tun.c 38.0 KB
Newer Older
L
Linus Torvalds 已提交
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
/*
 *  TUN - Universal TUN/TAP device driver.
 *  Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com>
 *
 *  This program is free software; you can redistribute it and/or modify
 *  it under the terms of the GNU General Public License as published by
 *  the Free Software Foundation; either version 2 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 *  GNU General Public License for more details.
 *
 *  $Id: tun.c,v 1.15 2002/03/01 02:44:24 maxk Exp $
 */

/*
 *  Changes:
 *
21 22 23
 *  Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14
 *    Add TUNSETLINK ioctl to set the link encapsulation
 *
L
Linus Torvalds 已提交
24
 *  Mark Smith <markzzzsmith@yahoo.com.au>
25
 *    Use random_ether_addr() for tap MAC address.
L
Linus Torvalds 已提交
26 27 28 29 30 31 32 33 34 35 36
 *
 *  Harald Roelle <harald.roelle@ifi.lmu.de>  2004/04/20
 *    Fixes in packet dropping, queue length setting and queue wakeup.
 *    Increased default tx queue length.
 *    Added ethtool API.
 *    Minor cleanups
 *
 *  Daniel Podlejski <underley@underley.eu.org>
 *    Modifications for 2.3.99-pre5 kernel.
 */

37 38
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt

L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57
#define DRV_NAME	"tun"
#define DRV_VERSION	"1.6"
#define DRV_DESCRIPTION	"Universal TUN/TAP device driver"
#define DRV_COPYRIGHT	"(C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>"

#include <linux/module.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/major.h>
#include <linux/slab.h>
#include <linux/poll.h>
#include <linux/fcntl.h>
#include <linux/init.h>
#include <linux/skbuff.h>
#include <linux/netdevice.h>
#include <linux/etherdevice.h>
#include <linux/miscdevice.h>
#include <linux/ethtool.h>
#include <linux/rtnetlink.h>
58
#include <linux/compat.h>
L
Linus Torvalds 已提交
59 60 61 62 63
#include <linux/if.h>
#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/if_tun.h>
#include <linux/crc32.h>
64
#include <linux/nsproxy.h>
65
#include <linux/virtio_net.h>
M
Michael S. Tsirkin 已提交
66
#include <linux/rcupdate.h>
67
#include <net/net_namespace.h>
68
#include <net/netns/generic.h>
69
#include <net/rtnetlink.h>
70
#include <net/sock.h>
L
Linus Torvalds 已提交
71 72 73 74

#include <asm/system.h>
#include <asm/uaccess.h>

75 76 77
/* Uncomment to enable debugging */
/* #define TUN_DEBUG 1 */

L
Linus Torvalds 已提交
78 79
#ifdef TUN_DEBUG
static int debug;
80

81 82 83 84 85 86 87 88 89 90
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (tun->debug)						\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (debug == 2)						\
		printk(level fmt, ##args);			\
} while (0)
91
#else
92 93 94 95 96 97 98 99 100 101
#define tun_debug(level, tun, fmt, args...)			\
do {								\
	if (0)							\
		netdev_printk(level, tun->dev, fmt, ##args);	\
} while (0)
#define DBG1(level, fmt, args...)				\
do {								\
	if (0)							\
		printk(level fmt, ##args);			\
} while (0)
102 103
#endif

104 105 106 107 108 109 110
#define FLT_EXACT_COUNT 8
struct tap_filter {
	unsigned int    count;    /* Number of addrs. Zero means disabled */
	u32             mask[2];  /* Mask of the hashed addrs */
	unsigned char	addr[FLT_EXACT_COUNT][ETH_ALEN];
};

E
Eric W. Biederman 已提交
111
struct tun_file {
112
	atomic_t count;
E
Eric W. Biederman 已提交
113
	struct tun_struct *tun;
E
Eric W. Biederman 已提交
114
	struct net *net;
E
Eric W. Biederman 已提交
115 116
};

117 118
struct tun_sock;

119
struct tun_struct {
E
Eric W. Biederman 已提交
120
	struct tun_file		*tfile;
121
	unsigned int 		flags;
122 123 124 125
	uid_t			owner;
	gid_t			group;

	struct net_device	*dev;
126 127 128
	u32			set_features;
#define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \
			  NETIF_F_TSO6|NETIF_F_UFO)
129
	struct fasync_struct	*fasync;
130

131
	struct tap_filter       txflt;
132
	struct socket		socket;
133
	struct socket_wq	wq;
134 135 136

	int			vnet_hdr_sz;

137 138
#ifdef TUN_DEBUG
	int debug;
L
Linus Torvalds 已提交
139
#endif
140
};
L
Linus Torvalds 已提交
141

142 143 144 145 146 147 148 149 150 151
struct tun_sock {
	struct sock		sk;
	struct tun_struct	*tun;
};

static inline struct tun_sock *tun_sk(struct sock *sk)
{
	return container_of(sk, struct tun_sock, sk);
}

152 153
static int tun_attach(struct tun_struct *tun, struct file *file)
{
E
Eric W. Biederman 已提交
154
	struct tun_file *tfile = file->private_data;
155
	int err;
156 157 158

	ASSERT_RTNL();

159 160 161 162 163 164 165 166 167 168 169
	netif_tx_lock_bh(tun->dev);

	err = -EINVAL;
	if (tfile->tun)
		goto out;

	err = -EBUSY;
	if (tun->tfile)
		goto out;

	err = 0;
E
Eric W. Biederman 已提交
170 171
	tfile->tun = tun;
	tun->tfile = tfile;
172
	tun->socket.file = file;
173
	netif_carrier_on(tun->dev);
174
	dev_hold(tun->dev);
175
	sock_hold(tun->socket.sk);
176
	atomic_inc(&tfile->count);
177

178 179 180
out:
	netif_tx_unlock_bh(tun->dev);
	return err;
181 182
}

E
Eric W. Biederman 已提交
183 184 185
static void __tun_detach(struct tun_struct *tun)
{
	/* Detach from net device */
186
	netif_tx_lock_bh(tun->dev);
187
	netif_carrier_off(tun->dev);
E
Eric W. Biederman 已提交
188
	tun->tfile = NULL;
189
	tun->socket.file = NULL;
190
	netif_tx_unlock_bh(tun->dev);
E
Eric W. Biederman 已提交
191 192

	/* Drop read queue */
193
	skb_queue_purge(&tun->socket.sk->sk_receive_queue);
194 195 196 197 198 199 200 201 202 203

	/* Drop the extra count on the net device */
	dev_put(tun->dev);
}

static void tun_detach(struct tun_struct *tun)
{
	rtnl_lock();
	__tun_detach(tun);
	rtnl_unlock();
E
Eric W. Biederman 已提交
204 205 206 207
}

static struct tun_struct *__tun_get(struct tun_file *tfile)
{
208 209 210 211 212 213
	struct tun_struct *tun = NULL;

	if (atomic_inc_not_zero(&tfile->count))
		tun = tfile->tun;

	return tun;
E
Eric W. Biederman 已提交
214 215 216 217 218 219 220 221 222
}

static struct tun_struct *tun_get(struct file *file)
{
	return __tun_get(file->private_data);
}

static void tun_put(struct tun_struct *tun)
{
223 224 225 226
	struct tun_file *tfile = tun->tfile;

	if (atomic_dec_and_test(&tfile->count))
		tun_detach(tfile->tun);
E
Eric W. Biederman 已提交
227 228
}

