tun.c 53.9 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
/*
 *  TUN - Universal TUN/TAP device driver.
 *  Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 *  GNU General Public License for more details.
 *
 *  $Id: tun.c,v 1.15 2002/03/01 02:44:24 maxk Exp $
 */

/*
 *  Changes:
 *
21 22 23
 *  Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14
 *    Add TUNSETLINK ioctl to set the link encapsulation
 *
L
Linus Torvalds 已提交
24
 *  Mark Smith <markzzzsmith@yahoo.com.au>
J
Joe Perches 已提交
25
 *    Use eth_random_addr() for tap MAC address.
L
Linus Torvalds 已提交
26 27 28 29 30 31 32 33 34 35 36
 *
 *  Harald Roelle <harald.roelle@ifi.lmu.de>  2004/04/20
 *    Fixes in packet dropping, queue length setting and queue wakeup.
 *    Increased default tx queue length.
 *    Added ethtool API.
 *    Minor cleanups
 *
 *  Daniel Podlejski <underley@underley.eu.org>
 *    Modifications for 2.3.99-pre5 kernel.
 */

37 38
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
#define DRV_NAME	"tun"
#define DRV_VERSION	"1.6"
#define DRV_DESCRIPTION	"Universal TUN/TAP device driver"
#define DRV_COPYRIGHT	"(C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>"

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/miscdevice.h>
#include <linux/ethtool.h>
#include <linux/rtnetlink.h>
58
#include <linux/compat.h>
L
Linus Torvalds 已提交
59 60 61 62 63
#include <linux/if.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/crc32.h>
64
#include <linux/nsproxy.h>
65
#include <linux/virtio_net.h>
M
Michael S. Tsirkin 已提交
66
#include <linux/rcupdate.h>
67
#include <net/net_namespace.h>
68
#include <net/netns/generic.h>
69
#include <net/rtnetlink.h>
70
#include <net/sock.h>
L
Linus Torvalds 已提交
71 72 73

#include <asm/uaccess.h>

74 75 76
/* Uncomment to enable debugging */
/* #define TUN_DEBUG 1 */

L
Linus Torvalds 已提交
77 78
#ifdef TUN_DEBUG
static int debug;
79

80 81 82 83 84 85 86 87 88 89
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (tun->debug)						\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (debug == 2)						\
		printk(level fmt, ##args);			\
} while (0)
90
#else
91 92 93 94 95 96 97 98 99 100
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (0)							\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (0)							\
		printk(level fmt, ##args);			\
} while (0)
101 102
#endif

103 104
#define GOODCOPY_LEN 128

105 106 107 108 109 110 111
#define FLT_EXACT_COUNT 8
struct tap_filter {
	unsigned int    count;    /* Number of addrs. Zero means disabled */
	u32             mask[2];  /* Mask of the hashed addrs */
	unsigned char	addr[FLT_EXACT_COUNT][ETH_ALEN];
};

112 113 114 115
/* DEFAULT_MAX_NUM_RSS_QUEUES were choosed to let the rx/tx queues allocated for
 * the netdevice to be fit in one page. So we can make sure the success of
 * memory allocation. TODO: increase the limit. */
#define MAX_TAP_QUEUES DEFAULT_MAX_NUM_RSS_QUEUES
116
#define MAX_TAP_FLOWS  4096
J
Jason Wang 已提交
117

J
Jason Wang 已提交
118 119
#define TUN_FLOW_EXPIRE (3 * HZ)

J
Jason Wang 已提交
120 121 122 123
/* A tun_file connects an open character device to a tuntap netdevice. It
 * also contains all socket related strctures (except sock_fprog and tap_filter)
 * to serve as one transmit queue for tuntap device. The sock_fprog and
 * tap_filter were kept in tun_struct since they were used for filtering for the
R
Rami Rosen 已提交
124
 * netdevice not for a specific queue (at least I didn't see the requirement for
J
Jason Wang 已提交
125
 * this).
126 127
 *
 * RCU usage:
R
Rami Rosen 已提交
128
 * The tun_file and tun_struct are loosely coupled, the pointer from one to the
129
 * other can only be read while rcu_read_lock or rtnl_lock is held.
J
Jason Wang 已提交
130
 */
E
Eric W. Biederman 已提交
131
struct tun_file {
J
Jason Wang 已提交
132 133 134
	struct sock sk;
	struct socket socket;
	struct socket_wq wq;
135
	struct tun_struct __rcu *tun;
E
Eric W. Biederman 已提交
136
	struct net *net;
J
Jason Wang 已提交
137 138 139
	struct fasync_struct *fasync;
	/* only used for fasnyc */
	unsigned int flags;
J
Jason Wang 已提交
140
	u16 queue_index;
J
Jason Wang 已提交
141 142
	struct list_head next;
	struct tun_struct *detached;
E
Eric W. Biederman 已提交
143 144
};

J
Jason Wang 已提交
145 146 147 148 149 150 151 152 153 154 155 156
struct tun_flow_entry {
	struct hlist_node hash_link;
	struct rcu_head rcu;
	struct tun_struct *tun;

	u32 rxhash;
	int queue_index;
	unsigned long updated;
};

#define TUN_NUM_FLOW_ENTRIES 1024

J
Jason Wang 已提交
157
/* Since the socket were moved to tun_file, to preserve the behavior of persist
R
Rami Rosen 已提交
158
 * device, socket filter, sndbuf and vnet header size were restore when the
J
Jason Wang 已提交
159 160
 * file were attached to a persist device.
 */
161
struct tun_struct {
J
Jason Wang 已提交
162 163
	struct tun_file __rcu	*tfiles[MAX_TAP_QUEUES];
	unsigned int            numqueues;
164
	unsigned int 		flags;
165 166
	kuid_t			owner;
	kgid_t			group;
167 168

	struct net_device	*dev;
169
	netdev_features_t	set_features;
170 171
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
			  NETIF_F_TSO6|NETIF_F_UFO)
172 173

	int			vnet_hdr_sz;
J
Jason Wang 已提交
174 175 176 177 178
	int			sndbuf;
	struct tap_filter	txflt;
	struct sock_fprog	fprog;
	/* protected by rtnl lock */
	bool			filter_attached;
179 180
#ifdef TUN_DEBUG
	int debug;
L
Linus Torvalds 已提交
181
#endif
J
Jason Wang 已提交
182 183 184 185
	spinlock_t lock;
	struct hlist_head flows[TUN_NUM_FLOW_ENTRIES];
	struct timer_list flow_gc_timer;
	unsigned long ageing_time;
J
Jason Wang 已提交
186 187
	unsigned int numdisabled;
	struct list_head disabled;
188
	void *security;
189
	u32 flow_count;
190
};
L
Linus Torvalds 已提交
191

J
Jason Wang 已提交
192 193 194 195 196 197 198 199 200
static inline u32 tun_hashfn(u32 rxhash)
{
	return rxhash & 0x3ff;
}

static struct tun_flow_entry *tun_flow_find(struct hlist_head *head, u32 rxhash)
{
	struct tun_flow_entry *e;

201
	hlist_for_each_entry_rcu(e, head, hash_link) {
J
Jason Wang 已提交
202 203 204 205 206 207 208 209 210 211
		if (e->rxhash == rxhash)
			return e;
	}
	return NULL;
}

static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
					      struct hlist_head *head,
					      u32 rxhash, u16 queue_index)
{
212 213
	struct tun_flow_entry *e = kmalloc(sizeof(*e), GFP_ATOMIC);

J
Jason Wang 已提交
214 215 216 217 218 219 220 221
	if (e) {
		tun_debug(KERN_INFO, tun, "create flow: hash %u index %u\n",
			  rxhash, queue_index);
		e->updated = jiffies;
		e->rxhash = rxhash;
		e->queue_index = queue_index;
		e->tun = tun;
		hlist_add_head_rcu(&e->hash_link, head);
222
		++tun->flow_count;
J
Jason Wang 已提交
223 224 225 226 227 228 229 230 231
	}
	return e;
}

static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
{
	tun_debug(KERN_INFO, tun, "delete flow: hash %u index %u\n",
		  e->rxhash, e->queue_index);
	hlist_del_rcu(&e->hash_link);
232
	kfree_rcu(e, rcu);
233
	--tun->flow_count;
J
Jason Wang 已提交
234 235 236 237 238 239 240 241 242
}

static void tun_flow_flush(struct tun_struct *tun)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
243
		struct hlist_node *n;
J
Jason Wang 已提交
244

245
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link)
J
Jason Wang 已提交
246 247 248 249 250 251 252 253 254 255 256 257
			tun_flow_delete(tun, e);
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_delete_by_queue(struct tun_struct *tun, u16 queue_index)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
258
		struct hlist_node *n;
J
Jason Wang 已提交
259

260
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
J
Jason Wang 已提交
261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280
			if (e->queue_index == queue_index)
				tun_flow_delete(tun, e);
		}
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_cleanup(unsigned long data)
{
	struct tun_struct *tun = (struct tun_struct *)data;
	unsigned long delay = tun->ageing_time;
	unsigned long next_timer = jiffies + delay;
	unsigned long count = 0;
	int i;

	tun_debug(KERN_INFO, tun, "tun_flow_cleanup\n");

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
281
		struct hlist_node *n;
J
Jason Wang 已提交
282

283
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
J
Jason Wang 已提交
284 285 286 287 288 289 290 291 292 293 294 295 296 297 298
			unsigned long this_timer;
			count++;
			this_timer = e->updated + delay;
			if (time_before_eq(this_timer, jiffies))
				tun_flow_delete(tun, e);
			else if (time_before(this_timer, next_timer))
				next_timer = this_timer;
		}
	}

	if (count)
		mod_timer(&tun->flow_gc_timer, round_jiffies_up(next_timer));
	spin_unlock_bh(&tun->lock);
}

299
static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
300
			    struct tun_file *tfile)
J
Jason Wang 已提交
301 302 303 304
{
	struct hlist_head *head;
	struct tun_flow_entry *e;
	unsigned long delay = tun->ageing_time;
305
	u16 queue_index = tfile->queue_index;
J
Jason Wang 已提交
306 307 308 309 310 311 312 313

	if (!rxhash)
		return;
	else
		head = &tun->flows[tun_hashfn(rxhash)];

	rcu_read_lock();

