tun.c 52.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
/*
 *  TUN - Universal TUN/TAP device driver.
 *  Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 *  GNU General Public License for more details.
 *
 *  $Id: tun.c,v 1.15 2002/03/01 02:44:24 maxk Exp $
 */

/*
 *  Changes:
 *
21 22 23
 *  Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14
 *    Add TUNSETLINK ioctl to set the link encapsulation
 *
L
Linus Torvalds 已提交
24
 *  Mark Smith <markzzzsmith@yahoo.com.au>
J
Joe Perches 已提交
25
 *    Use eth_random_addr() for tap MAC address.
L
Linus Torvalds 已提交
26 27 28 29 30 31 32 33 34 35 36
 *
 *  Harald Roelle <harald.roelle@ifi.lmu.de>  2004/04/20
 *    Fixes in packet dropping, queue length setting and queue wakeup.
 *    Increased default tx queue length.
 *    Added ethtool API.
 *    Minor cleanups
 *
 *  Daniel Podlejski <underley@underley.eu.org>
 *    Modifications for 2.3.99-pre5 kernel.
 */

37 38
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
#define DRV_NAME	"tun"
#define DRV_VERSION	"1.6"
#define DRV_DESCRIPTION	"Universal TUN/TAP device driver"
#define DRV_COPYRIGHT	"(C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>"

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/miscdevice.h>
#include <linux/ethtool.h>
#include <linux/rtnetlink.h>
58
#include <linux/compat.h>
L
Linus Torvalds 已提交
59 60 61 62 63
#include <linux/if.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/crc32.h>
64
#include <linux/nsproxy.h>
65
#include <linux/virtio_net.h>
M
Michael S. Tsirkin 已提交
66
#include <linux/rcupdate.h>
67
#include <net/net_namespace.h>
68
#include <net/netns/generic.h>
69
#include <net/rtnetlink.h>
70
#include <net/sock.h>
L
Linus Torvalds 已提交
71 72 73

#include <asm/uaccess.h>

74 75 76
/* Uncomment to enable debugging */
/* #define TUN_DEBUG 1 */

L
Linus Torvalds 已提交
77 78
#ifdef TUN_DEBUG
static int debug;
79

80 81 82 83 84 85 86 87 88 89
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (tun->debug)						\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (debug == 2)						\
		printk(level fmt, ##args);			\
} while (0)
90
#else
91 92 93 94 95 96 97 98 99 100
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (0)							\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (0)							\
		printk(level fmt, ##args);			\
} while (0)
101 102
#endif

103 104
#define GOODCOPY_LEN 128

105 106 107 108 109 110 111
#define FLT_EXACT_COUNT 8
struct tap_filter {
	unsigned int    count;    /* Number of addrs. Zero means disabled */
	u32             mask[2];  /* Mask of the hashed addrs */
	unsigned char	addr[FLT_EXACT_COUNT][ETH_ALEN];
};

J
Jason Wang 已提交
112 113 114 115 116 117
/* 1024 is probably a high enough limit: modern hypervisors seem to support on
 * the order of 100-200 CPUs so this leaves us some breathing space if we want
 * to match a queue per guest CPU.
 */
#define MAX_TAP_QUEUES 1024

J
Jason Wang 已提交
118 119
#define TUN_FLOW_EXPIRE (3 * HZ)

J
Jason Wang 已提交
120 121 122 123
/* A tun_file connects an open character device to a tuntap netdevice. It
 * also contains all socket related strctures (except sock_fprog and tap_filter)
 * to serve as one transmit queue for tuntap device. The sock_fprog and
 * tap_filter were kept in tun_struct since they were used for filtering for the
R
Rami Rosen 已提交
124
 * netdevice not for a specific queue (at least I didn't see the requirement for
J
Jason Wang 已提交
125
 * this).
126 127
 *
 * RCU usage:
R
Rami Rosen 已提交
128
 * The tun_file and tun_struct are loosely coupled, the pointer from one to the
129
 * other can only be read while rcu_read_lock or rtnl_lock is held.
J
Jason Wang 已提交
130
 */
E
Eric W. Biederman 已提交
131
struct tun_file {
J
Jason Wang 已提交
132 133 134
	struct sock sk;
	struct socket socket;
	struct socket_wq wq;
135
	struct tun_struct __rcu *tun;
E
Eric W. Biederman 已提交
136
	struct net *net;
J
Jason Wang 已提交
137 138 139
	struct fasync_struct *fasync;
	/* only used for fasnyc */
	unsigned int flags;
J
Jason Wang 已提交
140
	u16 queue_index;
E
Eric W. Biederman 已提交
141 142
};

J
Jason Wang 已提交
143 144 145 146 147 148 149 150 151 152 153 154
struct tun_flow_entry {
	struct hlist_node hash_link;
	struct rcu_head rcu;
	struct tun_struct *tun;

	u32 rxhash;
	int queue_index;
	unsigned long updated;
};

#define TUN_NUM_FLOW_ENTRIES 1024

J
Jason Wang 已提交
155
/* Since the socket were moved to tun_file, to preserve the behavior of persist
R
Rami Rosen 已提交
156
 * device, socket filter, sndbuf and vnet header size were restore when the
J
Jason Wang 已提交
157 158
 * file were attached to a persist device.
 */
159
struct tun_struct {
J
Jason Wang 已提交
160 161
	struct tun_file __rcu	*tfiles[MAX_TAP_QUEUES];
	unsigned int            numqueues;
162
	unsigned int 		flags;
163 164
	kuid_t			owner;
	kgid_t			group;
165 166

	struct net_device	*dev;
167
	netdev_features_t	set_features;
168 169
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
			  NETIF_F_TSO6|NETIF_F_UFO)
170 171

	int			vnet_hdr_sz;
J
Jason Wang 已提交
172 173 174 175 176
	int			sndbuf;
	struct tap_filter	txflt;
	struct sock_fprog	fprog;
	/* protected by rtnl lock */
	bool			filter_attached;
177 178
#ifdef TUN_DEBUG
	int debug;
L
Linus Torvalds 已提交
179
#endif
J
Jason Wang 已提交
180 181 182 183 184
	spinlock_t lock;
	struct kmem_cache *flow_cache;
	struct hlist_head flows[TUN_NUM_FLOW_ENTRIES];
	struct timer_list flow_gc_timer;
	unsigned long ageing_time;
185
};
L
Linus Torvalds 已提交
186

J
Jason Wang 已提交
187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337
static inline u32 tun_hashfn(u32 rxhash)
{
	return rxhash & 0x3ff;
}

static struct tun_flow_entry *tun_flow_find(struct hlist_head *head, u32 rxhash)
{
	struct tun_flow_entry *e;
	struct hlist_node *n;

	hlist_for_each_entry_rcu(e, n, head, hash_link) {
		if (e->rxhash == rxhash)
			return e;
	}
	return NULL;
}

static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
					      struct hlist_head *head,
					      u32 rxhash, u16 queue_index)
{
	struct tun_flow_entry *e = kmem_cache_alloc(tun->flow_cache,
						    GFP_ATOMIC);
	if (e) {
		tun_debug(KERN_INFO, tun, "create flow: hash %u index %u\n",
			  rxhash, queue_index);
		e->updated = jiffies;
		e->rxhash = rxhash;
		e->queue_index = queue_index;
		e->tun = tun;
		hlist_add_head_rcu(&e->hash_link, head);
	}
	return e;
}

static void tun_flow_free(struct rcu_head *head)
{
	struct tun_flow_entry *e
		= container_of(head, struct tun_flow_entry, rcu);
	kmem_cache_free(e->tun->flow_cache, e);
}

static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
{
	tun_debug(KERN_INFO, tun, "delete flow: hash %u index %u\n",
		  e->rxhash, e->queue_index);
	hlist_del_rcu(&e->hash_link);
	call_rcu(&e->rcu, tun_flow_free);
}

static void tun_flow_flush(struct tun_struct *tun)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
		struct hlist_node *h, *n;

		hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link)
			tun_flow_delete(tun, e);
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_delete_by_queue(struct tun_struct *tun, u16 queue_index)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
		struct hlist_node *h, *n;

		hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link) {
			if (e->queue_index == queue_index)
				tun_flow_delete(tun, e);
		}
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_cleanup(unsigned long data)
{
	struct tun_struct *tun = (struct tun_struct *)data;
	unsigned long delay = tun->ageing_time;
	unsigned long next_timer = jiffies + delay;
	unsigned long count = 0;
	int i;

	tun_debug(KERN_INFO, tun, "tun_flow_cleanup\n");