229
/* TAP filtering */
230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278
static void addr_hash_set(u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	mask[n >> 5] |= (1 << (n & 31));
}

static unsigned int addr_hash_test(const u32 *mask, const u8 *addr)
{
	int n = ether_crc(ETH_ALEN, addr) >> 26;
	return mask[n >> 5] & (1 << (n & 31));
}

static int update_filter(struct tap_filter *filter, void __user *arg)
{
	struct { u8 u[ETH_ALEN]; } *addr;
	struct tun_filter uf;
	int err, alen, n, nexact;

	if (copy_from_user(&uf, arg, sizeof(uf)))
		return -EFAULT;

	if (!uf.count) {
		/* Disabled */
		filter->count = 0;
		return 0;
	}

	alen = ETH_ALEN * uf.count;
	addr = kmalloc(alen, GFP_KERNEL);
	if (!addr)
		return -ENOMEM;

	if (copy_from_user(addr, arg + sizeof(uf), alen)) {
		err = -EFAULT;
		goto done;
	}

	/* The filter is updated without holding any locks. Which is
	 * perfectly safe. We disable it first and in the worst
	 * case we'll accept a few undesired packets. */
	filter->count = 0;
	wmb();

	/* Use first set of addresses as an exact filter */
	for (n = 0; n < uf.count && n < FLT_EXACT_COUNT; n++)
		memcpy(filter->addr[n], addr[n].u, ETH_ALEN);

	nexact = n;

279 280
	/* Remaining multicast addresses are hashed,
	 * unicast will leave the filter disabled. */
281
	memset(filter->mask, 0, sizeof(filter->mask));
282 283 284 285 286
	for (; n < uf.count; n++) {
		if (!is_multicast_ether_addr(addr[n].u)) {
			err = 0; /* no filter */
			goto done;
		}
287
		addr_hash_set(filter->mask, addr[n].u);
288
	}
289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338

	/* For ALLMULTI just set the mask to all ones.
	 * This overrides the mask populated above. */
	if ((uf.flags & TUN_FLT_ALLMULTI))
		memset(filter->mask, ~0, sizeof(filter->mask));

	/* Now enable the filter */
	wmb();
	filter->count = nexact;

	/* Return the number of exact filters */
	err = nexact;

done:
	kfree(addr);
	return err;
}

/* Returns: 0 - drop, !=0 - accept */
static int run_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	/* Cannot use eth_hdr(skb) here because skb_mac_hdr() is incorrect
	 * at this point. */
	struct ethhdr *eh = (struct ethhdr *) skb->data;
	int i;

	/* Exact match */
	for (i = 0; i < filter->count; i++)
		if (!compare_ether_addr(eh->h_dest, filter->addr[i]))
			return 1;

	/* Inexact match (multicast only) */
	if (is_multicast_ether_addr(eh->h_dest))
		return addr_hash_test(filter->mask, eh->h_dest);

	return 0;
}

/*
 * Checks whether the packet is accepted or not.
 * Returns: 0 - drop, !=0 - accept
 */
static int check_filter(struct tap_filter *filter, const struct sk_buff *skb)
{
	if (!filter->count)
		return 1;

	return run_filter(filter, skb);
}

L
Linus Torvalds 已提交
339 340
/* Network device part of the driver */

341
static const struct ethtool_ops tun_ethtool_ops;
L
Linus Torvalds 已提交
342

343 344 345 346 347 348 349 350 351
/* Net device detach from fd. */
static void tun_net_uninit(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
	struct tun_file *tfile = tun->tfile;

	/* Inform the methods they need to stop using the dev.
	 */
	if (tfile) {
352
		wake_up_all(&tun->wq.wait);
353 354 355 356 357
		if (atomic_dec_and_test(&tfile->count))
			__tun_detach(tun);
	}
}

358 359 360 361
static void tun_free_netdev(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

362
	sock_put(tun->socket.sk);
363 364
}

L
Linus Torvalds 已提交
365 366 367 368 369 370 371 372 373 374 375 376 377 378 379
/* Net device open. */
static int tun_net_open(struct net_device *dev)
{
	netif_start_queue(dev);
	return 0;
}

/* Net device close. */
static int tun_net_close(struct net_device *dev)
{
	netif_stop_queue(dev);
	return 0;
}

/* Net device start xmit */
380
static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
L
Linus Torvalds 已提交
381 382 383
{
	struct tun_struct *tun = netdev_priv(dev);

384
	tun_debug(KERN_INFO, tun, "tun_net_xmit %d\n", skb->len);
L
Linus Torvalds 已提交
385 386

	/* Drop packet if interface is not attached */
E
Eric W. Biederman 已提交
387
	if (!tun->tfile)
L
Linus Torvalds 已提交
388 389
		goto drop;

390 391 392 393 394 395
	/* Drop if the filter does not like it.
	 * This is a noop if the filter is disabled.
	 * Filter can be enabled only for the TAP devices. */
	if (!check_filter(&tun->txflt, skb))
		goto drop;

M
Michael S. Tsirkin 已提交
396 397 398 399
	if (tun->socket.sk->sk_filter &&
	    sk_filter(tun->socket.sk, skb))
		goto drop;

400
	if (skb_queue_len(&tun->socket.sk->sk_receive_queue) >= dev->tx_queue_len) {
L
Linus Torvalds 已提交
401 402 403 404 405 406 407
		if (!(tun->flags & TUN_ONE_QUEUE)) {
			/* Normal queueing mode. */
			/* Packet scheduler handles dropping of further packets. */
			netif_stop_queue(dev);

			/* We won't see all dropped packets individually, so overrun
			 * error is more appropriate. */
408
			dev->stats.tx_fifo_errors++;
L
Linus Torvalds 已提交
409 410 411 412 413 414 415
		} else {
			/* Single queue mode.
			 * Driver handles dropping of all packets itself. */
			goto drop;
		}
	}

M
Michael S. Tsirkin 已提交
416 417 418 419
	/* Orphan the skb - required as we might hang on to it
	 * for indefinite time. */
	skb_orphan(skb);

420
	/* Enqueue packet */
421
	skb_queue_tail(&tun->socket.sk->sk_receive_queue, skb);
L
Linus Torvalds 已提交
422 423 424 425

	/* Notify and wake up reader process */
	if (tun->flags & TUN_FASYNC)
		kill_fasync(&tun->fasync, SIGIO, POLL_IN);
426
	wake_up_interruptible_poll(&tun->wq.wait, POLLIN |
427
				   POLLRDNORM | POLLRDBAND);
428
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
429 430

drop:
431
	dev->stats.tx_dropped++;
L
Linus Torvalds 已提交
432
	kfree_skb(skb);
433
	return NETDEV_TX_OK;
L
Linus Torvalds 已提交
434 435
}

436
static void tun_net_mclist(struct net_device *dev)
L
Linus Torvalds 已提交
437
{
438 439 440 441 442
	/*
	 * This callback is supposed to deal with mc filter in
	 * _rx_ path and has nothing to do with the _tx_ path.
	 * In rx path we always accept everything userspace gives us.
	 */
L
Linus Torvalds 已提交
443 444
}

E
Ed Swierk 已提交
445 446 447 448 449 450 451 452 453 454 455 456
#define MIN_MTU 68
#define MAX_MTU 65535

static int
tun_net_change_mtu(struct net_device *dev, int new_mtu)
{
	if (new_mtu < MIN_MTU || new_mtu + dev->hard_header_len > MAX_MTU)
		return -EINVAL;
	dev->mtu = new_mtu;
	return 0;
}