314 315 316
	/* We may get a very small possibility of OOO during switching, not
	 * worth to optimize.*/
	if (tun->numqueues == 1 || tfile->detached)
J
Jason Wang 已提交
317 318 319 320 321 322 323 324 325
		goto unlock;

	e = tun_flow_find(head, rxhash);
	if (likely(e)) {
		/* TODO: keep queueing to old queue until it's empty? */
		e->queue_index = queue_index;
		e->updated = jiffies;
	} else {
		spin_lock_bh(&tun->lock);
326 327
		if (!tun_flow_find(head, rxhash) &&
		    tun->flow_count < MAX_TAP_FLOWS)
J
Jason Wang 已提交
328 329 330 331 332 333 334 335 336 337 338 339
			tun_flow_create(tun, head, rxhash, queue_index);

		if (!timer_pending(&tun->flow_gc_timer))
			mod_timer(&tun->flow_gc_timer,
				  round_jiffies_up(jiffies + delay));
		spin_unlock_bh(&tun->lock);
	}

unlock:
	rcu_read_unlock();
}

J
Jason Wang 已提交
340 341 342 343 344 345 346 347 348 349
/* We try to identify a flow through its rxhash first. The reason that
 * we do not check rxq no. is becuase some cards(e.g 82599), chooses
 * the rxq based on the txq where the last packet of the flow comes. As
 * the userspace application move between processors, we may get a
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
350
	struct tun_flow_entry *e;
J
Jason Wang 已提交
351 352 353 354 355 356 357 358
	u32 txq = 0;
	u32 numqueues = 0;

	rcu_read_lock();
	numqueues = tun->numqueues;

	txq = skb_get_rxhash(skb);
	if (txq) {
J
Jason Wang 已提交
359 360 361 362 363 364
		e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq);
		if (e)
			txq = e->queue_index;
		else
			/* use multiply and shift instead of expensive divide */
			txq = ((u64)txq * numqueues) >> 32;
J
Jason Wang 已提交
365 366 367 368 369 370 371 372 373 374
	} else if (likely(skb_rx_queue_recorded(skb))) {
		txq = skb_get_rx_queue(skb);
		while (unlikely(txq >= numqueues))
			txq -= numqueues;
	}

	rcu_read_unlock();
	return txq;
}

375 376 377
static inline bool tun_not_capable(struct tun_struct *tun)
{
	const struct cred *cred = current_cred();
378
	struct net *net = dev_net(tun->dev);
379 380 381

	return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
		  (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
382
		!ns_capable(net->user_ns, CAP_NET_ADMIN);
383 384
}

J
Jason Wang 已提交
385 386 387 388 389 390
static void tun_set_real_num_queues(struct tun_struct *tun)
{
	netif_set_real_num_tx_queues(tun->dev, tun->numqueues);
	netif_set_real_num_rx_queues(tun->dev, tun->numqueues);
}

J
Jason Wang 已提交
391 392 393 394 395 396 397
static void tun_disable_queue(struct tun_struct *tun, struct tun_file *tfile)
{
	tfile->detached = tun;
	list_add_tail(&tfile->next, &tun->disabled);
	++tun->numdisabled;
}

J
Jason Wang 已提交
398
static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
J
Jason Wang 已提交
399 400 401 402 403 404 405 406 407
{
	struct tun_struct *tun = tfile->detached;

	tfile->detached = NULL;
	list_del_init(&tfile->next);
	--tun->numdisabled;
	return tun;
}

J
Jason Wang 已提交
408 409 410 411 412 413
static void __tun_detach(struct tun_file *tfile, bool clean)
{
	struct tun_file *ntfile;
	struct tun_struct *tun;
	struct net_device *dev;

414 415
	tun = rtnl_dereference(tfile->tun);

416
	if (tun && !tfile->detached) {
J
Jason Wang 已提交
417 418 419 420 421 422
		u16 index = tfile->queue_index;
		BUG_ON(index >= tun->numqueues);
		dev = tun->dev;

		rcu_assign_pointer(tun->tfiles[index],
				   tun->tfiles[tun->numqueues - 1]);
423
		ntfile = rtnl_dereference(tun->tfiles[index]);
J
Jason Wang 已提交
424 425 426
		ntfile->queue_index = index;

		--tun->numqueues;
427 428
		if (clean) {
			rcu_assign_pointer(tfile->tun, NULL);
J
Jason Wang 已提交
429
			sock_put(&tfile->sk);
430
		} else
J
Jason Wang 已提交
431
			tun_disable_queue(tun, tfile);
J
Jason Wang 已提交
432 433

		synchronize_net();
J
Jason Wang 已提交
434
		tun_flow_delete_by_queue(tun, tun->numqueues + 1);
J
Jason Wang 已提交
435 436 437
		/* Drop read queue */
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		tun_set_real_num_queues(tun);
J
Jason Wang 已提交
438
	} else if (tfile->detached && clean) {
J
Jason Wang 已提交
439
		tun = tun_enable_queue(tfile);
J
Jason Wang 已提交
440 441
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
442 443

	if (clean) {
444 445 446 447 448
		if (tun && tun->numqueues == 0 && tun->numdisabled == 0) {
			netif_carrier_off(tun->dev);

			if (!(tun->flags & TUN_PERSIST) &&
			    tun->dev->reg_state == NETREG_REGISTERED)
J
Jason Wang 已提交
449
				unregister_netdevice(tun->dev);
450
		}
J
Jason Wang 已提交
451

J
Jason Wang 已提交
452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467
		BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
				 &tfile->socket.flags));
		sk_release_kernel(&tfile->sk);
	}
}

static void tun_detach(struct tun_file *tfile, bool clean)
{
	rtnl_lock();
	__tun_detach(tfile, clean);
	rtnl_unlock();
}

static void tun_detach_all(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
468
	struct tun_file *tfile, *tmp;
J
Jason Wang 已提交
469 470 471
	int i, n = tun->numqueues;

	for (i = 0; i < n; i++) {
472
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
473 474 475 476 477
		BUG_ON(!tfile);
		wake_up_all(&tfile->wq.wait);
		rcu_assign_pointer(tfile->tun, NULL);
		--tun->numqueues;
	}
478 479 480 481
	list_for_each_entry(tfile, &tun->disabled, next) {
		wake_up_all(&tfile->wq.wait);
		rcu_assign_pointer(tfile->tun, NULL);
	}
J
Jason Wang 已提交
482 483 484 485
	BUG_ON(tun->numqueues != 0);

	synchronize_net();
	for (i = 0; i < n; i++) {
486
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
487 488 489 490
		/* Drop read queue */
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
491 492 493 494 495 496
	list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
		tun_enable_queue(tfile);
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		sock_put(&tfile->sk);
	}
	BUG_ON(tun->numdisabled != 0);
J
Jason Wang 已提交
497 498 499

	if (tun->flags & TUN_PERSIST)
		module_put(THIS_MODULE);
J
Jason Wang 已提交
500 501
}

502 503
static int tun_attach(struct tun_struct *tun, struct file *file)
{
E
Eric W. Biederman 已提交
504
	struct tun_file *tfile = file->private_data;
505
	int err;
506

507 508 509 510
	err = security_tun_dev_attach(tfile->socket.sk, tun->security);
	if (err < 0)
		goto out;

511
	err = -EINVAL;
512
	if (rtnl_dereference(tfile->tun) && !tfile->detached)
513 514 515
		goto out;

	err = -EBUSY;
J
Jason Wang 已提交
516 517 518 519
	if (!(tun->flags & TUN_TAP_MQ) && tun->numqueues == 1)
		goto out;

	err = -E2BIG;
J
Jason Wang 已提交
520 521
	if (!tfile->detached &&
	    tun->numqueues + tun->numdisabled == MAX_TAP_QUEUES)
522 523 524
		goto out;

	err = 0;
J
Jason Wang 已提交
525

J
Jason Wang 已提交
526
	/* Re-attach the filter to presist device */
J
Jason Wang 已提交
527 528 529 530 531
	if (tun->filter_attached == true) {
		err = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (!err)
			goto out;
	}
J
Jason Wang 已提交
532
	tfile->queue_index = tun->numqueues;
533
	rcu_assign_pointer(tfile->tun, tun);
J
Jason Wang 已提交
534 535
	rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
	tun->numqueues++;
536

J
Jason Wang 已提交
537 538 539 540 541
	if (tfile->detached)
		tun_enable_queue(tfile);
	else
		sock_hold(&tfile->sk);

J
Jason Wang 已提交
542
	tun_set_real_num_queues(tun);
543

J
Jason Wang 已提交
544 545 546 547 548 549
	/* device is allowed to go away first, so no need to hold extra
	 * refcnt.
	 */

out:
	return err;
E
Eric W. Biederman 已提交
550 551 552 553
}

static struct tun_struct *__tun_get(struct tun_file *tfile)
{
554
	struct tun_struct *tun;
555

556 557 558 559 560
	rcu_read_lock();
	tun = rcu_dereference(tfile->tun);
	if (tun)
		dev_hold(tun->dev);
	rcu_read_unlock();
561 562

	return tun;
E
Eric W. Biederman 已提交
563 564 565 566 567 568 569 570 571
}

static struct tun_struct *tun_get(struct file *file)
{
	return __tun_get(file->private_data);
}

static void tun_put(struct tun_struct *tun)
{
572
	dev_put(tun->dev);
E
Eric W. Biederman 已提交
573 574
}

575
/* TAP filtering */
576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624
static void addr_hash_set(u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	mask[n >> 5] |= (1 << (n & 31));
}

static unsigned int addr_hash_test(const u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	return mask[n >> 5] & (1 << (n & 31));
}

static int update_filter(struct tap_filter *filter, void __user *arg)
{
	struct { u8 u[ETH_ALEN]; } *addr;
	struct tun_filter uf;
	int err, alen, n, nexact;

	if (copy_from_user(&uf, arg, sizeof(uf)))
		return -EFAULT;

	if (!uf.count) {
		/* Disabled */
		filter->count = 0;
		return 0;
	}

	alen = ETH_ALEN * uf.count;
	addr = kmalloc(alen, GFP_KERNEL);
	if (!addr)
		return -ENOMEM;

	if (copy_from_user(addr, arg + sizeof(uf), alen)) {
		err = -EFAULT;
		goto done;
	}

