]> git.saurik.com Git - apple/xnu.git/blobdiff - bsd/netinet/raw_ip.c
xnu-792.13.8.tar.gz
[apple/xnu.git] / bsd / netinet / raw_ip.c
index c305d431f57d18e0f4b8ba24c4e8ea2239eda941..175962478c618b86018a89b942fc0641b642652c 100644 (file)
@@ -1,23 +1,31 @@
 /*
  * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
  *
- * @APPLE_LICENSE_HEADER_START@
+ * @APPLE_LICENSE_OSREFERENCE_HEADER_START@
  * 
- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License").  You may not use this file except in compliance with the
- * License.  Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
- * 
- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
- * License for the specific language governing rights and limitations
- * under the License.
- * 
- * @APPLE_LICENSE_HEADER_END@
+ * This file contains Original Code and/or Modifications of Original Code 
+ * as defined in and that are subject to the Apple Public Source License 
+ * Version 2.0 (the 'License'). You may not use this file except in 
+ * compliance with the License.  The rights granted to you under the 
+ * License may not be used to create, or enable the creation or 
+ * redistribution of, unlawful or unlicensed copies of an Apple operating 
+ * system, or to circumvent, violate, or enable the circumvention or 
+ * violation of, any terms of an Apple operating system software license 
+ * agreement.
+ *
+ * Please obtain a copy of the License at 
+ * http://www.opensource.apple.com/apsl/ and read it before using this 
+ * file.
+ *
+ * The Original Code and all software distributed under the License are 
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 
+ * Please see the License for the specific language governing rights and 
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_OSREFERENCE_HEADER_END@
  */
 /*
  * Copyright (c) 1982, 1986, 1988, 1993
 #include <sys/malloc.h>
 #include <sys/mbuf.h>
 #include <sys/proc.h>
+#include <sys/domain.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/socketvar.h>
 #include <sys/sysctl.h>
 
-#if ISFB31
+#if __FreeBSD__
 #include <vm/vm_zone.h>
 #endif
 
@@ -76,8 +85,6 @@
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
 #include <netinet/in_pcb.h>
 #include <netinet/in_var.h>
 #include <netinet/ip_var.h>
 #include <netinet6/ipsec.h>
 #endif /*IPSEC*/
 
-#if ISFB31
-#include "opt_ipdn.h"
-#endif
-
 #if DUMMYNET
 #include <netinet/ip_dummynet.h>
 #endif
-#if !defined(COMPAT_IPFW) || COMPAT_IPFW == 1
-#undef COMPAT_IPFW
-#define COMPAT_IPFW 1
-#else
-#undef COMPAT_IPFW
+
+#if IPSEC
+extern int ipsec_bypass;
+extern lck_mtx_t *sadb_mutex;
 #endif
 
-struct inpcbhead ripcb;
-struct inpcbinfo ripcbinfo;
+extern u_long  route_generation;
+struct inpcbhead ripcb;
+struct inpcbinfo ripcbinfo;
+
+/* control hooks for ipfw and dummynet */
+ip_fw_ctl_t *ip_fw_ctl_ptr;
+#if DUMMYNET
+ip_dn_ctl_t *ip_dn_ctl_ptr;
+#endif /* DUMMYNET */
 
 /*
  * Nominal space allocated to a raw ip socket.
@@ -122,6 +131,8 @@ struct inpcbinfo ripcbinfo;
 void
 rip_init()
 {
+       struct inpcbinfo *pcbinfo;
+
        LIST_INIT(&ripcb);
        ripcbinfo.listhead = &ripcb;
        /*
@@ -136,6 +147,22 @@ rip_init()
                                            (4096 * sizeof(struct inpcb)), 
                                            4096, "ripzone");
 
