xnu-1699.22.73.tar.gz

[apple/xnu.git] / bsd / netinet / in_pcb.c

diff --git a/bsd/netinet/in_pcb.c b/bsd/netinet/in_pcb.c
index 3e1a98d3002ae6d2f572da033766efe53f40e96d..51eeca0b323477caa2074b9ef4d93d6d3c2eaf69 100644 (file)
--- a/bsd/netinet/in_pcb.c
+++ b/bsd/netinet/in_pcb.c
@@ -1,16 +1,19 @@
 /*
 /*

- * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
+ * Copyright (c) 2000-2011 Apple Inc. All rights reserved.

  *
  *

- * @APPLE_LICENSE_HEADER_START@
- * 
- * Copyright (c) 1999-2003 Apple Computer, Inc.  All Rights Reserved.
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

  * 
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in
  * 
  * This file contains Original Code and/or Modifications of Original Code
  * as defined in and that are subject to the Apple Public Source License
  * Version 2.0 (the 'License'). You may not use this file except in

- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ * 
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.

  * 
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  * 
  * The Original Code and all software distributed under the License are
  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER


@@ -20,7 +23,7 @@
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * 
  * Please see the License for the specific language governing rights and
  * limitations under the License.
  * 

- * @APPLE_LICENSE_HEADER_END@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@

  */
 /*
  * Copyright (c) 1982, 1986, 1991, 1993, 1995
  */
 /*
  * Copyright (c) 1982, 1986, 1991, 1993, 1995


@@ -72,6 +75,10 @@
 #endif
 #include <sys/kernel.h>
 #include <sys/sysctl.h>
 #endif
 #include <sys/kernel.h>
 #include <sys/sysctl.h>

+#include <sys/mcache.h>
+#include <sys/kauth.h>
+#include <sys/priv.h>
+#include <libkern/OSAtomic.h>

 
 #include <machine/limits.h>
 
 
 #include <machine/limits.h>
 


@@ -100,6 +107,7 @@
 #endif /* IPSEC */
 
 #include <sys/kdebug.h>
 #endif /* IPSEC */
 
 #include <sys/kdebug.h>

+#include <sys/random.h>

 
 #if IPSEC
 extern int ipsec_bypass;
 
 #if IPSEC
 extern int ipsec_bypass;


@@ -133,6 +141,7 @@ int ipport_hilastauto  = IPPORT_HILASTAUTO;         /* 65535 */
 static int
 sysctl_net_ipport_check SYSCTL_HANDLER_ARGS
 {
 static int
 sysctl_net_ipport_check SYSCTL_HANDLER_ARGS
 {

+#pragma unused(arg1, arg2)

        int error = sysctl_handle_int(oidp,
                oidp->oid_arg1, oidp->oid_arg2, req);
        if (!error) {
        int error = sysctl_handle_int(oidp,
                oidp->oid_arg1, oidp->oid_arg2, req);
        if (!error) {


@@ -148,21 +157,24 @@ sysctl_net_ipport_check SYSCTL_HANDLER_ARGS
 
 #undef RANGECHK
 
 
 #undef RANGECHK
 

-SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange, CTLFLAG_RW, 0, "IP Ports");
+SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange, CTLFLAG_RW|CTLFLAG_LOCKED, 0, "IP Ports");

 
 

-SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst, CTLTYPE_INT|CTLFLAG_RW,
+SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,

           &ipport_lowfirstauto, 0, &sysctl_net_ipport_check, "I", "");
           &ipport_lowfirstauto, 0, &sysctl_net_ipport_check, "I", "");

-SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast, CTLTYPE_INT|CTLFLAG_RW,
+SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,

           &ipport_lowlastauto, 0, &sysctl_net_ipport_check, "I", "");
           &ipport_lowlastauto, 0, &sysctl_net_ipport_check, "I", "");

-SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first, CTLTYPE_INT|CTLFLAG_RW,
+SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,

           &ipport_firstauto, 0, &sysctl_net_ipport_check, "I", "");
           &ipport_firstauto, 0, &sysctl_net_ipport_check, "I", "");

-SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last, CTLTYPE_INT|CTLFLAG_RW,
+SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,

           &ipport_lastauto, 0, &sysctl_net_ipport_check, "I", "");
           &ipport_lastauto, 0, &sysctl_net_ipport_check, "I", "");

-SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst, CTLTYPE_INT|CTLFLAG_RW,
+SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,

           &ipport_hifirstauto, 0, &sysctl_net_ipport_check, "I", "");
           &ipport_hifirstauto, 0, &sysctl_net_ipport_check, "I", "");

-SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW,
+SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW | CTLFLAG_LOCKED,

           &ipport_hilastauto, 0, &sysctl_net_ipport_check, "I", "");
 
           &ipport_hilastauto, 0, &sysctl_net_ipport_check, "I", "");
 

+extern int     udp_use_randomport;
+extern int     tcp_use_randomport;
+

 /*
  * in_pcb.c: manage the Protocol Control Blocks.
  *
 /*
  * in_pcb.c: manage the Protocol Control Blocks.
  *


@@ -173,18 +185,25 @@ SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast, CTLTYPE_INT|CTLFLAG_RW,
 
 /*
  * Allocate a PCB and associate it with the socket.
 
 /*
  * Allocate a PCB and associate it with the socket.

+ *
+ * Returns:    0                       Success
+ *             ENOBUFS
+ *             ENOMEM
+ *     ipsec_init_policy:???           [IPSEC]

  */
 int
  */
 int

-in_pcballoc(so, pcbinfo, p)
-       struct socket *so;
-       struct inpcbinfo *pcbinfo;
-       struct proc *p;
+in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo, __unused struct proc *p)

 {
 {

-       register struct inpcb *inp;
+       struct inpcb *inp;

        caddr_t               temp;
 #if IPSEC
        caddr_t               temp;
 #if IPSEC

+#ifndef __APPLE__

        int error;
 #endif
        int error;
 #endif

+#endif
+#if CONFIG_MACF_NET
+       int mac_error;
+#endif

 
        if (so->cached_in_sock_layer == 0) {
 #if TEMPDEBUG
 
        if (so->cached_in_sock_layer == 0) {
 #if TEMPDEBUG


@@ -208,44 +227,144 @@ in_pcballoc(so, pcbinfo, p)
        inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
        inp->inp_pcbinfo = pcbinfo;
        inp->inp_socket = so;
        inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
        inp->inp_pcbinfo = pcbinfo;
        inp->inp_socket = so;

+#if CONFIG_MACF_NET
+       mac_error = mac_inpcb_label_init(inp, M_WAITOK);
+       if (mac_error != 0) {
+               if (so->cached_in_sock_layer == 0)
+                       zfree(pcbinfo->ipi_zone, inp);
+               return (mac_error);
+       }
+       mac_inpcb_label_associate(so, inp);
+#endif
+       // make sure inp_stat is always 64bit aligned
+       inp->inp_stat = (struct inp_stat*)P2ROUNDUP(inp->inp_stat_store, sizeof(u_int64_t));
+       if (((uintptr_t)inp->inp_stat - (uintptr_t)inp->inp_stat_store)
+               + sizeof(*inp->inp_stat) > sizeof(inp->inp_stat_store)) {
+               panic("insufficient space to align inp_stat");
+       }
+
+       so->so_pcb = (caddr_t)inp;
+
+       if (so->so_proto->pr_flags & PR_PCBLOCK) {
+               lck_mtx_init(&inp->inpcb_mtx, pcbinfo->mtx_grp, pcbinfo->mtx_attr);
+       }
+

 #if IPSEC
 #ifndef __APPLE__
        if (ipsec_bypass == 0) {
                error = ipsec_init_policy(so, &inp->inp_sp);
                if (error != 0) {
 #if IPSEC
 #ifndef __APPLE__
        if (ipsec_bypass == 0) {
                error = ipsec_init_policy(so, &inp->inp_sp);
                if (error != 0) {

-                       zfree(pcbinfo->ipi_zone, (vm_offset_t)inp);
+                       zfree(pcbinfo->ipi_zone, inp);

                        return error;
                }
        }
 #endif
 #endif /*IPSEC*/
                        return error;
                }
        }
 #endif
 #endif /*IPSEC*/

-#if defined(INET6)
+#if INET6

        if (INP_SOCKAF(so) == AF_INET6 && !ip6_mapped_addr_on)
                inp->inp_flags |= IN6P_IPV6_V6ONLY;
 #endif
        if (INP_SOCKAF(so) == AF_INET6 && !ip6_mapped_addr_on)
                inp->inp_flags |= IN6P_IPV6_V6ONLY;
 #endif

-       LIST_INSERT_HEAD(pcbinfo->listhead, inp, inp_list);
-       pcbinfo->ipi_count++;
-       so->so_pcb = (caddr_t)inp;
+       

 #if INET6
        if (ip6_auto_flowlabel)
                inp->inp_flags |= IN6P_AUTOFLOWLABEL;
 #endif
 #if INET6
        if (ip6_auto_flowlabel)
                inp->inp_flags |= IN6P_AUTOFLOWLABEL;
 #endif

+       lck_rw_lock_exclusive(pcbinfo->mtx);
+       inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
+       LIST_INSERT_HEAD(pcbinfo->listhead, inp, inp_list);
+       pcbinfo->ipi_count++;
+       lck_rw_done(pcbinfo->mtx);

        return (0);
 }
 
        return (0);
 }
 

+
+/*
+  in_pcblookup_local_and_cleanup does everything
+  in_pcblookup_local does but it checks for a socket
+  that's going away. Since we know that the lock is
+  held read+write when this funciton is called, we
+  can safely dispose of this socket like the slow
+  timer would usually do and return NULL. This is
+  great for bind.
+*/
+struct inpcb*
+in_pcblookup_local_and_cleanup(
+       struct inpcbinfo *pcbinfo,
+       struct in_addr laddr,
+       u_int lport_arg,
+       int wild_okay)
+{
+       struct inpcb *inp;
+       
+       /* Perform normal lookup */
+       inp = in_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay);
+       
+       /* Check if we found a match but it's waiting to be disposed */
+       if (inp && inp->inp_wantcnt == WNT_STOPUSING) {
+               struct socket *so = inp->inp_socket;
+               
+               lck_mtx_lock(&inp->inpcb_mtx);
+               
+               if (so->so_usecount == 0) {
+                       if (inp->inp_state != INPCB_STATE_DEAD)
+                               in_pcbdetach(inp);
+                       in_pcbdispose(inp);
+                       inp = NULL;
+               }
+               else {
+                       lck_mtx_unlock(&inp->inpcb_mtx);
+               }
+       }
+       
+       return inp;
+}
+
+#ifdef __APPLE_API_PRIVATE
+static void
+in_pcb_conflict_post_msg(u_int16_t port)
+{
+       /* 
+        * Radar 5523020 send a kernel event notification if a non-participating socket tries to bind
+        *               the port a socket who has set SOF_NOTIFYCONFLICT owns.
+        */
+       struct kev_msg        ev_msg;
+       struct kev_in_portinuse in_portinuse;
+
+       bzero(&in_portinuse, sizeof(struct kev_in_portinuse));
+       bzero(&ev_msg, sizeof(struct kev_msg));
+       in_portinuse.port = ntohs(port);        /* port in host order */
+       in_portinuse.req_pid = proc_selfpid();
+       ev_msg.vendor_code = KEV_VENDOR_APPLE;
+       ev_msg.kev_class = KEV_NETWORK_CLASS;
+       ev_msg.kev_subclass = KEV_INET_SUBCLASS;
+       ev_msg.event_code = KEV_INET_PORTINUSE;
+       ev_msg.dv[0].data_ptr = &in_portinuse;
+       ev_msg.dv[0].data_length      = sizeof(struct kev_in_portinuse);
+       ev_msg.dv[1].data_length = 0;
+       kev_post_msg(&ev_msg);
+}
+#endif
+/*
+ * Returns:    0                       Success
+ *             EADDRNOTAVAIL           Address not available.
+ *             EINVAL                  Invalid argument
+ *             EAFNOSUPPORT            Address family not supported [notdef]
+ *             EACCES                  Permission denied
+ *             EADDRINUSE              Address in use
+ *             EAGAIN                  Resource unavailable, try again
+ *             priv_check_cred:EPERM   Operation not permitted
+ */

 int
 int

-in_pcbbind(inp, nam, p)
-       register struct inpcb *inp;
-       struct sockaddr *nam;
-       struct proc *p;
+in_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p)

