syzkaller/sys/linux/dev_net_tun.txt

# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.

include <linux/if_tun.h>
include <linux/virtio_net.h>
include <uapi/linux/if_arp.h>

resource fd_tun[fd]

openat$tun(fd const[AT_FDCWD], file ptr[in, string["/dev/net/tun"]], flags flags[open_flags], mode const[0]) fd_tun
write$tun(fd fd_tun, buf ptr[in, tun_buffer], count len[buf])
ioctl$TUNGETFEATURES(fd fd_tun, cmd const[TUNGETFEATURES], arg ptr[out, int32])
ioctl$TUNSETQUEUE(fd fd_tun, cmd const[TUNSETQUEUE], arg ptr[in, ifreq_t[flags[tun_queue_flags, int16]]])
ioctl$TUNSETIFF(fd fd_tun, cmd const[TUNSETIFF], arg ptr[in, ifreq_t[flags[tun_setiff_flags, int16]]])
ioctl$TUNSETIFINDEX(fd fd_tun, cmd const[TUNSETIFINDEX], arg ptr[in, ifindex])
ioctl$TUNGETIFF(fd fd_tun, cmd const[TUNGETIFF], arg ptr[out, ifreq_t[void]])
ioctl$TUNSETNOCSUM(fd fd_tun, cmd const[TUNSETNOCSUM], arg bool32)
ioctl$TUNSETPERSIST(fd fd_tun, cmd const[TUNSETPERSIST], arg bool32)
ioctl$TUNSETOWNER(fd fd_tun, cmd const[TUNSETOWNER], arg uid)
ioctl$TUNSETGROUP(fd fd_tun, cmd const[TUNSETGROUP], arg gid)
ioctl$TUNSETLINK(fd fd_tun, cmd const[TUNSETLINK], arg flags[dev_type_arphdr])
ioctl$TUNSETOFFLOAD(fd fd_tun, cmd const[TUNSETOFFLOAD], arg flags[tun_offload_flags])
ioctl$TUNSETTXFILTER(fd fd_tun, cmd const[TUNSETTXFILTER], arg ptr[in, tun_filter])
ioctl$SIOCGIFHWADDR(fd fd_tun, cmd const[SIOCGIFHWADDR], arg ptr[out, ifreq_t[void]])
ioctl$SIOCSIFHWADDR(fd fd_tun, cmd const[SIOCSIFHWADDR], arg ptr[in, ifreq_t[mac_addr]])
ioctl$TUNGETSNDBUF(fd fd_tun, cmd const[TUNGETSNDBUF], arg ptr[out, int32])
ioctl$TUNSETSNDBUF(fd fd_tun, cmd const[TUNSETSNDBUF], arg ptr[in, int32])
ioctl$TUNGETVNETHDRSZ(fd fd_tun, cmd const[TUNGETVNETHDRSZ], arg ptr[out, int32])
ioctl$TUNSETVNETHDRSZ(fd fd_tun, cmd const[TUNSETVNETHDRSZ], arg ptr[in, int32])
ioctl$TUNATTACHFILTER(fd fd_tun, cmd const[TUNATTACHFILTER], arg ptr[in, sock_fprog])
ioctl$TUNDETACHFILTER(fd fd_tun, cmd const[TUNDETACHFILTER], arg const[0])
ioctl$TUNGETFILTER(fd fd_tun, cmd const[TUNGETFILTER], arg buffer[out])
ioctl$TUNSETSTEERINGEBPF(fd fd_tun, cmd const[TUNSETSTEERINGEBPF], arg ptr[in, fd_bpf_prog])
ioctl$TUNSETFILTEREBPF(fd fd_tun, cmd const[TUNSETFILTEREBPF], arg ptr[in, fd_bpf_prog])
ioctl$TUNSETVNETLE(fd fd_tun, cmd const[TUNSETVNETLE], arg ptr[in, bool32])
ioctl$TUNSETVNETBE(fd fd_tun, cmd const[TUNSETVNETBE], arg ptr[in, bool32])
ioctl$TUNSETCARRIER(fd fd_tun, cmd const[TUNSETCARRIER], arg ptr[in, bool32])
ioctl$TUNGETDEVNETNS(fd fd_tun, cmd const[TUNGETDEVNETNS], arg const[0]) fd_namespace

