xref: /dragonfly/sys/net/tun/if_tun.c (revision c70d4562)
1 /*	$NetBSD: if_tun.c,v 1.14 1994/06/29 06:36:25 cgd Exp $	*/
2 
3 /*
4  * Copyright (c) 1988, Julian Onions <jpo@cs.nott.ac.uk>
5  * Nottingham University 1987.
6  *
7  * This source may be freely distributed, however I would be interested
8  * in any changes that are made.
9  *
10  * This driver takes packets off the IP i/f and hands them up to a
11  * user process to have its wicked way with. This driver has it's
12  * roots in a similar driver written by Phil Cockcroft (formerly) at
13  * UCL. This driver is based much more on read/write/poll mode of
14  * operation though.
15  *
16  * $FreeBSD: src/sys/net/if_tun.c,v 1.74.2.8 2002/02/13 00:43:11 dillon Exp $
17  */
18 
19 #include "use_tun.h"
20 #include "opt_inet.h"
21 #include "opt_inet6.h"
22 
23 #include <sys/param.h>
24 #include <sys/proc.h>
25 #include <sys/priv.h>
26 #include <sys/systm.h>
27 #include <sys/mbuf.h>
28 #include <sys/socket.h>
29 #include <sys/conf.h>
30 #include <sys/device.h>
31 #include <sys/filio.h>
32 #include <sys/sockio.h>
33 #include <sys/thread2.h>
34 #include <sys/ttycom.h>
35 #include <sys/signalvar.h>
36 #include <sys/filedesc.h>
37 #include <sys/kernel.h>
38 #include <sys/sysctl.h>
39 #include <sys/uio.h>
40 #include <sys/vnode.h>
41 #include <sys/malloc.h>
42 #include <sys/mplock2.h>
43 #include <sys/devfs.h>
44 #include <sys/queue.h>
45 
46 #include <net/bpf.h>
47 #include <net/if.h>
48 #include <net/if_types.h>
49 #include <net/if_clone.h>
50 #include <net/ifq_var.h>
51 #include <net/netisr.h>
52 #include <net/route.h>
53 
54 #ifdef INET
55 #include <netinet/in.h>
56 #endif
57 
58 #include "if_tunvar.h"
59 #include "if_tun.h"
60 
61 #if NTUN <= 1
62 #define TUN_PREALLOCATED_UNITS	4
63 #else
64 #define TUN_PREALLOCATED_UNITS	NTUN
65 #endif
66 
67 #define TUN		"tun"
68 #define TUNDEBUG	if (tundebug) if_printf
69 
70 /* module */
71 static int		tunmodevent(module_t, int, void *);
72 
73 /* device */
74 static struct tun_softc *tuncreate(cdev_t, int);
75 static void		tundestroy(struct tun_softc *sc);
76 
77 /* clone */
78 static int		tun_clone_create(struct if_clone *, int, caddr_t);
79 static int		tun_clone_destroy(struct ifnet *);
80 
81 /* network interface */
82 static int		tunifinit(struct ifnet *);
83 static void		tunifstart(struct ifnet *, struct ifaltq_subque *);
84 static int		tunifoutput(struct ifnet *, struct mbuf *,
85 				    struct sockaddr *, struct rtentry *rt);
86 static int		tunifioctl(struct ifnet *, u_long,
87 				   caddr_t, struct ucred *);
88 
89 /* character device */
90 static d_open_t		tunopen;
91 static d_close_t	tunclose;
92 static d_read_t		tunread;
93 static d_write_t	tunwrite;
94 static d_ioctl_t	tunioctl;
95 static d_kqfilter_t	tunkqfilter;
96 static d_clone_t	tunclone;
97 
98 static struct dev_ops	tun_ops = {
99 	{ TUN, 0, 0 },
100 	.d_open =	tunopen,
101 	.d_close =	tunclose,
102 	.d_read =	tunread,
103 	.d_write =	tunwrite,
104 	.d_ioctl =	tunioctl,
105 	.d_kqfilter =	tunkqfilter
106 };
107 
108 /* kqueue support */
109 static void		tun_filter_detach(struct knote *);
110 static int		tun_filter_read(struct knote *, long);
111 static int		tun_filter_write(struct knote *, long);
112 
113 static struct filterops tun_read_filtops = {
114 	FILTEROP_ISFD,
115 	NULL,
116 	tun_filter_detach,
117 	tun_filter_read
118 };
119 static struct filterops tun_write_filtops = {
120 	FILTEROP_ISFD,
