if_softc;
223
224	mtx_lock(&tp->tun_mtx);
225	if (tp->tun_flags & TUN_RWAIT) {
226		tp->tun_flags &= ~TUN_RWAIT;
227		wakeup(tp);
228	}
229	if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio) {
230		mtx_unlock(&tp->tun_mtx);
231		pgsigio(&tp->tun_sigio, SIGIO, 0);
232	} else
233		mtx_unlock(&tp->tun_mtx);
234	selwakeuppri(&tp->tun_rsel, PZERO + 1);
235}
236
237static void
238tuncreate(dev_t dev)
239{
240	struct tun_softc *sc;
241	struct ifnet *ifp;
242
243	dev->si_flags &= ~SI_CHEAPCLONE;
244
245	MALLOC(sc, struct tun_softc *, sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
246	mtx_init(&sc->tun_mtx, "tun_mtx", NULL, MTX_DEF);
247	sc->tun_flags = TUN_INITED;
248	sc->tun_dev = dev;
249	mtx_lock(&tunmtx);
250	TAILQ_INSERT_TAIL(&tunhead, sc, tun_list);
251	mtx_unlock(&tunmtx);
252
253	ifp = &sc->tun_if;
254	if_initname(ifp, TUNNAME, dev2unit(dev));
255	ifp->if_mtu = TUNMTU;
256	ifp->if_ioctl = tunifioctl;
257	ifp->if_output = tunoutput;
258	ifp->if_start = tunstart;
259	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
260	ifp->if_type = IFT_PPP;
261	ifp->if_snd.ifq_maxlen = ifqmaxlen;
262	ifp->if_softc = sc;
263	if_attach(ifp);
264	bpfattach(ifp, DLT_NULL, sizeof(u_int));
265	dev->si_drv1 = sc;
266}
267
268static int
269tunopen(dev_t dev, int flag, int mode, struct thread *td)
270{
271	struct ifnet	*ifp;
272	struct tun_softc *tp;
273
274	/*
275	 * XXXRW: Non-atomic test and set of dev->si_drv1 requires
276	 * synchronization.
277	 */
278	tp = dev->si_drv1;
279	if (!tp) {
280		tuncreate(dev);
281		tp = dev->si_drv1;
282	}
283
284	/*
285	 * XXXRW: This use of tun_pid is subject to error due to the
286	 * fact that a reference to the tunnel can live beyond the
287	 * death of the process that created it.  Can we replace this
288	 * with a simple busy flag?
289	 */
290	mtx_lock(&tp->tun_mtx);
291	if (tp->tun_pid != 0 && tp->tun_pid != td->td_proc->p_pid) {
292		mtx_unlock(&tp->tun_mtx);
293		return (EBUSY);
294	}
295	tp->tun_pid = td->td_proc->p_pid;
296
297	tp->tun_flags |= TUN_OPEN;
298	mtx_unlock(&tp->tun_mtx);
299	ifp = &tp->tun_if;
300	TUNDEBUG(ifp, "open\n");
301
302	return (0);
303}
304
305/*
306 * tunclose - close the device - mark i/f down & delete
307 * routing info
308 */
309static	int
310tunclose(dev_t dev, int foo, int bar, struct thread *td)
311{
312	struct tun_softc *tp;
313	struct ifnet *ifp;
314	int s;
315
316	tp = dev->si_drv1;
317	ifp = &tp->tun_if;
318
319	mtx_lock(&tp->tun_mtx);
320	tp->tun_flags &= ~TUN_OPEN;
321	tp->tun_pid = 0;
322	mtx_unlock(&tp->tun_mtx);
323
324	/*
325	 * junk all pending output
326	 */
327	IF_DRAIN(&ifp->if_snd);
328
329	if (ifp->if_flags & IFF_UP) {
330		s = splimp();
331		if_down(ifp);
