xref: /dragonfly/sys/net/tun/if_tun.c (revision 335b9e93)
1 /*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5  * Nottingham University 1987.
6  *
7  * This source may be freely distributed, however I would be interested
8  * in any changes that are made.
9  *
10  * This driver takes packets off the IP i/f and hands them up to a
11  * user process to have its wicked way with. This driver has it's
12  * roots in a similar driver written by Phil Cockcroft (formerly) at
13  * UCL. This driver is based much more on read/write/poll mode of
14  * operation though.
15  *
16  * $FreeBSD: src/sys/net/if_tun.c,v 1.74.2.8 2002/02/13 00:43:11 dillon Exp $
17  */
18 
19 #include "opt_inet.h"
20 #include "opt_inet6.h"
21 
22 #include <sys/param.h>
23 #include <sys/proc.h>
24 #include <sys/priv.h>
25 #include <sys/systm.h>
26 #include <sys/mbuf.h>
27 #include <sys/socket.h>
28 #include <sys/conf.h>
29 #include <sys/device.h>
30 #include <sys/filio.h>
31 #include <sys/sockio.h>
32 #include <sys/ttycom.h>
33 #include <sys/signalvar.h>
34 #include <sys/filedesc.h>
35 #include <sys/kernel.h>
36 #include <sys/sysctl.h>
37 #include <sys/uio.h>
38 #include <sys/vnode.h>
39 #include <sys/malloc.h>
40 #include <sys/mplock2.h>
41 #include <sys/devfs.h>
42 #include <sys/queue.h>
43 
44 #include <net/bpf.h>
45 #include <net/if.h>
46 #include <net/if_types.h>
47 #include <net/if_clone.h>
48 #include <net/ifq_var.h>
49 #include <net/netisr.h>
50 #include <net/route.h>
51 
52 #ifdef INET
53 #include <netinet/in.h>
54 #endif
55 
56 #include "if_tunvar.h"
57 #include "if_tun.h"
58 
59 #define TUN		"tun"
60 #define TUNDEBUG	if (tundebug) if_printf
61 
62 /* module */
63 static int		tunmodevent(module_t, int, void *);
64 
65 /* device */
66 static struct tun_softc *tuncreate(cdev_t, int);
67 static void		tundestroy(struct tun_softc *sc);
68 
69 /* clone */
70 static int		tun_clone_create(struct if_clone *, int, caddr_t);
71 static int		tun_clone_destroy(struct ifnet *);
72 
73 /* network interface */
74 static int		tunifinit(struct ifnet *);
75 static void		tunifstart(struct ifnet *, struct ifaltq_subque *);
76 static int		tunifoutput(struct ifnet *, struct mbuf *,
77 				    struct sockaddr *, struct rtentry *rt);
78 static int		tunifioctl(struct ifnet *, u_long,
79 				   caddr_t, struct ucred *);
80 
81 /* character device */
82 static d_open_t		tunopen;
83 static d_close_t	tunclose;
84 static d_read_t		tunread;
85 static d_write_t	tunwrite;
86 static d_ioctl_t	tunioctl;
87 static d_kqfilter_t	tunkqfilter;
88 static d_clone_t	tunclone;
89 
90 static struct dev_ops	tun_ops = {
91 	{ TUN, 0, 0 },
92 	.d_open =	tunopen,
93 	.d_close =	tunclose,
94 	.d_read =	tunread,
95 	.d_write =	tunwrite,
96 	.d_ioctl =	tunioctl,
97 	.d_kqfilter =	tunkqfilter
98 };
99 
100 /* kqueue support */
101 static void		tun_filter_detach(struct knote *);
102 static int		tun_filter_read(struct knote *, long);
103 static int		tun_filter_write(struct knote *, long);
104 
105 static struct filterops tun_read_filtops = {
106 	FILTEROP_ISFD,
107 	NULL,
108 	tun_filter_detach,
109 	tun_filter_read
110 };
111 static struct filterops tun_write_filtops = {
112 	FILTEROP_ISFD,
113 	NULL,
114 	tun_filter_detach,
115 	tun_filter_write
116 };
117 
118 static int		tundebug = 0;	/* debug flag */