121 	NULL,
122 	tun_filter_detach,
123 	tun_filter_write
124 };
125 
126 static int		tundebug = 0;	/* debug flag */
127 static int		tunrefcnt = 0;	/* module reference counter */
128 
129 static MALLOC_DEFINE(M_TUN, TUN, "Tunnel Interface");
130 
131 static DEVFS_DEFINE_CLONE_BITMAP(tun);
132 
133 struct if_clone tun_cloner = IF_CLONE_INITIALIZER(
134 	TUN, tun_clone_create, tun_clone_destroy, 0, IF_MAXUNIT);
135 
136 static SLIST_HEAD(,tun_softc) tun_listhead =
137 	SLIST_HEAD_INITIALIZER(&tun_listhead);
138 
139 SYSCTL_INT(_debug, OID_AUTO, if_tun_debug, CTLFLAG_RW, &tundebug, 0,
140 	   "Enable debug output");
141 SYSCTL_DECL(_net_link);
142 SYSCTL_NODE(_net_link, OID_AUTO, tun, CTLFLAG_RW, 0,
143 	    "IP tunnel software network interface");
144 SYSCTL_INT(_net_link_tun, OID_AUTO, debug, CTLFLAG_RW, &tundebug, 0,
145 	   "Enable debug output");
146 SYSCTL_INT(_net_link_tun, OID_AUTO, refcnt, CTLFLAG_RD, &tunrefcnt, 0,
147 	   "Number of opened devices");
148 
149 DEV_MODULE(if_tun, tunmodevent, NULL);
150 
151 /*
152  * tunmodevent - module event handler
153  */
154 static int
155 tunmodevent(module_t mod, int type, void *data)
156 {
157 	static cdev_t dev = NULL;
158 	struct tun_softc *sc, *sc_tmp;
159 	int i;
160 
161 	switch (type) {
162 	case MOD_LOAD:
163 		dev = make_autoclone_dev(&tun_ops, &DEVFS_CLONE_BITMAP(tun),
164 					 tunclone, UID_UUCP, GID_DIALER,
165 					 0600, TUN);
166 
167 		SLIST_INIT(&tun_listhead);
168 		if_clone_attach(&tun_cloner);
169 
170 		for (i = 0; i < TUN_PREALLOCATED_UNITS; ++i) {
171 			make_dev(&tun_ops, i, UID_UUCP, GID_DIALER,
172 				 0600, "%s%d", TUN, i);
173 			devfs_clone_bitmap_set(&DEVFS_CLONE_BITMAP(tun), i);
174 		}
175 		break;
176 
177 	case MOD_UNLOAD:
178 		if (tunrefcnt > 0)
179 			return (EBUSY);
180 
181 		if_clone_detach(&tun_cloner);
182 
183 		SLIST_FOREACH_MUTABLE(sc, &tun_listhead, tun_link, sc_tmp)
184 			tundestroy(sc);
185 
186 		dev_ops_remove_all(&tun_ops);
187 		destroy_autoclone_dev(dev, &DEVFS_CLONE_BITMAP(tun));
188 		break;
189 
190 	default:
191 		return (EOPNOTSUPP);
192 	}
193 
194 	return (0);
195 }
196 
197 static int
198 tunclone(struct dev_clone_args *ap)
199 {
200 	int unit;
201 
202 	unit = devfs_clone_bitmap_get(&DEVFS_CLONE_BITMAP(tun), 0);
203 	ap->a_dev = make_only_dev(&tun_ops, unit, UID_UUCP, GID_DIALER,
204 				  0600, "%s%d", TUN, unit);
205 
206 	if (tuncreate(ap->a_dev, 0) == NULL)
207 		return (ENOMEM);
208 	else
209 		return (0);
210 }
211 
212 static struct tun_softc *
213 tuncreate(cdev_t dev, int flags)
214 {
215 	struct tun_softc *sc;
216 	struct ifnet *ifp;
217 	int unit = minor(dev);
218 
219 	sc = kmalloc(sizeof(*sc), M_TUN, M_WAITOK | M_ZERO);
220 	dev->si_drv1 = sc;
221 	sc->tun_dev = dev;
222 	sc->tun_flags = TUN_INITED;
223 	sc->tun_flags |= flags;
224 
225 	reference_dev(dev);  /* device association */
226 
227 	ifp = sc->tun_ifp = if_alloc(IFT_PPP);
228 	if (ifp == NULL) {
229 		kprintf("%s: failed to if_alloc() interface for %s%d",
230 			__func__, TUN, unit);
231 		return (NULL);
232 	}
233 
234 	if_initname(ifp, TUN, unit);
235 	ifp->if_mtu = TUNMTU;
236 	ifp->if_ioctl = tunifioctl;
237 	ifp->if_output = tunifoutput;
238 	ifp->if_start = tunifstart;
239 	ifp->if_flags = IFF_POINTOPOINT | IFF_MULTICAST;
240 	ifp->if_type = IFT_PPP;
241 	ifp->if_softc = sc;
242 	ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
243 	ifq_set_ready(&ifp->if_snd);
244 
