1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
|
# Copyright 2015 syzkaller project authors. All rights reserved.
# Use of this source code is governed by Apache 2 LICENSE that can be found in the LICENSE file.
include <linux/if_tun.h>
include <linux/virtio_net.h>
resource fd_tun[fd]
syz_open_dev$tun(dev ptr[in, string["/dev/net/tun"]], id const[0], flags flags[open_flags]) fd_tun
write$tun(fd fd_tun, buf ptr[in, tun_buffer], count len[buf])
ioctl$TUNGETFEATURES(fd fd_tun, cmd const[TUNGETFEATURES], arg ptr[out, int32])
ioctl$TUNSETQUEUE(fd fd_tun, cmd const[TUNSETQUEUE], arg ptr[in, ifreq])
ioctl$TUNSETIFF(fd fd_tun, cmd const[TUNSETIFF], arg ptr[in, ifreq])
ioctl$TUNSETIFINDEX(fd fd_tun, cmd const[TUNSETIFINDEX], arg ptr[in, int32])
ioctl$TUNGETIFF(fd fd_tun, cmd const[TUNGETIFF], arg ptr[in, int32])
ioctl$TUNSETNOCSUM(fd fd_tun, cmd const[TUNSETNOCSUM], arg ptr[in, int32])
# TODO: we need a bool type that has only 2 values.
# Lots of ioctl args are effectively bool (0/not-0, for example, TUNSETPERSIST).
# Using bool type will reduce search space.
# We probably need bool/bool16/bool32/bool64.
ioctl$TUNSETPERSIST(fd fd_tun, cmd const[TUNSETPERSIST], arg ptr[in, int32])
ioctl$TUNSETOWNER(fd fd_tun, cmd const[TUNSETOWNER], arg ptr[in, uid])
ioctl$TUNSETLINK(fd fd_tun, cmd const[TUNSETLINK], arg ptr[in, int32])
ioctl$TUNSETOFFLOAD(fd fd_tun, cmd const[TUNSETOFFLOAD], arg ptr[in, int32])
ioctl$TUNSETTXFILTER(fd fd_tun, cmd const[TUNSETTXFILTER], arg ptr[in, tun_filter])
ioctl$SIOCGIFHWADDR(fd fd_tun, cmd const[SIOCGIFHWADDR], arg ptr[out, ifreq])
ioctl$SIOCSIFHWADDR(fd fd_tun, cmd const[SIOCSIFHWADDR], arg ptr[in, ifreq])
ioctl$TUNGETSNDBUF(fd fd_tun, cmd const[TUNGETSNDBUF], arg ptr[out, int32])
ioctl$TUNSETSNDBUF(fd fd_tun, cmd const[TUNSETSNDBUF], arg ptr[in, int32])
ioctl$TUNGETVNETHDRSZ(fd fd_tun, cmd const[TUNGETVNETHDRSZ], arg ptr[out, int32])
ioctl$TUNSETVNETHDRSZ(fd fd_tun, cmd const[TUNSETVNETHDRSZ], arg ptr[in, int32])
ioctl$TUNATTACHFILTER(fd fd_tun, cmd const[TUNATTACHFILTER], arg ptr[in, sock_fprog])
ioctl$TUNDETACHFILTER(fd fd_tun, cmd const[TUNDETACHFILTER], arg const[0])
ioctl$TTUNGETFILTER(fd fd_tun, cmd const[TUNGETFILTER], arg buffer[out])
# TODO: we need to support opt for struct fields.
# tun_buffer has optional tun_pi (if !IFF_NO_PI),
# followed by optional virtio_net_hdr (if IFF_VNET_HDR).
# This gives 4 combinations, it would be nice to mark both fields as opt.
tun_buffer [
pi tun_pi
hdr virtio_net_hdr
] [varlen]
tun_pi {
flags const[0, int16]
proto flags[ether_types, int16be]
data tun_payload
}
virtio_net_hdr {
flags flags[virtio_net_flags, int8]
gsotype flags[virtio_net_types, int8]
hdrlen int16
gsosize int16
start int16
offset int16
data tun_payload
}
tun_payload [
eth eth_packet
ipv4 ipv4_packet
ipv6 ipv6_packet
] [varlen]
tun_filter {
flags flags[tun_filter_flags, int16]
count len[addr, int16]
addr array[mac_addr]
}
tun_filter_flags = TUN_FLT_ALLMULTI
virtio_net_flags = VIRTIO_NET_HDR_F_NEEDS_CSUM, VIRTIO_NET_HDR_F_DATA_VALID
virtio_net_types = VIRTIO_NET_HDR_GSO_NONE, VIRTIO_NET_HDR_GSO_TCPV4, VIRTIO_NET_HDR_GSO_UDP, VIRTIO_NET_HDR_GSO_TCPV6, VIRTIO_NET_HDR_GSO_ECN
|