457 458 459 460 461 462
static u32 tun_net_fix_features(struct net_device *dev, u32 features)
{
	struct tun_struct *tun = netdev_priv(dev);

	return (features & tun->set_features) | (features & ~TUN_USER_FEATURES);
}
463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479
#ifdef CONFIG_NET_POLL_CONTROLLER
static void tun_poll_controller(struct net_device *dev)
{
	/*
	 * Tun only receives frames when:
	 * 1) the char device endpoint gets data from user space
	 * 2) the tun socket gets a sendmsg call from user space
	 * Since both of those are syncronous operations, we are guaranteed
	 * never to have pending data when we poll for it
	 * so theres nothing to do here but return.
	 * We need this though so netpoll recognizes us as an interface that
	 * supports polling, which enables bridge devices in virt setups to
	 * still use netconsole
	 */
	return;
}
#endif
S
Stephen Hemminger 已提交
480
static const struct net_device_ops tun_netdev_ops = {
481
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
482 483
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
484
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
485
	.ndo_change_mtu		= tun_net_change_mtu,
486
	.ndo_fix_features	= tun_net_fix_features,
487 488 489
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
490 491 492
};

static const struct net_device_ops tap_netdev_ops = {
493
	.ndo_uninit		= tun_net_uninit,
S
Stephen Hemminger 已提交
494 495
	.ndo_open		= tun_net_open,
	.ndo_stop		= tun_net_close,
496
	.ndo_start_xmit		= tun_net_xmit,
S
Stephen Hemminger 已提交
497
	.ndo_change_mtu		= tun_net_change_mtu,
498
	.ndo_fix_features	= tun_net_fix_features,
S
Stephen Hemminger 已提交
499 500 501
	.ndo_set_multicast_list	= tun_net_mclist,
	.ndo_set_mac_address	= eth_mac_addr,
	.ndo_validate_addr	= eth_validate_addr,
502 503 504
#ifdef CONFIG_NET_POLL_CONTROLLER
	.ndo_poll_controller	= tun_poll_controller,
#endif
S
Stephen Hemminger 已提交
505 506
};

L
Linus Torvalds 已提交
507 508 509 510
/* Initialize net device. */
static void tun_net_init(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);
511

L
Linus Torvalds 已提交
512 513
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
S
Stephen Hemminger 已提交
514 515
		dev->netdev_ops = &tun_netdev_ops;

L
Linus Torvalds 已提交
516 517 518 519 520 521
		/* Point-to-Point TUN Device */
		dev->hard_header_len = 0;
		dev->addr_len = 0;
		dev->mtu = 1500;

		/* Zero header length */
522
		dev->type = ARPHRD_NONE;
L
Linus Torvalds 已提交
523 524 525 526 527
		dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;

	case TUN_TAP_DEV:
K
Kusanagi Kouichi 已提交
528
		dev->netdev_ops = &tap_netdev_ops;
L
Linus Torvalds 已提交
529 530
		/* Ethernet TAP Device */
		ether_setup(dev);
531

532
		random_ether_addr(dev->dev_addr);
533

L
Linus Torvalds 已提交
534 535 536 537 538 539 540 541 542
		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
		break;
	}
}

/* Character device part */

/* Poll */
static unsigned int tun_chr_poll(struct file *file, poll_table * wait)
543
{
544 545
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
546
	struct sock *sk;
547
	unsigned int mask = 0;
L
Linus Torvalds 已提交
548 549

	if (!tun)
550
		return POLLERR;
L
Linus Torvalds 已提交
551

552
	sk = tun->socket.sk;
553

554
	tun_debug(KERN_INFO, tun, "tun_chr_poll\n");
L
Linus Torvalds 已提交
555

556
	poll_wait(file, &tun->wq.wait, wait);
557

558
	if (!skb_queue_empty(&sk->sk_receive_queue))
L
Linus Torvalds 已提交
559 560
		mask |= POLLIN | POLLRDNORM;

561 562 563 564 565
	if (sock_writeable(sk) ||
	    (!test_and_set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags) &&
	     sock_writeable(sk)))
		mask |= POLLOUT | POLLWRNORM;

566 567 568
	if (tun->dev->reg_state != NETREG_REGISTERED)
		mask = POLLERR;

E
Eric W. Biederman 已提交
569
	tun_put(tun);
L
Linus Torvalds 已提交
570 571 572
	return mask;
}

573 574
/* prepad is the amount to reserve at front.  len is length after that.
 * linear is a hint as to how much to copy (usually headers). */
575 576 577
static inline struct sk_buff *tun_alloc_skb(struct tun_struct *tun,
					    size_t prepad, size_t len,
					    size_t linear, int noblock)
578
{
579
	struct sock *sk = tun->socket.sk;
580
	struct sk_buff *skb;
581
	int err;
582

583 584
	sock_update_classid(sk);

585
	/* Under a page?  Don't bother with paged skb. */
H
Herbert Xu 已提交
586
	if (prepad + len < PAGE_SIZE || !linear)
587
		linear = len;
588

589 590
	skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
				   &err);
591
	if (!skb)
592
		return ERR_PTR(err);
593 594 595

	skb_reserve(skb, prepad);
	skb_put(skb, linear);
596 597
	skb->data_len = len - linear;
	skb->len += len - linear;
598 599 600 601

	return skb;
}

L
Linus Torvalds 已提交
602
/* Get packet from user space buffer */
603
static __inline__ ssize_t tun_get_user(struct tun_struct *tun,
604
				       const struct iovec *iv, size_t count,
605
				       int noblock)
L
Linus Torvalds 已提交
606
{
607
	struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) };
L
Linus Torvalds 已提交
608 609
	struct sk_buff *skb;
	size_t len = count, align = 0;
610
	struct virtio_net_hdr gso = { 0 };
611
	int offset = 0;
L
Linus Torvalds 已提交
612 613 614 615 616

	if (!(tun->flags & TUN_NO_PI)) {
		if ((len -= sizeof(pi)) > count)
			return -EINVAL;

617
		if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
L
Linus Torvalds 已提交
618
			return -EFAULT;
619
		offset += sizeof(pi);
L
Linus Torvalds 已提交
620 621
	}

622
	if (tun->flags & TUN_VNET_HDR) {
623
		if ((len -= tun->vnet_hdr_sz) > count)
624 625
			return -EINVAL;

626
		if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
627 628
			return -EFAULT;

629 630 631 632
		if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
		    gso.csum_start + gso.csum_offset + 2 > gso.hdr_len)
			gso.hdr_len = gso.csum_start + gso.csum_offset + 2;

633 634
		if (gso.hdr_len > len)
			return -EINVAL;
635
		offset += tun->vnet_hdr_sz;
636 637
	}

638
	if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) {
L
Linus Torvalds 已提交
639
		align = NET_IP_ALIGN;
H
Herbert Xu 已提交
640 641
		if (unlikely(len < ETH_HLEN ||
			     (gso.hdr_len && gso.hdr_len < ETH_HLEN)))
642 643
			return -EINVAL;
	}
644

645 646 647 648 649
	skb = tun_alloc_skb(tun, align, len, gso.hdr_len, noblock);
	if (IS_ERR(skb)) {
		if (PTR_ERR(skb) != -EAGAIN)
			tun->dev->stats.rx_dropped++;
		return PTR_ERR(skb);
L
Linus Torvalds 已提交
650 651
	}

652
	if (skb_copy_datagram_from_iovec(skb, 0, iv, offset, len)) {
653
		tun->dev->stats.rx_dropped++;
D
Dave Jones 已提交
654
		kfree_skb(skb);
L
Linus Torvalds 已提交
655
		return -EFAULT;
D
Dave Jones 已提交
656
	}
L
Linus Torvalds 已提交
657

658 659 660 661 662 663 664
	if (gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
		if (!skb_partial_csum_set(skb, gso.csum_start,
					  gso.csum_offset)) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}
665
	}
666

L
Linus Torvalds 已提交
667 668
	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
669 670 671 672 673 674 675 676 677 678 679 680 681 682 683
		if (tun->flags & TUN_NO_PI) {
			switch (skb->data[0] & 0xf0) {
			case 0x40:
				pi.proto = htons(ETH_P_IP);
				break;
			case 0x60:
				pi.proto = htons(ETH_P_IPV6);
				break;
			default:
				tun->dev->stats.rx_dropped++;
				kfree_skb(skb);
				return -EINVAL;
			}
		}