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
		struct hlist_node *h, *n;

		hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link) {
			unsigned long this_timer;
			count++;
			this_timer = e->updated + delay;
			if (time_before_eq(this_timer, jiffies))
				tun_flow_delete(tun, e);
			else if (time_before(this_timer, next_timer))
				next_timer = this_timer;
		}
	}

	if (count)
		mod_timer(&tun->flow_gc_timer, round_jiffies_up(next_timer));
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_update(struct tun_struct *tun, struct sk_buff *skb,
			    u16 queue_index)
{
	struct hlist_head *head;
	struct tun_flow_entry *e;
	unsigned long delay = tun->ageing_time;
	u32 rxhash = skb_get_rxhash(skb);

	if (!rxhash)
		return;
	else
		head = &tun->flows[tun_hashfn(rxhash)];

	rcu_read_lock();

	if (tun->numqueues == 1)
		goto unlock;

	e = tun_flow_find(head, rxhash);
	if (likely(e)) {
		/* TODO: keep queueing to old queue until it's empty? */
		e->queue_index = queue_index;
		e->updated = jiffies;
	} else {
		spin_lock_bh(&tun->lock);
		if (!tun_flow_find(head, rxhash))
			tun_flow_create(tun, head, rxhash, queue_index);

		if (!timer_pending(&tun->flow_gc_timer))
			mod_timer(&tun->flow_gc_timer,
				  round_jiffies_up(jiffies + delay));
		spin_unlock_bh(&tun->lock);
	}

unlock:
	rcu_read_unlock();
}

J
Jason Wang 已提交
338 339 340 341 342 343 344 345 346 347
/* We try to identify a flow through its rxhash first. The reason that
 * we do not check rxq no. is becuase some cards(e.g 82599), chooses
 * the rxq based on the txq where the last packet of the flow comes. As
 * the userspace application move between processors, we may get a
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
348
	struct tun_flow_entry *e;
J
Jason Wang 已提交
349 350 351 352 353 354 355 356
	u32 txq = 0;
	u32 numqueues = 0;

	rcu_read_lock();
	numqueues = tun->numqueues;

	txq = skb_get_rxhash(skb);
	if (txq) {
J
Jason Wang 已提交
357 358 359 360 361 362
		e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq);
		if (e)
			txq = e->queue_index;
		else
			/* use multiply and shift instead of expensive divide */
			txq = ((u64)txq * numqueues) >> 32;
J
Jason Wang 已提交
363 364 365 366 367 368 369 370 371 372
	} else if (likely(skb_rx_queue_recorded(skb))) {
		txq = skb_get_rx_queue(skb);
		while (unlikely(txq >= numqueues))
			txq -= numqueues;
	}

	rcu_read_unlock();
	return txq;
}

373 374 375
static inline bool tun_not_capable(struct tun_struct *tun)
{
	const struct cred *cred = current_cred();
376
	struct net *net = dev_net(tun->dev);
377 378 379

	return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
		  (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
380
		!ns_capable(net->user_ns, CAP_NET_ADMIN);
381 382
}

J
Jason Wang 已提交
383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412
static void tun_set_real_num_queues(struct tun_struct *tun)
{
	netif_set_real_num_tx_queues(tun->dev, tun->numqueues);
	netif_set_real_num_rx_queues(tun->dev, tun->numqueues);
}

static void __tun_detach(struct tun_file *tfile, bool clean)
{
	struct tun_file *ntfile;
	struct tun_struct *tun;
	struct net_device *dev;

	tun = rcu_dereference_protected(tfile->tun,
					lockdep_rtnl_is_held());
	if (tun) {
		u16 index = tfile->queue_index;
		BUG_ON(index >= tun->numqueues);
		dev = tun->dev;

		rcu_assign_pointer(tun->tfiles[index],
				   tun->tfiles[tun->numqueues - 1]);
		rcu_assign_pointer(tfile->tun, NULL);
		ntfile = rcu_dereference_protected(tun->tfiles[index],
						   lockdep_rtnl_is_held());
		ntfile->queue_index = index;

		--tun->numqueues;
		sock_put(&tfile->sk);

		synchronize_net();
J
Jason Wang 已提交
413
		tun_flow_delete_by_queue(tun, tun->numqueues + 1);
J
Jason Wang 已提交
414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462
		/* Drop read queue */
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		tun_set_real_num_queues(tun);

		if (tun->numqueues == 0 && !(tun->flags & TUN_PERSIST))
			if (dev->reg_state == NETREG_REGISTERED)
				unregister_netdevice(dev);
	}

	if (clean) {
		BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
				 &tfile->socket.flags));
		sk_release_kernel(&tfile->sk);
	}
}

static void tun_detach(struct tun_file *tfile, bool clean)
{
	rtnl_lock();
	__tun_detach(tfile, clean);
	rtnl_unlock();
}

static void tun_detach_all(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
	struct tun_file *tfile;
	int i, n = tun->numqueues;

	for (i = 0; i < n; i++) {
		tfile = rcu_dereference_protected(tun->tfiles[i],
						  lockdep_rtnl_is_held());
		BUG_ON(!tfile);
		wake_up_all(&tfile->wq.wait);
		rcu_assign_pointer(tfile->tun, NULL);
		--tun->numqueues;
	}
	BUG_ON(tun->numqueues != 0);

	synchronize_net();
	for (i = 0; i < n; i++) {
		tfile = rcu_dereference_protected(tun->tfiles[i],
						  lockdep_rtnl_is_held());
		/* Drop read queue */
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		sock_put(&tfile->sk);
	}
}

463 464
static int tun_attach(struct tun_struct *tun, struct file *file)
{
E
Eric W. Biederman 已提交
465
	struct tun_file *tfile = file->private_data;
466
	int err;
467

468
	err = -EINVAL;
J
Jason Wang 已提交
469
	if (rcu_dereference_protected(tfile->tun, lockdep_rtnl_is_held()))
470 471 472
		goto out;

	err = -EBUSY;
J
Jason Wang 已提交
473 474 475 476 477
	if (!(tun->flags & TUN_TAP_MQ) && tun->numqueues == 1)
		goto out;

	err = -E2BIG;
	if (tun->numqueues == MAX_TAP_QUEUES)
478 479 480
		goto out;

	err = 0;
J
Jason Wang 已提交
481

J
Jason Wang 已提交
482
	/* Re-attach the filter to presist device */
J
Jason Wang 已提交
483 484 485 486 487
	if (tun->filter_attached == true) {
		err = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (!err)
			goto out;
	}
J
Jason Wang 已提交
488
	tfile->queue_index = tun->numqueues;
489
	rcu_assign_pointer(tfile->tun, tun);
J
Jason Wang 已提交
490
	rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
J
Jason Wang 已提交
491
	sock_hold(&tfile->sk);
J
Jason Wang 已提交
492
	tun->numqueues++;
493

J
Jason Wang 已提交
494
	tun_set_real_num_queues(tun);
495

J
Jason Wang 已提交
496 497 498 499 500 501
	/* device is allowed to go away first, so no need to hold extra
	 * refcnt.
	 */

out:
	return err;
E
Eric W. Biederman 已提交
502 503 504 505
}

static struct tun_struct *__tun_get(struct tun_file *tfile)
{
506
	struct tun_struct *tun;
507

508 509 510 511 512
	rcu_read_lock();
	tun = rcu_dereference(tfile->tun);
	if (tun)
		dev_hold(tun->dev);
	rcu_read_unlock();
513 514

	return tun;
E
Eric W. Biederman 已提交
515 516 517 518 519 520 521 522 523
}

static struct tun_struct *tun_get(struct file *file)
{
	return __tun_get(file->private_data);
}

static void tun_put(struct tun_struct *tun)
{
524
	dev_put(tun->dev);
E
Eric W. Biederman 已提交
525 526
}

527
/* TAP filtering */
528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576
static void addr_hash_set(u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	mask[n >> 5] |= (1 << (n & 31));
}

static unsigned int addr_hash_test(const u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	return mask[n >> 5] & (1 << (n & 31));
}

static int update_filter(struct tap_filter *filter, void __user *arg)
{
	struct { u8 u[ETH_ALEN]; } *addr;
	struct tun_filter uf;
	int err, alen, n, nexact;

	if (copy_from_user(&uf, arg, sizeof(uf)))
		return -EFAULT;

	if (!uf.count) {
		/* Disabled */
		filter->count = 0;
		return 0;
	}

	alen = ETH_ALEN * uf.count;
	addr = kmalloc(alen, GFP_KERNEL);
	if (!addr)
		return -ENOMEM;

	if (copy_from_user(addr, arg + sizeof(uf), alen)) {
		err = -EFAULT;
		goto done;
	}

	/* The filter is updated without holding any locks. Which is
	 * perfectly safe. We disable it first and in the worst
	 * case we'll accept a few undesired packets. */
	filter->count = 0;
	wmb();

	/* Use first set of addresses as an exact filter */
	for (n = 0; n < uf.count && n < FLT_EXACT_COUNT; n++)
		memcpy(filter->addr[n], addr[n].u, ETH_ALEN);

	nexact = n;

577 578
	/* Remaining multicast addresses are hashed,
	 * unicast will leave the filter disabled. */
579
	memset(filter->mask, 0, sizeof(filter->mask));
580 581 582 583 584
	for (; n < uf.count; n++) {
		if (!is_multicast_ether_addr(addr[n].u)) {
			err = 0; /* no filter */
			goto done;
		}
585
		addr_hash_set(filter->mask, addr[n].u);
586
	}
587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614

	/* For ALLMULTI just set the mask to all ones.
	 * This overrides the mask populated above. */
	if ((uf.flags & TUN_FLT_ALLMULTI))
		memset(filter->mask, ~0, sizeof(filter->mask));

	/* Now enable the filter */
	wmb();
	filter->count = nexact;

	/* Return the number of exact filters */
	err = nexact;

done:
	kfree(addr);
	return err;
}

/* Returns: 0 - drop, !=0 - accept */
static int run_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	/* Cannot use eth_hdr(skb) here because skb_mac_hdr() is incorrect
	 * at this point. */
	struct ethhdr *eh = (struct ethhdr *) skb->data;
	int i;

	/* Exact match */
	for (i = 0; i < filter->count; i++)
615
		if (ether_addr_equal(eh->h_dest, filter->addr[i]))
616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636
			return 1;

	/* Inexact match (multicast only) */
	if (is_multicast_ether_addr(eh->h_dest))
		return addr_hash_test(filter->mask, eh->h_dest);

	return 0;
}

/*
 * Checks whether the packet is accepted or not.
 * Returns: 0 - drop, !=0 - accept
 */
static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	if (!filter->count)
		return 1;

	return run_filter(filter, skb);
}

L
Linus Torvalds 已提交
637 638
/* Network device part of the driver */

639
static const struct ethtool_ops tun_ethtool_ops;
L
Linus Torvalds 已提交
640

641 642 643
/* Net device detach from fd. */
static void tun_net_uninit(struct net_device *dev)
{
J
Jason Wang 已提交
644
	tun_detach_all(dev);
645 646
}