+       pcbinfo = &ripcbinfo;
+        /*
+        * allocate lock group attribute and group for udp pcb mutexes
+        */
+       pcbinfo->mtx_grp_attr = lck_grp_attr_alloc_init();
+
+       pcbinfo->mtx_grp = lck_grp_alloc_init("ripcb", pcbinfo->mtx_grp_attr);
+               
+       /*
+        * allocate the lock attribute for udp pcb mutexes
+        */
+       pcbinfo->mtx_attr = lck_attr_alloc_init();
+
+       if ((pcbinfo->mtx = lck_rw_alloc_init(pcbinfo->mtx_grp, pcbinfo->mtx_attr)) == NULL)
+               return; /* pretty much dead if this fails... */
+
 }
 
 static struct  sockaddr_in ripsrc = { sizeof(ripsrc), AF_INET };
@@ -153,14 +180,16 @@ rip_input(m, iphlen)
        register struct inpcb *inp;
        struct inpcb *last = 0;
        struct mbuf *opts = 0;
-       short need_wakeup = 0;
+       int skipit;
 
        ripsrc.sin_addr = ip->ip_src;
+       lck_rw_lock_shared(ripcbinfo.mtx);
        LIST_FOREACH(inp, &ripcb, inp_list) {
-               if ((inp->inp_vflag & INP_IPV4) == NULL)
+#if INET6
+               if ((inp->inp_vflag & INP_IPV4) == 0)
                        continue;
-#warning do something about this
-               if (inp->inp_ip_p && inp->inp_ip_p != ip->ip_p)
+#endif
+               if (inp->inp_ip_p && (inp->inp_ip_p != ip->ip_p))
                        continue;
                if (inp->inp_laddr.s_addr &&
                   inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
@@ -170,58 +199,86 @@ rip_input(m, iphlen)
                        continue;
                if (last) {
                        struct mbuf *n = m_copy(m, 0, (int)M_COPYALL);
-                       if (n) {
+               
+#if IPSEC
+                       /* check AH/ESP integrity. */
+                       skipit = 0;
+                       if (ipsec_bypass == 0 && n) {
+                               lck_mtx_lock(sadb_mutex);
+                               if (ipsec4_in_reject_so(n, last->inp_socket)) {
+                                       m_freem(n);
+                                       ipsecstat.in_polvio++;
+                                       /* do not inject data to pcb */
+                                       skipit = 1;
+                               }
+                               lck_mtx_unlock(sadb_mutex);
+                       } 
+#endif /*IPSEC*/
+                       if (n && skipit == 0) {
+                               int error = 0;
                                if (last->inp_flags & INP_CONTROLOPTS ||
                                    last->inp_socket->so_options & SO_TIMESTAMP)
                                    ip_savecontrol(last, &opts, ip, n);
-                if (last->inp_flags & INP_STRIPHDR) {
-                    n->m_len -= iphlen;
-                    n->m_pkthdr.len -= iphlen;
-                    n->m_data += iphlen;
-                }
+                               if (last->inp_flags & INP_STRIPHDR) {
+                                       n->m_len -= iphlen;
+                                       n->m_pkthdr.len -= iphlen;
+                                       n->m_data += iphlen;
+                               }
+// ###LOCK need to lock that socket?
                                if (sbappendaddr(&last->inp_socket->so_rcv,
                                    (struct sockaddr *)&ripsrc, n,
-                                   opts) == 0) {
-                                       /* should notify about lost packet */
-                                   kprintf("rip_input can't append to socket\n");
-                                       m_freem(n);
-                                       if (opts)
-                                           m_freem(opts);
-                               } else {
-                                   /* kprintf("rip_input calling sorwakeup\n"); */
-                                   need_wakeup++;
+                                   opts, &error) != 0) {
+                                       sorwakeup(last->inp_socket);
+                               }
+                               else {
+                                       if (error) {
+                                               /* should notify about lost packet */
+                                               kprintf("rip_input can't append to socket\n");
+                                       }
                                }
                                opts = 0;
                        }
                }
                last = inp;
        }
-       if (last) {
-               if (last->inp_flags & INP_CONTROLOPTS ||
-                   last->inp_socket->so_options & SO_TIMESTAMP)
-                       ip_savecontrol(last, &opts, ip, m);
-        if (last->inp_flags & INP_STRIPHDR) {
-            m->m_len -= iphlen;
-            m->m_pkthdr.len -= iphlen;
-            m->m_data += iphlen;
-        }
-               if (sbappendaddr(&last->inp_socket->so_rcv,
-                   (struct sockaddr *)&ripsrc, m, opts) == 0) {
-                   kprintf("rip_input(2) can't append to socket\n");
+       lck_rw_done(ripcbinfo.mtx);
+#if IPSEC
+       /* check AH/ESP integrity. */
+       skipit = 0;
+       if (ipsec_bypass == 0 && last) {
+               lck_mtx_lock(sadb_mutex);
+               if (ipsec4_in_reject_so(m, last->inp_socket)) {
                        m_freem(m);
-                       if (opts)
-                           m_freem(opts);
+                       ipsecstat.in_polvio++;
+                       ipstat.ips_delivered--;
+                       /* do not inject data to pcb */
+                       skipit = 1;
+               }
+               lck_mtx_unlock(sadb_mutex);
+       } 
+#endif /*IPSEC*/
+       if (skipit == 0) {
+               if (last) {
+                       if (last->inp_flags & INP_CONTROLOPTS ||
+                               last->inp_socket->so_options & SO_TIMESTAMP)
+                               ip_savecontrol(last, &opts, ip, m);
+                       if (last->inp_flags & INP_STRIPHDR) {
+                               m->m_len -= iphlen;
+                               m->m_pkthdr.len -= iphlen;
+                               m->m_data += iphlen;
+                       }
+                       if (sbappendaddr(&last->inp_socket->so_rcv,
+                               (struct sockaddr *)&ripsrc, m, opts, NULL) != 0) {
+                               sorwakeup(last->inp_socket);
+                       } else {
+                               kprintf("rip_input(2) can't append to socket\n");
+                       }
                } else {
-                   /* kprintf("rip_input calling sorwakeup\n"); */
-                   need_wakeup++;
+                       m_freem(m);
+                       ipstat.ips_noproto++;
+                       ipstat.ips_delivered--;
                }
-       } else {
-               m_freem(m);
-              ipstat.ips_noproto++;
-              ipstat.ips_delivered--;
-      }
-      if (need_wakeup)
-                   sorwakeup(last->inp_socket);
+       }
 }
 