245 	if_attach(ifp, NULL);
246 	bpfattach(ifp, DLT_NULL, sizeof(u_int));
247 
248 	SLIST_INSERT_HEAD(&tun_listhead, sc, tun_link);
249 	TUNDEBUG(ifp, "created, minor = %#x, flags = 0x%x\n",
250 		 unit, sc->tun_flags);
251 	return (sc);
252 }
253 
254 static void
255 tundestroy(struct tun_softc *sc)
256 {
257 	cdev_t dev = sc->tun_dev;
258 	struct ifnet *ifp = sc->tun_ifp;
259 	int unit = minor(dev);
260 
261 	TUNDEBUG(ifp, "destroyed, minor = %#x. Module refcnt = %d\n",
262 		 unit, tunrefcnt);
263 
264 	bpfdetach(ifp);
265 	if_detach(ifp);
266 	if_free(ifp);
267 
268 	sc->tun_dev = NULL;
269 	dev->si_drv1 = NULL;
270 	release_dev(dev);  /* device disassociation */
271 
272 	/* Also destroy the cloned device */
273 	if (unit >= TUN_PREALLOCATED_UNITS) {
274 		destroy_dev(dev);
275 		devfs_clone_bitmap_put(&DEVFS_CLONE_BITMAP(tun), unit);
276 	}
277 
278 	SLIST_REMOVE(&tun_listhead, sc, tun_softc, tun_link);
279 	kfree(sc, M_TUN);
280 }
281 
282 /*
283  * tunnel open - must be superuser & the device must be configured in
284  */
285 static int
286 tunopen(struct dev_open_args *ap)
287 {
288 	cdev_t dev = ap->a_head.a_dev;
289 	struct ifnet *ifp;
290 	struct tun_softc *sc;
291 	int error;
292 
293 	if ((error = priv_check_cred(ap->a_cred, PRIV_ROOT, 0)) != 0)
294 		return (error);
295 
296 	sc = dev->si_drv1;
297 	if (sc == NULL && (sc = tuncreate(dev, TUN_MANUALMAKE)) == NULL)
298 		return (ENOMEM);
299 	if (sc->tun_flags & TUN_OPEN)
300 		return (EBUSY);
301 
302 	ifp = sc->tun_ifp;
303 	if ((sc->tun_flags & TUN_CLONE) == 0) {
304 		EVENTHANDLER_INVOKE(ifnet_attach_event, ifp);
305 
306 		/* Announce the return of the interface. */
307 		rt_ifannouncemsg(ifp, IFAN_ARRIVAL);
308 	}
309 
310 	sc->tun_pid = curproc->p_pid;
311 	sc->tun_flags |= TUN_OPEN;
312 	tunrefcnt++;
313 
314 	TUNDEBUG(ifp, "opened, minor = %#x. Module refcnt = %d\n",
315 		 minor(dev), tunrefcnt);
316 	return (0);
317 }
318 
319 /*
320  * close the device - mark interface down & delete routing info
321  */
322 static int
323 tunclose(struct dev_close_args *ap)
324 {
325 	cdev_t dev = ap->a_head.a_dev;
326 	struct tun_softc *sc = dev->si_drv1;
327 	struct ifnet *ifp = sc->tun_ifp;
328 	int unit = minor(dev);
329 
330 	sc->tun_flags &= ~TUN_OPEN;
331 	sc->tun_pid = 0;
332 
333 	/* Junk all pending output. */
334 	ifq_purge_all(&ifp->if_snd);
335 
336 	if (ifp->if_flags & IFF_UP)
337 		if_down(ifp);
338 	ifp->if_flags &= ~IFF_RUNNING;
339 
340 	if ((sc->tun_flags & TUN_CLONE) == 0) {
341 		if_purgeaddrs_nolink(ifp);
342 
343 		EVENTHANDLER_INVOKE(ifnet_detach_event, ifp);
344 
345 		/* Announce the departure of the interface. */
346 		rt_ifannouncemsg(ifp, IFAN_DEPARTURE);
347 	}
348 
349 	funsetown(&sc->tun_sigio);
350 	KNOTE(&sc->tun_rkq.ki_note, 0);
351 
352 	tunrefcnt--;
353 	if (tunrefcnt < 0) {
354 		tunrefcnt = 0;
355 		if_printf(ifp, ". Module refcnt = %d is out of sync! "
356 			  "Force refcnt to be 0.\n", tunrefcnt);
357 	}
358 
359 	TUNDEBUG(ifp, "closed, minor = %#x. Module refcnt = %d\n",
360 		 unit, tunrefcnt);
361 
362 	/* Only auto-destroy if the interface was not manually created. */
363 	if ((sc->tun_flags & TUN_MANUALMAKE) == 0 &&
364 	    unit >= TUN_PREALLOCATED_UNITS) {
365 		tundestroy(sc);
366 		dev->si_drv1 = NULL;
367 	}
368 
369 	return (0);
370 }
371 
372 
373 /*
374  * Interface clone support
375  *
376  * Create and destroy tun device/interface via ifconfig(8).
