Fixed the skb->sk dereference prolblem.
[linux-2.6.git] / linux-2.6-526-tun-tap.patch
1 diff -Nurb linux-2.6.22-525/drivers/net/Makefile linux-2.6.22-526/drivers/net/Makefile
2 --- linux-2.6.22-525/drivers/net/Makefile       2008-07-10 10:37:08.000000000 -0400
3 +++ linux-2.6.22-526/drivers/net/Makefile       2008-07-10 10:37:22.000000000 -0400
4 @@ -1,7 +1,7 @@
5  #
6  # Makefile for the Linux network (ethercard) device drivers.
7  #
8 -
9 +obj-m += vnet_tun.o
10  obj-$(CONFIG_E1000) += e1000/
11  obj-$(CONFIG_E1000E) += e1000e/
12  obj-$(CONFIG_IBM_EMAC) += ibm_emac/
13 diff -Nurb linux-2.6.22-525/drivers/net/vnet_tun.c linux-2.6.22-526/drivers/net/vnet_tun.c
14 --- linux-2.6.22-525/drivers/net/vnet_tun.c     1969-12-31 19:00:00.000000000 -0500
15 +++ linux-2.6.22-526/drivers/net/vnet_tun.c     2008-07-13 23:56:16.000000000 -0400
16 @@ -0,0 +1,713 @@
17 +/*
18 + *  TUN - Universal TUN/TAP device driver.
19 + *  Copyright (C) 1999-2002 Maxim Krasnyansky <maxk@qualcomm.com>
20 + *  Modifications for PlanetLab by
21 + *  Mark Huang <mlhuang@cs.princeton.edu>
22 + *  Copyright (C) 2005 The Trustees of Princeton University
23 + *  Ported to PlanetLab 4.2 by Sapan Bhatia <sapanb@cs.princeton.edu>
24 + *
25 + *  Modifications for PlanetLab by
26 + *  Mark Huang <mlhuang@cs.princeton.edu>
27 + *  Copyright (C) 2005 The Trustees of Princeton University
28 + *
29 + *  This program is free software; you can redistribute it and/or modify
30 + *  it under the terms of the GNU General Public License as published by
31 + *  the Free Software Foundation; either version 2 of the License, or
32 + *  (at your option) any later version.
33 + *
34 + *  This program is distributed in the hope that it will be useful,
35 + *  but WITHOUT ANY WARRANTY; without even the implied warranty of
36 + *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
37 + *  GNU General Public License for more details.
38 + *
39 + *  $Id: vnet_tun.c,v 1.10 2007/03/07 21:25:26 mef Exp $
40 + */
41 +
42 +/*
43 + *  Daniel Podlejski <underley@underley.eu.org>
44 + *    Modifications for 2.3.99-pre5 kernel.
45 + */
46 +
47 +#define TUN_VER "1.5"
48 +
49 +int vnet_verbose=1;
50 +
51 +#define dbg(format, args...) do { if (vnet_verbose >= 2) { printk(format, ## args); } } while (0)
52 +#define err(format, args...) do { if (vnet_verbose >= 1) { printk(format, ## args); } } while (0)
53 +
54 +#include <linux/version.h>
55 +#include <linux/module.h>
56 +#include <linux/errno.h>
57 +#include <linux/kernel.h>
58 +#include <linux/major.h>
59 +#include <linux/slab.h>
60 +#include <linux/poll.h>
61 +#include <linux/fcntl.h>
62 +#include <linux/init.h>
63 +#include <linux/random.h>
64 +#include <linux/skbuff.h>
65 +#include <linux/netdevice.h>
66 +#include <linux/etherdevice.h>
67 +#include <linux/miscdevice.h>
68 +#include <linux/rtnetlink.h>
69 +#include <linux/if.h>
70 +#include <linux/if_arp.h>
71 +#include <linux/if_ether.h>
72 +#include <linux/if_tun.h>
73 +
74 +#include <asm/system.h>
75 +#include <asm/uaccess.h>
76 +
77 +/*
78 + * PlanetLab TAP device
79 + *
80 + * A single, persistent tap0 to /dev/net/tun tunnel. Packets sent out
81 + * the tap0 device, via either IP or raw sockets, are queued to both
82 + * the sending slice's /dev/net/tun queue, and the root queue. Only
83 + * one reader of each queue is allowed at a time. Any type of packet
84 + * may be written to /dev/net/tun and received via packet socket(s)
85 + * bound to tap0. However, only locally destined IP packets will be
86 + * injected into the stack, and such packets are subject to the same
87 + * connection tracking and ownership assignment that all inbound IP
88 + * packets are subject to.