119 static int		tunrefcnt = 0;	/* module reference counter */
120 
121 static MALLOC_DEFINE(M_TUN, TUN, "Tunnel Interface");
122 
123 static DEVFS_DEFINE_CLONE_BITMAP(tun);
124 
125 struct if_clone tun_cloner = IF_CLONE_INITIALIZER(
126 	TUN, tun_clone_create, tun_clone_destroy, 0, IF_MAXUNIT);
127 
128 static SLIST_HEAD(,tun_softc) tun_listhead =
129 	SLIST_HEAD_INITIALIZER(&tun_listhead);
130 
131 SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0,
132 	   "Enable debug output");
133 SYSCTL_DECL(_net_link);
134 SYSCTL_NODE(_net_link, OID_AUTO, tun, CTLFLAG_RW, 0,
135 	    "IP tunnel software network interface");
136 SYSCTL_INT(_net_link_tun, OID_AUTO, debug, CTLFLAG_RW, &tundebug, 0,
137 	   "Enable debug output");
138 SYSCTL_INT(_net_link_tun, OID_AUTO, refcnt, CTLFLAG_RD, &tunrefcnt, 0,
139 	   "Number of opened devices");
140 
141 DEV_MODULE(if_tun, tunmodevent, NULL);
142 
143 /*
144  * tunmodevent - module event handler
145  */
146 static int
147 tunmodevent(module_t mod, int type, void *data)
148 {
149 	static cdev_t dev = NULL;
150 	struct tun_softc *sc, *sc_tmp;
151 
152 	switch (type) {
153 	case MOD_LOAD:
154 		dev = make_autoclone_dev(&tun_ops, &DEVFS_CLONE_BITMAP(tun),
155 					 tunclone, UID_UUCP, GID_DIALER,
156 					 0600, TUN);
157 
158 		SLIST_INIT(&tun_listhead);
159 		if_clone_attach(&tun_cloner);
160 		break;
161 
162 	case MOD_UNLOAD:
163 		if (tunrefcnt > 0)
164 			return (EBUSY);
165 
166 		if_clone_detach(&tun_cloner);
167 
168 		SLIST_FOREACH_MUTABLE(sc, &tun_listhead, tun_link, sc_tmp)
169 			tundestroy(sc);
170 
171 		dev_ops_remove_all(&tun_ops);
172 		destroy_autoclone_dev(dev, &DEVFS_CLONE_BITMAP(tun));
173 		break;
174 
175 	default:
176 		return (EOPNOTSUPP);
177 	}
178 
179 	return (0);
180 }
181 
182 static int
183 tunclone(struct dev_clone_args *ap)
184 {
185 	int unit;
186 
187 	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(tun), 0);
188 	ap->a_dev = make_only_dev(&tun_ops, unit, UID_UUCP, GID_DIALER,
189 				  0600, "%s%d", TUN, unit);
190 
191 	if (tuncreate(ap->a_dev, 0) == NULL)
192 		return (ENOMEM);
193 	else
194 		return (0);
195 }
196 
197 static struct tun_softc *
198 tuncreate(cdev_t dev, int flags)
199 {
200 	struct tun_softc *sc;
201 	struct ifnet *ifp;
202 	int unit = minor(dev);
203 
204 	sc = kmalloc(sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
205 	dev->si_drv1 = sc;
206 	sc->tun_dev = dev;
207 	sc->tun_flags = TUN_INITED;
208 	sc->tun_flags |= flags;
209 
210 	reference_dev(dev);  /* device association */
211 
212 	ifp = sc->tun_ifp = if_alloc(IFT_PPP);
213 	if (ifp == NULL) {
214 		kprintf("%s: failed to if_alloc() interface for %s%d",
215 			__func__, TUN, unit);
216 		return (NULL);
217 	}
218 
219 	if_initname(ifp, TUN, unit);
220 	ifp->if_mtu = TUNMTU;
221 	ifp->if_ioctl = tunifioctl;
222 	ifp->if_output = tunifoutput;
223 	ifp->if_start = tunifstart;
224 	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
225 	ifp->if_type = IFT_PPP;
226 	ifp->if_softc = sc;
227 	ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
228 	ifq_set_ready(&ifp->if_snd);
229 
230 	if_attach(ifp, NULL);
231 	bpfattach(ifp, DLT_NULL, sizeof(u_int));
232 
233 	SLIST_INSERT_HEAD(&tun_listhead, sc, tun_link);
234 	TUNDEBUG(ifp, "created, minor = %#x, flags = 0x%x\n",
