1 /* 2 * TUN - Universal TUN/TAP device driver. 3 * Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License as published by 7 * the Free Software Foundation; either version 2 of the License, or 8 * (at your option) any later version. 9 * 10 * This program is distributed in the hope that it will be useful, 11 * but WITHOUT ANY WARRANTY; without even the implied warranty of 12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 13 * GNU General Public License for more details. 14 * 15 * $Id: tun.c,v 1.15 2002/03/01 02:44:24 maxk Exp $ 16 */ 17 18 /* 19 * Changes: 20 * 21 * Mike Kershaw <dragorn@kismetwireless.net> 2005/08/14 22 * Add TUNSETLINK ioctl to set the link encapsulation 23 * 24 * Mark Smith <markzzzsmith@yahoo.com.au> 25 * Use eth_random_addr() for tap MAC address. 26 * 27 * Harald Roelle <harald.roelle@ifi.lmu.de> 2004/04/20 28 * Fixes in packet dropping, queue length setting and queue wakeup. 29 * Increased default tx queue length. 30 * Added ethtool API. 31 * Minor cleanups 32 * 33 * Daniel Podlejski <underley@underley.eu.org> 34 * Modifications for 2.3.99-pre5 kernel. 35 */ 36 37 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 38 39 #define DRV_NAME "tun" 40 #define DRV_VERSION "1.6" 41 #define DRV_DESCRIPTION "Universal TUN/TAP device driver" 42 #define DRV_COPYRIGHT "(C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>" 43 44 #include <linux/module.h> 45 #include <linux/errno.h> 46 #include <linux/kernel.h> 47 #include <linux/major.h> 48 #include <linux/slab.h> 49 #include <linux/poll.h> 50 #include <linux/fcntl.h> 51 #include <linux/init.h> 52 #include <linux/skbuff.h> 53 #include <linux/netdevice.h> 54 #include <linux/etherdevice.h> 55 #include <linux/miscdevice.h> 56 #include <linux/ethtool.h> 57 #include <linux/rtnetlink.h> 58 #include <linux/compat.h> 59 #include <linux/if.h> 60 #include <linux/if_arp.h> 61 #include <linux/if_ether.h> 62 #include <linux/if_tun.h> 63 #include <linux/if_vlan.h> 64 #include <linux/crc32.h> 65 #include <linux/nsproxy.h> 66 #include <linux/virtio_net.h> 67 #include <linux/rcupdate.h> 68 #include <net/net_namespace.h> 69 #include <net/netns/generic.h> 70 #include <net/rtnetlink.h> 71 #include <net/sock.h> 72 #include <linux/seq_file.h> 73 #include <linux/uio.h> 74 #include <linux/skb_array.h> 75 76 #include <asm/uaccess.h> 77 78 /* Uncomment to enable debugging */ 79 /* #define TUN_DEBUG 1 */ 80 81 #ifdef TUN_DEBUG 82 static int debug; 83 84 #define tun_debug(level, tun, fmt, args...) \ 85 do { \ 86 if (tun->debug) \ 87 netdev_printk(level, tun->dev, fmt, ##args); \ 88 } while (0) 89 #define DBG1(level, fmt, args...) \ 90 do { \ 91 if (debug == 2) \ 92 printk(level fmt, ##args); \ 93 } while (0) 94 #else 95 #define tun_debug(level, tun, fmt, args...) \ 96 do { \ 97 if (0) \ 98 netdev_printk(level, tun->dev, fmt, ##args); \ 99 } while (0) 100 #define DBG1(level, fmt, args...) \ 101 do { \ 102 if (0) \ 103 printk(level fmt, ##args); \ 104 } while (0) 105 #endif 106 107 /* TUN device flags */ 108 109 /* IFF_ATTACH_QUEUE is never stored in device flags, 110 * overload it to mean fasync when stored there. 111 */ 112 #define TUN_FASYNC IFF_ATTACH_QUEUE 113 /* High bits in flags field are unused. */ 114 #define TUN_VNET_LE 0x80000000 115 #define TUN_VNET_BE 0x40000000 116 117 #define TUN_FEATURES (IFF_NO_PI | IFF_ONE_QUEUE | IFF_VNET_HDR | \ 118 IFF_MULTI_QUEUE) 119 #define GOODCOPY_LEN 128 120 121 #define FLT_EXACT_COUNT 8 122 struct tap_filter { 123 unsigned int count; /* Number of addrs. Zero means disabled */ 124 u32 mask[2]; /* Mask of the hashed addrs */ 125 unsigned char addr[FLT_EXACT_COUNT][ETH_ALEN]; 126 }; 127 128 /* MAX_TAP_QUEUES 256 is chosen to allow rx/tx queues to be equal 129 * to max number of VCPUs in guest. */ 130 #define MAX_TAP_QUEUES 256 131 #define MAX_TAP_FLOWS 4096 132 133 #define TUN_FLOW_EXPIRE (3 * HZ) 134 135 struct tun_pcpu_stats { 136 u64 rx_packets; 137 u64 rx_bytes; 138 u64 tx_packets; 139 u64 tx_bytes; 140 struct u64_stats_sync syncp; 141 u32 rx_dropped; 142 u32 tx_dropped; 143 u32 rx_frame_errors; 144 }; 145 146 /* A tun_file connects an open character device to a tuntap netdevice. It 147 * also contains all socket related structures (except sock_fprog and tap_filter) 148 * to serve as one transmit queue for tuntap device. The sock_fprog and 149 * tap_filter were kept in tun_struct since they were used for filtering for the 150 * netdevice not for a specific queue (at least I didn't see the requirement for 151 * this). 152 * 153 * RCU usage: 154 * The tun_file and tun_struct are loosely coupled, the pointer from one to the 155 * other can only be read while rcu_read_lock or rtnl_lock is held. 156 */ 157 struct tun_file { 158 struct sock sk; 159 struct socket socket; 160 struct socket_wq wq; 161 struct tun_struct __rcu *tun; 162 struct fasync_struct *fasync; 163 /* only used for fasnyc */ 164 unsigned int flags; 165 union { 166 u16 queue_index; 167 unsigned int ifindex; 168 }; 169 struct list_head next; 170 struct tun_struct *detached; 171 struct skb_array tx_array; 172 }; 173 174 struct tun_flow_entry { 175 struct hlist_node hash_link; 176 struct rcu_head rcu; 177 struct tun_struct *tun; 178 179 u32 rxhash; 180 u32 rps_rxhash; 181 int queue_index; 182 unsigned long updated; 183 }; 184 185 #define TUN_NUM_FLOW_ENTRIES 1024 186 187 /* Since the socket were moved to tun_file, to preserve the behavior of persist 188 * device, socket filter, sndbuf and vnet header size were restore when the 189 * file were attached to a persist device. 190 */ 191 struct tun_struct { 192 struct tun_file __rcu *tfiles[MAX_TAP_QUEUES]; 193 unsigned int numqueues; 194 unsigned int flags; 195 kuid_t owner; 196 kgid_t group; 197 198 struct net_device *dev; 199 netdev_features_t set_features; 200 #define TUN_USER_FEATURES (NETIF_F_HW_CSUM|NETIF_F_TSO_ECN|NETIF_F_TSO| \ 201 NETIF_F_TSO6|NETIF_F_UFO) 202 203 int align; 204 int vnet_hdr_sz; 205 int sndbuf; 206 struct tap_filter txflt; 207 struct sock_fprog fprog; 208 /* protected by rtnl lock */ 209 bool filter_attached; 210 #ifdef TUN_DEBUG 211 int debug; 212 #endif 213 spinlock_t lock; 214 struct hlist_head flows[TUN_NUM_FLOW_ENTRIES]; 215 struct timer_list flow_gc_timer; 216 unsigned long ageing_time; 217 unsigned int numdisabled; 218 struct list_head disabled; 219 void *security; 220 u32 flow_count; 221 struct tun_pcpu_stats __percpu *pcpu_stats; 222 }; 223 224 #ifdef CONFIG_TUN_VNET_CROSS_LE 225 static inline bool tun_legacy_is_little_endian(struct tun_struct *tun) 226 { 227 return tun->flags & TUN_VNET_BE ? false : 228 virtio_legacy_is_little_endian(); 229 } 230 231 static long tun_get_vnet_be(struct tun_struct *tun, int __user *argp) 232 { 233 int be = !!(tun->flags & TUN_VNET_BE); 234 235 if (put_user(be, argp)) 236 return -EFAULT; 237 238 return 0; 239 } 240 241 static long tun_set_vnet_be(struct tun_struct *tun, int __user *argp) 242 { 243 int be; 244 245 if (get_user(be, argp)) 246 return -EFAULT; 247 248 if (be) 249 tun->flags |= TUN_VNET_BE; 250 else 251 tun->flags &= ~TUN_VNET_BE; 252 253 return 0; 254 } 255 #else 256 static inline bool tun_legacy_is_little_endian(struct tun_struct *tun) 257 { 258 return virtio_legacy_is_little_endian(); 259 } 260 261 static long tun_get_vnet_be(struct tun_struct *tun, int __user *argp) 262 { 263 return -EINVAL; 264 } 265 266 static long tun_set_vnet_be(struct tun_struct *tun, int __user *argp) 267 { 268 return -EINVAL; 269 } 270 #endif /* CONFIG_TUN_VNET_CROSS_LE */ 271 272 static inline bool tun_is_little_endian(struct tun_struct *tun) 273 { 274 return tun->flags & TUN_VNET_LE || 275 tun_legacy_is_little_endian(tun); 276 } 277 278 static inline u16 tun16_to_cpu(struct tun_struct *tun, __virtio16 val) 279 { 280 return __virtio16_to_cpu(tun_is_little_endian(tun), val); 281 } 282 283 static inline __virtio16 cpu_to_tun16(struct tun_struct *tun, u16 val) 284 { 285 return __cpu_to_virtio16(tun_is_little_endian(tun), val); 286 } 287 288 static inline u32 tun_hashfn(u32 rxhash) 289 { 290 return rxhash & 0x3ff; 291 } 292 293 static struct tun_flow_entry *tun_flow_find(struct hlist_head *head, u32 rxhash) 294 { 295 struct tun_flow_entry *e; 296 297 hlist_for_each_entry_rcu(e, head, hash_link) { 298 if (e->rxhash == rxhash) 299 return e; 300 } 301 return NULL; 302 } 303 304 static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun, 305 struct hlist_head *head, 306 u32 rxhash, u16 queue_index) 307 { 308 struct tun_flow_entry *e = kmalloc(sizeof(*e), GFP_ATOMIC); 309 310 if (e) { 311 tun_debug(KERN_INFO, tun, "create flow: hash %u index %u\n", 312 rxhash, queue_index); 313 e->updated = jiffies; 314 e->rxhash = rxhash; 315 e->rps_rxhash = 0; 316 e->queue_index = queue_index; 317 e->tun = tun; 318 hlist_add_head_rcu(&e->hash_link, head); 319 ++tun->flow_count; 320 } 321 return e; 322 } 323 324 static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e) 325 { 326 tun_debug(KERN_INFO, tun, "delete flow: hash %u index %u\n", 327 e->rxhash, e->queue_index); 328 hlist_del_rcu(&e->hash_link); 329 kfree_rcu(e, rcu); 330 --tun->flow_count; 331 } 332 333 static void tun_flow_flush(struct tun_struct *tun) 334 { 335 int i; 336 337 spin_lock_bh(&tun->lock); 338 for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) { 339 struct tun_flow_entry *e; 340 struct hlist_node *n; 341 342 hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) 343 tun_flow_delete(tun, e); 344 } 345 spin_unlock_bh(&tun->lock); 346 } 347 348 static void tun_flow_delete_by_queue(struct tun_struct *tun, u16 queue_index) 349 { 350 int i; 351 352 spin_lock_bh(&tun->lock); 353 for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) { 354 struct tun_flow_entry *e; 355 struct hlist_node *n; 356 357 hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) { 358 if (e->queue_index == queue_index) 359 tun_flow_delete(tun, e); 360 } 361 } 362 spin_unlock_bh(&tun->lock); 363 } 364 365 static void tun_flow_cleanup(unsigned long data) 366 { 367 struct tun_struct *tun = (struct tun_struct *)data; 368 unsigned long delay = tun->ageing_time; 369 unsigned long next_timer = jiffies + delay; 370 unsigned long count = 0; 371 int i; 372 373 tun_debug(KERN_INFO, tun, "tun_flow_cleanup\n"); 374 375 spin_lock_bh(&tun->lock); 376 for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) { 377 struct tun_flow_entry *e; 378 struct hlist_node *n; 379 380 hlist_for_each_entry_safe(e, n, &tun->flows[i], hash_link) { 381 unsigned long this_timer; 382 count++; 383 this_timer = e->updated + delay; 384 if (time_before_eq(this_timer, jiffies)) 385 tun_flow_delete(tun, e); 386 else if (time_before(this_timer, next_timer)) 387 next_timer = this_timer; 388 } 389 } 390 391 if (count) 392 mod_timer(&tun->flow_gc_timer, round_jiffies_up(next_timer)); 393 spin_unlock_bh(&tun->lock); 394 } 395 396 static void tun_flow_update(struct tun_struct *tun, u32 rxhash, 397 struct tun_file *tfile) 398 { 399 struct hlist_head *head; 400 struct tun_flow_entry *e; 401 unsigned long delay = tun->ageing_time; 402 u16 queue_index = tfile->queue_index; 403 404 if (!rxhash) 405 return; 406 else 407 head = &tun->flows[tun_hashfn(rxhash)]; 408 409 rcu_read_lock(); 410 411 /* We may get a very small possibility of OOO during switching, not 412 * worth to optimize.*/ 413 if (tun->numqueues == 1 || tfile->detached) 414 goto unlock; 415 416 e = tun_flow_find(head, rxhash); 417 if (likely(e)) { 418 /* TODO: keep queueing to old queue until it's empty? */ 419 e->queue_index = queue_index; 420 e->updated = jiffies; 421 sock_rps_record_flow_hash(e->rps_rxhash); 422 } else { 423 spin_lock_bh(&tun->lock); 424 if (!tun_flow_find(head, rxhash) && 425 tun->flow_count < MAX_TAP_FLOWS) 426 tun_flow_create(tun, head, rxhash, queue_index); 427 428 if (!timer_pending(&tun->flow_gc_timer)) 429 mod_timer(&tun->flow_gc_timer, 430 round_jiffies_up(jiffies + delay)); 431 spin_unlock_bh(&tun->lock); 432 } 433 434 unlock: 435 rcu_read_unlock(); 436 } 437 438 /** 439 * Save the hash received in the stack receive path and update the 440 * flow_hash table accordingly. 441 */ 442 static inline void tun_flow_save_rps_rxhash(struct tun_flow_entry *e, u32 hash) 443 { 444 if (unlikely(e->rps_rxhash != hash)) 445 e->rps_rxhash = hash; 446 } 447 448 /* We try to identify a flow through its rxhash first. The reason that 449 * we do not check rxq no. is because some cards(e.g 82599), chooses 450 * the rxq based on the txq where the last packet of the flow comes. As 451 * the userspace application move between processors, we may get a 452 * different rxq no. here. If we could not get rxhash, then we would 453 * hope the rxq no. may help here. 454 */ 455 static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb, 456 void *accel_priv, select_queue_fallback_t fallback) 457 { 458 struct tun_struct *tun = netdev_priv(dev); 459 struct tun_flow_entry *e; 460 u32 txq = 0; 461 u32 numqueues = 0; 462 463 rcu_read_lock(); 464 numqueues = ACCESS_ONCE(tun->numqueues); 465 466 txq = skb_get_hash(skb); 467 if (txq) { 468 e = tun_flow_find(&tun->flows[tun_hashfn(txq)], txq); 469 if (e) { 470 tun_flow_save_rps_rxhash(e, txq); 471 txq = e->queue_index; 472 } else 473 /* use multiply and shift instead of expensive divide */ 474 txq = ((u64)txq * numqueues) >> 32; 475 } else if (likely(skb_rx_queue_recorded(skb))) { 476 txq = skb_get_rx_queue(skb); 477 while (unlikely(txq >= numqueues)) 478 txq -= numqueues; 479 } 480 481 rcu_read_unlock(); 482 return txq; 483 } 484 485 static inline bool tun_not_capable(struct tun_struct *tun) 486 { 487 const struct cred *cred = current_cred(); 488 struct net *net = dev_net(tun->dev); 489 490 return ((uid_valid(tun->owner) && !uid_eq(cred->euid, tun->owner)) || 491 (gid_valid(tun->group) && !in_egroup_p(tun->group))) && 492 !ns_capable(net->user_ns, CAP_NET_ADMIN); 493 } 494 495 static void tun_set_real_num_queues(struct tun_struct *tun) 496 { 497 netif_set_real_num_tx_queues(tun->dev, tun->numqueues); 498 netif_set_real_num_rx_queues(tun->dev, tun->numqueues); 499 } 500 501 static void tun_disable_queue(struct tun_struct *tun, struct tun_file *tfile) 502 { 503 tfile->detached = tun; 504 list_add_tail(&tfile->next, &tun->disabled); 505 ++tun->numdisabled; 506 } 507 508 static struct tun_struct *tun_enable_queue(struct tun_file *tfile) 509 { 510 struct tun_struct *tun = tfile->detached; 511 512 tfile->detached = NULL; 513 list_del_init(&tfile->next); 514 --tun->numdisabled; 515 return tun; 516 } 517 518 static void tun_queue_purge(struct tun_file *tfile) 519 { 520 struct sk_buff *skb; 521 522 while ((skb = skb_array_consume(&tfile->tx_array)) != NULL) 523 kfree_skb(skb); 524 525 skb_queue_purge(&tfile->sk.sk_error_queue); 526 } 527 528 static void __tun_detach(struct tun_file *tfile, bool clean) 529 { 530 struct tun_file *ntfile; 531 struct tun_struct *tun; 532 533 tun = rtnl_dereference(tfile->tun); 534 535 if (tun && !tfile->detached) { 536 u16 index = tfile->queue_index; 537 BUG_ON(index >= tun->numqueues); 538 539 rcu_assign_pointer(tun->tfiles[index], 540 tun->tfiles[tun->numqueues - 1]); 541 ntfile = rtnl_dereference(tun->tfiles[index]); 542 ntfile->queue_index = index; 543 544 --tun->numqueues; 545 if (clean) { 546 RCU_INIT_POINTER(tfile->tun, NULL); 547 sock_put(&tfile->sk); 548 } else 549 tun_disable_queue(tun, tfile); 550 551 synchronize_net(); 552 tun_flow_delete_by_queue(tun, tun->numqueues + 1); 553 /* Drop read queue */ 554 tun_queue_purge(tfile); 555 tun_set_real_num_queues(tun); 556 } else if (tfile->detached && clean) { 557 tun = tun_enable_queue(tfile); 558 sock_put(&tfile->sk); 559 } 560 561 if (clean) { 562 if (tun && tun->numqueues == 0 && tun->numdisabled == 0) { 563 netif_carrier_off(tun->dev); 564 565 if (!(tun->flags & IFF_PERSIST) && 566 tun->dev->reg_state == NETREG_REGISTERED) 567 unregister_netdevice(tun->dev); 568 } 569 if (tun) 570 skb_array_cleanup(&tfile->tx_array); 571 sock_put(&tfile->sk); 572 } 573 } 574 575 static void tun_detach(struct tun_file *tfile, bool clean) 576 { 577 rtnl_lock(); 578 __tun_detach(tfile, clean); 579 rtnl_unlock(); 580 } 581 582 static void tun_detach_all(struct net_device *dev) 583 { 584 struct tun_struct *tun = netdev_priv(dev); 585 struct tun_file *tfile, *tmp; 586 int i, n = tun->numqueues; 587 588 for (i = 0; i < n; i++) { 589 tfile = rtnl_dereference(tun->tfiles[i]); 590 BUG_ON(!tfile); 591 tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN; 592 tfile->socket.sk->sk_data_ready(tfile->socket.sk); 593 RCU_INIT_POINTER(tfile->tun, NULL); 594 --tun->numqueues; 595 } 596 list_for_each_entry(tfile, &tun->disabled, next) { 597 tfile->socket.sk->sk_shutdown = RCV_SHUTDOWN; 598 tfile->socket.sk->sk_data_ready(tfile->socket.sk); 599 RCU_INIT_POINTER(tfile->tun, NULL); 600 } 601 BUG_ON(tun->numqueues != 0); 602 603 synchronize_net(); 604 for (i = 0; i < n; i++) { 605 tfile = rtnl_dereference(tun->tfiles[i]); 606 /* Drop read queue */ 607 tun_queue_purge(tfile); 608 sock_put(&tfile->sk); 609 } 610 list_for_each_entry_safe(tfile, tmp, &tun->disabled, next) { 611 tun_enable_queue(tfile); 612 tun_queue_purge(tfile); 613 sock_put(&tfile->sk); 614 } 615 BUG_ON(tun->numdisabled != 0); 616 617 if (tun->flags & IFF_PERSIST) 618 module_put(THIS_MODULE); 619 } 620 621 static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filter) 622 { 623 struct tun_file *tfile = file->private_data; 624 struct net_device *dev = tun->dev; 625 int err; 626 627 err = security_tun_dev_attach(tfile->socket.sk, tun->security); 628 if (err < 0) 629 goto out; 630 631 err = -EINVAL; 632 if (rtnl_dereference(tfile->tun) && !tfile->detached) 633 goto out; 634 635 err = -EBUSY; 636 if (!