89 + */
90 +
91 +struct net_device tun_netdev;
92 +static struct net_device_stats tun_stats;
93 +
94 +int print_once=1;
95 +
96 +static inline xid_t
97 +get_sk_xid(struct sock *sk)
98 +{
99 +       if (sk) {
100 +               return (int) sk->sk_nid >= 0 ? sk->sk_nid : 0;
101 +       } 
102 +       else {
103 +               if (in_interrupt() && print_once) {
104 +                       print_once=0;
105 +                       printk(KERN_EMERG "vnet_tun: get-sk_xid called in interrupt context!\n");
106 +               }
107 +               return current->xid;
108 +       }
109 +}
110 +
111 +#define set_sk_xid(sk,xid) sk->sk_nid=xid
112 +#define set_skb_xid(skb,xid) skb->skb_tag=xid
113 +
114 +/* Extended fields */
115 +struct tun_pi_ext {
116 +       unsigned long mark;
117 +       long timestamp_sec;
118 +       long timestamp_usec;
119 +};
120 +#define TUN_PKT_EXT    0x0002
121 +       
122 +#include <net/ip.h>
123 +
124 +/* UID hash function stolen from kernel/user.c */
125 +#define XIDHASH_BITS           8
126 +#define XIDHASH_SZ             (1 << XIDHASH_BITS)
127 +#define XIDHASH_MASK           (XIDHASH_SZ - 1)
128 +#define __xidhashfn(xid)       (((xid >> XIDHASH_BITS) + xid) & XIDHASH_MASK)
129 +
130 +static struct list_head tun_dev_hash[XIDHASH_SZ];
131 +static rwlock_t tun_dev_hash_lock = RW_LOCK_UNLOCKED;
132 +
133 +static inline xid_t
134 +get_file_xid(struct file *file)
135 +{
136 +               return file->f_xid;
137 +}
138 +
139 +static inline void
140 +set_file_xid(struct file *file, xid_t xid)
141 +{
142 +               file->f_xid = xid;
143 +}
144 +
145 +static struct tun_struct *tun_get_by_xid(xid_t xid)
146 +{
147 +       struct tun_struct *tun;
148 +
149 +       read_lock_bh(&tun_dev_hash_lock);
150 +
151 +       list_for_each_entry(tun, &tun_dev_hash[__xidhashfn(xid)], list) {
152 +               if (tun->owner == xid) {
153 +                       read_unlock_bh(&tun_dev_hash_lock);
154 +                       return tun;
155 +               }
156 +       }
157 +
158 +       read_unlock_bh(&tun_dev_hash_lock);
159 +
160 +       return NULL;
161 +}
162 +
163 +/* Network device part of the driver */
164 +
165 +static void tun_xmit(struct sk_buff *skb, struct tun_struct *tun)
166 +{
167 +       /* Drop packet if interface is not attached */
168 +       if (!tun || !tun->attached)
169 +               goto drop;
170 +
171 +       dbg("%s:%d: tun_xmit %d\n", tun->dev->name, tun->owner, skb->len);
172 +
173 +       /* Queue packet */
174 +       if (skb_queue_len(&tun->readq) >= tun->dev->tx_queue_len)
175 +               goto drop;
176 +
177 +       skb = skb_clone(skb, GFP_ATOMIC);
178 +       if (!skb)
179 +               goto drop;
180 +
181 +       skb_queue_tail(&tun->readq, skb);
182 +
183 +       /* Notify and wake up reader process */
184 +       if (tun->flags & TUN_FASYNC)
185 +               kill_fasync(&tun->fasync, SIGIO, POLL_IN);
186 +       wake_up_interruptible(&tun->read_wait);
187 +
188 + drop:
189 +       if (tun)
190 +               tun->stats.tx_dropped++;
191 +       tun_stats.tx_dropped++;
192 +}
193 +
194 +/* Net device start xmit */
195 +static int tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
196 +{
197 +       xid_t xid = get_sk_xid(skb->sk);
198 +       struct tun_struct *tun = tun_get_by_xid(xid);
199 +
200 +       /* Mark packet */
201 +       set_skb_xid(skb, xid);
202 +
203 +       tun_xmit(skb, tun);
204 +
205 +       /* Copy root on packets that the slice is not listening for */
206 +       if ((!tun || !tun->attached) && xid) {
207 +               tun = tun_get_by_xid(0);
208 +               tun_xmit(skb, tun);
209 +       }
210 +
211 +       kfree_skb(skb);
212 +       return 0;
213 +}
214 +
215 +static void tun_net_mclist(struct net_device *dev)
216 +{
217 +       /* Nothing to do for multicast filters. 
