tun.c 55.7 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
/*
 *  TUN - Universal TUN/TAP device driver.
 *  Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 *  GNU General Public License for more details.
 *
 *  $Id: tun.c,v 1.15 2002/03/01 02:44:24 maxk Exp $
 */

/*
 *  Changes:
 *
21 22 23
 *  Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14
 *    Add TUNSETLINK ioctl to set the link encapsulation
 *
L
Linus Torvalds 已提交
24
 *  Mark Smith <markzzzsmith@yahoo.com.au>
J
Joe Perches 已提交
25
 *    Use eth_random_addr() for tap MAC address.
L
Linus Torvalds 已提交
26 27 28 29 30 31 32 33 34 35 36
 *
 *  Harald Roelle <harald.roelle@ifi.lmu.de>  2004/04/20
 *    Fixes in packet dropping, queue length setting and queue wakeup.
 *    Increased default tx queue length.
 *    Added ethtool API.
 *    Minor cleanups
 *
 *  Daniel Podlejski <underley@underley.eu.org>
 *    Modifications for 2.3.99-pre5 kernel.
 */

37 38
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
#define DRV_NAME	"tun"
#define DRV_VERSION	"1.6"
#define DRV_DESCRIPTION	"Universal TUN/TAP device driver"
#define DRV_COPYRIGHT	"(C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>"

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/miscdevice.h>
#include <linux/ethtool.h>
#include <linux/rtnetlink.h>
58
#include <linux/compat.h>
L
Linus Torvalds 已提交
59 60 61 62
#include <linux/if.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
J
Jason Wang 已提交
63
#include <linux/if_vlan.h>
L
Linus Torvalds 已提交
64
#include <linux/crc32.h>
65
#include <linux/nsproxy.h>
66
#include <linux/virtio_net.h>
M
Michael S. Tsirkin 已提交
67
#include <linux/rcupdate.h>
68
#include <net/ipv6.h>
69
#include <net/net_namespace.h>
70
#include <net/netns/generic.h>
71
#include <net/rtnetlink.h>
72
#include <net/sock.h>
73
#include <linux/seq_file.h>
H
Herbert Xu 已提交
74
#include <linux/uio.h>
L
Linus Torvalds 已提交
75 76 77

#include <asm/uaccess.h>

78 79 80
/* Uncomment to enable debugging */
/* #define TUN_DEBUG 1 */

L
Linus Torvalds 已提交
81 82
#ifdef TUN_DEBUG
static int debug;
83

84 85 86 87 88 89 90 91 92 93
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (tun->debug)						\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (debug == 2)						\
		printk(level fmt, ##args);			\
} while (0)
94
#else
95 96 97 98 99 100 101 102 103 104
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (0)							\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (0)							\
		printk(level fmt, ##args);			\
} while (0)
105 106
#endif

107 108
#define GOODCOPY_LEN 128

109 110 111 112 113 114 115
#define FLT_EXACT_COUNT 8
struct tap_filter {
	unsigned int    count;    /* Number of addrs. Zero means disabled */
	u32             mask[2];  /* Mask of the hashed addrs */
	unsigned char	addr[FLT_EXACT_COUNT][ETH_ALEN];
};

S
stephen hemminger 已提交
116
/* DEFAULT_MAX_NUM_RSS_QUEUES were chosen to let the rx/tx queues allocated for
117 118 119
 * the netdevice to be fit in one page. So we can make sure the success of
 * memory allocation. TODO: increase the limit. */
#define MAX_TAP_QUEUES DEFAULT_MAX_NUM_RSS_QUEUES
120
#define MAX_TAP_FLOWS  4096
J
Jason Wang 已提交
121

J
Jason Wang 已提交
122 123
#define TUN_FLOW_EXPIRE (3 * HZ)

J
Jason Wang 已提交
124
/* A tun_file connects an open character device to a tuntap netdevice. It
S
stephen hemminger 已提交
125
 * also contains all socket related structures (except sock_fprog and tap_filter)
J
Jason Wang 已提交
126 127
 * to serve as one transmit queue for tuntap device. The sock_fprog and
 * tap_filter were kept in tun_struct since they were used for filtering for the
R
Rami Rosen 已提交
128
 * netdevice not for a specific queue (at least I didn't see the requirement for
J
Jason Wang 已提交
129
 * this).
130 131
 *
 * RCU usage:
R
Rami Rosen 已提交
132
 * The tun_file and tun_struct are loosely coupled, the pointer from one to the
133
 * other can only be read while rcu_read_lock or rtnl_lock is held.
J
Jason Wang 已提交
134
 */
E
Eric W. Biederman 已提交
135
struct tun_file {
J
Jason Wang 已提交
136 137 138
	struct sock sk;
	struct socket socket;
	struct socket_wq wq;
139
	struct tun_struct __rcu *tun;
E
Eric W. Biederman 已提交
140
	struct net *net;
J
Jason Wang 已提交
141 142 143
	struct fasync_struct *fasync;
	/* only used for fasnyc */
	unsigned int flags;
144 145 146 147
	union {
		u16 queue_index;
		unsigned int ifindex;
	};
J
Jason Wang 已提交
148 149
	struct list_head next;
	struct tun_struct *detached;
E
Eric W. Biederman 已提交
150 151
};

J
Jason Wang 已提交
152 153 154 155 156 157
struct tun_flow_entry {
	struct hlist_node hash_link;
	struct rcu_head rcu;
	struct tun_struct *tun;

	u32 rxhash;
158
	u32 rps_rxhash;
J
Jason Wang 已提交
159 160 161 162 163 164
	int queue_index;
	unsigned long updated;
};

#define TUN_NUM_FLOW_ENTRIES 1024

J
Jason Wang 已提交
165
/* Since the socket were moved to tun_file, to preserve the behavior of persist
R
Rami Rosen 已提交
166
 * device, socket filter, sndbuf and vnet header size were restore when the
J
Jason Wang 已提交
167 168
 * file were attached to a persist device.
 */
169
struct tun_struct {
J
Jason Wang 已提交
170 171
	struct tun_file __rcu	*tfiles[MAX_TAP_QUEUES];
	unsigned int            numqueues;
172
	unsigned int 		flags;
173 174
	kuid_t			owner;
	kgid_t			group;
175 176

	struct net_device	*dev;
177
	netdev_features_t	set_features;
178
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
179
			  NETIF_F_TSO6)
180 181

	int			vnet_hdr_sz;
J
Jason Wang 已提交
182 183 184 185 186
	int			sndbuf;
	struct tap_filter	txflt;
	struct sock_fprog	fprog;
	/* protected by rtnl lock */
	bool			filter_attached;
187 188
#ifdef TUN_DEBUG
	int debug;
L
Linus Torvalds 已提交
189
#endif
J
Jason Wang 已提交
190 191 192 193
	spinlock_t lock;
	struct hlist_head flows[TUN_NUM_FLOW_ENTRIES];
	struct timer_list flow_gc_timer;
	unsigned long ageing_time;
J
Jason Wang 已提交
194 195
	unsigned int numdisabled;
	struct list_head disabled;
196
	void *security;
197
	u32 flow_count;
198
};
L
Linus Torvalds 已提交
199

J
Jason Wang 已提交
200 201 202 203 204 205 206 207 208
static inline u32 tun_hashfn(u32 rxhash)
{
	return rxhash & 0x3ff;
}

static struct tun_flow_entry *tun_flow_find(struct hlist_head *head, u32 rxhash)
{
	struct tun_flow_entry *e;

209
	hlist_for_each_entry_rcu(e, head, hash_link) {
J
Jason Wang 已提交
210 211 212 213 214 215 216 217 218 219
		if (e->rxhash == rxhash)
			return e;
	}
	return NULL;
}

static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
					      struct hlist_head *head,
					      u32 rxhash, u16 queue_index)
{
220 221
	struct tun_flow_entry *e = kmalloc(sizeof(*e), GFP_ATOMIC);

J
Jason Wang 已提交
222 223 224 225 226
	if (e) {
		tun_debug(KERN_INFO, tun, "create flow: hash %u index %u\n",
			  rxhash, queue_index);
		e->updated = jiffies;
		e->rxhash = rxhash;
227
		e->rps_rxhash = 0;
J
Jason Wang 已提交
228 229 230
		e->queue_index = queue_index;
		e->tun = tun;
		hlist_add_head_rcu(&e->hash_link, head);
231
		++tun->flow_count;
J
Jason Wang 已提交
232 233 234 235 236 237 238 239
	}
	return e;
}

static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
{
	tun_debug(KERN_INFO, tun, "delete flow: hash %u index %u\n",
		  e->rxhash, e->queue_index);
240
	sock_rps_reset_flow_hash(e->rps_rxhash);
J
Jason Wang 已提交
241
	hlist_del_rcu(&e->hash_link);
242
	kfree_rcu(e, rcu);
243
	--tun->flow_count;
J
Jason Wang 已提交
244 245 246 247 248 249 250 251 252
}

static void tun_flow_flush(struct tun_struct *tun)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
253
		struct hlist_node *n;
J
Jason Wang 已提交
254

255
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link)
J
Jason Wang 已提交
256 257 258 259 260 261 262 263 264 265 266 267
			tun_flow_delete(tun, e);
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_delete_by_queue(struct tun_struct *tun, u16 queue_index)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
268
		struct hlist_node *n;
J
Jason Wang 已提交
269

270
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
J
Jason Wang 已提交
271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290
			if (e->queue_index == queue_index)
				tun_flow_delete(tun, e);
		}
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_cleanup(unsigned long data)
{
	struct tun_struct *tun = (struct tun_struct *)data;
	unsigned long delay = tun->ageing_time;
	unsigned long next_timer = jiffies + delay;
	unsigned long count = 0;
	int i;

	tun_debug(KERN_INFO, tun, "tun_flow_cleanup\n");

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
291
		struct hlist_node *n;
J
Jason Wang 已提交
292

293
		hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) {
J
Jason Wang 已提交
294 295 296 297 298 299 300 301 302 303 304 305 306 307 308
			unsigned long this_timer;
			count++;
			this_timer = e->updated + delay;
			if (time_before_eq(this_timer, jiffies))
				tun_flow_delete(tun, e);
			else if (time_before(this_timer, next_timer))
				next_timer = this_timer;
		}
	}

	if (count)
		mod_timer(&tun->flow_gc_timer, round_jiffies_up(next_timer));
	spin_unlock_bh(&tun->lock);
}

309
static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
310
			    struct tun_file *tfile)
J
Jason Wang 已提交
311 312 313 314
{
	struct hlist_head *head;
	struct tun_flow_entry *e;
	unsigned long delay = tun->ageing_time;
315
	u16 queue_index = tfile->queue_index;
J
Jason Wang 已提交
316 317 318 319 320 321 322 323

	if (!rxhash)
		return;
	else
		head = &tun->flows[tun_hashfn(rxhash)];

	rcu_read_lock();