377  */
378 
379 static struct tun_softc *
380 tunfind(int unit)
381 {
382 	struct tun_softc *sc;
383 
384 	SLIST_FOREACH(sc, &tun_listhead, tun_link) {
385 		if (minor(sc->tun_dev) == unit)
386 			return (sc);
387 	}
388 	return (NULL);
389 }
390 
391 static int
392 tun_clone_create(struct if_clone *ifc __unused, int unit,
393 		 caddr_t param __unused)
394 {
395 	struct tun_softc *sc;
396 	cdev_t dev;
397 
398 	sc = tunfind(unit);
399 	if (sc == NULL) {
400 		if (!devfs_clone_bitmap_chk(&DEVFS_CLONE_BITMAP(tun), unit)) {
401 			devfs_clone_bitmap_set(&DEVFS_CLONE_BITMAP(tun), unit);
402 			dev = make_dev(&tun_ops, unit, UID_UUCP, GID_DIALER,
403 				       0600, "%s%d", TUN, unit);
404 		} else {
405 			dev = devfs_find_device_by_name("%s%d", TUN, unit);
406 		}
407 
408 		if (dev == NULL)
409 			return (ENODEV);
410 		if ((sc = tuncreate(dev, TUN_MANUALMAKE)) == NULL)
411 			return (ENOMEM);
412 	}
413 
414 	sc->tun_flags |= TUN_CLONE;
415 	TUNDEBUG(sc->tun_ifp, "clone created, minor = %#x, flags = 0x%x\n",
416 		 minor(sc->tun_dev), sc->tun_flags);
417 
418 	return (0);
419 }
420 
421 static int
422 tun_clone_destroy(struct ifnet * ifp)
423 {
424 	struct tun_softc *sc = ifp->if_softc;
425 
426 	if ((sc->tun_flags & TUN_CLONE) == 0)
427 		return (ENXIO);
428 
429 	TUNDEBUG(ifp, "clone destroyed, minor = %#x, flags = 0x%x\n",
430 		 minor(sc->tun_dev), sc->tun_flags);
431 	tundestroy(sc);
432 
433 	return (0);
434 }
435 
436 
437 /*
438  * Network interface functions
439  */
440 
441 static int
442 tunifinit(struct ifnet *ifp)
443 {
444 #ifdef INET
445 	struct tun_softc *sc = ifp->if_softc;
446 #endif
447 	struct ifaddr_container *ifac;
448 	int error = 0;
449 
450 	TUNDEBUG(ifp, "initialize\n");
451 
452 	ifp->if_flags |= IFF_UP | IFF_RUNNING;
453 	getmicrotime(&ifp->if_lastchange);
454 
455 	TAILQ_FOREACH(ifac, &ifp->if_addrheads[mycpuid], ifa_link) {
456 		struct ifaddr *ifa = ifac->ifa;
457 
458 		if (ifa->ifa_addr == NULL) {
459 			error = EFAULT;
460 			/* XXX: Should maybe return straight off? */
461 		} else {
462 #ifdef INET
463 			if (ifa->ifa_addr->sa_family == AF_INET) {
464 				struct sockaddr_in *si;
465 
466 				si = (struct sockaddr_in *)ifa->ifa_addr;
467 				if (si->sin_addr.s_addr)
468 					sc->tun_flags |= TUN_IASET;
469 			}
470 #endif
471 		}
472 	}
473 	return (error);
474 }
475 
476 /*
477  * Process an ioctl request.
478  *
479  * MPSAFE
480  */
481 static int
482 tunifioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
483 {
484 	struct ifreq *ifr = (struct ifreq *)data;
485 	struct tun_softc *sc = ifp->if_softc;
486 	struct ifstat *ifs;
487 	int error = 0;
488 
489 	switch (cmd) {
490 	case SIOCGIFSTATUS:
491 		ifs = (struct ifstat *)data;
492 		if (sc->tun_pid)
493 			ksprintf(ifs->ascii + strlen(ifs->ascii),
494 			    "\tOpened by PID %d\n", sc->tun_pid);
495 		break;
496 	case SIOCSIFADDR:
497 		error = tunifinit(ifp);
498 		TUNDEBUG(ifp, "address set, error=%d\n", error);
499 		break;
500 	case SIOCSIFDSTADDR:
501 		error = tunifinit(ifp);
502 		TUNDEBUG(ifp, "destination address set, error=%d\n", error);
503 		break;
504 	case SIOCSIFMTU:
505 		ifp->if_mtu = ifr->ifr_mtu;
506 		TUNDEBUG(ifp, "mtu set\n");
507 		break;
508 	case SIOCSIFFLAGS:
509 	case SIOCADDMULTI:
510 	case SIOCDELMULTI:
511 		break;
512 	default:
513 		error = EINVAL;
514 	}
515 	return (error);
516 }
517 
518 /*
519  * Start packet transmission on the interface.