	/* The filter is updated without holding any locks. Which is
	 * perfectly safe. We disable it first and in the worst
	 * case we'll accept a few undesired packets. */
	filter->count = 0;
	wmb();

	/* Use first set of addresses as an exact filter */
	for (n = 0; n < uf.count && n < FLT_EXACT_COUNT; n++)
		memcpy(filter->addr[n], addr[n].u, ETH_ALEN);

	nexact = n;

625 626
	/* Remaining multicast addresses are hashed,
	 * unicast will leave the filter disabled. */
627
	memset(filter->mask, 0, sizeof(filter->mask));
628 629 630 631 632
	for (; n < uf.count; n++) {
		if (!is_multicast_ether_addr(addr[n].u)) {
			err = 0; /* no filter */
			goto done;
		}
633
		addr_hash_set(filter->mask, addr[n].u);
634
	}
635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662

	/* For ALLMULTI just set the mask to all ones.
	 * This overrides the mask populated above. */
	if ((uf.flags & TUN_FLT_ALLMULTI))
		memset(filter->mask, ~0, sizeof(filter->mask));

	/* Now enable the filter */
	wmb();
	filter->count = nexact;

	/* Return the number of exact filters */
	err = nexact;

done:
	kfree(addr);
	return err;
}

/* Returns: 0 - drop, !=0 - accept */
static int run_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	/* Cannot use eth_hdr(skb) here because skb_mac_hdr() is incorrect
	 * at this point. */
	struct ethhdr *eh = (struct ethhdr *) skb->data;
	int i;

	/* Exact match */
	for (i = 0; i < filter->count; i++)
663
		if (ether_addr_equal(eh->h_dest, filter->addr[i]))
664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684
			return 1;

	/* Inexact match (multicast only) */
	if (is_multicast_ether_addr(eh->h_dest))
		return addr_hash_test(filter->mask, eh->h_dest);

	return 0;
}

/*
 * Checks whether the packet is accepted or not.
 * Returns: 0 - drop, !=0 - accept
 */
static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	if (!filter->count)
		return 1;

	return run_filter(filter, skb);
}

L
Linus Torvalds 已提交
685 686
/* Network device part of the driver */

687
static const struct ethtool_ops tun_ethtool_ops;
L
Linus Torvalds 已提交
688

689 690 691
/* Net device detach from fd. */
static void tun_net_uninit(struct net_device *dev)
{
J
Jason Wang 已提交
692
	tun_detach_all(dev);
693 694
}

L
Linus Torvalds 已提交
695 696 697
/* Net device open. */
static int tun_net_open(struct net_device *dev)
{
J
Jason Wang 已提交
698
	netif_tx_start_all_queues(dev);
L
Linus Torvalds 已提交
699 700 701 702 703 704
	return 0;
}

/* Net device close. */
static int tun_net_close(struct net_device *dev)
{
J
Jason Wang 已提交
705
	netif_tx_stop_all_queues(dev);
L
Linus Torvalds 已提交
706 707 708 709
	return 0;
}

/* Net device start xmit */
710
static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
L
Linus Torvalds 已提交
711 712
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
713
	int txq = skb->queue_mapping;
714
	struct tun_file *tfile;
L
Linus Torvalds 已提交
715

716
	rcu_read_lock();
J
Jason Wang 已提交
717 718
	tfile = rcu_dereference(tun->tfiles[txq]);

L
Linus Torvalds 已提交
719
	/* Drop packet if interface is not attached */
J
Jason Wang 已提交
720
	if (txq >= tun->numqueues)
L
Linus Torvalds 已提交
721 722
		goto drop;

723 724
	tun_debug(KERN_INFO, tun, "tun_net_xmit %d\n", skb->len);

J
Jason Wang 已提交
725 726
	BUG_ON(!tfile);

727 728 729 730 731 732
	/* Drop if the filter does not like it.
	 * This is a noop if the filter is disabled.
	 * Filter can be enabled only for the TAP devices. */
	if (!check_filter(&tun->txflt, skb))
		goto drop;

J
Jason Wang 已提交
733 734
	if (tfile->socket.sk->sk_filter &&
	    sk_filter(tfile->socket.sk, skb))
M
Michael S. Tsirkin 已提交
735 736
		goto drop;

R
Rami Rosen 已提交
737
	/* Limit the number of packets queued by dividing txq length with the
J
Jason Wang 已提交
738 739
	 * number of queues.
	 */
J
Jason Wang 已提交
740
	if (skb_queue_len(&tfile->socket.sk->sk_receive_queue)
741 742
			  >= dev->tx_queue_len / tun->numqueues)
		goto drop;
L
Linus Torvalds 已提交
743

M
Michael S. Tsirkin 已提交
744 745
	/* Orphan the skb - required as we might hang on to it
	 * for indefinite time. */
M
Michael S. Tsirkin 已提交
746 747
	if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
		goto drop;
M
Michael S. Tsirkin 已提交
748 749
	skb_orphan(skb);

750 751
	nf_reset(skb);

752
	/* Enqueue packet */
J
Jason Wang 已提交
753
	skb_queue_tail(&tfile->socket.sk->sk_receive_queue, skb);
L
Linus Torvalds 已提交
754 755

	/* Notify and wake up reader process */
J
Jason Wang 已提交
756 757 758
	if (tfile->flags & TUN_FASYNC)
		kill_fasync(&tfile->fasync, SIGIO, POLL_IN);
	wake_up_interruptible_poll(&tfile->wq.wait, POLLIN |
759
				   POLLRDNORM | POLLRDBAND);
760 761

	rcu_read_unlock();
762
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
763 764

drop:
765
	dev->stats.tx_dropped++;
766
	skb_tx_error(skb);
L
Linus Torvalds 已提交
767
	kfree_skb(skb);
768
	rcu_read_unlock();
769
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
770 771
}

772
static void tun_net_mclist(struct net_device *dev)
L
Linus Torvalds 已提交
773
{
774 775 776 777 778
	/*
	 * This callback is supposed to deal with mc filter in
	 * _rx_ path and has nothing to do with the _tx_ path.
	 * In rx path we always accept everything userspace gives us.
	 */
L
Linus Torvalds 已提交
779 780
}

E
Ed Swierk 已提交
781 782 783 784 785 786 787 788 789 790 791 792
#define MIN_MTU 68
#define MAX_MTU 65535

static int
tun_net_change_mtu(struct net_device *dev, int new_mtu)
{
	if (new_mtu < MIN_MTU || new_mtu + dev->hard_header_len > MAX_MTU)
		return -EINVAL;
	dev->mtu = new_mtu;
	return 0;
}

793 794
static netdev_features_t tun_net_fix_features(struct net_device *dev,
	netdev_features_t features)
795 796 797 798 799
{
	struct tun_struct *tun = netdev_priv(dev);

	return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
}
800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816
#ifdef CONFIG_NET_POLL_CONTROLLER
static void tun_poll_controller(struct net_device *dev)
{
	/*
	 * Tun only receives frames when:
	 * 1) the char device endpoint gets data from user space
	 * 2) the tun socket gets a sendmsg call from user space
	 * Since both of those are syncronous operations, we are guaranteed
	 * never to have pending data when we poll for it
	 * so theres nothing to do here but return.
	 * We need this though so netpoll recognizes us as an interface that
	 * supports polling, which enables bridge devices in virt setups to
	 * still use netconsole
	 */
	return;
}
#endif
S
Stephen Hemminger 已提交
817
static const struct net_device_ops tun_netdev_ops = {
818
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
819 820
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
821
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
822
	.ndo_change_mtu		= tun_net_change_mtu,
823
	.ndo_fix_features	= tun_net_fix_features,
J
Jason Wang 已提交
824
	.ndo_select_queue	= tun_select_queue,
825 826 827
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
828 829 830
};

static const struct net_device_ops tap_netdev_ops = {
831
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
832 833
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
834
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
835
	.ndo_change_mtu		= tun_net_change_mtu,
836
	.ndo_fix_features	= tun_net_fix_features,
837
	.ndo_set_rx_mode	= tun_net_mclist,
S
Stephen Hemminger 已提交
838 839
	.ndo_set_mac_address	= eth_mac_addr,
	.ndo_validate_addr	= eth_validate_addr,
J
Jason Wang 已提交
840
	.ndo_select_queue	= tun_select_queue,
841 842 843
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
844 845
};

J
Jason Wang 已提交
846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866
static int tun_flow_init(struct tun_struct *tun)
{
	int i;

	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++)
		INIT_HLIST_HEAD(&tun->flows[i]);

	tun->ageing_time = TUN_FLOW_EXPIRE;
	setup_timer(&tun->flow_gc_timer, tun_flow_cleanup, (unsigned long)tun);
	mod_timer(&tun->flow_gc_timer,
		  round_jiffies_up(jiffies + tun->ageing_time));

	return 0;
}

static void tun_flow_uninit(struct tun_struct *tun)
{
	del_timer_sync(&tun->flow_gc_timer);
	tun_flow_flush(tun);
}

L
Linus Torvalds 已提交
867 868 869 870
/* Initialize net device. */
static void tun_net_init(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
871

L
Linus Torvalds 已提交
872 873
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
S
Stephen Hemminger 已提交
874 875
		dev->netdev_ops = &tun_netdev_ops;

L
Linus Torvalds 已提交
876 877 878 879 880 881
		/* Point-to-Point TUN Device */
		dev->hard_header_len = 0;
		dev->addr_len = 0;
		dev->mtu = 1500;

		/* Zero header length */
882
		dev->type = ARPHRD_NONE;
L
Linus Torvalds 已提交
883 884 885 886 887
		dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;

	case TUN_TAP_DEV:
K
Kusanagi Kouichi 已提交
888
		dev->netdev_ops = &tap_netdev_ops;
L
Linus Torvalds 已提交
889 890
		/* Ethernet TAP Device */
		ether_setup(dev);
891
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
892
		dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
893

894
		eth_hw_addr_random(dev);
895

L
Linus Torvalds 已提交
896 897 898 899 900 901 902 903
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;
	}
}