324 325 326
	/* We may get a very small possibility of OOO during switching, not
	 * worth to optimize.*/
	if (tun->numqueues == 1 || tfile->detached)
J
Jason Wang 已提交
327 328 329 330 331 332 333
		goto unlock;

	e = tun_flow_find(head, rxhash);
	if (likely(e)) {
		/* TODO: keep queueing to old queue until it's empty? */
		e->queue_index = queue_index;
		e->updated = jiffies;
334
		sock_rps_record_flow_hash(e->rps_rxhash);
J
Jason Wang 已提交
335 336
	} else {
		spin_lock_bh(&tun->lock);
337 338
		if (!tun_flow_find(head, rxhash) &&
		    tun->flow_count < MAX_TAP_FLOWS)
J
Jason Wang 已提交
339 340 341 342 343 344 345 346 347 348 349 350
			tun_flow_create(tun, head, rxhash, queue_index);

		if (!timer_pending(&tun->flow_gc_timer))
			mod_timer(&tun->flow_gc_timer,
				  round_jiffies_up(jiffies + delay));
		spin_unlock_bh(&tun->lock);
	}

unlock:
	rcu_read_unlock();
}

351 352 353 354 355 356 357 358 359 360 361 362
/**
 * Save the hash received in the stack receive path and update the
 * flow_hash table accordingly.
 */
static inline void tun_flow_save_rps_rxhash(struct tun_flow_entry *e, u32 hash)
{
	if (unlikely(e->rps_rxhash != hash)) {
		sock_rps_reset_flow_hash(e->rps_rxhash);
		e->rps_rxhash = hash;
	}
}

J
Jason Wang 已提交
363
/* We try to identify a flow through its rxhash first. The reason that
S
stephen hemminger 已提交
364
 * we do not check rxq no. is because some cards(e.g 82599), chooses
J
Jason Wang 已提交
365 366 367 368 369
 * the rxq based on the txq where the last packet of the flow comes. As
 * the userspace application move between processors, we may get a
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
370
static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
371
			    void *accel_priv, select_queue_fallback_t fallback)
J
Jason Wang 已提交
372 373
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
374
	struct tun_flow_entry *e;
J
Jason Wang 已提交
375 376 377 378
	u32 txq = 0;
	u32 numqueues = 0;

	rcu_read_lock();
379
	numqueues = ACCESS_ONCE(tun->numqueues);
J
Jason Wang 已提交
380

381
	txq = skb_get_hash(skb);
J
Jason Wang 已提交
382
	if (txq) {
J
Jason Wang 已提交
383
		e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq);
384 385
		if (e) {
			tun_flow_save_rps_rxhash(e, txq);
386
			txq = e->queue_index;
387
		} else
J
Jason Wang 已提交
388 389
			/* use multiply and shift instead of expensive divide */
			txq = ((u64)txq * numqueues) >> 32;
J
Jason Wang 已提交
390 391 392 393 394 395 396 397 398 399
	} else if (likely(skb_rx_queue_recorded(skb))) {
		txq = skb_get_rx_queue(skb);
		while (unlikely(txq >= numqueues))
			txq -= numqueues;
	}

	rcu_read_unlock();
	return txq;
}

400 401 402
static inline bool tun_not_capable(struct tun_struct *tun)
{
	const struct cred *cred = current_cred();
403
	struct net *net = dev_net(tun->dev);
404 405 406

	return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
		  (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
407
		!ns_capable(net->user_ns, CAP_NET_ADMIN);
408 409
}

J
Jason Wang 已提交
410 411 412 413 414 415
static void tun_set_real_num_queues(struct tun_struct *tun)
{
	netif_set_real_num_tx_queues(tun->dev, tun->numqueues);
	netif_set_real_num_rx_queues(tun->dev, tun->numqueues);
}

J
Jason Wang 已提交
416 417 418 419 420 421 422
static void tun_disable_queue(struct tun_struct *tun, struct tun_file *tfile)
{
	tfile->detached = tun;
	list_add_tail(&tfile->next, &tun->disabled);
	++tun->numdisabled;
}

J
Jason Wang 已提交
423
static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
J
Jason Wang 已提交
424 425 426 427 428 429 430 431 432
{
	struct tun_struct *tun = tfile->detached;

	tfile->detached = NULL;
	list_del_init(&tfile->next);
	--tun->numdisabled;
	return tun;
}

433 434 435 436 437 438
static void tun_queue_purge(struct tun_file *tfile)
{
	skb_queue_purge(&tfile->sk.sk_receive_queue);
	skb_queue_purge(&tfile->sk.sk_error_queue);
}

J
Jason Wang 已提交
439 440 441 442 443
static void __tun_detach(struct tun_file *tfile, bool clean)
{
	struct tun_file *ntfile;
	struct tun_struct *tun;

444 445
	tun = rtnl_dereference(tfile->tun);

446
	if (tun && !tfile->detached) {
J
Jason Wang 已提交
447 448 449 450 451
		u16 index = tfile->queue_index;
		BUG_ON(index >= tun->numqueues);

		rcu_assign_pointer(tun->tfiles[index],
				   tun->tfiles[tun->numqueues - 1]);
452
		ntfile = rtnl_dereference(tun->tfiles[index]);
J
Jason Wang 已提交
453 454 455
		ntfile->queue_index = index;

		--tun->numqueues;
456
		if (clean) {
457
			RCU_INIT_POINTER(tfile->tun, NULL);
J
Jason Wang 已提交
458
			sock_put(&tfile->sk);
459
		} else
J
Jason Wang 已提交
460
			tun_disable_queue(tun, tfile);
J
Jason Wang 已提交
461 462

		synchronize_net();
J
Jason Wang 已提交
463
		tun_flow_delete_by_queue(tun, tun->numqueues + 1);
J
Jason Wang 已提交
464
		/* Drop read queue */
465
		tun_queue_purge(tfile);
J
Jason Wang 已提交
466
		tun_set_real_num_queues(tun);
J
Jason Wang 已提交
467
	} else if (tfile->detached && clean) {
J
Jason Wang 已提交
468
		tun = tun_enable_queue(tfile);
J
Jason Wang 已提交
469 470
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
471 472

	if (clean) {
473 474 475 476 477
		if (tun && tun->numqueues == 0 && tun->numdisabled == 0) {
			netif_carrier_off(tun->dev);

			if (!(tun->flags & TUN_PERSIST) &&
			    tun->dev->reg_state == NETREG_REGISTERED)
J
Jason Wang 已提交
478
				unregister_netdevice(tun->dev);
479
		}
J
Jason Wang 已提交
480

J
Jason Wang 已提交
481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496
		BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
				 &tfile->socket.flags));
		sk_release_kernel(&tfile->sk);
	}
}

static void tun_detach(struct tun_file *tfile, bool clean)
{
	rtnl_lock();
	__tun_detach(tfile, clean);
	rtnl_unlock();
}

static void tun_detach_all(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
497
	struct tun_file *tfile, *tmp;
J
Jason Wang 已提交
498 499 500
	int i, n = tun->numqueues;

	for (i = 0; i < n; i++) {
501
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
502
		BUG_ON(!tfile);
503
		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
504
		RCU_INIT_POINTER(tfile->tun, NULL);
J
Jason Wang 已提交
505 506
		--tun->numqueues;
	}
507
	list_for_each_entry(tfile, &tun->disabled, next) {
508
		tfile->socket.sk->sk_data_ready(tfile->socket.sk);
509
		RCU_INIT_POINTER(tfile->tun, NULL);
510
	}
J
Jason Wang 已提交
511 512 513 514
	BUG_ON(tun->numqueues != 0);

	synchronize_net();
	for (i = 0; i < n; i++) {
515
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
516
		/* Drop read queue */
517
		tun_queue_purge(tfile);
J
Jason Wang 已提交
518 519
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
520 521
	list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
		tun_enable_queue(tfile);
522
		tun_queue_purge(tfile);
J
Jason Wang 已提交
523 524 525
		sock_put(&tfile->sk);
	}
	BUG_ON(tun->numdisabled != 0);
J
Jason Wang 已提交
526 527 528

	if (tun->flags & TUN_PERSIST)
		module_put(THIS_MODULE);
J
Jason Wang 已提交
529 530
}

531
static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filter)
532
{
E
Eric W. Biederman 已提交
533
	struct tun_file *tfile = file->private_data;
534
	int err;
535

536 537 538 539
	err = security_tun_dev_attach(tfile->socket.sk, tun->security);
	if (err < 0)
		goto out;

540
	err = -EINVAL;
541
	if (rtnl_dereference(tfile->tun) && !tfile->detached)
542 543 544
		goto out;

	err = -EBUSY;
J
Jason Wang 已提交
545 546 547 548
	if (!(tun->flags & TUN_TAP_MQ) && tun->numqueues == 1)
		goto out;

	err = -E2BIG;
J
Jason Wang 已提交
549 550
	if (!tfile->detached &&
	    tun->numqueues + tun->numdisabled == MAX_TAP_QUEUES)
551 552 553
		goto out;

	err = 0;
J
Jason Wang 已提交
554

S
stephen hemminger 已提交
555
	/* Re-attach the filter to persist device */
556
	if (!skip_filter && (tun->filter_attached == true)) {
J
Jason Wang 已提交
557 558 559 560
		err = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (!err)
			goto out;
	}
J
Jason Wang 已提交
561
	tfile->queue_index = tun->numqueues;
562
	rcu_assign_pointer(tfile->tun, tun);
J
Jason Wang 已提交
563 564
	rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
	tun->numqueues++;
565

J
Jason Wang 已提交
566 567 568 569 570
	if (tfile->detached)
		tun_enable_queue(tfile);
	else
		sock_hold(&tfile->sk);

J
Jason Wang 已提交
571
	tun_set_real_num_queues(tun);
572

J
Jason Wang 已提交
573 574 575 576 577 578
	/* device is allowed to go away first, so no need to hold extra
	 * refcnt.
	 */

out:
	return err;
E
Eric W. Biederman 已提交
579 580 581 582
}

static struct tun_struct *__tun_get(struct tun_file *tfile)
{
583
	struct tun_struct *tun;
584

585 586 587 588 589
	rcu_read_lock();
	tun = rcu_dereference(tfile->tun);
	if (tun)
		dev_hold(tun->dev);
	rcu_read_unlock();
590 591

	return tun;
E
Eric W. Biederman 已提交
592 593 594 595 596 597 598 599 600
}

static struct tun_struct *tun_get(struct file *file)
{
	return __tun_get(file->private_data);
}

static void tun_put(struct tun_struct *tun)
{
601
	dev_put(tun->dev);
E
Eric W. Biederman 已提交
602 603
}

604
/* TAP filtering */
605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653
static void addr_hash_set(u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	mask[n >> 5] |= (1 << (n & 31));
}

static unsigned int addr_hash_test(const u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	return mask[n >> 5] & (1 << (n & 31));
}

static int update_filter(struct tap_filter *filter, void __user *arg)
{
	struct { u8 u[ETH_ALEN]; } *addr;
	struct tun_filter uf;
	int err, alen, n, nexact;

	if (copy_from_user(&uf, arg, sizeof(uf)))
		return -EFAULT;

	if (!uf.count) {
		/* Disabled */
		filter->count = 0;
		return 0;
	}

	alen = ETH_ALEN * uf.count;
	addr = kmalloc(alen, GFP_KERNEL);
	if (!addr)
		return -ENOMEM;

	if (copy_from_user(addr, arg + sizeof(uf), alen)) {
		err = -EFAULT;
		goto done;
	}