332		splx(s);
333	}
334
335	if (ifp->if_flags & IFF_RUNNING) {
336		struct ifaddr *ifa;
337
338		s = splimp();
339		/* find internet addresses and delete routes */
340		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
341			if (ifa->ifa_addr->sa_family == AF_INET)
342				/* Unlocked read. */
343				rtinit(ifa, (int)RTM_DELETE,
344				    tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
345		ifp->if_flags &= ~IFF_RUNNING;
346		splx(s);
347	}
348
349	funsetown(&tp->tun_sigio);
350	selwakeuppri(&tp->tun_rsel, PZERO + 1);
351	TUNDEBUG (ifp, "closed\n");
352	return (0);
353}
354
355static int
356tuninit(struct ifnet *ifp)
357{
358	struct tun_softc *tp = ifp->if_softc;
359	struct ifaddr *ifa;
360	int error = 0;
361
362	TUNDEBUG(ifp, "tuninit\n");
363
364	ifp->if_flags |= IFF_UP | IFF_RUNNING;
365	getmicrotime(&ifp->if_lastchange);
366
367	for (ifa = TAILQ_FIRST(&ifp->if_addrhead); ifa;
368	     ifa = TAILQ_NEXT(ifa, ifa_link)) {
369		if (ifa->ifa_addr == NULL)
370			error = EFAULT;
371			/* XXX: Should maybe return straight off? */
372		else {
373#ifdef INET
374			if (ifa->ifa_addr->sa_family == AF_INET) {
375			    struct sockaddr_in *si;
376
377			    si = (struct sockaddr_in *)ifa->ifa_addr;
378			    mtx_lock(&tp->tun_mtx);
379			    if (si->sin_addr.s_addr)
380				    tp->tun_flags |= TUN_IASET;
381
382			    si = (struct sockaddr_in *)ifa->ifa_dstaddr;
383			    if (si && si->sin_addr.s_addr)
384				    tp->tun_flags |= TUN_DSTADDR;
385			    mtx_unlock(&tp->tun_mtx);
386			}
387#endif
388		}
389	}
390	return (error);
391}
392
393/*
394 * Process an ioctl request.
395 */
396static int
397tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
398{
399	struct ifreq *ifr = (struct ifreq *)data;
400	struct tun_softc *tp = ifp->if_softc;
401	struct ifstat *ifs;
402	int		error = 0, s;
403
404	s = splimp();
405	switch(cmd) {
406	case SIOCGIFSTATUS:
407		ifs = (struct ifstat *)data;
408		mtx_lock(&tp->tun_mtx);
409		if (tp->tun_pid)
410			sprintf(ifs->ascii + strlen(ifs->ascii),
411			    "\tOpened by PID %d\n", tp->tun_pid);
412		mtx_unlock(&tp->tun_mtx);
413		break;
414	case SIOCSIFADDR:
415		error = tuninit(ifp);
416		TUNDEBUG(ifp, "address set, error=%d\n", error);
417		break;
418	case SIOCSIFDSTADDR:
419		error = tuninit(ifp);
420		TUNDEBUG(ifp, "destination address set, error=%d\n", error);
421		break;
422	case SIOCSIFMTU:
423		ifp->if_mtu = ifr->ifr_mtu;
424		TUNDEBUG(ifp, "mtu set\n");
425		break;
426	case SIOCSIFFLAGS:
427	case SIOCADDMULTI:
428	case SIOCDELMULTI:
429		break;
430	default:
431		error = EINVAL;
432	}
433	splx(s);
434	return (error);
435}
436
437/*
438 * tunoutput - queue packets from higher level ready to put out.