(tun->flags & IFF_MULTI_QUEUE) && tun->numqueues == 1) 637 goto out; 638 639 err = -E2BIG; 640 if (!tfile->detached && 641 tun->numqueues + tun->numdisabled == MAX_TAP_QUEUES) 642 goto out; 643 644 err = 0; 645 646 /* Re-attach the filter to persist device */ 647 if (!skip_filter && (tun->filter_attached == true)) { 648 lock_sock(tfile->socket.sk); 649 err = sk_attach_filter(&tun->fprog, tfile->socket.sk); 650 release_sock(tfile->socket.sk); 651 if (!err) 652 goto out; 653 } 654 655 if (!tfile->detached && 656 skb_array_init(&tfile->tx_array, dev->tx_queue_len, GFP_KERNEL)) { 657 err = -ENOMEM; 658 goto out; 659 } 660 661 tfile->queue_index = tun->numqueues; 662 tfile->socket.sk->sk_shutdown &= ~RCV_SHUTDOWN; 663 rcu_assign_pointer(tfile->tun, tun); 664 rcu_assign_pointer(tun->tfiles[tun->numqueues], tfile); 665 tun->numqueues++; 666 667 if (tfile->detached) 668 tun_enable_queue(tfile); 669 else 670 sock_hold(&tfile->sk); 671 672 tun_set_real_num_queues(tun); 673 674 /* device is allowed to go away first, so no need to hold extra 675 * refcnt. 676 */ 677 678 out: 679 return err; 680 } 681 682 static struct tun_struct *__tun_get(struct tun_file *tfile) 683 { 684 struct tun_struct *tun; 685 686 rcu_read_lock(); 687 tun = rcu_dereference(tfile->tun); 688 if (tun) 689 dev_hold(tun->dev); 690 rcu_read_unlock(); 691 692 return tun; 693 } 694 695 static struct tun_struct *tun_get(struct file *file) 696 { 697 return __tun_get(file->private_data); 698 } 699 700 static void tun_put(struct tun_struct *tun) 701 { 702 dev_put(tun->dev); 703 } 704 705 /* TAP filtering */ 706 static void addr_hash_set(u32 *mask, const u8 *addr) 707 { 708 int n = ether_crc(ETH_ALEN, addr) >> 26; 709 mask[n >> 5] |= (1 << (n & 31)); 710 } 711 712 static unsigned int addr_hash_test(const u32 *mask, const u8 *addr) 713 { 714 int n = ether_crc(ETH_ALEN, addr) >> 26; 715 return mask[n >> 5] & (1 << (n & 31)); 716 } 717 718 static int update_filter(struct tap_filter *filter, void __user *arg) 719 { 720 struct { u8 u[ETH_ALEN]; } *addr; 721 struct tun_filter uf; 722 int err, alen, n, nexact; 723 724 if (copy_from_user(&uf, arg, sizeof(uf))) 725 return -EFAULT; 726 727 if (!uf.count) { 728 /* Disabled */ 729 filter->count = 0; 730 return 0; 731 } 732 733 alen = ETH_ALEN * uf.count; 734 addr = memdup_user(arg + sizeof(uf), alen); 735 if (IS_ERR(addr)) 736 return PTR_ERR(addr); 737 738 /* The filter is updated without holding any locks. Which is 739 * perfectly safe. We disable it first and in the worst 740 * case we'll accept a few undesired packets. */ 741 filter->count = 0; 742 wmb(); 743 744 /* Use first set of addresses as an exact filter */ 745 for (n = 0; n < uf.count && n < FLT_EXACT_COUNT; n++) 746 memcpy(filter->addr[n], addr[n].u, ETH_ALEN); 747 748 nexact = n; 749 750 /* Remaining multicast addresses are hashed, 751 * unicast will leave the filter disabled. */ 752 memset(filter->mask, 0, sizeof(filter->mask)); 753 for (; n < uf.count; n++) { 754 if (!is_multicast_ether_addr(addr[n].u)) { 755 err = 0; /* no filter */ 756 goto free_addr; 757 } 758 addr_hash_set(filter->mask, addr[n].u); 759 } 760 761 /* For ALLMULTI just set the mask to all ones. 762 * This overrides the mask populated above. */ 763 if ((uf.flags & TUN_FLT_ALLMULTI)) 764 memset(filter->mask, ~0, sizeof(filter->mask)); 765 766 /* Now enable the filter */ 767 wmb(); 768 filter->count = nexact; 769 770 /* Return the number of exact filters */ 771 err = nexact; 772 free_addr: 773 kfree(addr); 774 return err; 775 } 776 777 /* Returns: 0 - drop, !=0 - accept */ 778 static int run_filter(struct tap_filter *filter, const struct sk_buff *skb) 779 { 780 /* Cannot use eth_hdr(skb) here because skb_mac_hdr() is incorrect 781 * at this point. */ 782 struct ethhdr *eh = (struct ethhdr *) skb->data; 783 int i; 784 785 /* Exact match */ 786 for (i = 0; i < filter->count; i++) 787 if (ether_addr_equal(eh->h_dest, filter->addr[i])) 788 return 1; 789 790 /* Inexact match (multicast only) */ 791 if (is_multicast_ether_addr(eh->h_dest)) 792 return addr_hash_test(filter->mask, eh->h_dest); 793 794 return 0; 795 } 796 797 /* 798 * Checks whether the packet is accepted or not. 799 * Returns: 0 - drop, !=0 - accept 800 */ 801 static int check_filter(struct tap_filter *filter, const struct sk_buff *skb) 802 { 803 if (!filter->count) 804 return 1; 805 806 return run_filter(filter, skb); 807 } 808 809 /* Network device part of the driver */ 810 811 static const struct ethtool_ops tun_ethtool_ops; 812 813 /* Net device detach from fd. */ 814 static void tun_net_uninit(struct net_device *dev) 815 { 816 tun_detach_all(dev); 817 } 818 819 /* Net device open. */ 820 static int tun_net_open(struct net_device *dev) 821 { 822 netif_tx_start_all_queues(dev); 823 return 0; 824 } 825 826 /* Net device close. */ 827 static int tun_net_close(struct net_device *dev) 828 { 829 netif_tx_stop_all_queues(dev); 830 return 0; 831 } 832 833 /* Net device start xmit */ 834 static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev) 835 { 836 struct tun_struct *tun = netdev_priv(dev); 837 int txq = skb->queue_mapping; 838 struct tun_file *tfile; 839 u32 numqueues = 0; 840 841 rcu_read_lock(); 842 tfile = rcu_dereference(tun->tfiles[txq]); 843 numqueues = ACCESS_ONCE(tun->numqueues); 844 845 /* Drop packet if interface is not attached */ 846 if (txq >= numqueues) 847 goto drop; 848 849 #ifdef CONFIG_RPS 850 if (numqueues == 1 && static_key_false(&rps_needed)) { 851 /* Select queue was not called for the skbuff, so we extract the 852 * RPS hash and save it into the flow_table here. 853 */ 854 __u32 rxhash; 855 856 rxhash = skb_get_hash(skb); 857 if (rxhash) { 858 struct tun_flow_entry *e; 859 e = tun_flow_find(&tun->flows[tun_hashfn(rxhash)], 860 rxhash); 861 if (e) 862 tun_flow_save_rps_rxhash(e, rxhash); 863 } 864 } 865 #endif 866 867 tun_debug(KERN_INFO, tun, "tun_net_xmit %d\n", skb->len); 868 869 BUG_ON(!tfile); 870 871 /* Drop if the filter does not like it. 872 * This is a noop if the filter is disabled. 873 * Filter can be enabled only for the TAP devices. */ 874 if (!check_filter(&tun->txflt, skb)) 875 goto drop; 876 877 if (tfile->socket.sk->sk_filter && 878 sk_filter(tfile->socket.sk, skb)) 879 goto drop; 880 881 /* Limit the number of packets queued by dividing txq length with the 882 * number of queues. 883 */ 884 if (skb_queue_len(&tfile->socket.sk->sk_receive_queue) * numqueues 885 >= dev->tx_queue_len) 886 goto drop; 887 888 if (unlikely(skb_orphan_frags(skb, GFP_ATOMIC))) 889 goto drop; 890 891 skb_tx_timestamp(skb); 892 893 /* Orphan the skb - required as we might hang on to it 894 * for indefinite time. 895 */ 896 skb_orphan(skb); 897 898 nf_reset(skb); 899 900 if (skb_array_produce(&tfile->tx_array, skb)) 901 goto drop; 902 903 /* Notify and wake up reader process */ 904 if (tfile->flags & TUN_FASYNC) 905 kill_fasync(&tfile->fasync, SIGIO, POLL_IN); 906 tfile->socket.sk->sk_data_ready(tfile->socket.sk); 907 908 rcu_read_unlock(); 909 return NETDEV_TX_OK; 910 911 drop: 912 this_cpu_inc(tun->pcpu_stats->tx_dropped); 913 skb_tx_error(skb); 914 kfree_skb(skb); 915 rcu_read_unlock(); 916 return NET_XMIT_DROP; 917 } 918 919 static void tun_net_mclist(struct net_device *dev) 920 { 921 /* 922 * This callback is supposed to deal with mc filter in 923 * _rx_ path and has nothing to do with the _tx_ path. 924 * In rx path we always accept everything userspace gives us. 925 */ 926 } 927 928 #define MIN_MTU 68 929 #define MAX_MTU 65535 930 931 static int 932 tun_net_change_mtu(struct net_device *dev, int new_mtu) 933 { 934 if (new_mtu < MIN_MTU || new_mtu + dev->hard_header_len > MAX_MTU) 935 return -EINVAL; 936 dev->mtu = new_mtu; 937 return 0; 938 } 939 940 static netdev_features_t tun_net_fix_features(struct net_device *dev, 941 netdev_features_t features) 942 { 943 struct tun_struct *tun = netdev_priv(dev); 944 945 return (features & tun->set_features) | (features & ~TUN_USER_FEATURES); 946 } 947 #ifdef CONFIG_NET_POLL_CONTROLLER 948 static void tun_poll_controller(struct net_device *dev) 949 { 950 /* 951 * Tun only receives frames when: 952 * 1) the char device endpoint gets data from user space 953 * 2) the tun socket gets a sendmsg call from user space 954 * Since both of those are synchronous operations, we are guaranteed 955 * never to have pending data when we poll for it 956 * so there is nothing to do here but return. 