218 +        * We always accept all frames. */
219 +       return;
220 +}
221 +
222 +static struct net_device_stats *tun_net_stats(struct net_device *dev)
223 +{
224 +       struct tun_struct *tun = tun_get_by_xid(current->xid);
225 +       return tun ? &tun->stats : &tun_stats;
226 +}
227 +
228 +/* Character device part */
229 +
230 +/* Poll */
231 +static unsigned int tun_chr_poll(struct file *file, poll_table * wait)
232 +{  
233 +       struct tun_struct *tun = file->private_data;
234 +       unsigned int mask = POLLOUT | POLLWRNORM;
235 +
236 +       if (!tun)
237 +               return -EBADFD;
238 +
239 +       dbg("%s:%d: tun_chr_poll\n", tun->dev->name, tun->owner);
240 +
241 +       poll_wait(file, &tun->read_wait, wait);
242
243 +       if (skb_queue_len(&tun->readq))
244 +               mask |= POLLIN | POLLRDNORM;
245 +
246 +       return mask;
247 +}
248 +
249 +/* Get packet from user space buffer */
250 +static __inline__ ssize_t tun_get_user(struct tun_struct *tun, struct iovec *iv, size_t count)
251 +{
252 +       struct tun_pi pi = { 0, __constant_htons(ETH_P_IP) };
253 +       struct tun_pi_ext pi_ext;
254 +       struct sk_buff *skb;
255 +       size_t len = count;
256 +
257 +       if (!(tun->flags & TUN_NO_PI)) {
258 +               if ((len -= sizeof(pi)) < 0)
259 +                       return -EINVAL;
260 +
261 +               if(memcpy_fromiovec((void *)&pi, iv, sizeof(pi)))
262 +                       return -EFAULT;
263 +
264 +               if (pi.flags & TUN_PKT_EXT) {
265 +                       if ((len -= sizeof(pi_ext)) < 0)
266 +                               return -EINVAL;
267 +
268 +                       if (memcpy_fromiovec((void *)&pi_ext, iv, sizeof(pi_ext)))
269 +                               return -EFAULT;
270 +               }
271 +       }
272
273 +       if (!(skb = alloc_skb(len + 2, GFP_KERNEL))) {
274 +               tun->stats.rx_dropped++;
275 +               tun_stats.rx_dropped++;
276 +               return -ENOMEM;
277 +       }
278 +
279 +       skb_reserve(skb, 2);
280 +       if (memcpy_fromiovec(skb_put(skb, len), iv, len))
281 +               return -EFAULT;
282 +
283 +       skb->dev = tun->dev;
284 +       switch (tun->flags & TUN_TYPE_MASK) {
285 +       case TUN_TUN_DEV:
286 +               skb_reset_mac_header(skb);
287 +               skb->protocol = pi.proto;
288 +               break;
289 +       case TUN_TAP_DEV:
290 +               skb->protocol = eth_type_trans(skb, tun->dev);
291 +               break;
292 +       };
293 +
294 +       if (tun->flags & TUN_NOCHECKSUM)
295 +               skb->ip_summed = CHECKSUM_UNNECESSARY;
296 +
297 +       /* Mark packet */
298 +       set_skb_xid(skb, tun->owner);
299 +
300 +       netif_rx_ni(skb);
301 +   
302 +       tun->stats.rx_packets++;
303 +       tun->stats.rx_bytes += len;
304 +       tun_stats.rx_packets++;
305 +       tun_stats.rx_bytes += len;
306 +
307 +       return count;
308 +} 
309 +
310 +static inline size_t iov_total(const struct iovec *iv, unsigned long count)
311 +{
312 +       unsigned long i;
313 +       size_t len;
314 +
315 +       for (i = 0, len = 0; i < count; i++) 
316 +               len += iv[i].iov_len;
317 +
318 +       return len;
319 +}
320 +
321 +/* Writev - Obsolete in 2.6.22, but let's keep this aroudn just in case */
322 +static ssize_t tun_chr_writev(struct file * file, const struct iovec *iv, 