 /*
@@ -249,13 +306,13 @@ rip_output(m, so, dst)
                }
                M_PREPEND(m, sizeof(struct ip), M_WAIT);
                ip = mtod(m, struct ip *);
-               ip->ip_tos = 0;
+               ip->ip_tos = inp->inp_ip_tos;
                ip->ip_off = 0;
                ip->ip_p = inp->inp_ip_p;
                ip->ip_len = m->m_pkthdr.len;
                ip->ip_src = inp->inp_laddr;
                ip->ip_dst.s_addr = dst;
-               ip->ip_ttl = MAXTTL;
+               ip->ip_ttl = inp->inp_ip_ttl;
        } else {
                if (m->m_pkthdr.len > IP_MAXPACKET) {
                        m_freem(m);
@@ -264,7 +321,7 @@ rip_output(m, so, dst)
                ip = mtod(m, struct ip *);
                /* don't allow both user specified and setsockopt options,
                   and don't allow packet length sizes that will crash */
-               if (((IP_VHL_HL(ip->ip_vhl) != (sizeof (*ip) >> 2)) 
+               if (((IP_VHL_HL(ip->ip_vhl) != (sizeof (*ip) >> 2))
                     && inp->inp_options)
                    || (ip->ip_len > m->m_pkthdr.len)
                    || (ip->ip_len < (IP_VHL_HL(ip->ip_vhl) << 2))) {
@@ -272,20 +329,48 @@ rip_output(m, so, dst)
                        return EINVAL;
                }
                if (ip->ip_id == 0)
+#if RANDOM_IP_ID
+                       ip->ip_id = ip_randomid();
+#else
                        ip->ip_id = htons(ip_id++);
+#endif
                /* XXX prevent ip_output from overwriting header fields */
                flags |= IP_RAWOUTPUT;
                ipstat.ips_rawout++;
        }
 
 #if IPSEC
-       m->m_pkthdr.rcvif = (struct ifnet *)so; /*XXX*/
+       if (ipsec_bypass == 0 && ipsec_setsocket(m, so) != 0) {
+               m_freem(m);
+               return ENOBUFS;
+       }
 #endif /*IPSEC*/
 