439 */
440static int
441tunoutput(
442	struct ifnet *ifp,
443	struct mbuf *m0,
444	struct sockaddr *dst,
445	struct rtentry *rt)
446{
447	struct tun_softc *tp = ifp->if_softc;
448	u_short cached_tun_flags;
449#ifdef MAC
450	int error;
451#endif
452
453	TUNDEBUG (ifp, "tunoutput\n");
454
455#ifdef MAC
456	error = mac_check_ifnet_transmit(ifp, m0);
457	if (error) {
458		m_freem(m0);
459		return (error);
460	}
461#endif
462
463	/* Could be unlocked read? */
464	mtx_lock(&tp->tun_mtx);
465	cached_tun_flags = tp->tun_flags;
466	mtx_unlock(&tp->tun_mtx);
467	if ((cached_tun_flags & TUN_READY) != TUN_READY) {
468		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
469		m_freem (m0);
470		return (EHOSTDOWN);
471	}
472
473	if ((ifp->if_flags & IFF_UP) != IFF_UP) {
474		m_freem (m0);
475		return (EHOSTDOWN);
476	}
477
478	/* BPF write needs to be handled specially */
479	if (dst->sa_family == AF_UNSPEC) {
480		dst->sa_family = *(mtod(m0, int *));
481		m0->m_len -= sizeof(int);
482		m0->m_pkthdr.len -= sizeof(int);
483		m0->m_data += sizeof(int);
484	}
485
486	if (ifp->if_bpf) {
487		uint32_t af = dst->sa_family;
488		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
489	}
490
491	/* prepend sockaddr? this may abort if the mbuf allocation fails */
492	if (cached_tun_flags & TUN_LMODE) {
493		/* allocate space for sockaddr */
494		M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
495
496		/* if allocation failed drop packet */
497		if (m0 == NULL) {
498			ifp->if_iqdrops++;
499			ifp->if_oerrors++;
500			return (ENOBUFS);
501		} else {
502			bcopy(dst, m0->m_data, dst->sa_len);
503		}
504	}
505
506	if (cached_tun_flags & TUN_IFHEAD) {
507		/* Prepend the address family */
508		M_PREPEND(m0, 4, M_DONTWAIT);
509
510		/* if allocation failed drop packet */
511		if (m0 == NULL) {
512			ifp->if_iqdrops++;
513			ifp->if_oerrors++;
514			return (ENOBUFS);
515		} else
516			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
517	} else {
518#ifdef INET
519		if (dst->sa_family != AF_INET)
520#endif
521		{
522			m_freem(m0);
523			return (EAFNOSUPPORT);
524		}
525	}
526
527	if (! IF_HANDOFF(&ifp->if_snd, m0, ifp)) {
528		ifp->if_collisions++;
529		return (ENOBUFS);
530	}
531	ifp->if_opackets++;
532	return (0);
533}
534
535/*
536 * the cdevsw interface is now pretty minimal.
537 */
538static	int
539tunioctl(dev_t dev, u_long cmd, caddr_t data, int flag, struct thread *td)
540{
541	int		s;
542	int		error;
543	struct tun_softc *tp = dev->si_drv1;
544	struct tuninfo *tunp;
545
546	switch (cmd) {
547	case TUNSIFINFO:
548		tunp = (struct tuninfo *)data;
549		if (tunp->mtu < IF_MINMTU)
550			return (EINVAL);
551		if (tp->tun_if.if_mtu != tunp->mtu
552		&& (error = suser(td)) != 0)
553			return (error);
554		tp->tun_if.if_mtu = tunp->mtu;
555		tp->tun_if.if_type = tunp->type;
556		tp->tun_if.if_baudrate = tunp->baudrate;
557		break;
558	case TUNGIFINFO:
559		tunp = (struct tuninfo *)data;
560		tunp->mtu = tp->tun_if.if_mtu;
561		tunp->type = tp->tun_if.if_type;
562		tunp->baudrate = tp->tun_if.if_baudrate;
563		break;
564	case TUNSDEBUG:
565		tundebug = *(int *)data;
566		break;
567	case TUNGDEBUG:
568		*(int *)data = tundebug;
569		break;
570	case TUNSLMODE:
571		mtx_lock(&tp->tun_mtx);
572		if (*(int *)data) {
573			tp->tun_flags |= TUN_LMODE;
574			tp->tun_flags &= ~TUN_IFHEAD;
575		} else
576			tp->tun_flags &= ~TUN_LMODE;
577		mtx_unlock(&tp->tun_mtx);
578		break;
579	case TUNSIFHEAD:
580		mtx_lock(&tp->tun_mtx);
581		if (*(int *)data) {
582			tp->tun_flags |= TUN_IFHEAD;
583			tp->tun_flags &= ~TUN_LMODE;
584		} else
585			tp->tun_flags &= ~TUN_IFHEAD;
586		mtx_unlock(&tp->tun_mtx);
587		break;
588	case TUNGIFHEAD:
589		/* Could be unlocked read? */
590		mtx_lock(&tp->tun_mtx);
591		*(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
592		mtx_unlock(&tp->tun_mtx);
593		break;
594	case TUNSIFMODE:
595		/* deny this if UP */
596		if (tp->tun_if.if_flags & IFF_UP)
597			return(EBUSY);
598
599		switch (*(int *)data & ~IFF_MULTICAST) {
600		case IFF_POINTOPOINT:
601		case IFF_BROADCAST:
602			tp->tun_if.if_flags &=
603			    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
604			tp->tun_if.if_flags |= *(int *)data;
605			break;
606		default:
607			return(EINVAL);
608		}
609		break;
610	case TUNSIFPID:
611		mtx_lock(&tp->tun_mtx);
612		tp->tun_pid = curthread->td_proc->p_pid;
613		mtx_unlock(&tp->tun_mtx);
614		break;
615	case FIONBIO:
616		break;
617	case FIOASYNC:
618		mtx_lock(&tp->tun_mtx);
619		if (*(int *)data)
620			tp->tun_flags |= TUN_ASYNC;
621		else
622			tp->tun_flags &= ~TUN_ASYNC;
623		mtx_unlock(&tp->tun_mtx);
624		break;
625	case FIONREAD:
626		s = splimp();
627		if (tp->tun_if.if_snd.ifq_head) {
628			struct mbuf *mb = tp->tun_if.if_snd.ifq_head;
629			for( *(int *)data = 0; mb != 0; mb = mb->m_next)
630				*(int *)data += mb->m_len;
631		} else
632			*(int *)data = 0;
633		splx(s);
634		break;
635	case FIOSETOWN:
636		return (fsetown(*(int *)data, &tp->tun_sigio));
637
638	case FIOGETOWN:
639		*(int *)data = fgetown(&tp->tun_sigio);
640		return (0);
641
642	/* This is deprecated, FIOSETOWN should be used instead. */
643	case TIOCSPGRP:
644		return (fsetown(-(*(int *)data), &tp->tun_sigio));
645
646	/* This is deprecated, FIOGETOWN should be used instead. */
647	case TIOCGPGRP:
648		*(int *)data = -fgetown(&tp->tun_sigio);
649		return (0);
650
651	default:
652		return (ENOTTY);
653	}
654	return (0);
655}
656
657/*
658 * The cdevsw read interface - reads a packet at a time, or at
659 * least as much of a packet as can be read.
660 */
661static	int
662tunread(dev_t dev, struct uio *uio, int flag)
663{
664	struct tun_softc *tp = dev->si_drv1;
665	struct ifnet	*ifp = &tp->tun_if;
666	struct mbuf	*m;
667	int		error=0, len, s;
668
669	TUNDEBUG (ifp, "read\n");
670	mtx_lock(&tp->tun_mtx);
671	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
672		mtx_unlock(&tp->tun_mtx);
673		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
674		return (EHOSTDOWN);
675	}
676
677	tp->tun_flags &= ~TUN_RWAIT;
678	mtx_unlock(&tp->tun_mtx);
679
680	s = splimp();
681	do {
682		IF_DEQUEUE(&ifp->if_snd, m);
683		if (m == NULL) {
684			if (flag & IO_NDELAY) {
685				splx(s);
686				return (EWOULDBLOCK);
687			}
688			mtx_lock(&tp->tun_mtx);
689			tp->tun_flags |= TUN_RWAIT;
690			mtx_unlock(&tp->tun_mtx);
691			if((error = tsleep(tp, PCATCH | (PZERO + 1),
692					"tunread", 0)) != 0) {
693				splx(s);
694				return (error);
695			}
696		}
697	} while (m == NULL);
698	splx(s);
699
700	while (m && uio->uio_resid > 0 && error == 0) {
701		len = min(uio->uio_resid, m->m_len);
702		if (len != 0)
703			error = uiomove(mtod(m, void *), len, uio);
704		m = m_free(m);
705	}
706
707	if (m) {
708		TUNDEBUG(ifp, "Dropping mbuf\n");
709		m_freem(m);
710	}
711	return (error);
712}
713
714/*
715 * the cdevsw write interface - an atomic write is a packet - or else!