684
		skb_reset_mac_header(skb);
L
Linus Torvalds 已提交
685
		skb->protocol = pi.proto;
686
		skb->dev = tun->dev;
L
Linus Torvalds 已提交
687 688 689 690 691 692
		break;
	case TUN_TAP_DEV:
		skb->protocol = eth_type_trans(skb, tun->dev);
		break;
	};

693 694 695 696 697 698 699 700 701
	if (gso.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
		pr_debug("GSO!\n");
		switch (gso.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
		case VIRTIO_NET_HDR_GSO_TCPV4:
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
			break;
		case VIRTIO_NET_HDR_GSO_TCPV6:
			skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
			break;
702 703 704
		case VIRTIO_NET_HDR_GSO_UDP:
			skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
			break;
705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724
		default:
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		if (gso.gso_type & VIRTIO_NET_HDR_GSO_ECN)
			skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;

		skb_shinfo(skb)->gso_size = gso.gso_size;
		if (skb_shinfo(skb)->gso_size == 0) {
			tun->dev->stats.rx_frame_errors++;
			kfree_skb(skb);
			return -EINVAL;
		}

		/* Header must be checked, and gso_segs computed. */
		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
		skb_shinfo(skb)->gso_segs = 0;
	}
725

L
Linus Torvalds 已提交
726
	netif_rx_ni(skb);
727

728 729
	tun->dev->stats.rx_packets++;
	tun->dev->stats.rx_bytes += len;
L
Linus Torvalds 已提交
730 731

	return count;
732
}
L
Linus Torvalds 已提交
733

734 735
static ssize_t tun_chr_aio_write(struct kiocb *iocb, const struct iovec *iv,
			      unsigned long count, loff_t pos)
L
Linus Torvalds 已提交
736
{
737
	struct file *file = iocb->ki_filp;
H
Herbert Xu 已提交
738
	struct tun_struct *tun = tun_get(file);
E
Eric W. Biederman 已提交
739
	ssize_t result;
L
Linus Torvalds 已提交
740 741 742 743

	if (!tun)
		return -EBADFD;

744
	tun_debug(KERN_INFO, tun, "tun_chr_write %ld\n", count);
L
Linus Torvalds 已提交
745

746
	result = tun_get_user(tun, iv, iov_length(iv, count),
747
			      file->f_flags & O_NONBLOCK);
E
Eric W. Biederman 已提交
748 749 750

	tun_put(tun);
	return result;
L
Linus Torvalds 已提交
751 752 753 754 755
}

/* Put packet to the user space buffer */
static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
				       struct sk_buff *skb,
756
				       const struct iovec *iv, int len)
L
Linus Torvalds 已提交
757 758 759 760 761 762 763 764 765 766 767 768
{
	struct tun_pi pi = { 0, skb->protocol };
	ssize_t total = 0;

	if (!(tun->flags & TUN_NO_PI)) {
		if ((len -= sizeof(pi)) < 0)
			return -EINVAL;

		if (len < skb->len) {
			/* Packet will be striped */
			pi.flags |= TUN_PKT_STRIP;
		}
769

770
		if (memcpy_toiovecend(iv, (void *) &pi, 0, sizeof(pi)))
L
Linus Torvalds 已提交
771 772
			return -EFAULT;
		total += sizeof(pi);
773
	}
L
Linus Torvalds 已提交
774

775 776
	if (tun->flags & TUN_VNET_HDR) {
		struct virtio_net_hdr gso = { 0 }; /* no info leak */
777
		if ((len -= tun->vnet_hdr_sz) < 0)
778 779 780 781 782 783 784 785 786 787 788 789
			return -EINVAL;

		if (skb_is_gso(skb)) {
			struct skb_shared_info *sinfo = skb_shinfo(skb);

			/* This is a hint as to how much should be linear. */
			gso.hdr_len = skb_headlen(skb);
			gso.gso_size = sinfo->gso_size;
			if (sinfo->gso_type & SKB_GSO_TCPV4)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
			else if (sinfo->gso_type & SKB_GSO_TCPV6)
				gso.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
790 791
			else if (sinfo->gso_type & SKB_GSO_UDP)
				gso.gso_type = VIRTIO_NET_HDR_GSO_UDP;
792
			else {
793
				pr_err("unexpected GSO type: "
794 795 796 797 798 799 800 801 802 803
				       "0x%x, gso_size %d, hdr_len %d\n",
				       sinfo->gso_type, gso.gso_size,
				       gso.hdr_len);
				print_hex_dump(KERN_ERR, "tun: ",
					       DUMP_PREFIX_NONE,
					       16, 1, skb->head,
					       min((int)gso.hdr_len, 64), true);
				WARN_ON_ONCE(1);
				return -EINVAL;
			}
804 805 806 807 808 809 810
			if (sinfo->gso_type & SKB_GSO_TCP_ECN)
				gso.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
		} else
			gso.gso_type = VIRTIO_NET_HDR_GSO_NONE;

		if (skb->ip_summed == CHECKSUM_PARTIAL) {
			gso.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
811
			gso.csum_start = skb_checksum_start_offset(skb);
812 813 814
			gso.csum_offset = skb->csum_offset;
		} /* else everything is zero */

815 816
		if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total,
					       sizeof(gso))))
817
			return -EFAULT;
818
		total += tun->vnet_hdr_sz;
819 820
	}

L
Linus Torvalds 已提交
821 822
	len = min_t(int, skb->len, len);

823
	skb_copy_datagram_const_iovec(skb, 0, iv, total, len);
824
	total += skb->len;
L
Linus Torvalds 已提交
825

826 827
	tun->dev->stats.tx_packets++;
	tun->dev->stats.tx_bytes += len;
L
Linus Torvalds 已提交
828 829 830 831

	return total;
}

832 833 834
static ssize_t tun_do_read(struct tun_struct *tun,
			   struct kiocb *iocb, const struct iovec *iv,
			   ssize_t len, int noblock)
L
Linus Torvalds 已提交
835 836 837
{
	DECLARE_WAITQUEUE(wait, current);
	struct sk_buff *skb;
838
	ssize_t ret = 0;
L
Linus Torvalds 已提交
839

840
	tun_debug(KERN_INFO, tun, "tun_chr_read\n");
L
Linus Torvalds 已提交
841

842
	add_wait_queue(&tun->wq.wait, &wait);
L
Linus Torvalds 已提交
843 844 845 846
	while (len) {
		current->state = TASK_INTERRUPTIBLE;

		/* Read frames from the queue */
847
		if (!(skb=skb_dequeue(&tun->socket.sk->sk_receive_queue))) {
848
			if (noblock) {
L
Linus Torvalds 已提交
849 850 851 852 853 854 855
				ret = -EAGAIN;
				break;
			}
			if (signal_pending(current)) {
				ret = -ERESTARTSYS;
				break;
			}
856 857 858 859
			if (tun->dev->reg_state != NETREG_REGISTERED) {
				ret = -EIO;
				break;
			}
L
Linus Torvalds 已提交
860 861 862 863 864 865 866

			/* Nothing to read, let's sleep */
			schedule();
			continue;
		}
		netif_wake_queue(tun->dev);

867
		ret = tun_put_user(tun, skb, iv, len);
868 869
		kfree_skb(skb);
		break;
L
Linus Torvalds 已提交
870 871 872
	}

	current->state = TASK_RUNNING;
873
	remove_wait_queue(&tun->wq.wait, &wait);
L
Linus Torvalds 已提交
874