957 * We need this though so netpoll recognizes us as an interface that 958 * supports polling, which enables bridge devices in virt setups to 959 * still use netconsole 960 */ 961 return; 962 } 963 #endif 964 965 static void tun_set_headroom(struct net_device *dev, int new_hr) 966 { 967 struct tun_struct *tun = netdev_priv(dev); 968 969 if (new_hr < NET_SKB_PAD) 970 new_hr = NET_SKB_PAD; 971 972 tun->align = new_hr; 973 } 974 975 static struct rtnl_link_stats64 * 976 tun_net_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats) 977 { 978 u32 rx_dropped = 0, tx_dropped = 0, rx_frame_errors = 0; 979 struct tun_struct *tun = netdev_priv(dev); 980 struct tun_pcpu_stats *p; 981 int i; 982 983 for_each_possible_cpu(i) { 984 u64 rxpackets, rxbytes, txpackets, txbytes; 985 unsigned int start; 986 987 p = per_cpu_ptr(tun->pcpu_stats, i); 988 do { 989 start = u64_stats_fetch_begin(&p->syncp); 990 rxpackets = p->rx_packets; 991 rxbytes = p->rx_bytes; 992 txpackets = p->tx_packets; 993 txbytes = p->tx_bytes; 994 } while (u64_stats_fetch_retry(&p->syncp, start)); 995 996 stats->rx_packets += rxpackets; 997 stats->rx_bytes += rxbytes; 998 stats->tx_packets += txpackets; 999 stats->tx_bytes += txbytes; 1000 1001 /* u32 counters */ 1002 rx_dropped += p->rx_dropped; 1003 rx_frame_errors += p->rx_frame_errors; 1004 tx_dropped += p->tx_dropped; 1005 } 1006 stats->rx_dropped = rx_dropped; 1007 stats->rx_frame_errors = rx_frame_errors; 1008 stats->tx_dropped = tx_dropped; 1009 return stats; 1010 } 1011 1012 static const struct net_device_ops tun_netdev_ops = { 1013 .ndo_uninit = tun_net_uninit, 1014 .ndo_open = tun_net_open, 1015 .ndo_stop = tun_net_close, 1016 .ndo_start_xmit = tun_net_xmit, 1017 .ndo_change_mtu = tun_net_change_mtu, 1018 .ndo_fix_features = tun_net_fix_features, 1019 .ndo_select_queue = tun_select_queue, 1020 #ifdef CONFIG_NET_POLL_CONTROLLER 1021 .ndo_poll_controller = tun_poll_controller, 1022 #endif 1023 .ndo_set_rx_headroom = tun_set_headroom, 1024 .ndo_get_stats64 = tun_net_get_stats64, 1025 }; 1026 1027 static const struct net_device_ops tap_netdev_ops = { 1028 .ndo_uninit = tun_net_uninit, 1029 .ndo_open = tun_net_open, 1030 .ndo_stop = tun_net_close, 1031 .ndo_start_xmit = tun_net_xmit, 1032 .ndo_change_mtu = tun_net_change_mtu, 1033 .ndo_fix_features = tun_net_fix_features, 1034 .ndo_set_rx_mode = tun_net_mclist, 1035 .ndo_set_mac_address = eth_mac_addr, 1036 .ndo_validate_addr = eth_validate_addr, 1037 .ndo_select_queue = tun_select_queue, 1038 #ifdef CONFIG_NET_POLL_CONTROLLER 1039 .ndo_poll_controller = tun_poll_controller, 1040 #endif 1041 .ndo_features_check = passthru_features_check, 1042 .ndo_set_rx_headroom = tun_set_headroom, 1043 .ndo_get_stats64 = tun_net_get_stats64, 1044 }; 1045 1046 static void tun_flow_init(struct tun_struct *tun) 1047 { 1048 int i; 1049 1050 for (i = 0; i < TUN_NUM_FLOW_ENTRIES; i++) 1051 INIT_HLIST_HEAD(&tun->flows[i]); 1052 1053 tun->ageing_time = TUN_FLOW_EXPIRE; 1054 setup_timer(&tun->flow_gc_timer, tun_flow_cleanup, (unsigned long)tun); 1055 mod_timer(&tun->flow_gc_timer, 1056 round_jiffies_up(jiffies + tun->ageing_time)); 1057 } 1058 1059 static void tun_flow_uninit(struct tun_struct *tun) 1060 { 1061 del_timer_sync(&tun->flow_gc_timer); 1062 tun_flow_flush(tun); 1063 } 1064 1065 /* Initialize net device. */ 1066 static void tun_net_init(struct net_device *dev) 1067 { 1068 struct tun_struct *tun = netdev_priv(dev); 1069 1070 switch (tun->flags & TUN_TYPE_MASK) { 1071 case IFF_TUN: 1072 dev->netdev_ops = &tun_netdev_ops; 1073 1074 /* Point-to-Point TUN Device */ 1075 dev->hard_header_len = 0; 1076 dev->addr_len = 0; 1077 dev->mtu = 1500; 1078 1079 /* Zero header length */ 1080 dev->type = ARPHRD_NONE; 1081 dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; 1082 break; 1083 1084 case IFF_TAP: 1085 dev->netdev_ops = &tap_netdev_ops; 1086 /* Ethernet TAP Device */ 1087 ether_setup(dev); 1088 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 1089 dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; 1090 1091 eth_hw_addr_random(dev); 1092 1093 break; 1094 } 1095 } 1096 1097 /* Character device part */ 1098 1099 /* Poll */ 1100 static unsigned int tun_chr_poll(struct file *file, poll_table *wait) 1101 { 1102 struct tun_file *tfile = file->private_data; 1103 struct tun_struct *tun = __tun_get(tfile); 1104 struct sock *sk; 1105 unsigned int mask = 0; 1106 1107 if (!tun) 1108 return POLLERR; 1109 1110 sk = tfile->socket.sk; 1111 1112 tun_debug(KERN_INFO, tun, "tun_chr_poll\n"); 1113 1114 poll_wait(file, sk_sleep(sk), wait); 1115 1116 if (!skb_array_empty(&tfile->tx_array)) 1117 mask |= POLLIN | POLLRDNORM; 1118 1119 if (sock_writeable(sk) || 1120 (!test_and_set_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags) && 1121 sock_writeable(sk))) 1122 mask |= POLLOUT | POLLWRNORM; 1123 1124 if (tun->dev->reg_state != NETREG_REGISTERED) 1125 mask = POLLERR; 1126 1127 tun_put(tun); 1128 return mask; 1129 } 1130 1131 /* prepad is the amount to reserve at front. len is length after that. 1132 * linear is a hint as to how much to copy (usually headers). */ 1133 static struct sk_buff *tun_alloc_skb(struct tun_file *tfile, 1134 size_t prepad, size_t len, 1135 size_t linear, int noblock) 1136 { 1137 struct sock *sk = tfile->socket.sk; 1138 struct sk_buff *skb; 1139 int err; 1140 1141 /* Under a page? Don't bother with paged skb. */ 1142 if (prepad + len < PAGE_SIZE || !linear) 1143 linear = len; 1144 1145 skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock, 1146 &err, 0); 1147 if (!skb) 1148 return ERR_PTR(err); 1149 1150 skb_reserve(skb, prepad); 1151 skb_put(skb, linear); 1152 skb->data_len = len - linear; 1153 skb->len += len - linear; 1154 1155 return skb; 1156 } 1157 1158 /* Get packet from user space buffer */ 1159 static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, 1160 void *msg_control, struct iov_iter *from, 1161 int noblock) 1162 { 1163 struct tun_pi pi = { 0, cpu_to_be16(ETH_P_IP) }; 1164 struct sk_buff *skb; 1165 size_t total_len = iov_iter_count(from); 1166 size_t len = total_len, align = tun->align, linear; 1167 struct virtio_net_hdr gso = { 0 }; 1168 struct tun_pcpu_stats *stats; 1169 int good_linear; 1170 int copylen; 1171 bool zerocopy = false; 1172 int err; 1173 u32 rxhash; 1174 ssize_t n; 1175 1176 if (!(tun->dev->flags & IFF_UP)) 1177 return -EIO; 1178 1179 if (!(tun->flags & IFF_NO_PI)) { 1180 if (len < sizeof(pi)) 1181 return -EINVAL; 1182 len -= sizeof(pi); 1183 1184 n = copy_from_iter(&pi, sizeof(pi), from); 1185 if (n != sizeof(pi)) 1186 return -EFAULT; 1187 } 1188 1189 if (tun->flags & IFF_VNET_HDR) { 1190 if (len < tun->vnet_hdr_sz) 1191 return -EINVAL; 1192 len -= tun->vnet_hdr_sz; 1193 1194 n = copy_from_iter(&gso, sizeof(gso), from); 1195 if (n != sizeof(gso)) 1196 return -EFAULT; 1197 1198 if ((gso.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && 1199 tun16_to_cpu(tun, gso.csum_start) + tun16_to_cpu(tun, gso.csum_offset) + 2 > tun16_to_cpu(tun, gso.hdr_len)) 1200 gso.hdr_len = cpu_to_tun16(tun, tun16_to_cpu(tun, gso.csum_start) + tun16_to_cpu(tun, gso.csum_offset) + 2); 1201 1202 if (tun16_to_cpu(tun, gso.hdr_len) > len) 1203 return -EINVAL; 1204 iov_iter_advance(from, tun->vnet_hdr_sz - sizeof(gso)); 1205 } 1206 1207 if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP) { 1208 align += NET_IP_ALIGN; 1209 if (unlikely(len < ETH_HLEN || 1210 (gso.hdr_len && tun16_to_cpu(tun, gso.hdr_len) < ETH_HLEN))) 1211 return -EINVAL; 1212 } 1213 1214 good_linear = SKB_MAX_HEAD(align); 1215 1216 if (msg_control) { 1217 struct iov_iter i = *from; 1218 1219 /* There are 256 bytes to be copied in skb, so there is 1220 * enough room for skb expand head in case it is used. 1221 * The rest of the buffer is mapped from userspace. 