tun.c 53.5 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
/*
 *  TUN - Universal TUN/TAP device driver.
 *  Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 *  GNU General Public License for more details.
 *
 *  $Id: tun.c,v 1.15 2002/03/01 02:44:24 maxk Exp $
 */

/*
 *  Changes:
 *
21 22 23
 *  Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14
 *    Add TUNSETLINK ioctl to set the link encapsulation
 *
L
Linus Torvalds 已提交
24
 *  Mark Smith <markzzzsmith@yahoo.com.au>
J
Joe Perches 已提交
25
 *    Use eth_random_addr() for tap MAC address.
L
Linus Torvalds 已提交
26 27 28 29 30 31 32 33 34 35 36
 *
 *  Harald Roelle <harald.roelle@ifi.lmu.de>  2004/04/20
 *    Fixes in packet dropping, queue length setting and queue wakeup.
 *    Increased default tx queue length.
 *    Added ethtool API.
 *    Minor cleanups
 *
 *  Daniel Podlejski <underley@underley.eu.org>
 *    Modifications for 2.3.99-pre5 kernel.
 */

37 38
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
#define DRV_NAME	"tun"
#define DRV_VERSION	"1.6"
#define DRV_DESCRIPTION	"Universal TUN/TAP device driver"
#define DRV_COPYRIGHT	"(C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>"

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/miscdevice.h>
#include <linux/ethtool.h>
#include <linux/rtnetlink.h>
58
#include <linux/compat.h>
L
Linus Torvalds 已提交
59 60 61 62 63
#include <linux/if.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/crc32.h>
64
#include <linux/nsproxy.h>
65
#include <linux/virtio_net.h>
M
Michael S. Tsirkin 已提交
66
#include <linux/rcupdate.h>
67
#include <net/net_namespace.h>
68
#include <net/netns/generic.h>
69
#include <net/rtnetlink.h>
70
#include <net/sock.h>
L
Linus Torvalds 已提交
71 72 73

#include <asm/uaccess.h>

74 75 76
/* Uncomment to enable debugging */
/* #define TUN_DEBUG 1 */

L
Linus Torvalds 已提交
77 78
#ifdef TUN_DEBUG
static int debug;
79

80 81 82 83 84 85 86 87 88 89
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (tun->debug)						\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (debug == 2)						\
		printk(level fmt, ##args);			\
} while (0)
90
#else
91 92 93 94 95 96 97 98 99 100
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (0)							\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (0)							\
		printk(level fmt, ##args);			\
} while (0)
101 102
#endif

103 104
#define GOODCOPY_LEN 128

105 106 107 108 109 110 111
#define FLT_EXACT_COUNT 8
struct tap_filter {
	unsigned int    count;    /* Number of addrs. Zero means disabled */
	u32             mask[2];  /* Mask of the hashed addrs */
	unsigned char	addr[FLT_EXACT_COUNT][ETH_ALEN];
};

112 113 114 115
/* DEFAULT_MAX_NUM_RSS_QUEUES were choosed to let the rx/tx queues allocated for
 * the netdevice to be fit in one page. So we can make sure the success of
 * memory allocation. TODO: increase the limit. */
#define MAX_TAP_QUEUES DEFAULT_MAX_NUM_RSS_QUEUES
116
#define MAX_TAP_FLOWS  4096
J
Jason Wang 已提交
117

J
Jason Wang 已提交
118 119
#define TUN_FLOW_EXPIRE (3 * HZ)

J
Jason Wang 已提交
120 121 122 123
/* A tun_file connects an open character device to a tuntap netdevice. It
 * also contains all socket related strctures (except sock_fprog and tap_filter)
 * to serve as one transmit queue for tuntap device. The sock_fprog and
 * tap_filter were kept in tun_struct since they were used for filtering for the
R
Rami Rosen 已提交
124
 * netdevice not for a specific queue (at least I didn't see the requirement for
J
Jason Wang 已提交
125
 * this).
126 127
 *
 * RCU usage:
R
Rami Rosen 已提交
128
 * The tun_file and tun_struct are loosely coupled, the pointer from one to the
129
 * other can only be read while rcu_read_lock or rtnl_lock is held.
J
Jason Wang 已提交
130
 */
E
Eric W. Biederman 已提交
131
struct tun_file {
J
Jason Wang 已提交
132 133 134
	struct sock sk;
	struct socket socket;
	struct socket_wq wq;
135
	struct tun_struct __rcu *tun;
E
Eric W. Biederman 已提交
136
	struct net *net;
J
Jason Wang 已提交
137 138 139
	struct fasync_struct *fasync;
	/* only used for fasnyc */
	unsigned int flags;
J
Jason Wang 已提交
140
	u16 queue_index;
J
Jason Wang 已提交
141 142
	struct list_head next;
	struct tun_struct *detached;
E
Eric W. Biederman 已提交
143 144
};

J
Jason Wang 已提交
145 146 147 148 149 150 151 152 153 154 155 156
struct tun_flow_entry {
	struct hlist_node hash_link;
	struct rcu_head rcu;
	struct tun_struct *tun;

	u32 rxhash;
	int queue_index;
	unsigned long updated;
};

#define TUN_NUM_FLOW_ENTRIES 1024

J
Jason Wang 已提交
157
/* Since the socket were moved to tun_file, to preserve the behavior of persist
R
Rami Rosen 已提交
158
 * device, socket filter, sndbuf and vnet header size were restore when the
J
Jason Wang 已提交
159 160
 * file were attached to a persist device.
 */
161
struct tun_struct {
J
Jason Wang 已提交
162 163
	struct tun_file __rcu	*tfiles[MAX_TAP_QUEUES];
	unsigned int            numqueues;
164
	unsigned int 		flags;
165 166
	kuid_t			owner;
	kgid_t			group;
167 168

	struct net_device	*dev;
169
	netdev_features_t	set_features;
170 171
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
			  NETIF_F_TSO6|NETIF_F_UFO)
172 173

	int			vnet_hdr_sz;
J
Jason Wang 已提交
174 175 176 177 178
	int			sndbuf;
	struct tap_filter	txflt;
	struct sock_fprog	fprog;
	/* protected by rtnl lock */
	bool			filter_attached;
179 180
#ifdef TUN_DEBUG
	int debug;
L
Linus Torvalds 已提交
181
#endif
J
Jason Wang 已提交
182 183 184 185
	spinlock_t lock;
	struct hlist_head flows[TUN_NUM_FLOW_ENTRIES];
	struct timer_list flow_gc_timer;
	unsigned long ageing_time;
J
Jason Wang 已提交
186 187
	unsigned int numdisabled;
	struct list_head disabled;
188
	void *security;
189
	u32 flow_count;
190
};
L
Linus Torvalds 已提交
191

J
Jason Wang 已提交
192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212
static inline u32 tun_hashfn(u32 rxhash)
{
	return rxhash & 0x3ff;
}

static struct tun_flow_entry *tun_flow_find(struct hlist_head *head, u32 rxhash)
{
	struct tun_flow_entry *e;
	struct hlist_node *n;

	hlist_for_each_entry_rcu(e, n, head, hash_link) {
		if (e->rxhash == rxhash)
			return e;
	}
	return NULL;
}

static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
					      struct hlist_head *head,
					      u32 rxhash, u16 queue_index)
{
213 214
	struct tun_flow_entry *e = kmalloc(sizeof(*e), GFP_ATOMIC);

J
Jason Wang 已提交
215 216 217 218 219 220 221 222
	if (e) {
		tun_debug(KERN_INFO, tun, "create flow: hash %u index %u\n",
			  rxhash, queue_index);
		e->updated = jiffies;
		e->rxhash = rxhash;
		e->queue_index = queue_index;
		e->tun = tun;
		hlist_add_head_rcu(&e->hash_link, head);
223
		++tun->flow_count;
J
Jason Wang 已提交
224 225 226 227 228 229 230 231 232
	}
	return e;
}

static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
{
	tun_debug(KERN_INFO, tun, "delete flow: hash %u index %u\n",
		  e->rxhash, e->queue_index);
	hlist_del_rcu(&e->hash_link);
233
	kfree_rcu(e, rcu);
234
	--tun->flow_count;
J
Jason Wang 已提交
235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299
}

static void tun_flow_flush(struct tun_struct *tun)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
		struct hlist_node *h, *n;

		hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link)
			tun_flow_delete(tun, e);
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_delete_by_queue(struct tun_struct *tun, u16 queue_index)
{
	int i;

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
		struct hlist_node *h, *n;

		hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link) {
			if (e->queue_index == queue_index)
				tun_flow_delete(tun, e);
		}
	}
	spin_unlock_bh(&tun->lock);
}

static void tun_flow_cleanup(unsigned long data)
{
	struct tun_struct *tun = (struct tun_struct *)data;
	unsigned long delay = tun->ageing_time;
	unsigned long next_timer = jiffies + delay;
	unsigned long count = 0;
	int i;

	tun_debug(KERN_INFO, tun, "tun_flow_cleanup\n");

	spin_lock_bh(&tun->lock);
	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) {
		struct tun_flow_entry *e;
		struct hlist_node *h, *n;

		hlist_for_each_entry_safe(e, h, n, &tun->flows[i], hash_link) {
			unsigned long this_timer;
			count++;
			this_timer = e->updated + delay;
			if (time_before_eq(this_timer, jiffies))
				tun_flow_delete(tun, e);
			else if (time_before(this_timer, next_timer))
				next_timer = this_timer;
		}
	}

	if (count)
		mod_timer(&tun->flow_gc_timer, round_jiffies_up(next_timer));
	spin_unlock_bh(&tun->lock);
}