	/* The filter is updated without holding any locks. Which is
	 * perfectly safe. We disable it first and in the worst
	 * case we'll accept a few undesired packets. */
	filter->count = 0;
	wmb();

	/* Use first set of addresses as an exact filter */
	for (n = 0; n < uf.count && n < FLT_EXACT_COUNT; n++)
		memcpy(filter->addr[n], addr[n].u, ETH_ALEN);

	nexact = n;

654 655
	/* Remaining multicast addresses are hashed,
	 * unicast will leave the filter disabled. */
656
	memset(filter->mask, 0, sizeof(filter->mask));
657 658 659 660 661
	for (; n < uf.count; n++) {
		if (!is_multicast_ether_addr(addr[n].u)) {
			err = 0; /* no filter */
			goto done;
		}
662
		addr_hash_set(filter->mask, addr[n].u);
663
	}
664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691

	/* For ALLMULTI just set the mask to all ones.
	 * This overrides the mask populated above. */
	if ((uf.flags & TUN_FLT_ALLMULTI))
		memset(filter->mask, ~0, sizeof(filter->mask));

	/* Now enable the filter */
	wmb();
	filter->count = nexact;

	/* Return the number of exact filters */
	err = nexact;

done:
	kfree(addr);
	return err;
}

/* Returns: 0 - drop, !=0 - accept */
static int run_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	/* Cannot use eth_hdr(skb) here because skb_mac_hdr() is incorrect
	 * at this point. */
	struct ethhdr *eh = (struct ethhdr *) skb->data;
	int i;

	/* Exact match */
	for (i = 0; i < filter->count; i++)
692
		if (ether_addr_equal(eh->h_dest, filter->addr[i]))
693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713
			return 1;

	/* Inexact match (multicast only) */
	if (is_multicast_ether_addr(eh->h_dest))
		return addr_hash_test(filter->mask, eh->h_dest);

	return 0;
}

/*
 * Checks whether the packet is accepted or not.
 * Returns: 0 - drop, !=0 - accept
 */
static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	if (!filter->count)
		return 1;

	return run_filter(filter, skb);
}

L
Linus Torvalds 已提交
714 715
/* Network device part of the driver */

716
static const struct ethtool_ops tun_ethtool_ops;
L
Linus Torvalds 已提交
717

718 719 720
/* Net device detach from fd. */
static void tun_net_uninit(struct net_device *dev)
{
J
Jason Wang 已提交
721
	tun_detach_all(dev);
722 723
}

L
Linus Torvalds 已提交
724 725 726
/* Net device open. */
static int tun_net_open(struct net_device *dev)
{
J
Jason Wang 已提交
727
	netif_tx_start_all_queues(dev);
L
Linus Torvalds 已提交
728 729 730 731 732 733
	return 0;
}

/* Net device close. */
static int tun_net_close(struct net_device *dev)
{
J
Jason Wang 已提交
734
	netif_tx_stop_all_queues(dev);
L
Linus Torvalds 已提交
735 736 737 738
	return 0;
}

/* Net device start xmit */
739
static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
L
Linus Torvalds 已提交
740 741
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
742
	int txq = skb->queue_mapping;
743
	struct tun_file *tfile;
744
	u32 numqueues = 0;
L
Linus Torvalds 已提交
745

746
	rcu_read_lock();
J
Jason Wang 已提交
747
	tfile = rcu_dereference(tun->tfiles[txq]);
748
	numqueues = ACCESS_ONCE(tun->numqueues);
J
Jason Wang 已提交
749

L
Linus Torvalds 已提交
750
	/* Drop packet if interface is not attached */
751
	if (txq >= numqueues)
L
Linus Torvalds 已提交
752 753
		goto drop;

754
	if (numqueues == 1) {
755 756 757 758 759 760 761 762 763 764 765 766 767 768 769
		/* Select queue was not called for the skbuff, so we extract the
		 * RPS hash and save it into the flow_table here.
		 */
		__u32 rxhash;

		rxhash = skb_get_hash(skb);
		if (rxhash) {
			struct tun_flow_entry *e;
			e = tun_flow_find(&tun->flows[tun_hashfn(rxhash)],
					rxhash);
			if (e)
				tun_flow_save_rps_rxhash(e, rxhash);
		}
	}

770 771
	tun_debug(KERN_INFO, tun, "tun_net_xmit %d\n", skb->len);

J
Jason Wang 已提交
772 773
	BUG_ON(!tfile);

774 775 776 777 778 779
	/* Drop if the filter does not like it.
	 * This is a noop if the filter is disabled.
	 * Filter can be enabled only for the TAP devices. */
	if (!check_filter(&tun->txflt, skb))
		goto drop;

J
Jason Wang 已提交
780 781
	if (tfile->socket.sk->sk_filter &&
	    sk_filter(tfile->socket.sk, skb))
M
Michael S. Tsirkin 已提交
782 783
		goto drop;

R
Rami Rosen 已提交
784
	/* Limit the number of packets queued by dividing txq length with the
J
Jason Wang 已提交
785 786
	 * number of queues.
	 */
787 788
	if (skb_queue_len(&tfile->socket.sk->sk_receive_queue) * numqueues
			  >= dev->tx_queue_len)
789
		goto drop;
L
Linus Torvalds 已提交
790

791 792 793
	if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
		goto drop;

794 795 796 797 798
	if (skb->sk) {
		sock_tx_timestamp(skb->sk, &skb_shinfo(skb)->tx_flags);
		sw_tx_timestamp(skb);
	}

M
Michael S. Tsirkin 已提交
799
	/* Orphan the skb - required as we might hang on to it
800 801
	 * for indefinite time.
	 */
M
Michael S. Tsirkin 已提交
802 803
	skb_orphan(skb);

804 805
	nf_reset(skb);

806
	/* Enqueue packet */
J
Jason Wang 已提交
807
	skb_queue_tail(&tfile->socket.sk->sk_receive_queue, skb);
L
Linus Torvalds 已提交
808 809

	/* Notify and wake up reader process */
J
Jason Wang 已提交
810 811
	if (tfile->flags & TUN_FASYNC)
		kill_fasync(&tfile->fasync, SIGIO, POLL_IN);
812
	tfile->socket.sk->sk_data_ready(tfile->socket.sk);
813 814

	rcu_read_unlock();
815
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
816 817

drop:
818
	dev->stats.tx_dropped++;
819
	skb_tx_error(skb);
L
Linus Torvalds 已提交
820
	kfree_skb(skb);
821
	rcu_read_unlock();
822
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
823 824
}

825
static void tun_net_mclist(struct net_device *dev)
L
Linus Torvalds 已提交
826
{
827 828 829 830 831
	/*
	 * This callback is supposed to deal with mc filter in
	 * _rx_ path and has nothing to do with the _tx_ path.
	 * In rx path we always accept everything userspace gives us.
	 */
L
Linus Torvalds 已提交
832 833
}

E
Ed Swierk 已提交
834 835 836 837 838 839 840 841 842 843 844 845
#define MIN_MTU 68
#define MAX_MTU 65535

static int
tun_net_change_mtu(struct net_device *dev, int new_mtu)
{
	if (new_mtu < MIN_MTU || new_mtu + dev->hard_header_len > MAX_MTU)
		return -EINVAL;
	dev->mtu = new_mtu;
	return 0;
}

846 847
static netdev_features_t tun_net_fix_features(struct net_device *dev,
	netdev_features_t features)
848 849 850 851 852
{
	struct tun_struct *tun = netdev_priv(dev);

	return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
}
853 854 855 856 857 858 859
#ifdef CONFIG_NET_POLL_CONTROLLER
static void tun_poll_controller(struct net_device *dev)
{
	/*
	 * Tun only receives frames when:
	 * 1) the char device endpoint gets data from user space
	 * 2) the tun socket gets a sendmsg call from user space
S
stephen hemminger 已提交
860
	 * Since both of those are synchronous operations, we are guaranteed
861
	 * never to have pending data when we poll for it
S
stephen hemminger 已提交
862
	 * so there is nothing to do here but return.
863 864 865 866 867 868 869
	 * We need this though so netpoll recognizes us as an interface that
	 * supports polling, which enables bridge devices in virt setups to
	 * still use netconsole
	 */
	return;
}
#endif
S
Stephen Hemminger 已提交
870
static const struct net_device_ops tun_netdev_ops = {
871
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
872 873
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
874
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
875
	.ndo_change_mtu		= tun_net_change_mtu,
876
	.ndo_fix_features	= tun_net_fix_features,
J
Jason Wang 已提交
877
	.ndo_select_queue	= tun_select_queue,
878 879 880
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
881 882 883
};

static const struct net_device_ops tap_netdev_ops = {
884
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
885 886
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
887
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
888
	.ndo_change_mtu		= tun_net_change_mtu,
889
	.ndo_fix_features	= tun_net_fix_features,
890
	.ndo_set_rx_mode	= tun_net_mclist,
S
Stephen Hemminger 已提交
891 892
	.ndo_set_mac_address	= eth_mac_addr,
	.ndo_validate_addr	= eth_validate_addr,
J
Jason Wang 已提交
893
	.ndo_select_queue	= tun_select_queue,
894 895 896
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
897 898
};

899
static void tun_flow_init(struct tun_struct *tun)
J
Jason Wang 已提交
900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917
{
	int i;

	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++)
		INIT_HLIST_HEAD(&tun->flows[i]);

	tun->ageing_time = TUN_FLOW_EXPIRE;
	setup_timer(&tun->flow_gc_timer, tun_flow_cleanup, (unsigned long)tun);
	mod_timer(&tun->flow_gc_timer,
		  round_jiffies_up(jiffies + tun->ageing_time));
}

static void tun_flow_uninit(struct tun_struct *tun)
{
	del_timer_sync(&tun->flow_gc_timer);
	tun_flow_flush(tun);
}

L
Linus Torvalds 已提交
918 919 920 921
/* Initialize net device. */
static void tun_net_init(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
922

L
Linus Torvalds 已提交
923 924
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
S
Stephen Hemminger 已提交
925 926
		dev->netdev_ops = &tun_netdev_ops;

L
Linus Torvalds 已提交
927 928 929 930 931 932
		/* Point-to-Point TUN Device */
		dev->hard_header_len = 0;
		dev->addr_len = 0;
		dev->mtu = 1500;

		/* Zero header length */
933
		dev->type = ARPHRD_NONE;
L
Linus Torvalds 已提交
934 935 936 937 938
		dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;

	case TUN_TAP_DEV:
K
Kusanagi Kouichi 已提交
939
		dev->netdev_ops = &tap_netdev_ops;
L
Linus Torvalds 已提交
940 941
		/* Ethernet TAP Device */
		ether_setup(dev);
942
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
943
		dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
944