 {
 {

-       register struct socket *so = inp->inp_socket;
+       struct socket *so = inp->inp_socket;

        unsigned short *lastport;
        struct sockaddr_in *sin;
        struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
        unsigned short *lastport;
        struct sockaddr_in *sin;
        struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;

-       u_short lport = 0;
+       u_short lport = 0, rand_port = 0;

        int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
        int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);

-       int error;
+       int error, randomport, conflict = 0;
+       kauth_cred_t cred;

 
        if (TAILQ_EMPTY(&in_ifaddrhead)) /* XXX broken! */
                return (EADDRNOTAVAIL);
 
        if (TAILQ_EMPTY(&in_ifaddrhead)) /* XXX broken! */
                return (EADDRNOTAVAIL);


@@ -253,17 +372,27 @@ in_pcbbind(inp, nam, p)
                return (EINVAL);
        if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0)
                wild = 1;
                return (EINVAL);
        if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0)
                wild = 1;

+       socket_unlock(so, 0); /* keep reference on socket */
+       lck_rw_lock_exclusive(pcbinfo->mtx);

        if (nam) {
        if (nam) {

+               unsigned int outif = 0;
+

                sin = (struct sockaddr_in *)nam;
                sin = (struct sockaddr_in *)nam;

-               if (nam->sa_len != sizeof (*sin))
+               if (nam->sa_len != sizeof (*sin)) {
+                       lck_rw_done(pcbinfo->mtx);
+                       socket_lock(so, 0);

                        return (EINVAL);
                        return (EINVAL);

+               }

 #ifdef notdef
                /*
                 * We should check the family, but old programs
                 * incorrectly fail to initialize it.
                 */
 #ifdef notdef
                /*
                 * We should check the family, but old programs
                 * incorrectly fail to initialize it.
                 */

-               if (sin->sin_family != AF_INET)
+               if (sin->sin_family != AF_INET) {
+                       lck_rw_done(pcbinfo->mtx);
+                       socket_lock(so, 0);

                        return (EAFNOSUPPORT);
                        return (EAFNOSUPPORT);

+               }

 #endif
                lport = sin->sin_port;
                if (IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
 #endif
                lport = sin->sin_port;
                if (IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {


@@ -277,27 +406,47 @@ in_pcbbind(inp, nam, p)
                        if (so->so_options & SO_REUSEADDR)
                                reuseport = SO_REUSEADDR|SO_REUSEPORT;
                } else if (sin->sin_addr.s_addr != INADDR_ANY) {
                        if (so->so_options & SO_REUSEADDR)
                                reuseport = SO_REUSEADDR|SO_REUSEPORT;
                } else if (sin->sin_addr.s_addr != INADDR_ANY) {

+                       struct ifaddr *ifa;

                        sin->sin_port = 0;              /* yech... */
                        sin->sin_port = 0;              /* yech... */

-                       if (ifa_ifwithaddr((struct sockaddr *)sin) == 0)
+                       if ((ifa = ifa_ifwithaddr((struct sockaddr *)sin)) == 0) {
+                               lck_rw_done(pcbinfo->mtx);
+                               socket_lock(so, 0);

                                return (EADDRNOTAVAIL);
                                return (EADDRNOTAVAIL);

+                       }
+                       else {
+                               IFA_LOCK(ifa);
+                               outif = ifa->ifa_ifp->if_index;
+                               IFA_UNLOCK(ifa);
+                               IFA_REMREF(ifa);
+                       }

                }
                if (lport) {
                        struct inpcb *t;
 
                        /* GROSS */
                }
                if (lport) {
                        struct inpcb *t;
 
                        /* GROSS */

-                       if (ntohs(lport) < IPPORT_RESERVED && p &&
-                           suser(p->p_ucred, &p->p_acflag))
-                               return (EACCES);
+#if !CONFIG_EMBEDDED
+                       if (ntohs(lport) < IPPORT_RESERVED) {
+                               cred = kauth_cred_proc_ref(p);
+                               error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0);
+                               kauth_cred_unref(&cred);
+                               if (error != 0) {
+                                       lck_rw_done(pcbinfo->mtx);
+                                       socket_lock(so, 0);
+                                       return (EACCES);
+                               }
+                       }
+#endif

                        if (so->so_uid &&
                            !IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
                        if (so->so_uid &&
                            !IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {

-                               t = in_pcblookup_local(inp->inp_pcbinfo,
+                               t = in_pcblookup_local_and_cleanup(inp->inp_pcbinfo,

                                    sin->sin_addr, lport, INPLOOKUP_WILDCARD);
                                if (t &&
                                    (ntohl(sin->sin_addr.s_addr) != INADDR_ANY ||
                                     ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
                                     (t->inp_socket->so_options &
                                         SO_REUSEPORT) == 0) &&
                                    sin->sin_addr, lport, INPLOOKUP_WILDCARD);
                                if (t &&
                                    (ntohl(sin->sin_addr.s_addr) != INADDR_ANY ||
                                     ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
                                     (t->inp_socket->so_options &
                                         SO_REUSEPORT) == 0) &&

-                                    (so->so_uid != t->inp_socket->so_uid)) {
+                                    (so->so_uid != t->inp_socket->so_uid) &&
+                                     ((t->inp_socket->so_flags & SOF_REUSESHAREUID) == 0)) {

 #if INET6
                                        if (ntohl(sin->sin_addr.s_addr) !=
                                            INADDR_ANY ||
 #if INET6
                                        if (ntohl(sin->sin_addr.s_addr) !=
                                            INADDR_ANY ||


@@ -305,11 +454,27 @@ in_pcbbind(inp, nam, p)
                                            INADDR_ANY ||
                                            INP_SOCKAF(so) ==
                                            INP_SOCKAF(t->inp_socket))
                                            INADDR_ANY ||
                                            INP_SOCKAF(so) ==
                                            INP_SOCKAF(t->inp_socket))

-#endif /* defined(INET6) */
-                                       return (EADDRINUSE);
+#endif /* INET6 */
+                                       {
+#ifdef __APPLE_API_PRIVATE
+
+                                               if ((t->inp_socket->so_flags & SOF_NOTIFYCONFLICT) && ((so->so_flags & SOF_NOTIFYCONFLICT) == 0)) 
+                                                       conflict = 1;
+
+                                               lck_rw_done(pcbinfo->mtx);
+
+                                               if (conflict)
+                                                       in_pcb_conflict_post_msg(lport);
+#else
+                                               lck_rw_done(pcbinfo->mtx);
+#endif /* __APPLE_API_PRIVATE */
+
+                                               socket_lock(so, 0);
+                                               return (EADDRINUSE);
+                                       }

                                }
                        }
                                }
                        }

-                       t = in_pcblookup_local(pcbinfo, sin->sin_addr,
+                       t = in_pcblookup_local_and_cleanup(pcbinfo, sin->sin_addr,

                            lport, wild);
                        if (t &&
                            (reuseport & t->inp_socket->so_options) == 0) {
                            lport, wild);
                        if (t &&
                            (reuseport & t->inp_socket->so_options) == 0) {


@@ -321,16 +486,35 @@ in_pcbbind(inp, nam, p)
                                    INADDR_ANY ||
                                    INP_SOCKAF(so) ==
                                    INP_SOCKAF(t->inp_socket))
                                    INADDR_ANY ||
                                    INP_SOCKAF(so) ==
                                    INP_SOCKAF(t->inp_socket))

-#endif /* defined(INET6) */
-                               return (EADDRINUSE);
+#endif /* INET6 */
+                               {
+#ifdef __APPLE_API_PRIVATE
+
+                                       if ((t->inp_socket->so_flags & SOF_NOTIFYCONFLICT) && ((so->so_flags & SOF_NOTIFYCONFLICT) == 0)) 
+                                               conflict = 1;
+
+                                       lck_rw_done(pcbinfo->mtx);
+
+                                       if (conflict)
+                                               in_pcb_conflict_post_msg(lport);
+#else
+                                       lck_rw_done(pcbinfo->mtx);
+#endif /* __APPLE_API_PRIVATE */
+                                       socket_lock(so, 0);
+                                       return (EADDRINUSE);
+                               }

                        }
                }
                inp->inp_laddr = sin->sin_addr;
                        }
                }
                inp->inp_laddr = sin->sin_addr;

+               inp->inp_last_outif = outif;

        }
        if (lport == 0) {
                u_short first, last;
                int count;
 
        }
        if (lport == 0) {
                u_short first, last;
                int count;
 

+               randomport = (so->so_flags & SOF_BINDRANDOMPORT) || 
+                       (so->so_type == SOCK_STREAM ? tcp_use_randomport : udp_use_randomport);
+

                inp->inp_flags |= INP_ANONPORT;
 
                if (inp->inp_flags & INP_HIGHPORT) {
                inp->inp_flags |= INP_ANONPORT;
 
                if (inp->inp_flags & INP_HIGHPORT) {


@@ -338,8 +522,14 @@ in_pcbbind(inp, nam, p)
                        last  = ipport_hilastauto;
                        lastport = &pcbinfo->lasthi;
                } else if (inp->inp_flags & INP_LOWPORT) {
                        last  = ipport_hilastauto;
                        lastport = &pcbinfo->lasthi;
                } else if (inp->inp_flags & INP_LOWPORT) {

-                       if (p && (error = suser(p->p_ucred, &p->p_acflag)))
+                       cred = kauth_cred_proc_ref(p);
+                       error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0);
+                       kauth_cred_unref(&cred);
+                       if (error != 0) {
+                               lck_rw_done(pcbinfo->mtx);
+                               socket_lock(so, 0);

                                return error;
                                return error;

+                       }

                        first = ipport_lowfirstauto;    /* 1023 */
                        last  = ipport_lowlastauto;     /* 600 */
                        lastport = &pcbinfo->lastlow;
                        first = ipport_lowfirstauto;    /* 1023 */
                        last  = ipport_lowlastauto;     /* 600 */
                        lastport = &pcbinfo->lastlow;


@@ -348,6 +538,10 @@ in_pcbbind(inp, nam, p)
                        last  = ipport_lastauto;
                        lastport = &pcbinfo->lastport;
                }
                        last  = ipport_lastauto;
                        lastport = &pcbinfo->lastport;
                }

+               /* No point in randomizing if only one port is available */
+
+               if (first == last)
+                       randomport = 0; 

                /*
                 * Simple check to ensure all ports are not used up causing
                 * a deadlock here.
                /*
                 * Simple check to ensure all ports are not used up causing
                 * a deadlock here.


@@ -359,44 +553,63 @@ in_pcbbind(inp, nam, p)
                        /*
                         * counting down
                         */
                        /*
                         * counting down
                         */

+                       if (randomport) {
+                               read_random(&rand_port, sizeof(rand_port));
+                               *lastport = first - (rand_port % (first - last));
+                       }

                        count = first - last;
 
                        do {
                                if (count-- < 0) {      /* completely used? */
                        count = first - last;
 
                        do {
                                if (count-- < 0) {      /* completely used? */

+                                       lck_rw_done(pcbinfo->mtx);
+                                       socket_lock(so, 0);

                                        inp->inp_laddr.s_addr = INADDR_ANY;
                                        inp->inp_laddr.s_addr = INADDR_ANY;

+                                       inp->inp_last_outif = 0;

                                        return (EADDRNOTAVAIL);
                                }
                                --*lastport;
                                if (*lastport > first || *lastport < last)
                                        *lastport = first;
                                lport = htons(*lastport);
                                        return (EADDRNOTAVAIL);
                                }
                                --*lastport;
                                if (*lastport > first || *lastport < last)
                                        *lastport = first;
                                lport = htons(*lastport);

-                       } while (in_pcblookup_local(pcbinfo,
+                       } while (in_pcblookup_local_and_cleanup(pcbinfo,

                                 inp->inp_laddr, lport, wild));
                } else {
                        /*
                         * counting up
                         */
                                 inp->inp_laddr, lport, wild));
                } else {
                        /*
                         * counting up
                         */

+                       if (randomport) {
+                               read_random(&rand_port, sizeof(rand_port));
+                               *lastport = first + (rand_port % (first - last));
+                       }

                        count = last - first;
 
                        do {
                                if (count-- < 0) {      /* completely used? */
                        count = last - first;
 
                        do {
                                if (count-- < 0) {      /* completely used? */

+                                       lck_rw_done(pcbinfo->mtx);
+                                       socket_lock(so, 0);

                                        inp->inp_laddr.s_addr = INADDR_ANY;
                                        inp->inp_laddr.s_addr = INADDR_ANY;

+                                       inp->inp_last_outif = 0;

                                        return (EADDRNOTAVAIL);
                                }
                                ++*lastport;
                                if (*lastport < first || *lastport > last)
                                        *lastport = first;
                                lport = htons(*lastport);
                                        return (EADDRNOTAVAIL);
                                }
                                ++*lastport;
                                if (*lastport < first || *lastport > last)
                                        *lastport = first;
                                lport = htons(*lastport);

-                       } while (in_pcblookup_local(pcbinfo,
+                       } while (in_pcblookup_local_and_cleanup(pcbinfo,

                                 inp->inp_laddr, lport, wild));
                }
        }
                                 inp->inp_laddr, lport, wild));
                }
        }

+       socket_lock(so, 0);

        inp->inp_lport = lport;
        inp->inp_lport = lport;

-       if (in_pcbinshash(inp) != 0) {
+       if (in_pcbinshash(inp, 1) != 0) {

                inp->inp_laddr.s_addr = INADDR_ANY;
                inp->inp_lport = 0;
                inp->inp_laddr.s_addr = INADDR_ANY;
                inp->inp_lport = 0;

+               inp->inp_last_outif = 0;
+               lck_rw_done(pcbinfo->mtx);

                return (EAGAIN);
        }
                return (EAGAIN);
        }

+       lck_rw_done(pcbinfo->mtx);
+       sflt_notify(so, sock_evt_bound, NULL);

        return (0);
 }
 
        return (0);
 }
 


@@ -410,16 +623,18 @@ in_pcbbind(inp, nam, p)
  *   slightly different version for T/TCP.  (This is more than
  *   a bit of a kludge, but cleaning up the internal interfaces would
  *   have forced minor changes in every protocol).
  *   slightly different version for T/TCP.  (This is more than
  *   a bit of a kludge, but cleaning up the internal interfaces would
  *   have forced minor changes in every protocol).