300
static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
J
Jason Wang 已提交
301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323
			    u16 queue_index)
{
	struct hlist_head *head;
	struct tun_flow_entry *e;
	unsigned long delay = tun->ageing_time;

	if (!rxhash)
		return;
	else
		head = &tun->flows[tun_hashfn(rxhash)];

	rcu_read_lock();

	if (tun->numqueues == 1)
		goto unlock;

	e = tun_flow_find(head, rxhash);
	if (likely(e)) {
		/* TODO: keep queueing to old queue until it's empty? */
		e->queue_index = queue_index;
		e->updated = jiffies;
	} else {
		spin_lock_bh(&tun->lock);
324 325
		if (!tun_flow_find(head, rxhash) &&
		    tun->flow_count < MAX_TAP_FLOWS)
J
Jason Wang 已提交
326 327 328 329 330 331 332 333 334 335 336 337
			tun_flow_create(tun, head, rxhash, queue_index);

		if (!timer_pending(&tun->flow_gc_timer))
			mod_timer(&tun->flow_gc_timer,
				  round_jiffies_up(jiffies + delay));
		spin_unlock_bh(&tun->lock);
	}

unlock:
	rcu_read_unlock();
}

J
Jason Wang 已提交
338 339 340 341 342 343 344 345 346 347
/* We try to identify a flow through its rxhash first. The reason that
 * we do not check rxq no. is becuase some cards(e.g 82599), chooses
 * the rxq based on the txq where the last packet of the flow comes. As
 * the userspace application move between processors, we may get a
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
348
	struct tun_flow_entry *e;
J
Jason Wang 已提交
349 350 351 352 353 354 355 356
	u32 txq = 0;
	u32 numqueues = 0;

	rcu_read_lock();
	numqueues = tun->numqueues;

	txq = skb_get_rxhash(skb);
	if (txq) {
J
Jason Wang 已提交
357 358 359 360 361 362
		e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq);
		if (e)
			txq = e->queue_index;
		else
			/* use multiply and shift instead of expensive divide */
			txq = ((u64)txq * numqueues) >> 32;
J
Jason Wang 已提交
363 364 365 366 367 368 369 370 371 372
	} else if (likely(skb_rx_queue_recorded(skb))) {
		txq = skb_get_rx_queue(skb);
		while (unlikely(txq >= numqueues))
			txq -= numqueues;
	}

	rcu_read_unlock();
	return txq;
}

373 374 375
static inline bool tun_not_capable(struct tun_struct *tun)
{
	const struct cred *cred = current_cred();
376
	struct net *net = dev_net(tun->dev);
377 378 379

	return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) ||
		  (gid_valid(tun->group) && !in_egroup_p(tun->group))) &&
380
		!ns_capable(net->user_ns, CAP_NET_ADMIN);
381 382
}

J
Jason Wang 已提交
383 384 385 386 387 388
static void tun_set_real_num_queues(struct tun_struct *tun)
{
	netif_set_real_num_tx_queues(tun->dev, tun->numqueues);
	netif_set_real_num_rx_queues(tun->dev, tun->numqueues);
}

J
Jason Wang 已提交
389 390 391 392 393 394 395
static void tun_disable_queue(struct tun_struct *tun, struct tun_file *tfile)
{
	tfile->detached = tun;
	list_add_tail(&tfile->next, &tun->disabled);
	++tun->numdisabled;
}

J
Jason Wang 已提交
396
static struct tun_struct *tun_enable_queue(struct tun_file *tfile)
J
Jason Wang 已提交
397 398 399 400 401 402 403 404 405
{
	struct tun_struct *tun = tfile->detached;

	tfile->detached = NULL;
	list_del_init(&tfile->next);
	--tun->numdisabled;
	return tun;
}

J
Jason Wang 已提交
406 407 408 409 410 411
static void __tun_detach(struct tun_file *tfile, bool clean)
{
	struct tun_file *ntfile;
	struct tun_struct *tun;
	struct net_device *dev;

412 413
	tun = rtnl_dereference(tfile->tun);

J
Jason Wang 已提交
414 415 416 417 418 419 420 421
	if (tun) {
		u16 index = tfile->queue_index;
		BUG_ON(index >= tun->numqueues);
		dev = tun->dev;

		rcu_assign_pointer(tun->tfiles[index],
				   tun->tfiles[tun->numqueues - 1]);
		rcu_assign_pointer(tfile->tun, NULL);
422
		ntfile = rtnl_dereference(tun->tfiles[index]);
J
Jason Wang 已提交
423 424 425
		ntfile->queue_index = index;

		--tun->numqueues;
J
Jason Wang 已提交
426 427 428 429
		if (clean)
			sock_put(&tfile->sk);
		else
			tun_disable_queue(tun, tfile);
J
Jason Wang 已提交
430 431

		synchronize_net();
J
Jason Wang 已提交
432
		tun_flow_delete_by_queue(tun, tun->numqueues + 1);
J
Jason Wang 已提交
433 434 435
		/* Drop read queue */
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		tun_set_real_num_queues(tun);
J
Jason Wang 已提交
436
	} else if (tfile->detached && clean) {
J
Jason Wang 已提交
437
		tun = tun_enable_queue(tfile);
J
Jason Wang 已提交
438 439
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
440 441

	if (clean) {
J
Jason Wang 已提交
442 443 444 445 446
		if (tun && tun->numqueues == 0 && tun->numdisabled == 0 &&
		    !(tun->flags & TUN_PERSIST))
			if (tun->dev->reg_state == NETREG_REGISTERED)
				unregister_netdevice(tun->dev);

J
Jason Wang 已提交
447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462
		BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
				 &tfile->socket.flags));
		sk_release_kernel(&tfile->sk);
	}
}

static void tun_detach(struct tun_file *tfile, bool clean)
{
	rtnl_lock();
	__tun_detach(tfile, clean);
	rtnl_unlock();
}

static void tun_detach_all(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
463
	struct tun_file *tfile, *tmp;
J
Jason Wang 已提交
464 465 466
	int i, n = tun->numqueues;

	for (i = 0; i < n; i++) {
467
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
468 469 470 471 472 473 474 475 476
		BUG_ON(!tfile);
		wake_up_all(&tfile->wq.wait);
		rcu_assign_pointer(tfile->tun, NULL);
		--tun->numqueues;
	}
	BUG_ON(tun->numqueues != 0);

	synchronize_net();
	for (i = 0; i < n; i++) {
477
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
478 479 480 481
		/* Drop read queue */
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		sock_put(&tfile->sk);
	}
J
Jason Wang 已提交
482 483 484 485 486 487
	list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) {
		tun_enable_queue(tfile);
		skb_queue_purge(&tfile->sk.sk_receive_queue);
		sock_put(&tfile->sk);
	}
	BUG_ON(tun->numdisabled != 0);
J
Jason Wang 已提交
488 489 490

	if (tun->flags & TUN_PERSIST)
		module_put(THIS_MODULE);
J
Jason Wang 已提交
491 492
}

493 494
static int tun_attach(struct tun_struct *tun, struct file *file)
{
E
Eric W. Biederman 已提交
495
	struct tun_file *tfile = file->private_data;
496
	int err;
497

498 499 500 501
	err = security_tun_dev_attach(tfile->socket.sk, tun->security);
	if (err < 0)
		goto out;

502
	err = -EINVAL;
503
	if (rtnl_dereference(tfile->tun))
504 505 506
		goto out;

	err = -EBUSY;
J
Jason Wang 已提交
507 508 509 510
	if (!(tun->flags & TUN_TAP_MQ) && tun->numqueues == 1)
		goto out;

	err = -E2BIG;
J
Jason Wang 已提交
511 512
	if (!tfile->detached &&
	    tun->numqueues + tun->numdisabled == MAX_TAP_QUEUES)
513 514 515
		goto out;

	err = 0;
J
Jason Wang 已提交
516

J
Jason Wang 已提交
517
	/* Re-attach the filter to presist device */
J
Jason Wang 已提交
518 519 520 521 522
	if (tun->filter_attached == true) {
		err = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (!err)
			goto out;
	}
J
Jason Wang 已提交
523
	tfile->queue_index = tun->numqueues;
524
	rcu_assign_pointer(tfile->tun, tun);
J
Jason Wang 已提交
525 526
	rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile);
	tun->numqueues++;
527

J
Jason Wang 已提交
528 529 530 531 532
	if (tfile->detached)
		tun_enable_queue(tfile);
	else
		sock_hold(&tfile->sk);

J
Jason Wang 已提交
533
	tun_set_real_num_queues(tun);
534

J
Jason Wang 已提交
535 536 537 538 539 540
	/* device is allowed to go away first, so no need to hold extra
	 * refcnt.
	 */

out:
	return err;
E
Eric W. Biederman 已提交
541 542 543 544
}

static struct tun_struct *__tun_get(struct tun_file *tfile)
{
545
	struct tun_struct *tun;
546

547 548 549 550 551
	rcu_read_lock();
	tun = rcu_dereference(tfile->tun);
	if (tun)
		dev_hold(tun->dev);
	rcu_read_unlock();
552 553

	return tun;
E
Eric W. Biederman 已提交
554 555 556 557 558 559 560 561 562
}

static struct tun_struct *tun_get(struct file *file)
{
	return __tun_get(file->private_data);
}

static void tun_put(struct tun_struct *tun)
{
563
	dev_put(tun->dev);
E
Eric W. Biederman 已提交
564 565
}

566
/* TAP filtering */
567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615
static void addr_hash_set(u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	mask[n >> 5] |= (1 << (n & 31));
}

static unsigned int addr_hash_test(const u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	return mask[n >> 5] & (1 << (n & 31));
}

static int update_filter(struct tap_filter *filter, void __user *arg)
{
	struct { u8 u[ETH_ALEN]; } *addr;
	struct tun_filter uf;
	int err, alen, n, nexact;

	if (copy_from_user(&uf, arg, sizeof(uf)))
		return -EFAULT;

	if (!uf.count) {
		/* Disabled */
		filter->count = 0;
		return 0;
	}

	alen = ETH_ALEN * uf.count;
	addr = kmalloc(alen, GFP_KERNEL);
	if (!addr)
		return -ENOMEM;

	if (copy_from_user(addr, arg + sizeof(uf), alen)) {
		err = -EFAULT;
		goto done;
	}

	/* The filter is updated without holding any locks. Which is
	 * perfectly safe. We disable it first and in the worst
	 * case we'll accept a few undesired packets. */
	filter->count = 0;
	wmb();

	/* Use first set of addresses as an exact filter */
	for (n = 0; n < uf.count && n < FLT_EXACT_COUNT; n++)
		memcpy(filter->addr[n], addr[n].u, ETH_ALEN);

	nexact = n;

616 617
	/* Remaining multicast addresses are hashed,
	 * unicast will leave the filter disabled. */
618
	memset(filter->mask, 0, sizeof(filter->mask));
619 620 621 622 623
	for (; n < uf.count; n++) {
		if (!is_multicast_ether_addr(addr[n].u)) {
			err = 0; /* no filter */
			goto done;
		}
624
		addr_hash_set(filter->mask, addr[n].u);
625
	}
626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653