945
		eth_hw_addr_random(dev);
946

L
Linus Torvalds 已提交
947 948 949 950 951 952 953 954
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;
	}
}

/* Character device part */

/* Poll */
J
Jason Wang 已提交
955
static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
956
{
957 958
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
959
	struct sock *sk;
960
	unsigned int mask = 0;
L
Linus Torvalds 已提交
961 962

	if (!tun)
963
		return POLLERR;
L
Linus Torvalds 已提交
964

J
Jason Wang 已提交
965
	sk = tfile->socket.sk;
966

967
	tun_debug(KERN_INFO, tun, "tun_chr_poll\n");
L
Linus Torvalds 已提交
968

969
	poll_wait(file, sk_sleep(sk), wait);
970

971
	if (!skb_queue_empty(&sk->sk_receive_queue))
L
Linus Torvalds 已提交
972 973
		mask |= POLLIN | POLLRDNORM;

974 975 976 977 978
	if (sock_writeable(sk) ||
	    (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
	     sock_writeable(sk)))
		mask |= POLLOUT | POLLWRNORM;

979 980 981
	if (tun->dev->reg_state != NETREG_REGISTERED)
		mask = POLLERR;

E
Eric W. Biederman 已提交
982
	tun_put(tun);
L
Linus Torvalds 已提交
983 984 985
	return mask;
}

986 987
/* prepad is the amount to reserve at front.  len is length after that.
 * linear is a hint as to how much to copy (usually headers). */
J
Jason Wang 已提交
988
static struct sk_buff *tun_alloc_skb(struct tun_file *tfile,
989 990
				     size_t prepad, size_t len,
				     size_t linear, int noblock)
991
{
J
Jason Wang 已提交
992
	struct sock *sk = tfile->socket.sk;
993
	struct sk_buff *skb;
994
	int err;
995 996

	/* Under a page?  Don't bother with paged skb. */
H
Herbert Xu 已提交
997
	if (prepad + len < PAGE_SIZE || !linear)
998
		linear = len;
999

1000
	skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
1001
				   &err, 0);
1002
	if (!skb)
1003
		return ERR_PTR(err);
1004 1005 1006

	skb_reserve(skb, prepad);
	skb_put(skb, linear);
1007 1008
	skb->data_len = len - linear;
	skb->len += len - linear;
1009 1010 1011 1012

	return skb;
}

L
Linus Torvalds 已提交
1013
/* Get packet from user space buffer */
J
Jason Wang 已提交
1014 1015 1016
static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
			    void *msg_control, const struct iovec *iv,
			    size_t total_len, size_t count, int noblock)
L
Linus Torvalds 已提交
1017
{
1018
	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
L
Linus Torvalds 已提交
1019
	struct sk_buff *skb;
1020
	size_t len = total_len, align = NET_SKB_PAD, linear;
1021
	struct virtio_net_hdr gso = { 0 };
1022
	int good_linear;
1023
	int offset = 0;
1024 1025 1026
	int copylen;
	bool zerocopy = false;
	int err;
1027
	u32 rxhash;
L
Linus Torvalds 已提交
1028 1029

	if (!(tun->flags & TUN_NO_PI)) {
1030
		if (len < sizeof(pi))
L
Linus Torvalds 已提交
1031
			return -EINVAL;
1032
		len -= sizeof(pi);
L
Linus Torvalds 已提交
1033

1034
		if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
L
Linus Torvalds 已提交
1035
			return -EFAULT;
1036
		offset += sizeof(pi);
L
Linus Torvalds 已提交
1037 1038
	}

1039
	if (tun->flags & TUN_VNET_HDR) {
1040
		if (len < tun->vnet_hdr_sz)
1041
			return -EINVAL;
1042
		len -= tun->vnet_hdr_sz;
1043

1044
		if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
1045 1046
			return -EFAULT;

1047 1048 1049 1050
		if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
		    gso.csum_start + gso.csum_offset + 2 > gso.hdr_len)
			gso.hdr_len = gso.csum_start + gso.csum_offset + 2;

1051 1052
		if (gso.hdr_len > len)
			return -EINVAL;
1053
		offset += tun->vnet_hdr_sz;
1054 1055
	}

1056
	if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
1057
		align += NET_IP_ALIGN;
H
Herbert Xu 已提交
1058 1059
		if (unlikely(len < ETH_HLEN ||
			     (gso.hdr_len && gso.hdr_len < ETH_HLEN)))
1060 1061
			return -EINVAL;
	}
1062

1063 1064
	good_linear = SKB_MAX_HEAD(align);

1065 1066 1067
	if (msg_control) {
		/* There are 256 bytes to be copied in skb, so there is
		 * enough room for skb expand head in case it is used.
1068 1069
		 * The rest of the buffer is mapped from userspace.
		 */
1070
		copylen = gso.hdr_len ? gso.hdr_len : GOODCOPY_LEN;
1071 1072
		if (copylen > good_linear)
			copylen = good_linear;
1073
		linear = copylen;
1074 1075 1076 1077 1078
		if (iov_pages(iv, offset + copylen, count) <= MAX_SKB_FRAGS)
			zerocopy = true;
	}

	if (!zerocopy) {
1079
		copylen = len;
1080 1081 1082 1083
		if (gso.hdr_len > good_linear)
			linear = good_linear;
		else
			linear = gso.hdr_len;
1084
	}
1085

1086
	skb = tun_alloc_skb(tfile, align, copylen, linear, noblock);
1087 1088 1089 1090
	if (IS_ERR(skb)) {
		if (PTR_ERR(skb) != -EAGAIN)
			tun->dev->stats.rx_dropped++;
		return PTR_ERR(skb);
L
Linus Torvalds 已提交
1091 1092
	}

1093 1094
	if (zerocopy)
		err = zerocopy_sg_from_iovec(skb, iv, offset, count);
1095
	else {
1096
		err = skb_copy_datagram_from_iovec(skb, 0, iv, offset, len);
1097 1098 1099 1100 1101
		if (!err && msg_control) {
			struct ubuf_info *uarg = msg_control;
			uarg->callback(uarg, false);
		}
	}
1102 1103

	if (err) {
1104
		tun->dev->stats.rx_dropped++;
D
Dave Jones 已提交
1105
		kfree_skb(skb);
L
Linus Torvalds 已提交
1106
		return -EFAULT;
D
Dave Jones 已提交
1107
	}
L
Linus Torvalds 已提交
1108

1109 1110 1111 1112 1113 1114 1115
	if (gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
		if (!skb_partial_csum_set(skb, gso.csum_start,
					  gso.csum_offset)) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}
1116
	}
1117

L
Linus Torvalds 已提交
1118 1119
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134
		if (tun->flags & TUN_NO_PI) {
			switch (skb->data[0] & 0xf0) {
			case 0x40:
				pi.proto = htons(ETH_P_IP);
				break;
			case 0x60:
				pi.proto = htons(ETH_P_IPV6);
				break;
			default:
				tun->dev->stats.rx_dropped++;
				kfree_skb(skb);
				return -EINVAL;
			}
		}

1135
		skb_reset_mac_header(skb);
L
Linus Torvalds 已提交
1136
		skb->protocol = pi.proto;
1137
		skb->dev = tun->dev;
L
Linus Torvalds 已提交
1138 1139 1140 1141
		break;
	case TUN_TAP_DEV:
		skb->protocol = eth_type_trans(skb, tun->dev);
		break;
1142
	}
L
Linus Torvalds 已提交
1143

1144 1145
	skb_reset_network_header(skb);

1146 1147 1148 1149
	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
		pr_debug("GSO!\n");
		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
		case VIRTIO_NET_HDR_GSO_TCPV4:
1150
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
1151 1152
			break;
		case VIRTIO_NET_HDR_GSO_TCPV6:
1153
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
1154
			break;
1155
		case VIRTIO_NET_HDR_GSO_UDP:
1156 1157 1158 1159 1160 1161 1162 1163 1164
		{
			static bool warned;

			if (!warned) {
				warned = true;
				netdev_warn(tun->dev,
					    "%s: using disabled UFO feature; please fix this program\n",
					    current->comm);
			}
1165
			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
1166 1167
			if (skb->protocol == htons(ETH_P_IPV6))
				ipv6_proxy_select_ident(skb);
1168
			break;
1169
		}
1170 1171 1172 1173 1174 1175 1176
		default:
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		if (gso.gso_type & VIRTIO_NET_HDR_GSO_ECN)
1177
			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189

		skb_shinfo(skb)->gso_size = gso.gso_size;
		if (skb_shinfo(skb)->gso_size == 0) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		/* Header must be checked, and gso_segs computed. */
		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
		skb_shinfo(skb)->gso_segs = 0;
	}
1190

1191 1192 1193 1194
	/* copy skb_ubuf_info for callback when skb has no error */
	if (zerocopy) {
		skb_shinfo(skb)->destructor_arg = msg_control;
		skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
1195
		skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG;
1196 1197
	}

1198
	skb_probe_transport_header(skb, 0);
1199

1200
	rxhash = skb_get_hash(skb);
L
Linus Torvalds 已提交
1201
	netif_rx_ni(skb);
1202

1203 1204
	tun->dev->stats.rx_packets++;
	tun->dev->stats.rx_bytes += len;
L
Linus Torvalds 已提交
1205

1206
	tun_flow_update(tun, rxhash, tfile);
1207
	return total_len;
1208
}
L
Linus Torvalds 已提交
1209

1210 1211
static ssize_t tun_chr_aio_write(struct kiocb *iocb, const struct iovec *iv,
			      unsigned long count, loff_t pos)
L
Linus Torvalds 已提交
1212
{
1213
	struct file *file = iocb->ki_filp;
H
Herbert Xu 已提交
1214
	struct tun_struct *tun = tun_get(file);
J
Jason Wang 已提交
1215
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1216
	ssize_t result;
L
Linus Torvalds 已提交
1217 1218 1219 1220

	if (!tun)
		return -EBADFD;

1221
	tun_debug(KERN_INFO, tun, "tun_chr_write %ld\n", count);
L
Linus Torvalds 已提交
1222

J
Jason Wang 已提交
1223 1224
	result = tun_get_user(tun, tfile, NULL, iv, iov_length(iv, count),
			      count, file->f_flags & O_NONBLOCK);
E
Eric W. Biederman 已提交
1225 1226 1227

	tun_put(tun);
	return result;
L
Linus Torvalds 已提交
1228 1229 1230
}

/* Put packet to the user space buffer */
1231
static ssize_t tun_put_user(struct tun_struct *tun,
J
Jason Wang 已提交
1232
			    struct tun_file *tfile,
1233
			    struct sk_buff *skb,
H
Herbert Xu 已提交
1234
			    struct iov_iter *iter)
L
Linus Torvalds 已提交
1235 1236
{
	struct tun_pi pi = { 0, skb->protocol };
H
Herbert Xu 已提交
1237
	ssize_t total;
1238
	int vlan_offset = 0;
1239
	int vlan_hlen = 0;
H
Herbert Xu 已提交
1240
	int vnet_hdr_sz = 0;
1241 1242 1243

	if (vlan_tx_tag_present(skb))
		vlan_hlen = VLAN_HLEN;
L
Linus Torvalds 已提交
1244

H
Herbert Xu 已提交
1245 1246 1247
	if (tun->flags & TUN_VNET_HDR)
		vnet_hdr_sz = tun->vnet_hdr_sz;