323 +                             unsigned long count, loff_t *pos)
324 +{
325 +       struct tun_struct *tun = file->private_data;
326 +
327 +       if (!tun)
328 +               return -EBADFD;
329 +
330 +       dbg("%s:%d: tun_chr_write %ld\n", tun->dev->name, tun->owner, count);
331 +
332 +       return tun_get_user(tun, (struct iovec *) iv, iov_total(iv, count));
333 +}
334 +
335 +/* Write */
336 +static ssize_t tun_chr_write(struct file * file, const char __user * buf, 
337 +                            size_t count, loff_t *pos)
338 +{
339 +       struct iovec iv = { (void __user *) buf, count };
340 +       return tun_chr_writev(file, &iv, 1, pos);
341 +}
342 +
343 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,14)
344 +
345 +static inline void skb_get_timestamp(const struct sk_buff *skb, struct timeval *stamp)
346 +{
347 +       stamp->tv_sec = skb->stamp.tv_sec;
348 +       stamp->tv_usec = skb->stamp.tv_usec;
349 +}
350 +
351 +static inline void skb_set_timestamp(struct sk_buff *skb, const struct timeval *stamp)
352 +{
353 +       skb->stamp.tv_sec = stamp->tv_sec;
354 +       skb->stamp.tv_usec = stamp->tv_usec;
355 +}
356 +
357 +static void __net_timestamp(struct sk_buff *skb)
358 +{
359 +       struct timeval tv;
360 +
361 +       do_gettimeofday(&tv);
362 +       skb_set_timestamp(skb, &tv);
363 +}
364 +
365 +#endif
366 +
367 +/* Put packet to the user space buffer */
368 +static __inline__ ssize_t tun_put_user(struct tun_struct *tun,
369 +                                      struct sk_buff *skb,
370 +                                      struct iovec *iv, int len)
371 +{
372 +       struct tun_pi pi;
373 +       struct tun_pi_ext pi_ext;
374 +       struct timeval stamp;
375 +       ssize_t total = 0;
376 +
377 +       if (!(tun->flags & TUN_NO_PI)) {
378 +               struct iovec iv1 = { iv->iov_base, iv->iov_len };
379 +
380 +               if ((len -= sizeof(pi)) < 0)
381 +                       return -EINVAL;
382 +
383 +               if (memcpy_fromiovec((void *)&pi, &iv1, sizeof(pi)))
384 +                       return -EFAULT;
385 +
386 +               if (pi.flags & TUN_PKT_EXT) {
387 +                       if ((len -= sizeof(pi_ext)) < 0)
388 +                               return -EINVAL;
389 +
390 +                       /* We might not have a timestamp, get one */
391 +                       skb_get_timestamp(skb, &stamp);
392 +                       if (stamp.tv_sec == 0) {
393 +                               __net_timestamp(skb);
394 +                               skb_get_timestamp(skb, &stamp);
395 +                       }
396 +
397 +                       pi.flags = TUN_PKT_EXT;
398 +                       pi.proto = skb->protocol;
399 +                       pi_ext.timestamp_sec = stamp.tv_sec;
400 +                       pi_ext.timestamp_usec = stamp.tv_usec;
401 +                       pi_ext.mark = skb->skb_tag;
402 +               } else {
403 +                       pi.flags = 0;
404 +                       pi.proto = skb->protocol;
405 +               }
406 +
407 +               if (len < skb->len) {
408 +                       /* Packet will be striped */
409 +                       pi.flags |= TUN_PKT_STRIP;
410 +               }
411
412 +               if (memcpy_toiovec(iv, (void *) &pi, sizeof(pi)))
