if_tun.c revision 139208 
1/*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2
3/*
4 * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5 * Nottingham University 1987.
6 *
7 * This source may be freely distributed, however I would be interested
8 * in any changes that are made.
9 *
10 * This driver takes packets off the IP i/f and hands them up to a
11 * user process to have its wicked way with. This driver has it's
12 * roots in a similar driver written by Phil Cockcroft (formerly) at
13 * UCL. This driver is based much more on read/write/poll mode of
14 * operation though.
15 *
16 * $FreeBSD: head/sys/net/if_tun.c 139208 2004-12-22 17:39:21Z phk $
17 */
18
19#include "opt_atalk.h"
20#include "opt_inet.h"
21#include "opt_inet6.h"
22#include "opt_ipx.h"
23#include "opt_mac.h"
24
25#include <sys/param.h>
26#include <sys/proc.h>
27#include <sys/systm.h>
28#include <sys/mac.h>
29#include <sys/mbuf.h>
30#include <sys/module.h>
31#include <sys/socket.h>
32#include <sys/fcntl.h>
33#include <sys/filio.h>
34#include <sys/sockio.h>
35#include <sys/ttycom.h>
36#include <sys/poll.h>
37#include <sys/selinfo.h>
38#include <sys/signalvar.h>
39#include <sys/filedesc.h>
40#include <sys/kernel.h>
41#include <sys/sysctl.h>
42#include <sys/conf.h>
43#include <sys/uio.h>
44#include <sys/malloc.h>
45#include <sys/random.h>
46
47#include <net/if.h>
48#include <net/if_types.h>
49#include <net/netisr.h>
50#include <net/route.h>
51#ifdef INET
52#include <netinet/in.h>
53#endif
54#include <net/bpf.h>
55#include <net/if_tun.h>
56
57#include <sys/queue.h>
58
59/*
60 * tun_list is protected by global tunmtx.  Other mutable fields are
61 * protected by tun->tun_mtx, or by their owning subsystem.  tun_dev is
62 * static for the duration of a tunnel interface.
63 */
64struct tun_softc {
65	TAILQ_ENTRY(tun_softc)	tun_list;
66	struct cdev *tun_dev;
67	u_short	tun_flags;		/* misc flags */
68#define	TUN_OPEN	0x0001
69#define	TUN_INITED	0x0002
70#define	TUN_RCOLL	0x0004
71#define	TUN_IASET	0x0008
72#define	TUN_DSTADDR	0x0010
73#define	TUN_LMODE	0x0020
74#define	TUN_RWAIT	0x0040
75#define	TUN_ASYNC	0x0080
76#define	TUN_IFHEAD	0x0100
77
78#define TUN_READY       (TUN_OPEN | TUN_INITED)
79
80	/*
81	 * XXXRW: tun_pid is used to exclusively lock /dev/tun.  Is this
82	 * actually needed?  Can we just return EBUSY if already open?
83	 * Problem is that this involved inherent races when a tun device
84	 * is handed off from one process to another, as opposed to just
85	 * being slightly stale informationally.
86	 */
87	pid_t	tun_pid;		/* owning pid */
88	struct	ifnet tun_if;		/* the interface */
89	struct  sigio *tun_sigio;	/* information for async I/O */
90	struct	selinfo	tun_rsel;	/* read select */
91	struct mtx	tun_mtx;	/* protect mutable softc fields */
92};
93
94#define TUNDEBUG	if (tundebug) if_printf
95#define	TUNNAME		"tun"
96
97/*
98 * All mutable global variables in if_tun are locked using tunmtx, with
99 * the exception of tundebug, which is used unlocked, and tunclones,
100 * which is static after setup.