L
Linus Torvalds 已提交
647 648 649
/* Net device open. */
static int tun_net_open(struct net_device *dev)
{
J
Jason Wang 已提交
650
	netif_tx_start_all_queues(dev);
L
Linus Torvalds 已提交
651 652 653 654 655 656
	return 0;
}

/* Net device close. */
static int tun_net_close(struct net_device *dev)
{
J
Jason Wang 已提交
657
	netif_tx_stop_all_queues(dev);
L
Linus Torvalds 已提交
658 659 660 661
	return 0;
}

/* Net device start xmit */
662
static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
L
Linus Torvalds 已提交
663 664
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
665
	int txq = skb->queue_mapping;
666
	struct tun_file *tfile;
L
Linus Torvalds 已提交
667

668
	rcu_read_lock();
J
Jason Wang 已提交
669 670
	tfile = rcu_dereference(tun->tfiles[txq]);

L
Linus Torvalds 已提交
671
	/* Drop packet if interface is not attached */
J
Jason Wang 已提交
672
	if (txq >= tun->numqueues)
L
Linus Torvalds 已提交
673 674
		goto drop;

675 676
	tun_debug(KERN_INFO, tun, "tun_net_xmit %d\n", skb->len);

J
Jason Wang 已提交
677 678
	BUG_ON(!tfile);

679 680 681 682 683 684
	/* Drop if the filter does not like it.
	 * This is a noop if the filter is disabled.
	 * Filter can be enabled only for the TAP devices. */
	if (!check_filter(&tun->txflt, skb))
		goto drop;

J
Jason Wang 已提交
685 686
	if (tfile->socket.sk->sk_filter &&
	    sk_filter(tfile->socket.sk, skb))
M
Michael S. Tsirkin 已提交
687 688
		goto drop;

R
Rami Rosen 已提交
689
	/* Limit the number of packets queued by dividing txq length with the
J
Jason Wang 已提交
690 691
	 * number of queues.
	 */
J
Jason Wang 已提交
692
	if (skb_queue_len(&tfile->socket.sk->sk_receive_queue)
693 694
			  >= dev->tx_queue_len / tun->numqueues)
		goto drop;
L
Linus Torvalds 已提交
695

M
Michael S. Tsirkin 已提交
696 697
	/* Orphan the skb - required as we might hang on to it
	 * for indefinite time. */
M
Michael S. Tsirkin 已提交
698 699
	if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
		goto drop;
M
Michael S. Tsirkin 已提交
700 701
	skb_orphan(skb);

702
	/* Enqueue packet */
J
Jason Wang 已提交
703
	skb_queue_tail(&tfile->socket.sk->sk_receive_queue, skb);
L
Linus Torvalds 已提交
704 705

	/* Notify and wake up reader process */
J
Jason Wang 已提交
706 707 708
	if (tfile->flags & TUN_FASYNC)
		kill_fasync(&tfile->fasync, SIGIO, POLL_IN);
	wake_up_interruptible_poll(&tfile->wq.wait, POLLIN |
709
				   POLLRDNORM | POLLRDBAND);
710 711

	rcu_read_unlock();
712
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
713 714

drop:
715
	dev->stats.tx_dropped++;
716
	skb_tx_error(skb);
L
Linus Torvalds 已提交
717
	kfree_skb(skb);
718
	rcu_read_unlock();
719
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
720 721
}

722
static void tun_net_mclist(struct net_device *dev)
L
Linus Torvalds 已提交
723
{
724 725 726 727 728
	/*
	 * This callback is supposed to deal with mc filter in
	 * _rx_ path and has nothing to do with the _tx_ path.
	 * In rx path we always accept everything userspace gives us.
	 */
L
Linus Torvalds 已提交
729 730
}

E
Ed Swierk 已提交
731 732 733 734 735 736 737 738 739 740 741 742
#define MIN_MTU 68
#define MAX_MTU 65535

static int
tun_net_change_mtu(struct net_device *dev, int new_mtu)
{
	if (new_mtu < MIN_MTU || new_mtu + dev->hard_header_len > MAX_MTU)
		return -EINVAL;
	dev->mtu = new_mtu;
	return 0;
}

743 744
static netdev_features_t tun_net_fix_features(struct net_device *dev,
	netdev_features_t features)
745 746 747 748 749
{
	struct tun_struct *tun = netdev_priv(dev);

	return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
}
750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766
#ifdef CONFIG_NET_POLL_CONTROLLER
static void tun_poll_controller(struct net_device *dev)
{
	/*
	 * Tun only receives frames when:
	 * 1) the char device endpoint gets data from user space
	 * 2) the tun socket gets a sendmsg call from user space
	 * Since both of those are syncronous operations, we are guaranteed
	 * never to have pending data when we poll for it
	 * so theres nothing to do here but return.
	 * We need this though so netpoll recognizes us as an interface that
	 * supports polling, which enables bridge devices in virt setups to
	 * still use netconsole
	 */
	return;
}
#endif
S
Stephen Hemminger 已提交
767
static const struct net_device_ops tun_netdev_ops = {
768
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
769 770
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
771
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
772
	.ndo_change_mtu		= tun_net_change_mtu,
773
	.ndo_fix_features	= tun_net_fix_features,
J
Jason Wang 已提交
774
	.ndo_select_queue	= tun_select_queue,
775 776 777
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
778 779 780
};

static const struct net_device_ops tap_netdev_ops = {
781
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
782 783
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
784
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
785
	.ndo_change_mtu		= tun_net_change_mtu,
786
	.ndo_fix_features	= tun_net_fix_features,
787
	.ndo_set_rx_mode	= tun_net_mclist,
S
Stephen Hemminger 已提交
788 789
	.ndo_set_mac_address	= eth_mac_addr,
	.ndo_validate_addr	= eth_validate_addr,
J
Jason Wang 已提交
790
	.ndo_select_queue	= tun_select_queue,
791 792 793
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
794 795
};

J
Jason Wang 已提交
796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826
static int tun_flow_init(struct tun_struct *tun)
{
	int i;

	tun->flow_cache = kmem_cache_create("tun_flow_cache",
					    sizeof(struct tun_flow_entry), 0, 0,
					    NULL);
	if (!tun->flow_cache)
		return -ENOMEM;

	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++)
		INIT_HLIST_HEAD(&tun->flows[i]);

	tun->ageing_time = TUN_FLOW_EXPIRE;
	setup_timer(&tun->flow_gc_timer, tun_flow_cleanup, (unsigned long)tun);
	mod_timer(&tun->flow_gc_timer,
		  round_jiffies_up(jiffies + tun->ageing_time));

	return 0;
}

static void tun_flow_uninit(struct tun_struct *tun)
{
	del_timer_sync(&tun->flow_gc_timer);
	tun_flow_flush(tun);

	/* Wait for completion of call_rcu()'s */
	rcu_barrier();
	kmem_cache_destroy(tun->flow_cache);
}

L
Linus Torvalds 已提交
827 828 829 830
/* Initialize net device. */
static void tun_net_init(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
831

L
Linus Torvalds 已提交
832 833
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
S
Stephen Hemminger 已提交
834 835
		dev->netdev_ops = &tun_netdev_ops;

L
Linus Torvalds 已提交
836 837 838 839 840 841
		/* Point-to-Point TUN Device */
		dev->hard_header_len = 0;
		dev->addr_len = 0;
		dev->mtu = 1500;

		/* Zero header length */
842
		dev->type = ARPHRD_NONE;
L
Linus Torvalds 已提交
843 844 845 846 847
		dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;

	case TUN_TAP_DEV:
K
Kusanagi Kouichi 已提交
848
		dev->netdev_ops = &tap_netdev_ops;
L
Linus Torvalds 已提交
849 850
		/* Ethernet TAP Device */
		ether_setup(dev);
851
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
852

853
		eth_hw_addr_random(dev);
854

L
Linus Torvalds 已提交
855 856 857 858 859 860 861 862
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;
	}
}

/* Character device part */

/* Poll */
J
Jason Wang 已提交
863
static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
864
{
865 866
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
867
	struct sock *sk;
868
	unsigned int mask = 0;
L
Linus Torvalds 已提交
869 870

	if (!tun)
871
		return POLLERR;
L
Linus Torvalds 已提交
872

J
Jason Wang 已提交
873
	sk = tfile->socket.sk;
874

875
	tun_debug(KERN_INFO, tun, "tun_chr_poll\n");
L
Linus Torvalds 已提交
876

J
Jason Wang 已提交
877
	poll_wait(file, &tfile->wq.wait, wait);
878

879
	if (!skb_queue_empty(&sk->sk_receive_queue))
L
Linus Torvalds 已提交
880 881
		mask |= POLLIN | POLLRDNORM;

882 883 884 885 886
	if (sock_writeable(sk) ||
	    (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
	     sock_writeable(sk)))
		mask |= POLLOUT | POLLWRNORM;

887 888 889
	if (tun->dev->reg_state != NETREG_REGISTERED)
		mask = POLLERR;

E
Eric W. Biederman 已提交
890
	tun_put(tun);
L
Linus Torvalds 已提交
891 892 893
	return mask;
}

894 895
/* prepad is the amount to reserve at front.  len is length after that.
 * linear is a hint as to how much to copy (usually headers). */
J
Jason Wang 已提交
896
static struct sk_buff *tun_alloc_skb(struct tun_file *tfile,
897 898
				     size_t prepad, size_t len,
				     size_t linear, int noblock)
899
{
J
Jason Wang 已提交
900
	struct sock *sk = tfile->socket.sk;
901
	struct sk_buff *skb;
902
	int err;
903 904

	/* Under a page?  Don't bother with paged skb. */
H
Herbert Xu 已提交
905
	if (prepad + len < PAGE_SIZE || !linear)
906
		linear = len;
907