-       return (ip_output(m, inp->inp_options, &inp->inp_route, flags,
+       if (inp->inp_route.ro_rt && inp->inp_route.ro_rt->generation_id != route_generation) {
+               rtfree(inp->inp_route.ro_rt);
+               inp->inp_route.ro_rt = (struct rtentry *)0;
+       }
+
+       return (ip_output_list(m, 0, inp->inp_options, &inp->inp_route, flags,
                          inp->inp_moptions));
 }
 
+extern int
+load_ipfw()
+{
+       kern_return_t   err;
+       
+       ipfw_init();
+       
+#if DUMMYNET
+       if (!DUMMYNET_LOADED)
+               ip_dn_init();
+#endif /* DUMMYNET */
+       err = 0;
+       
+       return err == 0 && ip_fw_ctl_ptr == NULL ? -1 : err;
+}
+
 /*
  * Raw IP socket option processing.
  */
@@ -315,29 +400,26 @@ rip_ctloutput(so, sopt)
             error = sooptcopyout(sopt, &optval, sizeof optval);
             break;
 
-#if COMPAT_IPFW
+               case IP_FW_ADD:
                case IP_FW_GET:
+               case IP_OLD_FW_ADD:
+               case IP_OLD_FW_GET:
                        if (ip_fw_ctl_ptr == 0)
-                               error = ENOPROTOOPT;
-                       else
+                               error = load_ipfw();
+                       if (ip_fw_ctl_ptr && error == 0)
                                error = ip_fw_ctl_ptr(sopt);
-                       break;
-
-               case IP_NAT:
-                       if (ip_nat_ctl_ptr == 0)
-                               error = ENOPROTOOPT;
                        else
-                               error = ip_nat_ctl_ptr(sopt);
+                               error = ENOPROTOOPT;
                        break;
+
 #if DUMMYNET
                case IP_DUMMYNET_GET:
-                       if (ip_dn_ctl_ptr == NULL)
-                               error = ENOPROTOOPT ;
-                       else
+                       if (DUMMYNET_LOADED)
                                error = ip_dn_ctl_ptr(sopt);
+                       else
+                               error = ENOPROTOOPT;
                        break ;
 #endif /* DUMMYNET */
-#endif /* COMPAT_IPFW */
 
                case MRT_INIT:
                case MRT_DONE:
@@ -381,34 +463,34 @@ rip_ctloutput(so, sopt)
             break;
 
 
-#if COMPAT_IPFW
                case IP_FW_ADD:
                case IP_FW_DEL:
                case IP_FW_FLUSH:
                case IP_FW_ZERO:
+               case IP_FW_RESETLOG:
+               case IP_OLD_FW_ADD:
+               case IP_OLD_FW_DEL:
+               case IP_OLD_FW_FLUSH:
+               case IP_OLD_FW_ZERO:
+               case IP_OLD_FW_RESETLOG:
                        if (ip_fw_ctl_ptr == 0)
-                               error = ENOPROTOOPT;
-                       else
+                               error = load_ipfw();
+                       if (ip_fw_ctl_ptr && error == 0)
                                error = ip_fw_ctl_ptr(sopt);
-                       break;
-
-               case IP_NAT:
-                       if (ip_nat_ctl_ptr == 0)
-                               error = ENOPROTOOPT;
                        else
-                               error = ip_nat_ctl_ptr(sopt);
+                               error = ENOPROTOOPT;
                        break;
+
 #if DUMMYNET
                case IP_DUMMYNET_CONFIGURE:
                case IP_DUMMYNET_DEL:
                case IP_DUMMYNET_FLUSH:
-                       if (ip_dn_ctl_ptr == NULL)
-                               error = ENOPROTOOPT ;
-                       else
+                       if (DUMMYNET_LOADED)
                                error = ip_dn_ctl_ptr(sopt);
+                       else
+                               error = ENOPROTOOPT ;
                        break ;
 #endif
-#endif /* COMPAT_IPFW */
 
                case IP_RSVP_ON:
                        error = ip_rsvp_init(so);
@@ -468,6 +550,7 @@ rip_ctlinput(cmd, sa, vip)
 