101 */
102static struct mtx tunmtx;
103static MALLOC_DEFINE(M_TUN, TUNNAME, "Tunnel Interface");
104static int tundebug = 0;
105static struct clonedevs *tunclones;
106static TAILQ_HEAD(,tun_softc)	tunhead = TAILQ_HEAD_INITIALIZER(tunhead);
107SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0, "");
108
109static void	tunclone(void *arg, char *name, int namelen, struct cdev **dev);
110static void	tuncreate(struct cdev *dev);
111static int	tunifioctl(struct ifnet *, u_long, caddr_t);
112static int	tuninit(struct ifnet *);
113static int	tunmodevent(module_t, int, void *);
114static int	tunoutput(struct ifnet *, struct mbuf *, struct sockaddr *,
115		    struct rtentry *rt);
116static void	tunstart(struct ifnet *);
117
118static d_open_t		tunopen;
119static d_close_t	tunclose;
120static d_read_t		tunread;
121static d_write_t	tunwrite;
122static d_ioctl_t	tunioctl;
123static d_poll_t		tunpoll;
124
125static struct cdevsw tun_cdevsw = {
126	.d_version =	D_VERSION,
127	.d_flags =	D_PSEUDO | D_NEEDGIANT,
128	.d_open =	tunopen,
129	.d_close =	tunclose,
130	.d_read =	tunread,
131	.d_write =	tunwrite,
132	.d_ioctl =	tunioctl,
133	.d_poll =	tunpoll,
134	.d_name =	TUNNAME,
135};
136
137static void
138tunclone(void *arg, char *name, int namelen, struct cdev **dev)
139{
140	int u, i;
141
142	if (*dev != NULL)
143		return;
144
145	if (strcmp(name, TUNNAME) == 0) {
146		u = -1;
147	} else if (dev_stdclone(name, NULL, TUNNAME, &u) != 1)
148		return;	/* Don't recognise the name */
149	if (u != -1 && u > IF_MAXUNIT)
150		return;	/* Unit number too high */
151
152	/* find any existing device, or allocate new unit number */
153	i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
154	if (i) {
155		/* No preexisting struct cdev *, create one */
156		*dev = make_dev(&tun_cdevsw, unit2minor(u),
157		    UID_UUCP, GID_DIALER, 0600, "tun%d", u);
158		if (*dev != NULL)
159			(*dev)->si_flags |= SI_CHEAPCLONE;
160	}
161}
162
163static void
164tun_destroy(struct tun_softc *tp)
165{
166	struct cdev *dev;
167
168	/* Unlocked read. */
169	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
170	    ("tununits is out of sync - unit %d", tp->tun_if.if_dunit));
171
172	dev = tp->tun_dev;
173	bpfdetach(&tp->tun_if);
174	if_detach(&tp->tun_if);
175	destroy_dev(dev);
176	mtx_destroy(&tp->tun_mtx);
177	free(tp, M_TUN);
178}
179
180static int
181tunmodevent(module_t mod, int type, void *data)
182{
183	static eventhandler_tag tag;
184	struct tun_softc *tp;
185
186	switch (type) {
187	case MOD_LOAD:
188		mtx_init(&tunmtx, "tunmtx", NULL, MTX_DEF);
189		clone_setup(&tunclones);
190		tag = EVENTHANDLER_REGISTER(dev_clone, tunclone, 0, 1000);
191		if (tag == NULL)
192			return (ENOMEM);
193		break;
194	case MOD_UNLOAD:
195		EVENTHANDLER_DEREGISTER(dev_clone, tag);
196
197		mtx_lock(&tunmtx);
198		while ((tp = TAILQ_FIRST(&tunhead)) != NULL) {
199			TAILQ_REMOVE(&tunhead, tp, tun_list);
200			mtx_unlock(&tunmtx);
201			tun_destroy(tp);
202			mtx_lock(&tunmtx);
203		}
204		mtx_unlock(&tunmtx);
205		clone_cleanup(&tunclones);