235 		 unit, sc->tun_flags);
236 	return (sc);
237 }
238 
239 static void
240 tundestroy(struct tun_softc *sc)
241 {
242 	cdev_t dev = sc->tun_dev;
243 	struct ifnet *ifp = sc->tun_ifp;
244 	int unit = minor(dev);
245 
246 	TUNDEBUG(ifp, "destroyed, minor = %#x. Module refcnt = %d\n",
247 		 unit, tunrefcnt);
248 
249 	bpfdetach(ifp);
250 	if_detach(ifp);
251 	if_free(ifp);
252 
253 	sc->tun_dev = NULL;
254 	dev->si_drv1 = NULL;
255 	release_dev(dev);  /* device disassociation */
256 
257 	/* Also destroy the cloned device */
258 	destroy_dev(dev);
259 	devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(tun), unit);
260 
261 	SLIST_REMOVE(&tun_listhead, sc, tun_softc, tun_link);
262 	kfree(sc, M_TUN);
263 }
264 
265 /*
266  * tunnel open - must be superuser & the device must be configured in
267  */
268 static int
269 tunopen(struct dev_open_args *ap)
270 {
271 	cdev_t dev = ap->a_head.a_dev;
272 	struct ifnet *ifp;
273 	struct tun_softc *sc;
274 	int error;
275 
276 	if ((error = priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) != 0)
277 		return (error);
278 
279 	sc = dev->si_drv1;
280 	if (sc == NULL && (sc = tuncreate(dev, TUN_MANUALMAKE)) == NULL)
281 		return (ENOMEM);
282 	if (sc->tun_flags & TUN_OPEN)
283 		return (EBUSY);
284 
285 	ifp = sc->tun_ifp;
286 	if ((sc->tun_flags & TUN_CLONE) == 0) {
287 		EVENTHANDLER_INVOKE(ifnet_attach_event, ifp);
288 
289 		/* Announce the return of the interface. */
290 		rt_ifannouncemsg(ifp, IFAN_ARRIVAL);
291 	}
292 
293 	sc->tun_pid = curproc->p_pid;
294 	sc->tun_flags |= TUN_OPEN;
295 	tunrefcnt++;
296 
297 	TUNDEBUG(ifp, "opened, minor = %#x. Module refcnt = %d\n",
298 		 minor(dev), tunrefcnt);
299 	return (0);
300 }
301 
302 /*
303  * close the device - mark interface down & delete routing info
304  */
305 static int
306 tunclose(struct dev_close_args *ap)
307 {
308 	cdev_t dev = ap->a_head.a_dev;
309 	struct tun_softc *sc = dev->si_drv1;
310 	struct ifnet *ifp;
311 	int unit = minor(dev);
312 
313 	KASSERT(sc != NULL,
314 		("try closing the already destroyed %s%d", TUN, unit));
315 	ifp = sc->tun_ifp;
316 
317 	sc->tun_flags &= ~TUN_OPEN;
318 	sc->tun_pid = 0;
319 
320 	/* Junk all pending output. */
321 	ifq_purge_all(&ifp->if_snd);
322 
323 	if (ifp->if_flags & IFF_UP)
324 		if_down(ifp);
325 	ifp->if_flags &= ~IFF_RUNNING;
326 
327 	if ((sc->tun_flags & TUN_CLONE) == 0) {
328 		if_purgeaddrs_nolink(ifp);
329 
330 		EVENTHANDLER_INVOKE(ifnet_detach_event, ifp);
331 
332 		/* Announce the departure of the interface. */
333 		rt_ifannouncemsg(ifp, IFAN_DEPARTURE);
334 	}
335 
336 	funsetown(&sc->tun_sigio);
337 	KNOTE(&sc->tun_rkq.ki_note, 0);
338 
339 	tunrefcnt--;
340 	if (tunrefcnt < 0) {
341 		tunrefcnt = 0;
342 		if_printf(ifp, ". Module refcnt = %d is out of sync! "
343 			  "Force refcnt to be 0.\n", tunrefcnt);
344 	}
345 
346 	TUNDEBUG(ifp, "closed, minor = %#x. Module refcnt = %d\n",
347 		 unit, tunrefcnt);
348 
349 	/* Only auto-destroy if the interface was not manually created. */
350 	if ((sc->tun_flags & TUN_MANUALMAKE) == 0) {
351 		tundestroy(sc);
352 		dev->si_drv1 = NULL;
353 	}
354 
355 	return (0);
356 }
357 
358 
359 /*
360  * Interface clone support
361  *
362  * Create and destroy tun device/interface via ifconfig(8).