1222 */ 1223 copylen = gso.hdr_len ? tun16_to_cpu(tun, gso.hdr_len) : GOODCOPY_LEN; 1224 if (copylen > good_linear) 1225 copylen = good_linear; 1226 linear = copylen; 1227 iov_iter_advance(&i, copylen); 1228 if (iov_iter_npages(&i, INT_MAX) <= MAX_SKB_FRAGS) 1229 zerocopy = true; 1230 } 1231 1232 if (!zerocopy) { 1233 copylen = len; 1234 if (tun16_to_cpu(tun, gso.hdr_len) > good_linear) 1235 linear = good_linear; 1236 else 1237 linear = tun16_to_cpu(tun, gso.hdr_len); 1238 } 1239 1240 skb = tun_alloc_skb(tfile, align, copylen, linear, noblock); 1241 if (IS_ERR(skb)) { 1242 if (PTR_ERR(skb) != -EAGAIN) 1243 this_cpu_inc(tun->pcpu_stats->rx_dropped); 1244 return PTR_ERR(skb); 1245 } 1246 1247 if (zerocopy) 1248 err = zerocopy_sg_from_iter(skb, from); 1249 else { 1250 err = skb_copy_datagram_from_iter(skb, 0, from, len); 1251 if (!err && msg_control) { 1252 struct ubuf_info *uarg = msg_control; 1253 uarg->callback(uarg, false); 1254 } 1255 } 1256 1257 if (err) { 1258 this_cpu_inc(tun->pcpu_stats->rx_dropped); 1259 kfree_skb(skb); 1260 return -EFAULT; 1261 } 1262 1263 err = virtio_net_hdr_to_skb(skb, &gso, tun_is_little_endian(tun)); 1264 if (err) { 1265 this_cpu_inc(tun->pcpu_stats->rx_frame_errors); 1266 kfree_skb(skb); 1267 return -EINVAL; 1268 } 1269 1270 switch (tun->flags & TUN_TYPE_MASK) { 1271 case IFF_TUN: 1272 if (tun->flags & IFF_NO_PI) { 1273 switch (skb->data[0] & 0xf0) { 1274 case 0x40: 1275 pi.proto = htons(ETH_P_IP); 1276 break; 1277 case 0x60: 1278 pi.proto = htons(ETH_P_IPV6); 1279 break; 1280 default: 1281 this_cpu_inc(tun->pcpu_stats->rx_dropped); 1282 kfree_skb(skb); 1283 return -EINVAL; 1284 } 1285 } 1286 1287 skb_reset_mac_header(skb); 1288 skb->protocol = pi.proto; 1289 skb->dev = tun->dev; 1290 break; 1291 case IFF_TAP: 1292 skb->protocol = eth_type_trans(skb, tun->dev); 1293 break; 1294 } 1295 1296 /* copy skb_ubuf_info for callback when skb has no error */ 1297 if (zerocopy) { 1298 skb_shinfo(skb)->destructor_arg = msg_control; 1299 skb_shinfo(skb)->tx_flags |= SKBTX_DEV_ZEROCOPY; 1300 skb_shinfo(skb)->tx_flags |= SKBTX_SHARED_FRAG; 1301 } 1302 1303 skb_reset_network_header(skb); 1304 skb_probe_transport_header(skb, 0); 1305 1306 rxhash = skb_get_hash(skb); 1307 netif_rx_ni(skb); 1308 1309 stats = get_cpu_ptr(tun->pcpu_stats); 1310 u64_stats_update_begin(&stats->syncp); 1311 stats->rx_packets++; 1312 stats->rx_bytes += len; 1313 u64_stats_update_end(&stats->syncp); 1314 put_cpu_ptr(stats); 1315 1316 tun_flow_update(tun, rxhash, tfile); 1317 return total_len; 1318 } 1319 1320 static ssize_t tun_chr_write_iter(struct kiocb *iocb, struct iov_iter *from) 1321 { 1322 struct file *file = iocb->ki_filp; 1323 struct tun_struct *tun = tun_get(file); 1324 struct tun_file *tfile = file->private_data; 1325 ssize_t result; 1326 1327 if (!tun) 1328 return -EBADFD; 1329 1330 result = tun_get_user(tun, tfile, NULL, from, file->f_flags & O_NONBLOCK); 1331 1332 tun_put(tun); 1333 return result; 1334 } 1335 1336 /* Put packet to the user space buffer */ 1337 static ssize_t tun_put_user(struct tun_struct *tun, 1338 struct tun_file *tfile, 1339 struct sk_buff *skb, 1340 struct iov_iter *iter) 1341 { 1342 struct tun_pi pi = { 0, skb->protocol }; 1343 struct tun_pcpu_stats *stats; 1344 ssize_t total; 1345 int vlan_offset = 0; 1346 int vlan_hlen = 0; 1347 int vnet_hdr_sz = 0; 1348 1349 if (skb_vlan_tag_present(skb)) 1350 vlan_hlen = VLAN_HLEN; 1351 1352 if (tun->flags & IFF_VNET_HDR) 1353 vnet_hdr_sz = tun->vnet_hdr_sz; 1354 1355 total = skb->len + vlan_hlen + vnet_hdr_sz; 1356 1357 if (!(tun->flags & IFF_NO_PI)) { 1358 if (iov_iter_count(iter) < sizeof(pi)) 1359 return -EINVAL; 1360 1361 total += sizeof(pi); 1362 if (iov_iter_count(iter) < total) { 1363 /* Packet will be striped */ 1364 pi.flags |= TUN_PKT_STRIP; 1365 } 1366 1367 if (copy_to_iter(&pi, sizeof(pi), iter) != sizeof(pi)) 1368 return -EFAULT; 1369 } 1370 1371 if (vnet_hdr_sz) { 1372 struct virtio_net_hdr gso = { 0 }; /* no info leak */ 1373 int ret; 1374 1375 if (iov_iter_count(iter) < vnet_hdr_sz) 1376 return -EINVAL; 1377 1378 ret = virtio_net_hdr_from_skb(skb, &gso, 1379 tun_is_little_endian(tun)); 1380 if (ret) { 1381 struct skb_shared_info *sinfo = skb_shinfo(skb); 1382 pr_err("unexpected GSO type: " 1383 "0x%x, gso_size %d, hdr_len %d\n", 1384 sinfo->gso_type, tun16_to_cpu(tun, gso.gso_size), 1385 tun16_to_cpu(tun, gso.hdr_len)); 1386 print_hex_dump(KERN_ERR, "tun: ", 1387 DUMP_PREFIX_NONE, 1388 16, 1, skb->head, 1389 min((int)tun16_to_cpu(tun, gso.hdr_len), 64), true); 1390 WARN_ON_ONCE(1); 1391 return -EINVAL; 1392 } 1393 1394 if (copy_to_iter(&gso, sizeof(gso), iter) != sizeof(gso)) 1395 return -EFAULT; 1396 1397 iov_iter_advance(iter, vnet_hdr_sz - sizeof(gso)); 1398 } 1399 1400 if (vlan_hlen) { 1401 int ret; 1402 struct { 1403 __be16 h_vlan_proto; 1404 __be16 h_vlan_TCI; 1405 } veth; 1406 1407 veth.h_vlan_proto = skb->vlan_proto; 1408 veth.h_vlan_TCI = htons(skb_vlan_tag_get(skb)); 1409 1410 vlan_offset = offsetof(struct vlan_ethhdr, h_vlan_proto); 1411 1412 ret = skb_copy_datagram_iter(skb, 0, iter, vlan_offset); 1413 if (ret || !iov_iter_count(iter)) 1414 goto done; 1415 1416 ret = copy_to_iter(&veth, sizeof(veth), iter); 1417 if (ret != sizeof(veth) || !iov_iter_count(iter)) 1418 goto done; 1419 } 1420 1421 skb_copy_datagram_iter(skb, vlan_offset, iter, skb->len - vlan_offset); 1422 1423 done: 1424 /* caller is in process context, */ 1425 stats = get_cpu_ptr(tun->pcpu_stats); 1426 u64_stats_update_begin(&stats->syncp); 1427 stats->tx_packets++; 1428 stats->tx_bytes += skb->len + vlan_hlen; 1429 u64_stats_update_end(&stats->syncp); 1430 put_cpu_ptr(tun->pcpu_stats); 1431 1432 return total; 1433 } 1434 1435 static struct sk_buff *tun_ring_recv(struct tun_file *tfile, int noblock, 1436 int *err) 1437 { 1438 DECLARE_WAITQUEUE(wait, current); 1439 struct sk_buff *skb = NULL; 1440 int error = 0; 1441 1442 skb = skb_array_consume(&tfile->tx_array); 1443 if (skb) 1444 goto out; 1445 if (noblock) { 1446 error = -EAGAIN; 1447 goto out; 1448 } 1449 1450 add_wait_queue(&tfile->wq.wait, &wait); 1451 current->state = TASK_INTERRUPTIBLE; 1452 1453 while (1) { 1454 skb = skb_array_consume(&tfile->tx_array); 1455 if (skb) 1456 break; 1457 if (signal_pending(current)) { 1458 error = -ERESTARTSYS; 1459 break; 1460 } 1461 if (tfile->socket.sk->sk_shutdown & RCV_SHUTDOWN) { 1462 error = -EFAULT; 1463 break; 1464 } 1465 1466 schedule(); 1467 } 1468 1469 current->state = TASK_RUNNING; 1470 remove_wait_queue(&tfile->wq.wait, &wait); 1471 1472 out: 1473 *err = error; 1474 return skb; 1475 } 1476 1477 static ssize_t tun_do_read(struct tun_struct *tun, struct tun_file *tfile, 1478 struct iov_iter *to, 1479 int noblock) 1480 { 1481 struct sk_buff *skb; 1482 ssize_t ret; 1483 int err; 1484 1485 tun_debug(KERN_INFO, tun, "tun_do_read\n"); 1486 1487 if (!iov_iter_count(to)) 1488 return 0; 1489 1490 /* Read frames from ring */ 1491 skb = tun_ring_recv(tfile, noblock, &err); 1492 if (!skb) 1493 return err; 1494 1495 ret = tun_put_user(tun, tfile, skb, to); 1496 if (unlikely(ret < 0)) 1497 kfree_skb(skb); 1498 else 1499 consume_skb(skb); 1500 1501 return ret; 1502 } 1503 1504 static ssize_t tun_chr_read_iter(struct kiocb *iocb, struct iov_iter *to) 1505 { 1506 struct file *file = iocb->ki_filp; 1507 struct tun_file *tfile = file->private_data; 1508 struct tun_struct *tun = __tun_get(tfile); 1509 ssize_t len = iov_iter_count(to), ret; 1510 1511 if (!tun) 1512 return -EBADFD; 1513 ret = tun_do_read(tun, tfile, to, file->f_flags & O_NONBLOCK); 1514 ret = min_t(ssize_t, ret, len); 1515 if (ret > 0) 1516 iocb->ki_pos = ret; 1517 tun_put(tun); 1518 return ret; 1519 } 1520 1521 static void tun_free_netdev(struct net_device *dev) 1522 { 1523 struct tun_struct *tun = netdev_priv(dev); 1524 1525 BUG_ON(!(list_empty(&tun->disabled))); 1526 free_percpu(tun->pcpu_stats); 1527 tun_flow_uninit(tun); 1528 security_tun_dev_free_security(tun->security); 1529 free_netdev(dev); 1530 } 1531 1532 static void tun_setup(struct net_device *dev) 1533 { 1534 struct tun_struct *tun = netdev_priv(dev); 1535 1536 tun->owner = INVALID_UID; 1537 tun->group = INVALID_GID; 1538 1539 dev->ethtool_ops = &tun_ethtool_ops; 1540 dev->destructor = tun_free_netdev; 1541 /* We prefer our own queue length */ 1542 dev->tx_queue_len = TUN_READQ_SIZE; 1543 } 1544 1545 /* Trivial set of netlink ops to allow deleting tun or tap 1546 * device with netlink. 