Fix some long standing bugs in writing to the BPF device attached to

a DLT_NULL interface. In particular:

        1) Consistently use type u_int32_t for the header of a
           DLT_NULL device - it continues to represent the address
           family as always.
        2) In the DLT_NULL case get bpf_movein to store the u_int32_t
           in a sockaddr rather than in the mbuf, to be consistent
           with all the DLT types.
        3) Consequently fix a bug in bpf_movein/bpfwrite which
           only permitted packets up to 4 bytes less than the MTU
           to be written.
        4) Fix all DLT_NULL devices to have the code required to
           allow writing to their bpf devices.
        5) Move the code to allow writing to if_lo from if_simloop
           to looutput, because it only applies to DLT_NULL devices
           but was being applied to other devices that use if_simloop
           possibly incorrectly.

PR:		82157
Submitted by:	Matthew Luckie <mjl@luckie.org.nz>
Approved by:	re (scottl)

1 files changed, 6 insertions, 7 deletions

diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c
index 310ff490d199..4c23fa8150da 100644
--- a/sys/net/if_tun.c
+++ b/sys/net/if_tun.c
@@ -285,7 +285,7 @@ tuncreate(struct cdev *dev)
 	IFQ_SET_READY(&ifp->if_snd);
 
 	if_attach(ifp);
-	bpfattach(ifp, DLT_NULL, sizeof(u_int));
+	bpfattach(ifp, DLT_NULL, sizeof(u_int32_t));
 	dev->si_drv1 = sc;
 }
 
@@ -473,6 +473,7 @@ tunoutput(
 	struct tun_softc *tp = ifp->if_softc;
 	u_short cached_tun_flags;
 	int error;
+	u_int32_t af;
 
 	TUNDEBUG (ifp, "tunoutput\n");
 
@@ -499,16 +500,14 @@ tunoutput(
 		return (EHOSTDOWN);
 	}
 
-	/* BPF write needs to be handled specially */
+	/* BPF writes need to be handled specially. */
 	if (dst->sa_family == AF_UNSPEC) {
-		dst->sa_family = *(mtod(m0, int *));
-		m0->m_len -= sizeof(int);
-		m0->m_pkthdr.len -= sizeof(int);
-		m0->m_data += sizeof(int);
+		bcopy(dst->sa_data, &af, sizeof(af));
+		dst->sa_family = af; 
 	}
 
 	if (ifp->if_bpf) {
-		uint32_t af = dst->sa_family;
+		af = dst->sa_family;
 		bpf_mtap2(ifp->if_bpf, &af, sizeof(af), m0);
 	}