875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895
	return ret;
}

static ssize_t tun_chr_aio_read(struct kiocb *iocb, const struct iovec *iv,
			    unsigned long count, loff_t pos)
{
	struct file *file = iocb->ki_filp;
	struct tun_file *tfile = file->private_data;
	struct tun_struct *tun = __tun_get(tfile);
	ssize_t len, ret;

	if (!tun)
		return -EBADFD;
	len = iov_length(iv, count);
	if (len < 0) {
		ret = -EINVAL;
		goto out;
	}

	ret = tun_do_read(tun, iocb, iv, len, file->f_flags & O_NONBLOCK);
	ret = min_t(ssize_t, ret, len);
E
Eric W. Biederman 已提交
896 897
out:
	tun_put(tun);
L
Linus Torvalds 已提交
898 899 900 901 902 903 904 905
	return ret;
}

static void tun_setup(struct net_device *dev)
{
	struct tun_struct *tun = netdev_priv(dev);

	tun->owner = -1;
906
	tun->group = -1;
L
Linus Torvalds 已提交
907 908

	dev->ethtool_ops = &tun_ethtool_ops;
909
	dev->destructor = tun_free_netdev;
L
Linus Torvalds 已提交
910 911
}

912 913 914 915 916 917 918 919 920 921 922 923 924 925 926
/* Trivial set of netlink ops to allow deleting tun or tap
 * device with netlink.
 */
static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
{
	return -EINVAL;
}

static struct rtnl_link_ops tun_link_ops __read_mostly = {
	.kind		= DRV_NAME,
	.priv_size	= sizeof(struct tun_struct),
	.setup		= tun_setup,
	.validate	= tun_validate,
};

927 928 929
static void tun_sock_write_space(struct sock *sk)
{
	struct tun_struct *tun;
930
	wait_queue_head_t *wqueue;
931 932 933 934 935 936 937

	if (!sock_writeable(sk))
		return;

	if (!test_and_clear_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags))
		return;

938 939 940
	wqueue = sk_sleep(sk);
	if (wqueue && waitqueue_active(wqueue))
		wake_up_interruptible_sync_poll(wqueue, POLLOUT |
941
						POLLWRNORM | POLLWRBAND);
H
Herbert Xu 已提交
942

943
	tun = tun_sk(sk)->tun;
944 945 946 947 948
	kill_fasync(&tun->fasync, SIGIO, POLL_OUT);
}

static void tun_sock_destruct(struct sock *sk)
{
949
	free_netdev(tun_sk(sk)->tun->dev);
950 951
}

952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982
static int tun_sendmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len)
{
	struct tun_struct *tun = container_of(sock, struct tun_struct, socket);
	return tun_get_user(tun, m->msg_iov, total_len,
			    m->msg_flags & MSG_DONTWAIT);
}

static int tun_recvmsg(struct kiocb *iocb, struct socket *sock,
		       struct msghdr *m, size_t total_len,
		       int flags)
{
	struct tun_struct *tun = container_of(sock, struct tun_struct, socket);
	int ret;
	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
		return -EINVAL;
	ret = tun_do_read(tun, iocb, m->msg_iov, total_len,
			  flags & MSG_DONTWAIT);
	if (ret > total_len) {
		m->msg_flags |= MSG_TRUNC;
		ret = flags & MSG_TRUNC ? ret : total_len;
	}
	return ret;
}

/* Ops structure to mimic raw sockets with tun */
static const struct proto_ops tun_socket_ops = {
	.sendmsg = tun_sendmsg,
	.recvmsg = tun_recvmsg,
};

983 984 985 986 987
static struct proto tun_proto = {
	.name		= "tun",
	.owner		= THIS_MODULE,
	.obj_size	= sizeof(struct tun_sock),
};
988

989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034
static int tun_flags(struct tun_struct *tun)
{
	int flags = 0;

	if (tun->flags & TUN_TUN_DEV)
		flags |= IFF_TUN;
	else
		flags |= IFF_TAP;

	if (tun->flags & TUN_NO_PI)
		flags |= IFF_NO_PI;

	if (tun->flags & TUN_ONE_QUEUE)
		flags |= IFF_ONE_QUEUE;

	if (tun->flags & TUN_VNET_HDR)
		flags |= IFF_VNET_HDR;

	return flags;
}

static ssize_t tun_show_flags(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "0x%x\n", tun_flags(tun));
}

static ssize_t tun_show_owner(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "%d\n", tun->owner);
}

static ssize_t tun_show_group(struct device *dev, struct device_attribute *attr,
			      char *buf)
{
	struct tun_struct *tun = netdev_priv(to_net_dev(dev));
	return sprintf(buf, "%d\n", tun->group);
}

static DEVICE_ATTR(tun_flags, 0444, tun_show_flags, NULL);
static DEVICE_ATTR(owner, 0444, tun_show_owner, NULL);
static DEVICE_ATTR(group, 0444, tun_show_group, NULL);

1035
static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
L
Linus Torvalds 已提交
1036
{
1037
	struct sock *sk;
L
Linus Torvalds 已提交
1038 1039 1040 1041
	struct tun_struct *tun;
	struct net_device *dev;
	int err;

1042 1043
	dev = __dev_get_by_name(net, ifr->ifr_name);
	if (dev) {
P
Paul Moore 已提交
1044 1045
		const struct cred *cred = current_cred();

1046 1047
		if (ifr->ifr_flags & IFF_TUN_EXCL)
			return -EBUSY;
1048 1049 1050 1051 1052 1053 1054
		if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops)
			tun = netdev_priv(dev);
		else if ((ifr->ifr_flags & IFF_TAP) && dev->netdev_ops == &tap_netdev_ops)
			tun = netdev_priv(dev);
		else
			return -EINVAL;

P
Paul Moore 已提交
1055 1056 1057 1058
		if (((tun->owner != -1 && cred->euid != tun->owner) ||
		     (tun->group != -1 && !in_egroup_p(tun->group))) &&
		    !capable(CAP_NET_ADMIN))
			return -EPERM;
1059
		err = security_tun_dev_attach(tun->socket.sk);
P
Paul Moore 已提交
1060 1061 1062
		if (err < 0)
			return err;

1063 1064 1065
		err = tun_attach(tun, file);
		if (err < 0)
			return err;
1066
	}
L
Linus Torvalds 已提交
1067 1068 1069 1070
	else {
		char *name;
		unsigned long flags = 0;

1071 1072
		if (!capable(CAP_NET_ADMIN))
			return -EPERM;
P
Paul Moore 已提交
1073 1074 1075
		err = security_tun_dev_create();
		if (err < 0)
			return err;
1076

L
Linus Torvalds 已提交
1077 1078 1079 1080 1081 1082 1083 1084 1085
		/* Set dev type */
		if (ifr->ifr_flags & IFF_TUN) {
			/* TUN device */
			flags |= TUN_TUN_DEV;
			name = "tun%d";
		} else if (ifr->ifr_flags & IFF_TAP) {
			/* TAP device */
			flags |= TUN_TAP_DEV;
			name = "tap%d";
1086
		} else
1087
			return -EINVAL;
1088

L
Linus Torvalds 已提交
1089 1090 1091 1092 1093 1094 1095 1096
		if (*ifr->ifr_name)
			name = ifr->ifr_name;

		dev = alloc_netdev(sizeof(struct tun_struct), name,
				   tun_setup);
		if (!dev)
			return -ENOMEM;

1097
		dev_net_set(dev, net);
1098
		dev->rtnl_link_ops = &tun_link_ops;
S
Stephen Hemminger 已提交
1099

L
Linus Torvalds 已提交
1100 1101 1102
		tun = netdev_priv(dev);
		tun->dev = dev;
		tun->flags = flags;
1103
		tun->txflt.count = 0;
1104
		tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr);
L
Linus Torvalds 已提交
1105