# There are 4 combinations of tun packets:
# tun_pi can be present or missing (depending on !IFF_NO_PI),
# virtio_net_hdr can be present or missing (depending on IFF_VNET_HDR).
# We may want to support optional fields, which will make this simpler.
tun_buffer {
	pi	optional[tun_pi]
	hdr	optional[virtio_net_hdr]
	data	tun_payload
} [packed]

tun_pi {
	flags	const[0, int16]
	proto	flags[ether_types, int16be]
}

virtio_net_hdr {
	flags	flags[virtio_net_flags, int8]
	gsotype	flags[virtio_net_types, int8]
	hdrlen	int16
	gsosize	int16
	start	int16
	offset	int16
}

tun_payload [
	eth	eth_packet
	ipv4	ipv4_packet
	ipv6	ipv6_packet
	arp	arp_packet
	llc	llc_packet
	ipx	ipx_packet
	x25	x25_packet
	mpls	mpls_packet
] [varlen]

tun_filter {
	flags	flags[tun_filter_flags, int16]
	count	len[addr, int16]
	addr	array[mac_addr]
}

tun_filter_flags = TUN_FLT_ALLMULTI
virtio_net_flags = VIRTIO_NET_HDR_F_NEEDS_CSUM, VIRTIO_NET_HDR_F_DATA_VALID
virtio_net_types = VIRTIO_NET_HDR_GSO_NONE, VIRTIO_NET_HDR_GSO_TCPV4, VIRTIO_NET_HDR_GSO_UDP, VIRTIO_NET_HDR_GSO_TCPV6, VIRTIO_NET_HDR_GSO_ECN
tun_offload_flags = TUN_F_CSUM, TUN_F_TSO4, TUN_F_TSO6, TUN_F_TSO_ECN, TUN_F_UFO
tun_setiff_flags = IFF_TUN, IFF_TAP, IFF_NAPI, IFF_NAPI_FRAGS, IFF_NO_PI, IFF_ONE_QUEUE, IFF_VNET_HDR, IFF_TUN_EXCL, IFF_MULTI_QUEUE, IFF_ATTACH_QUEUE, IFF_DETACH_QUEUE, IFF_PERSIST, IFF_NOFILTER
tun_queue_flags = IFF_ATTACH_QUEUE, IFF_DETACH_QUEUE
dev_type_arphdr = ARPHRD_NETROM, ARPHRD_ETHER, ARPHRD_EETHER, ARPHRD_AX25, ARPHRD_PRONET, ARPHRD_CHAOS, ARPHRD_IEEE802, ARPHRD_ARCNET, ARPHRD_APPLETLK, ARPHRD_DLCI, ARPHRD_ATM, ARPHRD_METRICOM, ARPHRD_IEEE1394, ARPHRD_EUI64, ARPHRD_INFINIBAND, ARPHRD_SLIP, ARPHRD_CSLIP, ARPHRD_SLIP6, ARPHRD_CSLIP6, ARPHRD_RSRVD, ARPHRD_ADAPT, ARPHRD_ROSE, ARPHRD_X25, ARPHRD_HWX25, ARPHRD_CAN, ARPHRD_PPP, ARPHRD_CISCO, ARPHRD_HDLC, ARPHRD_LAPB, ARPHRD_DDCMP, ARPHRD_RAWHDLC, ARPHRD_RAWIP, ARPHRD_TUNNEL, ARPHRD_TUNNEL6, ARPHRD_FRAD, ARPHRD_SKIP, ARPHRD_LOOPBACK, ARPHRD_LOCALTLK, ARPHRD_FDDI, ARPHRD_BIF, ARPHRD_SIT, ARPHRD_IPDDP, ARPHRD_IPGRE, ARPHRD_PIMREG, ARPHRD_HIPPI, ARPHRD_ASH, ARPHRD_ECONET, ARPHRD_IRDA, ARPHRD_FCPP, ARPHRD_FCAL, ARPHRD_FCPL, ARPHRD_FCFABRIC, ARPHRD_IEEE802_TR, ARPHRD_IEEE80211, ARPHRD_IEEE80211_PRISM, ARPHRD_IEEE80211_RADIOTAP, ARPHRD_IEEE802154, ARPHRD_IEEE802154_MONITOR, ARPHRD_PHONET, ARPHRD_PHONET_PIPE, ARPHRD_CAIF, ARPHRD_IP6GRE, ARPHRD_NETLINK, ARPHRD_6LOWPAN, ARPHRD_VSOCKMON, ARPHRD_VOID, ARPHRD_NONE