	/* For ALLMULTI just set the mask to all ones.
	 * This overrides the mask populated above. */
	if ((uf.flags & TUN_FLT_ALLMULTI))
		memset(filter->mask, ~0, sizeof(filter->mask));

	/* Now enable the filter */
	wmb();
	filter->count = nexact;

	/* Return the number of exact filters */
	err = nexact;

done:
	kfree(addr);
	return err;
}

/* Returns: 0 - drop, !=0 - accept */
static int run_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	/* Cannot use eth_hdr(skb) here because skb_mac_hdr() is incorrect
	 * at this point. */
	struct ethhdr *eh = (struct ethhdr *) skb->data;
	int i;

	/* Exact match */
	for (i = 0; i < filter->count; i++)
654
		if (ether_addr_equal(eh->h_dest, filter->addr[i]))
655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675
			return 1;

	/* Inexact match (multicast only) */
	if (is_multicast_ether_addr(eh->h_dest))
		return addr_hash_test(filter->mask, eh->h_dest);

	return 0;
}

/*
 * Checks whether the packet is accepted or not.
 * Returns: 0 - drop, !=0 - accept
 */
static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	if (!filter->count)
		return 1;

	return run_filter(filter, skb);
}

L
Linus Torvalds 已提交
676 677
/* Network device part of the driver */

678
static const struct ethtool_ops tun_ethtool_ops;
L
Linus Torvalds 已提交
679

680 681 682
/* Net device detach from fd. */
static void tun_net_uninit(struct net_device *dev)
{
J
Jason Wang 已提交
683
	tun_detach_all(dev);
684 685
}

L
Linus Torvalds 已提交
686 687 688
/* Net device open. */
static int tun_net_open(struct net_device *dev)
{
J
Jason Wang 已提交
689
	netif_tx_start_all_queues(dev);
L
Linus Torvalds 已提交
690 691 692 693 694 695
	return 0;
}

/* Net device close. */
static int tun_net_close(struct net_device *dev)
{
J
Jason Wang 已提交
696
	netif_tx_stop_all_queues(dev);
L
Linus Torvalds 已提交
697 698 699 700
	return 0;
}

/* Net device start xmit */
701
static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
L
Linus Torvalds 已提交
702 703
{
	struct tun_struct *tun = netdev_priv(dev);
J
Jason Wang 已提交
704
	int txq = skb->queue_mapping;
705
	struct tun_file *tfile;
L
Linus Torvalds 已提交
706

707
	rcu_read_lock();
J
Jason Wang 已提交
708 709
	tfile = rcu_dereference(tun->tfiles[txq]);

L
Linus Torvalds 已提交
710
	/* Drop packet if interface is not attached */
J
Jason Wang 已提交
711
	if (txq >= tun->numqueues)
L
Linus Torvalds 已提交
712 713
		goto drop;

714 715
	tun_debug(KERN_INFO, tun, "tun_net_xmit %d\n", skb->len);

J
Jason Wang 已提交
716 717
	BUG_ON(!tfile);

718 719 720 721 722 723
	/* Drop if the filter does not like it.
	 * This is a noop if the filter is disabled.
	 * Filter can be enabled only for the TAP devices. */
	if (!check_filter(&tun->txflt, skb))
		goto drop;

J
Jason Wang 已提交
724 725
	if (tfile->socket.sk->sk_filter &&
	    sk_filter(tfile->socket.sk, skb))
M
Michael S. Tsirkin 已提交
726 727
		goto drop;

R
Rami Rosen 已提交
728
	/* Limit the number of packets queued by dividing txq length with the
J
Jason Wang 已提交
729 730
	 * number of queues.
	 */
J
Jason Wang 已提交
731
	if (skb_queue_len(&tfile->socket.sk->sk_receive_queue)
732 733
			  >= dev->tx_queue_len / tun->numqueues)
		goto drop;
L
Linus Torvalds 已提交
734

M
Michael S. Tsirkin 已提交
735 736
	/* Orphan the skb - required as we might hang on to it
	 * for indefinite time. */
M
Michael S. Tsirkin 已提交
737 738
	if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC)))
		goto drop;
M
Michael S. Tsirkin 已提交
739 740
	skb_orphan(skb);

741
	/* Enqueue packet */
J
Jason Wang 已提交
742
	skb_queue_tail(&tfile->socket.sk->sk_receive_queue, skb);
L
Linus Torvalds 已提交
743 744

	/* Notify and wake up reader process */
J
Jason Wang 已提交
745 746 747
	if (tfile->flags & TUN_FASYNC)
		kill_fasync(&tfile->fasync, SIGIO, POLL_IN);
	wake_up_interruptible_poll(&tfile->wq.wait, POLLIN |
748
				   POLLRDNORM | POLLRDBAND);
749 750

	rcu_read_unlock();
751
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
752 753

drop:
754
	dev->stats.tx_dropped++;
755
	skb_tx_error(skb);
L
Linus Torvalds 已提交
756
	kfree_skb(skb);
757
	rcu_read_unlock();
758
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
759 760
}

761
static void tun_net_mclist(struct net_device *dev)
L
Linus Torvalds 已提交
762
{
763 764 765 766 767
	/*
	 * This callback is supposed to deal with mc filter in
	 * _rx_ path and has nothing to do with the _tx_ path.
	 * In rx path we always accept everything userspace gives us.
	 */
L
Linus Torvalds 已提交
768 769
}

E
Ed Swierk 已提交
770 771 772 773 774 775 776 777 778 779 780 781
#define MIN_MTU 68
#define MAX_MTU 65535

static int
tun_net_change_mtu(struct net_device *dev, int new_mtu)
{
	if (new_mtu < MIN_MTU || new_mtu + dev->hard_header_len > MAX_MTU)
		return -EINVAL;
	dev->mtu = new_mtu;
	return 0;
}

782 783
static netdev_features_t tun_net_fix_features(struct net_device *dev,
	netdev_features_t features)
784 785 786 787 788
{
	struct tun_struct *tun = netdev_priv(dev);

	return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
}
789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805
#ifdef CONFIG_NET_POLL_CONTROLLER
static void tun_poll_controller(struct net_device *dev)
{
	/*
	 * Tun only receives frames when:
	 * 1) the char device endpoint gets data from user space
	 * 2) the tun socket gets a sendmsg call from user space
	 * Since both of those are syncronous operations, we are guaranteed
	 * never to have pending data when we poll for it
	 * so theres nothing to do here but return.
	 * We need this though so netpoll recognizes us as an interface that
	 * supports polling, which enables bridge devices in virt setups to
	 * still use netconsole
	 */
	return;
}
#endif
S
Stephen Hemminger 已提交
806
static const struct net_device_ops tun_netdev_ops = {
807
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
808 809
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
810
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
811
	.ndo_change_mtu		= tun_net_change_mtu,
812
	.ndo_fix_features	= tun_net_fix_features,
J
Jason Wang 已提交
813
	.ndo_select_queue	= tun_select_queue,
814 815 816
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
817 818 819
};

static const struct net_device_ops tap_netdev_ops = {
820
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
821 822
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
823
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
824
	.ndo_change_mtu		= tun_net_change_mtu,
825
	.ndo_fix_features	= tun_net_fix_features,
826
	.ndo_set_rx_mode	= tun_net_mclist,
S
Stephen Hemminger 已提交
827 828
	.ndo_set_mac_address	= eth_mac_addr,
	.ndo_validate_addr	= eth_validate_addr,
J
Jason Wang 已提交
829
	.ndo_select_queue	= tun_select_queue,
830 831 832
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
833 834
};

J
Jason Wang 已提交
835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855
static int tun_flow_init(struct tun_struct *tun)
{
	int i;

	for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++)
		INIT_HLIST_HEAD(&tun->flows[i]);

	tun->ageing_time = TUN_FLOW_EXPIRE;
	setup_timer(&tun->flow_gc_timer, tun_flow_cleanup, (unsigned long)tun);
	mod_timer(&tun->flow_gc_timer,
		  round_jiffies_up(jiffies + tun->ageing_time));

	return 0;
}

static void tun_flow_uninit(struct tun_struct *tun)
{
	del_timer_sync(&tun->flow_gc_timer);
	tun_flow_flush(tun);
}

L
Linus Torvalds 已提交
856 857 858 859
/* Initialize net device. */
static void tun_net_init(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
860

L
Linus Torvalds 已提交
861 862
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
S
Stephen Hemminger 已提交
863 864
		dev->netdev_ops = &tun_netdev_ops;

L
Linus Torvalds 已提交
865 866 867 868 869 870
		/* Point-to-Point TUN Device */
		dev->hard_header_len = 0;
		dev->addr_len = 0;
		dev->mtu = 1500;

		/* Zero header length */
871
		dev->type = ARPHRD_NONE;
L
Linus Torvalds 已提交
872 873 874 875 876
		dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;

	case TUN_TAP_DEV:
K
Kusanagi Kouichi 已提交
877
		dev->netdev_ops = &tap_netdev_ops;
L
Linus Torvalds 已提交
878 879
		/* Ethernet TAP Device */
		ether_setup(dev);
880
		dev->priv_flags &= ~IFF_TX_SKB_SHARING;
881
		dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
882

883
		eth_hw_addr_random(dev);
884

L
Linus Torvalds 已提交
885 886 887 888 889 890 891 892
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;
	}
}

/* Character device part */

/* Poll */
J
Jason Wang 已提交
893
static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
894
{
895 896
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
897
	struct sock *sk;
898
	unsigned int mask = 0;
L
Linus Torvalds 已提交
899 900

	if (!tun)
901
		return POLLERR;
L
Linus Torvalds 已提交
902

J
Jason Wang 已提交
903
	sk = tfile->socket.sk;
904

905
	tun_debug(KERN_INFO, tun, "tun_chr_poll\n");
L
Linus Torvalds 已提交
906

J
Jason Wang 已提交
907
	poll_wait(file, &tfile->wq.wait, wait);
908

909
	if (!skb_queue_empty(&sk->sk_receive_queue))
L
Linus Torvalds 已提交
910 911
		mask |= POLLIN | POLLRDNORM;

912 913 914 915 916
	if (sock_writeable(sk) ||
	    (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
	     sock_writeable(sk)))
		mask |= POLLOUT | POLLWRNORM;