        switch (cmd) {
        case PRC_IFDOWN:
+               lck_mtx_lock(rt_mtx);
                for (ia = in_ifaddrhead.tqh_first; ia;
                     ia = ia->ia_link.tqe_next) {
                        if (ia->ia_ifa.ifa_addr == sa
@@ -475,27 +558,31 @@ rip_ctlinput(cmd, sa, vip)
                                /*
                                 * in_ifscrub kills the interface route.
                                 */
-                               in_ifscrub(ia->ia_ifp, ia);
+                               in_ifscrub(ia->ia_ifp, ia, 1);
                                /*
                                 * in_ifadown gets rid of all the rest of
                                 * the routes.  This is not quite the right
                                 * thing to do, but at least if we are running
                                 * a routing process they will come back.
                                 */
-                               in_ifadown(&ia->ia_ifa);
+                               in_ifadown(&ia->ia_ifa, 1);
                                break;
                        }
                }
+               lck_mtx_unlock(rt_mtx);
                break;
 
        case PRC_IFUP:
+               lck_mtx_lock(rt_mtx);
                for (ia = in_ifaddrhead.tqh_first; ia;
                     ia = ia->ia_link.tqe_next) {
                        if (ia->ia_ifa.ifa_addr == sa)
                                break;
                }
-               if (ia == 0 || (ia->ia_flags & IFA_ROUTE))
+               if (ia == 0 || (ia->ia_flags & IFA_ROUTE)) {
+                       lck_mtx_unlock(rt_mtx);
                        return;
+               }
                flags = RTF_UP;
                ifp = ia->ia_ifa.ifa_ifp;
 
@@ -503,7 +590,8 @@ rip_ctlinput(cmd, sa, vip)
                    || (ifp->if_flags & IFF_POINTOPOINT))
                        flags |= RTF_HOST;
 
-               err = rtinit(&ia->ia_ifa, RTM_ADD, flags);
+               err = rtinit_locked(&ia->ia_ifa, RTM_ADD, flags);
+               lck_mtx_unlock(rt_mtx);
                if (err == 0)
                        ia->ia_flags |= IFA_ROUTE;
                break;
@@ -513,10 +601,10 @@ rip_ctlinput(cmd, sa, vip)
 u_long rip_sendspace = RIPSNDQ;
 u_long rip_recvspace = RIPRCVQ;
 
-SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW, &rip_sendspace,
-          0, "");
-SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW, &rip_recvspace,
-          0, "");
+SYSCTL_INT(_net_inet_raw, OID_AUTO, maxdgram, CTLFLAG_RW,
+    &rip_sendspace, 0, "Maximum outgoing raw IP datagram size");
+SYSCTL_INT(_net_inet_raw, OID_AUTO, recvspace, CTLFLAG_RW,
+    &rip_recvspace, 0, "Maximum incoming raw IP datagram size");
 
 static int
 rip_attach(struct socket *so, int proto, struct proc *p)
@@ -527,39 +615,30 @@ rip_attach(struct socket *so, int proto, struct proc *p)
        inp = sotoinpcb(so);
        if (inp)
                panic("rip_attach");
-
-
-#if ISFB31
-               if (p && (error = suser(p->p_ucred, &p->p_acflag)) != 0)
-                       return error;
+#if __APPLE__
+       if ((so->so_state & SS_PRIV) == 0)
+               return (EPERM);
 #else
-               if ((so->so_state & SS_PRIV) == 0)
-                       return (EPERM);
+       if (p && (error = suser(p)) != 0)
+               return error;
 #endif
 
+       error = soreserve(so, rip_sendspace, rip_recvspace);
+       if (error)
+               return error;
        s = splnet();
        error = in_pcballoc(so, &ripcbinfo, p);
        splx(s);
-       if (error)
-               return error;
-       error = soreserve(so, rip_sendspace, rip_recvspace);
        if (error)
                return error;
        inp = (struct inpcb *)so->so_pcb;
        inp->inp_vflag |= INP_IPV4;
        inp->inp_ip_p = proto;
-#if IPSEC
-       error = ipsec_init_policy(so, &inp->inp_sp);
-       if (error != 0) {
-               in_pcbdetach(inp);
-               return error;
-       }
-#endif /*IPSEC*/
-
+       inp->inp_ip_ttl = ip_defttl;
        return 0;
 }
 