H
Herbert Xu 已提交
1248 1249
	total = skb->len + vlan_hlen + vnet_hdr_sz;

L
Linus Torvalds 已提交
1250
	if (!(tun->flags & TUN_NO_PI)) {
H
Herbert Xu 已提交
1251
		if (iov_iter_count(iter) < sizeof(pi))
L
Linus Torvalds 已提交
1252 1253
			return -EINVAL;

H
Herbert Xu 已提交
1254 1255
		total += sizeof(pi);
		if (iov_iter_count(iter) < total) {
L
Linus Torvalds 已提交
1256 1257 1258
			/* Packet will be striped */
			pi.flags |= TUN_PKT_STRIP;
		}
1259

H
Herbert Xu 已提交
1260
		if (copy_to_iter(&pi, sizeof(pi), iter) != sizeof(pi))
L
Linus Torvalds 已提交
1261
			return -EFAULT;
1262
	}
L
Linus Torvalds 已提交
1263

H
Herbert Xu 已提交
1264
	if (vnet_hdr_sz) {
1265
		struct virtio_net_hdr gso = { 0 }; /* no info leak */
H
Herbert Xu 已提交
1266
		if (iov_iter_count(iter) < vnet_hdr_sz)
1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278
			return -EINVAL;

		if (skb_is_gso(skb)) {
			struct skb_shared_info *sinfo = skb_shinfo(skb);

			/* This is a hint as to how much should be linear. */
			gso.hdr_len = skb_headlen(skb);
			gso.gso_size = sinfo->gso_size;
			if (sinfo->gso_type & SKB_GSO_TCPV4)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
			else if (sinfo->gso_type & SKB_GSO_TCPV6)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
1279
			else {
1280
				pr_err("unexpected GSO type: "
1281 1282 1283 1284 1285 1286 1287 1288 1289 1290
				       "0x%x, gso_size %d, hdr_len %d\n",
				       sinfo->gso_type, gso.gso_size,
				       gso.hdr_len);
				print_hex_dump(KERN_ERR, "tun: ",
					       DUMP_PREFIX_NONE,
					       16, 1, skb->head,
					       min((int)gso.hdr_len, 64), true);
				WARN_ON_ONCE(1);
				return -EINVAL;
			}
1291 1292 1293 1294 1295 1296 1297
			if (sinfo->gso_type & SKB_GSO_TCP_ECN)
				gso.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
		} else
			gso.gso_type = VIRTIO_NET_HDR_GSO_NONE;

		if (skb->ip_summed == CHECKSUM_PARTIAL) {
			gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
1298 1299
			gso.csum_start = skb_checksum_start_offset(skb) +
					 vlan_hlen;
1300
			gso.csum_offset = skb->csum_offset;
1301 1302
		} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
			gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
1303 1304
		} /* else everything is zero */

H
Herbert Xu 已提交
1305
		if (copy_to_iter(&gso, sizeof(gso), iter) != sizeof(gso))
1306
			return -EFAULT;
1307 1308

		iov_iter_advance(iter, vnet_hdr_sz - sizeof(gso));
1309 1310
	}

1311
	if (vlan_hlen) {
H
Herbert Xu 已提交
1312
		int ret;
J
Jason Wang 已提交
1313 1314 1315 1316 1317 1318 1319 1320 1321 1322
		struct {
			__be16 h_vlan_proto;
			__be16 h_vlan_TCI;
		} veth;

		veth.h_vlan_proto = skb->vlan_proto;
		veth.h_vlan_TCI = htons(vlan_tx_tag_get(skb));

		vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto);

H
Herbert Xu 已提交
1323 1324
		ret = skb_copy_datagram_iter(skb, 0, iter, vlan_offset);
		if (ret || !iov_iter_count(iter))
J
Jason Wang 已提交
1325 1326
			goto done;

H
Herbert Xu 已提交
1327 1328
		ret = copy_to_iter(&veth, sizeof(veth), iter);
		if (ret != sizeof(veth) || !iov_iter_count(iter))
J
Jason Wang 已提交
1329 1330
			goto done;
	}
L
Linus Torvalds 已提交
1331

H
Herbert Xu 已提交
1332
	skb_copy_datagram_iter(skb, vlan_offset, iter, skb->len - vlan_offset);
L
Linus Torvalds 已提交
1333

J
Jason Wang 已提交
1334
done:
1335
	tun->dev->stats.tx_packets++;
H
Herbert Xu 已提交
1336
	tun->dev->stats.tx_bytes += skb->len + vlan_hlen;
L
Linus Torvalds 已提交
1337 1338 1339 1340

	return total;
}

J
Jason Wang 已提交
1341
static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
H
Herbert Xu 已提交
1342 1343
			   const struct iovec *iv, unsigned long segs,
			   ssize_t len, int noblock)
L
Linus Torvalds 已提交
1344 1345
{
	struct sk_buff *skb;
1346
	ssize_t ret = 0;
1347
	int peeked, err, off = 0;
H
Herbert Xu 已提交
1348
	struct iov_iter iter;
L
Linus Torvalds 已提交
1349

1350
	tun_debug(KERN_INFO, tun, "tun_do_read\n");
L
Linus Torvalds 已提交
1351

1352 1353
	if (!len)
		return ret;
L
Linus Torvalds 已提交
1354

1355 1356
	if (tun->dev->reg_state != NETREG_REGISTERED)
		return -EIO;
L
Linus Torvalds 已提交
1357

1358 1359 1360
	/* Read frames from queue */
	skb = __skb_recv_datagram(tfile->socket.sk, noblock ? MSG_DONTWAIT : 0,
				  &peeked, &off, &err);
H
Herbert Xu 已提交
1361 1362 1363 1364 1365 1366
	if (!skb)
		return ret;

	iov_iter_init(&iter, READ, iv, segs, len);
	ret = tun_put_user(tun, tfile, skb, &iter);
	kfree_skb(skb);
L
Linus Torvalds 已提交
1367

1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386
	return ret;
}

static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
			    unsigned long count, loff_t pos)
{
	struct file *file = iocb->ki_filp;
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
	ssize_t len, ret;

	if (!tun)
		return -EBADFD;
	len = iov_length(iv, count);
	if (len < 0) {
		ret = -EINVAL;
		goto out;
	}

H
Herbert Xu 已提交
1387
	ret = tun_do_read(tun, tfile, iv, count, len,
J
Jason Wang 已提交
1388
			  file->f_flags & O_NONBLOCK);
1389
	ret = min_t(ssize_t, ret, len);
Z
Zhi Yong Wu 已提交
1390 1391
	if (ret > 0)
		iocb->ki_pos = ret;
E
Eric W. Biederman 已提交
1392 1393
out:
	tun_put(tun);
L
Linus Torvalds 已提交
1394 1395 1396
	return ret;
}

J
Jason Wang 已提交
1397 1398 1399 1400
static void tun_free_netdev(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

J
Jason Wang 已提交
1401
	BUG_ON(!(list_empty(&tun->disabled)));
J
Jason Wang 已提交
1402
	tun_flow_uninit(tun);
1403
	security_tun_dev_free_security(tun->security);
J
Jason Wang 已提交
1404 1405 1406
	free_netdev(dev);
}

L
Linus Torvalds 已提交
1407 1408 1409 1410
static void tun_setup(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

1411 1412
	tun->owner = INVALID_UID;
	tun->group = INVALID_GID;
L
Linus Torvalds 已提交
1413 1414

	dev->ethtool_ops = &tun_ethtool_ops;
J
Jason Wang 已提交
1415
	dev->destructor = tun_free_netdev;
L
Linus Torvalds 已提交
1416 1417
}

1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432
/* Trivial set of netlink ops to allow deleting tun or tap
 * device with netlink.
 */
static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
{
	return -EINVAL;
}

static struct rtnl_link_ops tun_link_ops __read_mostly = {
	.kind		= DRV_NAME,
	.priv_size	= sizeof(struct tun_struct),
	.setup		= tun_setup,
	.validate	= tun_validate,
};

1433 1434
static void tun_sock_write_space(struct sock *sk)
{
J
Jason Wang 已提交
1435
	struct tun_file *tfile;
1436
	wait_queue_head_t *wqueue;
1437 1438 1439 1440 1441 1442 1443

	if (!sock_writeable(sk))
		return;

	if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
		return;

1444 1445 1446
	wqueue = sk_sleep(sk);
	if (wqueue && waitqueue_active(wqueue))
		wake_up_interruptible_sync_poll(wqueue, POLLOUT |
1447
						POLLWRNORM | POLLWRBAND);
H
Herbert Xu 已提交
1448

J
Jason Wang 已提交
1449 1450
	tfile = container_of(sk, struct tun_file, sk);
	kill_fasync(&tfile->fasync, SIGIO, POLL_OUT);
1451 1452
}

1453 1454 1455
static int tun_sendmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len)
{
J
Jason Wang 已提交
1456 1457 1458 1459 1460 1461 1462 1463 1464 1465
	int ret;
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);

	if (!tun)
		return -EBADFD;
	ret = tun_get_user(tun, tfile, m->msg_control, m->msg_iov, total_len,
			   m->msg_iovlen, m->msg_flags & MSG_DONTWAIT);
	tun_put(tun);
	return ret;
1466 1467 1468 1469 1470 1471
}

static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len,
		       int flags)
{
J
Jason Wang 已提交
1472 1473
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);
1474
	int ret;
J
Jason Wang 已提交
1475 1476 1477 1478

	if (!tun)
		return -EBADFD;

1479
	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) {
1480 1481 1482
		ret = -EINVAL;
		goto out;
	}
1483 1484 1485 1486 1487
	if (flags & MSG_ERRQUEUE) {
		ret = sock_recv_errqueue(sock->sk, m, total_len,
					 SOL_PACKET, TUN_TX_TIMESTAMP);
		goto out;
	}
H
Herbert Xu 已提交
1488
	ret = tun_do_read(tun, tfile, m->msg_iov, m->msg_iovlen, total_len,
1489
			  flags & MSG_DONTWAIT);
1490 1491 1492 1493
	if (ret > total_len) {
		m->msg_flags |= MSG_TRUNC;
		ret = flags & MSG_TRUNC ? ret : total_len;
	}
1494
out:
J
Jason Wang 已提交
1495
	tun_put(tun);
1496 1497 1498
	return ret;
}

1499 1500 1501 1502 1503 1504 1505
static int tun_release(struct socket *sock)
{
	if (sock->sk)
		sock_put(sock->sk);
	return 0;
}

1506 1507 1508 1509
/* Ops structure to mimic raw sockets with tun */
static const struct proto_ops tun_socket_ops = {
	.sendmsg = tun_sendmsg,
	.recvmsg = tun_recvmsg,
1510
	.release = tun_release,
1511 1512
};

1513 1514 1515
static struct proto tun_proto = {
	.name		= "tun",
	.owner		= THIS_MODULE,
J
Jason Wang 已提交
1516
	.obj_size	= sizeof(struct tun_file),
1517
};
1518

1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530
static int tun_flags(struct tun_struct *tun)
{
	int flags = 0;

	if (tun->flags & TUN_TUN_DEV)
		flags |= IFF_TUN;
	else
		flags |= IFF_TAP;

	if (tun->flags & TUN_NO_PI)
		flags |= IFF_NO_PI;

1531 1532 1533
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
1534 1535 1536 1537 1538 1539
	if (tun->flags & TUN_ONE_QUEUE)
		flags |= IFF_ONE_QUEUE;

	if (tun->flags & TUN_VNET_HDR)
		flags |= IFF_VNET_HDR;

J
Jason Wang 已提交
1540 1541 1542
	if (tun->flags & TUN_TAP_MQ)
		flags |= IFF_MULTI_QUEUE;

1543 1544 1545
	if (tun->flags & TUN_PERSIST)
		flags |= IFF_PERSIST;

1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559
	return flags;
}

static ssize_t tun_show_flags(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "0x%x\n", tun_flags(tun));
}

static ssize_t tun_show_owner(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1560 1561 1562 1563
	return uid_valid(tun->owner)?
		sprintf(buf, "%u\n",
			from_kuid_munged(current_user_ns(), tun->owner)):
		sprintf(buf, "-1\n");
1564 1565 1566 1567 1568 1569
}

static ssize_t tun_show_group(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1570 1571 1572 1573
	return gid_valid(tun->group) ?
		sprintf(buf, "%u\n",
			from_kgid_munged(current_user_ns(), tun->group)):
		sprintf(buf, "-1\n");
1574 1575 1576 1577 1578 1579
}

static DEVICE_ATTR(tun_flags, 0444, tun_show_flags, NULL);
static DEVICE_ATTR(owner, 0444, tun_show_owner, NULL);
static DEVICE_ATTR(group, 0444, tun_show_group, NULL);

1580
static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
L
Linus Torvalds 已提交
1581 1582
{
	struct tun_struct *tun;
J
Jason Wang 已提交
1583
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
1584 1585 1586
	struct net_device *dev;
	int err;

1587 1588 1589
	if (tfile->detached)
		return -EINVAL;

1590 1591
	dev = __dev_get_by_name(net, ifr->ifr_name);
	if (dev) {
1592 1593
		if (ifr->ifr_flags & IFF_TUN_EXCL)
			return -EBUSY;
1594 1595 1596 1597 1598 1599 1600
		if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
			tun = netdev_priv(dev);
		else if ((ifr->ifr_flags & IFF_TAP) && dev->netdev_ops == &tap_netdev_ops)
			tun = netdev_priv(dev);
		else
			return -EINVAL;

1601 1602 1603 1604
		if (!!(ifr->ifr_flags & IFF_MULTI_QUEUE) !=
		    !!(tun->flags & TUN_TAP_MQ))
			return -EINVAL;

1605
		if (tun_not_capable(tun))
P
Paul Moore 已提交
1606
			return -EPERM;
1607
		err = security_tun_dev_open(tun->security);
P
Paul Moore 已提交
1608 1609 1610
		if (err < 0)
			return err;

1611
		err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER);
1612 1613
		if (err < 0)
			return err;
J
Jason Wang 已提交
1614 1615

		if (tun->flags & TUN_TAP_MQ &&
1616 1617 1618 1619 1620 1621
		    (tun->numqueues + tun->numdisabled > 1)) {
			/* One or more queue has already been attached, no need
			 * to initialize the device again.
			 */
			return 0;
		}
1622
	}
L
Linus Torvalds 已提交
1623 1624 1625
	else {
		char *name;
		unsigned long flags = 0;
1626 1627
		int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
			     MAX_TAP_QUEUES : 1;
L
Linus Torvalds 已提交
1628

1629
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1630
			return -EPERM;
P
Paul Moore 已提交
1631 1632 1633
		err = security_tun_dev_create();
		if (err < 0)
			return err;
1634

L
Linus Torvalds 已提交
1635 1636 1637 1638 1639 1640 1641 1642 1643
		/* Set dev type */
		if (ifr->ifr_flags & IFF_TUN) {
			/* TUN device */
			flags |= TUN_TUN_DEV;
			name = "tun%d";
		} else if (ifr->ifr_flags & IFF_TAP) {
			/* TAP device */
			flags |= TUN_TAP_DEV;
			name = "tap%d";
1644
		} else
1645
			return -EINVAL;
1646

L
Linus Torvalds 已提交
1647 1648 1649
		if (*ifr->ifr_name)
			name = ifr->ifr_name;

J
Jason Wang 已提交
1650
		dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
1651 1652
				       NET_NAME_UNKNOWN, tun_setup, queues,
				       queues);
1653

L
Linus Torvalds 已提交
1654 1655 1656
		if (!dev)
			return -ENOMEM;

1657
		dev_net_set(dev, net);
1658
		dev->rtnl_link_ops = &tun_link_ops;
1659
		dev->ifindex = tfile->ifindex;
S
Stephen Hemminger 已提交
1660

L
Linus Torvalds 已提交
1661 1662 1663
		tun = netdev_priv(dev);
		tun->dev = dev;
		tun->flags = flags;
1664
		tun->txflt.count = 0;
1665
		tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
1666

J
Jason Wang 已提交
1667 1668
		tun->filter_attached = false;
		tun->sndbuf = tfile->socket.sk->sk_sndbuf;
1669

J
Jason Wang 已提交
1670 1671
		spin_lock_init(&tun->lock);

1672 1673 1674
		err = security_tun_dev_alloc_security(&tun->security);
		if (err < 0)
			goto err_free_dev;
P
Paul Moore 已提交
1675

L
Linus Torvalds 已提交
1676
		tun_net_init(dev);
1677
		tun_flow_init(tun);
J
Jason Wang 已提交
1678

1679
		dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
J
Jason Wang 已提交
1680 1681
				   TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX |
				   NETIF_F_HW_VLAN_STAG_TX;
1682
		dev->features = dev->hw_features;
1683 1684 1685
		dev->vlan_features = dev->features &
				     ~(NETIF_F_HW_VLAN_CTAG_TX |
				       NETIF_F_HW_VLAN_STAG_TX);
1686

J
Jason Wang 已提交
1687
		INIT_LIST_HEAD(&tun->disabled);
1688
		err = tun_attach(tun, file, false);
1689
		if (err < 0)
1690
			goto err_free_flow;
1691

L
Linus Torvalds 已提交
1692 1693
		err = register_netdevice(tun->dev);
		if (err < 0)
1694
			goto err_detach;
1695

1696 1697 1698
		if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
		    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
		    device_create_file(&tun->dev->dev, &dev_attr_group))
1699
			pr_err("Failed to create tun sysfs files\n");
L
Linus Torvalds 已提交
1700 1701
	}

1702 1703
	netif_carrier_on(tun->dev);

1704
	tun_debug(KERN_INFO, tun, "tun_set_iff\n");
L
Linus Torvalds 已提交
1705 1706 1707

	if (ifr->ifr_flags & IFF_NO_PI)
		tun->flags |= TUN_NO_PI;
1708 1709
	else
		tun->flags &= ~TUN_NO_PI;
L
Linus Torvalds 已提交
1710

1711 1712 1713
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
L
Linus Torvalds 已提交
1714 1715
	if (ifr->ifr_flags & IFF_ONE_QUEUE)
		tun->flags |= TUN_ONE_QUEUE;
1716 1717
	else
		tun->flags &= ~TUN_ONE_QUEUE;
L
Linus Torvalds 已提交
1718

1719 1720 1721 1722 1723
	if (ifr->ifr_flags & IFF_VNET_HDR)
		tun->flags |= TUN_VNET_HDR;
	else
		tun->flags &= ~TUN_VNET_HDR;

J
Jason Wang 已提交
1724 1725 1726 1727 1728
	if (ifr->ifr_flags & IFF_MULTI_QUEUE)
		tun->flags |= TUN_TAP_MQ;
	else
		tun->flags &= ~TUN_TAP_MQ;

1729 1730 1731 1732
	/* Make sure persistent devices do not get stuck in
	 * xoff state.
	 */
	if (netif_running(tun->dev))
J
Jason Wang 已提交
1733
		netif_tx_wake_all_queues(tun->dev);
1734

L
Linus Torvalds 已提交
1735 1736 1737
	strcpy(ifr->ifr_name, tun->dev->name);
	return 0;

1738 1739 1740 1741 1742 1743
err_detach:
	tun_detach_all(dev);
err_free_flow:
	tun_flow_uninit(tun);
	security_tun_dev_free_security(tun->security);
err_free_dev:
L
Linus Torvalds 已提交
1744 1745 1746 1747
	free_netdev(dev);
	return err;
}

R
Rami Rosen 已提交
1748
static void tun_get_iff(struct net *net, struct tun_struct *tun,
1749
		       struct ifreq *ifr)
1750
{
1751
	tun_debug(KERN_INFO, tun, "tun_get_iff\n");
1752 1753 1754

	strcpy(ifr->ifr_name, tun->dev->name);

1755
	ifr->ifr_flags = tun_flags(tun);
1756 1757 1758

}

1759 1760
/* This is like a cut-down ethtool ops, except done via tun fd so no
 * privs required. */
1761
static int set_offload(struct tun_struct *tun, unsigned long arg)
1762
{
1763
	netdev_features_t features = 0;
1764 1765

	if (arg & TUN_F_CSUM) {
1766
		features |= NETIF_F_HW_CSUM;
1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786
		arg &= ~TUN_F_CSUM;

		if (arg & (TUN_F_TSO4|TUN_F_TSO6)) {
			if (arg & TUN_F_TSO_ECN) {
				features |= NETIF_F_TSO_ECN;
				arg &= ~TUN_F_TSO_ECN;
			}
			if (arg & TUN_F_TSO4)
				features |= NETIF_F_TSO;
			if (arg & TUN_F_TSO6)
				features |= NETIF_F_TSO6;
			arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
		}
	}

	/* This gives the user a way to test for new features in future by
	 * trying to set them. */
	if (arg)
		return -EINVAL;

1787 1788
	tun->set_features = features;
	netdev_update_features(tun->dev);
1789 1790 1791 1792

	return 0;
}

J
Jason Wang 已提交
1793 1794 1795 1796 1797 1798
static void tun_detach_filter(struct tun_struct *tun, int n)
{
	int i;
	struct tun_file *tfile;

	for (i = 0; i < n; i++) {
1799
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811
		sk_detach_filter(tfile->socket.sk);
	}

	tun->filter_attached = false;
}

static int tun_attach_filter(struct tun_struct *tun)
{
	int i, ret = 0;
	struct tun_file *tfile;

	for (i = 0; i < tun->numqueues; i++) {
1812
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829
		ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (ret) {
			tun_detach_filter(tun, i);
			return ret;
		}
	}

	tun->filter_attached = true;
	return ret;
}

static void tun_set_sndbuf(struct tun_struct *tun)
{
	struct tun_file *tfile;
	int i;

	for (i = 0; i < tun->numqueues; i++) {
1830
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1831 1832 1833 1834
		tfile->socket.sk->sk_sndbuf = tun->sndbuf;
	}
}

1835 1836 1837 1838 1839 1840 1841 1842 1843
static int tun_set_queue(struct file *file, struct ifreq *ifr)
{
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun;
	int ret = 0;

	rtnl_lock();

	if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
J
Jason Wang 已提交
1844
		tun = tfile->detached;
1845
		if (!tun) {
1846
			ret = -EINVAL;
1847 1848 1849 1850 1851
			goto unlock;
		}
		ret = security_tun_dev_attach_queue(tun->security);
		if (ret < 0)
			goto unlock;
1852
		ret = tun_attach(tun, file, false);
J
Jason Wang 已提交
1853
	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
1854
		tun = rtnl_dereference(tfile->tun);
1855
		if (!tun || !(tun->flags & TUN_TAP_MQ) || tfile->detached)
J
Jason Wang 已提交
1856 1857 1858 1859
			ret = -EINVAL;
		else
			__tun_detach(tfile, false);
	} else
1860 1861
		ret = -EINVAL;

1862
unlock:
1863 1864 1865 1866
	rtnl_unlock();
	return ret;
}

1867 1868
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg, int ifreq_len)
L
Linus Torvalds 已提交
1869
{
E
Eric W. Biederman 已提交
1870
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1871
	struct tun_struct *tun;
L
Linus Torvalds 已提交
1872 1873
	void __user* argp = (void __user*)arg;
	struct ifreq ifr;
1874 1875
	kuid_t owner;
	kgid_t group;
1876
	int sndbuf;
1877
	int vnet_hdr_sz;
1878
	unsigned int ifindex;
1879
	int ret;
L
Linus Torvalds 已提交
1880

1881
	if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
1882
		if (copy_from_user(&ifr, argp, ifreq_len))
L
Linus Torvalds 已提交
1883
			return -EFAULT;
D
David S. Miller 已提交
1884
	} else {
1885
		memset(&ifr, 0, sizeof(ifr));
D
David S. Miller 已提交
1886
	}
E
Eric W. Biederman 已提交
1887 1888 1889 1890 1891
	if (cmd == TUNGETFEATURES) {
		/* Currently this just means: "what IFF flags are valid?".
		 * This is needed because we never checked for invalid flags on
		 * TUNSETIFF. */
		return put_user(IFF_TUN | IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE |
1892
				IFF_VNET_HDR | IFF_MULTI_QUEUE,
E
Eric W. Biederman 已提交
1893
				(unsigned int __user*)argp);
1894 1895
	} else if (cmd == TUNSETQUEUE)
		return tun_set_queue(file, &ifr);
E
Eric W. Biederman 已提交
1896

J
Jason Wang 已提交
1897
	ret = 0;
1898 1899
	rtnl_lock();

E
Eric W. Biederman 已提交
1900
	tun = __tun_get(tfile);
L
Linus Torvalds 已提交
1901 1902 1903
	if (cmd == TUNSETIFF && !tun) {
		ifr.ifr_name[IFNAMSIZ-1] = '\0';

1904
		ret = tun_set_iff(tfile->net, file, &ifr);
L
Linus Torvalds 已提交
1905

1906 1907
		if (ret)
			goto unlock;
L
Linus Torvalds 已提交
1908

1909
		if (copy_to_user(argp, &ifr, ifreq_len))
1910 1911
			ret = -EFAULT;
		goto unlock;
L
Linus Torvalds 已提交
1912
	}
1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925
	if (cmd == TUNSETIFINDEX) {
		ret = -EPERM;
		if (tun)
			goto unlock;

		ret = -EFAULT;
		if (copy_from_user(&ifindex, argp, sizeof(ifindex)))
			goto unlock;

		ret = 0;
		tfile->ifindex = ifindex;
		goto unlock;
	}
L
Linus Torvalds 已提交
1926

1927
	ret = -EBADFD;
L
Linus Torvalds 已提交
1928
	if (!tun)
1929
		goto unlock;
L
Linus Torvalds 已提交
1930

1931
	tun_debug(KERN_INFO, tun, "tun_chr_ioctl cmd %u\n", cmd);
L
Linus Torvalds 已提交
1932

E
Eric W. Biederman 已提交
1933
	ret = 0;
L
Linus Torvalds 已提交
1934
	switch (cmd) {
1935
	case TUNGETIFF:
R
Rami Rosen 已提交
1936
		tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
1937

1938 1939
		if (tfile->detached)
			ifr.ifr_flags |= IFF_DETACH_QUEUE;
1940 1941
		if (!tfile->socket.sk->sk_filter)
			ifr.ifr_flags |= IFF_NOFILTER;
1942

1943
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1944
			ret = -EFAULT;
1945 1946
		break;

L
Linus Torvalds 已提交
1947 1948 1949
	case TUNSETNOCSUM:
		/* Disable/Enable checksum */

1950 1951
		/* [unimplemented] */
		tun_debug(KERN_INFO, tun, "ignored: set checksum %s\n",
1952
			  arg ? "disabled" : "enabled");
L
Linus Torvalds 已提交
1953 1954 1955
		break;

	case TUNSETPERSIST:
J
Jason Wang 已提交
1956 1957 1958
		/* Disable/Enable persist mode. Keep an extra reference to the
		 * module to prevent the module being unprobed.
		 */
J
Jason Wang 已提交
1959
		if (arg && !(tun->flags & TUN_PERSIST)) {
L
Linus Torvalds 已提交
1960
			tun->flags |= TUN_PERSIST;
J
Jason Wang 已提交
1961
			__module_get(THIS_MODULE);
J
Jason Wang 已提交
1962 1963
		}
		if (!arg && (tun->flags & TUN_PERSIST)) {
L
Linus Torvalds 已提交
1964
			tun->flags &= ~TUN_PERSIST;
J
Jason Wang 已提交
1965 1966
			module_put(THIS_MODULE);
		}
L
Linus Torvalds 已提交
1967

1968 1969
		tun_debug(KERN_INFO, tun, "persist %s\n",
			  arg ? "enabled" : "disabled");
L
Linus Torvalds 已提交
1970 1971 1972 1973
		break;

	case TUNSETOWNER:
		/* Set owner of the device */
1974 1975 1976 1977 1978 1979
		owner = make_kuid(current_user_ns(), arg);
		if (!uid_valid(owner)) {
			ret = -EINVAL;
			break;
		}
		tun->owner = owner;
1980
		tun_debug(KERN_INFO, tun, "owner set to %u\n",
1981
			  from_kuid(&init_user_ns, tun->owner));
L
Linus Torvalds 已提交
1982 1983
		break;

1984 1985
	case TUNSETGROUP:
		/* Set group of the device */
1986 1987 1988 1989 1990 1991
		group = make_kgid(current_user_ns(), arg);
		if (!gid_valid(group)) {
			ret = -EINVAL;
			break;
		}
		tun->group = group;
1992
		tun_debug(KERN_INFO, tun, "group set to %u\n",
1993
			  from_kgid(&init_user_ns, tun->group));
1994 1995
		break;

1996 1997 1998
	case TUNSETLINK:
		/* Only allow setting the type when the interface is down */
		if (tun->dev->flags & IFF_UP) {
1999 2000
			tun_debug(KERN_INFO, tun,
				  "Linktype set failed because interface is up\n");
2001
			ret = -EBUSY;
2002 2003
		} else {
			tun->dev->type = (int) arg;
2004 2005
			tun_debug(KERN_INFO, tun, "linktype set to %d\n",
				  tun->dev->type);
2006
			ret = 0;
2007
		}
E
Eric W. Biederman 已提交
2008
		break;
2009

L
Linus Torvalds 已提交
2010 2011 2012 2013 2014
#ifdef TUN_DEBUG
	case TUNSETDEBUG:
		tun->debug = arg;
		break;
#endif
2015
	case TUNSETOFFLOAD:
2016
		ret = set_offload(tun, arg);
E
Eric W. Biederman 已提交
2017
		break;
2018

2019 2020
	case TUNSETTXFILTER:
		/* Can be set only for TAPs */
E
Eric W. Biederman 已提交
2021
		ret = -EINVAL;
2022
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
E
Eric W. Biederman 已提交
2023
			break;
H
Harvey Harrison 已提交
2024
		ret = update_filter(&tun->txflt, (void __user *)arg);
E
Eric W. Biederman 已提交
2025
		break;
L
Linus Torvalds 已提交
2026 2027

	case SIOCGIFHWADDR:
2028
		/* Get hw address */
2029 2030
		memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN);
		ifr.ifr_hwaddr.sa_family = tun->dev->type;
2031
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
2032 2033
			ret = -EFAULT;
		break;
L
Linus Torvalds 已提交
2034 2035

	case SIOCSIFHWADDR:
2036
		/* Set hw address */
2037 2038
		tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n",
			  ifr.ifr_hwaddr.sa_data);
2039 2040

		ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
E
Eric W. Biederman 已提交
2041
		break;
2042 2043

	case TUNGETSNDBUF:
J
Jason Wang 已提交
2044
		sndbuf = tfile->socket.sk->sk_sndbuf;
2045 2046 2047 2048 2049 2050 2051 2052 2053 2054
		if (copy_to_user(argp, &sndbuf, sizeof(sndbuf)))
			ret = -EFAULT;
		break;

	case TUNSETSNDBUF:
		if (copy_from_user(&sndbuf, argp, sizeof(sndbuf))) {
			ret = -EFAULT;
			break;
		}

J
Jason Wang 已提交
2055 2056
		tun->sndbuf = sndbuf;
		tun_set_sndbuf(tun);
2057 2058
		break;

2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077
	case TUNGETVNETHDRSZ:
		vnet_hdr_sz = tun->vnet_hdr_sz;
		if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
			ret = -EFAULT;
		break;

	case TUNSETVNETHDRSZ:
		if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
			ret = -EFAULT;
			break;
		}
		if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
			ret = -EINVAL;
			break;
		}

		tun->vnet_hdr_sz = vnet_hdr_sz;
		break;

M
Michael S. Tsirkin 已提交
2078 2079 2080 2081 2082 2083
	case TUNATTACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
		ret = -EFAULT;
J
Jason Wang 已提交
2084
		if (copy_from_user(&tun->fprog, argp, sizeof(tun->fprog)))
M
Michael S. Tsirkin 已提交
2085 2086
			break;

J
Jason Wang 已提交
2087
		ret = tun_attach_filter(tun);
M
Michael S. Tsirkin 已提交
2088 2089 2090 2091 2092 2093 2094
		break;

	case TUNDETACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
J
Jason Wang 已提交
2095 2096
		ret = 0;
		tun_detach_filter(tun, tun->numqueues);
M
Michael S. Tsirkin 已提交
2097 2098
		break;