+ *
+ * Returns:    0                       Success
+ *             EINVAL                  Invalid argument
+ *             EAFNOSUPPORT            Address family not supported
+ *             EADDRNOTAVAIL           Address not available

  */
  */

-

 int
 int

-in_pcbladdr(inp, nam, plocal_sin)
-       register struct inpcb *inp;
-       struct sockaddr *nam;
-       struct sockaddr_in **plocal_sin;
+in_pcbladdr(struct inpcb *inp, struct sockaddr *nam,
+    struct sockaddr_in *plocal_sin, unsigned int *out_ifscope)

 {
        struct in_ifaddr *ia;
 {
        struct in_ifaddr *ia;

-       register struct sockaddr_in *sin = (struct sockaddr_in *)nam;
+       struct sockaddr_in *sin = (struct sockaddr_in *)nam;

 
        if (nam->sa_len != sizeof (*sin))
                return (EINVAL);
 
        if (nam->sa_len != sizeof (*sin))
                return (EINVAL);


@@ -427,7 +642,10 @@ in_pcbladdr(inp, nam, plocal_sin)
                return (EAFNOSUPPORT);
        if (sin->sin_port == 0)
                return (EADDRNOTAVAIL);
                return (EAFNOSUPPORT);
        if (sin->sin_port == 0)
                return (EADDRNOTAVAIL);

+
+       lck_rw_lock_shared(in_ifaddr_rwlock);

        if (!TAILQ_EMPTY(&in_ifaddrhead)) {
        if (!TAILQ_EMPTY(&in_ifaddrhead)) {

+               ia = TAILQ_FIRST(&in_ifaddrhead);

                /*
                 * If the destination address is INADDR_ANY,
                 * use the primary local address.
                /*
                 * If the destination address is INADDR_ANY,
                 * use the primary local address.


@@ -438,37 +656,78 @@ in_pcbladdr(inp, nam, plocal_sin)
 #define        satosin(sa)     ((struct sockaddr_in *)(sa))
 #define sintosa(sin)   ((struct sockaddr *)(sin))
 #define ifatoia(ifa)   ((struct in_ifaddr *)(ifa))
 #define        satosin(sa)     ((struct sockaddr_in *)(sa))
 #define sintosa(sin)   ((struct sockaddr *)(sin))
 #define ifatoia(ifa)   ((struct in_ifaddr *)(ifa))

+               IFA_LOCK_SPIN(&ia->ia_ifa);

                if (sin->sin_addr.s_addr == INADDR_ANY)
                if (sin->sin_addr.s_addr == INADDR_ANY)

-                   sin->sin_addr = IA_SIN(TAILQ_FIRST(&in_ifaddrhead))->sin_addr;
-               else if (sin->sin_addr.s_addr == (u_long)INADDR_BROADCAST &&
-                 (TAILQ_FIRST(&in_ifaddrhead)->ia_ifp->if_flags & IFF_BROADCAST))
-                   sin->sin_addr = satosin(&TAILQ_FIRST(&in_ifaddrhead)->ia_broadaddr)->sin_addr;
+                       sin->sin_addr = IA_SIN(ia)->sin_addr;
+               else if (sin->sin_addr.s_addr == (u_int32_t)INADDR_BROADCAST &&
+                   (ia->ia_ifp->if_flags & IFF_BROADCAST))
+                       sin->sin_addr = satosin(&ia->ia_broadaddr)->sin_addr;
+               IFA_UNLOCK(&ia->ia_ifa);
+               ia = NULL;

        }
        }

-       if (inp->inp_laddr.s_addr == INADDR_ANY) {
-               register struct route *ro;
+       lck_rw_done(in_ifaddr_rwlock);

 
 

+       if (inp->inp_laddr.s_addr == INADDR_ANY) {
+               struct route *ro;
+               unsigned int ifscope = IFSCOPE_NONE;
+               unsigned int nocell;
+               /*
+                * If the socket is bound to a specifc interface, the
+                 * optional scoped takes precedence over that if it
+                 * is set by the caller.
+                */

                ia = (struct in_ifaddr *)0;
                ia = (struct in_ifaddr *)0;

+
+               if (out_ifscope != NULL && *out_ifscope != IFSCOPE_NONE)
+                       ifscope = *out_ifscope;
+               else if (inp->inp_flags & INP_BOUND_IF)
+                       ifscope = inp->inp_boundif;
+
+               nocell = (inp->inp_flags & INP_NO_IFT_CELLULAR) ? 1 : 0;

                /*
                 * If route is known or can be allocated now,
                 * our src addr is taken from the i/f, else punt.
                /*
                 * If route is known or can be allocated now,
                 * our src addr is taken from the i/f, else punt.

+                * Note that we should check the address family of the cached
+                * destination, in case of sharing the cache with IPv6.

                 */
                ro = &inp->inp_route;
                 */
                ro = &inp->inp_route;

-               if (ro->ro_rt &&
-                   (satosin(&ro->ro_dst)->sin_addr.s_addr !=
-                       sin->sin_addr.s_addr ||
-                   inp->inp_socket->so_options & SO_DONTROUTE)) {
+               if (ro->ro_rt != NULL)
+                       RT_LOCK_SPIN(ro->ro_rt);
+               if (ro->ro_rt && (ro->ro_dst.sa_family != AF_INET ||
+                   satosin(&ro->ro_dst)->sin_addr.s_addr !=
+                   sin->sin_addr.s_addr ||
+                   inp->inp_socket->so_options & SO_DONTROUTE ||
+                   ro->ro_rt->generation_id != route_generation)) {
+                       RT_UNLOCK(ro->ro_rt);

                        rtfree(ro->ro_rt);
                        rtfree(ro->ro_rt);

-                       ro->ro_rt = (struct rtentry *)0;
+                       ro->ro_rt = NULL;

                }
                if ((inp->inp_socket->so_options & SO_DONTROUTE) == 0 && /*XXX*/
                }
                if ((inp->inp_socket->so_options & SO_DONTROUTE) == 0 && /*XXX*/

-                   (ro->ro_rt == (struct rtentry *)0 ||
-                   ro->ro_rt->rt_ifp == (struct ifnet *)0)) {
+                   (ro->ro_rt == NULL || ro->ro_rt->rt_ifp == NULL)) {
+                       if (ro->ro_rt != NULL)
+                               RT_UNLOCK(ro->ro_rt);

                        /* No route yet, so try to acquire one */
                        /* No route yet, so try to acquire one */

+                       bzero(&ro->ro_dst, sizeof(struct sockaddr_in));

                        ro->ro_dst.sa_family = AF_INET;
                        ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
                        ((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
                                sin->sin_addr;
                        ro->ro_dst.sa_family = AF_INET;
                        ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
                        ((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
                                sin->sin_addr;

-                       rtalloc(ro);
+                       rtalloc_scoped(ro, ifscope);
+                       if (ro->ro_rt != NULL)
+                               RT_LOCK_SPIN(ro->ro_rt);
+               }
+               /*
+                * If the route points to a cellular interface and the
+                * caller forbids our using interfaces of such type,
+                * pretend that there is no route.
+                */
+               if (nocell && ro->ro_rt != NULL) {
+                       RT_LOCK_ASSERT_HELD(ro->ro_rt);
+                       if (ro->ro_rt->rt_ifp->if_type == IFT_CELLULAR) {
+                               RT_UNLOCK(ro->ro_rt);
+                               rtfree(ro->ro_rt);
+                               ro->ro_rt = NULL;
+                       }

                }
                /*
                 * If we found a route, use the address
                }
                /*
                 * If we found a route, use the address


@@ -476,18 +735,44 @@ in_pcbladdr(inp, nam, plocal_sin)
                 * unless it is the loopback (in case a route
                 * to our address on another net goes to loopback).
                 */
                 * unless it is the loopback (in case a route
                 * to our address on another net goes to loopback).
                 */

-               if (ro->ro_rt && !(ro->ro_rt->rt_ifp->if_flags & IFF_LOOPBACK))
-                       ia = ifatoia(ro->ro_rt->rt_ifa);
+               if (ro->ro_rt != NULL) {
+                       /* Become a regular mutex */
+                       RT_CONVERT_LOCK(ro->ro_rt);
+                       if (!(ro->ro_rt->rt_ifp->if_flags & IFF_LOOPBACK)) {
+                               ia = ifatoia(ro->ro_rt->rt_ifa);
+                               if (ia) {
+                                       IFA_ADDREF(&ia->ia_ifa);
+                               }
+                       }
+                       RT_UNLOCK(ro->ro_rt);
+               }

                if (ia == 0) {
                        u_short fport = sin->sin_port;
 
                        sin->sin_port = 0;
                        ia = ifatoia(ifa_ifwithdstaddr(sintosa(sin)));
                if (ia == 0) {
                        u_short fport = sin->sin_port;
 
                        sin->sin_port = 0;
                        ia = ifatoia(ifa_ifwithdstaddr(sintosa(sin)));

-                       if (ia == 0)
-                               ia = ifatoia(ifa_ifwithnet(sintosa(sin)));
+                       if (ia == 0) {
+                               ia = ifatoia(ifa_ifwithnet_scoped(sintosa(sin),
+                                   ifscope));
+                       }

                        sin->sin_port = fport;
                        sin->sin_port = fport;

-                       if (ia == 0)
+                       if (ia == 0) {
+                               lck_rw_lock_shared(in_ifaddr_rwlock);

                                ia = TAILQ_FIRST(&in_ifaddrhead);
                                ia = TAILQ_FIRST(&in_ifaddrhead);

+                               if (ia)
+                                       IFA_ADDREF(&ia->ia_ifa);
+                               lck_rw_done(in_ifaddr_rwlock);
+                       }
+                       /*
+                        * If the source address belongs to a cellular interface
+                        * and the socket forbids our using interfaces of such
+                        * type, pretend that there is no source address.
+                        */
+                       if (nocell && ia != NULL &&
+                           ia->ia_ifa.ifa_ifp->if_type == IFT_CELLULAR) {
+                               IFA_REMREF(&ia->ia_ifa);
+                               ia = NULL;
+                       }

                        if (ia == 0)
                                return (EADDRNOTAVAIL);
                }
                        if (ia == 0)
                                return (EADDRNOTAVAIL);
                }


@@ -502,21 +787,37 @@ in_pcbladdr(inp, nam, plocal_sin)
                        struct ifnet *ifp;
 
                        imo = inp->inp_moptions;
                        struct ifnet *ifp;
 
                        imo = inp->inp_moptions;

-                       if (imo->imo_multicast_ifp != NULL) {
+                       IMO_LOCK(imo);
+                       if (imo->imo_multicast_ifp != NULL && (ia == NULL ||
+                               ia->ia_ifp != imo->imo_multicast_ifp)) {