917 918 919
	if (tun->dev->reg_state != NETREG_REGISTERED)
		mask = POLLERR;

E
Eric W. Biederman 已提交
920
	tun_put(tun);
L
Linus Torvalds 已提交
921 922 923
	return mask;
}

924 925
/* prepad is the amount to reserve at front.  len is length after that.
 * linear is a hint as to how much to copy (usually headers). */
J
Jason Wang 已提交
926
static struct sk_buff *tun_alloc_skb(struct tun_file *tfile,
927 928
				     size_t prepad, size_t len,
				     size_t linear, int noblock)
929
{
J
Jason Wang 已提交
930
	struct sock *sk = tfile->socket.sk;
931
	struct sk_buff *skb;
932
	int err;
933 934

	/* Under a page?  Don't bother with paged skb. */
H
Herbert Xu 已提交
935
	if (prepad + len < PAGE_SIZE || !linear)
936
		linear = len;
937

938 939
	skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
				   &err);
940
	if (!skb)
941
		return ERR_PTR(err);
942 943 944

	skb_reserve(skb, prepad);
	skb_put(skb, linear);
945 946
	skb->data_len = len - linear;
	skb->len += len - linear;
947 948 949 950

	return skb;
}

951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028
/* set skb frags from iovec, this can move to core network code for reuse */
static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
				  int offset, size_t count)
{
	int len = iov_length(from, count) - offset;
	int copy = skb_headlen(skb);
	int size, offset1 = 0;
	int i = 0;

	/* Skip over from offset */
	while (count && (offset >= from->iov_len)) {
		offset -= from->iov_len;
		++from;
		--count;
	}

	/* copy up to skb headlen */
	while (count && (copy > 0)) {
		size = min_t(unsigned int, copy, from->iov_len - offset);
		if (copy_from_user(skb->data + offset1, from->iov_base + offset,
				   size))
			return -EFAULT;
		if (copy > size) {
			++from;
			--count;
			offset = 0;
		} else
			offset += size;
		copy -= size;
		offset1 += size;
	}

	if (len == offset1)
		return 0;

	while (count--) {
		struct page *page[MAX_SKB_FRAGS];
		int num_pages;
		unsigned long base;
		unsigned long truesize;

		len = from->iov_len - offset;
		if (!len) {
			offset = 0;
			++from;
			continue;
		}
		base = (unsigned long)from->iov_base + offset;
		size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
		if (i + size > MAX_SKB_FRAGS)
			return -EMSGSIZE;
		num_pages = get_user_pages_fast(base, size, 0, &page[i]);
		if (num_pages != size) {
			for (i = 0; i < num_pages; i++)
				put_page(page[i]);
			return -EFAULT;
		}
		truesize = size * PAGE_SIZE;
		skb->data_len += len;
		skb->len += len;
		skb->truesize += truesize;
		atomic_add(truesize, &skb->sk->sk_wmem_alloc);
		while (len) {
			int off = base & ~PAGE_MASK;
			int size = min_t(int, len, PAGE_SIZE - off);
			__skb_fill_page_desc(skb, i, page[i], off, size);
			skb_shinfo(skb)->nr_frags++;
			/* increase sk_wmem_alloc */
			base += size;
			len -= size;
			i++;
		}
		offset = 0;
		++from;
	}
	return 0;
}

L
Linus Torvalds 已提交
1029
/* Get packet from user space buffer */
J
Jason Wang 已提交
1030 1031 1032
static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
			    void *msg_control, const struct iovec *iv,
			    size_t total_len, size_t count, int noblock)
L
Linus Torvalds 已提交
1033
{
1034
	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
L
Linus Torvalds 已提交
1035
	struct sk_buff *skb;
1036
	size_t len = total_len, align = NET_SKB_PAD;
1037
	struct virtio_net_hdr gso = { 0 };
1038
	int offset = 0;
1039 1040 1041
	int copylen;
	bool zerocopy = false;
	int err;
1042
	u32 rxhash;
L
Linus Torvalds 已提交
1043 1044

	if (!(tun->flags & TUN_NO_PI)) {
1045
		if ((len -= sizeof(pi)) > total_len)
L
Linus Torvalds 已提交
1046 1047
			return -EINVAL;

1048
		if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
L
Linus Torvalds 已提交
1049
			return -EFAULT;
1050
		offset += sizeof(pi);
L
Linus Torvalds 已提交
1051 1052
	}

1053
	if (tun->flags & TUN_VNET_HDR) {
1054
		if ((len -= tun->vnet_hdr_sz) > total_len)
1055 1056
			return -EINVAL;

1057
		if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
1058 1059
			return -EFAULT;

1060 1061 1062 1063
		if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
		    gso.csum_start + gso.csum_offset + 2 > gso.hdr_len)
			gso.hdr_len = gso.csum_start + gso.csum_offset + 2;

1064 1065
		if (gso.hdr_len > len)
			return -EINVAL;
1066
		offset += tun->vnet_hdr_sz;
1067 1068
	}

1069
	if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
1070
		align += NET_IP_ALIGN;
H
Herbert Xu 已提交
1071 1072
		if (unlikely(len < ETH_HLEN ||
			     (gso.hdr_len && gso.hdr_len < ETH_HLEN)))
1073 1074
			return -EINVAL;
	}
1075

1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102
	if (msg_control)
		zerocopy = true;

	if (zerocopy) {
		/* Userspace may produce vectors with count greater than
		 * MAX_SKB_FRAGS, so we need to linearize parts of the skb
		 * to let the rest of data to be fit in the frags.
		 */
		if (count > MAX_SKB_FRAGS) {
			copylen = iov_length(iv, count - MAX_SKB_FRAGS);
			if (copylen < offset)
				copylen = 0;
			else
				copylen -= offset;
		} else
				copylen = 0;
		/* There are 256 bytes to be copied in skb, so there is enough
		 * room for skb expand head in case it is used.
		 * The rest of the buffer is mapped from userspace.
		 */
		if (copylen < gso.hdr_len)
			copylen = gso.hdr_len;
		if (!copylen)
			copylen = GOODCOPY_LEN;
	} else
		copylen = len;

J
Jason Wang 已提交
1103
	skb = tun_alloc_skb(tfile, align, copylen, gso.hdr_len, noblock);
1104 1105 1106 1107
	if (IS_ERR(skb)) {
		if (PTR_ERR(skb) != -EAGAIN)
			tun->dev->stats.rx_dropped++;
		return PTR_ERR(skb);
L
Linus Torvalds 已提交
1108 1109
	}

1110 1111 1112 1113 1114 1115
	if (zerocopy)
		err = zerocopy_sg_from_iovec(skb, iv, offset, count);
	else
		err = skb_copy_datagram_from_iovec(skb, 0, iv, offset, len);

	if (err) {
1116
		tun->dev->stats.rx_dropped++;
D
Dave Jones 已提交
1117
		kfree_skb(skb);
L
Linus Torvalds 已提交
1118
		return -EFAULT;
D
Dave Jones 已提交
1119
	}
L
Linus Torvalds 已提交
1120

1121 1122 1123 1124 1125 1126 1127
	if (gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
		if (!skb_partial_csum_set(skb, gso.csum_start,
					  gso.csum_offset)) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}
1128
	}
1129

L
Linus Torvalds 已提交
1130 1131
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146
		if (tun->flags & TUN_NO_PI) {
			switch (skb->data[0] & 0xf0) {
			case 0x40:
				pi.proto = htons(ETH_P_IP);
				break;
			case 0x60:
				pi.proto = htons(ETH_P_IPV6);
				break;
			default:
				tun->dev->stats.rx_dropped++;
				kfree_skb(skb);
				return -EINVAL;
			}
		}

1147
		skb_reset_mac_header(skb);
L
Linus Torvalds 已提交
1148
		skb->protocol = pi.proto;
1149
		skb->dev = tun->dev;
L
Linus Torvalds 已提交
1150 1151 1152 1153
		break;
	case TUN_TAP_DEV:
		skb->protocol = eth_type_trans(skb, tun->dev);
		break;
1154
	}
L
Linus Torvalds 已提交
1155

1156 1157 1158 1159 1160 1161 1162 1163 1164
	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
		pr_debug("GSO!\n");
		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
		case VIRTIO_NET_HDR_GSO_TCPV4:
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
			break;
		case VIRTIO_NET_HDR_GSO_TCPV6:
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
			break;
1165 1166 1167
		case VIRTIO_NET_HDR_GSO_UDP:
			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
			break;
1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187
		default:
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		if (gso.gso_type & VIRTIO_NET_HDR_GSO_ECN)
			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;

		skb_shinfo(skb)->gso_size = gso.gso_size;
		if (skb_shinfo(skb)->gso_size == 0) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		/* Header must be checked, and gso_segs computed. */
		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
		skb_shinfo(skb)->gso_segs = 0;
	}
1188

1189 1190 1191 1192 1193 1194
	/* copy skb_ubuf_info for callback when skb has no error */
	if (zerocopy) {
		skb_shinfo(skb)->destructor_arg = msg_control;
		skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY;
	}

1195
	skb_reset_network_header(skb);
1196
	rxhash = skb_get_rxhash(skb);
L
Linus Torvalds 已提交
1197
	netif_rx_ni(skb);
1198

1199 1200
	tun->dev->stats.rx_packets++;
	tun->dev->stats.rx_bytes += len;
L
Linus Torvalds 已提交
1201

1202
	tun_flow_update(tun, rxhash, tfile->queue_index);
1203
	return total_len;
1204
}
L
Linus Torvalds 已提交
1205

1206 1207
static ssize_t tun_chr_aio_write(struct kiocb *iocb, const struct iovec *iv,
			      unsigned long count, loff_t pos)
L
Linus Torvalds 已提交
1208
{
1209
	struct file *file = iocb->ki_filp;
H
Herbert Xu 已提交
1210
	struct tun_struct *tun = tun_get(file);
J
Jason Wang 已提交
1211
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1212
	ssize_t result;
L
Linus Torvalds 已提交
1213 1214 1215 1216

	if (!tun)
		return -EBADFD;

1217
	tun_debug(KERN_INFO, tun, "tun_chr_write %ld\n", count);
L
Linus Torvalds 已提交
1218

J
Jason Wang 已提交
1219 1220
	result = tun_get_user(tun, tfile, NULL, iv, iov_length(iv, count),
			      count, file->f_flags & O_NONBLOCK);
E
Eric W. Biederman 已提交
1221 1222 1223

	tun_put(tun);
	return result;
L
Linus Torvalds 已提交
1224 1225 1226
}

/* Put packet to the user space buffer */
1227
static ssize_t tun_put_user(struct tun_struct *tun,
J
Jason Wang 已提交
1228
			    struct tun_file *tfile,
1229 1230
			    struct sk_buff *skb,
			    const struct iovec *iv, int len)
L
Linus Torvalds 已提交
1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242
{
	struct tun_pi pi = { 0, skb->protocol };
	ssize_t total = 0;

	if (!(tun->flags & TUN_NO_PI)) {
		if ((len -= sizeof(pi)) < 0)
			return -EINVAL;

		if (len < skb->len) {
			/* Packet will be striped */
			pi.flags |= TUN_PKT_STRIP;
		}
1243

1244
		if (memcpy_toiovecend(iv, (void *) &pi, 0, sizeof(pi)))
L
Linus Torvalds 已提交
1245 1246
			return -EFAULT;
		total += sizeof(pi);
1247
	}
L
Linus Torvalds 已提交
1248

1249 1250
	if (tun->flags & TUN_VNET_HDR) {
		struct virtio_net_hdr gso = { 0 }; /* no info leak */
1251
		if ((len -= tun->vnet_hdr_sz) < 0)
1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263
			return -EINVAL;

		if (skb_is_gso(skb)) {
			struct skb_shared_info *sinfo = skb_shinfo(skb);

			/* This is a hint as to how much should be linear. */
			gso.hdr_len = skb_headlen(skb);
			gso.gso_size = sinfo->gso_size;
			if (sinfo->gso_type & SKB_GSO_TCPV4)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
			else if (sinfo->gso_type & SKB_GSO_TCPV6)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
1264 1265
			else if (sinfo->gso_type & SKB_GSO_UDP)
				gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
1266
			else {
1267
				pr_err("unexpected GSO type: "
1268 1269 1270 1271 1272 1273 1274 1275 1276 1277
				       "0x%x, gso_size %d, hdr_len %d\n",
				       sinfo->gso_type, gso.gso_size,
				       gso.hdr_len);
				print_hex_dump(KERN_ERR, "tun: ",
					       DUMP_PREFIX_NONE,
					       16, 1, skb->head,
					       min((int)gso.hdr_len, 64), true);
				WARN_ON_ONCE(1);
				return -EINVAL;
			}
1278 1279 1280 1281 1282 1283 1284
			if (sinfo->gso_type & SKB_GSO_TCP_ECN)
				gso.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
		} else
			gso.gso_type = VIRTIO_NET_HDR_GSO_NONE;

		if (skb->ip_summed == CHECKSUM_PARTIAL) {
			gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
1285
			gso.csum_start = skb_checksum_start_offset(skb);
1286
			gso.csum_offset = skb->csum_offset;
1287 1288
		} else if (skb->ip_summed == CHECKSUM_UNNECESSARY) {
			gso.flags = VIRTIO_NET_HDR_F_DATA_VALID;
1289 1290
		} /* else everything is zero */

1291 1292
		if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
					       sizeof(gso))))
1293
			return -EFAULT;
1294
		total += tun->vnet_hdr_sz;
1295 1296
	}

L
Linus Torvalds 已提交
1297 1298
	len = min_t(int, skb->len, len);

1299
	skb_copy_datagram_const_iovec(skb, 0, iv, total, len);
1300
	total += skb->len;
L
Linus Torvalds 已提交
1301

1302 1303
	tun->dev->stats.tx_packets++;
	tun->dev->stats.tx_bytes += len;
L
Linus Torvalds 已提交
1304 1305 1306 1307

	return total;
}

J
Jason Wang 已提交
1308
static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile,
1309 1310
			   struct kiocb *iocb, const struct iovec *iv,
			   ssize_t len, int noblock)
L
Linus Torvalds 已提交
1311 1312 1313
{
	DECLARE_WAITQUEUE(wait, current);
	struct sk_buff *skb;
1314
	ssize_t ret = 0;
L
Linus Torvalds 已提交
1315

1316
	tun_debug(KERN_INFO, tun, "tun_do_read\n");
L
Linus Torvalds 已提交
1317

1318
	if (unlikely(!noblock))
J
Jason Wang 已提交
1319
		add_wait_queue(&tfile->wq.wait, &wait);
L
Linus Torvalds 已提交
1320 1321 1322 1323
	while (len) {
		current->state = TASK_INTERRUPTIBLE;

		/* Read frames from the queue */
J
Jason Wang 已提交
1324
		if (!(skb = skb_dequeue(&tfile->socket.sk->sk_receive_queue))) {
1325
			if (noblock) {
L
Linus Torvalds 已提交
1326 1327 1328 1329 1330 1331 1332
				ret = -EAGAIN;
				break;
			}
			if (signal_pending(current)) {
				ret = -ERESTARTSYS;
				break;
			}
1333 1334 1335 1336
			if (tun->dev->reg_state != NETREG_REGISTERED) {
				ret = -EIO;
				break;
			}
L
Linus Torvalds 已提交
1337 1338 1339 1340 1341 1342

			/* Nothing to read, let's sleep */
			schedule();
			continue;
		}

J
Jason Wang 已提交
1343
		ret = tun_put_user(tun, tfile, skb, iv, len);
1344 1345
		kfree_skb(skb);
		break;
L
Linus Torvalds 已提交
1346 1347 1348
	}

	current->state = TASK_RUNNING;
1349
	if (unlikely(!noblock))
J
Jason Wang 已提交
1350
		remove_wait_queue(&tfile->wq.wait, &wait);
L
Linus Torvalds 已提交
1351

1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370
	return ret;
}

static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
			    unsigned long count, loff_t pos)
{
	struct file *file = iocb->ki_filp;
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
	ssize_t len, ret;

	if (!tun)
		return -EBADFD;
	len = iov_length(iv, count);
	if (len < 0) {
		ret = -EINVAL;
		goto out;
	}

J
Jason Wang 已提交
1371 1372
	ret = tun_do_read(tun, tfile, iocb, iv, len,
			  file->f_flags & O_NONBLOCK);
1373
	ret = min_t(ssize_t, ret, len);
E
Eric W. Biederman 已提交
1374 1375
out:
	tun_put(tun);
L
Linus Torvalds 已提交
1376 1377 1378
	return ret;
}

J
Jason Wang 已提交
1379 1380 1381 1382
static void tun_free_netdev(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

J
Jason Wang 已提交
1383
	BUG_ON(!(list_empty(&tun->disabled)));
J
Jason Wang 已提交
1384
	tun_flow_uninit(tun);
1385
	security_tun_dev_free_security(tun->security);
J
Jason Wang 已提交
1386 1387 1388
	free_netdev(dev);
}

L
Linus Torvalds 已提交
1389 1390 1391 1392
static void tun_setup(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

1393 1394
	tun->owner = INVALID_UID;
	tun->group = INVALID_GID;
L
Linus Torvalds 已提交
1395 1396

	dev->ethtool_ops = &tun_ethtool_ops;
J
Jason Wang 已提交
1397
	dev->destructor = tun_free_netdev;
L
Linus Torvalds 已提交
1398 1399
}

1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414
/* Trivial set of netlink ops to allow deleting tun or tap
 * device with netlink.
 */
static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
{
	return -EINVAL;
}

static struct rtnl_link_ops tun_link_ops __read_mostly = {
	.kind		= DRV_NAME,
	.priv_size	= sizeof(struct tun_struct),
	.setup		= tun_setup,
	.validate	= tun_validate,
};

1415 1416
static void tun_sock_write_space(struct sock *sk)
{
J
Jason Wang 已提交
1417
	struct tun_file *tfile;
1418
	wait_queue_head_t *wqueue;
1419 1420 1421 1422 1423 1424 1425

	if (!sock_writeable(sk))
		return;

	if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
		return;

1426 1427 1428
	wqueue = sk_sleep(sk);
	if (wqueue && waitqueue_active(wqueue))
		wake_up_interruptible_sync_poll(wqueue, POLLOUT |
1429
						POLLWRNORM | POLLWRBAND);
H
Herbert Xu 已提交
1430

J
Jason Wang 已提交
1431 1432
	tfile = container_of(sk, struct tun_file, sk);
	kill_fasync(&tfile->fasync, SIGIO, POLL_OUT);
1433 1434
}

1435 1436 1437
static int tun_sendmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len)
{
J
Jason Wang 已提交
1438 1439 1440 1441 1442 1443 1444 1445 1446 1447
	int ret;
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);

	if (!tun)
		return -EBADFD;
	ret = tun_get_user(tun, tfile, m->msg_control, m->msg_iov, total_len,
			   m->msg_iovlen, m->msg_flags & MSG_DONTWAIT);
	tun_put(tun);
	return ret;
1448 1449
}

J
Jason Wang 已提交
1450

1451 1452 1453 1454
static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len,
		       int flags)
{
J
Jason Wang 已提交
1455 1456
	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
	struct tun_struct *tun = __tun_get(tfile);
1457
	int ret;
J
Jason Wang 已提交
1458 1459 1460 1461

	if (!tun)
		return -EBADFD;

1462 1463
	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
		return -EINVAL;
J
Jason Wang 已提交
1464
	ret = tun_do_read(tun, tfile, iocb, m->msg_iov, total_len,
1465 1466 1467 1468 1469
			  flags & MSG_DONTWAIT);
	if (ret > total_len) {
		m->msg_flags |= MSG_TRUNC;
		ret = flags & MSG_TRUNC ? ret : total_len;
	}
J
Jason Wang 已提交
1470
	tun_put(tun);
1471 1472 1473
	return ret;
}

1474 1475 1476 1477 1478 1479 1480
static int tun_release(struct socket *sock)
{
	if (sock->sk)
		sock_put(sock->sk);
	return 0;
}

1481 1482 1483 1484
/* Ops structure to mimic raw sockets with tun */
static const struct proto_ops tun_socket_ops = {
	.sendmsg = tun_sendmsg,
	.recvmsg = tun_recvmsg,
1485
	.release = tun_release,
1486 1487
};