P
Pavel Emelyanov 已提交
2099 2100 2101 2102 2103 2104 2105 2106 2107 2108
	case TUNGETFILTER:
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
		ret = -EFAULT;
		if (copy_to_user(argp, &tun->fprog, sizeof(tun->fprog)))
			break;
		ret = 0;
		break;

L
Linus Torvalds 已提交
2109
	default:
E
Eric W. Biederman 已提交
2110 2111
		ret = -EINVAL;
		break;
2112
	}
L
Linus Torvalds 已提交
2113

2114 2115 2116 2117
unlock:
	rtnl_unlock();
	if (tun)
		tun_put(tun);
E
Eric W. Biederman 已提交
2118
	return ret;
L
Linus Torvalds 已提交
2119 2120
}

2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153 2154 2155
static long tun_chr_ioctl(struct file *file,
			  unsigned int cmd, unsigned long arg)
{
	return __tun_chr_ioctl(file, cmd, arg, sizeof (struct ifreq));
}

#ifdef CONFIG_COMPAT
static long tun_chr_compat_ioctl(struct file *file,
			 unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case TUNSETIFF:
	case TUNGETIFF:
	case TUNSETTXFILTER:
	case TUNGETSNDBUF:
	case TUNSETSNDBUF:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
		arg = (unsigned long)compat_ptr(arg);
		break;
	default:
		arg = (compat_ulong_t)arg;
		break;
	}

	/*
	 * compat_ifreq is shorter than ifreq, so we must not access beyond
	 * the end of that structure. All fields that are used in this
	 * driver are compatible though, we don't need to convert the
	 * contents.
	 */
	return __tun_chr_ioctl(file, cmd, arg, sizeof(struct compat_ifreq));
}
#endif /* CONFIG_COMPAT */

L
Linus Torvalds 已提交
2156 2157
static int tun_chr_fasync(int fd, struct file *file, int on)
{
J
Jason Wang 已提交
2158
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
2159 2160
	int ret;

J
Jason Wang 已提交
2161
	if ((ret = fasync_helper(fd, file, on, &tfile->fasync)) < 0)
J
Jonathan Corbet 已提交
2162
		goto out;
2163

L
Linus Torvalds 已提交
2164
	if (on) {
2165
		__f_setown(file, task_pid(current), PIDTYPE_PID, 0);
J
Jason Wang 已提交
2166
		tfile->flags |= TUN_FASYNC;
2167
	} else
J
Jason Wang 已提交
2168
		tfile->flags &= ~TUN_FASYNC;
J
Jonathan Corbet 已提交
2169 2170 2171
	ret = 0;
out:
	return ret;
L
Linus Torvalds 已提交
2172 2173 2174 2175
}

static int tun_chr_open(struct inode *inode, struct file * file)
{
E
Eric W. Biederman 已提交
2176
	struct tun_file *tfile;
T
Thomas Gleixner 已提交
2177

2178
	DBG1(KERN_INFO, "tunX: tun_chr_open\n");
E
Eric W. Biederman 已提交
2179

J
Jason Wang 已提交
2180 2181
	tfile = (struct tun_file *)sk_alloc(&init_net, AF_UNSPEC, GFP_KERNEL,
					    &tun_proto);
E
Eric W. Biederman 已提交
2182 2183
	if (!tfile)
		return -ENOMEM;
2184
	RCU_INIT_POINTER(tfile->tun, NULL);
E
Eric W. Biederman 已提交
2185
	tfile->net = get_net(current->nsproxy->net_ns);
J
Jason Wang 已提交
2186
	tfile->flags = 0;
2187
	tfile->ifindex = 0;
J
Jason Wang 已提交
2188 2189

	init_waitqueue_head(&tfile->wq.wait);
2190
	RCU_INIT_POINTER(tfile->socket.wq, &tfile->wq);
J
Jason Wang 已提交
2191 2192 2193 2194 2195 2196 2197 2198 2199 2200

	tfile->socket.file = file;
	tfile->socket.ops = &tun_socket_ops;

	sock_init_data(&tfile->socket, &tfile->sk);
	sk_change_net(&tfile->sk, tfile->net);

	tfile->sk.sk_write_space = tun_sock_write_space;
	tfile->sk.sk_sndbuf = INT_MAX;

E
Eric W. Biederman 已提交
2201
	file->private_data = tfile;
J
Jason Wang 已提交
2202
	set_bit(SOCK_EXTERNALLY_ALLOCATED, &tfile->socket.flags);
J
Jason Wang 已提交
2203
	INIT_LIST_HEAD(&tfile->next);
J
Jason Wang 已提交
2204

2205 2206
	sock_set_flag(&tfile->sk, SOCK_ZEROCOPY);

L
Linus Torvalds 已提交
2207 2208 2209 2210 2211
	return 0;
}

static int tun_chr_close(struct inode *inode, struct file *file)
{
E
Eric W. Biederman 已提交
2212
	struct tun_file *tfile = file->private_data;
J
Jason Wang 已提交
2213
	struct net *net = tfile->net;
L
Linus Torvalds 已提交
2214

J
Jason Wang 已提交
2215
	tun_detach(tfile, true);
J
Jason Wang 已提交
2216
	put_net(net);
L
Linus Torvalds 已提交
2217 2218 2219 2220

	return 0;
}

2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241
#ifdef CONFIG_PROC_FS
static int tun_chr_show_fdinfo(struct seq_file *m, struct file *f)
{
	struct tun_struct *tun;
	struct ifreq ifr;

	memset(&ifr, 0, sizeof(ifr));

	rtnl_lock();
	tun = tun_get(f);
	if (tun)
		tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
	rtnl_unlock();

	if (tun)
		tun_put(tun);

	return seq_printf(m, "iff:\t%s\n", ifr.ifr_name);
}
#endif

2242
static const struct file_operations tun_fops = {
2243
	.owner	= THIS_MODULE,
L
Linus Torvalds 已提交
2244
	.llseek = no_llseek,
2245 2246 2247 2248
	.read  = do_sync_read,
	.aio_read  = tun_chr_aio_read,
	.write = do_sync_write,
	.aio_write = tun_chr_aio_write,
L
Linus Torvalds 已提交
2249
	.poll	= tun_chr_poll,
2250 2251 2252 2253
	.unlocked_ioctl	= tun_chr_ioctl,
#ifdef CONFIG_COMPAT
	.compat_ioctl = tun_chr_compat_ioctl,
#endif
L
Linus Torvalds 已提交
2254 2255
	.open	= tun_chr_open,
	.release = tun_chr_close,
2256 2257 2258 2259
	.fasync = tun_chr_fasync,
#ifdef CONFIG_PROC_FS
	.show_fdinfo = tun_chr_show_fdinfo,
#endif
L
Linus Torvalds 已提交
2260 2261 2262 2263 2264
};

static struct miscdevice tun_miscdev = {
	.minor = TUN_MINOR,
	.name = "tun",
2265
	.nodename = "net/tun",
L
Linus Torvalds 已提交
2266 2267 2268 2269 2270 2271 2272 2273 2274
	.fops = &tun_fops,
};

/* ethtool interface */

static int tun_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
	cmd->supported		= 0;
	cmd->advertising	= 0;
2275
	ethtool_cmd_speed_set(cmd, SPEED_10);
L
Linus Torvalds 已提交
2276 2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289
	cmd->duplex		= DUPLEX_FULL;
	cmd->port		= PORT_TP;
	cmd->phy_address	= 0;
	cmd->transceiver	= XCVR_INTERNAL;
	cmd->autoneg		= AUTONEG_DISABLE;
	cmd->maxtxpkt		= 0;
	cmd->maxrxpkt		= 0;
	return 0;
}

static void tun_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
{
	struct tun_struct *tun = netdev_priv(dev);

2290 2291
	strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
	strlcpy(info->version, DRV_VERSION, sizeof(info->version));
L
Linus Torvalds 已提交
2292 2293 2294

	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
2295
		strlcpy(info->bus_info, "tun", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2296 2297
		break;
	case TUN_TAP_DEV:
2298
		strlcpy(info->bus_info, "tap", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320
		break;
	}
}

static u32 tun_get_msglevel(struct net_device *dev)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	return tun->debug;
#else
	return -EOPNOTSUPP;
#endif
}

static void tun_set_msglevel(struct net_device *dev, u32 value)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	tun->debug = value;
#endif
}

2321
static const struct ethtool_ops tun_ethtool_ops = {
L
Linus Torvalds 已提交
2322 2323 2324 2325
	.get_settings	= tun_get_settings,
	.get_drvinfo	= tun_get_drvinfo,
	.get_msglevel	= tun_get_msglevel,
	.set_msglevel	= tun_set_msglevel,
2326
	.get_link	= ethtool_op_get_link,
2327
	.get_ts_info	= ethtool_op_get_ts_info,
L
Linus Torvalds 已提交
2328 2329
};

2330

L
Linus Torvalds 已提交
2331 2332 2333 2334
static int __init tun_init(void)
{
	int ret = 0;

2335 2336
	pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
	pr_info("%s\n", DRV_COPYRIGHT);
L
Linus Torvalds 已提交
2337

2338
	ret = rtnl_link_register(&tun_link_ops);
2339
	if (ret) {
2340
		pr_err("Can't register link_ops\n");
2341
		goto err_linkops;
2342 2343
	}

L
Linus Torvalds 已提交
2344
	ret = misc_register(&tun_miscdev);
2345
	if (ret) {
2346
		pr_err("Can't register misc device %d\n", TUN_MINOR);
2347 2348
		goto err_misc;
	}
2349
	return  0;
2350
err_misc:
2351 2352
	rtnl_link_unregister(&tun_link_ops);
err_linkops:
L
Linus Torvalds 已提交
2353 2354 2355 2356 2357
	return ret;
}

static void tun_cleanup(void)
{
2358
	misc_deregister(&tun_miscdev);
2359
	rtnl_link_unregister(&tun_link_ops);
L
Linus Torvalds 已提交
2360 2361
}

2362 2363 2364 2365 2366 2367
/* Get an underlying socket object from tun file.  Returns error unless file is
 * attached to a device.  The returned object works like a packet socket, it
 * can be used for sock_sendmsg/sock_recvmsg.  The caller is responsible for
 * holding a reference to the file for as long as the socket is in use. */
struct socket *tun_get_socket(struct file *file)
{
2368
	struct tun_file *tfile;
2369 2370
	if (file->f_op != &tun_fops)
		return ERR_PTR(-EINVAL);
2371 2372
	tfile = file->private_data;
	if (!tfile)
2373
		return ERR_PTR(-EBADFD);
J
Jason Wang 已提交
2374
	return &tfile->socket;
2375 2376 2377
}
EXPORT_SYMBOL_GPL(tun_get_socket);

L
Linus Torvalds 已提交
2378 2379 2380 2381 2382 2383
module_init(tun_init);
module_exit(tun_cleanup);
MODULE_DESCRIPTION(DRV_DESCRIPTION);
MODULE_AUTHOR(DRV_COPYRIGHT);
MODULE_LICENSE("GPL");
MODULE_ALIAS_MISCDEV(TUN_MINOR);
2384
MODULE_ALIAS("devname:net/tun");