                                ifp = imo->imo_multicast_ifp;
                                ifp = imo->imo_multicast_ifp;

-                               TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link)
+                               if (ia)
+                                       IFA_REMREF(&ia->ia_ifa);
+                               lck_rw_lock_shared(in_ifaddr_rwlock);
+                               TAILQ_FOREACH(ia, &in_ifaddrhead, ia_link) {

                                        if (ia->ia_ifp == ifp)
                                                break;
                                        if (ia->ia_ifp == ifp)
                                                break;

-                               if (ia == 0)
+                               }
+                               if (ia)
+                                       IFA_ADDREF(&ia->ia_ifa);
+                               lck_rw_done(in_ifaddr_rwlock);
+                               if (ia == 0) {
+                                       IMO_UNLOCK(imo);

                                        return (EADDRNOTAVAIL);
                                        return (EADDRNOTAVAIL);

+                               }

                        }
                        }

+                       IMO_UNLOCK(imo);

                }
                }

-       /*
-        * Don't do pcblookup call here; return interface in plocal_sin
-        * and exit to caller, that will do the lookup.
-        */
-               *plocal_sin = &ia->ia_addr;
-
+               /*
+                * Don't do pcblookup call here; return interface in plocal_sin
+                * and exit to caller, that will do the lookup.
+                */
+               IFA_LOCK_SPIN(&ia->ia_ifa);
+               *plocal_sin = ia->ia_addr;
+               if (out_ifscope != NULL)
+                       *out_ifscope = ia->ia_ifp->if_index;
+               IFA_UNLOCK(&ia->ia_ifa);
+               IFA_REMREF(&ia->ia_ifa);

        }
        return(0);
 }
        }
        return(0);
 }


@@ -529,25 +830,35 @@ in_pcbladdr(inp, nam, plocal_sin)
  * then pick one.
  */
 int
  * then pick one.
  */
 int

-in_pcbconnect(inp, nam, p)
-       register struct inpcb *inp;
-       struct sockaddr *nam;
-       struct proc *p;
+in_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct proc *p, unsigned int *ifscope)

 {
 {

-       struct sockaddr_in *ifaddr;
+       struct sockaddr_in ifaddr;

        struct sockaddr_in *sin = (struct sockaddr_in *)nam;
        struct sockaddr_in *sin = (struct sockaddr_in *)nam;

-       struct sockaddr_in sa;
+       struct inpcb *pcb;

        int error;
 
        /*
         *   Call inner routine, to assign local interface address.
         */
        int error;
 
        /*
         *   Call inner routine, to assign local interface address.
         */

-       if ((error = in_pcbladdr(inp, nam, &ifaddr)) != 0)
+       if ((error = in_pcbladdr(inp, nam, &ifaddr, ifscope)) != 0)

                return(error);
 
                return(error);
 

-       if (in_pcblookup_hash(inp->inp_pcbinfo, sin->sin_addr, sin->sin_port,
-           inp->inp_laddr.s_addr ? inp->inp_laddr : ifaddr->sin_addr,
-           inp->inp_lport, 0, NULL) != NULL) {
+       socket_unlock(inp->inp_socket, 0);
+       pcb = in_pcblookup_hash(inp->inp_pcbinfo, sin->sin_addr, sin->sin_port,
+           inp->inp_laddr.s_addr ? inp->inp_laddr : ifaddr.sin_addr,
+           inp->inp_lport, 0, NULL);
+       socket_lock(inp->inp_socket, 0);
+
+       /* Check if the socket is still in a valid state. When we unlock this 
+        * embryonic socket, it can get aborted if another thread is closing 
+        * the listener (radar 7947600).
+        */
+       if ((inp->inp_socket->so_flags & SOF_ABORTED) != 0) {
+               return ECONNREFUSED;
+       }
+
+       if (pcb != NULL) {
+               in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0);

                return (EADDRINUSE);
        }
        if (inp->inp_laddr.s_addr == INADDR_ANY) {
                return (EADDRINUSE);
        }
        if (inp->inp_laddr.s_addr == INADDR_ANY) {


@@ -556,75 +867,163 @@ in_pcbconnect(inp, nam, p)
                        if (error)
                            return (error);
                }
                        if (error)
                            return (error);
                }

-               inp->inp_laddr = ifaddr->sin_addr;
+               if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
+                       /*lock inversion issue, mostly with udp multicast packets */
+                       socket_unlock(inp->inp_socket, 0);
+                       lck_rw_lock_exclusive(inp->inp_pcbinfo->mtx);
+                       socket_lock(inp->inp_socket, 0);
+               }
+               inp->inp_laddr = ifaddr.sin_addr;
+               inp->inp_last_outif = ifscope ? *ifscope : IFSCOPE_NONE;
+               inp->inp_flags |= INP_INADDR_ANY;
+       }
+        else {
+               if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
+                       /*lock inversion issue, mostly with udp multicast packets */
+                       socket_unlock(inp->inp_socket, 0);
+                       lck_rw_lock_exclusive(inp->inp_pcbinfo->mtx);
+                       socket_lock(inp->inp_socket, 0);
+               }

        }
        inp->inp_faddr = sin->sin_addr;
        inp->inp_fport = sin->sin_port;
        in_pcbrehash(inp);
        }
        inp->inp_faddr = sin->sin_addr;
        inp->inp_fport = sin->sin_port;
        in_pcbrehash(inp);

+       lck_rw_done(inp->inp_pcbinfo->mtx);

        return (0);
 }
 
 void
        return (0);
 }
 
 void

-in_pcbdisconnect(inp)
-       struct inpcb *inp;
+in_pcbdisconnect(struct inpcb *inp)

 {
 
        inp->inp_faddr.s_addr = INADDR_ANY;
        inp->inp_fport = 0;
 {
 
        inp->inp_faddr.s_addr = INADDR_ANY;
        inp->inp_fport = 0;

+
+       if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
+               /*lock inversion issue, mostly with udp multicast packets */
+               socket_unlock(inp->inp_socket, 0);
+               lck_rw_lock_exclusive(inp->inp_pcbinfo->mtx);
+               socket_lock(inp->inp_socket, 0);
+       }
+

        in_pcbrehash(inp);
        in_pcbrehash(inp);

-       if (inp->inp_socket->so_state & SS_NOFDREF)
+       lck_rw_done(inp->inp_pcbinfo->mtx);
+
+       if (inp->inp_socket->so_state & SS_NOFDREF) 

                in_pcbdetach(inp);
 }
 
 void
                in_pcbdetach(inp);
 }
 
 void

-in_pcbdetach(inp)
-       struct inpcb *inp;
+in_pcbdetach(struct inpcb *inp)

 {
        struct socket *so = inp->inp_socket;
 {
        struct socket *so = inp->inp_socket;

-       struct inpcbinfo *ipi = inp->inp_pcbinfo;
-       struct rtentry *rt  = inp->inp_route.ro_rt;
+
+       if (so->so_pcb == 0) { /* we've been called twice */
+               panic("in_pcbdetach: inp=%p so=%p proto=%d so_pcb is null!\n",
+                       inp, so, so->so_proto->pr_protocol);
+       }

 
 #if IPSEC
 
 #if IPSEC

-       ipsec4_delete_pcbpolicy(inp);
+       if (ipsec_bypass == 0) {
+               ipsec4_delete_pcbpolicy(inp);
+       }

 #endif /*IPSEC*/
 #endif /*IPSEC*/

-       inp->inp_gencnt = ++ipi->ipi_gencnt;
-       in_pcbremlists(inp);
+
+       /* mark socket state as dead */
+       if (in_pcb_checkstate(inp, WNT_STOPUSING, 1) != WNT_STOPUSING)
+               panic("in_pcbdetach so=%p prot=%x couldn't set to STOPUSING\n", so, so->so_proto->pr_protocol);

 
 #if TEMPDEBUG
        if (so->cached_in_sock_layer)
 
 #if TEMPDEBUG
        if (so->cached_in_sock_layer)

-           printf("PCB_DETACH for cached socket %x\n", so);
+           printf("in_pcbdetach for cached socket %x flags=%x\n", so, so->so_flags);

        else
        else

-           printf("PCB_DETACH for allocated socket %x\n", so);
+           printf("in_pcbdetach for allocated socket %x flags=%x\n", so, so->so_flags);
+#endif
+       if ((so->so_flags & SOF_PCBCLEARING) == 0) {
+               struct rtentry *rt;
+               struct ip_moptions *imo;
+
+               inp->inp_vflag = 0;
+               if (inp->inp_options) 
+                       (void)m_free(inp->inp_options);
+               if ((rt = inp->inp_route.ro_rt) != NULL) {
+                       inp->inp_route.ro_rt = NULL;
+                       rtfree(rt);
+               }
+               imo = inp->inp_moptions;
+               inp->inp_moptions = NULL;
+               if (imo != NULL)
+                       IMO_REMREF(imo);
+               sofreelastref(so, 0);
+               inp->inp_state = INPCB_STATE_DEAD;
+               so->so_flags |= SOF_PCBCLEARING; /* makes sure we're not called twice from so_close */
+       }
+}
+
+
+void 
+in_pcbdispose(struct inpcb *inp) 
+{
+       struct socket *so = inp->inp_socket;
+       struct inpcbinfo *ipi = inp->inp_pcbinfo;
+
+#if TEMPDEBUG
+       if (inp->inp_state != INPCB_STATE_DEAD) {
+               printf("in_pcbdispose: not dead yet? so=%p\n", so);
+       }

 #endif
 #endif

+       if (so && so->so_usecount != 0)
+               panic("%s: so %p so_usecount %d so_lockhistory %s\n",
+                       __func__, so, so->so_usecount,
+                       (so != NULL) ? solockhistory_nr(so) : "--");

 
 

-       so->so_pcb = 0;
+       lck_rw_assert(ipi->mtx, LCK_RW_ASSERT_EXCLUSIVE);

 
 

-       if (inp->inp_options)
-               (void)m_free(inp->inp_options);
-       if (rt) {
-               /* 
-                * route deletion requires reference count to be <= zero 
+       inp->inp_gencnt = ++ipi->ipi_gencnt;
+       /*### access ipi in in_pcbremlists */
+       in_pcbremlists(inp);
+       
+       if (so) {
+               if (so->so_proto->pr_flags & PR_PCBLOCK) {
+                       sofreelastref(so, 0);
+                       if (so->so_rcv.sb_cc || so->so_snd.sb_cc) {
+#if TEMPDEBUG
+                               printf("in_pcbdispose sb not cleaned up so=%p rc_cci=%x snd_cc=%x\n",
+                                       so, so->so_rcv.sb_cc, so->so_snd.sb_cc);        
+#endif
+                               sbrelease(&so->so_rcv);
+                               sbrelease(&so->so_snd);
+                       }
+                       if (so->so_head != NULL)
+                               panic("in_pcbdispose, so=%p head still exist\n", so);
+                       lck_mtx_unlock(&inp->inpcb_mtx);        
+                       lck_mtx_destroy(&inp->inpcb_mtx, ipi->mtx_grp); 
+               }
+               so->so_flags |= SOF_PCBCLEARING; /* makes sure we're not called twice from so_close */
+               so->so_saved_pcb = (caddr_t) inp;
+               so->so_pcb = 0; 
+               inp->inp_socket = 0;
+#if CONFIG_MACF_NET
+               mac_inpcb_label_destroy(inp);
+#endif
+               /*
+                * In case there a route cached after a detach (possible
+                * in the tcp case), make sure that it is freed before
+                * we deallocate the structure.

                 */
                 */

-               if ((rt->rt_flags & RTF_DELCLONE) &&
-                   (rt->rt_flags & RTF_WASCLONED) &&
-                   (rt->rt_refcnt <= 1)) {
-                       rtunref(rt);
-                       rt->rt_flags &= ~RTF_UP;
-                       rtrequest(RTM_DELETE, rt_key(rt),
-                                 rt->rt_gateway, rt_mask(rt),
-                                 rt->rt_flags, (struct rtentry **)0);
+               if (inp->inp_route.ro_rt != NULL) {
+                       rtfree(inp->inp_route.ro_rt);
+                       inp->inp_route.ro_rt = NULL;

                }
                }

-               else
-                       rtfree(rt);
+               if (so->cached_in_sock_layer == 0) {
+                       zfree(ipi->ipi_zone, inp);
+               }
+               sodealloc(so);

        }
        }

-       ip_freemoptions(inp->inp_moptions);
-       inp->inp_vflag = 0;
-       if (so->cached_in_sock_layer)
-            so->so_saved_pcb = (caddr_t) inp;
+#if TEMPDEBUG

        else
        else

-            zfree(ipi->ipi_zone, (vm_offset_t) inp);
-
-       sofree(so);
+               printf("in_pcbdispose: no socket for inp=%p\n", inp);
+#endif

 }
 
 /*
 }
 
 /*


@@ -636,15 +1035,16 @@ in_pcbdetach(inp)
  * except through a kernel programming error, so it is acceptable to panic
  * (or in this case trap) if the PCB is invalid.  (Actually, we don't trap
  * because there actually /is/ a programming error somewhere... XXX)
  * except through a kernel programming error, so it is acceptable to panic
  * (or in this case trap) if the PCB is invalid.  (Actually, we don't trap
  * because there actually /is/ a programming error somewhere... XXX)

+ *
+ * Returns:    0                       Success
+ *             ENOBUFS                 No buffer space available
+ *             ECONNRESET              Connection reset

  */
 int
  */
 int

-in_setsockaddr(so, nam)
-       struct socket *so;
-       struct sockaddr **nam;
+in_setsockaddr(struct socket *so, struct sockaddr **nam)

 {
 {

-       int s;
-       register struct inpcb *inp;
-       register struct sockaddr_in *sin;
+       struct inpcb *inp;
+       struct sockaddr_in *sin;

 
        /*
         * Do the malloc first in case it blocks.
 
        /*
         * Do the malloc first in case it blocks.


@@ -656,29 +1056,23 @@ in_setsockaddr(so, nam)
        sin->sin_family = AF_INET;
        sin->sin_len = sizeof(*sin);
 
        sin->sin_family = AF_INET;
        sin->sin_len = sizeof(*sin);
 

-       s = splnet();

        inp = sotoinpcb(so);
        if (!inp) {
        inp = sotoinpcb(so);
        if (!inp) {

-               splx(s);

                FREE(sin, M_SONAME);
                return ECONNRESET;
        }
        sin->sin_port = inp->inp_lport;
        sin->sin_addr = inp->inp_laddr;
                FREE(sin, M_SONAME);
                return ECONNRESET;
        }
        sin->sin_port = inp->inp_lport;
        sin->sin_addr = inp->inp_laddr;

-       splx(s);

 
        *nam = (struct sockaddr *)sin;
        return 0;
 }
 
 int
 
        *nam = (struct sockaddr *)sin;
        return 0;
 }
 
 int

-in_setpeeraddr(so, nam)
-       struct socket *so;
-       struct sockaddr **nam;
+in_setpeeraddr(struct socket *so, struct sockaddr **nam)

 {
 {

-       int s;

        struct inpcb *inp;
        struct inpcb *inp;

-       register struct sockaddr_in *sin;
+       struct sockaddr_in *sin;

 
        /*
         * Do the malloc first in case it blocks.
 
        /*
         * Do the malloc first in case it blocks.


@@ -690,33 +1084,27 @@ in_setpeeraddr(so, nam)
        sin->sin_family = AF_INET;
        sin->sin_len = sizeof(*sin);
 
        sin->sin_family = AF_INET;
        sin->sin_len = sizeof(*sin);
 

-       s = splnet();

        inp = sotoinpcb(so);
        if (!inp) {
        inp = sotoinpcb(so);
        if (!inp) {

-               splx(s);

                FREE(sin, M_SONAME);
                return ECONNRESET;
        }
        sin->sin_port = inp->inp_fport;
        sin->sin_addr = inp->inp_faddr;
                FREE(sin, M_SONAME);
                return ECONNRESET;
        }
        sin->sin_port = inp->inp_fport;
        sin->sin_addr = inp->inp_faddr;

-       splx(s);

 
        *nam = (struct sockaddr *)sin;
        return 0;
 }
 
 void
 
        *nam = (struct sockaddr *)sin;
        return 0;
 }
 
 void

-in_pcbnotifyall(head, faddr, errno, notify)
-       struct inpcbhead *head;
-       struct in_addr faddr;
-       void (*notify) __P((struct inpcb *, int));
+in_pcbnotifyall(struct inpcbinfo *pcbinfo, struct in_addr faddr,
+               int errno, void (*notify)(struct inpcb *, int))

 {
 {

-       struct inpcb *inp, *ninp;
-       int s;
+       struct inpcb *inp;

 
 

-       s = splnet();
-       for (inp = LIST_FIRST(head); inp != NULL; inp = ninp) {
-               ninp = LIST_NEXT(inp, inp_list);
+       lck_rw_lock_shared(pcbinfo->mtx);
+
+       LIST_FOREACH(inp, pcbinfo->listhead, inp_list) {

 #if INET6
                if ((inp->inp_vflag & INP_IPV4) == 0)
                        continue;
 #if INET6
                if ((inp->inp_vflag & INP_IPV4) == 0)
                        continue;


@@ -724,47 +1112,14 @@ in_pcbnotifyall(head, faddr, errno, notify)
                if (inp->inp_faddr.s_addr != faddr.s_addr ||
                    inp->inp_socket == NULL)
                                continue;
                if (inp->inp_faddr.s_addr != faddr.s_addr ||
                    inp->inp_socket == NULL)
                                continue;

+               if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) 
+                       continue;
+               socket_lock(inp->inp_socket, 1);

                (*notify)(inp, errno);
                (*notify)(inp, errno);

+               (void)in_pcb_checkstate(inp, WNT_RELEASE, 1);
+               socket_unlock(inp->inp_socket, 1);

        }
        }

-       splx(s);
-}
-
-void
-in_pcbpurgeif0(head, ifp)
-       struct inpcb *head;
-       struct ifnet *ifp;
-{
-       struct inpcb *inp;
-       struct ip_moptions *imo;
-       int i, gap;
-
-       for (inp = head; inp != NULL; inp = LIST_NEXT(inp, inp_list)) {
-               imo = inp->inp_moptions;
-               if ((inp->inp_vflag & INP_IPV4) &&
-                   imo != NULL) {
-                       /*
-                        * Unselect the outgoing interface if it is being
-                        * detached.
-                        */
-                       if (imo->imo_multicast_ifp == ifp)
-                               imo->imo_multicast_ifp = NULL;
-
-                       /*
-                        * Drop multicast group membership if we joined
-                        * through the interface being detached.
-                        */
-                       for (i = 0, gap = 0; i < imo->imo_num_memberships;
-                           i++) {
-                               if (imo->imo_membership[i]->inm_ifp == ifp) {
-                                       in_delmulti(imo->imo_membership[i]);
-                                       gap++;
-                               } else if (gap != 0)
-                                       imo->imo_membership[i - gap] =
-                                           imo->imo_membership[i];
-                       }
-                       imo->imo_num_memberships -= gap;
-               }
-       }
+       lck_rw_done(pcbinfo->mtx);

 }
 
 /*
 }
 
 /*


@@ -774,25 +1129,41 @@ in_pcbpurgeif0(head, ifp)
  * (by a redirect), time to try a default gateway again.
  */
 void
  * (by a redirect), time to try a default gateway again.
  */
 void

-in_losing(inp)
-       struct inpcb *inp;
+in_losing(struct inpcb *inp)

 {
 {

-       register struct rtentry *rt;
+       struct rtentry *rt;

        struct rt_addrinfo info;
 
        struct rt_addrinfo info;
 

-       if ((rt = inp->inp_route.ro_rt)) {
+       if ((rt = inp->inp_route.ro_rt) != NULL) {
+               struct in_ifaddr *ia;
+

                bzero((caddr_t)&info, sizeof(info));
                bzero((caddr_t)&info, sizeof(info));

+               RT_LOCK(rt);

                info.rti_info[RTAX_DST] =
                        (struct sockaddr *)&inp->inp_route.ro_dst;
                info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
                info.rti_info[RTAX_NETMASK] = rt_mask(rt);
                rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0);
                info.rti_info[RTAX_DST] =
                        (struct sockaddr *)&inp->inp_route.ro_dst;
                info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
                info.rti_info[RTAX_NETMASK] = rt_mask(rt);
                rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0);

-               if (rt->rt_flags & RTF_DYNAMIC)
+               if (rt->rt_flags & RTF_DYNAMIC) {
+                       /*
+                        * Prevent another thread from modifying rt_key,
+                        * rt_gateway via rt_setgate() after rt_lock is
+                        * dropped by marking the route as defunct.
+                        */
+                       rt->rt_flags |= RTF_CONDEMNED;
+                       RT_UNLOCK(rt);

                        (void) rtrequest(RTM_DELETE, rt_key(rt),
                                rt->rt_gateway, rt_mask(rt), rt->rt_flags,
                                (struct rtentry **)0);
                        (void) rtrequest(RTM_DELETE, rt_key(rt),
                                rt->rt_gateway, rt_mask(rt), rt->rt_flags,
                                (struct rtentry **)0);

-               inp->inp_route.ro_rt = 0;
-               rtfree(rt);
+               } else {
+                       RT_UNLOCK(rt);
+               }
+               /* if the address is gone keep the old route in the pcb */
+               if ((ia = ifa_foraddr(inp->inp_laddr.s_addr)) != NULL) {
+                       inp->inp_route.ro_rt = NULL;
+                       rtfree(rt);
+                       IFA_REMREF(&ia->ia_ifa);
+               }

                /*
                 * A new route can be allocated
                 * the next time output is attempted.
                /*
                 * A new route can be allocated
                 * the next time output is attempted.


@@ -805,13 +1176,19 @@ in_losing(inp)
  * and allocate a (hopefully) better one.
  */
 void
  * and allocate a (hopefully) better one.
  */
 void

-in_rtchange(inp, errno)
-       register struct inpcb *inp;
-       int errno;
+in_rtchange(struct inpcb *inp, __unused int errno)

 {
 {

-       if (inp->inp_route.ro_rt) {
-               rtfree(inp->inp_route.ro_rt);
-               inp->inp_route.ro_rt = 0;
+       struct rtentry *rt;
+
+       if ((rt = inp->inp_route.ro_rt) != NULL) {
+               struct in_ifaddr *ia;
+
+               if ((ia = ifa_foraddr(inp->inp_laddr.s_addr)) == NULL) {
+                       return; /* we can't remove the route now. not sure if still ok to use src */
+               }
+               IFA_REMREF(&ia->ia_ifa);
+               rtfree(rt);
+               inp->inp_route.ro_rt = NULL;

                /*
                 * A new route can be allocated the next time
                 * output is attempted.
                /*
                 * A new route can be allocated the next time
                 * output is attempted.


@@ -823,13 +1200,10 @@ in_rtchange(inp, errno)
  * Lookup a PCB based on the local address and port.
  */
 struct inpcb *
  * Lookup a PCB based on the local address and port.
  */
 struct inpcb *

-in_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay)
-       struct inpcbinfo *pcbinfo;
-       struct in_addr laddr;
-       u_int lport_arg;
-       int wild_okay;
+in_pcblookup_local(struct inpcbinfo *pcbinfo, struct in_addr laddr,
+                  unsigned int lport_arg, int wild_okay)

 {
 {

-       register struct inpcb *inp;
+       struct inpcb *inp;

        int matchwild = 3, wildcard;
        u_short lport = lport_arg;
 
        int matchwild = 3, wildcard;
        u_short lport = lport_arg;
 


@@ -914,38 +1288,152 @@ in_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay)
 }
 
 /*
 }
 
 /*

- * Lookup PCB in hash list.
+ * Check if PCB exists in hash list.