206		mtx_destroy(&tunmtx);
207		break;
208	default:
209		return EOPNOTSUPP;
210	}
211	return 0;
212}
213
214static moduledata_t tun_mod = {
215	"if_tun",
216	tunmodevent,
217	0
218};
219
220DECLARE_MODULE(if_tun, tun_mod, SI_SUB_PSEUDO, SI_ORDER_ANY);
221
222static void
223tunstart(struct ifnet *ifp)
224{
225	struct tun_softc *tp = ifp->if_softc;
226	struct mbuf *m;
227
228	if (ALTQ_IS_ENABLED(&ifp->if_snd)) {
229		IFQ_LOCK(&ifp->if_snd);
230		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
231		if (m == NULL) {
232			IFQ_UNLOCK(&ifp->if_snd);
233			return;
234		}
235		IFQ_UNLOCK(&ifp->if_snd);
236	}
237
238	mtx_lock(&tp->tun_mtx);
239	if (tp->tun_flags & TUN_RWAIT) {
240		tp->tun_flags &= ~TUN_RWAIT;
241		wakeup(tp);
242	}
243	if (tp->tun_flags & TUN_ASYNC && tp->tun_sigio) {
244		mtx_unlock(&tp->tun_mtx);
245		pgsigio(&tp->tun_sigio, SIGIO, 0);
246	} else
247		mtx_unlock(&tp->tun_mtx);
248	selwakeuppri(&tp->tun_rsel, PZERO + 1);
249}
250
251static void
252tuncreate(struct cdev *dev)
253{
254	struct tun_softc *sc;
255	struct ifnet *ifp;
256
257	dev->si_flags &= ~SI_CHEAPCLONE;
258
259	MALLOC(sc, struct tun_softc *, sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
260	mtx_init(&sc->tun_mtx, "tun_mtx", NULL, MTX_DEF);
261	sc->tun_flags = TUN_INITED;
262	sc->tun_dev = dev;
263	mtx_lock(&tunmtx);
264	TAILQ_INSERT_TAIL(&tunhead, sc, tun_list);
265	mtx_unlock(&tunmtx);
266
267	ifp = &sc->tun_if;
268	if_initname(ifp, TUNNAME, dev2unit(dev));
269	ifp->if_mtu = TUNMTU;
270	ifp->if_ioctl = tunifioctl;
271	ifp->if_output = tunoutput;
272	ifp->if_start = tunstart;
273	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
274	ifp->if_type = IFT_PPP;
275	ifp->if_softc = sc;
276	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
277	ifp->if_snd.ifq_drv_maxlen = 0;
278	IFQ_SET_READY(&ifp->if_snd);
279
280	if_attach(ifp);
281	bpfattach(ifp, DLT_NULL, sizeof(u_int));
282	dev->si_drv1 = sc;
283}
284
285static int
286tunopen(struct cdev *dev, int flag, int mode, struct thread *td)
287{
288	struct ifnet	*ifp;
289	struct tun_softc *tp;
290
291	/*
292	 * XXXRW: Non-atomic test and set of dev->si_drv1 requires
293	 * synchronization.
294	 */
295	tp = dev->si_drv1;
296	if (!tp) {
297		tuncreate(dev);
298		tp = dev->si_drv1;
299	}
300
301	/*
302	 * XXXRW: This use of tun_pid is subject to error due to the
303	 * fact that a reference to the tunnel can live beyond the
304	 * death of the process that created it.  Can we replace this
305	 * with a simple busy flag?
306	 */
307	mtx_lock(&tp->tun_mtx);
308	if (tp->tun_pid != 0 && tp->tun_pid != td->td_proc->p_pid) {
309		mtx_unlock(&tp->tun_mtx);
310		return (EBUSY);
311	}
312	tp->tun_pid = td->td_proc->p_pid;
313
314	tp->tun_flags |= TUN_OPEN;
315	mtx_unlock(&tp->tun_mtx);
316	ifp = &tp->tun_if;
317	TUNDEBUG(ifp, "open\n");
318
319	return (0);
320}
321
322/*
323 * tunclose - close the device - mark i/f down & delete
324 * routing info
325 */
326static	int
327tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
328{
329	struct tun_softc *tp;
330	struct ifnet *ifp;