413 +                       return -EFAULT;
414 +               total += sizeof(pi);
415 +
416 +               if (pi.flags & TUN_PKT_EXT) {
417 +                       if (memcpy_toiovec(iv, (void *) &pi_ext, sizeof(pi_ext)))
418 +                               return -EFAULT;
419 +                       total += sizeof(pi_ext);
420 +               }
421 +       }       
422 +
423 +       len = min_t(int, skb->len, len);
424 +
425 +       skb_copy_datagram_iovec(skb, 0, iv, len);
426 +       total += len;
427 +
428 +       tun->stats.tx_packets++;
429 +       tun->stats.tx_bytes += len;
430 +       tun_stats.tx_packets++;
431 +       tun_stats.tx_bytes += len;
432 +
433 +       return total;
434 +}
435 +
436 +/* Readv - Obsolete in 2.6.22, but let's keep this aroudn just in case */
437 +static ssize_t tun_chr_readv(struct file *file, const struct iovec *iv,
438 +                           unsigned long count, loff_t *pos)
439 +{
440 +       struct tun_struct *tun = file->private_data;
441 +       DECLARE_WAITQUEUE(wait, current);
442 +       struct sk_buff *skb;
443 +       ssize_t len, ret = 0;
444 +
445 +       if (!tun)
446 +               return -EBADFD;
447 +
448 +       dbg("%s:%d: tun_chr_read\n", tun->dev->name, tun->owner);
449 +
450 +       len = iov_total(iv, count);
451 +       if (len < 0)
452 +               return -EINVAL;
453 +
454 +       add_wait_queue(&tun->read_wait, &wait);
455 +       while (len) {
456 +               current->state = TASK_INTERRUPTIBLE;
457 +
458 +               /* Read frames from the queue */
459 +               if (!(skb=skb_dequeue(&tun->readq))) {
460 +                       if (file->f_flags & O_NONBLOCK) {
461 +                               ret = -EAGAIN;
462 +                               break;
463 +                       }
464 +                       if (signal_pending(current)) {
465 +                               ret = -ERESTARTSYS;
466 +                               break;
467 +                       }
468 +
469 +                       /* Nothing to read, let's sleep */
470 +                       schedule();
471 +                       continue;
472 +               }
473 +
474 +               ret = tun_put_user(tun, skb, (struct iovec *) iv, len);
475 +
476 +               kfree_skb(skb);
477 +               break;
478 +       }
479 +
480 +       current->state = TASK_RUNNING;
481 +       remove_wait_queue(&tun->read_wait, &wait);
482 +
483 +       return ret;
484 +}
485 +
486 +/* Read */
487 +static ssize_t tun_chr_read(struct file * file, char __user * buf, 
488 +                           size_t count, loff_t *pos)
489 +{
490 +       struct iovec iv = { buf, count };
491 +       return tun_chr_readv(file, &iv, 1, pos);
492 +}
493 +
494 +static int tun_set_iff(struct file *file, struct ifreq *ifr)
495 +{
496 +       struct tun_struct *tun;
497 +
498 +       tun = tun_get_by_xid(get_file_xid(file));
499 +       if (tun) {
500 +               if (tun->attached)
501 +                       return -EBUSY;
502 +
503 +               /* Check permissions */
504 +               if (tun->owner != -1 &&
505 +                   get_file_xid(file) != tun->owner && !capable(CAP_NET_ADMIN))
506 +                       return -EPERM;
507 +       }
508 +       else {
509 +               /* Create a new queue */
510 +               tun = kmalloc(sizeof(struct tun_struct), GFP_KERNEL);