520  * when the interface queue is rate-limited by ALTQ,
521  * if_start is needed to drain packets from the queue in order
522  * to notify readers when outgoing packets become ready.
523  */
524 static void
525 tunifstart(struct ifnet *ifp, struct ifaltq_subque *ifsq)
526 {
527 	struct tun_softc *sc = ifp->if_softc;
528 	struct mbuf *m;
529 
530 	ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
531 
532 	if (!ifq_is_enabled(&ifp->if_snd))
533 		return;
534 
535 	m = ifsq_poll(ifsq);
536 	if (m != NULL) {
537 		if (sc->tun_flags & TUN_RWAIT) {
538 			sc->tun_flags &= ~TUN_RWAIT;
539 			wakeup((caddr_t)sc);
540 		}
541 		if (sc->tun_flags & TUN_ASYNC && sc->tun_sigio)
542 			pgsigio(sc->tun_sigio, SIGIO, 0);
543 		ifsq_deserialize_hw(ifsq);
544 		KNOTE(&sc->tun_rkq.ki_note, 0);
545 		ifsq_serialize_hw(ifsq);
546 	}
547 }
548 
549 /*
550  * tunifoutput - queue packets from higher level ready to put out.
551  *
552  * MPSAFE
553  */
554 static int
555 tunifoutput_serialized(struct ifnet *ifp, struct mbuf *m0,
556 		       struct sockaddr *dst, struct rtentry *rt)
557 {
558 	struct tun_softc *sc = ifp->if_softc;
559 	int error;
560 	struct altq_pktattr pktattr;
561 
562 	TUNDEBUG(ifp, "output\n");
563 
564 	if ((sc->tun_flags & TUN_READY) != TUN_READY) {
565 		TUNDEBUG(ifp, "not ready, flags = 0x%x\n", sc->tun_flags);
566 		m_freem (m0);
567 		return (EHOSTDOWN);
568 	}
569 
570 	/*
571 	 * if the queueing discipline needs packet classification,
572 	 * do it before prepending link headers.
573 	 */
574 	ifq_classify(&ifp->if_snd, m0, dst->sa_family, &pktattr);
575 
576 	/* BPF write needs to be handled specially */
577 	if (dst->sa_family == AF_UNSPEC) {
578 		dst->sa_family = *(mtod(m0, int *));
579 		m0->m_len -= sizeof(int);
580 		m0->m_pkthdr.len -= sizeof(int);
581 		m0->m_data += sizeof(int);
582 	}
583 
584 	if (ifp->if_bpf) {
585 		bpf_gettoken();
586 		if (ifp->if_bpf) {
587 			/*
588 			 * We need to prepend the address family as
589 			 * a four byte field.
590 			 */
591 			uint32_t af = dst->sa_family;
592 
593 			bpf_ptap(ifp->if_bpf, m0, &af, sizeof(af));
594 		}
595 		bpf_reltoken();
596 	}
597 
598 	/* prepend sockaddr? this may abort if the mbuf allocation fails */
599 	if (sc->tun_flags & TUN_LMODE) {
600 		/* allocate space for sockaddr */
601 		M_PREPEND(m0, dst->sa_len, M_NOWAIT);
602 
603 		/* if allocation failed drop packet */
604 		if (m0 == NULL){
605 			IFNET_STAT_INC(ifp, oerrors, 1);
606 			return (ENOBUFS);
607 		} else {
608 			bcopy(dst, m0->m_data, dst->sa_len);
609 		}
610 	}
611 
612 	if (sc->tun_flags & TUN_IFHEAD) {
613 		/* Prepend the address family */
614 		M_PREPEND(m0, 4, M_NOWAIT);
615 
616 		/* if allocation failed drop packet */
617 		if (m0 == NULL){
618 			IFNET_STAT_INC(ifp, oerrors, 1);
619 			return (ENOBUFS);
620 		} else {
621 			*(u_int32_t *)m0->m_data = htonl(dst->sa_family);
622 		}
623 	} else {
624 #ifdef INET
625 		if (dst->sa_family != AF_INET)
626 #endif
627 		{
628 			m_freem(m0);
629 			return (EAFNOSUPPORT);
630 		}
631 	}
632 
633 	error = ifq_handoff(ifp, m0, &pktattr);
634 	if (error) {
635 		IFNET_STAT_INC(ifp, collisions, 1);
636 	} else {
637 		IFNET_STAT_INC(ifp, opackets, 1);
638 		if (sc->tun_flags & TUN_RWAIT) {
639 			sc->tun_flags &= ~TUN_RWAIT;
640 			wakeup((caddr_t)sc);
641 		}
642 		get_mplock();
643 		if (sc->tun_flags & TUN_ASYNC && sc->tun_sigio)
644 			pgsigio(sc->tun_sigio, SIGIO, 0);
645 		rel_mplock();
646 		ifnet_deserialize_all(ifp);
647 		KNOTE(&sc->tun_rkq.ki_note, 0);
648 		ifnet_serialize_all(ifp);
649 	}
650 	return (error);
651 }
652 
653 static int
654 tunifoutput(struct ifnet *ifp, struct mbuf *m0, struct sockaddr *dst,
655 	    struct rtentry *rt)
656 {
657 	int error;
658 
659 	ifnet_serialize_all(ifp);
660 	error = tunifoutput_serialized(ifp, m0, dst, rt);
661 	ifnet_deserialize_all(ifp);
662 
663 	return (error);
664 }
665 
666 
667 /*
668  * the ops interface is now pretty minimal.