331	int s;
332
333	tp = dev->si_drv1;
334	ifp = &tp->tun_if;
335
336	mtx_lock(&tp->tun_mtx);
337	tp->tun_flags &= ~TUN_OPEN;
338	tp->tun_pid = 0;
339
340	/*
341	 * junk all pending output
342	 */
343	s = splimp();
344	IFQ_PURGE(&ifp->if_snd);
345	splx(s);
346	mtx_unlock(&tp->tun_mtx);
347
348	if (ifp->if_flags & IFF_UP) {
349		s = splimp();
350		if_down(ifp);
351		splx(s);
352	}
353
354	if (ifp->if_flags & IFF_RUNNING) {
355		struct ifaddr *ifa;
356
357		s = splimp();
358		/* find internet addresses and delete routes */
359		TAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link)
360			if (ifa->ifa_addr->sa_family == AF_INET)
361				/* Unlocked read. */
362				rtinit(ifa, (int)RTM_DELETE,
363				    tp->tun_flags & TUN_DSTADDR ? RTF_HOST : 0);
364		ifp->if_flags &= ~IFF_RUNNING;
365		splx(s);
366	}
367
368	funsetown(&tp->tun_sigio);
369	selwakeuppri(&tp->tun_rsel, PZERO + 1);
370	TUNDEBUG (ifp, "closed\n");
371	return (0);
372}
373
374static int
375tuninit(struct ifnet *ifp)
376{
377	struct tun_softc *tp = ifp->if_softc;
378	struct ifaddr *ifa;
379	int error = 0;
380
381	TUNDEBUG(ifp, "tuninit\n");
382
383	ifp->if_flags |= IFF_UP | IFF_RUNNING;
384	getmicrotime(&ifp->if_lastchange);
385
386	for (ifa = TAILQ_FIRST(&ifp->if_addrhead); ifa;
387	     ifa = TAILQ_NEXT(ifa, ifa_link)) {
388		if (ifa->ifa_addr == NULL)
389			error = EFAULT;
390			/* XXX: Should maybe return straight off? */
391		else {
392#ifdef INET
393			if (ifa->ifa_addr->sa_family == AF_INET) {
394			    struct sockaddr_in *si;
395
396			    si = (struct sockaddr_in *)ifa->ifa_addr;
397			    mtx_lock(&tp->tun_mtx);
398			    if (si->sin_addr.s_addr)
399				    tp->tun_flags |= TUN_IASET;
400
401			    si = (struct sockaddr_in *)ifa->ifa_dstaddr;
402			    if (si && si->sin_addr.s_addr)
403				    tp->tun_flags |= TUN_DSTADDR;
404			    mtx_unlock(&tp->tun_mtx);
405			}
406#endif
407		}
408	}
409	return (error);
410}
411
412/*
413 * Process an ioctl request.
414 */
415static int
416tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
417{
418	struct ifreq *ifr = (struct ifreq *)data;
419	struct tun_softc *tp = ifp->if_softc;
420	struct ifstat *ifs;
421	int		error = 0, s;
422
423	s = splimp();
424	switch(cmd) {
425	case SIOCGIFSTATUS:
426		ifs = (struct ifstat *)data;
427		mtx_lock(&tp->tun_mtx);
428		if (tp->tun_pid)
429			sprintf(ifs->ascii + strlen(ifs->ascii),
430			    "\tOpened by PID %d\n", tp->tun_pid);
431		mtx_unlock(&tp->tun_mtx);
432		break;
433	case SIOCSIFADDR:
434		error = tuninit(ifp);
435		TUNDEBUG(ifp, "address set, error=%d\n", error);
436		break;
437	case SIOCSIFDSTADDR:
438		error = tuninit(ifp);
439		TUNDEBUG(ifp, "destination address set, error=%d\n", error);
440		break;
441	case SIOCSIFMTU:
442		ifp->if_mtu = ifr->ifr_mtu;
443		TUNDEBUG(ifp, "mtu set\n");
444		break;
445	case SIOCSIFFLAGS:
446	case SIOCADDMULTI:
447	case SIOCDELMULTI:
448		break;
449	default:
450		error = EINVAL;
451	}
452	splx(s);
453	return (error);
454}
455
456/*
457 * tunoutput - queue packets from higher level ready to put out.