1488 1489 1490
static struct proto tun_proto = {
	.name		= "tun",
	.owner		= THIS_MODULE,
J
Jason Wang 已提交
1491
	.obj_size	= sizeof(struct tun_file),
1492
};
1493

1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505
static int tun_flags(struct tun_struct *tun)
{
	int flags = 0;

	if (tun->flags & TUN_TUN_DEV)
		flags |= IFF_TUN;
	else
		flags |= IFF_TAP;

	if (tun->flags & TUN_NO_PI)
		flags |= IFF_NO_PI;

1506 1507 1508
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
1509 1510 1511 1512 1513 1514
	if (tun->flags & TUN_ONE_QUEUE)
		flags |= IFF_ONE_QUEUE;

	if (tun->flags & TUN_VNET_HDR)
		flags |= IFF_VNET_HDR;

J
Jason Wang 已提交
1515 1516 1517
	if (tun->flags & TUN_TAP_MQ)
		flags |= IFF_MULTI_QUEUE;

1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531
	return flags;
}

static ssize_t tun_show_flags(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "0x%x\n", tun_flags(tun));
}

static ssize_t tun_show_owner(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1532 1533 1534 1535
	return uid_valid(tun->owner)?
		sprintf(buf, "%u\n",
			from_kuid_munged(current_user_ns(), tun->owner)):
		sprintf(buf, "-1\n");
1536 1537 1538 1539 1540 1541
}

static ssize_t tun_show_group(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
1542 1543 1544 1545
	return gid_valid(tun->group) ?
		sprintf(buf, "%u\n",
			from_kgid_munged(current_user_ns(), tun->group)):
		sprintf(buf, "-1\n");
1546 1547 1548 1549 1550 1551
}

static DEVICE_ATTR(tun_flags, 0444, tun_show_flags, NULL);
static DEVICE_ATTR(owner, 0444, tun_show_owner, NULL);
static DEVICE_ATTR(group, 0444, tun_show_group, NULL);

1552
static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
L
Linus Torvalds 已提交
1553 1554
{
	struct tun_struct *tun;
J
Jason Wang 已提交
1555
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
1556 1557 1558
	struct net_device *dev;
	int err;

1559 1560 1561
	if (tfile->detached)
		return -EINVAL;

1562 1563
	dev = __dev_get_by_name(net, ifr->ifr_name);
	if (dev) {
1564 1565
		if (ifr->ifr_flags & IFF_TUN_EXCL)
			return -EBUSY;
1566 1567 1568 1569 1570 1571 1572
		if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
			tun = netdev_priv(dev);
		else if ((ifr->ifr_flags & IFF_TAP) && dev->netdev_ops == &tap_netdev_ops)
			tun = netdev_priv(dev);
		else
			return -EINVAL;

1573
		if (tun_not_capable(tun))
P
Paul Moore 已提交
1574
			return -EPERM;
1575
		err = security_tun_dev_open(tun->security);
P
Paul Moore 已提交
1576 1577 1578
		if (err < 0)
			return err;

1579 1580 1581
		err = tun_attach(tun, file);
		if (err < 0)
			return err;
J
Jason Wang 已提交
1582 1583 1584 1585

		if (tun->flags & TUN_TAP_MQ &&
		    (tun->numqueues + tun->numdisabled > 1))
			return err;
1586
	}
L
Linus Torvalds 已提交
1587 1588 1589
	else {
		char *name;
		unsigned long flags = 0;
1590 1591
		int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
			     MAX_TAP_QUEUES : 1;
L
Linus Torvalds 已提交
1592

1593
		if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
1594
			return -EPERM;
P
Paul Moore 已提交
1595 1596 1597
		err = security_tun_dev_create();
		if (err < 0)
			return err;
1598

L
Linus Torvalds 已提交
1599 1600 1601 1602 1603 1604 1605 1606 1607
		/* Set dev type */
		if (ifr->ifr_flags & IFF_TUN) {
			/* TUN device */
			flags |= TUN_TUN_DEV;
			name = "tun%d";
		} else if (ifr->ifr_flags & IFF_TAP) {
			/* TAP device */
			flags |= TUN_TAP_DEV;
			name = "tap%d";
1608
		} else
1609
			return -EINVAL;
1610

L
Linus Torvalds 已提交
1611 1612 1613
		if (*ifr->ifr_name)
			name = ifr->ifr_name;

J
Jason Wang 已提交
1614
		dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
1615 1616
				       tun_setup, queues, queues);

L
Linus Torvalds 已提交
1617 1618 1619
		if (!dev)
			return -ENOMEM;

1620
		dev_net_set(dev, net);
1621
		dev->rtnl_link_ops = &tun_link_ops;
S
Stephen Hemminger 已提交
1622

L
Linus Torvalds 已提交
1623 1624 1625
		tun = netdev_priv(dev);
		tun->dev = dev;
		tun->flags = flags;
1626
		tun->txflt.count = 0;
1627
		tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
1628

J
Jason Wang 已提交
1629 1630
		tun->filter_attached = false;
		tun->sndbuf = tfile->socket.sk->sk_sndbuf;
1631

J
Jason Wang 已提交
1632 1633
		spin_lock_init(&tun->lock);

1634 1635 1636
		err = security_tun_dev_alloc_security(&tun->security);
		if (err < 0)
			goto err_free_dev;
P
Paul Moore 已提交
1637

L
Linus Torvalds 已提交
1638 1639
		tun_net_init(dev);

1640 1641
		err = tun_flow_init(tun);
		if (err < 0)
J
Jason Wang 已提交
1642 1643
			goto err_free_dev;

1644 1645 1646 1647
		dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
			TUN_USER_FEATURES;
		dev->features = dev->hw_features;

J
Jason Wang 已提交
1648
		INIT_LIST_HEAD(&tun->disabled);
1649 1650 1651 1652
		err = tun_attach(tun, file);
		if (err < 0)
			goto err_free_dev;

L
Linus Torvalds 已提交
1653 1654
		err = register_netdevice(tun->dev);
		if (err < 0)
J
Jason Wang 已提交
1655
			goto err_free_dev;
1656

1657 1658 1659
		if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
		    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
		    device_create_file(&tun->dev->dev, &dev_attr_group))
1660
			pr_err("Failed to create tun sysfs files\n");
1661

1662
		netif_carrier_on(tun->dev);
L
Linus Torvalds 已提交
1663 1664
	}

1665
	tun_debug(KERN_INFO, tun, "tun_set_iff\n");
L
Linus Torvalds 已提交
1666 1667 1668

	if (ifr->ifr_flags & IFF_NO_PI)
		tun->flags |= TUN_NO_PI;
1669 1670
	else
		tun->flags &= ~TUN_NO_PI;
L
Linus Torvalds 已提交
1671

1672 1673 1674
	/* This flag has no real effect.  We track the value for backwards
	 * compatibility.
	 */
L
Linus Torvalds 已提交
1675 1676
	if (ifr->ifr_flags & IFF_ONE_QUEUE)
		tun->flags |= TUN_ONE_QUEUE;
1677 1678
	else
		tun->flags &= ~TUN_ONE_QUEUE;
L
Linus Torvalds 已提交
1679

1680 1681 1682 1683 1684
	if (ifr->ifr_flags & IFF_VNET_HDR)
		tun->flags |= TUN_VNET_HDR;
	else
		tun->flags &= ~TUN_VNET_HDR;

J
Jason Wang 已提交
1685 1686 1687 1688 1689
	if (ifr->ifr_flags & IFF_MULTI_QUEUE)
		tun->flags |= TUN_TAP_MQ;
	else
		tun->flags &= ~TUN_TAP_MQ;

1690 1691 1692 1693
	/* Make sure persistent devices do not get stuck in
	 * xoff state.
	 */
	if (netif_running(tun->dev))
J
Jason Wang 已提交
1694
		netif_tx_wake_all_queues(tun->dev);
1695

L
Linus Torvalds 已提交
1696 1697 1698 1699 1700 1701 1702 1703
	strcpy(ifr->ifr_name, tun->dev->name);
	return 0;

 err_free_dev:
	free_netdev(dev);
	return err;
}

R
Rami Rosen 已提交
1704
static void tun_get_iff(struct net *net, struct tun_struct *tun,
1705
		       struct ifreq *ifr)
1706
{
1707
	tun_debug(KERN_INFO, tun, "tun_get_iff\n");
1708 1709 1710

	strcpy(ifr->ifr_name, tun->dev->name);

1711
	ifr->ifr_flags = tun_flags(tun);
1712 1713 1714

}

1715 1716
/* This is like a cut-down ethtool ops, except done via tun fd so no
 * privs required. */
1717
static int set_offload(struct tun_struct *tun, unsigned long arg)
1718
{
1719
	netdev_features_t features = 0;
1720 1721

	if (arg & TUN_F_CSUM) {
1722
		features |= NETIF_F_HW_CSUM;
1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735
		arg &= ~TUN_F_CSUM;

		if (arg & (TUN_F_TSO4|TUN_F_TSO6)) {
			if (arg & TUN_F_TSO_ECN) {
				features |= NETIF_F_TSO_ECN;
				arg &= ~TUN_F_TSO_ECN;
			}
			if (arg & TUN_F_TSO4)
				features |= NETIF_F_TSO;
			if (arg & TUN_F_TSO6)
				features |= NETIF_F_TSO6;
			arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
		}
1736 1737 1738 1739 1740

		if (arg & TUN_F_UFO) {
			features |= NETIF_F_UFO;
			arg &= ~TUN_F_UFO;
		}
1741 1742 1743 1744 1745 1746 1747
	}

	/* This gives the user a way to test for new features in future by
	 * trying to set them. */
	if (arg)
		return -EINVAL;

1748 1749
	tun->set_features = features;
	netdev_update_features(tun->dev);
1750 1751 1752 1753

	return 0;
}

J
Jason Wang 已提交
1754 1755 1756 1757 1758 1759
static void tun_detach_filter(struct tun_struct *tun, int n)
{
	int i;
	struct tun_file *tfile;

	for (i = 0; i < n; i++) {
1760
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772
		sk_detach_filter(tfile->socket.sk);
	}

	tun->filter_attached = false;
}

static int tun_attach_filter(struct tun_struct *tun)
{
	int i, ret = 0;
	struct tun_file *tfile;

	for (i = 0; i < tun->numqueues; i++) {
1773
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790
		ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
		if (ret) {
			tun_detach_filter(tun, i);
			return ret;
		}
	}

	tun->filter_attached = true;
	return ret;
}

static void tun_set_sndbuf(struct tun_struct *tun)
{
	struct tun_file *tfile;
	int i;

	for (i = 0; i < tun->numqueues; i++) {
1791
		tfile = rtnl_dereference(tun->tfiles[i]);
J
Jason Wang 已提交
1792 1793 1794 1795
		tfile->socket.sk->sk_sndbuf = tun->sndbuf;
	}
}