1547 */ 1548 static int tun_validate(struct nlattr *tb[], struct nlattr *data[]) 1549 { 1550 return -EINVAL; 1551 } 1552 1553 static struct rtnl_link_ops tun_link_ops __read_mostly = { 1554 .kind = DRV_NAME, 1555 .priv_size = sizeof(struct tun_struct), 1556 .setup = tun_setup, 1557 .validate = tun_validate, 1558 }; 1559 1560 static void tun_sock_write_space(struct sock *sk) 1561 { 1562 struct tun_file *tfile; 1563 wait_queue_head_t *wqueue; 1564 1565 if (!sock_writeable(sk)) 1566 return; 1567 1568 if (!test_and_clear_bit(SOCKWQ_ASYNC_NOSPACE, &sk->sk_socket->flags)) 1569 return; 1570 1571 wqueue = sk_sleep(sk); 1572 if (wqueue && waitqueue_active(wqueue)) 1573 wake_up_interruptible_sync_poll(wqueue, POLLOUT | 1574 POLLWRNORM | POLLWRBAND); 1575 1576 tfile = container_of(sk, struct tun_file, sk); 1577 kill_fasync(&tfile->fasync, SIGIO, POLL_OUT); 1578 } 1579 1580 static int tun_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) 1581 { 1582 int ret; 1583 struct tun_file *tfile = container_of(sock, struct tun_file, socket); 1584 struct tun_struct *tun = __tun_get(tfile); 1585 1586 if (!tun) 1587 return -EBADFD; 1588 1589 ret = tun_get_user(tun, tfile, m->msg_control, &m->msg_iter, 1590 m->msg_flags & MSG_DONTWAIT); 1591 tun_put(tun); 1592 return ret; 1593 } 1594 1595 static int tun_recvmsg(struct socket *sock, struct msghdr *m, size_t total_len, 1596 int flags) 1597 { 1598 struct tun_file *tfile = container_of(sock, struct tun_file, socket); 1599 struct tun_struct *tun = __tun_get(tfile); 1600 int ret; 1601 1602 if (!tun) 1603 return -EBADFD; 1604 1605 if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) { 1606 ret = -EINVAL; 1607 goto out; 1608 } 1609 if (flags & MSG_ERRQUEUE) { 1610 ret = sock_recv_errqueue(sock->sk, m, total_len, 1611 SOL_PACKET, TUN_TX_TIMESTAMP); 1612 goto out; 1613 } 1614 ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT); 1615 if (ret > (ssize_t)total_len) { 1616 m->msg_flags |= MSG_TRUNC; 1617 ret = flags & MSG_TRUNC ? ret : total_len; 1618 } 1619 out: 1620 tun_put(tun); 1621 return ret; 1622 } 1623 1624 static int tun_peek_len(struct socket *sock) 1625 { 1626 struct tun_file *tfile = container_of(sock, struct tun_file, socket); 1627 struct tun_struct *tun; 1628 int ret = 0; 1629 1630 tun = __tun_get(tfile); 1631 if (!tun) 1632 return 0; 1633 1634 ret = skb_array_peek_len(&tfile->tx_array); 1635 tun_put(tun); 1636 1637 return ret; 1638 } 1639 1640 /* Ops structure to mimic raw sockets with tun */ 1641 static const struct proto_ops tun_socket_ops = { 1642 .peek_len = tun_peek_len, 1643 .sendmsg = tun_sendmsg, 1644 .recvmsg = tun_recvmsg, 1645 }; 1646 1647 static struct proto tun_proto = { 1648 .name = "tun", 1649 .owner = THIS_MODULE, 1650 .obj_size = sizeof(struct tun_file), 1651 }; 1652 1653 static int tun_flags(struct tun_struct *tun) 1654 { 1655 return tun->flags & (TUN_FEATURES | IFF_PERSIST | IFF_TUN | IFF_TAP); 1656 } 1657 1658 static ssize_t tun_show_flags(struct device *dev, struct device_attribute *attr, 1659 char *buf) 1660 { 1661 struct tun_struct *tun = netdev_priv(to_net_dev(dev)); 1662 return sprintf(buf, "0x%x\n", tun_flags(tun)); 1663 } 1664 1665 static ssize_t tun_show_owner(struct device *dev, struct device_attribute *attr, 1666 char *buf) 1667 { 1668 struct tun_struct *tun = netdev_priv(to_net_dev(dev)); 1669 return uid_valid(tun->owner)? 1670 sprintf(buf, "%u\n", 1671 from_kuid_munged(current_user_ns(), tun->owner)): 1672 sprintf(buf, "-1\n"); 1673 } 1674 1675 static ssize_t tun_show_group(struct device *dev, struct device_attribute *attr, 1676 char *buf) 1677 { 1678 struct tun_struct *tun = netdev_priv(to_net_dev(dev)); 1679 return gid_valid(tun->group) ? 1680 sprintf(buf, "%u\n", 1681 from_kgid_munged(current_user_ns(), tun->group)): 1682 sprintf(buf, "-1\n"); 1683 } 1684 1685 static DEVICE_ATTR(tun_flags, 0444, tun_show_flags, NULL); 1686 static DEVICE_ATTR(owner, 0444, tun_show_owner, NULL); 1687 static DEVICE_ATTR(group, 0444, tun_show_group, NULL); 1688 1689 static struct attribute *tun_dev_attrs[] = { 1690 &dev_attr_tun_flags.attr, 1691 &dev_attr_owner.attr, 1692 &dev_attr_group.attr, 1693 NULL 1694 }; 1695 1696 static const struct attribute_group tun_attr_group = { 1697 .attrs = tun_dev_attrs 1698 }; 1699 1700 static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) 1701 { 1702 struct tun_struct *tun; 1703 struct tun_file *tfile = file->private_data; 1704 struct net_device *dev; 1705 int err; 1706 1707 if (tfile->detached) 1708 return -EINVAL; 1709 1710 dev = __dev_get_by_name(net, ifr->ifr_name); 1711 if (dev) { 1712 if (ifr->ifr_flags & IFF_TUN_EXCL) 1713 return -EBUSY; 1714 if ((ifr->ifr_flags & IFF_TUN) && dev->netdev_ops == &tun_netdev_ops) 1715 tun = netdev_priv(dev); 1716 else if ((ifr->ifr_flags & IFF_TAP) && dev->netdev_ops == &tap_netdev_ops) 1717 tun = netdev_priv(dev); 1718 else 1719 return -EINVAL; 1720 1721 if (!!(ifr->ifr_flags & IFF_MULTI_QUEUE) != 1722 !!(tun->flags & IFF_MULTI_QUEUE)) 1723 return -EINVAL; 1724 1725 if (tun_not_capable(tun)) 1726 return -EPERM; 1727 err = security_tun_dev_open(tun->security); 1728 if (err < 0) 1729 return err; 1730 1731 err = tun_attach(tun, file, ifr->ifr_flags & IFF_NOFILTER); 1732 if (err < 0) 1733 return err; 1734 1735 if (tun->flags & IFF_MULTI_QUEUE && 1736 (tun->numqueues + tun->numdisabled > 1)) { 1737 /* One or more queue has already been attached, no need 1738 * to initialize the device again. 1739 */ 1740 return 0; 1741 } 1742 } 1743 else { 1744 char *name; 1745 unsigned long flags = 0; 1746 int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ? 1747 MAX_TAP_QUEUES : 1; 1748 1749 if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) 1750 return -EPERM; 1751 err = security_tun_dev_create(); 1752 if (err < 0) 1753 return err; 1754 1755 /* Set dev type */ 1756 if (ifr->ifr_flags & IFF_TUN) { 1757 /* TUN device */ 1758 flags |= IFF_TUN; 1759 name = "tun%d"; 1760 } else if (ifr->ifr_flags & IFF_TAP) { 1761 /* TAP device */ 1762 flags |= IFF_TAP; 1763 name = "tap%d"; 1764 } else 1765 return -EINVAL; 1766 1767 if (*ifr->ifr_name) 1768 name = ifr->ifr_name; 1769 1770 dev = alloc_netdev_mqs(sizeof(struct tun_struct), name, 1771 NET_NAME_UNKNOWN, tun_setup, queues, 1772 queues); 1773 1774 if (!dev) 1775 return -ENOMEM; 1776 1777 dev_net_set(dev, net); 1778 dev->rtnl_link_ops = &tun_link_ops; 1779 dev->ifindex = tfile->ifindex; 1780 dev->sysfs_groups[0] = &tun_attr_group; 1781 1782 tun = netdev_priv(dev); 1783 tun->dev = dev; 1784 tun->flags = flags; 1785 tun->txflt.count = 0; 1786 tun->vnet_hdr_sz = sizeof(struct virtio_net_hdr); 1787 1788 tun->align = NET_SKB_PAD; 1789 tun->filter_attached = false; 1790 tun->sndbuf = tfile->socket.sk->sk_sndbuf; 1791 1792 tun->pcpu_stats = netdev_alloc_pcpu_stats(struct tun_pcpu_stats); 1793 if (!tun->pcpu_stats) { 1794 err = -ENOMEM; 1795 goto err_free_dev; 1796 } 1797 1798 spin_lock_init(&tun->lock); 1799 1800 err = security_tun_dev_alloc_security(&tun->security); 1801 if (err < 0) 1802 goto err_free_stat; 1803 1804 tun_net_init(dev); 1805 tun_flow_init(tun); 1806 1807 dev->hw_features = NETIF_F_SG | NETIF_F_FRAGLIST | 1808 TUN_USER_FEATURES | NETIF_F_HW_VLAN_CTAG_TX | 1809 NETIF_F_HW_VLAN_STAG_TX; 1810 dev->features = dev->hw_features | NETIF_F_LLTX; 1811 dev->vlan_features = dev->features & 1812 ~(NETIF_F_HW_VLAN_CTAG_TX | 1813 NETIF_F_HW_VLAN_STAG_TX); 1814 1815 INIT_LIST_HEAD(&tun->disabled); 1816 err = tun_attach(tun, file, false); 1817 if (err < 0) 1818 goto err_free_flow; 1819 1820 err = register_netdevice(tun->dev); 1821 if (err < 0) 1822 goto err_detach; 1823 } 1824 1825 netif_carrier_on(tun->dev); 1826 1827 tun_debug(KERN_INFO, tun, "tun_set_iff\n"); 1828 1829 tun->flags = (tun->flags & ~TUN_FEATURES) | 1830 (ifr->ifr_flags & TUN_FEATURES); 1831 1832 /* Make sure persistent devices do not get stuck in 1833 * xoff state. 1834 */ 1835 if (netif_running(tun->dev)) 1836 netif_tx_wake_all_queues(tun->dev); 1837 1838 strcpy(ifr->ifr_name, tun->dev->name); 1839 return 0; 1840 1841 err_detach: 1842 tun_detach_all(dev); 1843 err_free_flow: 1844 tun_flow_uninit(tun); 1845 security_tun_dev_free_security(tun->security); 1846 err_free_stat: 1847 free_percpu(tun->pcpu_stats); 1848 err_free_dev: 1849 free_netdev(dev); 1850 return err; 1851 } 1852 1853 static void tun_get_iff(struct net *net, struct tun_struct *tun, 1854 struct ifreq *ifr) 1855 { 1856 tun_debug(KERN_INFO, tun, "tun_get_iff\n"); 1857 1858 strcpy(ifr->ifr_name, tun->dev->name); 1859 1860 ifr->ifr_flags = tun_flags(tun); 1861 1862 } 1863 1864 /* This is like a cut-down ethtool ops, except done via tun fd so no 1865 * privs required. */ 1866 static int set_offload(struct tun_struct *tun, unsigned long arg) 1867 { 1868 netdev_features_t features = 0; 1869 1870 if (arg & TUN_F_CSUM) { 1871 features |= NETIF_F_HW_CSUM; 1872 arg &= ~TUN_F_CSUM; 1873 1874 if (arg & (TUN_F_TSO4|TUN_F_TSO6)) { 1875 if (arg & TUN_F_TSO_ECN) { 1876 features |= NETIF_F_TSO_ECN; 1877 arg &= ~TUN_F_TSO_ECN; 1878 } 1879 if (arg & TUN_F_TSO4) 1880 features |= NETIF_F_TSO; 1881 if (arg & TUN_F_TSO6) 1882 features |= NETIF_F_TSO6; 1883 arg &= ~(TUN_F_TSO4|TUN_F_TSO6); 1884 } 1885 1886 if (arg & TUN_F_UFO) { 1887 features |= NETIF_F_UFO; 1888 arg &= ~TUN_F_UFO; 1889 } 1890 } 1891 1892 /* This gives the user a way to test for new features in future by 1893 * trying to set them. */ 1894 if (arg) 1895 return -EINVAL; 1896 1897 tun->set_features = features; 1898 netdev_update_features(tun->dev); 1899 