363  */
364 
365 static struct tun_softc *
366 tunfind(int unit)
367 {
368 	struct tun_softc *sc;
369 
370 	SLIST_FOREACH(sc, &tun_listhead, tun_link) {
371 		if (minor(sc->tun_dev) == unit)
372 			return (sc);
373 	}
374 	return (NULL);
375 }
376 
377 static int
378 tun_clone_create(struct if_clone *ifc __unused, int unit,
379 		 caddr_t param __unused)
380 {
381 	struct tun_softc *sc;
382 	cdev_t dev;
383 
384 	sc = tunfind(unit);
385 	if (sc == NULL) {
386 		if (!devfs_clone_bitmap_chk(&DEVFS_CLONE_BITMAP(tun), unit)) {
387 			devfs_clone_bitmap_set(&DEVFS_CLONE_BITMAP(tun), unit);
388 			dev = make_dev(&tun_ops, unit, UID_UUCP, GID_DIALER,
389 				       0600, "%s%d", TUN, unit);
390 		} else {
391 			dev = devfs_find_device_by_name("%s%d", TUN, unit);
392 		}
393 
394 		if (dev == NULL)
395 			return (ENODEV);
396 		if ((sc = tuncreate(dev, TUN_MANUALMAKE)) == NULL)
397 			return (ENOMEM);
398 	}
399 
400 	sc->tun_flags |= TUN_CLONE;
401 	TUNDEBUG(sc->tun_ifp, "clone created, minor = %#x, flags = 0x%x\n",
402 		 minor(sc->tun_dev), sc->tun_flags);
403 
404 	return (0);
405 }
406 
407 static int
408 tun_clone_destroy(struct ifnet * ifp)
409 {
410 	struct tun_softc *sc = ifp->if_softc;
411 
412 	if (sc->tun_flags & TUN_OPEN)
413 		return (EBUSY);
414 	if ((sc->tun_flags & TUN_CLONE) == 0)
415 		return (EINVAL);
416 
417 	TUNDEBUG(ifp, "clone destroyed, minor = %#x, flags = 0x%x\n",
418 		 minor(sc->tun_dev), sc->tun_flags);
419 	tundestroy(sc);
420 
421 	return (0);
422 }
423 
424 
425 /*
426  * Network interface functions
427  */
428 
429 static int
430 tunifinit(struct ifnet *ifp)
431 {
432 #ifdef INET
433 	struct tun_softc *sc = ifp->if_softc;
434 #endif
435 	struct ifaddr_container *ifac;
436 	int error = 0;
437 
438 	TUNDEBUG(ifp, "initialize\n");
439 
440 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
441 	getmicrotime(&ifp->if_lastchange);
442 
443 	TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) {
444 		struct ifaddr *ifa = ifac->ifa;
445 
446 		if (ifa->ifa_addr == NULL) {
447 			error = EFAULT;
448 			/* XXX: Should maybe return straight off? */
449 		} else {
450 #ifdef INET
451 			if (ifa->ifa_addr->sa_family == AF_INET) {
452 				struct sockaddr_in *si;
453 
454 				si = (struct sockaddr_in *)ifa->ifa_addr;
455 				if (si->sin_addr.s_addr)
456 					sc->tun_flags |= TUN_IASET;
457 			}
458 #endif
459 		}
460 	}
461 	return (error);
462 }
463 
464 /*
465  * Process an ioctl request.
466  *
467  * MPSAFE
468  */
469 static int
470 tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
471 {
472 	struct ifreq *ifr = (struct ifreq *)data;
473 	struct tun_softc *sc = ifp->if_softc;
474 	struct ifstat *ifs;
475 	int error = 0;
476 
477 	switch (cmd) {
478 	case SIOCGIFSTATUS:
479 		ifs = (struct ifstat *)data;
480 		if (sc->tun_pid)
481 			ksprintf(ifs->ascii + strlen(ifs->ascii),
482 			    "\tOpened by PID %d\n", sc->tun_pid);
483 		break;
484 	case SIOCSIFADDR:
485 		error = tunifinit(ifp);
486 		TUNDEBUG(ifp, "address set, error=%d\n", error);
487 		break;
488 	case SIOCSIFDSTADDR:
489 		error = tunifinit(ifp);
490 		TUNDEBUG(ifp, "destination address set, error=%d\n", error);
491 		break;
492 	case SIOCSIFMTU:
493 		ifp->if_mtu = ifr->ifr_mtu;
494 		TUNDEBUG(ifp, "mtu set\n");
495 		break;
496 	case SIOCSIFFLAGS:
497 	case SIOCADDMULTI:
498 	case SIOCDELMULTI:
499 		break;
500 	default:
501 		error = EINVAL;
502 	}
503 	return (error);
504 }
505 
506 /*
507  * Start packet transmission on the interface.
508  * when the interface queue is rate-limited by ALTQ,
509  * if_start is needed to drain packets from the queue in order
510  * to notify readers when outgoing packets become ready.