-static int
+__private_extern__ int
 rip_detach(struct socket *so)
 {
        struct inpcb *inp;
@@ -576,14 +655,14 @@ rip_detach(struct socket *so)
        return 0;
 }
 
-static int
+__private_extern__ int
 rip_abort(struct socket *so)
 {
        soisdisconnected(so);
        return rip_detach(so);
 }
 
-static int
+__private_extern__ int
 rip_disconnect(struct socket *so)
 {
        if ((so->so_state & SS_ISCONNECTED) == 0)
@@ -591,25 +670,31 @@ rip_disconnect(struct socket *so)
        return rip_abort(so);
 }
 
-static int
+__private_extern__ int
 rip_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
 {
        struct inpcb *inp = sotoinpcb(so);
        struct sockaddr_in *addr = (struct sockaddr_in *)nam;
+       struct ifaddr *ifa = NULL;
 
        if (nam->sa_len != sizeof(*addr))
                return EINVAL;
 
-       if (TAILQ_EMPTY(&ifnet) || ((addr->sin_family != AF_INET) &&
+       if (TAILQ_EMPTY(&ifnet_head) || ((addr->sin_family != AF_INET) &&
                                    (addr->sin_family != AF_IMPLINK)) ||
            (addr->sin_addr.s_addr &&
-            ifa_ifwithaddr((struct sockaddr *)addr) == 0))
+            (ifa = ifa_ifwithaddr((struct sockaddr *)addr)) == 0)) {
                return EADDRNOTAVAIL;
+       }
+       else if (ifa) {
+               ifafree(ifa);
+               ifa = NULL;
+       }
        inp->inp_laddr = addr->sin_addr;
        return 0;
 }
 
-static int
+__private_extern__ int
 rip_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
 {
        struct inpcb *inp = sotoinpcb(so);
@@ -617,7 +702,7 @@ rip_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
 
        if (nam->sa_len != sizeof(*addr))
                return EINVAL;
-       if (TAILQ_EMPTY(&ifnet))
+       if (TAILQ_EMPTY(&ifnet_head))
                return EADDRNOTAVAIL;
        if ((addr->sin_family != AF_INET) &&
            (addr->sin_family != AF_IMPLINK))
@@ -627,14 +712,14 @@ rip_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
        return 0;
 }
 
-static int
+__private_extern__ int
 rip_shutdown(struct socket *so)
 {
        socantsendmore(so);
        return 0;
 }
 
-static int
+__private_extern__ int
 rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
         struct mbuf *control, struct proc *p)
 {
@@ -657,6 +742,37 @@ rip_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
        return rip_output(m, so, dst);
 }
 
+/* note: rip_unlock is called from different protos  instead of the generic socket_unlock,
+ * it will handle the socket dealloc on last reference 
+ * */
+int
+rip_unlock(struct socket *so, int refcount, int debug)
+{
+       int lr_saved;
+       struct inpcb *inp = sotoinpcb(so);
+
+       if (debug == 0) 
+               lr_saved = (unsigned int) __builtin_return_address(0);
+       else lr_saved = debug;
+
+       if (refcount) {
+               if (so->so_usecount <= 0)
+                       panic("rip_unlock: bad refoucnt so=%x val=%x\n", so, so->so_usecount);
+               so->so_usecount--;
+               if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
+                       /* cleanup after last reference */
+                       lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
+                       lck_rw_lock_exclusive(ripcbinfo.mtx);
+                       in_pcbdispose(inp);
+                       lck_rw_done(ripcbinfo.mtx);
+                       return(0);
+               }
+       }
+       so->unlock_lr[so->next_unlock_lr] = (u_int *)lr_saved;
+       so->next_unlock_lr = (so->next_unlock_lr+1) % SO_LCKDBG_MAX;
+       lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
+       return(0);
+}
 
 static int
 rip_pcblist SYSCTL_HANDLER_ARGS
@@ -670,53 +786,67 @@ rip_pcblist SYSCTL_HANDLER_ARGS
         * The process of preparing the TCB list is too time-consuming and
         * resource-intensive to repeat twice on every request.
         */
-       if (req->oldptr == 0) {
+       lck_rw_lock_exclusive(ripcbinfo.mtx);
+       if (req->oldptr == USER_ADDR_NULL) {
                n = ripcbinfo.ipi_count;
                req->oldidx = 2 * (sizeof xig)
                        + (n + n/8) * sizeof(struct xinpcb);
+               lck_rw_done(ripcbinfo.mtx);
                return 0;
        }
 