908 909
	skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
				   &err);
910
	if (!skb)
911
		return ERR_PTR(err);
912 913 914

	skb_reserve(skb, prepad);
	skb_put(skb, linear);
915 916
	skb->data_len = len - linear;
	skb->len += len - linear;
917 918 919 920

	return skb;
}

921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998
/* set skb frags from iovec, this can move to core network code for reuse */
static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
				  int offset, size_t count)
{
	int len = iov_length(from, count) - offset;
	int copy = skb_headlen(skb);
	int size, offset1 = 0;
	int i = 0;

	/* Skip over from offset */
	while (count && (offset >= from->iov_len)) {
		offset -= from->iov_len;
		++from;
		--count;
	}

	/* copy up to skb headlen */
	while (count && (copy > 0)) {
		size = min_t(unsigned int, copy, from->iov_len - offset);
		if (copy_from_user(skb->data + offset1, from->iov_base + offset,
				   size))
			return -EFAULT;
		if (copy > size) {
			++from;
			--count;
			offset = 0;
		} else
			offset += size;
		copy -= size;
		offset1 += size;
	}

	if (len == offset1)
		return 0;

	while (count--) {
		struct page *page[MAX_SKB_FRAGS];
		int num_pages;
		unsigned long base;
		unsigned long truesize;

		len = from->iov_len - offset;
		if (!len) {
			offset = 0;
			++from;
			continue;
		}
		base = (unsigned long)from->iov_base + offset;
		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
		if (i + size > MAX_SKB_FRAGS)
			return -EMSGSIZE;
		num_pages = get_user_pages_fast(base, size, 0, &page[i]);
		if (num_pages != size) {
			for (i = 0; i < num_pages; i++)
				put_page(page[i]);
			return -EFAULT;
		}
		truesize = size * PAGE_SIZE;
		skb->data_len += len;
		skb->len += len;
		skb->truesize += truesize;
		atomic_add(truesize, &skb->sk->sk_wmem_alloc);
		while (len) {
			int off = base & ~PAGE_MASK;
			int size = min_t(int, len, PAGE_SIZE - off);
			__skb_fill_page_desc(skb, i, page[i], off, size);
			skb_shinfo(skb)->nr_frags++;
			/* increase sk_wmem_alloc */
			base += size;
			len -= size;
			i++;
		}
		offset = 0;
		++from;
	}
	return 0;
}

L
Linus Torvalds 已提交
999
/* Get packet from user space buffer */
J
Jason Wang 已提交
1000 1001 1002
static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
			    void *msg_control, const struct iovec *iv,
			    size_t total_len, size_t count, int noblock)
L
Linus Torvalds 已提交
1003
{
1004
	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
L
Linus Torvalds 已提交
1005
	struct sk_buff *skb;
1006
	size_t len = total_len, align = NET_SKB_PAD;
1007
	struct virtio_net_hdr gso = { 0 };
1008
	int offset = 0;
1009 1010 1011
	int copylen;
	bool zerocopy = false;
	int err;
L
Linus Torvalds 已提交
1012 1013

	if (!(tun->flags & TUN_NO_PI)) {
1014
		if ((len -= sizeof(pi)) > total_len)
L
Linus Torvalds 已提交
1015 1016
			return -EINVAL;

1017
		if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
L
Linus Torvalds 已提交
1018
			return -EFAULT;
1019
		offset += sizeof(pi);
L
Linus Torvalds 已提交
1020 1021
	}

1022
	if (tun->flags & TUN_VNET_HDR) {
1023
		if ((len -= tun->vnet_hdr_sz) > total_len)
1024 1025
			return -EINVAL;

1026
		if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
1027 1028
			return -EFAULT;

1029 1030 1031 1032
		if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
		    gso.csum_start + gso.csum_offset + 2 > gso.hdr_len)
			gso.hdr_len = gso.csum_start + gso.csum_offset + 2;

1033 1034
		if (gso.hdr_len > len)
			return -EINVAL;
1035
		offset += tun->vnet_hdr_sz;
1036 1037
	}

1038
	if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
1039
		align += NET_IP_ALIGN;
H
Herbert Xu 已提交
1040 1041
		if (unlikely(len < ETH_HLEN ||
			     (gso.hdr_len && gso.hdr_len < ETH_HLEN)))
1042 1043
			return -EINVAL;
	}
1044

1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071
	if (msg_control)
		zerocopy = true;

	if (zerocopy) {
		/* Userspace may produce vectors with count greater than
		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
		 * to let the rest of data to be fit in the frags.
		 */
		if (count > MAX_SKB_FRAGS) {
			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
			if (copylen < offset)
				copylen = 0;
			else
				copylen -= offset;
		} else
				copylen = 0;
		/* There are 256 bytes to be copied in skb, so there is enough
		 * room for skb expand head in case it is used.
		 * The rest of the buffer is mapped from userspace.
		 */
		if (copylen < gso.hdr_len)
			copylen = gso.hdr_len;
		if (!copylen)
			copylen = GOODCOPY_LEN;
	} else
		copylen = len;

J
Jason Wang 已提交
1072
	skb = tun_alloc_skb(tfile, align, copylen, gso.hdr_len, noblock);
1073 1074 1075 1076
	if (IS_ERR(skb)) {
		if (PTR_ERR(skb) != -EAGAIN)
			tun->dev->stats.rx_dropped++;
		return PTR_ERR(skb);
L
Linus Torvalds 已提交
1077 1078
	}

1079 1080 1081 1082 1083 1084
	if (zerocopy)
		err = zerocopy_sg_from_iovec(skb, iv, offset, count);
	else
		err = skb_copy_datagram_from_iovec(skb, 0, iv, offset, len);

	if (err) {
1085
		tun->dev->stats.rx_dropped++;
D
Dave Jones 已提交
1086
		kfree_skb(skb);
L
Linus Torvalds 已提交
1087
		return -EFAULT;
D
Dave Jones 已提交
1088
	}
L
Linus Torvalds 已提交
1089

1090 1091 1092 1093 1094 1095 1096
	if (gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
		if (!skb_partial_csum_set(skb, gso.csum_start,
					  gso.csum_offset)) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}
1097
	}
1098

L
Linus Torvalds 已提交
1099 1100
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115
		if (tun->flags & TUN_NO_PI) {
			switch (skb->data[0] & 0xf0) {
			case 0x40:
				pi.proto = htons(ETH_P_IP);
				break;
			case 0x60:
				pi.proto = htons(ETH_P_IPV6);
				break;
			default:
				tun->dev->stats.rx_dropped++;
				kfree_skb(skb);
				return -EINVAL;
			}
		}

1116
		skb_reset_mac_header(skb);
L
Linus Torvalds 已提交
1117
		skb->protocol = pi.proto;
1118
		skb->dev = tun->dev;
L
Linus Torvalds 已提交
1119 1120 1121 1122
		break;
	case TUN_TAP_DEV:
		skb->protocol = eth_type_trans(skb, tun->dev);
		break;
1123
	}
L
Linus Torvalds 已提交
1124

1125 1126 1127 1128 1129 1130 1131 1132 1133
	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
		pr_debug("GSO!\n");
		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
		case VIRTIO_NET_HDR_GSO_TCPV4:
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
			break;
		case VIRTIO_NET_HDR_GSO_TCPV6:
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
			break;
1134 1135 1136
		case VIRTIO_NET_HDR_GSO_UDP:
			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
			break;
1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156
		default:
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		if (gso.gso_type & VIRTIO_NET_HDR_GSO_ECN)
			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;

		skb_shinfo(skb)->gso_size = gso.gso_size;
		if (skb_shinfo(skb)->gso_size == 0) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		/* Header must be checked, and gso_segs computed. */
		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
		skb_shinfo(skb)->gso_segs = 0;
	}
1157

1158 1159 1160 1161 1162 1163
	/* copy skb_ubuf_info for callback when skb has no error */
	if (zerocopy) {
		skb_shinfo(skb)->destructor_arg = msg_control;
		skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
	}

L
Linus Torvalds 已提交
1164
	netif_rx_ni(skb);
1165

1166 1167
	tun->dev->stats.rx_packets++;
	tun->dev->stats.rx_bytes += len;
L
Linus Torvalds 已提交
1168

J
Jason Wang 已提交
1169
	tun_flow_update(tun, skb, tfile->queue_index);
1170
	return total_len;
1171
}
L
Linus Torvalds 已提交
1172

1173 1174
static ssize_t tun_chr_aio_write(struct kiocb *iocb, const struct iovec *iv,
			      unsigned long count, loff_t pos)
L
Linus Torvalds 已提交
1175
{
1176
	struct file *file = iocb->ki_filp;
H
Herbert Xu 已提交
1177
	struct tun_struct *tun = tun_get(file);
J
Jason Wang 已提交
1178
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1179
	ssize_t result;
L
Linus Torvalds 已提交
1180 1181 1182 1183

	if (!tun)
		return -EBADFD;

1184
	tun_debug(KERN_INFO, tun, "tun_chr_write %ld\n", count);
L
Linus Torvalds 已提交
1185

J
Jason Wang 已提交
1186 1187
	result = tun_get_user(tun, tfile, NULL, iv, iov_length(iv, count),
			      count, file->f_flags & O_NONBLOCK);
E
Eric W. Biederman 已提交
1188 1189 1190

	tun_put(tun);
	return result;
L
Linus Torvalds 已提交
1191 1192 1193
}

/* Put packet to the user space buffer */
1194
static ssize_t tun_put_user(struct tun_struct *tun,
J
Jason Wang 已提交
1195
			    struct tun_file *tfile,
1196 1197
			    struct sk_buff *skb,
			    const struct iovec *iv, int len)
L
Linus Torvalds 已提交
1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209
{
	struct tun_pi pi = { 0, skb->protocol };
	ssize_t total = 0;

	if (!(tun->flags & TUN_NO_PI)) {
		if ((len -= sizeof(pi)) < 0)
			return -EINVAL;

		if (len < skb->len) {
			/* Packet will be striped */
			pi.flags |= TUN_PKT_STRIP;
		}
1210