511  */
512 static void
513 tunifstart(struct ifnet *ifp, struct ifaltq_subque *ifsq)
514 {
515 	struct tun_softc *sc = ifp->if_softc;
516 	struct mbuf *m;
517 
518 	ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
519 
520 	if (!ifq_is_enabled(&ifp->if_snd))
521 		return;
522 
523 	m = ifsq_poll(ifsq);
524 	if (m != NULL) {
525 		if (sc->tun_flags & TUN_RWAIT) {
526 			sc->tun_flags &= ~TUN_RWAIT;
527 			wakeup((caddr_t)sc);
528 		}
529 		if (sc->tun_flags & TUN_ASYNC && sc->tun_sigio)
530 			pgsigio(sc->tun_sigio, SIGIO, 0);
531 		ifsq_deserialize_hw(ifsq);
532 		KNOTE(&sc->tun_rkq.ki_note, 0);
533 		ifsq_serialize_hw(ifsq);
534 	}
535 }
536 
537 /*
538  * tunifoutput - queue packets from higher level ready to put out.
539  *
540  * MPSAFE
541  */
542 static int
543 tunifoutput_serialized(struct ifnet *ifp, struct mbuf *m0,
544 		       struct sockaddr *dst, struct rtentry *rt)
545 {
546 	struct tun_softc *sc = ifp->if_softc;
547 	int error;
548 	struct altq_pktattr pktattr;
549 
550 	TUNDEBUG(ifp, "output\n");
551 
552 	if ((sc->tun_flags & TUN_READY) != TUN_READY) {
553 		TUNDEBUG(ifp, "not ready, flags = 0x%x\n", sc->tun_flags);
554 		m_freem (m0);
555 		return (EHOSTDOWN);
556 	}
557 
558 	/*
559 	 * if the queueing discipline needs packet classification,
560 	 * do it before prepending link headers.
561 	 */
562 	ifq_classify(&ifp->if_snd, m0, dst->sa_family, &pktattr);
563 
564 	/* BPF write needs to be handled specially */
565 	if (dst->sa_family == AF_UNSPEC) {
566 		dst->sa_family = *(mtod(m0, int *));
567 		m0->m_len -= sizeof(int);
568 		m0->m_pkthdr.len -= sizeof(int);
569 		m0->m_data += sizeof(int);
570 	}
571 
572 	if (ifp->if_bpf) {
573 		bpf_gettoken();
574 		if (ifp->if_bpf) {
575 			/*
576 			 * We need to prepend the address family as
577 			 * a four byte field.
578 			 */
579 			uint32_t af = dst->sa_family;
580 
581 			bpf_ptap(ifp->if_bpf, m0, &af, sizeof(af));
582 		}
583 		bpf_reltoken();
584 	}
585 
586 	/* prepend sockaddr? this may abort if the mbuf allocation fails */
587 	if (sc->tun_flags & TUN_LMODE) {
588 		/* allocate space for sockaddr */
589 		M_PREPEND(m0, dst->sa_len, M_NOWAIT);
590 
591 		/* if allocation failed drop packet */
592 		if (m0 == NULL){
593 			IFNET_STAT_INC(ifp, oerrors, 1);
594 			return (ENOBUFS);
595 		} else {
596 			bcopy(dst, m0->m_data, dst->sa_len);
597 		}
598 	}
599 
600 	if (sc->tun_flags & TUN_IFHEAD) {
601 		/* Prepend the address family */
602 		M_PREPEND(m0, 4, M_NOWAIT);
603 
604 		/* if allocation failed drop packet */
605 		if (m0 == NULL){
606 			IFNET_STAT_INC(ifp, oerrors, 1);
607 			return (ENOBUFS);
608 		} else {
609 			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
610 		}
611 	} else {
612 #ifdef INET
613 		if (dst->sa_family != AF_INET)
614 #endif
615 		{
616 			m_freem(m0);
617 			return (EAFNOSUPPORT);
618 		}
619 	}
620 
621 	error = ifq_handoff(ifp, m0, &pktattr);
622 	if (error) {
623 		IFNET_STAT_INC(ifp, collisions, 1);
624 	} else {
625 		IFNET_STAT_INC(ifp, opackets, 1);
626 		if (sc->tun_flags & TUN_RWAIT) {
627 			sc->tun_flags &= ~TUN_RWAIT;
628 			wakeup((caddr_t)sc);
629 		}
630 		get_mplock();
631 		if (sc->tun_flags & TUN_ASYNC && sc->tun_sigio)
632 			pgsigio(sc->tun_sigio, SIGIO, 0);
633 		rel_mplock();
634 		ifnet_deserialize_all(ifp);
635 		KNOTE(&sc->tun_rkq.ki_note, 0);
636 		ifnet_serialize_all(ifp);
637 	}
638 	return (error);
639 }
640 
641 static int
642 tunifoutput(struct ifnet *ifp, struct mbuf *m0, struct sockaddr *dst,
643 	    struct rtentry *rt)
644 {
645 	int error;
646 
647 	ifnet_serialize_all(ifp);
648 	error = tunifoutput_serialized(ifp, m0, dst, rt);
649 	ifnet_deserialize_all(ifp);
650 
651 	return (error);
652 }
653 
654 
655 /*
656  * the ops interface is now pretty minimal.