/* Character device part */

/* Poll */
J
Jason Wang 已提交
904
static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
905
{
906 907
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
908
	struct sock *sk;
909
	unsigned int mask = 0;
L
Linus Torvalds 已提交
910 911

	if (!tun)
912
		return POLLERR;
L
Linus Torvalds 已提交
913

J
Jason Wang 已提交
914
	sk = tfile->socket.sk;
915

916
	tun_debug(KERN_INFO, tun, "tun_chr_poll\n");
L
Linus Torvalds 已提交
917

J
Jason Wang 已提交
918
	poll_wait(file, &tfile->wq.wait, wait);
919

920
	if (!skb_queue_empty(&sk->sk_receive_queue))
L
Linus Torvalds 已提交
921 922
		mask |= POLLIN | POLLRDNORM;

923 924 925 926 927
	if (sock_writeable(sk) ||
	    (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
	     sock_writeable(sk)))
		mask |= POLLOUT | POLLWRNORM;

928 929 930
	if (tun->dev->reg_state != NETREG_REGISTERED)
		mask = POLLERR;

E
Eric W. Biederman 已提交
931
	tun_put(tun);
L
Linus Torvalds 已提交
932 933 934
	return mask;
}

935 936
/* prepad is the amount to reserve at front.  len is length after that.
 * linear is a hint as to how much to copy (usually headers). */
J
Jason Wang 已提交
937
static struct sk_buff *tun_alloc_skb(struct tun_file *tfile,
938 939
				     size_t prepad, size_t len,
				     size_t linear, int noblock)
940
{
J
Jason Wang 已提交
941
	struct sock *sk = tfile->socket.sk;
942
	struct sk_buff *skb;
943
	int err;
944 945

	/* Under a page?  Don't bother with paged skb. */
H
Herbert Xu 已提交
946
	if (prepad + len < PAGE_SIZE || !linear)
947
		linear = len;
948

949 950
	skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
				   &err);
951
	if (!skb)
952
		return ERR_PTR(err);
953 954 955

	skb_reserve(skb, prepad);
	skb_put(skb, linear);
956 957
	skb->data_len = len - linear;
	skb->len += len - linear;
958 959 960 961

	return skb;
}

962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039
/* set skb frags from iovec, this can move to core network code for reuse */
static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
				  int offset, size_t count)
{
	int len = iov_length(from, count) - offset;
	int copy = skb_headlen(skb);
	int size, offset1 = 0;
	int i = 0;

	/* Skip over from offset */
	while (count && (offset >= from->iov_len)) {
		offset -= from->iov_len;
		++from;
		--count;
	}

	/* copy up to skb headlen */
	while (count && (copy > 0)) {
		size = min_t(unsigned int, copy, from->iov_len - offset);
		if (copy_from_user(skb->data + offset1, from->iov_base + offset,
				   size))
			return -EFAULT;
		if (copy > size) {
			++from;
			--count;
			offset = 0;
		} else
			offset += size;
		copy -= size;
		offset1 += size;
	}

	if (len == offset1)
		return 0;

	while (count--) {
		struct page *page[MAX_SKB_FRAGS];
		int num_pages;
		unsigned long base;
		unsigned long truesize;

		len = from->iov_len - offset;
		if (!len) {
			offset = 0;
			++from;
			continue;
		}
		base = (unsigned long)from->iov_base + offset;
		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
		if (i + size > MAX_SKB_FRAGS)
			return -EMSGSIZE;
		num_pages = get_user_pages_fast(base, size, 0, &page[i]);
		if (num_pages != size) {
			for (i = 0; i < num_pages; i++)
				put_page(page[i]);
			return -EFAULT;
		}
		truesize = size * PAGE_SIZE;
		skb->data_len += len;
		skb->len += len;
		skb->truesize += truesize;
		atomic_add(truesize, &skb->sk->sk_wmem_alloc);
		while (len) {
			int off = base & ~PAGE_MASK;
			int size = min_t(int, len, PAGE_SIZE - off);
			__skb_fill_page_desc(skb, i, page[i], off, size);
			skb_shinfo(skb)->nr_frags++;
			/* increase sk_wmem_alloc */
			base += size;
			len -= size;
			i++;
		}
		offset = 0;
		++from;
	}
	return 0;
}

L
Linus Torvalds 已提交
1040
/* Get packet from user space buffer */
J
Jason Wang 已提交
1041 1042 1043
static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
			    void *msg_control, const struct iovec *iv,
			    size_t total_len, size_t count, int noblock)
L
Linus Torvalds 已提交
1044
{
1045
	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
L
Linus Torvalds 已提交
1046
	struct sk_buff *skb;
1047
	size_t len = total_len, align = NET_SKB_PAD;
1048
	struct virtio_net_hdr gso = { 0 };
1049
	int offset = 0;
1050 1051 1052
	int copylen;
	bool zerocopy = false;
	int err;
1053
	u32 rxhash;
L
Linus Torvalds 已提交
1054 1055

	if (!(tun->flags & TUN_NO_PI)) {
1056
		if ((len -= sizeof(pi)) > total_len)
L
Linus Torvalds 已提交
1057 1058
			return -EINVAL;

1059
		if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
L
Linus Torvalds 已提交
1060
			return -EFAULT;
1061
		offset += sizeof(pi);
L
Linus Torvalds 已提交
1062 1063
	}

1064
	if (tun->flags & TUN_VNET_HDR) {
1065
		if ((len -= tun->vnet_hdr_sz) > total_len)
1066 1067
			return -EINVAL;

1068
		if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
1069 1070
			return -EFAULT;

1071 1072 1073 1074
		if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
		    gso.csum_start + gso.csum_offset + 2 > gso.hdr_len)
			gso.hdr_len = gso.csum_start + gso.csum_offset + 2;

1075 1076
		if (gso.hdr_len > len)
			return -EINVAL;
1077
		offset += tun->vnet_hdr_sz;
1078 1079
	}

1080
	if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
1081
		align += NET_IP_ALIGN;
H
Herbert Xu 已提交
1082 1083
		if (unlikely(len < ETH_HLEN ||
			     (gso.hdr_len && gso.hdr_len < ETH_HLEN)))
1084 1085
			return -EINVAL;
	}
1086

1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113
	if (msg_control)
		zerocopy = true;

	if (zerocopy) {
		/* Userspace may produce vectors with count greater than
		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
		 * to let the rest of data to be fit in the frags.
		 */
		if (count > MAX_SKB_FRAGS) {
			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
			if (copylen < offset)
				copylen = 0;
			else
				copylen -= offset;
		} else
				copylen = 0;
		/* There are 256 bytes to be copied in skb, so there is enough
		 * room for skb expand head in case it is used.
		 * The rest of the buffer is mapped from userspace.
		 */
		if (copylen < gso.hdr_len)
			copylen = gso.hdr_len;
		if (!copylen)
			copylen = GOODCOPY_LEN;
	} else
		copylen = len;

J
Jason Wang 已提交
1114
	skb = tun_alloc_skb(tfile, align, copylen, gso.hdr_len, noblock);
1115 1116 1117 1118
	if (IS_ERR(skb)) {
		if (PTR_ERR(skb) != -EAGAIN)
			tun->dev->stats.rx_dropped++;
		return PTR_ERR(skb);
L
Linus Torvalds 已提交
1119 1120
	}

1121 1122 1123 1124 1125 1126
	if (zerocopy)
		err = zerocopy_sg_from_iovec(skb, iv, offset, count);
	else
		err = skb_copy_datagram_from_iovec(skb, 0, iv, offset, len);

	if (err) {
1127
		tun->dev->stats.rx_dropped++;
D
Dave Jones 已提交
1128
		kfree_skb(skb);
L
Linus Torvalds 已提交
1129
		return -EFAULT;
D
Dave Jones 已提交
1130
	}
L
Linus Torvalds 已提交
1131

1132 1133 1134 1135 1136 1137 1138
	if (gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
		if (!skb_partial_csum_set(skb, gso.csum_start,
					  gso.csum_offset)) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}
1139
	}
1140

L
Linus Torvalds 已提交
1141 1142
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157
		if (tun->flags & TUN_NO_PI) {
			switch (skb->data[0] & 0xf0) {
			case 0x40:
				pi.proto = htons(ETH_P_IP);
				break;
			case 0x60:
				pi.proto = htons(ETH_P_IPV6);
				break;
			default:
				tun->dev->stats.rx_dropped++;
				kfree_skb(skb);
				return -EINVAL;
			}
		}

1158
		skb_reset_mac_header(skb);
L
Linus Torvalds 已提交
1159
		skb->protocol = pi.proto;
1160
		skb->dev = tun->dev;
L
Linus Torvalds 已提交
1161 1162 1163 1164
		break;
	case TUN_TAP_DEV:
		skb->protocol = eth_type_trans(skb, tun->dev);
		break;
1165
	}
L
Linus Torvalds 已提交
1166

1167 1168 1169 1170
	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
		pr_debug("GSO!\n");
		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
		case VIRTIO_NET_HDR_GSO_TCPV4:
1171
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
1172 1173
			break;
		case VIRTIO_NET_HDR_GSO_TCPV6:
1174
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
1175
			break;
1176
		case VIRTIO_NET_HDR_GSO_UDP:
1177
			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1178
			break;
1179 1180 1181 1182 1183 1184 1185
		default:
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		if (gso.gso_type & VIRTIO_NET_HDR_GSO_ECN)
1186
			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198

		skb_shinfo(skb)->gso_size = gso.gso_size;
		if (skb_shinfo(skb)->gso_size == 0) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		/* Header must be checked, and gso_segs computed. */
		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
		skb_shinfo(skb)->gso_segs = 0;
	}
1199

1200 1201 1202 1203
	/* copy skb_ubuf_info for callback when skb has no error */
	if (zerocopy) {
		skb_shinfo(skb)->destructor_arg = msg_control;
		skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
1204
		skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
1205 1206
	}

1207
	skb_reset_network_header(skb);
1208
	rxhash = skb_get_rxhash(skb);
L
Linus Torvalds 已提交
1209
	netif_rx_ni(skb);
1210

1211 1212
	tun->dev->stats.rx_packets++;
	tun->dev->stats.rx_bytes += len;
L
Linus Torvalds 已提交
1213

1214
	tun_flow_update(tun, rxhash, tfile);
1215
	return total_len;
1216
}
L
Linus Torvalds 已提交
1217