1211
		if (memcpy_toiovecend(iv, (void *) &pi, 0, sizeof(pi)))
L
Linus Torvalds 已提交
1212 1213
			return -EFAULT;
		total += sizeof(pi);
1214
	}
L
Linus Torvalds 已提交
1215

1216 1217
	if (tun->flags & TUN_VNET_HDR) {
		struct virtio_net_hdr gso = { 0 }; /* no info leak */
1218
		if ((len -= tun->vnet_hdr_sz) < 0)
1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230
			return -EINVAL;

		if (skb_is_gso(skb)) {
			struct skb_shared_info *sinfo = skb_shinfo(skb);

			/* This is a hint as to how much should be linear. */
			gso.hdr_len = skb_headlen(skb);
			gso.gso_size = sinfo->gso_size;
			if (sinfo->gso_type & SKB_GSO_TCPV4)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
			else if (sinfo->gso_type & SKB_GSO_TCPV6)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
1231 1232
			else if (sinfo->gso_type & SKB_GSO_UDP)
				gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
1233
			else {
1234
				pr_err("unexpected GSO type: "
1235 1236 1237 1238 1239 1240 1241 1242 1243 1244
				       "0x%x, gso_size %d, hdr_len %d\n",
				       sinfo->gso_type, gso.gso_size,
				       gso.hdr_len);
				print_hex_dump(KERN_ERR, "tun: ",
					       DUMP_PREFIX_NONE,
					       16, 1, skb->head,
					       min((int)gso.hdr_len, 64), true);
				WARN_ON_ONCE(1);
				return -EINVAL;
			}
1245 1246 1247 1248 1249 1250 1251
			if (sinfo->gso_type & SKB_GSO_TCP_ECN)
				gso.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
		} else
			gso.gso_type = VIRTIO_NET_HDR_GSO_NONE;

		if (skb->ip_summed == CHECKSUM_PARTIAL) {
			gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
1252
			gso.csum_start = skb_checksum_start_offset(skb);
1253
			gso.csum_offset = skb->csum_offset;
1254 1255
		} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
			gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
1256 1257
		} /* else everything is zero */

1258 1259
		if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
					       sizeof(gso))))
1260
			return -EFAULT;
1261
		total += tun->vnet_hdr_sz;
1262 1263
	}

L
Linus Torvalds 已提交
1264 1265
	len = min_t(int, skb->len, len);

1266
	skb_copy_datagram_const_iovec(skb, 0, iv, total, len);
1267
	total += skb->len;
L
Linus Torvalds 已提交
1268

1269 1270
	tun->dev->stats.tx_packets++;
	tun->dev->stats.tx_bytes += len;
L
Linus Torvalds 已提交
1271 1272 1273 1274

	return total;
}

J
Jason Wang 已提交
1275
static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
1276 1277
			   struct kiocb *iocb, const struct iovec *iv,
			   ssize_t len, int noblock)
L
Linus Torvalds 已提交
1278 1279 1280
{
	DECLARE_WAITQUEUE(wait, current);
	struct sk_buff *skb;
1281
	ssize_t ret = 0;
L
Linus Torvalds 已提交
1282

1283
	tun_debug(KERN_INFO, tun, "tun_do_read\n");
L
Linus Torvalds 已提交
1284

1285
	if (unlikely(!noblock))
J
Jason Wang 已提交
1286
		add_wait_queue(&tfile->wq.wait, &wait);
L
Linus Torvalds 已提交
1287 1288 1289 1290
	while (len) {
		current->state = TASK_INTERRUPTIBLE;

		/* Read frames from the queue */
J
Jason Wang 已提交
1291
		if (!(skb = skb_dequeue(&tfile->socket.sk->sk_receive_queue))) {
1292
			if (noblock) {
L
Linus Torvalds 已提交
1293 1294 1295 1296 1297 1298 1299
				ret = -EAGAIN;
				break;
			}
			if (signal_pending(current)) {
				ret = -ERESTARTSYS;
				break;
			}
1300 1301 1302 1303
			if (tun->dev->reg_state != NETREG_REGISTERED) {
				ret = -EIO;
				break;
			}
L
Linus Torvalds 已提交
1304 1305 1306 1307 1308 1309

			/* Nothing to read, let's sleep */
			schedule();
			continue;
		}

J
Jason Wang 已提交
1310
		ret = tun_put_user(tun, tfile, skb, iv, len);
1311 1312
		kfree_skb(skb);
		break;
L
Linus Torvalds 已提交
1313 1314 1315
	}

	current->state = TASK_RUNNING;
1316
	if (unlikely(!noblock))
J
Jason Wang 已提交
1317
		remove_wait_queue(&tfile->wq.wait, &wait);
L
Linus Torvalds 已提交
1318

1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337
	return ret;
}

static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
			    unsigned long count, loff_t pos)
{
	struct file *file = iocb->ki_filp;
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
	ssize_t len, ret;

	if (!tun)
		return -EBADFD;
	len = iov_length(iv, count);
	if (len < 0) {
		ret = -EINVAL;
		goto out;
	}

J
Jason Wang 已提交
1338 1339
	ret = tun_do_read(tun, tfile, iocb, iv, len,
			  file->f_flags & O_NONBLOCK);
1340
	ret = min_t(ssize_t, ret, len);
E
Eric W. Biederman 已提交
1341 1342
out:
	tun_put(tun);
L
Linus Torvalds 已提交
1343 1344 1345
	return ret;
}

J
Jason Wang 已提交
1346 1347 1348 1349 1350 1351 1352 1353
static void tun_free_netdev(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

	tun_flow_uninit(tun);
	free_netdev(dev);
}

L
Linus Torvalds 已提交
1354 1355 1356 1357
static void tun_setup(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

1358 1359
	tun->owner = INVALID_UID;
	tun->group = INVALID_GID;
L
Linus Torvalds 已提交
1360 1361

	dev->ethtool_ops = &tun_ethtool_ops;
J
Jason Wang 已提交
1362
	dev->destructor = tun_free_netdev;
L
Linus Torvalds 已提交
1363 1364
}

1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379
/* Trivial set of netlink ops to allow deleting tun or tap
 * device with netlink.
 */
static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
{
	return -EINVAL;
}

static struct rtnl_link_ops tun_link_ops __read_mostly = {
	.kind		= DRV_NAME,
	.priv_size	= sizeof(struct tun_struct),
	.setup		= tun_setup,
	.validate	= tun_validate,
};

1380 1381
static void tun_sock_write_space(struct sock *sk)
{
J
Jason Wang 已提交
1382
	struct tun_file *tfile;
1383
	wait_queue_head_t *wqueue;
1384 1385 1386 1387 1388 1389 1390

	if (!sock_writeable(sk))
		return;

	if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
		return;

1391 1392 1393
	wqueue = sk_sleep(sk);
	if (wqueue && waitqueue_active(wqueue))
		wake_up_interruptible_sync_poll(wqueue, POLLOUT |
1394
						POLLWRNORM | POLLWRBAND);
H
Herbert Xu 已提交
1395

J
Jason Wang 已提交
1396 1397
	tfile = container_of(sk, struct tun_file, sk);
	kill_fasync(&tfile->fasync, SIGIO, POLL_OUT);
1398 1399
}

1400 1401 1402
static int tun_sendmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len)
{
J
Jason Wang 已提交
1403 1404 1405 1406 1407 1408 1409 1410 1411 1412
	int ret;
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);

	if (!tun)
		return -EBADFD;
	ret = tun_get_user(tun, tfile, m->msg_control, m->msg_iov, total_len,
			   m->msg_iovlen, m->msg_flags & MSG_DONTWAIT);
	tun_put(tun);
	return ret;
1413 1414
}

J
Jason Wang 已提交
1415

1416 1417 1418 1419
static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len,
		       int flags)
{
J
Jason Wang 已提交
1420 1421
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);
1422
	int ret;
J
Jason Wang 已提交
1423 1424 1425 1426

	if (!tun)
		return -EBADFD;

1427 1428
	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
		return -EINVAL;
J
Jason Wang 已提交
1429
	ret = tun_do_read(tun, tfile, iocb, m->msg_iov, total_len,
1430 1431 1432 1433 1434
			  flags & MSG_DONTWAIT);
	if (ret > total_len) {
		m->msg_flags |= MSG_TRUNC;
		ret = flags & MSG_TRUNC ? ret : total_len;
	}
J
Jason Wang 已提交
1435
	tun_put(tun);
1436 1437 1438
	return ret;
}

1439 1440 1441 1442 1443 1444 1445
static int tun_release(struct socket *sock)
{
	if (sock->sk)
		sock_put(sock->sk);
	return 0;
}

1446 1447 1448 1449
/* Ops structure to mimic raw sockets with tun */
static const struct proto_ops tun_socket_ops = {
	.sendmsg = tun_sendmsg,
	.recvmsg = tun_recvmsg,
1450
	.release = tun_release,
1451 1452
};

1453 1454 1455
static struct proto tun_proto = {
	.name		= "tun",
	.owner		= THIS_MODULE,
J
Jason Wang 已提交
1456
	.obj_size	= sizeof(struct tun_file),
1457
};
1458

1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470
static int tun_flags(struct tun_struct *tun)
{
	int flags = 0;

	if (tun->flags & TUN_TUN_DEV)
		flags |= IFF_TUN;
	else
		flags |= IFF_TAP;

	if (tun->flags & TUN_NO_PI)
		flags |= IFF_NO_PI;