657  */
658 static int
659 tunioctl(struct dev_ioctl_args *ap)
660 {
661 	cdev_t dev = ap->a_head.a_dev;
662 	caddr_t data = ap->a_data;
663 	struct tun_softc *sc = dev->si_drv1;
664 	struct ifnet *ifp = sc->tun_ifp;
665 	struct ifreq *ifr;
666 	struct tuninfo *tunp;
667 	int error = 0;
668 
669 	switch (ap->a_cmd) {
670 	case TUNSIFINFO:
671 		tunp = (struct tuninfo *)data;
672 		if (ifp->if_type != tunp->type)
673 			return (EPROTOTYPE);
674 		if (tunp->mtu < IF_MINMTU)
675 			return (EINVAL);
676 		ifp->if_mtu = tunp->mtu;
677 		ifp->if_baudrate = tunp->baudrate;
678 		break;
679 
680 	case TUNGIFINFO:
681 		tunp = (struct tuninfo *)data;
682 		tunp->mtu = ifp->if_mtu;
683 		tunp->type = ifp->if_type;
684 		tunp->baudrate = ifp->if_baudrate;
685 		break;
686 
687 	case TUNGIFNAME:
688 		ifr = (struct ifreq *)data;
689 		strlcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
690 		break;
691 
692 	case TUNSDEBUG:
693 		tundebug = *(int *)data;
694 		break;
695 
696 	case TUNGDEBUG:
697 		*(int *)data = tundebug;
698 		break;
699 
700 	case TUNSLMODE:
701 		if (*(int *)data) {
702 			sc->tun_flags |= TUN_LMODE;
703 			sc->tun_flags &= ~TUN_IFHEAD;
704 		} else {
705 			sc->tun_flags &= ~TUN_LMODE;
706 		}
707 		break;
708 
709 	case TUNSIFHEAD:
710 		if (*(int *)data) {
711 			sc->tun_flags |= TUN_IFHEAD;
712 			sc->tun_flags &= ~TUN_LMODE;
713 		} else {
714 			sc->tun_flags &= ~TUN_IFHEAD;
715 		}
716 		break;
717 
718 	case TUNGIFHEAD:
719 		*(int *)data = (sc->tun_flags & TUN_IFHEAD) ? 1 : 0;
720 		break;
721 
722 	case TUNSIFMODE:
723 		/* deny this if UP */
724 		if (ifp->if_flags & IFF_UP)
725 			return (EBUSY);
726 
727 		switch (*(int *)data & ~IFF_MULTICAST) {
728 		case IFF_POINTOPOINT:
729 		case IFF_BROADCAST:
730 			ifp->if_flags &= ~(IFF_BROADCAST | IFF_POINTOPOINT);
731 			ifp->if_flags |= *(int *)data;
732 			break;
733 		default:
734 			return (EINVAL);
735 		}
736 		break;
737 
738 	case TUNSIFPID:
739 		sc->tun_pid = curproc->p_pid;
740 		break;
741 
742 	case FIOASYNC:
743 		if (*(int *)data)
744 			sc->tun_flags |= TUN_ASYNC;
745 		else
746 			sc->tun_flags &= ~TUN_ASYNC;
747 		break;
748 
749 	case FIONREAD:
750 		*(int *)data = ifsq_poll_pktlen(
751 		    ifq_get_subq_default(&ifp->if_snd));
752 		break;
753 
754 	case FIOSETOWN:
755 		error = fsetown(*(int *)data, &sc->tun_sigio);
756 		break;
757 
758 	case FIOGETOWN:
759 		*(int *)data = fgetown(&sc->tun_sigio);
760 		break;
761 
762 	/* This is deprecated, FIOSETOWN should be used instead. */
763 	case TIOCSPGRP:
764 		error = fsetown(-(*(int *)data), &sc->tun_sigio);
765 		break;
766 
767 	/* This is deprecated, FIOGETOWN should be used instead. */
768 	case TIOCGPGRP:
769 		*(int *)data = -fgetown(&sc->tun_sigio);
770 		break;
771 
772 	default:
773 		error = ENOTTY;
774 		break;
775 	}
776 
777 	return (error);
778 }
779 
780 /*
781  * The ops read interface - reads a packet at a time, or at
782  * least as much of a packet as can be read.