  */
  */

-struct inpcb *
-in_pcblookup_hash(pcbinfo, faddr, fport_arg, laddr, lport_arg, wildcard,
-                 ifp)
-       struct inpcbinfo *pcbinfo;
-       struct in_addr faddr, laddr;
-       u_int fport_arg, lport_arg;
-       int wildcard;
-       struct ifnet *ifp;
+int
+in_pcblookup_hash_exists(
+       struct inpcbinfo *pcbinfo,
+       struct in_addr faddr,
+       u_int fport_arg,
+       struct in_addr laddr,
+       u_int lport_arg,
+       int wildcard,
+       uid_t *uid,
+       gid_t *gid,
+       __unused struct ifnet *ifp)

 {
        struct inpcbhead *head;
 {
        struct inpcbhead *head;

-       register struct inpcb *inp;
+       struct inpcb *inp;

        u_short fport = fport_arg, lport = lport_arg;
        u_short fport = fport_arg, lport = lport_arg;

+       int found;

 
 

+       *uid = UID_MAX;
+       *gid = GID_MAX;
+       

        /*
         * We may have found the pcb in the last lookup - check this first.
         */
 
        /*
         * We may have found the pcb in the last lookup - check this first.
         */
 

-       if ((!IN_MULTICAST(laddr.s_addr)) && (pcbinfo->last_pcb)) {
-           if (faddr.s_addr == pcbinfo->last_pcb->inp_faddr.s_addr &&
-               laddr.s_addr == pcbinfo->last_pcb->inp_laddr.s_addr &&
-               fport_arg    == pcbinfo->last_pcb->inp_fport &&
-               lport_arg    == pcbinfo->last_pcb->inp_lport) {
-               /*
-                * Found.
-                */
-               return (pcbinfo->last_pcb);
-           }
+       lck_rw_lock_shared(pcbinfo->mtx);

 
 

-           pcbinfo->last_pcb = 0;
+       /*
+        * First look for an exact match.
+        */
+       head = &pcbinfo->hashbase[INP_PCBHASH(faddr.s_addr, lport, fport,
+           pcbinfo->hashmask)];
+       LIST_FOREACH(inp, head, inp_hash) {
+#if INET6
+               if ((inp->inp_vflag & INP_IPV4) == 0)
+                       continue;
+#endif
+               if (inp->inp_faddr.s_addr == faddr.s_addr &&
+                   inp->inp_laddr.s_addr == laddr.s_addr &&
+                   inp->inp_fport == fport &&
+                   inp->inp_lport == lport) {
+                       if ((found = (inp->inp_socket != NULL))) {
+                               /*
+                                * Found.
+                                */
+                               *uid = inp->inp_socket->so_uid;
+                               *gid = inp->inp_socket->so_gid;
+                       }
+                       lck_rw_done(pcbinfo->mtx);
+                       return (found);
+               }

        }
        }

+       if (wildcard) {
+               struct inpcb *local_wild = NULL;
+#if INET6
+               struct inpcb *local_wild_mapped = NULL;
+#endif
+
+               head = &pcbinfo->hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
+                   pcbinfo->hashmask)];
+               LIST_FOREACH(inp, head, inp_hash) {
+#if INET6
+                       if ((inp->inp_vflag & INP_IPV4) == 0)
+                               continue;
+#endif
+                       if (inp->inp_faddr.s_addr == INADDR_ANY &&
+                           inp->inp_lport == lport) {
+#if defined(NFAITH) && NFAITH > 0
+                               if (ifp && ifp->if_type == IFT_FAITH &&
+                                   (inp->inp_flags & INP_FAITH) == 0)
+                                       continue;
+#endif
+                               if (inp->inp_laddr.s_addr == laddr.s_addr) {
+                                       if ((found = (inp->inp_socket != NULL))) {
+                                               *uid = inp->inp_socket->so_uid;
+                                               *gid = inp->inp_socket->so_gid;
+                                       }
+                                       lck_rw_done(pcbinfo->mtx);
+                                       return (found);
+                               }
+                               else if (inp->inp_laddr.s_addr == INADDR_ANY) {
+#if INET6
+                                       if (inp->inp_socket &&
+                                           INP_CHECK_SOCKAF(inp->inp_socket,
+                                           AF_INET6))
+                                               local_wild_mapped = inp;
+                                       else
+#endif /* INET6 */
+                                       local_wild = inp;
+                               }
+                       }
+               }
+               if (local_wild == NULL) {
+#if INET6
+                       if (local_wild_mapped != NULL) {
+                               if ((found = (local_wild_mapped->inp_socket != NULL))) {
+                                       *uid = local_wild_mapped->inp_socket->so_uid;
+                                       *gid = local_wild_mapped->inp_socket->so_gid;
+                               }
+                               lck_rw_done(pcbinfo->mtx);
+                               return (found);
+                       }
+#endif /* INET6 */
+                       lck_rw_done(pcbinfo->mtx);
+                       return (0);
+               }
+               if (local_wild != NULL) {
+                       if ((found = (local_wild->inp_socket != NULL))) {
+                               *uid = local_wild->inp_socket->so_uid;
+                               *gid = local_wild->inp_socket->so_gid;
+                       }
+                       lck_rw_done(pcbinfo->mtx);
+                       return (found);
+               }
+       }
+
+       /*
+        * Not found.
+        */
+       lck_rw_done(pcbinfo->mtx);
+       return (0);
+}
+
+/*
+ * Lookup PCB in hash list.
+ */
+struct inpcb *
+in_pcblookup_hash(
+       struct inpcbinfo *pcbinfo,
+       struct in_addr faddr,
+       u_int fport_arg,
+       struct in_addr laddr,
+       u_int lport_arg,
+       int wildcard,
+       __unused struct ifnet *ifp)
+{
+       struct inpcbhead *head;
+       struct inpcb *inp;
+       u_short fport = fport_arg, lport = lport_arg;
+
+       /*
+        * We may have found the pcb in the last lookup - check this first.
+        */
+
+       lck_rw_lock_shared(pcbinfo->mtx);

 
        /*
         * First look for an exact match.
 
        /*
         * First look for an exact match.


@@ -963,7 +1451,14 @@ in_pcblookup_hash(pcbinfo, faddr, fport_arg, laddr, lport_arg, wildcard,
                        /*
                         * Found.
                         */
                        /*
                         * Found.
                         */

-                       return (inp);
+                       if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) != WNT_STOPUSING) {
+                               lck_rw_done(pcbinfo->mtx);
+                               return (inp);
+                       }
+                       else {  /* it's there but dead, say it isn't found */
+                               lck_rw_done(pcbinfo->mtx);      
+                               return(NULL);
+                       }

                }
        }
        if (wildcard) {
                }
        }
        if (wildcard) {


@@ -985,29 +1480,57 @@ in_pcblookup_hash(pcbinfo, faddr, fport_arg, laddr, lport_arg, wildcard,
                                    (inp->inp_flags & INP_FAITH) == 0)
                                        continue;
 #endif
                                    (inp->inp_flags & INP_FAITH) == 0)
                                        continue;
 #endif

-                               if (inp->inp_laddr.s_addr == laddr.s_addr)
-                                       return (inp);
+                               if (inp->inp_laddr.s_addr == laddr.s_addr) {
+                                       if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) != WNT_STOPUSING) {
+                                               lck_rw_done(pcbinfo->mtx);
+                                               return (inp);
+                                       }
+                                       else {  /* it's there but dead, say it isn't found */
+                                               lck_rw_done(pcbinfo->mtx);      
+                                               return(NULL);
+                                       }
+                               }

                                else if (inp->inp_laddr.s_addr == INADDR_ANY) {
                                else if (inp->inp_laddr.s_addr == INADDR_ANY) {

-#if defined(INET6)
+#if INET6

                                        if (INP_CHECK_SOCKAF(inp->inp_socket,
                                                             AF_INET6))
                                                local_wild_mapped = inp;
                                        else
                                        if (INP_CHECK_SOCKAF(inp->inp_socket,
                                                             AF_INET6))
                                                local_wild_mapped = inp;
                                        else

-#endif /* defined(INET6) */
+#endif /* INET6 */

                                        local_wild = inp;
                                }
                        }
                }
                                        local_wild = inp;
                                }
                        }
                }

-#if defined(INET6)
-               if (local_wild == NULL)
-                       return (local_wild_mapped);
-#endif /* defined(INET6) */
-               return (local_wild);
+               if (local_wild == NULL) {
+#if INET6
+                       if (local_wild_mapped != NULL) {
+                               if (in_pcb_checkstate(local_wild_mapped, WNT_ACQUIRE, 0) != WNT_STOPUSING) {
+                                       lck_rw_done(pcbinfo->mtx);
+                                       return (local_wild_mapped);
+                               }
+                               else {  /* it's there but dead, say it isn't found */
+                                       lck_rw_done(pcbinfo->mtx);      
+                                       return(NULL);
+                               }
+                       }
+#endif /* INET6 */
+                       lck_rw_done(pcbinfo->mtx);
+                       return (NULL);
+               }
+               if (in_pcb_checkstate(local_wild, WNT_ACQUIRE, 0) != WNT_STOPUSING) {
+                       lck_rw_done(pcbinfo->mtx);
+                       return (local_wild);
+               }
+               else {  /* it's there but dead, say it isn't found */
+                       lck_rw_done(pcbinfo->mtx);      
+                       return(NULL);
+               }

        }
 
        /*
         * Not found.
         */
        }
 
        /*
         * Not found.
         */

+       lck_rw_done(pcbinfo->mtx);

        return (NULL);
 }
 
        return (NULL);
 }
 


@@ -1015,8 +1538,7 @@ in_pcblookup_hash(pcbinfo, faddr, fport_arg, laddr, lport_arg, wildcard,
  * Insert PCB onto various hash lists.
  */
 int
  * Insert PCB onto various hash lists.
  */
 int

-in_pcbinshash(inp)
-       struct inpcb *inp;
+in_pcbinshash(struct inpcb *inp, int locked)

 {
        struct inpcbhead *pcbhash;
        struct inpcbporthead *pcbporthash;
 {
        struct inpcbhead *pcbhash;
        struct inpcbporthead *pcbporthash;


@@ -1024,6 +1546,20 @@ in_pcbinshash(inp)
        struct inpcbport *phd;
        u_int32_t hashkey_faddr;
 
        struct inpcbport *phd;
        u_int32_t hashkey_faddr;
 

+        if (!locked) {
+                if (!lck_rw_try_lock_exclusive(pcbinfo->mtx)) {
+                       /*lock inversion issue, mostly with udp multicast packets */
+                        socket_unlock(inp->inp_socket, 0);
+                        lck_rw_lock_exclusive(pcbinfo->mtx);
+                        socket_lock(inp->inp_socket, 0);
+                       if (inp->inp_state == INPCB_STATE_DEAD) {
+                               /* The socket got dropped when it was unlocked */
+                               lck_rw_done(pcbinfo->mtx);
+                               return(ECONNABORTED);
+                       }
+                }
+        }
+

 #if INET6
        if (inp->inp_vflag & INP_IPV6)
                hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */;
 #if INET6
        if (inp->inp_vflag & INP_IPV6)
                hashkey_faddr = inp->in6p_faddr.s6_addr32[3] /* XXX */;


@@ -1031,8 +1567,9 @@ in_pcbinshash(inp)
 #endif /* INET6 */
        hashkey_faddr = inp->inp_faddr.s_addr;
 
 #endif /* INET6 */
        hashkey_faddr = inp->inp_faddr.s_addr;
 

-       pcbhash = &pcbinfo->hashbase[INP_PCBHASH(hashkey_faddr,
-                inp->inp_lport, inp->inp_fport, pcbinfo->hashmask)];
+       inp->hash_element = INP_PCBHASH(hashkey_faddr, inp->inp_lport, inp->inp_fport, pcbinfo->hashmask);
+
+       pcbhash = &pcbinfo->hashbase[inp->hash_element];

 
        pcbporthash = &pcbinfo->porthashbase[INP_PCBPORTHASH(inp->inp_lport,
            pcbinfo->porthashmask)];
 
        pcbporthash = &pcbinfo->porthashbase[INP_PCBPORTHASH(inp->inp_lport,
            pcbinfo->porthashmask)];


@@ -1050,6 +1587,8 @@ in_pcbinshash(inp)
        if (phd == NULL) {
                MALLOC(phd, struct inpcbport *, sizeof(struct inpcbport), M_PCB, M_WAITOK);
                if (phd == NULL) {
        if (phd == NULL) {
                MALLOC(phd, struct inpcbport *, sizeof(struct inpcbport), M_PCB, M_WAITOK);
                if (phd == NULL) {

+                       if (!locked)
+                               lck_rw_done(pcbinfo->mtx);

                        return (ENOBUFS); /* XXX */
                }
                phd->phd_port = inp->inp_lport;
                        return (ENOBUFS); /* XXX */
                }
                phd->phd_port = inp->inp_lport;


@@ -1059,10 +1598,8 @@ in_pcbinshash(inp)
        inp->inp_phd = phd;
        LIST_INSERT_HEAD(&phd->phd_pcblist, inp, inp_portlist);
        LIST_INSERT_HEAD(pcbhash, inp, inp_hash);
        inp->inp_phd = phd;
        LIST_INSERT_HEAD(&phd->phd_pcblist, inp, inp_portlist);
        LIST_INSERT_HEAD(pcbhash, inp, inp_hash);