716 */
717static	int
718tunwrite(dev_t dev, struct uio *uio, int flag)
719{
720	struct tun_softc *tp = dev->si_drv1;
721	struct ifnet	*ifp = &tp->tun_if;
722	struct mbuf	*top, **mp, *m;
723	int		error=0, tlen, mlen;
724	uint32_t	family;
725	int 		isr;
726
727	TUNDEBUG(ifp, "tunwrite\n");
728
729	if ((ifp->if_flags & IFF_UP) != IFF_UP)
730		/* ignore silently */
731		return (0);
732
733	if (uio->uio_resid == 0)
734		return (0);
735
736	if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
737		TUNDEBUG(ifp, "len=%d!\n", uio->uio_resid);
738		return (EIO);
739	}
740	tlen = uio->uio_resid;
741
742	/* get a header mbuf */
743	MGETHDR(m, M_DONTWAIT, MT_DATA);
744	if (m == NULL)
745		return (ENOBUFS);
746	mlen = MHLEN;
747
748	top = 0;
749	mp = &top;
750	while (error == 0 && uio->uio_resid > 0) {
751		m->m_len = min(mlen, uio->uio_resid);
752		error = uiomove(mtod(m, void *), m->m_len, uio);
753		*mp = m;
754		mp = &m->m_next;
755		if (uio->uio_resid > 0) {
756			MGET (m, M_DONTWAIT, MT_DATA);
757			if (m == 0) {
758				error = ENOBUFS;
759				break;
760			}
761			mlen = MLEN;
762		}
763	}
764	if (error) {
765		if (top)
766			m_freem (top);
767		ifp->if_ierrors++;
768		return (error);
769	}
770
771	top->m_pkthdr.len = tlen;
772	top->m_pkthdr.rcvif = ifp;
773#ifdef MAC
774	mac_create_mbuf_from_ifnet(ifp, top);
775#endif
776
777	/* Could be unlocked read? */
778	mtx_lock(&tp->tun_mtx);
779	if (tp->tun_flags & TUN_IFHEAD) {
780		mtx_unlock(&tp->tun_mtx);
781		if (top->m_len < sizeof(family) &&
782		    (top = m_pullup(top, sizeof(family))) == NULL)
783			return (ENOBUFS);
784		family = ntohl(*mtod(top, u_int32_t *));
785		m_adj(top, sizeof(family));
786	} else {
787		mtx_unlock(&tp->tun_mtx);
788		family = AF_INET;
789	}
790
791	BPF_MTAP2(ifp, &family, sizeof(family), top);
792
793	switch (family) {
794#ifdef INET
795	case AF_INET:
796		isr = NETISR_IP;
797		break;
798#endif
799#ifdef INET6
800	case AF_INET6:
801		isr = NETISR_IPV6;
802		break;
803#endif
804#ifdef IPX
805	case AF_IPX:
806		isr = NETISR_IPX;
807		break;
808#endif
809#ifdef NETATALK
810	case AF_APPLETALK:
811		isr = NETISR_ATALK2;
812		break;
813#endif
814	default:
815		m_freem(m);
816		return (EAFNOSUPPORT);
817	}
818	/* First chunk of an mbuf contains good junk */
819	if (harvest.point_to_point)
820		random_harvest(m, 16, 3, 0, RANDOM_NET);
821	ifp->if_ibytes += top->m_pkthdr.len;
822	ifp->if_ipackets++;
823	netisr_dispatch(isr, top);
824	return (0);
825}
826
827/*
828 * tunpoll - the poll interface, this is only useful on reads
829 * really. The write detect always returns true, write never blocks
830 * anyway, it either accepts the packet or drops it.
831 */
832static	int
833tunpoll(dev_t dev, int events, struct thread *td)
834{
835	int		s;
836	struct tun_softc *tp = dev->si_drv1;
837	struct ifnet	*ifp = &tp->tun_if;
838	int		revents = 0;
839
840	s = splimp();
841	TUNDEBUG(ifp, "tunpoll\n");
842
843	if (events & (POLLIN | POLLRDNORM)) {
844		if (ifp->if_snd.ifq_len > 0) {
845			TUNDEBUG(ifp, "tunpoll q=%d\n", ifp->if_snd.ifq_len);
846			revents |= events & (POLLIN | POLLRDNORM);
847		} else {
848			TUNDEBUG(ifp, "tunpoll waiting\n");
849			selrecord(td, &tp->tun_rsel);
850		}
851	}
852	if (events & (POLLOUT | POLLWRNORM))
853		revents |= events & (POLLOUT | POLLWRNORM);
854
855	splx(s);
856	return (revents);
857}
858