458 */
459static int
460tunoutput(
461	struct ifnet *ifp,
462	struct mbuf *m0,
463	struct sockaddr *dst,
464	struct rtentry *rt)
465{
466	struct tun_softc *tp = ifp->if_softc;
467	u_short cached_tun_flags;
468	int error;
469
470	TUNDEBUG (ifp, "tunoutput\n");
471
472#ifdef MAC
473	error = mac_check_ifnet_transmit(ifp, m0);
474	if (error) {
475		m_freem(m0);
476		return (error);
477	}
478#endif
479
480	/* Could be unlocked read? */
481	mtx_lock(&tp->tun_mtx);
482	cached_tun_flags = tp->tun_flags;
483	mtx_unlock(&tp->tun_mtx);
484	if ((cached_tun_flags & TUN_READY) != TUN_READY) {
485		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
486		m_freem (m0);
487		return (EHOSTDOWN);
488	}
489
490	if ((ifp->if_flags & IFF_UP) != IFF_UP) {
491		m_freem (m0);
492		return (EHOSTDOWN);
493	}
494
495	/* BPF write needs to be handled specially */
496	if (dst->sa_family == AF_UNSPEC) {
497		dst->sa_family = *(mtod(m0, int *));
498		m0->m_len -= sizeof(int);
499		m0->m_pkthdr.len -= sizeof(int);
500		m0->m_data += sizeof(int);
501	}
502
503	if (ifp->if_bpf) {
504		uint32_t af = dst->sa_family;
505		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
506	}
507
508	/* prepend sockaddr? this may abort if the mbuf allocation fails */
509	if (cached_tun_flags & TUN_LMODE) {
510		/* allocate space for sockaddr */
511		M_PREPEND(m0, dst->sa_len, M_DONTWAIT);
512
513		/* if allocation failed drop packet */
514		if (m0 == NULL) {
515			ifp->if_iqdrops++;
516			ifp->if_oerrors++;
517			return (ENOBUFS);
518		} else {
519			bcopy(dst, m0->m_data, dst->sa_len);
520		}
521	}
522
523	if (cached_tun_flags & TUN_IFHEAD) {
524		/* Prepend the address family */
525		M_PREPEND(m0, 4, M_DONTWAIT);
526
527		/* if allocation failed drop packet */
528		if (m0 == NULL) {
529			ifp->if_iqdrops++;
530			ifp->if_oerrors++;
531			return (ENOBUFS);
532		} else
533			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
534	} else {
535#ifdef INET
536		if (dst->sa_family != AF_INET)
537#endif
538		{
539			m_freem(m0);
540			return (EAFNOSUPPORT);
541		}
542	}
543
544	IFQ_HANDOFF(ifp, m0, error);
545	if (error) {
546		ifp->if_collisions++;
547		return (ENOBUFS);
548	}
549	ifp->if_opackets++;
550	return (0);
551}
552
553/*
554 * the cdevsw interface is now pretty minimal.
555 */
556static	int
557tunioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td)
558{
559	int		s;
560	int		error;
561	struct tun_softc *tp = dev->si_drv1;
562	struct tuninfo *tunp;
563
564	switch (cmd) {
565	case TUNSIFINFO:
566		tunp = (struct tuninfo *)data;
567		if (tunp->mtu < IF_MINMTU)
568			return (EINVAL);
569		if (tp->tun_if.if_mtu != tunp->mtu
570		&& (error = suser(td)) != 0)
571			return (error);
572		tp->tun_if.if_mtu = tunp->mtu;
573		tp->tun_if.if_type = tunp->type;
574		tp->tun_if.if_baudrate = tunp->baudrate;
575		break;
576	case TUNGIFINFO:
577		tunp = (struct tuninfo *)data;
578		tunp->mtu = tp->tun_if.if_mtu;
579		tunp->type = tp->tun_if.if_type;
580		tunp->baudrate = tp->tun_if.if_baudrate;
581		break;
582	case TUNSDEBUG:
583		tundebug = *(int *)data;
584		break;
585	case TUNGDEBUG:
586		*(int *)data = tundebug;
587		break;
588	case TUNSLMODE:
589		mtx_lock(&tp->tun_mtx);
590		if (*(int *)data) {
591			tp->tun_flags |= TUN_LMODE;
592			tp->tun_flags &= ~TUN_IFHEAD;
593		} else
594			tp->tun_flags &= ~TUN_LMODE;
595		mtx_unlock(&tp->tun_mtx);
596		break;
597	case TUNSIFHEAD:
598		mtx_lock(&tp->tun_mtx);
599		if (*(int *)data) {