669  */
670 static int
671 tunioctl(struct dev_ioctl_args *ap)
672 {
673 	cdev_t dev = ap->a_head.a_dev;
674 	caddr_t data = ap->a_data;
675 	struct tun_softc *sc = dev->si_drv1;
676 	struct ifnet *ifp = sc->tun_ifp;
677 	struct ifreq *ifr;
678 	struct tuninfo *tunp;
679 	int error = 0;
680 
681 	switch (ap->a_cmd) {
682 	case TUNSIFINFO:
683 		tunp = (struct tuninfo *)data;
684 		if (ifp->if_type != tunp->type)
685 			return (EPROTOTYPE);
686 		if (tunp->mtu < IF_MINMTU)
687 			return (EINVAL);
688 		ifp->if_mtu = tunp->mtu;
689 		ifp->if_baudrate = tunp->baudrate;
690 		break;
691 
692 	case TUNGIFINFO:
693 		tunp = (struct tuninfo *)data;
694 		tunp->mtu = ifp->if_mtu;
695 		tunp->type = ifp->if_type;
696 		tunp->baudrate = ifp->if_baudrate;
697 		break;
698 
699 	case TUNGIFNAME:
700 		ifr = (struct ifreq *)data;
701 		strlcpy(ifr->ifr_name, ifp->if_xname, IFNAMSIZ);
702 		break;
703 
704 	case TUNSDEBUG:
705 		tundebug = *(int *)data;
706 		break;
707 
708 	case TUNGDEBUG:
709 		*(int *)data = tundebug;
710 		break;
711 
712 	case TUNSLMODE:
713 		if (*(int *)data) {
714 			sc->tun_flags |= TUN_LMODE;
715 			sc->tun_flags &= ~TUN_IFHEAD;
716 		} else {
717 			sc->tun_flags &= ~TUN_LMODE;
718 		}
719 		break;
720 
721 	case TUNSIFHEAD:
722 		if (*(int *)data) {
723 			sc->tun_flags |= TUN_IFHEAD;
724 			sc->tun_flags &= ~TUN_LMODE;
725 		} else {
726 			sc->tun_flags &= ~TUN_IFHEAD;
727 		}
728 		break;
729 
730 	case TUNGIFHEAD:
731 		*(int *)data = (sc->tun_flags & TUN_IFHEAD) ? 1 : 0;
732 		break;
733 
734 	case TUNSIFMODE:
735 		/* deny this if UP */
736 		if (ifp->if_flags & IFF_UP)
737 			return (EBUSY);
738 
739 		switch (*(int *)data & ~IFF_MULTICAST) {
740 		case IFF_POINTOPOINT:
741 		case IFF_BROADCAST:
742 			ifp->if_flags &= ~(IFF_BROADCAST | IFF_POINTOPOINT);
743 			ifp->if_flags |= *(int *)data;
744 			break;
745 		default:
746 			return (EINVAL);
747 		}
748 		break;
749 
750 	case TUNSIFPID:
751 		sc->tun_pid = curproc->p_pid;
752 		break;
753 
754 	case FIOASYNC:
755 		if (*(int *)data)
756 			sc->tun_flags |= TUN_ASYNC;
757 		else
758 			sc->tun_flags &= ~TUN_ASYNC;
759 		break;
760 
761 	case FIONREAD:
762 		*(int *)data = ifsq_poll_pktlen(
763 		    ifq_get_subq_default(&ifp->if_snd));
764 		break;
765 
766 	case FIOSETOWN:
767 		error = fsetown(*(int *)data, &sc->tun_sigio);
768 		break;
769 
770 	case FIOGETOWN:
771 		*(int *)data = fgetown(&sc->tun_sigio);
772 		break;
773 
774 	/* This is deprecated, FIOSETOWN should be used instead. */
775 	case TIOCSPGRP:
776 		error = fsetown(-(*(int *)data), &sc->tun_sigio);
777 		break;
778 
779 	/* This is deprecated, FIOGETOWN should be used instead. */
780 	case TIOCGPGRP:
781 		*(int *)data = -fgetown(&sc->tun_sigio);
782 		break;
783 
784 	default:
785 		error = ENOTTY;
786 		break;
787 	}
788 
789 	return (error);
790 }
791 
792 /*
793  * The ops read interface - reads a packet at a time, or at
794  * least as much of a packet as can be read.