1900 return 0; 1901 } 1902 1903 static void tun_detach_filter(struct tun_struct *tun, int n) 1904 { 1905 int i; 1906 struct tun_file *tfile; 1907 1908 for (i = 0; i < n; i++) { 1909 tfile = rtnl_dereference(tun->tfiles[i]); 1910 lock_sock(tfile->socket.sk); 1911 sk_detach_filter(tfile->socket.sk); 1912 release_sock(tfile->socket.sk); 1913 } 1914 1915 tun->filter_attached = false; 1916 } 1917 1918 static int tun_attach_filter(struct tun_struct *tun) 1919 { 1920 int i, ret = 0; 1921 struct tun_file *tfile; 1922 1923 for (i = 0; i < tun->numqueues; i++) { 1924 tfile = rtnl_dereference(tun->tfiles[i]); 1925 lock_sock(tfile->socket.sk); 1926 ret = sk_attach_filter(&tun->fprog, tfile->socket.sk); 1927 release_sock(tfile->socket.sk); 1928 if (ret) { 1929 tun_detach_filter(tun, i); 1930 return ret; 1931 } 1932 } 1933 1934 tun->filter_attached = true; 1935 return ret; 1936 } 1937 1938 static void tun_set_sndbuf(struct tun_struct *tun) 1939 { 1940 struct tun_file *tfile; 1941 int i; 1942 1943 for (i = 0; i < tun->numqueues; i++) { 1944 tfile = rtnl_dereference(tun->tfiles[i]); 1945 tfile->socket.sk->sk_sndbuf = tun->sndbuf; 1946 } 1947 } 1948 1949 static int tun_set_queue(struct file *file, struct ifreq *ifr) 1950 { 1951 struct tun_file *tfile = file->private_data; 1952 struct tun_struct *tun; 1953 int ret = 0; 1954 1955 rtnl_lock(); 1956 1957 if (ifr->ifr_flags & IFF_ATTACH_QUEUE) { 1958 tun = tfile->detached; 1959 if (!tun) { 1960 ret = -EINVAL; 1961 goto unlock; 1962 } 1963 ret = security_tun_dev_attach_queue(tun->security); 1964 if (ret < 0) 1965 goto unlock; 1966 ret = tun_attach(tun, file, false); 1967 } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) { 1968 tun = rtnl_dereference(tfile->tun); 1969 if (!tun || !(tun->flags & IFF_MULTI_QUEUE) || tfile->detached) 1970 ret = -EINVAL; 1971 else 1972 __tun_detach(tfile, false); 1973 } else 1974 ret = -EINVAL; 1975 1976 unlock: 1977 rtnl_unlock(); 1978 return ret; 1979 } 1980 1981 static long __tun_chr_ioctl(struct file *file, unsigned int cmd, 1982 unsigned long arg, int ifreq_len) 1983 { 1984 struct tun_file *tfile = file->private_data; 1985 struct tun_struct *tun; 1986 void __user* argp = (void __user*)arg; 1987 struct ifreq ifr; 1988 kuid_t owner; 1989 kgid_t group; 1990 int sndbuf; 1991 int vnet_hdr_sz; 1992 unsigned int ifindex; 1993 int le; 1994 int ret; 1995 1996 if (cmd == TUNSETIFF || cmd == TUNSETQUEUE || _IOC_TYPE(cmd) == 0x89) { 1997 if (copy_from_user(&ifr, argp, ifreq_len)) 1998 return -EFAULT; 1999 } else { 2000 memset(&ifr, 0, sizeof(ifr)); 2001 } 2002 if (cmd == TUNGETFEATURES) { 2003 /* Currently this just means: "what IFF flags are valid?". 2004 * This is needed because we never checked for invalid flags on 2005 * TUNSETIFF. 2006 */ 2007 return put_user(IFF_TUN | IFF_TAP | TUN_FEATURES, 2008 (unsigned int __user*)argp); 2009 } else if (cmd == TUNSETQUEUE) 2010 return tun_set_queue(file, &ifr); 2011 2012 ret = 0; 2013 rtnl_lock(); 2014 2015 tun = __tun_get(tfile); 2016 if (cmd == TUNSETIFF && !tun) { 2017 ifr.ifr_name[IFNAMSIZ-1] = '\0'; 2018 2019 ret = tun_set_iff(sock_net(&tfile->sk), file, &ifr); 2020 2021 if (ret) 2022 goto unlock; 2023 2024 if (copy_to_user(argp, &ifr, ifreq_len)) 2025 ret = -EFAULT; 2026 goto unlock; 2027 } 2028 if (cmd == TUNSETIFINDEX) { 2029 ret = -EPERM; 2030 if (tun) 2031 goto unlock; 2032 2033 ret = -EFAULT; 2034 if (copy_from_user(&ifindex, argp, sizeof(ifindex))) 2035 goto unlock; 2036 2037 ret = 0; 2038 tfile->ifindex = ifindex; 2039 goto unlock; 2040 } 2041 2042 ret = -EBADFD; 2043 if (!tun) 2044 goto unlock; 2045 2046 tun_debug(KERN_INFO, tun, "tun_chr_ioctl cmd %u\n", cmd); 2047 2048 ret = 0; 2049 switch (cmd) { 2050 case TUNGETIFF: 2051 tun_get_iff(current->nsproxy->net_ns, tun, &ifr); 2052 2053 if (tfile->detached) 2054 ifr.ifr_flags |= IFF_DETACH_QUEUE; 2055 if (!tfile->socket.sk->sk_filter) 2056 ifr.ifr_flags |= IFF_NOFILTER; 2057 2058 if (copy_to_user(argp, &ifr, ifreq_len)) 2059 ret = -EFAULT; 2060 break; 2061 2062 case TUNSETNOCSUM: 2063 /* Disable/Enable checksum */ 2064 2065 /* [unimplemented] */ 2066 tun_debug(KERN_INFO, tun, "ignored: set checksum %s\n", 2067 arg ? "disabled" : "enabled"); 2068 break; 2069 2070 case TUNSETPERSIST: 2071 /* Disable/Enable persist mode. Keep an extra reference to the 2072 * module to prevent the module being unprobed. 2073 */ 2074 if (arg && !(tun->flags & IFF_PERSIST)) { 2075 tun->flags |= IFF_PERSIST; 2076 __module_get(THIS_MODULE); 2077 } 2078 if (!arg && (tun->flags & IFF_PERSIST)) { 2079 tun->flags &= ~IFF_PERSIST; 2080 module_put(THIS_MODULE); 2081 } 2082 2083 tun_debug(KERN_INFO, tun, "persist %s\n", 2084 arg ? "enabled" : "disabled"); 2085 break; 2086 2087 case TUNSETOWNER: 2088 /* Set owner of the device */ 2089 owner = make_kuid(current_user_ns(), arg); 2090 if (!uid_valid(owner)) { 2091 ret = -EINVAL; 2092 break; 2093 } 2094 tun->owner = owner; 2095 tun_debug(KERN_INFO, tun, "owner set to %u\n", 2096 from_kuid(&init_user_ns, tun->owner)); 2097 break; 2098 2099 case TUNSETGROUP: 2100 /* Set group of the device */ 2101 group = make_kgid(current_user_ns(), arg); 2102 if (!gid_valid(group)) { 2103 ret = -EINVAL; 2104 break; 2105 } 2106 tun->group = group; 2107 tun_debug(KERN_INFO, tun, "group set to %u\n", 2108 from_kgid(&init_user_ns, tun->group)); 2109 break; 2110 2111 case TUNSETLINK: 2112 /* Only allow setting the type when the interface is down */ 2113 if (tun->dev->flags & IFF_UP) { 2114 tun_debug(KERN_INFO, tun, 2115 "Linktype set failed because interface is up\n"); 2116 ret = -EBUSY; 2117 } else { 2118 tun->dev->type = (int) arg; 2119 tun_debug(KERN_INFO, tun, "linktype set to %d\n", 2120 tun->dev->type); 2121 ret = 0; 2122 } 2123 break; 2124 2125 #ifdef TUN_DEBUG 2126 case TUNSETDEBUG: 2127 tun->debug = arg; 2128 break; 2129 #endif 2130 case TUNSETOFFLOAD: 2131 ret = set_offload(tun, arg); 2132 break; 2133 2134 case TUNSETTXFILTER: 2135 /* Can be set only for TAPs */ 2136 ret = -EINVAL; 2137 if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP) 2138 break; 2139 ret = update_filter(&tun->txflt, (void __user *)arg); 2140 break; 2141 2142 case SIOCGIFHWADDR: 2143 /* Get hw address */ 2144 memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN); 2145 ifr.ifr_hwaddr.sa_family = tun->dev->type; 2146 if (copy_to_user(argp, &ifr, ifreq_len)) 2147 ret = -EFAULT; 2148 break; 2149 2150 case SIOCSIFHWADDR: 2151 /* Set hw address */ 2152 tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n", 2153 ifr.ifr_hwaddr.sa_data); 2154 2155 ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr); 2156 break; 2157 2158 case TUNGETSNDBUF: 2159 sndbuf = tfile->socket.sk->sk_sndbuf; 2160 if (copy_to_user(argp, &sndbuf, sizeof(sndbuf))) 2161 ret = -EFAULT; 2162 break; 2163 2164 case TUNSETSNDBUF: 2165 if (copy_from_user(&sndbuf, argp, sizeof(sndbuf))) { 2166 ret = -EFAULT; 2167 break; 2168 } 2169 2170 tun->sndbuf = sndbuf; 2171 tun_set_sndbuf(tun); 2172 break; 2173 2174 case TUNGETVNETHDRSZ: 2175 vnet_hdr_sz = tun->vnet_hdr_sz; 2176 if (copy_to_user(argp, &vnet_hdr_sz, sizeof(vnet_hdr_sz))) 2177 ret = -EFAULT; 2178 break; 2179 2180 case TUNSETVNETHDRSZ: 2181 if (copy_from_user(&vnet_hdr_sz, argp, sizeof(vnet_hdr_sz))) { 2182 ret = -EFAULT; 2183 break; 2184 } 2185 if (vnet_hdr_sz < (int)sizeof(struct virtio_net_hdr)) { 2186 ret = -EINVAL; 2187 break; 2188 } 2189 2190 tun->vnet_hdr_sz = vnet_hdr_sz; 2191 break; 2192 2193 case TUNGETVNETLE: 2194 le = !!(tun->flags & TUN_VNET_LE); 2195 if (put_user(le, (int __user *)argp)) 2196 ret = -EFAULT; 2197 break; 2198 2199 case TUNSETVNETLE: 2200 if (get_user(le, (int __user *)argp)) { 2201 ret = -EFAULT; 2202 break; 2203 } 2204 if (le) 2205 tun->flags |= TUN_VNET_LE; 2206 else 2207 tun->flags &= ~TUN_VNET_LE; 2208 break; 2209 2210 case TUNGETVNETBE: 2211 ret = tun_get_vnet_be(tun, argp); 2212 break; 2213 2214 case TUNSETVNETBE: 2215 ret = tun_set_vnet_be(tun, argp); 2216 break; 2217 2218 case TUNATTACHFILTER: 2219 /* Can be set only for TAPs */ 2220 ret = -EINVAL; 2221 if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP) 2222 break; 2223 ret = -EFAULT; 2224 if (copy_from_user(&tun->fprog, argp, sizeof(tun->fprog))) 2225 break; 2226 2227 ret = tun_attach_filter(tun); 2228 break; 2229 2230 case TUNDETACHFILTER: 2231 /* Can be set only for TAPs */ 2232 ret = -EINVAL; 2233 if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP) 2234 break; 2235 ret = 0; 2236 tun_detach_filter(tun, tun->numqueues); 2237 break; 2238 2239 case TUNGETFILTER: 2240 ret = -EINVAL; 2241 if ((tun->flags & TUN_TYPE_MASK) != IFF_TAP) 2242 break; 2243 ret = -EFAULT; 2244 if (copy_to_user(argp, &tun->fprog, sizeof(tun->fprog))) 2245 break; 2246 ret = 0; 2247 break; 2248 2249 default: 2250 ret = -EINVAL; 2251 break; 2252 } 2253 2254 unlock: 2255 rtnl_unlock(); 2256 if (tun) 2257 tun_put(tun); 2258 return ret; 2259 } 2260 2261 static long tun_chr_ioctl(struct file *file, 2262 unsigned int cmd, unsigned long arg) 2263 { 2264 return __tun_chr_ioctl(file, cmd, arg, sizeof (struct ifreq)); 2265 } 2266 2267 #ifdef CONFIG_COMPAT 2268 static long tun_chr_compat_ioctl(struct file *file, 2269 unsigned int cmd, unsigned long arg) 2270 { 2271 switch (cmd) { 2272 case TUNSETIFF: 2273 case TUNGETIFF: 2274 case TUNSETTXFILTER: 2275 case TUNGETSNDBUF: 2276 case TUNSETSNDBUF: 2277 case SIOCGIFHWADDR: 2278 case SIOCSIFHWADDR: 2279 arg = (unsigned long)compat_ptr(arg); 2280 break; 2281 default: 2282 arg = (compat_ulong_t)arg; 2283 break; 2284 } 2285 2286 /* 2287 * compat_ifreq is shorter than ifreq, so we must not access beyond 2288 * the end of that structure. All fields that are used in this 2289 * driver are compatible though, we don't need to convert the 2290 * contents. 