600			tp->tun_flags |= TUN_IFHEAD;
601			tp->tun_flags &= ~TUN_LMODE;
602		} else
603			tp->tun_flags &= ~TUN_IFHEAD;
604		mtx_unlock(&tp->tun_mtx);
605		break;
606	case TUNGIFHEAD:
607		/* Could be unlocked read? */
608		mtx_lock(&tp->tun_mtx);
609		*(int *)data = (tp->tun_flags & TUN_IFHEAD) ? 1 : 0;
610		mtx_unlock(&tp->tun_mtx);
611		break;
612	case TUNSIFMODE:
613		/* deny this if UP */
614		if (tp->tun_if.if_flags & IFF_UP)
615			return(EBUSY);
616
617		switch (*(int *)data & ~IFF_MULTICAST) {
618		case IFF_POINTOPOINT:
619		case IFF_BROADCAST:
620			tp->tun_if.if_flags &=
621			    ~(IFF_BROADCAST|IFF_POINTOPOINT|IFF_MULTICAST);
622			tp->tun_if.if_flags |= *(int *)data;
623			break;
624		default:
625			return(EINVAL);
626		}
627		break;
628	case TUNSIFPID:
629		mtx_lock(&tp->tun_mtx);
630		tp->tun_pid = curthread->td_proc->p_pid;
631		mtx_unlock(&tp->tun_mtx);
632		break;
633	case FIONBIO:
634		break;
635	case FIOASYNC:
636		mtx_lock(&tp->tun_mtx);
637		if (*(int *)data)
638			tp->tun_flags |= TUN_ASYNC;
639		else
640			tp->tun_flags &= ~TUN_ASYNC;
641		mtx_unlock(&tp->tun_mtx);
642		break;
643	case FIONREAD:
644		s = splimp();
645		if (!IFQ_IS_EMPTY(&tp->tun_if.if_snd)) {
646			struct mbuf *mb;
647			IFQ_LOCK(&tp->tun_if.if_snd);
648			IFQ_POLL_NOLOCK(&tp->tun_if.if_snd, mb);
649			for( *(int *)data = 0; mb != 0; mb = mb->m_next)
650				*(int *)data += mb->m_len;
651			IFQ_UNLOCK(&tp->tun_if.if_snd);
652		} else
653			*(int *)data = 0;
654		splx(s);
655		break;
656	case FIOSETOWN:
657		return (fsetown(*(int *)data, &tp->tun_sigio));
658
659	case FIOGETOWN:
660		*(int *)data = fgetown(&tp->tun_sigio);
661		return (0);
662
663	/* This is deprecated, FIOSETOWN should be used instead. */
664	case TIOCSPGRP:
665		return (fsetown(-(*(int *)data), &tp->tun_sigio));
666
667	/* This is deprecated, FIOGETOWN should be used instead. */
668	case TIOCGPGRP:
669		*(int *)data = -fgetown(&tp->tun_sigio);
670		return (0);
671
672	default:
673		return (ENOTTY);
674	}
675	return (0);
676}
677
678/*
679 * The cdevsw read interface - reads a packet at a time, or at
680 * least as much of a packet as can be read.
681 */
682static	int
683tunread(struct cdev *dev, struct uio *uio, int flag)
684{
685	struct tun_softc *tp = dev->si_drv1;
686	struct ifnet	*ifp = &tp->tun_if;
687	struct mbuf	*m;
688	int		error=0, len, s;
689
690	TUNDEBUG (ifp, "read\n");
691	mtx_lock(&tp->tun_mtx);
692	if ((tp->tun_flags & TUN_READY) != TUN_READY) {
693		mtx_unlock(&tp->tun_mtx);
694		TUNDEBUG (ifp, "not ready 0%o\n", tp->tun_flags);
695		return (EHOSTDOWN);
696	}
697
698	tp->tun_flags &= ~TUN_RWAIT;
699	mtx_unlock(&tp->tun_mtx);
700
701	s = splimp();
702	do {
703		IFQ_DEQUEUE(&ifp->if_snd, m);
704		if (m == NULL) {
705			if (flag & O_NONBLOCK) {
706				splx(s);
707				return (EWOULDBLOCK);
708			}
709			mtx_lock(&tp->tun_mtx);
710			tp->tun_flags |= TUN_RWAIT;
711			mtx_unlock(&tp->tun_mtx);
712			if((error = tsleep(tp, PCATCH | (PZERO + 1),
713					"tunread", 0)) != 0) {
714				splx(s);
715				return (error);
716			}
717		}
718	} while (m == NULL);
719	splx(s);
720
721	while (m && uio->uio_resid > 0 && error == 0) {
722		len = min(uio->uio_resid, m->m_len);
723		if (len != 0)
724			error = uiomove(mtod(m, void *), len, uio);
725		m = m_free(m);
726	}
727
728	if (m) {
729		TUNDEBUG(ifp, "Dropping mbuf\n");
730		m_freem(m);
731	}
732	return (error);
733}
734
735/*
736 * the cdevsw write interface - an atomic write is a packet - or else!