1471 1472 1473
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
1474 1475 1476 1477 1478 1479
	if (tun->flags & TUN_ONE_QUEUE)
		flags |= IFF_ONE_QUEUE;

	if (tun->flags & TUN_VNET_HDR)
		flags |= IFF_VNET_HDR;

J
Jason Wang 已提交
1480 1481 1482
	if (tun->flags & TUN_TAP_MQ)
		flags |= IFF_MULTI_QUEUE;

1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496
	return flags;
}

static ssize_t tun_show_flags(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "0x%x\n", tun_flags(tun));
}

static ssize_t tun_show_owner(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1497 1498 1499 1500
	return uid_valid(tun->owner)?
		sprintf(buf, "%u\n",
			from_kuid_munged(current_user_ns(), tun->owner)):
		sprintf(buf, "-1\n");
1501 1502 1503 1504 1505 1506
}

static ssize_t tun_show_group(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1507 1508 1509 1510
	return gid_valid(tun->group) ?
		sprintf(buf, "%u\n",
			from_kgid_munged(current_user_ns(), tun->group)):
		sprintf(buf, "-1\n");
1511 1512 1513 1514 1515 1516
}

static DEVICE_ATTR(tun_flags, 0444, tun_show_flags, NULL);
static DEVICE_ATTR(owner, 0444, tun_show_owner, NULL);
static DEVICE_ATTR(group, 0444, tun_show_group, NULL);

1517
static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
L
Linus Torvalds 已提交
1518 1519
{
	struct tun_struct *tun;
J
Jason Wang 已提交
1520
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
1521 1522 1523
	struct net_device *dev;
	int err;

1524 1525
	dev = __dev_get_by_name(net, ifr->ifr_name);
	if (dev) {
1526 1527
		if (ifr->ifr_flags & IFF_TUN_EXCL)
			return -EBUSY;
1528 1529 1530 1531 1532 1533 1534
		if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
			tun = netdev_priv(dev);
		else if ((ifr->ifr_flags & IFF_TAP) && dev->netdev_ops == &tap_netdev_ops)
			tun = netdev_priv(dev);
		else
			return -EINVAL;

1535
		if (tun_not_capable(tun))
P
Paul Moore 已提交
1536
			return -EPERM;
J
Jason Wang 已提交
1537
		err = security_tun_dev_attach(tfile->socket.sk);
P
Paul Moore 已提交
1538 1539 1540
		if (err < 0)
			return err;

1541 1542 1543
		err = tun_attach(tun, file);
		if (err < 0)
			return err;
1544
	}
L
Linus Torvalds 已提交
1545 1546 1547 1548
	else {
		char *name;
		unsigned long flags = 0;

1549
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1550
			return -EPERM;
P
Paul Moore 已提交
1551 1552 1553
		err = security_tun_dev_create();
		if (err < 0)
			return err;
1554

L
Linus Torvalds 已提交
1555 1556 1557 1558 1559 1560 1561 1562 1563
		/* Set dev type */
		if (ifr->ifr_flags & IFF_TUN) {
			/* TUN device */
			flags |= TUN_TUN_DEV;
			name = "tun%d";
		} else if (ifr->ifr_flags & IFF_TAP) {
			/* TAP device */
			flags |= TUN_TAP_DEV;
			name = "tap%d";
1564
		} else
1565
			return -EINVAL;
1566

L
Linus Torvalds 已提交
1567 1568 1569
		if (*ifr->ifr_name)
			name = ifr->ifr_name;

J
Jason Wang 已提交
1570 1571 1572
		dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
				       tun_setup,
				       MAX_TAP_QUEUES, MAX_TAP_QUEUES);
L
Linus Torvalds 已提交
1573 1574 1575
		if (!dev)
			return -ENOMEM;

1576
		dev_net_set(dev, net);
1577
		dev->rtnl_link_ops = &tun_link_ops;
S
Stephen Hemminger 已提交
1578

L
Linus Torvalds 已提交
1579 1580 1581
		tun = netdev_priv(dev);
		tun->dev = dev;
		tun->flags = flags;
1582
		tun->txflt.count = 0;
1583
		tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
1584

J
Jason Wang 已提交
1585 1586
		tun->filter_attached = false;
		tun->sndbuf = tfile->socket.sk->sk_sndbuf;
1587

J
Jason Wang 已提交
1588 1589
		spin_lock_init(&tun->lock);

J
Jason Wang 已提交
1590
		security_tun_dev_post_create(&tfile->sk);
P
Paul Moore 已提交
1591

L
Linus Torvalds 已提交
1592 1593
		tun_net_init(dev);

J
Jason Wang 已提交
1594 1595 1596
		if (tun_flow_init(tun))
			goto err_free_dev;

1597 1598 1599 1600
		dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
			TUN_USER_FEATURES;
		dev->features = dev->hw_features;

1601 1602 1603 1604
		err = tun_attach(tun, file);
		if (err < 0)
			goto err_free_dev;

L
Linus Torvalds 已提交
1605 1606
		err = register_netdevice(tun->dev);
		if (err < 0)
J
Jason Wang 已提交
1607
			goto err_free_dev;
1608

1609 1610 1611
		if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
		    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
		    device_create_file(&tun->dev->dev, &dev_attr_group))
1612
			pr_err("Failed to create tun sysfs files\n");
1613

1614
		netif_carrier_on(tun->dev);
L
Linus Torvalds 已提交
1615 1616
	}

1617
	tun_debug(KERN_INFO, tun, "tun_set_iff\n");
L
Linus Torvalds 已提交
1618 1619 1620

	if (ifr->ifr_flags & IFF_NO_PI)
		tun->flags |= TUN_NO_PI;
1621 1622
	else
		tun->flags &= ~TUN_NO_PI;
L
Linus Torvalds 已提交
1623

1624 1625 1626
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
L
Linus Torvalds 已提交
1627 1628
	if (ifr->ifr_flags & IFF_ONE_QUEUE)
		tun->flags |= TUN_ONE_QUEUE;
1629 1630
	else
		tun->flags &= ~TUN_ONE_QUEUE;
L
Linus Torvalds 已提交
1631

1632 1633 1634 1635 1636
	if (ifr->ifr_flags & IFF_VNET_HDR)
		tun->flags |= TUN_VNET_HDR;
	else
		tun->flags &= ~TUN_VNET_HDR;

J
Jason Wang 已提交
1637 1638 1639 1640 1641
	if (ifr->ifr_flags & IFF_MULTI_QUEUE)
		tun->flags |= TUN_TAP_MQ;
	else
		tun->flags &= ~TUN_TAP_MQ;

1642 1643 1644 1645
	/* Make sure persistent devices do not get stuck in
	 * xoff state.
	 */
	if (netif_running(tun->dev))
J
Jason Wang 已提交
1646
		netif_tx_wake_all_queues(tun->dev);
1647

L
Linus Torvalds 已提交
1648 1649 1650 1651 1652 1653 1654 1655
	strcpy(ifr->ifr_name, tun->dev->name);
	return 0;

 err_free_dev:
	free_netdev(dev);
	return err;
}

R
Rami Rosen 已提交
1656
static void tun_get_iff(struct net *net, struct tun_struct *tun,
1657
		       struct ifreq *ifr)
1658
{
1659
	tun_debug(KERN_INFO, tun, "tun_get_iff\n");
1660 1661 1662

	strcpy(ifr->ifr_name, tun->dev->name);

1663
	ifr->ifr_flags = tun_flags(tun);
1664 1665 1666

}

1667 1668
/* This is like a cut-down ethtool ops, except done via tun fd so no
 * privs required. */
1669
static int set_offload(struct tun_struct *tun, unsigned long arg)
1670
{
1671
	netdev_features_t features = 0;
1672 1673

	if (arg & TUN_F_CSUM) {
1674
		features |= NETIF_F_HW_CSUM;
1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687
		arg &= ~TUN_F_CSUM;

		if (arg & (TUN_F_TSO4|TUN_F_TSO6)) {
			if (arg & TUN_F_TSO_ECN) {
				features |= NETIF_F_TSO_ECN;
				arg &= ~TUN_F_TSO_ECN;
			}
			if (arg & TUN_F_TSO4)
				features |= NETIF_F_TSO;
			if (arg & TUN_F_TSO6)
				features |= NETIF_F_TSO6;
			arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
		}
1688 1689 1690 1691 1692

		if (arg & TUN_F_UFO) {
			features |= NETIF_F_UFO;
			arg &= ~TUN_F_UFO;
		}
1693 1694 1695 1696 1697 1698 1699
	}

	/* This gives the user a way to test for new features in future by
	 * trying to set them. */
	if (arg)
		return -EINVAL;

1700 1701
	tun->set_features = features;
	netdev_update_features(tun->dev);
1702 1703 1704 1705

	return 0;
}

J
Jason Wang 已提交
1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750
static void tun_detach_filter(struct tun_struct *tun, int n)
{
	int i;
	struct tun_file *tfile;

	for (i = 0; i < n; i++) {
		tfile = rcu_dereference_protected(tun->tfiles[i],
						  lockdep_rtnl_is_held());
		sk_detach_filter(tfile->socket.sk);
	}

	tun->filter_attached = false;
}

static int tun_attach_filter(struct tun_struct *tun)
{
	int i, ret = 0;
	struct tun_file *tfile;

	for (i = 0; i < tun->numqueues; i++) {
		tfile = rcu_dereference_protected(tun->tfiles[i],
						  lockdep_rtnl_is_held());
		ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (ret) {
			tun_detach_filter(tun, i);
			return ret;
		}
	}

	tun->filter_attached = true;
	return ret;
}

static void tun_set_sndbuf(struct tun_struct *tun)
{
	struct tun_file *tfile;
	int i;

	for (i = 0; i < tun->numqueues; i++) {
		tfile = rcu_dereference_protected(tun->tfiles[i],
						lockdep_rtnl_is_held());
		tfile->socket.sk->sk_sndbuf = tun->sndbuf;
	}
}