-#ifdef __APPLE__
-       inp->hash_element = INP_PCBHASH(inp->inp_faddr.s_addr, inp->inp_lport, 
-                                       inp->inp_fport, pcbinfo->hashmask);
-#endif
+       if (!locked)
+               lck_rw_done(pcbinfo->mtx);

        return (0);
 }
 
        return (0);
 }
 


@@ -1073,8 +1610,7 @@ in_pcbinshash(inp)
  * not change after in_pcbinshash() has been called.
  */
 void
  * not change after in_pcbinshash() has been called.
  */
 void

-in_pcbrehash(inp)
-       struct inpcb *inp;
+in_pcbrehash(struct inpcb *inp)

 {
        struct inpcbhead *head;
        u_int32_t hashkey_faddr;
 {
        struct inpcbhead *head;
        u_int32_t hashkey_faddr;


@@ -1085,37 +1621,29 @@ in_pcbrehash(inp)
        else
 #endif /* INET6 */
        hashkey_faddr = inp->inp_faddr.s_addr;
        else
 #endif /* INET6 */
        hashkey_faddr = inp->inp_faddr.s_addr;

-
-       head = &inp->inp_pcbinfo->hashbase[INP_PCBHASH(hashkey_faddr,
-               inp->inp_lport, inp->inp_fport, inp->inp_pcbinfo->hashmask)];
+       inp->hash_element = INP_PCBHASH(hashkey_faddr, inp->inp_lport, 
+                               inp->inp_fport, inp->inp_pcbinfo->hashmask);
+       head = &inp->inp_pcbinfo->hashbase[inp->hash_element];

 
        LIST_REMOVE(inp, inp_hash);
        LIST_INSERT_HEAD(head, inp, inp_hash);
 
        LIST_REMOVE(inp, inp_hash);
        LIST_INSERT_HEAD(head, inp, inp_hash);

-#ifdef __APPLE__
-       inp->hash_element = INP_PCBHASH(inp->inp_faddr.s_addr, inp->inp_lport, 
-                                       inp->inp_fport, inp->inp_pcbinfo->hashmask);
-#endif

 }
 
 /*
  * Remove PCB from various lists.
  */
 }
 
 /*
  * Remove PCB from various lists.
  */

+//###LOCK must be called with list lock held

 void
 void

-in_pcbremlists(inp)
-       struct inpcb *inp;
+in_pcbremlists(struct inpcb *inp)

 {
        inp->inp_gencnt = ++inp->inp_pcbinfo->ipi_gencnt;
 {
        inp->inp_gencnt = ++inp->inp_pcbinfo->ipi_gencnt;

-#ifdef __APPLE__
-       if (inp == inp->inp_pcbinfo->last_pcb)
-           inp->inp_pcbinfo->last_pcb = 0;
-#endif

 
        if (inp->inp_lport) {
                struct inpcbport *phd = inp->inp_phd;
 
                LIST_REMOVE(inp, inp_hash);
                LIST_REMOVE(inp, inp_portlist);
 
        if (inp->inp_lport) {
                struct inpcbport *phd = inp->inp_phd;
 
                LIST_REMOVE(inp, inp_hash);
                LIST_REMOVE(inp, inp_portlist);

-               if (LIST_FIRST(&phd->phd_pcblist) == NULL) {
+               if (phd != NULL && (LIST_FIRST(&phd->phd_pcblist) == NULL)) {

                        LIST_REMOVE(phd, phd_hash);
                        FREE(phd, M_PCB);
                }
                        LIST_REMOVE(phd, phd_hash);
                        FREE(phd, M_PCB);
                }


@@ -1124,309 +1652,266 @@ in_pcbremlists(inp)
        inp->inp_pcbinfo->ipi_count--;
 }
 
        inp->inp_pcbinfo->ipi_count--;
 }
 

-int    
-in_pcb_grab_port  __P((struct inpcbinfo *pcbinfo,
-                      u_short          options,
-                      struct in_addr   laddr, 
-                      u_short          *lport,
-                      struct in_addr   faddr,
-                      u_short          fport,
-                      u_int            cookie, 
-                      u_char           owner_id))
+/* Mechanism used to defer the memory release of PCBs
+ * The pcb list will contain the pcb until the ripper can clean it up if
+ * the following conditions are met: 1) state "DEAD", 2) wantcnt is STOPUSING
+ * 3) usecount is null
+ * This function will be called to either mark the pcb as
+*/
+int
+in_pcb_checkstate(struct inpcb *pcb, int mode, int locked)

 {
 {

-    struct inpcb  *pcb;
-    struct sockaddr_in sin;
-    struct proc *p = current_proc();
-    int  stat;
-
-
-    pcbinfo->nat_dummy_socket.so_pcb = 0;
-    pcbinfo->nat_dummy_socket.so_options = 0;
-    if (*lport) {
-       /* The grabber wants a particular port */
-
-       if (faddr.s_addr || fport) {
-           /*
-            * This is either the second half of an active connect, or
-            * it's from the acceptance of an incoming connection.
-           */  
-           if (laddr.s_addr == 0) {
-               return EINVAL;
-           }
-
-           if (in_pcblookup_hash(pcbinfo, faddr, fport,
-                                 laddr, *lport, 0, NULL) != NULL) {
-               if (!(IN_MULTICAST(ntohl(laddr.s_addr)))) {
-                   return (EADDRINUSE);
-               }
-           }
-           
-           stat = in_pcballoc(&pcbinfo->nat_dummy_socket, pcbinfo, p);
-           if (stat)
-               return stat;
-           pcb = sotoinpcb(&pcbinfo->nat_dummy_socket);
-           pcb->inp_vflag |= INP_IPV4;
-
-           pcb->inp_lport = *lport;
-           pcb->inp_laddr.s_addr = laddr.s_addr;
-
-           pcb->inp_faddr = faddr;
-           pcb->inp_fport = fport;
-           in_pcbinshash(pcb);
-       }
-       else {
-           /*
-            * This is either a bind for a passive socket, or it's the 
-            * first part of bind-connect sequence (not likely since an 
-            * ephemeral port is usually used in this case). Or, it's
-            * the result of a connection acceptance when the foreign
-            * address/port cannot be provided (which requires the SO_REUSEADDR
-            * flag if laddr is not multicast).
-            */
-
-           stat = in_pcballoc(&pcbinfo->nat_dummy_socket, pcbinfo, p);
-           if (stat)
-               return stat;
-           pcb = sotoinpcb(&pcbinfo->nat_dummy_socket);
-           pcb->inp_vflag |= INP_IPV4;
-
-           pcbinfo->nat_dummy_socket.so_options = options; 
-           bzero(&sin, sizeof(struct sockaddr_in));
-           sin.sin_len = sizeof(struct sockaddr_in);
-           sin.sin_family = AF_INET;
-           sin.sin_addr.s_addr = laddr.s_addr;
-           sin.sin_port = *lport;
-
-           stat = in_pcbbind((struct inpcb *) pcbinfo->nat_dummy_socket.so_pcb, 
-                             (struct sockaddr *) &sin, p);
-           if (stat) {
-               in_pcbdetach(pcb);
-               return stat;
-           }
-       }
-    }
-    else {
-       /* The grabber wants an ephemeral port */
-
-       stat = in_pcballoc(&pcbinfo->nat_dummy_socket, pcbinfo, p);
-       if (stat)
-           return stat;
-       pcb = sotoinpcb(&pcbinfo->nat_dummy_socket);
-       pcb->inp_vflag |= INP_IPV4;
-
-       bzero(&sin, sizeof(struct sockaddr_in));
-       sin.sin_len = sizeof(struct sockaddr_in);
-       sin.sin_family = AF_INET;
-       sin.sin_addr.s_addr = laddr.s_addr;
-       sin.sin_port = 0;
-
-       if (faddr.s_addr || fport) {
-           /*
-            * Not sure if this case will be used - could occur when connect
-            * is called, skipping the bind.
-            */
-
-           if (laddr.s_addr == 0) {
-               in_pcbdetach(pcb);
-               return EINVAL;
-           }
-
-           stat = in_pcbbind((struct inpcb *) pcbinfo->nat_dummy_socket.so_pcb, 
-                             (struct sockaddr *) &sin, p);
-           if (stat) {
-               in_pcbdetach(pcb);
-               return stat;
-           }
-
-           if (in_pcblookup_hash(pcbinfo, faddr, fport,
-                                 pcb->inp_laddr, pcb->inp_lport, 0, NULL) != NULL) {
-               in_pcbdetach(pcb);
-               return (EADDRINUSE);
-           }
-           
-           pcb->inp_faddr = faddr;
-           pcb->inp_fport = fport;
-           in_pcbrehash(pcb);
-       }
-       else {
-           /*
-            * This is a simple bind of an ephemeral port. The local addr
-            * may or may not be defined.
-            */
-           
-           stat = in_pcbbind((struct inpcb *) pcbinfo->nat_dummy_socket.so_pcb, 
-                             (struct sockaddr *) &sin, p);
-           if (stat) {
-               in_pcbdetach(pcb);
-               return stat;
-           }
-       }
-       *lport = pcb->inp_lport;
-    }
-    
-
-    pcb->nat_owner = owner_id;
-    pcb->nat_cookie = cookie;
-    pcb->inp_ppcb = (caddr_t) pcbinfo->dummy_cb;
-    return 0;
-}

 
 

-int    
-in_pcb_letgo_port __P((struct inpcbinfo *pcbinfo, struct in_addr laddr, u_short lport,
-                      struct in_addr faddr, u_short fport, u_char owner_id))
-{
-    struct inpcbhead *head;
-    register struct inpcb *inp;
-
-
-    /*
-     * First look for an exact match.
-     */
-    head = &pcbinfo->hashbase[INP_PCBHASH(faddr.s_addr, lport, fport, pcbinfo->hashmask)];
-    for (inp = head->lh_first; inp != NULL; inp = inp->inp_hash.le_next) {
-       if (inp->inp_faddr.s_addr == faddr.s_addr &&
-           inp->inp_laddr.s_addr == laddr.s_addr &&
-           inp->inp_fport == fport &&
-           inp->inp_lport == lport &&
-           inp->nat_owner == owner_id) {
-           /*
-            * Found.
-            */
-           in_pcbdetach(inp);
-           return 0;
-       }
-    }
+       volatile UInt32 *wantcnt        = (volatile UInt32 *)&pcb->inp_wantcnt;
+       UInt32 origwant;
+       UInt32 newwant;

 
 

-    return ENOENT;
-}
+       switch (mode) {

 
 

-u_char 
-in_pcb_get_owner(struct inpcbinfo *pcbinfo,
-                struct in_addr laddr, u_short lport,
-                struct in_addr faddr, u_short fport,
-                u_int   *cookie)
+               case WNT_STOPUSING:     /* try to mark the pcb as ready for recycling */

 
 

-{
-    struct inpcb *inp;
-    u_char       owner_id = INPCB_NO_OWNER;
-    struct      inpcbport *phd;
-    struct inpcbporthead *porthash;
+                       /* compareswap with STOPUSING, if success we're good, if it's in use, will be marked later */

 
 

+                       if (locked == 0)
+                               socket_lock(pcb->inp_socket, 1);
+                       pcb->inp_state = INPCB_STATE_DEAD;

 
 

-    if (IN_MULTICAST(laddr.s_addr)) {
-       /*
-        * Walk through PCB's looking for registered
-        * owners.
-       */
-
-       porthash = &pcbinfo->porthashbase[INP_PCBPORTHASH(lport,
-                                                         pcbinfo->porthashmask)];
-       for (phd = porthash->lh_first; phd != NULL; phd = phd->phd_hash.le_next) {
-           if (phd->phd_port == lport)
-               break;
-       }
+stopusing:
+                       if (pcb->inp_socket->so_usecount < 0)
+                               panic("in_pcb_checkstate STOP pcb=%p so=%p usecount is negative\n", pcb, pcb->inp_socket);
+                       if (locked == 0)
+                               socket_unlock(pcb->inp_socket, 1);

 
 