737 */
738static	int
739tunwrite(struct cdev *dev, struct uio *uio, int flag)
740{
741	struct tun_softc *tp = dev->si_drv1;
742	struct ifnet	*ifp = &tp->tun_if;
743	struct mbuf	*m;
744	int		error = 0;
745	uint32_t	family;
746	int 		isr;
747
748	TUNDEBUG(ifp, "tunwrite\n");
749
750	if ((ifp->if_flags & IFF_UP) != IFF_UP)
751		/* ignore silently */
752		return (0);
753
754	if (uio->uio_resid == 0)
755		return (0);
756
757	if (uio->uio_resid < 0 || uio->uio_resid > TUNMRU) {
758		TUNDEBUG(ifp, "len=%d!\n", uio->uio_resid);
759		return (EIO);
760	}
761
762	if ((m = m_uiotombuf(uio, M_DONTWAIT, 0)) == NULL) {
763		ifp->if_ierrors++;
764		return (error);
765	}
766
767	m->m_pkthdr.rcvif = ifp;
768#ifdef MAC
769	mac_create_mbuf_from_ifnet(ifp, m);
770#endif
771
772	/* Could be unlocked read? */
773	mtx_lock(&tp->tun_mtx);
774	if (tp->tun_flags & TUN_IFHEAD) {
775		mtx_unlock(&tp->tun_mtx);
776		if (m->m_len < sizeof(family) &&
777		    (m = m_pullup(m, sizeof(family))) == NULL)
778			return (ENOBUFS);
779		family = ntohl(*mtod(m, u_int32_t *));
780		m_adj(m, sizeof(family));
781	} else {
782		mtx_unlock(&tp->tun_mtx);
783		family = AF_INET;
784	}
785
786	BPF_MTAP2(ifp, &family, sizeof(family), m);
787
788	switch (family) {
789#ifdef INET
790	case AF_INET:
791		isr = NETISR_IP;
792		break;
793#endif
794#ifdef INET6
795	case AF_INET6:
796		isr = NETISR_IPV6;
797		break;
798#endif
799#ifdef IPX
800	case AF_IPX:
801		isr = NETISR_IPX;
802		break;
803#endif
804#ifdef NETATALK
805	case AF_APPLETALK:
806		isr = NETISR_ATALK2;
807		break;
808#endif
809	default:
810		m_freem(m);
811		return (EAFNOSUPPORT);
812	}
813	/* First chunk of an mbuf contains good junk */
814	if (harvest.point_to_point)
815		random_harvest(m, 16, 3, 0, RANDOM_NET);
816	ifp->if_ibytes += m->m_pkthdr.len;
817	ifp->if_ipackets++;
818	netisr_dispatch(isr, m);
819	return (0);
820}
821
822/*
823 * tunpoll - the poll interface, this is only useful on reads
824 * really. The write detect always returns true, write never blocks
825 * anyway, it either accepts the packet or drops it.
826 */
827static	int
828tunpoll(struct cdev *dev, int events, struct thread *td)
829{
830	int		s;
831	struct tun_softc *tp = dev->si_drv1;
832	struct ifnet	*ifp = &tp->tun_if;
833	int		revents = 0;
834	struct mbuf	*m;
835
836	s = splimp();
837	TUNDEBUG(ifp, "tunpoll\n");
838
839	if (events & (POLLIN | POLLRDNORM)) {
840		IFQ_LOCK(&ifp->if_snd);
841		IFQ_POLL_NOLOCK(&ifp->if_snd, m);
842		if (m != NULL) {
843			TUNDEBUG(ifp, "tunpoll q=%d\n", ifp->if_snd.ifq_len);
844			revents |= events & (POLLIN | POLLRDNORM);
845		} else {
846			TUNDEBUG(ifp, "tunpoll waiting\n");
847			selrecord(td, &tp->tun_rsel);
848		}
849		IFQ_UNLOCK(&ifp->if_snd);
850	}
851	if (events & (POLLOUT | POLLWRNORM))
852		revents |= events & (POLLOUT | POLLWRNORM);
853
854	splx(s);
855	return (revents);
856}
857