2291 */ 2292 return __tun_chr_ioctl(file, cmd, arg, sizeof(struct compat_ifreq)); 2293 } 2294 #endif /* CONFIG_COMPAT */ 2295 2296 static int tun_chr_fasync(int fd, struct file *file, int on) 2297 { 2298 struct tun_file *tfile = file->private_data; 2299 int ret; 2300 2301 if ((ret = fasync_helper(fd, file, on, &tfile->fasync)) < 0) 2302 goto out; 2303 2304 if (on) { 2305 __f_setown(file, task_pid(current), PIDTYPE_PID, 0); 2306 tfile->flags |= TUN_FASYNC; 2307 } else 2308 tfile->flags &= ~TUN_FASYNC; 2309 ret = 0; 2310 out: 2311 return ret; 2312 } 2313 2314 static int tun_chr_open(struct inode *inode, struct file * file) 2315 { 2316 struct net *net = current->nsproxy->net_ns; 2317 struct tun_file *tfile; 2318 2319 DBG1(KERN_INFO, "tunX: tun_chr_open\n"); 2320 2321 tfile = (struct tun_file *)sk_alloc(net, AF_UNSPEC, GFP_KERNEL, 2322 &tun_proto, 0); 2323 if (!tfile) 2324 return -ENOMEM; 2325 RCU_INIT_POINTER(tfile->tun, NULL); 2326 tfile->flags = 0; 2327 tfile->ifindex = 0; 2328 2329 init_waitqueue_head(&tfile->wq.wait); 2330 RCU_INIT_POINTER(tfile->socket.wq, &tfile->wq); 2331 2332 tfile->socket.file = file; 2333 tfile->socket.ops = &tun_socket_ops; 2334 2335 sock_init_data(&tfile->socket, &tfile->sk); 2336 2337 tfile->sk.sk_write_space = tun_sock_write_space; 2338 tfile->sk.sk_sndbuf = INT_MAX; 2339 2340 file->private_data = tfile; 2341 INIT_LIST_HEAD(&tfile->next); 2342 2343 sock_set_flag(&tfile->sk, SOCK_ZEROCOPY); 2344 2345 return 0; 2346 } 2347 2348 static int tun_chr_close(struct inode *inode, struct file *file) 2349 { 2350 struct tun_file *tfile = file->private_data; 2351 2352 tun_detach(tfile, true); 2353 2354 return 0; 2355 } 2356 2357 #ifdef CONFIG_PROC_FS 2358 static void tun_chr_show_fdinfo(struct seq_file *m, struct file *f) 2359 { 2360 struct tun_struct *tun; 2361 struct ifreq ifr; 2362 2363 memset(&ifr, 0, sizeof(ifr)); 2364 2365 rtnl_lock(); 2366 tun = tun_get(f); 2367 if (tun) 2368 tun_get_iff(current->nsproxy->net_ns, tun, &ifr); 2369 rtnl_unlock(); 2370 2371 if (tun) 2372 tun_put(tun); 2373 2374 seq_printf(m, "iff:\t%s\n", ifr.ifr_name); 2375 } 2376 #endif 2377 2378 static const struct file_operations tun_fops = { 2379 .owner = THIS_MODULE, 2380 .llseek = no_llseek, 2381 .read_iter = tun_chr_read_iter, 2382 .write_iter = tun_chr_write_iter, 2383 .poll = tun_chr_poll, 2384 .unlocked_ioctl = tun_chr_ioctl, 2385 #ifdef CONFIG_COMPAT 2386 .compat_ioctl = tun_chr_compat_ioctl, 2387 #endif 2388 .open = tun_chr_open, 2389 .release = tun_chr_close, 2390 .fasync = tun_chr_fasync, 2391 #ifdef CONFIG_PROC_FS 2392 .show_fdinfo = tun_chr_show_fdinfo, 2393 #endif 2394 }; 2395 2396 static struct miscdevice tun_miscdev = { 2397 .minor = TUN_MINOR, 2398 .name = "tun", 2399 .nodename = "net/tun", 2400 .fops = &tun_fops, 2401 }; 2402 2403 /* ethtool interface */ 2404 2405 static int tun_get_settings(struct net_device *dev, struct ethtool_cmd *cmd) 2406 { 2407 cmd->supported = 0; 2408 cmd->advertising = 0; 2409 ethtool_cmd_speed_set(cmd, SPEED_10); 2410 cmd->duplex = DUPLEX_FULL; 2411 cmd->port = PORT_TP; 2412 cmd->phy_address = 0; 2413 cmd->transceiver = XCVR_INTERNAL; 2414 cmd->autoneg = AUTONEG_DISABLE; 2415 cmd->maxtxpkt = 0; 2416 cmd->maxrxpkt = 0; 2417 return 0; 2418 } 2419 2420 static void tun_get_drvinfo(struct net_device *dev, struct ethtool_drvinfo *info) 2421 { 2422 struct tun_struct *tun = netdev_priv(dev); 2423 2424 strlcpy(info->driver, DRV_NAME, sizeof(info->driver)); 2425 strlcpy(info->version, DRV_VERSION, sizeof(info->version)); 2426 2427 switch (tun->flags & TUN_TYPE_MASK) { 2428 case IFF_TUN: 2429 strlcpy(info->bus_info, "tun", sizeof(info->bus_info)); 2430 break; 2431 case IFF_TAP: 2432 strlcpy(info->bus_info, "tap", sizeof(info->bus_info)); 2433 break; 2434 } 2435 } 2436 2437 static u32 tun_get_msglevel(struct net_device *dev) 2438 { 2439 #ifdef TUN_DEBUG 2440 struct tun_struct *tun = netdev_priv(dev); 2441 return tun->debug; 2442 #else 2443 return -EOPNOTSUPP; 2444 #endif 2445 } 2446 2447 static void tun_set_msglevel(struct net_device *dev, u32 value) 2448 { 2449 #ifdef TUN_DEBUG 2450 struct tun_struct *tun = netdev_priv(dev); 2451 tun->debug = value; 2452 #endif 2453 } 2454 2455 static const struct ethtool_ops tun_ethtool_ops = { 2456 .get_settings = tun_get_settings, 2457 .get_drvinfo = tun_get_drvinfo, 2458 .get_msglevel = tun_get_msglevel, 2459 .set_msglevel = tun_set_msglevel, 2460 .get_link = ethtool_op_get_link, 2461 .get_ts_info = ethtool_op_get_ts_info, 2462 }; 2463 2464 static int tun_queue_resize(struct tun_struct *tun) 2465 { 2466 struct net_device *dev = tun->dev; 2467 struct tun_file *tfile; 2468 struct skb_array **arrays; 2469 int n = tun->numqueues + tun->numdisabled; 2470 int ret, i; 2471 2472 arrays = kmalloc(sizeof *arrays * n, GFP_KERNEL); 2473 if (!arrays) 2474 return -ENOMEM; 2475 2476 for (i = 0; i < tun->numqueues; i++) { 2477 tfile = rtnl_dereference(tun->tfiles[i]); 2478 arrays[i] = &tfile->tx_array; 2479 } 2480 list_for_each_entry(tfile, &tun->disabled, next) 2481 arrays[i++] = &tfile->tx_array; 2482 2483 ret = skb_array_resize_multiple(arrays, n, 2484 dev->tx_queue_len, GFP_KERNEL); 2485 2486 kfree(arrays); 2487 return ret; 2488 } 2489 2490 static int tun_device_event(struct notifier_block *unused, 2491 unsigned long event, void *ptr) 2492 { 2493 struct net_device *dev = netdev_notifier_info_to_dev(ptr); 2494 struct tun_struct *tun = netdev_priv(dev); 2495 2496 if (dev->rtnl_link_ops != &tun_link_ops) 2497 return NOTIFY_DONE; 2498 2499 switch (event) { 2500 case NETDEV_CHANGE_TX_QUEUE_LEN: 2501 if (tun_queue_resize(tun)) 2502 return NOTIFY_BAD; 2503 break; 2504 default: 2505 break; 2506 } 2507 2508 return NOTIFY_DONE; 2509 } 2510 2511 static struct notifier_block tun_notifier_block __read_mostly = { 2512 .notifier_call = tun_device_event, 2513 }; 2514 2515 static int __init tun_init(void) 2516 { 2517 int ret = 0; 2518 2519 pr_info("%s, %s\n", DRV_DESCRIPTION, DRV_VERSION); 2520 pr_info("%s\n", DRV_COPYRIGHT); 2521 2522 ret = rtnl_link_register(&tun_link_ops); 2523 if (ret) { 2524 pr_err("Can't register link_ops\n"); 2525 goto err_linkops; 2526 } 2527 2528 ret = misc_register(&tun_miscdev); 2529 if (ret) { 2530 pr_err("Can't register misc device %d\n", TUN_MINOR); 2531 goto err_misc; 2532 } 2533 2534 register_netdevice_notifier(&tun_notifier_block); 2535 return 0; 2536 err_misc: 2537 rtnl_link_unregister(&tun_link_ops); 2538 err_linkops: 2539 return ret; 2540 } 2541 2542 static void tun_cleanup(void) 2543 { 2544 misc_deregister(&tun_miscdev); 2545 rtnl_link_unregister(&tun_link_ops); 2546 unregister_netdevice_notifier(&tun_notifier_block); 2547 } 2548 2549 /* Get an underlying socket object from tun file. Returns error unless file is 2550 * attached to a device. The returned object works like a packet socket, it 2551 * can be used for sock_sendmsg/sock_recvmsg. The caller is responsible for 2552 * holding a reference to the file for as long as the socket is in use. */ 2553 struct socket *tun_get_socket(struct file *file) 2554 { 2555 struct tun_file *tfile; 2556 if (file->f_op != &tun_fops) 2557 return ERR_PTR(-EINVAL); 2558 tfile = file->private_data; 2559 if (!tfile) 2560 return ERR_PTR(-EBADFD); 2561 return &tfile->socket; 2562 } 2563 EXPORT_SYMBOL_GPL(tun_get_socket); 2564 2565 module_init(tun_init); 2566 module_exit(tun_cleanup); 2567 MODULE_DESCRIPTION(DRV_DESCRIPTION); 2568 MODULE_AUTHOR(DRV_COPYRIGHT); 2569 MODULE_LICENSE("GPL"); 2570 MODULE_ALIAS_MISCDEV(TUN_MINOR); 2571 MODULE_ALIAS("devname:net/tun"); 2572