795  */
796 static	int
797 tunread(struct dev_read_args *ap)
798 {
799 	cdev_t dev = ap->a_head.a_dev;
800 	struct uio *uio = ap->a_uio;
801 	struct tun_softc *sc = dev->si_drv1;
802 	struct ifnet *ifp = sc->tun_ifp;
803 	struct ifaltq_subque *ifsq = ifq_get_subq_default(&ifp->if_snd);
804 	struct mbuf *m0;
805 	int error=0, len;
806 
807 	TUNDEBUG(ifp, "read\n");
808 	if ((sc->tun_flags & TUN_READY) != TUN_READY) {
809 		TUNDEBUG(ifp, "not ready, flags = 0x%x\n", sc->tun_flags);
810 		return (EHOSTDOWN);
811 	}
812 
813 	sc->tun_flags &= ~TUN_RWAIT;
814 
815 	ifnet_serialize_all(ifp);
816 
817 	while ((m0 = ifsq_dequeue(ifsq)) == NULL) {
818 		if (ap->a_ioflag & IO_NDELAY) {
819 			ifnet_deserialize_all(ifp);
820 			return (EWOULDBLOCK);
821 		}
822 		sc->tun_flags |= TUN_RWAIT;
823 		ifnet_deserialize_all(ifp);
824 		if ((error = tsleep(sc, PCATCH, "tunread", 0)) != 0)
825 			return (error);
826 		ifnet_serialize_all(ifp);
827 	}
828 
829 	ifnet_deserialize_all(ifp);
830 
831 	while (m0 && uio->uio_resid > 0 && error == 0) {
832 		len = (int)szmin(uio->uio_resid, m0->m_len);
833 		if (len != 0)
834 			error = uiomove(mtod(m0, caddr_t), (size_t)len, uio);
835 		m0 = m_free(m0);
836 	}
837 
838 	if (m0) {
839 		TUNDEBUG(ifp, "dropping mbuf\n");
840 		m_freem(m0);
841 	}
842 	return (error);
843 }
844 
845 /*
846  * the ops write interface - an atomic write is a packet - or else!
847  */
848 static	int
849 tunwrite(struct dev_write_args *ap)
850 {
851 	cdev_t dev = ap->a_head.a_dev;
852 	struct uio *uio = ap->a_uio;
853 	struct tun_softc *sc = dev->si_drv1;
854 	struct ifnet *ifp = sc->tun_ifp;
855 	struct mbuf *top, **mp, *m;
856 	size_t tlen;
857 	uint32_t family, mru;
858 	int error = 0;
859 	int isr;
860 
861 	TUNDEBUG(ifp, "tunwrite\n");
862 
863 	if (uio->uio_resid == 0)
864 		return (0);
865 
866 	mru = TUNMRU;
867 	if (sc->tun_flags & TUN_IFHEAD)
868 		mru += sizeof(family);
869 	if (uio->uio_resid > mru) {
870 		TUNDEBUG(ifp, "len = %zd!\n", uio->uio_resid);
871 		return (EIO);
872 	}
873 
874 	/* get a header mbuf */
875 	MGETHDR(m, M_WAITOK, MT_DATA);
876 	if (m == NULL)
877 		return (ENOBUFS);
878 
879 	tlen = uio->uio_resid;
880 	top = NULL;
881 	mp = &top;
882 	while (error == 0 && uio->uio_resid > 0) {
883 		m->m_len = (int)szmin(MHLEN, uio->uio_resid);
884 		error = uiomove(mtod(m, caddr_t), (size_t)m->m_len, uio);
885 		*mp = m;
886 		mp = &m->m_next;
887 		if (uio->uio_resid > 0) {
888 			MGET(m, M_WAITOK, MT_DATA);
889 			if (m == NULL) {
890 				error = ENOBUFS;
891 				break;
892 			}
893 		}
894 	}
895 	if (error) {
896 		if (top)
897 			m_freem(top);
898 		IFNET_STAT_INC(ifp, ierrors, 1);
899 		return (error);
900 	}
901 
902 	top->m_pkthdr.len = (int)tlen;
903 	top->m_pkthdr.rcvif = ifp;
904 
905 	if (ifp->if_bpf) {
906 		bpf_gettoken();
907 
908 		if (ifp->if_bpf) {
909 			if (sc->tun_flags & TUN_IFHEAD) {
910 				/*
911 				 * Conveniently, we already have a 4-byte
912 				 * address family prepended to our packet !