511 +               if (!tun)
512 +                       return -ENOMEM;
513 +               memset(tun, 0, sizeof(struct tun_struct));
514 +
515 +               tun->dev = &tun_netdev;
516 +
517 +               skb_queue_head_init(&tun->readq);
518 +               init_waitqueue_head(&tun->read_wait);
519 +
520 +               tun->owner = get_file_xid(file);
521 +
522 +               write_lock_bh(&tun_dev_hash_lock);
523 +               list_add(&tun->list, &tun_dev_hash[__xidhashfn(get_file_xid(file))]);
524 +               write_unlock_bh(&tun_dev_hash_lock);
525 +       }
526 +
527 +       dbg("%s:%d: tun_set_iff\n", tun->dev->name, tun->owner);
528 +
529 +       tun->flags = TUN_TAP_DEV;
530 +
531 +       if (ifr->ifr_flags & IFF_NO_PI)
532 +               tun->flags |= TUN_NO_PI;
533 +
534 +       file->private_data = tun;
535 +       tun->attached = 1;
536 +
537 +       strcpy(ifr->ifr_name, tun->dev->name);
538 +       return 0;
539 +}
540 +
541 +static int tun_chr_ioctl(struct inode *inode, struct file *file, 
542 +                        unsigned int cmd, unsigned long arg)
543 +{
544 +       struct tun_struct *tun = file->private_data;
545 +
546 +       if (cmd == TUNSETIFF && !tun) {
547 +               struct ifreq ifr;
548 +               int err;
549 +
550 +               if (copy_from_user(&ifr, (void __user *)arg, sizeof(ifr)))
551 +                       return -EFAULT;
552 +               ifr.ifr_name[IFNAMSIZ-1] = '\0';
553 +
554 +               err = tun_set_iff(file, &ifr);
555 +
556 +               if (err)
557 +                       return err;
558 +
559 +               if (copy_to_user((void __user *)arg, &ifr, sizeof(ifr)))
560 +                       return -EFAULT;
561 +               return 0;
562 +       }
563 +
564 +       if (!tun)
565 +               return -EBADFD;
566 +
567 +       dbg("%s:%d: tun_chr_ioctl cmd %d\n", tun->dev->name, tun->owner, cmd);
568 +
569 +       switch (cmd) {
570 +       case TUNSETNOCSUM:
571 +               /* Disable/Enable checksum */
572 +               if (arg)
573 +                       tun->flags |= TUN_NOCHECKSUM;
574 +               else
575 +                       tun->flags &= ~TUN_NOCHECKSUM;
576 +
577 +               dbg("%s:%d: checksum %s\n",
578 +                   tun->dev->name, tun->owner, arg ? "disabled" : "enabled");
579 +               break;
580 +
581 +       case TUNSETPERSIST:
582 +       case TUNSETOWNER:
583 +       case TUNSETDEBUG:
584 +               /* Not applicable */
585 +               break;
586 +
587 +       default:
588 +               return -EINVAL;
589 +       };
590 +
591 +       return 0;
592 +}
593 +
594 +static int tun_chr_fasync(int fd, struct file *file, int on)
595 +{
596 +       struct tun_struct *tun = file->private_data;
597 +       int ret;
598 +
599 +       if (!tun)
600 +               return -EBADFD;
601 +
602 +       dbg("%s:%d: tun_chr_fasync %d\n", tun->dev->name, tun->owner, on);
603 +
604 +       if ((ret = fasync_helper(fd, file, on, &tun->fasync)) < 0)
605 +               return ret; 
606
607 +       if (on) {
608 +               ret = f_setown(file, current->pid, 0);
609 +               if (ret)
610 +                       return ret;
611 +               tun->flags |= TUN_FASYNC;
612 +       } else 
613 +               tun->flags &= ~TUN_FASYNC;
614 +
615 +       return 0;