783  */
784 static	int
785 tunread(struct dev_read_args *ap)
786 {
787 	cdev_t dev = ap->a_head.a_dev;
788 	struct uio *uio = ap->a_uio;
789 	struct tun_softc *sc = dev->si_drv1;
790 	struct ifnet *ifp = sc->tun_ifp;
791 	struct ifaltq_subque *ifsq = ifq_get_subq_default(&ifp->if_snd);
792 	struct mbuf *m0;
793 	int error=0, len;
794 
795 	TUNDEBUG(ifp, "read\n");
796 	if ((sc->tun_flags & TUN_READY) != TUN_READY) {
797 		TUNDEBUG(ifp, "not ready, flags = 0x%x\n", sc->tun_flags);
798 		return (EHOSTDOWN);
799 	}
800 
801 	sc->tun_flags &= ~TUN_RWAIT;
802 
803 	ifnet_serialize_all(ifp);
804 
805 	while ((m0 = ifsq_dequeue(ifsq)) == NULL) {
806 		if (ap->a_ioflag & IO_NDELAY) {
807 			ifnet_deserialize_all(ifp);
808 			return (EWOULDBLOCK);
809 		}
810 		sc->tun_flags |= TUN_RWAIT;
811 		ifnet_deserialize_all(ifp);
812 		if ((error = tsleep(sc, PCATCH, "tunread", 0)) != 0)
813 			return (error);
814 		ifnet_serialize_all(ifp);
815 	}
816 
817 	ifnet_deserialize_all(ifp);
818 
819 	while (m0 && uio->uio_resid > 0 && error == 0) {
820 		len = (int)szmin(uio->uio_resid, m0->m_len);
821 		if (len != 0)
822 			error = uiomove(mtod(m0, caddr_t), (size_t)len, uio);
823 		m0 = m_free(m0);
824 	}
825 
826 	if (m0) {
827 		TUNDEBUG(ifp, "dropping mbuf\n");
828 		m_freem(m0);
829 	}
830 	return (error);
831 }
832 
833 /*
834  * the ops write interface - an atomic write is a packet - or else!
835  */
836 static	int
837 tunwrite(struct dev_write_args *ap)
838 {
839 	cdev_t dev = ap->a_head.a_dev;
840 	struct uio *uio = ap->a_uio;
841 	struct tun_softc *sc = dev->si_drv1;
842 	struct ifnet *ifp = sc->tun_ifp;
843 	struct mbuf *top, **mp, *m;
844 	size_t tlen;
845 	uint32_t family, mru;
846 	int error = 0;
847 	int isr;
848 
849 	TUNDEBUG(ifp, "tunwrite\n");
850 
851 	if (uio->uio_resid == 0)
852 		return (0);
853 
854 	mru = TUNMRU;
855 	if (sc->tun_flags & TUN_IFHEAD)
856 		mru += sizeof(family);
857 	if (uio->uio_resid > mru) {
858 		TUNDEBUG(ifp, "len = %zd!\n", uio->uio_resid);
859 		return (EIO);
860 	}
861 
862 	/* get a header mbuf */
863 	MGETHDR(m, M_WAITOK, MT_DATA);
864 	if (m == NULL)
865 		return (ENOBUFS);
866 
867 	tlen = uio->uio_resid;
868 	top = NULL;
869 	mp = &top;
870 	while (error == 0 && uio->uio_resid > 0) {
871 		m->m_len = (int)szmin(MHLEN, uio->uio_resid);
872 		error = uiomove(mtod(m, caddr_t), (size_t)m->m_len, uio);
873 		*mp = m;
874 		mp = &m->m_next;
875 		if (uio->uio_resid > 0) {
876 			MGET(m, M_WAITOK, MT_DATA);
877 			if (m == NULL) {
878 				error = ENOBUFS;
879 				break;
880 			}
881 		}
882 	}
883 	if (error) {
884 		if (top)
885 			m_freem(top);
886 		IFNET_STAT_INC(ifp, ierrors, 1);
887 		return (error);
888 	}
889 
890 	top->m_pkthdr.len = (int)tlen;
891 	top->m_pkthdr.rcvif = ifp;
892 
893 	if (ifp->if_bpf) {
894 		bpf_gettoken();
895 
896 		if (ifp->if_bpf) {
897 			if (sc->tun_flags & TUN_IFHEAD) {
898 				/*
899 				 * Conveniently, we already have a 4-byte
900 				 * address family prepended to our packet !