1106 1107 1108 1109 1110
		err = -ENOMEM;
		sk = sk_alloc(net, AF_UNSPEC, GFP_KERNEL, &tun_proto);
		if (!sk)
			goto err_free_dev;

1111 1112
		tun->socket.wq = &tun->wq;
		init_waitqueue_head(&tun->wq.wait);
1113
		tun->socket.ops = &tun_socket_ops;
1114 1115 1116 1117
		sock_init_data(&tun->socket, sk);
		sk->sk_write_space = tun_sock_write_space;
		sk->sk_sndbuf = INT_MAX;

1118
		tun_sk(sk)->tun = tun;
1119

P
Paul Moore 已提交
1120 1121
		security_tun_dev_post_create(sk);

L
Linus Torvalds 已提交
1122 1123
		tun_net_init(dev);

1124 1125 1126 1127
		dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST |
			TUN_USER_FEATURES;
		dev->features = dev->hw_features;

L
Linus Torvalds 已提交
1128 1129
		err = register_netdevice(tun->dev);
		if (err < 0)
1130 1131
			goto err_free_sk;

1132 1133 1134
		if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
		    device_create_file(&tun->dev->dev, &dev_attr_owner) ||
		    device_create_file(&tun->dev->dev, &dev_attr_group))
1135
			pr_err("Failed to create tun sysfs files\n");
1136

1137
		sk->sk_destruct = tun_sock_destruct;
1138 1139 1140

		err = tun_attach(tun, file);
		if (err < 0)
1141
			goto failed;
L
Linus Torvalds 已提交
1142 1143
	}

1144
	tun_debug(KERN_INFO, tun, "tun_set_iff\n");
L
Linus Torvalds 已提交
1145 1146 1147

	if (ifr->ifr_flags & IFF_NO_PI)
		tun->flags |= TUN_NO_PI;
1148 1149
	else
		tun->flags &= ~TUN_NO_PI;
L
Linus Torvalds 已提交
1150 1151 1152

	if (ifr->ifr_flags & IFF_ONE_QUEUE)
		tun->flags |= TUN_ONE_QUEUE;
1153 1154
	else
		tun->flags &= ~TUN_ONE_QUEUE;
L
Linus Torvalds 已提交
1155

1156 1157 1158 1159 1160
	if (ifr->ifr_flags & IFF_VNET_HDR)
		tun->flags |= TUN_VNET_HDR;
	else
		tun->flags &= ~TUN_VNET_HDR;

1161 1162 1163 1164 1165 1166
	/* Make sure persistent devices do not get stuck in
	 * xoff state.
	 */
	if (netif_running(tun->dev))
		netif_wake_queue(tun->dev);

L
Linus Torvalds 已提交
1167 1168 1169
	strcpy(ifr->ifr_name, tun->dev->name);
	return 0;

1170 1171
 err_free_sk:
	sock_put(sk);
L
Linus Torvalds 已提交
1172 1173 1174 1175 1176 1177
 err_free_dev:
	free_netdev(dev);
 failed:
	return err;
}

1178 1179
static int tun_get_iff(struct net *net, struct tun_struct *tun,
		       struct ifreq *ifr)
1180
{
1181
	tun_debug(KERN_INFO, tun, "tun_get_iff\n");
1182 1183 1184

	strcpy(ifr->ifr_name, tun->dev->name);

1185
	ifr->ifr_flags = tun_flags(tun);
1186 1187 1188 1189

	return 0;
}

1190 1191
/* This is like a cut-down ethtool ops, except done via tun fd so no
 * privs required. */
1192
static int set_offload(struct tun_struct *tun, unsigned long arg)
1193
{
1194
	u32 features = 0;
1195 1196

	if (arg & TUN_F_CSUM) {
1197
		features |= NETIF_F_HW_CSUM;
1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210
		arg &= ~TUN_F_CSUM;

		if (arg & (TUN_F_TSO4|TUN_F_TSO6)) {
			if (arg & TUN_F_TSO_ECN) {
				features |= NETIF_F_TSO_ECN;
				arg &= ~TUN_F_TSO_ECN;
			}
			if (arg & TUN_F_TSO4)
				features |= NETIF_F_TSO;
			if (arg & TUN_F_TSO6)
				features |= NETIF_F_TSO6;
			arg &= ~(TUN_F_TSO4|TUN_F_TSO6);
		}
1211 1212 1213 1214 1215

		if (arg & TUN_F_UFO) {
			features |= NETIF_F_UFO;
			arg &= ~TUN_F_UFO;
		}
1216 1217 1218 1219 1220 1221 1222
	}

	/* This gives the user a way to test for new features in future by
	 * trying to set them. */
	if (arg)
		return -EINVAL;

1223 1224
	tun->set_features = features;
	netdev_update_features(tun->dev);
1225 1226 1227 1228

	return 0;
}

1229 1230
static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
			    unsigned long arg, int ifreq_len)
L
Linus Torvalds 已提交
1231
{
E
Eric W. Biederman 已提交
1232
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1233
	struct tun_struct *tun;
L
Linus Torvalds 已提交
1234
	void __user* argp = (void __user*)arg;
M
Michael S. Tsirkin 已提交
1235
	struct sock_fprog fprog;
L
Linus Torvalds 已提交
1236
	struct ifreq ifr;
1237
	int sndbuf;
1238
	int vnet_hdr_sz;
1239
	int ret;
L
Linus Torvalds 已提交
1240 1241

	if (cmd == TUNSETIFF || _IOC_TYPE(cmd) == 0x89)
1242
		if (copy_from_user(&ifr, argp, ifreq_len))
L
Linus Torvalds 已提交
1243 1244
			return -EFAULT;

E
Eric W. Biederman 已提交
1245 1246 1247 1248 1249 1250 1251 1252 1253
	if (cmd == TUNGETFEATURES) {
		/* Currently this just means: "what IFF flags are valid?".
		 * This is needed because we never checked for invalid flags on
		 * TUNSETIFF. */
		return put_user(IFF_TUN | IFF_TAP | IFF_NO_PI | IFF_ONE_QUEUE |
				IFF_VNET_HDR,
				(unsigned int __user*)argp);
	}

1254 1255
	rtnl_lock();

E
Eric W. Biederman 已提交
1256
	tun = __tun_get(tfile);
L
Linus Torvalds 已提交
1257 1258 1259
	if (cmd == TUNSETIFF && !tun) {
		ifr.ifr_name[IFNAMSIZ-1] = '\0';

1260
		ret = tun_set_iff(tfile->net, file, &ifr);
L
Linus Torvalds 已提交
1261

1262 1263
		if (ret)
			goto unlock;
L
Linus Torvalds 已提交
1264

1265
		if (copy_to_user(argp, &ifr, ifreq_len))
1266 1267
			ret = -EFAULT;
		goto unlock;
L
Linus Torvalds 已提交
1268 1269
	}

1270
	ret = -EBADFD;
L
Linus Torvalds 已提交
1271
	if (!tun)
1272
		goto unlock;
L
Linus Torvalds 已提交
1273

1274
	tun_debug(KERN_INFO, tun, "tun_chr_ioctl cmd %d\n", cmd);
L
Linus Torvalds 已提交
1275

E
Eric W. Biederman 已提交
1276
	ret = 0;
L
Linus Torvalds 已提交
1277
	switch (cmd) {
1278
	case TUNGETIFF:
1279
		ret = tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
1280
		if (ret)
E
Eric W. Biederman 已提交
1281
			break;
1282

1283
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1284
			ret = -EFAULT;
1285 1286
		break;

L
Linus Torvalds 已提交
1287 1288 1289
	case TUNSETNOCSUM:
		/* Disable/Enable checksum */