616 +}
617 +
618 +static int tun_chr_open(struct inode *inode, struct file * file)
619 +{
620 +       dbg("tunX: tun_chr_open\n");
621 +       file->private_data = NULL;
622 +       return 0;
623 +}
624 +
625 +static int tun_chr_close(struct inode *inode, struct file *file)
626 +{
627 +       struct tun_struct *tun = file->private_data;
628 +
629 +       if (!tun)
630 +               return 0;
631 +
632 +       dbg("%s:%d: tun_chr_close\n", tun->dev->name, tun->owner);
633 +
634 +       tun_chr_fasync(-1, file, 0);
635 +
636 +       /* Detach from net device */
637 +       file->private_data = NULL;
638 +       tun->attached = 0;
639 +
640 +       /* Drop read queue */
641 +       skb_queue_purge(&tun->readq);
642 +
643 +       return 0;
644 +}
645 +
646 +static struct file_operations tun_fops = {
647 +       .owner  = THIS_MODULE,  
648 +       .llseek = no_llseek,
649 +       .read   = tun_chr_read,
650 +       //.readv        = tun_chr_readv,
651 +       .write  = tun_chr_write,
652 +       //.writev = tun_chr_writev,
653 +       .poll   = tun_chr_poll,
654 +       .ioctl  = tun_chr_ioctl,
655 +       .open   = tun_chr_open,
656 +       .release = tun_chr_close,
657 +       .fasync = tun_chr_fasync                
658 +};
659 +
660 +static struct miscdevice tun_miscdev = {
661 +       .minor = TUN_MINOR,
662 +       .name = "tun",
663 +       .fops = &tun_fops,
664 +#if LINUX_VERSION_CODE < KERNEL_VERSION(2,6,18)
665 +       .devfs_name = "net/tun",
666 +#endif
667 +};
668 +
669 +int __init tun_init(void)
670 +{
671 +       int ret = 0;
672 +       struct net_device *dev = &tun_netdev;
673 +       int i;
674 +
675 +       /* Initialize hash table */
676 +       for (i = 0; i < XIDHASH_SZ; i++)
677 +               INIT_LIST_HEAD(&tun_dev_hash[i]);
678 +
679 +       ret = misc_register(&tun_miscdev);
680 +       if (ret) {
681 +               err("tun: Can't register misc device %d\n", TUN_MINOR);
682 +               return ret;
683 +       }
684 +
685 +       memset(dev, 0, sizeof(struct net_device));
686 +
687 +       /* Ethernet TAP Device */
688 +       dev->set_multicast_list = tun_net_mclist;
689 +
690 +       /* Generate random Ethernet address.  */
691 +       *(u16 *)dev->dev_addr = htons(0x00FF);
692 +       get_random_bytes(dev->dev_addr + sizeof(u16), 4);
693 +
694 +       ether_setup(dev);
695 +
696 +       dev->flags |= IFF_NOARP | IFF_POINTOPOINT;
697 +       dev->flags &= ~IFF_MULTICAST;
698 +
699 +       SET_MODULE_OWNER(dev);
700 +       dev->hard_start_xmit = tun_net_xmit;
701 +       dev->get_stats = tun_net_stats;
702 +
703 +       strcpy(dev->name, "tap0");
704 +
705 +       ret = register_netdev(dev);
706 +       if (ret < 0)
707 +               misc_deregister(&tun_miscdev);
708 +
709 +       return ret;
710 +}
711 +
712 +void __exit tun_cleanup(void)
713 +{
714 +       struct tun_struct *tun, *nxt;
715 +       int i;
716 +
717 +       misc_deregister(&tun_miscdev);  
718 +
719 +       write_lock_bh(&tun_dev_hash_lock);
720 +       for (i = 0; i < XIDHASH_SZ; i++) {
721 +               list_for_each_entry_safe(tun, nxt, &tun_dev_hash[i], list) {
722 +                       skb_queue_purge(&tun->readq);
723 +                       kfree(tun);
724 +               }
725 +       }
726 +       write_unlock_bh(&tun_dev_hash_lock);
727 +
728 +       unregister_netdev(&tun_netdev);
729 +}