1218 1219
static ssize_t tun_chr_aio_write(struct kiocb *iocb, const struct iovec *iv,
			      unsigned long count, loff_t pos)
L
Linus Torvalds 已提交
1220
{
1221
	struct file *file = iocb->ki_filp;
H
Herbert Xu 已提交
1222
	struct tun_struct *tun = tun_get(file);
J
Jason Wang 已提交
1223
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1224
	ssize_t result;
L
Linus Torvalds 已提交
1225 1226 1227 1228

	if (!tun)
		return -EBADFD;

1229
	tun_debug(KERN_INFO, tun, "tun_chr_write %ld\n", count);
L
Linus Torvalds 已提交
1230

J
Jason Wang 已提交
1231 1232
	result = tun_get_user(tun, tfile, NULL, iv, iov_length(iv, count),
			      count, file->f_flags & O_NONBLOCK);
E
Eric W. Biederman 已提交
1233 1234 1235

	tun_put(tun);
	return result;
L
Linus Torvalds 已提交
1236 1237 1238
}

/* Put packet to the user space buffer */
1239
static ssize_t tun_put_user(struct tun_struct *tun,
J
Jason Wang 已提交
1240
			    struct tun_file *tfile,
1241 1242
			    struct sk_buff *skb,
			    const struct iovec *iv, int len)
L
Linus Torvalds 已提交
1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254
{
	struct tun_pi pi = { 0, skb->protocol };
	ssize_t total = 0;

	if (!(tun->flags & TUN_NO_PI)) {
		if ((len -= sizeof(pi)) < 0)
			return -EINVAL;

		if (len < skb->len) {
			/* Packet will be striped */
			pi.flags |= TUN_PKT_STRIP;
		}
1255

1256
		if (memcpy_toiovecend(iv, (void *) &pi, 0, sizeof(pi)))
L
Linus Torvalds 已提交
1257 1258
			return -EFAULT;
		total += sizeof(pi);
1259
	}
L
Linus Torvalds 已提交
1260

1261 1262
	if (tun->flags & TUN_VNET_HDR) {
		struct virtio_net_hdr gso = { 0 }; /* no info leak */
1263
		if ((len -= tun->vnet_hdr_sz) < 0)
1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275
			return -EINVAL;

		if (skb_is_gso(skb)) {
			struct skb_shared_info *sinfo = skb_shinfo(skb);

			/* This is a hint as to how much should be linear. */
			gso.hdr_len = skb_headlen(skb);
			gso.gso_size = sinfo->gso_size;
			if (sinfo->gso_type & SKB_GSO_TCPV4)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
			else if (sinfo->gso_type & SKB_GSO_TCPV6)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
1276 1277
			else if (sinfo->gso_type & SKB_GSO_UDP)
				gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
1278
			else {
1279
				pr_err("unexpected GSO type: "
1280 1281 1282 1283 1284 1285 1286 1287 1288 1289
				       "0x%x, gso_size %d, hdr_len %d\n",
				       sinfo->gso_type, gso.gso_size,
				       gso.hdr_len);
				print_hex_dump(KERN_ERR, "tun: ",
					       DUMP_PREFIX_NONE,
					       16, 1, skb->head,
					       min((int)gso.hdr_len, 64), true);
				WARN_ON_ONCE(1);
				return -EINVAL;
			}
1290 1291 1292 1293 1294 1295 1296
			if (sinfo->gso_type & SKB_GSO_TCP_ECN)
				gso.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
		} else
			gso.gso_type = VIRTIO_NET_HDR_GSO_NONE;

		if (skb->ip_summed == CHECKSUM_PARTIAL) {
			gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
1297
			gso.csum_start = skb_checksum_start_offset(skb);
1298
			gso.csum_offset = skb->csum_offset;
1299 1300
		} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
			gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
1301 1302
		} /* else everything is zero */

1303 1304
		if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
					       sizeof(gso))))
1305
			return -EFAULT;
1306
		total += tun->vnet_hdr_sz;
1307 1308
	}

L
Linus Torvalds 已提交
1309 1310
	len = min_t(int, skb->len, len);

1311
	skb_copy_datagram_const_iovec(skb, 0, iv, total, len);
1312
	total += skb->len;
L
Linus Torvalds 已提交
1313

1314 1315
	tun->dev->stats.tx_packets++;
	tun->dev->stats.tx_bytes += len;
L
Linus Torvalds 已提交
1316 1317 1318 1319

	return total;
}

J
Jason Wang 已提交
1320
static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
1321 1322
			   struct kiocb *iocb, const struct iovec *iv,
			   ssize_t len, int noblock)
L
Linus Torvalds 已提交
1323 1324 1325
{
	DECLARE_WAITQUEUE(wait, current);
	struct sk_buff *skb;
1326
	ssize_t ret = 0;
L
Linus Torvalds 已提交
1327

1328
	tun_debug(KERN_INFO, tun, "tun_do_read\n");
L
Linus Torvalds 已提交
1329

1330
	if (unlikely(!noblock))
J
Jason Wang 已提交
1331
		add_wait_queue(&tfile->wq.wait, &wait);
L
Linus Torvalds 已提交
1332 1333 1334 1335
	while (len) {
		current->state = TASK_INTERRUPTIBLE;

		/* Read frames from the queue */
J
Jason Wang 已提交
1336
		if (!(skb = skb_dequeue(&tfile->socket.sk->sk_receive_queue))) {
1337
			if (noblock) {
L
Linus Torvalds 已提交
1338 1339 1340 1341 1342 1343 1344
				ret = -EAGAIN;
				break;
			}
			if (signal_pending(current)) {
				ret = -ERESTARTSYS;
				break;
			}
1345 1346 1347 1348
			if (tun->dev->reg_state != NETREG_REGISTERED) {
				ret = -EIO;
				break;
			}
L
Linus Torvalds 已提交
1349 1350 1351 1352 1353 1354

			/* Nothing to read, let's sleep */
			schedule();
			continue;
		}

J
Jason Wang 已提交
1355
		ret = tun_put_user(tun, tfile, skb, iv, len);
1356 1357
		kfree_skb(skb);
		break;
L
Linus Torvalds 已提交
1358 1359 1360
	}

	current->state = TASK_RUNNING;
1361
	if (unlikely(!noblock))
J
Jason Wang 已提交
1362
		remove_wait_queue(&tfile->wq.wait, &wait);
L
Linus Torvalds 已提交
1363

1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382
	return ret;
}

static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
			    unsigned long count, loff_t pos)
{
	struct file *file = iocb->ki_filp;
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
	ssize_t len, ret;

	if (!tun)
		return -EBADFD;
	len = iov_length(iv, count);
	if (len < 0) {
		ret = -EINVAL;
		goto out;
	}

J
Jason Wang 已提交
1383 1384
	ret = tun_do_read(tun, tfile, iocb, iv, len,
			  file->f_flags & O_NONBLOCK);
1385
	ret = min_t(ssize_t, ret, len);
E
Eric W. Biederman 已提交
1386 1387
out:
	tun_put(tun);
L
Linus Torvalds 已提交
1388 1389 1390
	return ret;
}

J
Jason Wang 已提交
1391 1392 1393 1394
static void tun_free_netdev(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

J
Jason Wang 已提交
1395
	BUG_ON(!(list_empty(&tun->disabled)));
J
Jason Wang 已提交
1396
	tun_flow_uninit(tun);
1397
	security_tun_dev_free_security(tun->security);
J
Jason Wang 已提交
1398 1399 1400
	free_netdev(dev);
}

L
Linus Torvalds 已提交
1401 1402 1403 1404
static void tun_setup(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

1405 1406
	tun->owner = INVALID_UID;
	tun->group = INVALID_GID;
L
Linus Torvalds 已提交
1407 1408

	dev->ethtool_ops = &tun_ethtool_ops;
J
Jason Wang 已提交
1409
	dev->destructor = tun_free_netdev;
L
Linus Torvalds 已提交
1410 1411
}

1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426
/* Trivial set of netlink ops to allow deleting tun or tap
 * device with netlink.
 */
static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
{
	return -EINVAL;
}

static struct rtnl_link_ops tun_link_ops __read_mostly = {
	.kind		= DRV_NAME,
	.priv_size	= sizeof(struct tun_struct),
	.setup		= tun_setup,
	.validate	= tun_validate,
};

1427 1428
static void tun_sock_write_space(struct sock *sk)
{
J
Jason Wang 已提交
1429
	struct tun_file *tfile;
1430
	wait_queue_head_t *wqueue;
1431 1432 1433 1434 1435 1436 1437

	if (!sock_writeable(sk))
		return;

	if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
		return;

1438 1439 1440
	wqueue = sk_sleep(sk);
	if (wqueue && waitqueue_active(wqueue))
		wake_up_interruptible_sync_poll(wqueue, POLLOUT |
1441
						POLLWRNORM | POLLWRBAND);
H
Herbert Xu 已提交
1442

J
Jason Wang 已提交
1443 1444
	tfile = container_of(sk, struct tun_file, sk);
	kill_fasync(&tfile->fasync, SIGIO, POLL_OUT);
1445 1446
}

1447 1448 1449
static int tun_sendmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len)
{
J
Jason Wang 已提交
1450 1451 1452 1453 1454 1455 1456 1457 1458 1459
	int ret;
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);

	if (!tun)
		return -EBADFD;
	ret = tun_get_user(tun, tfile, m->msg_control, m->msg_iov, total_len,
			   m->msg_iovlen, m->msg_flags & MSG_DONTWAIT);
	tun_put(tun);
	return ret;
1460 1461
}

J
Jason Wang 已提交
1462

1463 1464 1465 1466
static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len,
		       int flags)
{
J
Jason Wang 已提交
1467 1468
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);
1469
	int ret;
J
Jason Wang 已提交
1470 1471 1472 1473

	if (!tun)
		return -EBADFD;

1474 1475
	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
		return -EINVAL;
J
Jason Wang 已提交
1476
	ret = tun_do_read(tun, tfile, iocb, m->msg_iov, total_len,
1477 1478 1479 1480 1481
			  flags & MSG_DONTWAIT);
	if (ret > total_len) {
		m->msg_flags |= MSG_TRUNC;
		ret = flags & MSG_TRUNC ? ret : total_len;
	}
J
Jason Wang 已提交
1482
	tun_put(tun);
1483 1484 1485
	return ret;
}

1486 1487 1488 1489 1490 1491 1492
static int tun_release(struct socket *sock)
{
	if (sock->sk)
		sock_put(sock->sk);
	return 0;
}