901 				 * Inconveniently, it's in the wrong byte
902 				 * order !
903 				 */
904 				if ((top = m_pullup(top, sizeof(family)))
905 				    == NULL) {
906 					bpf_reltoken();
907 					return (ENOBUFS);
908 				}
909 				*mtod(top, u_int32_t *) =
910 				    ntohl(*mtod(top, u_int32_t *));
911 				bpf_mtap(ifp->if_bpf, top);
912 				*mtod(top, u_int32_t *) =
913 				    htonl(*mtod(top, u_int32_t *));
914 			} else {
915 				/*
916 				 * We need to prepend the address family as
917 				 * a four byte field.
918 				 */
919 				static const uint32_t af = AF_INET;
920 
921 				bpf_ptap(ifp->if_bpf, top, &af, sizeof(af));
922 			}
923 		}
924 
925 		bpf_reltoken();
926 	}
927 
928 	if (sc->tun_flags & TUN_IFHEAD) {
929 		if (top->m_len < sizeof(family) &&
930 		    (top = m_pullup(top, sizeof(family))) == NULL)
931 				return (ENOBUFS);
932 		family = ntohl(*mtod(top, u_int32_t *));
933 		m_adj(top, sizeof(family));
934 	} else {
935 		family = AF_INET;
936 	}
937 
938 	IFNET_STAT_INC(ifp, ibytes, top->m_pkthdr.len);
939 	IFNET_STAT_INC(ifp, ipackets, 1);
940 
941 	switch (family) {
942 #ifdef INET
943 	case AF_INET:
944 		isr = NETISR_IP;
945 		break;
946 #endif
947 #ifdef INET6
948 	case AF_INET6:
949 		isr = NETISR_IPV6;
950 		break;
951 #endif
952 	default:
953 		m_freem(m);
954 		return (EAFNOSUPPORT);
955 	}
956 
957 	netisr_queue(isr, top);
958 	return (0);
959 }
960 
961 
962 /*
963  * tunkqfilter - support for the kevent() system call.
964  */
965 static int
966 tunkqfilter(struct dev_kqfilter_args *ap)
967 {
968 	cdev_t dev = ap->a_head.a_dev;
969 	struct tun_softc *sc = dev->si_drv1;
970 	struct ifnet *ifp = sc->tun_ifp;
971 	struct knote *kn = ap->a_kn;
972 	struct klist *klist;
973 
974 	ap->a_result = 0;
975 	ifnet_serialize_all(ifp);
976 
977 	switch (kn->kn_filter) {
978 	case EVFILT_READ:
979 		kn->kn_fop = &tun_read_filtops;
980 		kn->kn_hook = (caddr_t)sc;
981 		break;
982 	case EVFILT_WRITE:
983 		kn->kn_fop = &tun_write_filtops;
984 		kn->kn_hook = (caddr_t)sc;
985 		break;
986 	default:
987 		ifnet_deserialize_all(ifp);
988 		ap->a_result = EOPNOTSUPP;
989 		return (0);
990 	}
991 
992 	klist = &sc->tun_rkq.ki_note;
993 	knote_insert(klist, kn);
994 	ifnet_deserialize_all(ifp);
995 
996 	return (0);
997 }
998 
999 static void
1000 tun_filter_detach(struct knote *kn)
1001 {
1002 	struct tun_softc *sc = (struct tun_softc *)kn->kn_hook;
1003 	struct klist *klist = &sc->tun_rkq.ki_note;
1004 
1005 	knote_remove(klist, kn);
1006 }
1007 
1008 static int
1009 tun_filter_write(struct knote *kn, long hint)
1010 {
1011 	/* Always ready for a write */
1012 	return (1);
1013 }
1014 
1015 static int
1016 tun_filter_read(struct knote *kn, long hint)
1017 {
1018 	struct tun_softc *sc = (struct tun_softc *)kn->kn_hook;
1019 	struct ifnet *ifp = sc->tun_ifp;
1020 	int ready = 0;
1021 
1022 	ifnet_serialize_all(ifp);
1023 	if (!ifsq_is_empty(ifq_get_subq_default(&ifp->if_snd)))
1024 		ready = 1;
1025 	ifnet_deserialize_all(ifp);
1026 
1027 	return (ready);
1028 }
1029