1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784
static int tun_set_queue(struct file *file, struct ifreq *ifr)
{
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun;
	struct net_device *dev;
	int ret = 0;

	rtnl_lock();

	if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
		dev = __dev_get_by_name(tfile->net, ifr->ifr_name);
		if (!dev) {
			ret = -EINVAL;
			goto unlock;
		}

		tun = netdev_priv(dev);
		if (dev->netdev_ops != &tap_netdev_ops &&
			dev->netdev_ops != &tun_netdev_ops)
			ret = -EINVAL;
		else if (tun_not_capable(tun))
			ret = -EPERM;
		else
			ret = tun_attach(tun, file);
	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE)
		__tun_detach(tfile, false);
	else
		ret = -EINVAL;

unlock:
	rtnl_unlock();
	return ret;
}

1785 1786
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg, int ifreq_len)
L
Linus Torvalds 已提交
1787
{
E
Eric W. Biederman 已提交
1788
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1789
	struct tun_struct *tun;
L
Linus Torvalds 已提交
1790 1791
	void __user* argp = (void __user*)arg;
	struct ifreq ifr;
1792 1793
	kuid_t owner;
	kgid_t group;
1794
	int sndbuf;
1795
	int vnet_hdr_sz;
1796
	int ret;
L
Linus Torvalds 已提交
1797

1798
	if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
1799
		if (copy_from_user(&ifr, argp, ifreq_len))
L
Linus Torvalds 已提交
1800
			return -EFAULT;
D
David S. Miller 已提交
1801
	} else {
1802
		memset(&ifr, 0, sizeof(ifr));
D
David S. Miller 已提交
1803
	}
E
Eric W. Biederman 已提交
1804 1805 1806 1807 1808
	if (cmd == TUNGETFEATURES) {
		/* Currently this just means: "what IFF flags are valid?".
		 * This is needed because we never checked for invalid flags on
		 * TUNSETIFF. */
		return put_user(IFF_TUN | IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE |
1809
				IFF_VNET_HDR | IFF_MULTI_QUEUE,
E
Eric W. Biederman 已提交
1810
				(unsigned int __user*)argp);
1811 1812
	} else if (cmd == TUNSETQUEUE)
		return tun_set_queue(file, &ifr);
E
Eric W. Biederman 已提交
1813

J
Jason Wang 已提交
1814
	ret = 0;
1815 1816
	rtnl_lock();

E
Eric W. Biederman 已提交
1817
	tun = __tun_get(tfile);
L
Linus Torvalds 已提交
1818 1819 1820
	if (cmd == TUNSETIFF && !tun) {
		ifr.ifr_name[IFNAMSIZ-1] = '\0';

1821
		ret = tun_set_iff(tfile->net, file, &ifr);
L
Linus Torvalds 已提交
1822

1823 1824
		if (ret)
			goto unlock;
L
Linus Torvalds 已提交
1825

1826
		if (copy_to_user(argp, &ifr, ifreq_len))
1827 1828
			ret = -EFAULT;
		goto unlock;
L
Linus Torvalds 已提交
1829 1830
	}

1831
	ret = -EBADFD;
L
Linus Torvalds 已提交
1832
	if (!tun)
1833
		goto unlock;
L
Linus Torvalds 已提交
1834

1835
	tun_debug(KERN_INFO, tun, "tun_chr_ioctl cmd %u\n", cmd);
L
Linus Torvalds 已提交
1836

E
Eric W. Biederman 已提交
1837
	ret = 0;
L
Linus Torvalds 已提交
1838
	switch (cmd) {
1839
	case TUNGETIFF:
R
Rami Rosen 已提交
1840
		tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
1841

1842
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1843
			ret = -EFAULT;
1844 1845
		break;

L
Linus Torvalds 已提交
1846 1847 1848
	case TUNSETNOCSUM:
		/* Disable/Enable checksum */

1849 1850
		/* [unimplemented] */
		tun_debug(KERN_INFO, tun, "ignored: set checksum %s\n",
1851
			  arg ? "disabled" : "enabled");
L
Linus Torvalds 已提交
1852 1853 1854
		break;

	case TUNSETPERSIST:
J
Jason Wang 已提交
1855 1856 1857 1858
		/* Disable/Enable persist mode. Keep an extra reference to the
		 * module to prevent the module being unprobed.
		 */
		if (arg) {
L
Linus Torvalds 已提交
1859
			tun->flags |= TUN_PERSIST;
J
Jason Wang 已提交
1860 1861
			__module_get(THIS_MODULE);
		} else {
L
Linus Torvalds 已提交
1862
			tun->flags &= ~TUN_PERSIST;
J
Jason Wang 已提交
1863 1864
			module_put(THIS_MODULE);
		}
L
Linus Torvalds 已提交
1865

1866 1867
		tun_debug(KERN_INFO, tun, "persist %s\n",
			  arg ? "enabled" : "disabled");
L
Linus Torvalds 已提交
1868 1869 1870 1871
		break;

	case TUNSETOWNER:
		/* Set owner of the device */
1872 1873 1874 1875 1876 1877
		owner = make_kuid(current_user_ns(), arg);
		if (!uid_valid(owner)) {
			ret = -EINVAL;
			break;
		}
		tun->owner = owner;
1878
		tun_debug(KERN_INFO, tun, "owner set to %u\n",
1879
			  from_kuid(&init_user_ns, tun->owner));
L
Linus Torvalds 已提交
1880 1881
		break;

1882 1883
	case TUNSETGROUP:
		/* Set group of the device */
1884 1885 1886 1887 1888 1889
		group = make_kgid(current_user_ns(), arg);
		if (!gid_valid(group)) {
			ret = -EINVAL;
			break;
		}
		tun->group = group;
1890
		tun_debug(KERN_INFO, tun, "group set to %u\n",
1891
			  from_kgid(&init_user_ns, tun->group));
1892 1893
		break;

1894 1895 1896
	case TUNSETLINK:
		/* Only allow setting the type when the interface is down */
		if (tun->dev->flags & IFF_UP) {
1897 1898
			tun_debug(KERN_INFO, tun,
				  "Linktype set failed because interface is up\n");
1899
			ret = -EBUSY;
1900 1901
		} else {
			tun->dev->type = (int) arg;
1902 1903
			tun_debug(KERN_INFO, tun, "linktype set to %d\n",
				  tun->dev->type);
1904
			ret = 0;
1905
		}
E
Eric W. Biederman 已提交
1906
		break;
1907

L
Linus Torvalds 已提交
1908 1909 1910 1911 1912
#ifdef TUN_DEBUG
	case TUNSETDEBUG:
		tun->debug = arg;
		break;
#endif
1913
	case TUNSETOFFLOAD:
1914
		ret = set_offload(tun, arg);
E
Eric W. Biederman 已提交
1915
		break;
1916

1917 1918
	case TUNSETTXFILTER:
		/* Can be set only for TAPs */
E
Eric W. Biederman 已提交
1919
		ret = -EINVAL;
1920
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
E
Eric W. Biederman 已提交
1921
			break;
H
Harvey Harrison 已提交
1922
		ret = update_filter(&tun->txflt, (void __user *)arg);
E
Eric W. Biederman 已提交
1923
		break;
L
Linus Torvalds 已提交
1924 1925

	case SIOCGIFHWADDR:
1926
		/* Get hw address */
1927 1928
		memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN);
		ifr.ifr_hwaddr.sa_family = tun->dev->type;
1929
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1930 1931
			ret = -EFAULT;
		break;
L
Linus Torvalds 已提交
1932 1933

	case SIOCSIFHWADDR:
1934
		/* Set hw address */
1935 1936
		tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n",
			  ifr.ifr_hwaddr.sa_data);
1937 1938

		ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
E
Eric W. Biederman 已提交
1939
		break;
1940 1941

	case TUNGETSNDBUF:
J
Jason Wang 已提交
1942
		sndbuf = tfile->socket.sk->sk_sndbuf;
1943 1944 1945 1946 1947 1948 1949 1950 1951 1952
		if (copy_to_user(argp, &sndbuf, sizeof(sndbuf)))
			ret = -EFAULT;
		break;

	case TUNSETSNDBUF:
		if (copy_from_user(&sndbuf, argp, sizeof(sndbuf))) {
			ret = -EFAULT;
			break;
		}

J
Jason Wang 已提交
1953 1954
		tun->sndbuf = sndbuf;
		tun_set_sndbuf(tun);
1955 1956
		break;

1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975
	case TUNGETVNETHDRSZ:
		vnet_hdr_sz = tun->vnet_hdr_sz;
		if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
			ret = -EFAULT;
		break;

	case TUNSETVNETHDRSZ:
		if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
			ret = -EFAULT;
			break;
		}
		if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
			ret = -EINVAL;
			break;
		}

		tun->vnet_hdr_sz = vnet_hdr_sz;
		break;

M
Michael S. Tsirkin 已提交
1976 1977 1978 1979 1980 1981
	case TUNATTACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
		ret = -EFAULT;
J
Jason Wang 已提交
1982
		if (copy_from_user(&tun->fprog, argp, sizeof(tun->fprog)))
M
Michael S. Tsirkin 已提交
1983 1984
			break;

J
Jason Wang 已提交
1985
		ret = tun_attach_filter(tun);
M
Michael S. Tsirkin 已提交
1986 1987 1988 1989 1990 1991 1992
		break;

	case TUNDETACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
J
Jason Wang 已提交
1993 1994
		ret = 0;
		tun_detach_filter(tun, tun->numqueues);
M
Michael S. Tsirkin 已提交
1995 1996
		break;