1796 1797 1798 1799 1800 1801 1802 1803 1804
static int tun_set_queue(struct file *file, struct ifreq *ifr)
{
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun;
	int ret = 0;

	rtnl_lock();

	if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
J
Jason Wang 已提交
1805
		tun = tfile->detached;
1806
		if (!tun) {
1807
			ret = -EINVAL;
1808 1809 1810 1811 1812 1813
			goto unlock;
		}
		ret = security_tun_dev_attach_queue(tun->security);
		if (ret < 0)
			goto unlock;
		ret = tun_attach(tun, file);
J
Jason Wang 已提交
1814
	} else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
1815
		tun = rtnl_dereference(tfile->tun);
J
Jason Wang 已提交
1816 1817 1818 1819 1820
		if (!tun || !(tun->flags & TUN_TAP_MQ))
			ret = -EINVAL;
		else
			__tun_detach(tfile, false);
	} else
1821 1822
		ret = -EINVAL;

1823
unlock:
1824 1825 1826 1827
	rtnl_unlock();
	return ret;
}

1828 1829
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg, int ifreq_len)
L
Linus Torvalds 已提交
1830
{
E
Eric W. Biederman 已提交
1831
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1832
	struct tun_struct *tun;
L
Linus Torvalds 已提交
1833 1834
	void __user* argp = (void __user*)arg;
	struct ifreq ifr;
1835 1836
	kuid_t owner;
	kgid_t group;
1837
	int sndbuf;
1838
	int vnet_hdr_sz;
1839
	int ret;
L
Linus Torvalds 已提交
1840

1841
	if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) {
1842
		if (copy_from_user(&ifr, argp, ifreq_len))
L
Linus Torvalds 已提交
1843
			return -EFAULT;
D
David S. Miller 已提交
1844
	} else {
1845
		memset(&ifr, 0, sizeof(ifr));
D
David S. Miller 已提交
1846
	}
E
Eric W. Biederman 已提交
1847 1848 1849 1850 1851
	if (cmd == TUNGETFEATURES) {
		/* Currently this just means: "what IFF flags are valid?".
		 * This is needed because we never checked for invalid flags on
		 * TUNSETIFF. */
		return put_user(IFF_TUN | IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE |
1852
				IFF_VNET_HDR | IFF_MULTI_QUEUE,
E
Eric W. Biederman 已提交
1853
				(unsigned int __user*)argp);
1854 1855
	} else if (cmd == TUNSETQUEUE)
		return tun_set_queue(file, &ifr);
E
Eric W. Biederman 已提交
1856

J
Jason Wang 已提交
1857
	ret = 0;
1858 1859
	rtnl_lock();

E
Eric W. Biederman 已提交
1860
	tun = __tun_get(tfile);
L
Linus Torvalds 已提交
1861 1862 1863
	if (cmd == TUNSETIFF && !tun) {
		ifr.ifr_name[IFNAMSIZ-1] = '\0';

1864
		ret = tun_set_iff(tfile->net, file, &ifr);
L
Linus Torvalds 已提交
1865

1866 1867
		if (ret)
			goto unlock;
L
Linus Torvalds 已提交
1868

1869
		if (copy_to_user(argp, &ifr, ifreq_len))
1870 1871
			ret = -EFAULT;
		goto unlock;
L
Linus Torvalds 已提交
1872 1873
	}

1874
	ret = -EBADFD;
L
Linus Torvalds 已提交
1875
	if (!tun)
1876
		goto unlock;
L
Linus Torvalds 已提交
1877

1878
	tun_debug(KERN_INFO, tun, "tun_chr_ioctl cmd %u\n", cmd);
L
Linus Torvalds 已提交
1879

E
Eric W. Biederman 已提交
1880
	ret = 0;
L
Linus Torvalds 已提交
1881
	switch (cmd) {
1882
	case TUNGETIFF:
R
Rami Rosen 已提交
1883
		tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
1884

1885
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1886
			ret = -EFAULT;
1887 1888
		break;

L
Linus Torvalds 已提交
1889 1890 1891
	case TUNSETNOCSUM:
		/* Disable/Enable checksum */

1892 1893
		/* [unimplemented] */
		tun_debug(KERN_INFO, tun, "ignored: set checksum %s\n",
1894
			  arg ? "disabled" : "enabled");
L
Linus Torvalds 已提交
1895 1896 1897
		break;

	case TUNSETPERSIST:
J
Jason Wang 已提交
1898 1899 1900
		/* Disable/Enable persist mode. Keep an extra reference to the
		 * module to prevent the module being unprobed.
		 */
J
Jason Wang 已提交
1901
		if (arg && !(tun->flags & TUN_PERSIST)) {
L
Linus Torvalds 已提交
1902
			tun->flags |= TUN_PERSIST;
J
Jason Wang 已提交
1903
			__module_get(THIS_MODULE);
J
Jason Wang 已提交
1904 1905
		}
		if (!arg && (tun->flags & TUN_PERSIST)) {
L
Linus Torvalds 已提交
1906
			tun->flags &= ~TUN_PERSIST;
J
Jason Wang 已提交
1907 1908
			module_put(THIS_MODULE);
		}
L
Linus Torvalds 已提交
1909

1910 1911
		tun_debug(KERN_INFO, tun, "persist %s\n",
			  arg ? "enabled" : "disabled");
L
Linus Torvalds 已提交
1912 1913 1914 1915
		break;

	case TUNSETOWNER:
		/* Set owner of the device */
1916 1917 1918 1919 1920 1921
		owner = make_kuid(current_user_ns(), arg);
		if (!uid_valid(owner)) {
			ret = -EINVAL;
			break;
		}
		tun->owner = owner;
1922
		tun_debug(KERN_INFO, tun, "owner set to %u\n",
1923
			  from_kuid(&init_user_ns, tun->owner));
L
Linus Torvalds 已提交
1924 1925
		break;

1926 1927
	case TUNSETGROUP:
		/* Set group of the device */
1928 1929 1930 1931 1932 1933
		group = make_kgid(current_user_ns(), arg);
		if (!gid_valid(group)) {
			ret = -EINVAL;
			break;
		}
		tun->group = group;
1934
		tun_debug(KERN_INFO, tun, "group set to %u\n",
1935
			  from_kgid(&init_user_ns, tun->group));
1936 1937
		break;

1938 1939 1940
	case TUNSETLINK:
		/* Only allow setting the type when the interface is down */
		if (tun->dev->flags & IFF_UP) {
1941 1942
			tun_debug(KERN_INFO, tun,
				  "Linktype set failed because interface is up\n");
1943
			ret = -EBUSY;
1944 1945
		} else {
			tun->dev->type = (int) arg;
1946 1947
			tun_debug(KERN_INFO, tun, "linktype set to %d\n",
				  tun->dev->type);
1948
			ret = 0;
1949
		}
E
Eric W. Biederman 已提交
1950
		break;
1951

L
Linus Torvalds 已提交
1952 1953 1954 1955 1956
#ifdef TUN_DEBUG
	case TUNSETDEBUG:
		tun->debug = arg;
		break;
#endif
1957
	case TUNSETOFFLOAD:
1958
		ret = set_offload(tun, arg);
E
Eric W. Biederman 已提交
1959
		break;
1960

1961 1962
	case TUNSETTXFILTER:
		/* Can be set only for TAPs */
E
Eric W. Biederman 已提交
1963
		ret = -EINVAL;
1964
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
E
Eric W. Biederman 已提交
1965
			break;
H
Harvey Harrison 已提交
1966
		ret = update_filter(&tun->txflt, (void __user *)arg);
E
Eric W. Biederman 已提交
1967
		break;
L
Linus Torvalds 已提交
1968 1969

	case SIOCGIFHWADDR:
1970
		/* Get hw address */
1971 1972
		memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN);
		ifr.ifr_hwaddr.sa_family = tun->dev->type;
1973
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1974 1975
			ret = -EFAULT;
		break;
L
Linus Torvalds 已提交
1976 1977

	case SIOCSIFHWADDR:
1978
		/* Set hw address */
1979 1980
		tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n",
			  ifr.ifr_hwaddr.sa_data);
1981 1982

		ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
E
Eric W. Biederman 已提交
1983
		break;
1984 1985

	case TUNGETSNDBUF:
J
Jason Wang 已提交
1986
		sndbuf = tfile->socket.sk->sk_sndbuf;
1987 1988 1989 1990 1991 1992 1993 1994 1995 1996
		if (copy_to_user(argp, &sndbuf, sizeof(sndbuf)))
			ret = -EFAULT;
		break;

	case TUNSETSNDBUF:
		if (copy_from_user(&sndbuf, argp, sizeof(sndbuf))) {
			ret = -EFAULT;
			break;
		}

J
Jason Wang 已提交
1997 1998
		tun->sndbuf = sndbuf;
		tun_set_sndbuf(tun);
1999 2000
		break;

2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019
	case TUNGETVNETHDRSZ:
		vnet_hdr_sz = tun->vnet_hdr_sz;
		if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
			ret = -EFAULT;
		break;

	case TUNSETVNETHDRSZ:
		if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
			ret = -EFAULT;
			break;
		}
		if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
			ret = -EINVAL;
			break;
		}

		tun->vnet_hdr_sz = vnet_hdr_sz;
		break;

M
Michael S. Tsirkin 已提交
2020 2021 2022 2023 2024 2025
	case TUNATTACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
		ret = -EFAULT;
J
Jason Wang 已提交
2026
		if (copy_from_user(&tun->fprog, argp, sizeof(tun->fprog)))
M
Michael S. Tsirkin 已提交
2027 2028
			break;

J
Jason Wang 已提交
2029
		ret = tun_attach_filter(tun);
M
Michael S. Tsirkin 已提交
2030 2031 2032 2033 2034 2035 2036
		break;

	case TUNDETACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
J
Jason Wang 已提交
2037 2038
		ret = 0;
		tun_detach_filter(tun, tun->numqueues);
M
Michael S. Tsirkin 已提交
2039 2040
		break;