913 				 * Inconveniently, it's in the wrong byte
914 				 * order !
915 				 */
916 				if ((top = m_pullup(top, sizeof(family)))
917 				    == NULL) {
918 					bpf_reltoken();
919 					return (ENOBUFS);
920 				}
921 				*mtod(top, u_int32_t *) =
922 				    ntohl(*mtod(top, u_int32_t *));
923 				bpf_mtap(ifp->if_bpf, top);
924 				*mtod(top, u_int32_t *) =
925 				    htonl(*mtod(top, u_int32_t *));
926 			} else {
927 				/*
928 				 * We need to prepend the address family as
929 				 * a four byte field.
930 				 */
931 				static const uint32_t af = AF_INET;
932 
933 				bpf_ptap(ifp->if_bpf, top, &af, sizeof(af));
934 			}
935 		}
936 
937 		bpf_reltoken();
938 	}
939 
940 	if (sc->tun_flags & TUN_IFHEAD) {
941 		if (top->m_len < sizeof(family) &&
942 		    (top = m_pullup(top, sizeof(family))) == NULL)
943 				return (ENOBUFS);
944 		family = ntohl(*mtod(top, u_int32_t *));
945 		m_adj(top, sizeof(family));
946 	} else {
947 		family = AF_INET;
948 	}
949 
950 	IFNET_STAT_INC(ifp, ibytes, top->m_pkthdr.len);
951 	IFNET_STAT_INC(ifp, ipackets, 1);
952 
953 	switch (family) {
954 #ifdef INET
955 	case AF_INET:
956 		isr = NETISR_IP;
957 		break;
958 #endif
959 #ifdef INET6
960 	case AF_INET6:
961 		isr = NETISR_IPV6;
962 		break;
963 #endif
964 	default:
965 		m_freem(m);
966 		return (EAFNOSUPPORT);
967 	}
968 
969 	netisr_queue(isr, top);
970 	return (0);
971 }
972 
973 
974 /*
975  * tunkqfilter - support for the kevent() system call.
976  */
977 static int
978 tunkqfilter(struct dev_kqfilter_args *ap)
979 {
980 	cdev_t dev = ap->a_head.a_dev;
981 	struct tun_softc *sc = dev->si_drv1;
982 	struct ifnet *ifp = sc->tun_ifp;
983 	struct knote *kn = ap->a_kn;
984 	struct klist *klist;
985 
986 	ap->a_result = 0;
987 	ifnet_serialize_all(ifp);
988 
989 	switch (kn->kn_filter) {
990 	case EVFILT_READ:
991 		kn->kn_fop = &tun_read_filtops;
992 		kn->kn_hook = (caddr_t)sc;
993 		break;
994 	case EVFILT_WRITE:
995 		kn->kn_fop = &tun_write_filtops;
996 		kn->kn_hook = (caddr_t)sc;
997 		break;
998 	default:
999 		ifnet_deserialize_all(ifp);
1000 		ap->a_result = EOPNOTSUPP;
1001 		return (0);
1002 	}
1003 
1004 	klist = &sc->tun_rkq.ki_note;
1005 	knote_insert(klist, kn);
1006 	ifnet_deserialize_all(ifp);
1007 
1008 	return (0);
1009 }
1010 
1011 static void
1012 tun_filter_detach(struct knote *kn)
1013 {
1014 	struct tun_softc *sc = (struct tun_softc *)kn->kn_hook;
1015 	struct klist *klist = &sc->tun_rkq.ki_note;
1016 
1017 	knote_remove(klist, kn);
1018 }
1019 
1020 static int
1021 tun_filter_write(struct knote *kn, long hint)
1022 {
1023 	/* Always ready for a write */
1024 	return (1);
1025 }
1026 
1027 static int
1028 tun_filter_read(struct knote *kn, long hint)
1029 {
1030 	struct tun_softc *sc = (struct tun_softc *)kn->kn_hook;
1031 	struct ifnet *ifp = sc->tun_ifp;
1032 	int ready = 0;
1033 
1034 	ifnet_serialize_all(ifp);
1035 	if (!ifsq_is_empty(ifq_get_subq_default(&ifp->if_snd)))
1036 		ready = 1;
1037 	ifnet_deserialize_all(ifp);
1038 
1039 	return (ready);
1040 }
1041