-       if (phd == 0) {
-           return INPCB_NO_OWNER;
-       }
-               
-       owner_id = INPCB_NO_OWNER;
-       for (inp = phd->phd_pcblist.lh_first; inp != NULL;
-            inp = inp->inp_portlist.le_next) {
-
-           if (inp->inp_laddr.s_addr == laddr.s_addr) {
-               if (inp->nat_owner == 0) 
-                   owner_id |= INPCB_OWNED_BY_X;
-               else
-                   owner_id |= inp->nat_owner;
-           }
-       }
+                       origwant = *wantcnt;
+                       if ((UInt16) origwant == 0xffff ) /* should stop using */
+                               return (WNT_STOPUSING);
+                       newwant = 0xffff;                       
+                       if ((UInt16) origwant == 0) {/* try to mark it as unsuable now */
+                               OSCompareAndSwap(origwant, newwant, wantcnt) ;
+                       }
+                       return (WNT_STOPUSING);
+                       break;
+
+               case WNT_ACQUIRE:       /* try to increase reference to pcb */
+                                       /* if WNT_STOPUSING should bail out */
+                       /*
+                        * if socket state DEAD, try to set count to STOPUSING, return failed
+                        * otherwise increase cnt
+                        */
+                       do {
+                               origwant = *wantcnt;
+                               if ((UInt16) origwant == 0xffff ) {/* should stop using */
+//                                     printf("in_pcb_checkstate: ACQ PCB was STOPUSING while release. odd pcb=%p\n", pcb);
+                                       return (WNT_STOPUSING);
+                               }
+                               newwant = origwant + 1;         
+                       } while (!OSCompareAndSwap(origwant, newwant, wantcnt));
+                       return (WNT_ACQUIRE);
+                       break;
+
+               case WNT_RELEASE:       /* release reference. if result is null and pcb state is DEAD,
+                                          set wanted bit to STOPUSING
+                                        */
+
+                       if (locked == 0)
+                               socket_lock(pcb->inp_socket, 1);
+
+                       do {
+                               origwant = *wantcnt;
+                               if ((UInt16) origwant == 0x0 ) 
+                                       panic("in_pcb_checkstate pcb=%p release with zero count", pcb);
+                               if ((UInt16) origwant == 0xffff ) {/* should stop using */
+#if TEMPDEBUG
+                                       printf("in_pcb_checkstate: REL PCB was STOPUSING while release. odd pcb=%p\n", pcb);
+#endif
+                                       if (locked == 0)
+                                               socket_unlock(pcb->inp_socket, 1);
+                                       return (WNT_STOPUSING);
+                               }
+                               newwant = origwant - 1;         
+                       } while (!OSCompareAndSwap(origwant, newwant, wantcnt));
+
+                       if (pcb->inp_state == INPCB_STATE_DEAD) 
+                               goto stopusing;
+                       if (pcb->inp_socket->so_usecount < 0)
+                               panic("in_pcb_checkstate RELEASE pcb=%p so=%p usecount is negative\n", pcb, pcb->inp_socket);
+                               
+                       if (locked == 0)
+                               socket_unlock(pcb->inp_socket, 1);
+                       return (WNT_RELEASE);
+                       break;
+
+               default:

 
 

-       return owner_id;
-    }
-    else {
-       inp = in_pcblookup_hash(pcbinfo, faddr, fport,
-                               laddr, lport, 1, NULL);
-       if (inp) {
-           if (inp->nat_owner) {
-               owner_id = inp->nat_owner;
-               *cookie   = inp->nat_cookie;
-           }
-           else {
-               pcbinfo->last_pcb = inp;
-               owner_id = INPCB_OWNED_BY_X;
-           }
+                       panic("in_pcb_checkstate: so=%p not a valid state =%x\n", pcb->inp_socket, mode);

        }
        }

-       else 
-           owner_id = INPCB_NO_OWNER;

 
 

-       return owner_id;
-    }
+       /* NOTREACHED */
+       return (mode);

 }
 
 }
 

-int
-in_pcb_new_share_client(struct inpcbinfo *pcbinfo, u_char *owner_id)
+/*
+ * inpcb_to_compat copies specific bits of an inpcb to a inpcb_compat.
+ * The inpcb_compat data structure is passed to user space and must
+ * not change. We intentionally avoid copying pointers.
+ */
+void
+inpcb_to_compat(
+       struct inpcb *inp,
+       struct inpcb_compat *inp_compat)

 {
 {

+       bzero(inp_compat, sizeof(*inp_compat));
+       inp_compat->inp_fport = inp->inp_fport;
+       inp_compat->inp_lport = inp->inp_lport;
+       inp_compat->nat_owner = inp->nat_owner;
+       inp_compat->nat_cookie = inp->nat_cookie;
+       inp_compat->inp_gencnt = inp->inp_gencnt;
+       inp_compat->inp_flags = inp->inp_flags;
+       inp_compat->inp_flow = inp->inp_flow;
+       inp_compat->inp_vflag = inp->inp_vflag;
+       inp_compat->inp_ip_ttl = inp->inp_ip_ttl;
+       inp_compat->inp_ip_p = inp->inp_ip_p;
+       inp_compat->inp_dependfaddr.inp6_foreign = inp->inp_dependfaddr.inp6_foreign;
+       inp_compat->inp_dependladdr.inp6_local = inp->inp_dependladdr.inp6_local;
+       inp_compat->inp_depend4.inp4_ip_tos = inp->inp_depend4.inp4_ip_tos;
+       inp_compat->inp_depend6.inp6_hlim = inp->inp_depend6.inp6_hlim;
+       inp_compat->inp_depend6.inp6_cksum = inp->inp_depend6.inp6_cksum;
+       inp_compat->inp_depend6.inp6_ifindex = inp->inp_depend6.inp6_ifindex;
+       inp_compat->inp_depend6.inp6_hops = inp->inp_depend6.inp6_hops;
+}

 
 

-    int i;
+#if !CONFIG_EMBEDDED

 
 

+void
+inpcb_to_xinpcb64(
+        struct inpcb *inp,
+        struct xinpcb64 *xinp)
+{
+       xinp->inp_fport = inp->inp_fport;
+       xinp->inp_lport = inp->inp_lport;
+       xinp->inp_gencnt = inp->inp_gencnt;
+       xinp->inp_flags = inp->inp_flags;
+       xinp->inp_flow = inp->inp_flow;
+       xinp->inp_vflag = inp->inp_vflag;
+       xinp->inp_ip_ttl = inp->inp_ip_ttl;
+       xinp->inp_ip_p = inp->inp_ip_p;
+       xinp->inp_dependfaddr.inp6_foreign = inp->inp_dependfaddr.inp6_foreign;
+       xinp->inp_dependladdr.inp6_local = inp->inp_dependladdr.inp6_local;
+       xinp->inp_depend4.inp4_ip_tos = inp->inp_depend4.inp4_ip_tos;
+       xinp->inp_depend6.inp6_hlim = inp->inp_depend6.inp6_hlim;
+       xinp->inp_depend6.inp6_cksum = inp->inp_depend6.inp6_cksum;
+       xinp->inp_depend6.inp6_ifindex = inp->inp_depend6.inp6_ifindex;
+       xinp->inp_depend6.inp6_hops = inp->inp_depend6.inp6_hops;
+}

 
 

-    for (i=0; i < INPCB_MAX_IDS; i++) {
-       if ((pcbinfo->all_owners & (1 << i)) == 0) {
-           pcbinfo->all_owners |= (1 << i);
-           *owner_id = (1 << i);
-           return 0;
-       }
-    }
+#endif /* !CONFIG_EMBEDDED */

 
 

-    return ENOSPC;
-}              

 
 

-int
-in_pcb_rem_share_client(struct inpcbinfo *pcbinfo, u_char owner_id)
+/*
+ * The following routines implement this scheme:
+ *
+ * Callers of ip_output() that intend to cache the route in the inpcb pass
+ * a local copy of the struct route to ip_output().  Using a local copy of
+ * the cached route significantly simplifies things as IP no longer has to
+ * worry about having exclusive access to the passed in struct route, since
+ * it's defined in the caller's stack; in essence, this allows for a lock-
+ * less operation when updating the struct route at the IP level and below,
+ * whenever necessary. The scheme works as follows:
+ *
+ * Prior to dropping the socket's lock and calling ip_output(), the caller
+ * copies the struct route from the inpcb into its stack, and adds a reference
+ * to the cached route entry, if there was any.  The socket's lock is then
+ * dropped and ip_output() is called with a pointer to the copy of struct
+ * route defined on the stack (not to the one in the inpcb.)
+ *
+ * Upon returning from ip_output(), the caller then acquires the socket's
+ * lock and synchronizes the cache; if there is no route cached in the inpcb,
+ * it copies the local copy of struct route (which may or may not contain any
+ * route) back into the cache; otherwise, if the inpcb has a route cached in
+ * it, the one in the local copy will be freed, if there's any.  Trashing the
+ * cached route in the inpcb can be avoided because ip_output() is single-
+ * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized
+ * by the socket/transport layer.)
+ */
+void
+inp_route_copyout(struct inpcb *inp, struct route *dst)

 {
 {

-    struct inpcb *inp;
-
-
-    if (pcbinfo->all_owners & owner_id) {
-       pcbinfo->all_owners &= ~owner_id;
-       for (inp = pcbinfo->listhead->lh_first; inp != NULL; inp = inp->inp_list.le_next) {
-           if (inp->nat_owner & owner_id) {
-               if (inp->nat_owner == owner_id) 
-                   /*
-                    * Deallocate the pcb
-                    */
-                   in_pcbdetach(inp);
-               else
-                   inp->nat_owner &= ~owner_id;
-           }
-       }
-    }
-    else {
-       return ENOENT;
-    }
+       struct route *src = &inp->inp_route;
+
+       lck_mtx_assert(&inp->inpcb_mtx, LCK_MTX_ASSERT_OWNED);

 
 

-    return 0;
+       /*
+        * If the route in the PCB is not for IPv4, blow it away;
+        * this is possible in the case of IPv4-mapped address case.
+        */
+       if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET) {
+               rtfree(src->ro_rt);
+               src->ro_rt = NULL;
+       }
+       
+       route_copyout(dst, src, sizeof(*dst));

 }
 
 }
 

+void
+inp_route_copyin(struct inpcb *inp, struct route *src)
+{
+       struct route *dst = &inp->inp_route;
+
+       lck_mtx_assert(&inp->inpcb_mtx, LCK_MTX_ASSERT_OWNED);

 
 

+       /* Minor sanity check */
+       if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET)
+               panic("%s: wrong or corrupted route: %p", __func__, src);

 
 

-void  in_pcb_nat_init(struct inpcbinfo *pcbinfo, int afamily, 
-                     int pfamily, int protocol)
-{
-    bzero(&pcbinfo->nat_dummy_socket, sizeof(struct socket));
-    pcbinfo->nat_dummy_socket.so_proto = pffindproto(afamily, pfamily, protocol);
-    pcbinfo->all_owners = 0;
+       route_copyin(src, dst, sizeof(*src));

 }
 
 }
 

+/*
+ * Handler for setting IP_FORCE_OUT_IFP/IP_BOUND_IF/IPV6_BOUND_IF socket option.
+ */
+void
+inp_bindif(struct inpcb *inp, unsigned int ifscope)
+{
+       /*
+        * A zero interface scope value indicates an "unbind".
+        * Otherwise, take in whatever value the app desires;
+        * the app may already know the scope (or force itself
+        * to such a scope) ahead of time before the interface
+        * gets attached.  It doesn't matter either way; any
+        * route lookup from this point on will require an
+        * exact match for the embedded interface scope.
+        */
+       inp->inp_boundif = ifscope;
+       if (inp->inp_boundif == IFSCOPE_NONE)
+               inp->inp_flags &= ~INP_BOUND_IF;
+       else
+               inp->inp_flags |= INP_BOUND_IF;

 
 

-#ifndef __APPLE__
-prison_xinpcb(struct proc *p, struct inpcb *inp)
+       /* Blow away any cached route in the PCB */
+       if (inp->inp_route.ro_rt != NULL) {
+               rtfree(inp->inp_route.ro_rt);
+               inp->inp_route.ro_rt = NULL;
+       }
+}
+
+/*
+ * Handler for setting IP_NO_IFT_CELLULAR/IPV6_NO_IFT_CELLULAR socket option.
+ */
+int
+inp_nocellular(struct inpcb *inp, unsigned int val)

 {
 {

-       if (!p->p_prison)
-               return (0);
-       if (ntohl(inp->inp_laddr.s_addr) == p->p_prison->pr_ip)
-               return (0);
-       return (1);
+       if (val) {
+               inp->inp_flags |= INP_NO_IFT_CELLULAR;
+       } else if (inp->inp_flags & INP_NO_IFT_CELLULAR) {
+               /* once set, it cannot be unset */
+               return (EINVAL);
+       }
+
+       /* Blow away any cached route in the PCB */
+       if (inp->inp_route.ro_rt != NULL) {
+               rtfree(inp->inp_route.ro_rt);
+               inp->inp_route.ro_rt = NULL;
+       }
+
+       return (0);

 }
 }

-#endif