-       if (req->newptr != 0)
+       if (req->newptr != USER_ADDR_NULL) {
+               lck_rw_done(ripcbinfo.mtx);
                return EPERM;
+       }
 
        /*
         * OK, now we're committed to doing something.
         */
-       s = splnet();
        gencnt = ripcbinfo.ipi_gencnt;
        n = ripcbinfo.ipi_count;
-       splx(s);
-
+       
+       bzero(&xig, sizeof(xig));
        xig.xig_len = sizeof xig;
        xig.xig_count = n;
        xig.xig_gen = gencnt;
        xig.xig_sogen = so_gencnt;
        error = SYSCTL_OUT(req, &xig, sizeof xig);
-       if (error)
+       if (error) {
+               lck_rw_done(ripcbinfo.mtx);
                return error;
+       }
+    /*
+     * We are done if there is no pcb
+     */
+    if (n == 0) {
+       lck_rw_done(ripcbinfo.mtx);
+        return 0; 
+    }
 
        inp_list = _MALLOC(n * sizeof *inp_list, M_TEMP, M_WAITOK);
-       if (inp_list == 0)
+       if (inp_list == 0) {
+               lck_rw_done(ripcbinfo.mtx);
                return ENOMEM;
+       }
        
-       s = splnet();
        for (inp = ripcbinfo.listhead->lh_first, i = 0; inp && i < n;
             inp = inp->inp_list.le_next) {
-               if (inp->inp_gencnt <= gencnt)
+               if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD)
                        inp_list[i++] = inp;
        }
-       splx(s);
        n = i;
 
        error = 0;
        for (i = 0; i < n; i++) {
                inp = inp_list[i];
-               if (inp->inp_gencnt <= gencnt) {
+               if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {
                        struct xinpcb xi;
+
+                       bzero(&xi, sizeof(xi));
                        xi.xi_len = sizeof xi;
                        /* XXX should avoid extra copy */
-                       bcopy(inp, &xi.xi_inp, sizeof *inp);
+                       inpcb_to_compat(inp, &xi.xi_inp);
                        if (inp->inp_socket)
                                sotoxsocket(inp->inp_socket, &xi.xi_socket);
                        error = SYSCTL_OUT(req, &xi, sizeof xi);
@@ -730,18 +860,18 @@ rip_pcblist SYSCTL_HANDLER_ARGS
                 * while we were processing this request, and it
                 * might be necessary to retry.
                 */
-               s = splnet();
+               bzero(&xig, sizeof(xig));
+               xig.xig_len = sizeof xig;
                xig.xig_gen = ripcbinfo.ipi_gencnt;
                xig.xig_sogen = so_gencnt;
                xig.xig_count = ripcbinfo.ipi_count;
-               splx(s);
                error = SYSCTL_OUT(req, &xig, sizeof xig);
        }
        FREE(inp_list, M_TEMP);
+       lck_rw_done(ripcbinfo.mtx);
        return error;
 }
 
-
 SYSCTL_PROC(_net_inet_raw, OID_AUTO/*XXX*/, pcblist, CTLFLAG_RD, 0, 0,
            rip_pcblist, "S,xinpcb", "List of active raw IP sockets");
 
@@ -749,6 +879,6 @@ struct pr_usrreqs rip_usrreqs = {
        rip_abort, pru_accept_notsupp, rip_attach, rip_bind, rip_connect,
        pru_connect2_notsupp, in_control, rip_detach, rip_disconnect,
        pru_listen_notsupp, in_setpeeraddr, pru_rcvd_notsupp,
-       pru_rcvoob_notsupp, rip_send, pru_sense_null, rip_shutdown, 
-       in_setsockaddr, sosend, soreceive, sopoll
+       pru_rcvoob_notsupp, rip_send, pru_sense_null, rip_shutdown,
+       in_setsockaddr, sosend, soreceive, pru_sopoll_notsupp
 };