1493 1494 1495 1496
/* Ops structure to mimic raw sockets with tun */
static const struct proto_ops tun_socket_ops = {
	.sendmsg = tun_sendmsg,
	.recvmsg = tun_recvmsg,
1497
	.release = tun_release,
1498 1499
};

1500 1501 1502
static struct proto tun_proto = {
	.name		= "tun",
	.owner		= THIS_MODULE,
J
Jason Wang 已提交
1503
	.obj_size	= sizeof(struct tun_file),
1504
};
1505

1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517
static int tun_flags(struct tun_struct *tun)
{
	int flags = 0;

	if (tun->flags & TUN_TUN_DEV)
		flags |= IFF_TUN;
	else
		flags |= IFF_TAP;

	if (tun->flags & TUN_NO_PI)
		flags |= IFF_NO_PI;

1518 1519 1520
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
1521 1522 1523 1524 1525 1526
	if (tun->flags & TUN_ONE_QUEUE)
		flags |= IFF_ONE_QUEUE;

	if (tun->flags & TUN_VNET_HDR)
		flags |= IFF_VNET_HDR;

J
Jason Wang 已提交
1527 1528 1529
	if (tun->flags & TUN_TAP_MQ)
		flags |= IFF_MULTI_QUEUE;

1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543
	return flags;
}

static ssize_t tun_show_flags(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "0x%x\n", tun_flags(tun));
}

static ssize_t tun_show_owner(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1544 1545 1546 1547
	return uid_valid(tun->owner)?
		sprintf(buf, "%u\n",
			from_kuid_munged(current_user_ns(), tun->owner)):
		sprintf(buf, "-1\n");
1548 1549 1550 1551 1552 1553
}

static ssize_t tun_show_group(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1554 1555 1556 1557
	return gid_valid(tun->group) ?
		sprintf(buf, "%u\n",
			from_kgid_munged(current_user_ns(), tun->group)):
		sprintf(buf, "-1\n");
1558 1559 1560 1561 1562 1563
}

static DEVICE_ATTR(tun_flags, 0444, tun_show_flags, NULL);
static DEVICE_ATTR(owner, 0444, tun_show_owner, NULL);
static DEVICE_ATTR(group, 0444, tun_show_group, NULL);

1564
static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
L
Linus Torvalds 已提交
1565 1566
{
	struct tun_struct *tun;
J
Jason Wang 已提交
1567
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
1568 1569 1570
	struct net_device *dev;
	int err;

1571 1572 1573
	if (tfile->detached)
		return -EINVAL;

1574 1575
	dev = __dev_get_by_name(net, ifr->ifr_name);
	if (dev) {
1576 1577
		if (ifr->ifr_flags & IFF_TUN_EXCL)
			return -EBUSY;
1578 1579 1580 1581 1582 1583 1584
		if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
			tun = netdev_priv(dev);
		else if ((ifr->ifr_flags & IFF_TAP) && dev->netdev_ops == &tap_netdev_ops)
			tun = netdev_priv(dev);
		else
			return -EINVAL;

1585
		if (tun_not_capable(tun))
P
Paul Moore 已提交
1586
			return -EPERM;
1587
		err = security_tun_dev_open(tun->security);
P
Paul Moore 已提交
1588 1589 1590
		if (err < 0)
			return err;

1591 1592 1593
		err = tun_attach(tun, file);
		if (err < 0)
			return err;
J
Jason Wang 已提交
1594 1595 1596

		if (tun->flags & TUN_TAP_MQ &&
		    (tun->numqueues + tun->numdisabled > 1))
1597
			return -EBUSY;
1598
	}
L
Linus Torvalds 已提交
1599 1600 1601
	else {
		char *name;
		unsigned long flags = 0;
1602 1603
		int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
			     MAX_TAP_QUEUES : 1;
L
Linus Torvalds 已提交
1604

1605
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1606
			return -EPERM;
P
Paul Moore 已提交
1607 1608 1609
		err = security_tun_dev_create();
		if (err < 0)
			return err;
1610

L
Linus Torvalds 已提交
1611 1612 1613 1614 1615 1616 1617 1618 1619
		/* Set dev type */
		if (ifr->ifr_flags & IFF_TUN) {
			/* TUN device */
			flags |= TUN_TUN_DEV;
			name = "tun%d";
		} else if (ifr->ifr_flags & IFF_TAP) {
			/* TAP device */
			flags |= TUN_TAP_DEV;
			name = "tap%d";
1620
		} else
1621
			return -EINVAL;
1622

L
Linus Torvalds 已提交
1623 1624 1625
		if (*ifr->ifr_name)
			name = ifr->ifr_name;

J
Jason Wang 已提交
1626
		dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
1627 1628
				       tun_setup, queues, queues);

L
Linus Torvalds 已提交
1629 1630 1631
		if (!dev)
			return -ENOMEM;

1632
		dev_net_set(dev, net);
1633
		dev->rtnl_link_ops = &tun_link_ops;
S
Stephen Hemminger 已提交
1634

L
Linus Torvalds 已提交
1635 1636 1637
		tun = netdev_priv(dev);
		tun->dev = dev;
		tun->flags = flags;
1638
		tun->txflt.count = 0;
1639
		tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
1640

J
Jason Wang 已提交
1641 1642
		tun->filter_attached = false;
		tun->sndbuf = tfile->socket.sk->sk_sndbuf;
1643

J
Jason Wang 已提交
1644 1645
		spin_lock_init(&tun->lock);

1646 1647 1648
		err = security_tun_dev_alloc_security(&tun->security);
		if (err < 0)
			goto err_free_dev;
P
Paul Moore 已提交
1649

L
Linus Torvalds 已提交
1650 1651
		tun_net_init(dev);

1652 1653
		err = tun_flow_init(tun);
		if (err < 0)
J
Jason Wang 已提交
1654 1655
			goto err_free_dev;

1656 1657 1658 1659
		dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
			TUN_USER_FEATURES;
		dev->features = dev->hw_features;

J
Jason Wang 已提交
1660
		INIT_LIST_HEAD(&tun->disabled);
1661 1662 1663 1664
		err = tun_attach(tun, file);
		if (err < 0)
			goto err_free_dev;

L
Linus Torvalds 已提交
1665 1666
		err = register_netdevice(tun->dev);
		if (err < 0)
J
Jason Wang 已提交
1667
			goto err_free_dev;
1668

1669 1670 1671
		if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
		    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
		    device_create_file(&tun->dev->dev, &dev_attr_group))
1672
			pr_err("Failed to create tun sysfs files\n");
L
Linus Torvalds 已提交
1673 1674
	}

1675 1676
	netif_carrier_on(tun->dev);

1677
	tun_debug(KERN_INFO, tun, "tun_set_iff\n");
L
Linus Torvalds 已提交
1678 1679 1680

	if (ifr->ifr_flags & IFF_NO_PI)
		tun->flags |= TUN_NO_PI;
1681 1682
	else
		tun->flags &= ~TUN_NO_PI;
L
Linus Torvalds 已提交
1683

1684 1685 1686
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
L
Linus Torvalds 已提交
1687 1688
	if (ifr->ifr_flags & IFF_ONE_QUEUE)
		tun->flags |= TUN_ONE_QUEUE;
1689 1690
	else
		tun->flags &= ~TUN_ONE_QUEUE;
L
Linus Torvalds 已提交
1691

1692 1693 1694 1695 1696
	if (ifr->ifr_flags & IFF_VNET_HDR)
		tun->flags |= TUN_VNET_HDR;
	else
		tun->flags &= ~TUN_VNET_HDR;

J
Jason Wang 已提交
1697 1698 1699 1700 1701
	if (ifr->ifr_flags & IFF_MULTI_QUEUE)
		tun->flags |= TUN_TAP_MQ;
	else
		tun->flags &= ~TUN_TAP_MQ;

1702 1703 1704 1705
	/* Make sure persistent devices do not get stuck in
	 * xoff state.
	 */
	if (netif_running(tun->dev))
J
Jason Wang 已提交
1706
		netif_tx_wake_all_queues(tun->dev);
1707

L
Linus Torvalds 已提交
1708 1709 1710 1711 1712 1713 1714 1715
	strcpy(ifr->ifr_name, tun->dev->name);
	return 0;

 err_free_dev:
	free_netdev(dev);
	return err;
}

R
Rami Rosen 已提交
1716
static void tun_get_iff(struct net *net, struct tun_struct *tun,
1717
		       struct ifreq *ifr)
1718
{
1719
	tun_debug(KERN_INFO, tun, "tun_get_iff\n");
1720 1721 1722

	strcpy(ifr->ifr_name, tun->dev->name);

1723
	ifr->ifr_flags = tun_flags(tun);
1724 1725 1726

}

1727 1728
/* This is like a cut-down ethtool ops, except done via tun fd so no
 * privs required. */
1729
static int set_offload(struct tun_struct *tun, unsigned long arg)
1730
{
1731
	netdev_features_t features = 0;
1732 1733

	if (arg & TUN_F_CSUM) {
1734
		features |= NETIF_F_HW_CSUM;
1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747
		arg &= ~TUN_F_CSUM;

		if (arg & (TUN_F_TSO4|TUN_F_TSO6)) {
			if (arg & TUN_F_TSO_ECN) {
				features |= NETIF_F_TSO_ECN;
				arg &= ~TUN_F_TSO_ECN;
			}
			if (arg & TUN_F_TSO4)
				features |= NETIF_F_TSO;
			if (arg & TUN_F_TSO6)
				features |= NETIF_F_TSO6;
			arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
		}
1748 1749 1750 1751 1752

		if (arg & TUN_F_UFO) {
			features |= NETIF_F_UFO;
			arg &= ~TUN_F_UFO;
		}
1753 1754 1755 1756 1757 1758 1759
	}

	/* This gives the user a way to test for new features in future by
	 * trying to set them. */
	if (arg)
		return -EINVAL;

1760 1761
	tun->set_features = features;
	netdev_update_features(tun->dev);
1762 1763 1764 1765

	return 0;
}

J
Jason Wang 已提交
1766 1767 1768 1769 1770 1771
static void tun_detach_filter(struct tun_struct *tun, int n)
{
	int i;
	struct tun_file *tfile;

	for (i = 0; i < n; i++) {
1772
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784
		sk_detach_filter(tfile->socket.sk);
	}

	tun->filter_attached = false;
}

static int tun_attach_filter(struct tun_struct *tun)
{
	int i, ret = 0;
	struct tun_file *tfile;

	for (i = 0; i < tun->numqueues; i++) {
1785
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802
		ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (ret) {
			tun_detach_filter(tun, i);
			return ret;
		}
	}

	tun->filter_attached = true;
	return ret;
}

static void tun_set_sndbuf(struct tun_struct *tun)
{
	struct tun_file *tfile;
	int i;

	for (i = 0; i < tun->numqueues; i++) {
1803
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1804 1805 1806 1807
		tfile->socket.sk->sk_sndbuf = tun->sndbuf;
	}
}

1808 1809 1810 1811 1812 1813 1814 1815 1816
static int tun_set_queue(struct file *file, struct ifreq *ifr)
{
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun;
	int ret = 0;

	rtnl_lock();

	if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
J
Jason Wang 已提交
1817
		tun = tfile->detached;
1818
		if (!tun) {
1819
			ret = -EINVAL;
1820 1821 1822 1823 1824 1825
			goto unlock;
		}
		ret = security_tun_dev_attach_queue(tun->security);
		if (ret < 0)
			goto unlock;
		ret = tun_attach(tun, file);
J
Jason Wang 已提交
1826
	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
1827
		tun = rtnl_dereference(tfile->tun);
1828
		if (!tun || !(tun->flags & TUN_TAP_MQ) || tfile->detached)
J
Jason Wang 已提交
1829 1830 1831 1832
			ret = -EINVAL;
		else
			__tun_detach(tfile, false);
	} else
1833 1834
		ret = -EINVAL;

1835
unlock:
1836 1837 1838 1839
	rtnl_unlock();
	return ret;
}

1840 1841
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg, int ifreq_len)
L
Linus Torvalds 已提交
1842
{
E
Eric W. Biederman 已提交
1843
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1844
	struct tun_struct *tun;
L
Linus Torvalds 已提交
1845 1846
	void __user* argp = (void __user*)arg;
	struct ifreq ifr;
1847 1848
	kuid_t owner;
	kgid_t group;
1849
	int sndbuf;
1850
	int vnet_hdr_sz;
1851
	int ret;
L
Linus Torvalds 已提交
1852

1853
	if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
1854
		if (copy_from_user(&ifr, argp, ifreq_len))
L
Linus Torvalds 已提交
1855
			return -EFAULT;
D
David S. Miller 已提交
1856
	} else {
1857
		memset(&ifr, 0, sizeof(ifr));
D
David S. Miller 已提交
1858
	}
E
Eric W. Biederman 已提交
1859 1860 1861 1862 1863
	if (cmd == TUNGETFEATURES) {
		/* Currently this just means: "what IFF flags are valid?".
		 * This is needed because we never checked for invalid flags on
		 * TUNSETIFF. */
		return put_user(IFF_TUN | IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE |
1864
				IFF_VNET_HDR | IFF_MULTI_QUEUE,
E
Eric W. Biederman 已提交
1865
				(unsigned int __user*)argp);
1866 1867
	} else if (cmd == TUNSETQUEUE)
		return tun_set_queue(file, &ifr);
E
Eric W. Biederman 已提交
1868

J
Jason Wang 已提交
1869
	ret = 0;
1870 1871
	rtnl_lock();

E
Eric W. Biederman 已提交
1872
	tun = __tun_get(tfile);
L
Linus Torvalds 已提交
1873 1874 1875
	if (cmd == TUNSETIFF && !tun) {
		ifr.ifr_name[IFNAMSIZ-1] = '\0';

1876
		ret = tun_set_iff(tfile->net, file, &ifr);
L
Linus Torvalds 已提交
1877

1878 1879
		if (ret)
			goto unlock;
L
Linus Torvalds 已提交
1880

1881
		if (copy_to_user(argp, &ifr, ifreq_len))
1882 1883
			ret = -EFAULT;
		goto unlock;
L
Linus Torvalds 已提交
1884 1885
	}

1886
	ret = -EBADFD;
L
Linus Torvalds 已提交
1887
	if (!tun)
1888
		goto unlock;
L
Linus Torvalds 已提交
1889

1890
	tun_debug(KERN_INFO, tun, "tun_chr_ioctl cmd %u\n", cmd);
L
Linus Torvalds 已提交
1891

E
Eric W. Biederman 已提交
1892
	ret = 0;
L
Linus Torvalds 已提交
1893
	switch (cmd) {
1894
	case TUNGETIFF:
R
Rami Rosen 已提交
1895
		tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
1896

1897
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1898
			ret = -EFAULT;
1899 1900
		break;

L
Linus Torvalds 已提交
1901 1902 1903
	case TUNSETNOCSUM:
		/* Disable/Enable checksum */

1904 1905
		/* [unimplemented] */
		tun_debug(KERN_INFO, tun, "ignored: set checksum %s\n",
1906
			  arg ? "disabled" : "enabled");
L
Linus Torvalds 已提交
1907 1908 1909
		break;

	case TUNSETPERSIST:
J
Jason Wang 已提交
1910 1911 1912
		/* Disable/Enable persist mode. Keep an extra reference to the
		 * module to prevent the module being unprobed.
		 */
J
Jason Wang 已提交
1913
		if (arg && !(tun->flags & TUN_PERSIST)) {
L
Linus Torvalds 已提交
1914
			tun->flags |= TUN_PERSIST;
J
Jason Wang 已提交
1915
			__module_get(THIS_MODULE);
J
Jason Wang 已提交
1916 1917
		}
		if (!arg && (tun->flags & TUN_PERSIST)) {
L
Linus Torvalds 已提交
1918
			tun->flags &= ~TUN_PERSIST;
J
Jason Wang 已提交
1919 1920
			module_put(THIS_MODULE);
		}
L
Linus Torvalds 已提交
1921

1922 1923
		tun_debug(KERN_INFO, tun, "persist %s\n",
			  arg ? "enabled" : "disabled");
L
Linus Torvalds 已提交
1924 1925 1926 1927
		break;

	case TUNSETOWNER:
		/* Set owner of the device */
1928 1929 1930 1931 1932 1933
		owner = make_kuid(current_user_ns(), arg);
		if (!uid_valid(owner)) {
			ret = -EINVAL;
			break;
		}
		tun->owner = owner;
1934
		tun_debug(KERN_INFO, tun, "owner set to %u\n",
1935
			  from_kuid(&init_user_ns, tun->owner));
L
Linus Torvalds 已提交
1936 1937
		break;

1938 1939
	case TUNSETGROUP:
		/* Set group of the device */
1940 1941 1942 1943 1944 1945
		group = make_kgid(current_user_ns(), arg);
		if (!gid_valid(group)) {
			ret = -EINVAL;
			break;
		}
		tun->group = group;
1946
		tun_debug(KERN_INFO, tun, "group set to %u\n",
1947
			  from_kgid(&init_user_ns, tun->group));
1948 1949
		break;

1950 1951 1952
	case TUNSETLINK:
		/* Only allow setting the type when the interface is down */
		if (tun->dev->flags & IFF_UP) {
1953 1954
			tun_debug(KERN_INFO, tun,
				  "Linktype set failed because interface is up\n");
1955
			ret = -EBUSY;
1956 1957
		} else {
			tun->dev->type = (int) arg;
1958 1959
			tun_debug(KERN_INFO, tun, "linktype set to %d\n",
				  tun->dev->type);
1960
			ret = 0;
1961
		}
E
Eric W. Biederman 已提交
1962
		break;
1963

L
Linus Torvalds 已提交
1964 1965 1966 1967 1968
#ifdef TUN_DEBUG
	case TUNSETDEBUG:
		tun->debug = arg;
		break;
#endif
1969
	case TUNSETOFFLOAD:
1970
		ret = set_offload(tun, arg);
E
Eric W. Biederman 已提交
1971
		break;
1972

1973 1974
	case TUNSETTXFILTER:
		/* Can be set only for TAPs */
E
Eric W. Biederman 已提交
1975
		ret = -EINVAL;
1976
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
E
Eric W. Biederman 已提交
1977
			break;
H
Harvey Harrison 已提交
1978
		ret = update_filter(&tun->txflt, (void __user *)arg);
E
Eric W. Biederman 已提交
1979
		break;
L
Linus Torvalds 已提交
1980 1981

	case SIOCGIFHWADDR:
1982
		/* Get hw address */
1983 1984
		memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN);
		ifr.ifr_hwaddr.sa_family = tun->dev->type;
1985
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1986 1987
			ret = -EFAULT;
		break;
L
Linus Torvalds 已提交
1988 1989

	case SIOCSIFHWADDR:
1990
		/* Set hw address */
1991 1992
		tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n",
			  ifr.ifr_hwaddr.sa_data);
1993 1994

		ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
E
Eric W. Biederman 已提交
1995
		break;
1996 1997

	case TUNGETSNDBUF:
J
Jason Wang 已提交
1998
		sndbuf = tfile->socket.sk->sk_sndbuf;
1999 2000 2001 2002 2003 2004 2005 2006 2007 2008
		if (copy_to_user(argp, &sndbuf, sizeof(sndbuf)))
			ret = -EFAULT;
		break;

	case TUNSETSNDBUF:
		if (copy_from_user(&sndbuf, argp, sizeof(sndbuf))) {
			ret = -EFAULT;
			break;
		}

J
Jason Wang 已提交
2009 2010
		tun->sndbuf = sndbuf;
		tun_set_sndbuf(tun);
2011 2012
		break;

2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031
	case TUNGETVNETHDRSZ:
		vnet_hdr_sz = tun->vnet_hdr_sz;
		if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
			ret = -EFAULT;
		break;

	case TUNSETVNETHDRSZ:
		if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
			ret = -EFAULT;
			break;
		}
		if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
			ret = -EINVAL;
			break;
		}

		tun->vnet_hdr_sz = vnet_hdr_sz;
		break;

M
Michael S. Tsirkin 已提交
2032 2033 2034 2035 2036 2037
	case TUNATTACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
		ret = -EFAULT;
J
Jason Wang 已提交
2038
		if (copy_from_user(&tun->fprog, argp, sizeof(tun->fprog)))
M
Michael S. Tsirkin 已提交
2039 2040
			break;