L
Linus Torvalds 已提交
1997
	default:
E
Eric W. Biederman 已提交
1998 1999
		ret = -EINVAL;
		break;
2000
	}
L
Linus Torvalds 已提交
2001

2002 2003 2004 2005
unlock:
	rtnl_unlock();
	if (tun)
		tun_put(tun);
E
Eric W. Biederman 已提交
2006
	return ret;
L
Linus Torvalds 已提交
2007 2008
}

2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043
static long tun_chr_ioctl(struct file *file,
			  unsigned int cmd, unsigned long arg)
{
	return __tun_chr_ioctl(file, cmd, arg, sizeof (struct ifreq));
}

#ifdef CONFIG_COMPAT
static long tun_chr_compat_ioctl(struct file *file,
			 unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case TUNSETIFF:
	case TUNGETIFF:
	case TUNSETTXFILTER:
	case TUNGETSNDBUF:
	case TUNSETSNDBUF:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
		arg = (unsigned long)compat_ptr(arg);
		break;
	default:
		arg = (compat_ulong_t)arg;
		break;
	}

	/*
	 * compat_ifreq is shorter than ifreq, so we must not access beyond
	 * the end of that structure. All fields that are used in this
	 * driver are compatible though, we don't need to convert the
	 * contents.
	 */
	return __tun_chr_ioctl(file, cmd, arg, sizeof(struct compat_ifreq));
}
#endif /* CONFIG_COMPAT */

L
Linus Torvalds 已提交
2044 2045
static int tun_chr_fasync(int fd, struct file *file, int on)
{
J
Jason Wang 已提交
2046
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
2047 2048
	int ret;

J
Jason Wang 已提交
2049
	if ((ret = fasync_helper(fd, file, on, &tfile->fasync)) < 0)
J
Jonathan Corbet 已提交
2050
		goto out;
2051

L
Linus Torvalds 已提交
2052
	if (on) {
2053
		ret = __f_setown(file, task_pid(current), PIDTYPE_PID, 0);
L
Linus Torvalds 已提交
2054
		if (ret)
J
Jonathan Corbet 已提交
2055
			goto out;
J
Jason Wang 已提交
2056
		tfile->flags |= TUN_FASYNC;
2057
	} else
J
Jason Wang 已提交
2058
		tfile->flags &= ~TUN_FASYNC;
J
Jonathan Corbet 已提交
2059 2060 2061
	ret = 0;
out:
	return ret;
L
Linus Torvalds 已提交
2062 2063 2064 2065
}

static int tun_chr_open(struct inode *inode, struct file * file)
{
E
Eric W. Biederman 已提交
2066
	struct tun_file *tfile;
T
Thomas Gleixner 已提交
2067

2068
	DBG1(KERN_INFO, "tunX: tun_chr_open\n");
E
Eric W. Biederman 已提交
2069

J
Jason Wang 已提交
2070 2071
	tfile = (struct tun_file *)sk_alloc(&init_net, AF_UNSPEC, GFP_KERNEL,
					    &tun_proto);
E
Eric W. Biederman 已提交
2072 2073
	if (!tfile)
		return -ENOMEM;
2074
	rcu_assign_pointer(tfile->tun, NULL);
E
Eric W. Biederman 已提交
2075
	tfile->net = get_net(current->nsproxy->net_ns);
J
Jason Wang 已提交
2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089
	tfile->flags = 0;

	rcu_assign_pointer(tfile->socket.wq, &tfile->wq);
	init_waitqueue_head(&tfile->wq.wait);

	tfile->socket.file = file;
	tfile->socket.ops = &tun_socket_ops;

	sock_init_data(&tfile->socket, &tfile->sk);
	sk_change_net(&tfile->sk, tfile->net);

	tfile->sk.sk_write_space = tun_sock_write_space;
	tfile->sk.sk_sndbuf = INT_MAX;

E
Eric W. Biederman 已提交
2090
	file->private_data = tfile;
J
Jason Wang 已提交
2091 2092
	set_bit(SOCK_EXTERNALLY_ALLOCATED, &tfile->socket.flags);

L
Linus Torvalds 已提交
2093 2094 2095 2096 2097
	return 0;
}

static int tun_chr_close(struct inode *inode, struct file *file)
{
E
Eric W. Biederman 已提交
2098
	struct tun_file *tfile = file->private_data;
J
Jason Wang 已提交
2099
	struct net *net = tfile->net;
L
Linus Torvalds 已提交
2100

J
Jason Wang 已提交
2101
	tun_detach(tfile, true);
J
Jason Wang 已提交
2102
	put_net(net);
L
Linus Torvalds 已提交
2103 2104 2105 2106

	return 0;
}

2107
static const struct file_operations tun_fops = {
2108
	.owner	= THIS_MODULE,
L
Linus Torvalds 已提交
2109
	.llseek = no_llseek,
2110 2111 2112 2113
	.read  = do_sync_read,
	.aio_read  = tun_chr_aio_read,
	.write = do_sync_write,
	.aio_write = tun_chr_aio_write,
L
Linus Torvalds 已提交
2114
	.poll	= tun_chr_poll,
2115 2116 2117 2118
	.unlocked_ioctl	= tun_chr_ioctl,
#ifdef CONFIG_COMPAT
	.compat_ioctl = tun_chr_compat_ioctl,
#endif
L
Linus Torvalds 已提交
2119 2120
	.open	= tun_chr_open,
	.release = tun_chr_close,
2121
	.fasync = tun_chr_fasync
L
Linus Torvalds 已提交
2122 2123 2124 2125 2126
};

static struct miscdevice tun_miscdev = {
	.minor = TUN_MINOR,
	.name = "tun",
2127
	.nodename = "net/tun",
L
Linus Torvalds 已提交
2128 2129 2130 2131 2132 2133 2134 2135 2136
	.fops = &tun_fops,
};

/* ethtool interface */

static int tun_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
	cmd->supported		= 0;
	cmd->advertising	= 0;
2137
	ethtool_cmd_speed_set(cmd, SPEED_10);
L
Linus Torvalds 已提交
2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151
	cmd->duplex		= DUPLEX_FULL;
	cmd->port		= PORT_TP;
	cmd->phy_address	= 0;
	cmd->transceiver	= XCVR_INTERNAL;
	cmd->autoneg		= AUTONEG_DISABLE;
	cmd->maxtxpkt		= 0;
	cmd->maxrxpkt		= 0;
	return 0;
}

static void tun_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
{
	struct tun_struct *tun = netdev_priv(dev);

2152 2153
	strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
	strlcpy(info->version, DRV_VERSION, sizeof(info->version));
L
Linus Torvalds 已提交
2154 2155 2156

	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
2157
		strlcpy(info->bus_info, "tun", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2158 2159
		break;
	case TUN_TAP_DEV:
2160
		strlcpy(info->bus_info, "tap", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182
		break;
	}
}

static u32 tun_get_msglevel(struct net_device *dev)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	return tun->debug;
#else
	return -EOPNOTSUPP;
#endif
}

static void tun_set_msglevel(struct net_device *dev, u32 value)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	tun->debug = value;
#endif
}

2183
static const struct ethtool_ops tun_ethtool_ops = {
L
Linus Torvalds 已提交
2184 2185 2186 2187
	.get_settings	= tun_get_settings,
	.get_drvinfo	= tun_get_drvinfo,
	.get_msglevel	= tun_get_msglevel,
	.set_msglevel	= tun_set_msglevel,
2188
	.get_link	= ethtool_op_get_link,
L
Linus Torvalds 已提交
2189 2190
};

2191

L
Linus Torvalds 已提交
2192 2193 2194 2195
static int __init tun_init(void)
{
	int ret = 0;

2196 2197
	pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
	pr_info("%s\n", DRV_COPYRIGHT);
L
Linus Torvalds 已提交
2198

2199
	ret = rtnl_link_register(&tun_link_ops);
2200
	if (ret) {
2201
		pr_err("Can't register link_ops\n");
2202
		goto err_linkops;
2203 2204
	}

L
Linus Torvalds 已提交
2205
	ret = misc_register(&tun_miscdev);
2206
	if (ret) {
2207
		pr_err("Can't register misc device %d\n", TUN_MINOR);
2208 2209
		goto err_misc;
	}
2210
	return  0;
2211
err_misc:
2212 2213
	rtnl_link_unregister(&tun_link_ops);
err_linkops:
L
Linus Torvalds 已提交
2214 2215 2216 2217 2218
	return ret;
}

static void tun_cleanup(void)
{
2219
	misc_deregister(&tun_miscdev);
2220
	rtnl_link_unregister(&tun_link_ops);
L
Linus Torvalds 已提交
2221 2222
}

2223 2224 2225 2226 2227 2228
/* Get an underlying socket object from tun file.  Returns error unless file is
 * attached to a device.  The returned object works like a packet socket, it
 * can be used for sock_sendmsg/sock_recvmsg.  The caller is responsible for
 * holding a reference to the file for as long as the socket is in use. */
struct socket *tun_get_socket(struct file *file)
{
2229
	struct tun_file *tfile;
2230 2231
	if (file->f_op != &tun_fops)
		return ERR_PTR(-EINVAL);
2232 2233
	tfile = file->private_data;
	if (!tfile)
2234
		return ERR_PTR(-EBADFD);
J
Jason Wang 已提交
2235
	return &tfile->socket;
2236 2237 2238
}
EXPORT_SYMBOL_GPL(tun_get_socket);

L
Linus Torvalds 已提交
2239 2240 2241 2242 2243 2244
module_init(tun_init);
module_exit(tun_cleanup);
MODULE_DESCRIPTION(DRV_DESCRIPTION);
MODULE_AUTHOR(DRV_COPYRIGHT);
MODULE_LICENSE("GPL");
MODULE_ALIAS_MISCDEV(TUN_MINOR);
2245
MODULE_ALIAS("devname:net/tun");