>Number:         6473
>Category:       kern
>Synopsis:       can't send to tun* using bpf
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people (Kernel Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Nov 20 13:35:00 1998
>Last-Modified:
>Originator:     Bill Sommerfeld
>Organization:
	
>Release:        19981120
>Environment:
	
System: NetBSD orchard.arlington.ma.us 1.3F NetBSD 1.3F (ORCHARDII) #43: Thu Jul 23 18:24:42 EDT 1998 root@orchard.arlington.ma.us:/d4/d3/NetBSD-current/src/sys/arch/i386/compile/ORCHARDII i386


>Description:
	tunattach() registers the tun driver with BPF using the data
	link type DLT_NULL.

	bpf_write() constructs the destination sockaddr presented to
	the device driver in a call to bpf_movein()

	bpf_movein() sets the sa_family field of the destination
	sockaddr based on the linktype; DLT_NULL gets set to AF_UNSPEC

	tun_output() drops packets on the floor unless the sa_family
	of the destination sockaddr is AF_INET..
		
>How-To-Repeat:
	slightly painful.  uncovered when trying to get dhcpd to service tun0
>Fix:
	TBD.  Probably straightforward.
	Not clear whether fixing bpf to know about a DLT_TUN, or
	fixing tun_output to deal with AF_UNSPEC, makes more sense.
	opinions welcome.
>Audit-Trail:
>Unformatted: