Tap / Tun Devices

😉 Tap / Tun Devices一般用于 Overlay Network

网络虚拟化系列文章通过openvpn分析tun实现隧道的数据流程提醒： 1.网上大多文章在这方面的分析都是错的，认为是openvpn对数据进行额外的封装和解封。 2.但实际上，在不绕过内核的情况下，网络数据的封装和解封由内核负责，用户空间的程序无法对数据进行封装和解封。以OpenVPN配置ip隧道为例，下图是一个简图(而且是不正确的流程图)，后面会详细分析每一个步骤。公网上的两个主

理解Linux虚拟网卡设备tun/tap的一切

网络虚拟化系列文章理解Linux虚拟网卡设备tun/tap的一切在前一篇文章理解物理网卡、网卡接口、内核、IP等属性的关系中，介绍了物理网卡、网卡接口、IP属性、内核之间的关系，本文将简单介绍Linux中的虚拟网卡设备tun和tap。物理网卡收发数据的流程物理网卡可以接收和发送数据：收：外界向该物理网卡发送数据时，外界发送到网卡的数据最终会传输到内核空间的网络协议栈中发：本机

https://segmentfault.com/a/1190000009249039

📄 通过openvpn分析tun实现隧道的数据流程 _ 骏马金龙.pdf (570 KB)（暂未托管，后续换成 Google Drive 分享链接）

📄 理解Linux虚拟网卡设备tun_tap的一切 _ 骏马金龙.pdf (951 KB)（暂未托管，后续换成 Google Drive 分享链接）

tun设备的妙用-VPN篇

疫情期间，二哥在家远程工作了。因为每天都要通过VPN访问公司内部服务，二哥想起来，何不给大家介绍下VPN的工作原理呢？

tap/tun 提供了一台主机内用户空间的数据传输机制。它虚拟了一套网络接口，这套接口和物理的接口无任何区别，可以配置 IP，可以路由流量，不同的是，它的流量只在主机内流通。

作为网络设备，tap/tun 也需要配套相应的驱动程序才能工作。tap/tun 驱动程序包括两个部分，一个是字符设备驱动，一个是网卡驱动。这两部分驱动程序分工不太一样，字符驱动负责数据包在内核空间和用户空间的传送，网卡驱动负责数据包在 TCP/IP 网络协议栈上的传输和处理。

tap/tun 有些许的不同，tun 只操作三层的 IP 包，而 tap 操作二层的以太网帧。

在 Linux 中，用户空间和内核空间的数据传输有多种方式，字符设备就是其中的一种。tap/tun 通过驱动程序和一个与之关联的字符设备，来实现用户空间和内核空间的通信接口。

在 Linux 内核 2.6.x 之后的版本中，tap/tun 对应的字符设备文件分别为：

 tap：/dev/tap0

 tun：/dev/net/tun

设备文件即充当了用户空间和内核空间通信的接口。当应用程序打开设备文件时，驱动程序就会创建并注册相应的虚拟设备接口，一般以 tunX 或 tapX 命名。当应用程序关闭文件时，驱动也会自动删除 tunX 和 tapX 设备，还会删除已经建立起来的路由等信息。

tap/tun 设备文件就像一个管道，一端连接着用户空间，一端连接着内核空间。当用户程序向文件 /dev/net/tun 或/dev/tap0 写数据时，内核就可以从对应的 tunX 或 tapX 接口读到数据，反之，内核可以通过相反的方式向用户程序发送数据。

tap/tun 是 Linux 内核 2.4.x 版本之后实现的虚拟网络设备，不同于物理网卡靠硬件板卡实现，tap/tun 虚拟网卡完全由软件实现，功能和硬件实现完全没差别，它们都属于网络设备，都可配置 IP，都归 Linux 网络设备管理模块统一管理。

In computer networking, TUN and TAP are kernel virtual network devices. Being network devices supported entirely in software, they differ from ordinary network devices which are backed by physical network adapters.

The Universal TUN/TAP Driver originated in 2000 as a merger of the corresponding drivers in Solaris, Linux and BSD.[1] The driver continues to be maintained as part of the Linux[2] and FreeBSD[3][4] kernels.

Design[edit]

TUN and TAP in the network stack

Though both are for tunneling purposes, TUN and TAP can’t be used together because they transmit and receive packets at different layers of the network stack. TUN, namely network TUNnel, simulates a network layer device and operates in layer 3 carrying IP packets. TAP, namely network TAP, simulates a link layer device and operates in layer 2 carrying Ethernet frames. TUN is used with routing. TAP can be used to create a user space network bridge.[2]

Packets sent by an operating system via a TUN/TAP device are delivered to a user space program which attaches itself to the device. A user space program may also pass packets into a TUN/TAP device. In this case the TUN/TAP device delivers (or “injects”) these packets to the operating-system network stack thus emulating their reception from an external source.[2]

Universal TUN/TAP device driver Frequently Asked Question

Currently driver has been written for 3 Unices:

Linux kernels 2.2.x, 2.4.x

FreeBSD 3.x, 4.x, 5.x
Solaris 2.6, 7.0, 8.0

As mentioned above, main purpose of TUN/TAP driver is tunneling. It is used by VTun (http://vtun.sourceforge.net).

Another interesting application using TUN/TAP is pipsecd (http://perso.enst.fr/~beyssac/pipsec/), a userspace IPSec implementation that can use complete kernel routing (unlike FreeS/WAN).

Virtual network device can be viewed as a simple Point-to-Point or Ethernet device, which instead of receiving packets from a physical media, receives them from user space program and instead of sending packets via physical media sends them to the user space program.

Let’s say that you configured IPv6 on the tap0, then whenever the kernel sends an IPv6 packet to tap0, it is passed to the application (VTun for example). The application encrypts, compresses and sends it to the other side over TCP or UDP. The application on the other side decompresses and decrypts the data received and writes the packet to the TAP device, the kernel handles the packet like it came from real physical device.

TUN works with IP frames. TAP works with Ethernet frames.

This means that you have to read/write IP packets when you are using tun and ethernet frames when using tap.

BPF is an advanced packet filter. It can be attached to existing network interface. It does not provide a virtual network interface. A TUN/TAP driver does provide a virtual network interface and it is possible to attach BPF to this interface.

Yes. Linux and FreeBSD drivers support Ethernet bridging.