1290 1291
		/* [unimplemented] */
		tun_debug(KERN_INFO, tun, "ignored: set checksum %s\n",
1292
			  arg ? "disabled" : "enabled");
L
Linus Torvalds 已提交
1293 1294 1295 1296 1297 1298 1299 1300 1301
		break;

	case TUNSETPERSIST:
		/* Disable/Enable persist mode */
		if (arg)
			tun->flags |= TUN_PERSIST;
		else
			tun->flags &= ~TUN_PERSIST;

1302 1303
		tun_debug(KERN_INFO, tun, "persist %s\n",
			  arg ? "enabled" : "disabled");
L
Linus Torvalds 已提交
1304 1305 1306 1307 1308 1309
		break;

	case TUNSETOWNER:
		/* Set owner of the device */
		tun->owner = (uid_t) arg;

1310
		tun_debug(KERN_INFO, tun, "owner set to %d\n", tun->owner);
L
Linus Torvalds 已提交
1311 1312
		break;

1313 1314 1315 1316
	case TUNSETGROUP:
		/* Set group of the device */
		tun->group= (gid_t) arg;

1317
		tun_debug(KERN_INFO, tun, "group set to %d\n", tun->group);
1318 1319
		break;

1320 1321 1322
	case TUNSETLINK:
		/* Only allow setting the type when the interface is down */
		if (tun->dev->flags & IFF_UP) {
1323 1324
			tun_debug(KERN_INFO, tun,
				  "Linktype set failed because interface is up\n");
1325
			ret = -EBUSY;
1326 1327
		} else {
			tun->dev->type = (int) arg;
1328 1329
			tun_debug(KERN_INFO, tun, "linktype set to %d\n",
				  tun->dev->type);
1330
			ret = 0;
1331
		}
E
Eric W. Biederman 已提交
1332
		break;
1333

L
Linus Torvalds 已提交
1334 1335 1336 1337 1338
#ifdef TUN_DEBUG
	case TUNSETDEBUG:
		tun->debug = arg;
		break;
#endif
1339
	case TUNSETOFFLOAD:
1340
		ret = set_offload(tun, arg);
E
Eric W. Biederman 已提交
1341
		break;
1342

1343 1344
	case TUNSETTXFILTER:
		/* Can be set only for TAPs */
E
Eric W. Biederman 已提交
1345
		ret = -EINVAL;
1346
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
E
Eric W. Biederman 已提交
1347
			break;
H
Harvey Harrison 已提交
1348
		ret = update_filter(&tun->txflt, (void __user *)arg);
E
Eric W. Biederman 已提交
1349
		break;
L
Linus Torvalds 已提交
1350 1351

	case SIOCGIFHWADDR:
1352
		/* Get hw address */
1353 1354
		memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN);
		ifr.ifr_hwaddr.sa_family = tun->dev->type;
1355
		if (copy_to_user(argp, &ifr, ifreq_len))
E
Eric W. Biederman 已提交
1356 1357
			ret = -EFAULT;
		break;
L
Linus Torvalds 已提交
1358 1359

	case SIOCSIFHWADDR:
1360
		/* Set hw address */
1361 1362
		tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n",
			  ifr.ifr_hwaddr.sa_data);
1363 1364

		ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
E
Eric W. Biederman 已提交
1365
		break;
1366 1367

	case TUNGETSNDBUF:
1368
		sndbuf = tun->socket.sk->sk_sndbuf;
1369 1370 1371 1372 1373 1374 1375 1376 1377 1378
		if (copy_to_user(argp, &sndbuf, sizeof(sndbuf)))
			ret = -EFAULT;
		break;

	case TUNSETSNDBUF:
		if (copy_from_user(&sndbuf, argp, sizeof(sndbuf))) {
			ret = -EFAULT;
			break;
		}

1379
		tun->socket.sk->sk_sndbuf = sndbuf;
1380 1381
		break;

1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400
	case TUNGETVNETHDRSZ:
		vnet_hdr_sz = tun->vnet_hdr_sz;
		if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz)))
			ret = -EFAULT;
		break;

	case TUNSETVNETHDRSZ:
		if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) {
			ret = -EFAULT;
			break;
		}
		if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) {
			ret = -EINVAL;
			break;
		}

		tun->vnet_hdr_sz = vnet_hdr_sz;
		break;

M
Michael S. Tsirkin 已提交
1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420
	case TUNATTACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
		ret = -EFAULT;
		if (copy_from_user(&fprog, argp, sizeof(fprog)))
			break;

		ret = sk_attach_filter(&fprog, tun->socket.sk);
		break;

	case TUNDETACHFILTER:
		/* Can be set only for TAPs */
		ret = -EINVAL;
		if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
			break;
		ret = sk_detach_filter(tun->socket.sk);
		break;

L
Linus Torvalds 已提交
1421
	default:
E
Eric W. Biederman 已提交
1422 1423
		ret = -EINVAL;
		break;
1424
	}
L
Linus Torvalds 已提交
1425

1426 1427 1428 1429
unlock:
	rtnl_unlock();
	if (tun)
		tun_put(tun);
E
Eric W. Biederman 已提交
1430
	return ret;
L
Linus Torvalds 已提交
1431 1432
}

1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467
static long tun_chr_ioctl(struct file *file,
			  unsigned int cmd, unsigned long arg)
{
	return __tun_chr_ioctl(file, cmd, arg, sizeof (struct ifreq));
}

#ifdef CONFIG_COMPAT
static long tun_chr_compat_ioctl(struct file *file,
			 unsigned int cmd, unsigned long arg)
{
	switch (cmd) {
	case TUNSETIFF:
	case TUNGETIFF:
	case TUNSETTXFILTER:
	case TUNGETSNDBUF:
	case TUNSETSNDBUF:
	case SIOCGIFHWADDR:
	case SIOCSIFHWADDR:
		arg = (unsigned long)compat_ptr(arg);
		break;
	default:
		arg = (compat_ulong_t)arg;
		break;
	}

	/*
	 * compat_ifreq is shorter than ifreq, so we must not access beyond
	 * the end of that structure. All fields that are used in this
	 * driver are compatible though, we don't need to convert the
	 * contents.
	 */
	return __tun_chr_ioctl(file, cmd, arg, sizeof(struct compat_ifreq));
}
#endif /* CONFIG_COMPAT */

L
Linus Torvalds 已提交
1468 1469
static int tun_chr_fasync(int fd, struct file *file, int on)
{
E
Eric W. Biederman 已提交
1470
	struct tun_struct *tun = tun_get(file);
L
Linus Torvalds 已提交
1471 1472 1473 1474 1475
	int ret;

	if (!tun)
		return -EBADFD;

1476
	tun_debug(KERN_INFO, tun, "tun_chr_fasync %d\n", on);
L
Linus Torvalds 已提交
1477 1478

	if ((ret = fasync_helper(fd, file, on, &tun->fasync)) < 0)
J
Jonathan Corbet 已提交
1479
		goto out;
1480

L
Linus Torvalds 已提交
1481
	if (on) {
1482
		ret = __f_setown(file, task_pid(current), PIDTYPE_PID, 0);
L
Linus Torvalds 已提交
1483
		if (ret)
J
Jonathan Corbet 已提交
1484
			goto out;
L
Linus Torvalds 已提交
1485
		tun->flags |= TUN_FASYNC;
1486
	} else
L
Linus Torvalds 已提交
1487
		tun->flags &= ~TUN_FASYNC;
J
Jonathan Corbet 已提交
1488 1489
	ret = 0;
out:
E
Eric W. Biederman 已提交
1490
	tun_put(tun);
J
Jonathan Corbet 已提交
1491
	return ret;
L
Linus Torvalds 已提交
1492 1493 1494 1495
}

static int tun_chr_open(struct inode *inode, struct file * file)
{
E
Eric W. Biederman 已提交
1496
	struct tun_file *tfile;
T
Thomas Gleixner 已提交
1497

1498
	DBG1(KERN_INFO, "tunX: tun_chr_open\n");
E
Eric W. Biederman 已提交
1499 1500 1501 1502

	tfile = kmalloc(sizeof(*tfile), GFP_KERNEL);
	if (!tfile)
		return -ENOMEM;
1503
	atomic_set(&tfile->count, 0);
E
Eric W. Biederman 已提交
1504
	tfile->tun = NULL;
E
Eric W. Biederman 已提交
1505
	tfile->net = get_net(current->nsproxy->net_ns);
E
Eric W. Biederman 已提交
1506
	file->private_data = tfile;
L
Linus Torvalds 已提交
1507 1508 1509 1510 1511
	return 0;
}

static int tun_chr_close(struct inode *inode, struct file *file)
{
E
Eric W. Biederman 已提交
1512
	struct tun_file *tfile = file->private_data;
E
Eric W. Biederman 已提交
1513
	struct tun_struct *tun;
L
Linus Torvalds 已提交
1514

E
Eric W. Biederman 已提交
1515
	tun = __tun_get(tfile);
E
Eric W. Biederman 已提交
1516
	if (tun) {
H
Herbert Xu 已提交
1517 1518
		struct net_device *dev = tun->dev;

1519
		tun_debug(KERN_INFO, tun, "tun_chr_close\n");
L
Linus Torvalds 已提交
1520

E
Eric W. Biederman 已提交
1521
		__tun_detach(tun);
L
Linus Torvalds 已提交
1522

D
Daniel Mack 已提交
1523
		/* If desirable, unregister the netdevice. */
H
Herbert Xu 已提交
1524 1525 1526 1527 1528 1529
		if (!(tun->flags & TUN_PERSIST)) {
			rtnl_lock();
			if (dev->reg_state == NETREG_REGISTERED)
				unregister_netdevice(dev);
			rtnl_unlock();
		}
E
Eric W. Biederman 已提交
1530
	}
L
Linus Torvalds 已提交
1531

1532 1533
	tun = tfile->tun;
	if (tun)
1534
		sock_put(tun->socket.sk);
1535

E
Eric W. Biederman 已提交
1536
	put_net(tfile->net);
E
Eric W. Biederman 已提交
1537
	kfree(tfile);
L
Linus Torvalds 已提交
1538 1539 1540 1541

	return 0;
}

1542
static const struct file_operations tun_fops = {
1543
	.owner	= THIS_MODULE,
L
Linus Torvalds 已提交
1544
	.llseek = no_llseek,
1545 1546 1547 1548
	.read  = do_sync_read,
	.aio_read  = tun_chr_aio_read,
	.write = do_sync_write,
	.aio_write = tun_chr_aio_write,
L
Linus Torvalds 已提交
1549
	.poll	= tun_chr_poll,
1550 1551 1552 1553
	.unlocked_ioctl	= tun_chr_ioctl,
#ifdef CONFIG_COMPAT
	.compat_ioctl = tun_chr_compat_ioctl,
#endif
L
Linus Torvalds 已提交
1554 1555
	.open	= tun_chr_open,
	.release = tun_chr_close,
1556
	.fasync = tun_chr_fasync
L
Linus Torvalds 已提交
1557 1558 1559 1560 1561
};

static struct miscdevice tun_miscdev = {
	.minor = TUN_MINOR,
	.name = "tun",
1562
	.nodename = "net/tun",
L
Linus Torvalds 已提交
1563 1564 1565 1566 1567 1568 1569 1570 1571
	.fops = &tun_fops,
};

/* ethtool interface */

static int tun_get_settings(struct net_device *dev, struct ethtool_cmd *cmd)
{
	cmd->supported		= 0;
	cmd->advertising	= 0;
1572
	ethtool_cmd_speed_set(cmd, SPEED_10);
L
Linus Torvalds 已提交
1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618
	cmd->duplex		= DUPLEX_FULL;
	cmd->port		= PORT_TP;
	cmd->phy_address	= 0;
	cmd->transceiver	= XCVR_INTERNAL;
	cmd->autoneg		= AUTONEG_DISABLE;
	cmd->maxtxpkt		= 0;
	cmd->maxrxpkt		= 0;
	return 0;
}

static void tun_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info)
{
	struct tun_struct *tun = netdev_priv(dev);

	strcpy(info->driver, DRV_NAME);
	strcpy(info->version, DRV_VERSION);
	strcpy(info->fw_version, "N/A");

	switch (tun->flags & TUN_TYPE_MASK) {
	case TUN_TUN_DEV:
		strcpy(info->bus_info, "tun");
		break;
	case TUN_TAP_DEV:
		strcpy(info->bus_info, "tap");
		break;
	}
}

static u32 tun_get_msglevel(struct net_device *dev)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	return tun->debug;
#else
	return -EOPNOTSUPP;
#endif
}

static void tun_set_msglevel(struct net_device *dev, u32 value)
{
#ifdef TUN_DEBUG
	struct tun_struct *tun = netdev_priv(dev);
	tun->debug = value;
#endif
}

1619
static const struct ethtool_ops tun_ethtool_ops = {
L
Linus Torvalds 已提交
1620 1621 1622 1623
	.get_settings	= tun_get_settings,
	.get_drvinfo	= tun_get_drvinfo,
	.get_msglevel	= tun_get_msglevel,
	.set_msglevel	= tun_set_msglevel,
1624
	.get_link	= ethtool_op_get_link,
L
Linus Torvalds 已提交
1625 1626
};

1627

L
Linus Torvalds 已提交
1628 1629 1630 1631
static int __init tun_init(void)
{
	int ret = 0;

1632 1633
	pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION);
	pr_info("%s\n", DRV_COPYRIGHT);
L
Linus Torvalds 已提交
1634

1635
	ret = rtnl_link_register(&tun_link_ops);
1636
	if (ret) {
1637
		pr_err("Can't register link_ops\n");
1638
		goto err_linkops;
1639 1640
	}

L
Linus Torvalds 已提交
1641
	ret = misc_register(&tun_miscdev);
1642
	if (ret) {
1643
		pr_err("Can't register misc device %d\n", TUN_MINOR);
1644 1645
		goto err_misc;
	}
1646
	return  0;
1647
err_misc:
1648 1649
	rtnl_link_unregister(&tun_link_ops);
err_linkops:
L
Linus Torvalds 已提交
1650 1651 1652 1653 1654
	return ret;
}

static void tun_cleanup(void)
{
1655
	misc_deregister(&tun_miscdev);
1656
	rtnl_link_unregister(&tun_link_ops);
L
Linus Torvalds 已提交
1657 1658
}

1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675
/* Get an underlying socket object from tun file.  Returns error unless file is
 * attached to a device.  The returned object works like a packet socket, it
 * can be used for sock_sendmsg/sock_recvmsg.  The caller is responsible for
 * holding a reference to the file for as long as the socket is in use. */
struct socket *tun_get_socket(struct file *file)
{
	struct tun_struct *tun;
	if (file->f_op != &tun_fops)
		return ERR_PTR(-EINVAL);
	tun = tun_get(file);
	if (!tun)
		return ERR_PTR(-EBADFD);
	tun_put(tun);
	return &tun->socket;
}
EXPORT_SYMBOL_GPL(tun_get_socket);

L
Linus Torvalds 已提交
1676 1677 1678 1679 1680 1681
module_init(tun_init);
module_exit(tun_cleanup);
MODULE_DESCRIPTION(DRV_DESCRIPTION);
MODULE_AUTHOR(DRV_COPYRIGHT);
MODULE_LICENSE("GPL");
MODULE_ALIAS_MISCDEV(TUN_MINOR);
1682
MODULE_ALIAS("devname:net/tun");