J
Jason Wang 已提交
2041
		ret = tun_attach_filter(tun);
M
Michael S. Tsirkin 已提交
2042 2043 2044 2045 2046 2047 2048
		break;

	case TUNDETACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
J
Jason Wang 已提交
2049 2050
		ret = 0;
		tun_detach_filter(tun, tun->numqueues);
M
Michael S. Tsirkin 已提交
2051 2052
		break;

L
Linus Torvalds 已提交
2053
	default:
E
Eric W. Biederman 已提交
2054 2055
		ret = -EINVAL;
		break;
2056
	}
L
Linus Torvalds 已提交
2057

2058 2059 2060 2061
unlock:
	rtnl_unlock();
	if (tun)
		tun_put(tun);
E
Eric W. Biederman 已提交
2062
	return ret;
L
Linus Torvalds 已提交
2063 2064
}

2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099
static long tun_chr_ioctl(struct file *file,
			  unsigned int cmd, unsigned long arg)
{
	return __tun_chr_ioctl(file, cmd, arg, sizeof (struct ifreq));
}

#ifdef CONFIG_COMPAT
static long tun_chr_compat_ioctl(struct file *file,
			 unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case TUNSETIFF:
	case TUNGETIFF:
	case TUNSETTXFILTER:
	case TUNGETSNDBUF:
	case TUNSETSNDBUF:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
		arg = (unsigned long)compat_ptr(arg);
		break;
	default:
		arg = (compat_ulong_t)arg;
		break;
	}

	/*
	 * compat_ifreq is shorter than ifreq, so we must not access beyond
	 * the end of that structure. All fields that are used in this
	 * driver are compatible though, we don't need to convert the
	 * contents.
	 */
	return __tun_chr_ioctl(file, cmd, arg, sizeof(struct compat_ifreq));
}
#endif /* CONFIG_COMPAT */

L
Linus Torvalds 已提交
2100 2101
static int tun_chr_fasync(int fd, struct file *file, int on)
{
J
Jason Wang 已提交
2102
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
2103 2104
	int ret;

J
Jason Wang 已提交
2105
	if ((ret = fasync_helper(fd, file, on, &tfile->fasync)) < 0)
J
Jonathan Corbet 已提交
2106
		goto out;
2107

L
Linus Torvalds 已提交
2108
	if (on) {
2109
		ret = __f_setown(file, task_pid(current), PIDTYPE_PID, 0);
L
Linus Torvalds 已提交
2110
		if (ret)
J
Jonathan Corbet 已提交
2111
			goto out;
J
Jason Wang 已提交
2112
		tfile->flags |= TUN_FASYNC;
2113
	} else
J
Jason Wang 已提交
2114
		tfile->flags &= ~TUN_FASYNC;
J
Jonathan Corbet 已提交
2115 2116 2117
	ret = 0;
out:
	return ret;
L
Linus Torvalds 已提交
2118 2119 2120 2121
}

static int tun_chr_open(struct inode *inode, struct file * file)
{
E
Eric W. Biederman 已提交
2122
	struct tun_file *tfile;
T
Thomas Gleixner 已提交
2123

2124
	DBG1(KERN_INFO, "tunX: tun_chr_open\n");
E
Eric W. Biederman 已提交
2125

J
Jason Wang 已提交
2126 2127
	tfile = (struct tun_file *)sk_alloc(&init_net, AF_UNSPEC, GFP_KERNEL,
					    &tun_proto);
E
Eric W. Biederman 已提交
2128 2129
	if (!tfile)
		return -ENOMEM;
2130
	rcu_assign_pointer(tfile->tun, NULL);
E
Eric W. Biederman 已提交
2131
	tfile->net = get_net(current->nsproxy->net_ns);
J
Jason Wang 已提交
2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145
	tfile->flags = 0;

	rcu_assign_pointer(tfile->socket.wq, &tfile->wq);
	init_waitqueue_head(&tfile->wq.wait);

	tfile->socket.file = file;
	tfile->socket.ops = &tun_socket_ops;

	sock_init_data(&tfile->socket, &tfile->sk);
	sk_change_net(&tfile->sk, tfile->net);

	tfile->sk.sk_write_space = tun_sock_write_space;
	tfile->sk.sk_sndbuf = INT_MAX;

E
Eric W. Biederman 已提交
2146
	file->private_data = tfile;
J
Jason Wang 已提交
2147
	set_bit(SOCK_EXTERNALLY_ALLOCATED, &tfile->socket.flags);
J
Jason Wang 已提交
2148
	INIT_LIST_HEAD(&tfile->next);
J
Jason Wang 已提交
2149

L
Linus Torvalds 已提交
2150 2151 2152 2153 2154
	return 0;
}

static int tun_chr_close(struct inode *inode, struct file *file)
{
E
Eric W. Biederman 已提交
2155
	struct tun_file *tfile = file->private_data;
J
Jason Wang 已提交
2156
	struct net *net = tfile->net;
L
Linus Torvalds 已提交
2157

J
Jason Wang 已提交
2158
	tun_detach(tfile, true);
J
Jason Wang 已提交
2159
	put_net(net);
L
Linus Torvalds 已提交
2160 2161 2162 2163

	return 0;
}

2164
static const struct file_operations tun_fops = {
2165
	.owner	= THIS_MODULE,
L
Linus Torvalds 已提交
2166
	.llseek = no_llseek,
2167 2168 2169 2170
	.read  = do_sync_read,
	.aio_read  = tun_chr_aio_read,
	.write = do_sync_write,
	.aio_write = tun_chr_aio_write,
L
Linus Torvalds 已提交
2171
	.poll	= tun_chr_poll,
2172 2173 2174 2175
	.unlocked_ioctl	= tun_chr_ioctl,
#ifdef CONFIG_COMPAT
	.compat_ioctl = tun_chr_compat_ioctl,
#endif
L
Linus Torvalds 已提交
2176 2177
	.open	= tun_chr_open,
	.release = tun_chr_close,
2178
	.fasync = tun_chr_fasync
L
Linus Torvalds 已提交
2179 2180 2181 2182 2183
};

static struct miscdevice tun_miscdev = {
	.minor = TUN_MINOR,
	.name = "tun",
2184
	.nodename = "net/tun",
L
Linus Torvalds 已提交
2185 2186 2187 2188 2189 2190 2191 2192 2193
	.fops = &tun_fops,
};

/* ethtool interface */

static int tun_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
	cmd->supported		= 0;
	cmd->advertising	= 0;
2194
	ethtool_cmd_speed_set(cmd, SPEED_10);
L
Linus Torvalds 已提交
2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208
	cmd->duplex		= DUPLEX_FULL;
	cmd->port		= PORT_TP;
	cmd->phy_address	= 0;
	cmd->transceiver	= XCVR_INTERNAL;
	cmd->autoneg		= AUTONEG_DISABLE;
	cmd->maxtxpkt		= 0;
	cmd->maxrxpkt		= 0;
	return 0;
}

static void tun_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
{
	struct tun_struct *tun = netdev_priv(dev);

2209 2210
	strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
	strlcpy(info->version, DRV_VERSION, sizeof(info->version));
L
Linus Torvalds 已提交
2211 2212 2213

	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
2214
		strlcpy(info->bus_info, "tun", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2215 2216
		break;
	case TUN_TAP_DEV:
2217
		strlcpy(info->bus_info, "tap", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239
		break;
	}
}

static u32 tun_get_msglevel(struct net_device *dev)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	return tun->debug;
#else
	return -EOPNOTSUPP;
#endif
}

static void tun_set_msglevel(struct net_device *dev, u32 value)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	tun->debug = value;
#endif
}

2240
static const struct ethtool_ops tun_ethtool_ops = {
L
Linus Torvalds 已提交
2241 2242 2243 2244
	.get_settings	= tun_get_settings,
	.get_drvinfo	= tun_get_drvinfo,
	.get_msglevel	= tun_get_msglevel,
	.set_msglevel	= tun_set_msglevel,
2245
	.get_link	= ethtool_op_get_link,
L
Linus Torvalds 已提交
2246 2247
};

2248

L
Linus Torvalds 已提交
2249 2250 2251 2252
static int __init tun_init(void)
{
	int ret = 0;

2253 2254
	pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
	pr_info("%s\n", DRV_COPYRIGHT);
L
Linus Torvalds 已提交
2255

2256
	ret = rtnl_link_register(&tun_link_ops);
2257
	if (ret) {
2258
		pr_err("Can't register link_ops\n");
2259
		goto err_linkops;
2260 2261
	}

L
Linus Torvalds 已提交
2262
	ret = misc_register(&tun_miscdev);
2263
	if (ret) {
2264
		pr_err("Can't register misc device %d\n", TUN_MINOR);
2265 2266
		goto err_misc;
	}
2267
	return  0;
2268
err_misc:
2269 2270
	rtnl_link_unregister(&tun_link_ops);
err_linkops:
L
Linus Torvalds 已提交
2271 2272 2273 2274 2275
	return ret;
}

static void tun_cleanup(void)
{
2276
	misc_deregister(&tun_miscdev);
2277
	rtnl_link_unregister(&tun_link_ops);
L
Linus Torvalds 已提交
2278 2279
}

2280 2281 2282 2283 2284 2285
/* Get an underlying socket object from tun file.  Returns error unless file is
 * attached to a device.  The returned object works like a packet socket, it
 * can be used for sock_sendmsg/sock_recvmsg.  The caller is responsible for
 * holding a reference to the file for as long as the socket is in use. */
struct socket *tun_get_socket(struct file *file)
{
2286
	struct tun_file *tfile;
2287 2288
	if (file->f_op != &tun_fops)
		return ERR_PTR(-EINVAL);
2289 2290
	tfile = file->private_data;
	if (!tfile)
2291
		return ERR_PTR(-EBADFD);
J
Jason Wang 已提交
2292
	return &tfile->socket;
2293 2294 2295
}
EXPORT_SYMBOL_GPL(tun_get_socket);

L
Linus Torvalds 已提交
2296 2297 2298 2299 2300 2301
module_init(tun_init);
module_exit(tun_cleanup);
MODULE_DESCRIPTION(DRV_DESCRIPTION);
MODULE_AUTHOR(DRV_COPYRIGHT);
MODULE_LICENSE("GPL");
MODULE_ALIAS_MISCDEV(TUN_MINOR);
2302
MODULE_ALIAS("devname:net/tun");