L
Linus Torvalds 已提交
2041
	default:
E
Eric W. Biederman 已提交
2042 2043
		ret = -EINVAL;
		break;
2044
	}
L
Linus Torvalds 已提交
2045

2046 2047 2048 2049
unlock:
	rtnl_unlock();
	if (tun)
		tun_put(tun);
E
Eric W. Biederman 已提交
2050
	return ret;
L
Linus Torvalds 已提交
2051 2052
}

2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087
static long tun_chr_ioctl(struct file *file,
			  unsigned int cmd, unsigned long arg)
{
	return __tun_chr_ioctl(file, cmd, arg, sizeof (struct ifreq));
}

#ifdef CONFIG_COMPAT
static long tun_chr_compat_ioctl(struct file *file,
			 unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case TUNSETIFF:
	case TUNGETIFF:
	case TUNSETTXFILTER:
	case TUNGETSNDBUF:
	case TUNSETSNDBUF:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
		arg = (unsigned long)compat_ptr(arg);
		break;
	default:
		arg = (compat_ulong_t)arg;
		break;
	}

	/*
	 * compat_ifreq is shorter than ifreq, so we must not access beyond
	 * the end of that structure. All fields that are used in this
	 * driver are compatible though, we don't need to convert the
	 * contents.
	 */
	return __tun_chr_ioctl(file, cmd, arg, sizeof(struct compat_ifreq));
}
#endif /* CONFIG_COMPAT */

L
Linus Torvalds 已提交
2088 2089
static int tun_chr_fasync(int fd, struct file *file, int on)
{
J
Jason Wang 已提交
2090
	struct tun_file *tfile = file->private_data;
L
Linus Torvalds 已提交
2091 2092
	int ret;

J
Jason Wang 已提交
2093
	if ((ret = fasync_helper(fd, file, on, &tfile->fasync)) < 0)
J
Jonathan Corbet 已提交
2094
		goto out;
2095

L
Linus Torvalds 已提交
2096
	if (on) {
2097
		ret = __f_setown(file, task_pid(current), PIDTYPE_PID, 0);
L
Linus Torvalds 已提交
2098
		if (ret)
J
Jonathan Corbet 已提交
2099
			goto out;
J
Jason Wang 已提交
2100
		tfile->flags |= TUN_FASYNC;
2101
	} else
J
Jason Wang 已提交
2102
		tfile->flags &= ~TUN_FASYNC;
J
Jonathan Corbet 已提交
2103 2104 2105
	ret = 0;
out:
	return ret;
L
Linus Torvalds 已提交
2106 2107 2108 2109
}

static int tun_chr_open(struct inode *inode, struct file * file)
{
E
Eric W. Biederman 已提交
2110
	struct tun_file *tfile;
T
Thomas Gleixner 已提交
2111

2112
	DBG1(KERN_INFO, "tunX: tun_chr_open\n");
E
Eric W. Biederman 已提交
2113

J
Jason Wang 已提交
2114 2115
	tfile = (struct tun_file *)sk_alloc(&init_net, AF_UNSPEC, GFP_KERNEL,
					    &tun_proto);
E
Eric W. Biederman 已提交
2116 2117
	if (!tfile)
		return -ENOMEM;
2118
	rcu_assign_pointer(tfile->tun, NULL);
E
Eric W. Biederman 已提交
2119
	tfile->net = get_net(current->nsproxy->net_ns);
J
Jason Wang 已提交
2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133
	tfile->flags = 0;

	rcu_assign_pointer(tfile->socket.wq, &tfile->wq);
	init_waitqueue_head(&tfile->wq.wait);

	tfile->socket.file = file;
	tfile->socket.ops = &tun_socket_ops;

	sock_init_data(&tfile->socket, &tfile->sk);
	sk_change_net(&tfile->sk, tfile->net);

	tfile->sk.sk_write_space = tun_sock_write_space;
	tfile->sk.sk_sndbuf = INT_MAX;

E
Eric W. Biederman 已提交
2134
	file->private_data = tfile;
J
Jason Wang 已提交
2135
	set_bit(SOCK_EXTERNALLY_ALLOCATED, &tfile->socket.flags);
J
Jason Wang 已提交
2136
	INIT_LIST_HEAD(&tfile->next);
J
Jason Wang 已提交
2137

L
Linus Torvalds 已提交
2138 2139 2140 2141 2142
	return 0;
}

static int tun_chr_close(struct inode *inode, struct file *file)
{
E
Eric W. Biederman 已提交
2143
	struct tun_file *tfile = file->private_data;
J
Jason Wang 已提交
2144
	struct net *net = tfile->net;
L
Linus Torvalds 已提交
2145

J
Jason Wang 已提交
2146
	tun_detach(tfile, true);
J
Jason Wang 已提交
2147
	put_net(net);
L
Linus Torvalds 已提交
2148 2149 2150 2151

	return 0;
}

2152
static const struct file_operations tun_fops = {
2153
	.owner	= THIS_MODULE,
L
Linus Torvalds 已提交
2154
	.llseek = no_llseek,
2155 2156 2157 2158
	.read  = do_sync_read,
	.aio_read  = tun_chr_aio_read,
	.write = do_sync_write,
	.aio_write = tun_chr_aio_write,
L
Linus Torvalds 已提交
2159
	.poll	= tun_chr_poll,
2160 2161 2162 2163
	.unlocked_ioctl	= tun_chr_ioctl,
#ifdef CONFIG_COMPAT
	.compat_ioctl = tun_chr_compat_ioctl,
#endif
L
Linus Torvalds 已提交
2164 2165
	.open	= tun_chr_open,
	.release = tun_chr_close,
2166
	.fasync = tun_chr_fasync
L
Linus Torvalds 已提交
2167 2168 2169 2170 2171
};

static struct miscdevice tun_miscdev = {
	.minor = TUN_MINOR,
	.name = "tun",
2172
	.nodename = "net/tun",
L
Linus Torvalds 已提交
2173 2174 2175 2176 2177 2178 2179 2180 2181
	.fops = &tun_fops,
};

/* ethtool interface */

static int tun_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
	cmd->supported		= 0;
	cmd->advertising	= 0;
2182
	ethtool_cmd_speed_set(cmd, SPEED_10);
L
Linus Torvalds 已提交
2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196
	cmd->duplex		= DUPLEX_FULL;
	cmd->port		= PORT_TP;
	cmd->phy_address	= 0;
	cmd->transceiver	= XCVR_INTERNAL;
	cmd->autoneg		= AUTONEG_DISABLE;
	cmd->maxtxpkt		= 0;
	cmd->maxrxpkt		= 0;
	return 0;
}

static void tun_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
{
	struct tun_struct *tun = netdev_priv(dev);

2197 2198
	strlcpy(info->driver, DRV_NAME, sizeof(info->driver));
	strlcpy(info->version, DRV_VERSION, sizeof(info->version));
L
Linus Torvalds 已提交
2199 2200 2201

	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
2202
		strlcpy(info->bus_info, "tun", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2203 2204
		break;
	case TUN_TAP_DEV:
2205
		strlcpy(info->bus_info, "tap", sizeof(info->bus_info));
L
Linus Torvalds 已提交
2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227
		break;
	}
}

static u32 tun_get_msglevel(struct net_device *dev)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	return tun->debug;
#else
	return -EOPNOTSUPP;
#endif
}

static void tun_set_msglevel(struct net_device *dev, u32 value)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	tun->debug = value;
#endif
}

2228
static const struct ethtool_ops tun_ethtool_ops = {
L
Linus Torvalds 已提交
2229 2230 2231 2232
	.get_settings	= tun_get_settings,
	.get_drvinfo	= tun_get_drvinfo,
	.get_msglevel	= tun_get_msglevel,
	.set_msglevel	= tun_set_msglevel,
2233
	.get_link	= ethtool_op_get_link,
L
Linus Torvalds 已提交
2234 2235
};

2236

L
Linus Torvalds 已提交
2237 2238 2239 2240
static int __init tun_init(void)
{
	int ret = 0;

2241 2242
	pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
	pr_info("%s\n", DRV_COPYRIGHT);
L
Linus Torvalds 已提交
2243

2244
	ret = rtnl_link_register(&tun_link_ops);
2245
	if (ret) {
2246
		pr_err("Can't register link_ops\n");
2247
		goto err_linkops;
2248 2249
	}

L
Linus Torvalds 已提交
2250
	ret = misc_register(&tun_miscdev);
2251
	if (ret) {
2252
		pr_err("Can't register misc device %d\n", TUN_MINOR);
2253 2254
		goto err_misc;
	}
2255
	return  0;
2256
err_misc:
2257 2258
	rtnl_link_unregister(&tun_link_ops);
err_linkops:
L
Linus Torvalds 已提交
2259 2260 2261 2262 2263
	return ret;
}

static void tun_cleanup(void)
{
2264
	misc_deregister(&tun_miscdev);
2265
	rtnl_link_unregister(&tun_link_ops);
L
Linus Torvalds 已提交
2266 2267
}

2268 2269 2270 2271 2272 2273
/* Get an underlying socket object from tun file.  Returns error unless file is
 * attached to a device.  The returned object works like a packet socket, it
 * can be used for sock_sendmsg/sock_recvmsg.  The caller is responsible for
 * holding a reference to the file for as long as the socket is in use. */
struct socket *tun_get_socket(struct file *file)
{
2274
	struct tun_file *tfile;
2275 2276
	if (file->f_op != &tun_fops)
		return ERR_PTR(-EINVAL);
2277 2278
	tfile = file->private_data;
	if (!tfile)
2279
		return ERR_PTR(-EBADFD);
J
Jason Wang 已提交
2280
	return &tfile->socket;
2281 2282 2283
}
EXPORT_SYMBOL_GPL(tun_get_socket);

L
Linus Torvalds 已提交
2284 2285 2286 2287 2288 2289
module_init(tun_init);
module_exit(tun_cleanup);
MODULE_DESCRIPTION(DRV_DESCRIPTION);
MODULE_AUTHOR(DRV_COPYRIGHT);
MODULE_LICENSE("GPL");
MODULE_ALIAS_MISCDEV(TUN_MINOR);
2290
MODULE_ALIAS("devname:net/tun");