xnu-792.21.3.tar.gz

[apple/xnu.git] / bsd / netinet / udp_usrreq.c

diff --git a/bsd/netinet/udp_usrreq.c b/bsd/netinet/udp_usrreq.c
index 4dde880cef51ad2fb5cddd37526c2f0ecf9c51a1..c0376e448cf0fd19281d0e6178591b72acee3157 100644 (file)
--- a/bsd/netinet/udp_usrreq.c
+++ b/bsd/netinet/udp_usrreq.c
@@ -1,23 +1,29 @@
 /*
  * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
  *
 /*
  * Copyright (c) 2000 Apple Computer, Inc. All rights reserved.
  *

- * @APPLE_LICENSE_HEADER_START@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@

  * 
  * 

- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License").  You may not use this file except in compliance with the
- * License.  Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.

  * 
  * 

- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER

  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,

- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
- * License for the specific language governing rights and limitations
- * under the License.
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.

  * 
  * 

- * @APPLE_LICENSE_HEADER_END@
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@

  */
 /*
  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  */
 /*
  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995


@@ -68,6 +74,7 @@
 #include <sys/syslog.h>
 
 #include <net/if.h>
 #include <sys/syslog.h>
 
 #include <net/if.h>

+#include <net/if_types.h>

 #include <net/route.h>
 
 #include <netinet/in.h>
 #include <net/route.h>
 
 #include <netinet/in.h>


@@ -91,6 +98,7 @@
 #if IPSEC
 #include <netinet6/ipsec.h>
 extern int ipsec_bypass;
 #if IPSEC
 #include <netinet6/ipsec.h>
 extern int ipsec_bypass;

+extern lck_mtx_t *sadb_mutex;

 #endif /*IPSEC*/
 
 
 #endif /*IPSEC*/
 
 


@@ -101,8 +109,6 @@ extern int ipsec_bypass;
 #define DBG_FNC_UDP_INPUT      NETDBG_CODE(DBG_NETUDP, (5 << 8))
 #define DBG_FNC_UDP_OUTPUT     NETDBG_CODE(DBG_NETUDP, (6 << 8) | 1)
 
 #define DBG_FNC_UDP_INPUT      NETDBG_CODE(DBG_NETUDP, (5 << 8))
 #define DBG_FNC_UDP_OUTPUT     NETDBG_CODE(DBG_NETUDP, (6 << 8) | 1)
 

-
-#define __STDC__ 1

 /*
  * UDP protocol implementation.
  * Per RFC 768, August, 1980.
 /*
  * UDP protocol implementation.
  * Per RFC 768, August, 1980.


@@ -132,10 +138,25 @@ struct    inpcbinfo udbinfo;
 #endif
 
 extern  int apple_hwcksum_rx;
 #endif
 
 extern  int apple_hwcksum_rx;

+extern int     esp_udp_encap_port;
+extern u_long  route_generation;
+
+extern  void    ipfwsyslog( int level, char *format,...);
+ 
+extern int fw_verbose;
+
+#define log_in_vain_log( a ) {            \
+        if ( (log_in_vain == 3 ) && (fw_verbose == 2)) {        /* Apple logging, log to ipfw.log */ \
+                ipfwsyslog a ;  \
+        }                       \
+        else log a ;            \
+}

 
 struct udpstat udpstat;        /* from udp_var.h */
 SYSCTL_STRUCT(_net_inet_udp, UDPCTL_STATS, stats, CTLFLAG_RD,
     &udpstat, udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");
 
 struct udpstat udpstat;        /* from udp_var.h */
 SYSCTL_STRUCT(_net_inet_udp, UDPCTL_STATS, stats, CTLFLAG_RD,
     &udpstat, udpstat, "UDP statistics (struct udpstat, netinet/udp_var.h)");

+SYSCTL_INT(_net_inet_udp, OID_AUTO, pcbcount, CTLFLAG_RD, 
+    &udbinfo.ipi_count, 0, "Number of active PCBs");

 
 static struct  sockaddr_in udp_in = { sizeof(udp_in), AF_INET };
 #if INET6
 
 static struct  sockaddr_in udp_in = { sizeof(udp_in), AF_INET };
 #if INET6


@@ -152,25 +173,23 @@ struct udp_ip6 {
 } udp_ip6;
 #endif /* INET6 */
 
 } udp_ip6;
 #endif /* INET6 */
 

-static void udp_append __P((struct inpcb *last, struct ip *ip,
-                           struct mbuf *n, int off));
+static void udp_append(struct inpcb *last, struct ip *ip,
+                           struct mbuf *n, int off);

 #if INET6
 #if INET6

-static void ip_2_ip6_hdr __P((struct ip6_hdr *ip6, struct ip *ip));
+static void ip_2_ip6_hdr(struct ip6_hdr *ip6, struct ip *ip);

 #endif
 
 #endif
 

-static int udp_detach __P((struct socket *so));
-static int udp_output __P((struct inpcb *, struct mbuf *, struct sockaddr *,
-                           struct mbuf *, struct proc *));
+static int udp_detach(struct socket *so);
+static int udp_output(struct inpcb *, struct mbuf *, struct sockaddr *,
+                           struct mbuf *, struct proc *);
+extern int ChkAddressOK( __uint32_t dstaddr, __uint32_t srcaddr );

 
 void
 udp_init()
 {
 
 void
 udp_init()
 {

-       vm_size_t       str_size;
-       int             stat;
-       u_char          fake_owner;
-       struct in_addr  laddr;
-       struct in_addr  faddr;
-       u_short         lport;
+       vm_size_t                       str_size;
+       struct inpcbinfo        *pcbinfo;
+       

 
        LIST_INIT(&udb);
        udbinfo.listhead = &udb;
 
        LIST_INIT(&udb);
        udbinfo.listhead = &udb;


@@ -181,7 +200,21 @@ udp_init()
        str_size = (vm_size_t) sizeof(struct inpcb);
        udbinfo.ipi_zone = (void *) zinit(str_size, 80000*str_size, 8192, "udpcb");
 
        str_size = (vm_size_t) sizeof(struct inpcb);
        udbinfo.ipi_zone = (void *) zinit(str_size, 80000*str_size, 8192, "udpcb");
 

-       udbinfo.last_pcb = 0;
+       pcbinfo = &udbinfo;
+       /*
+        * allocate lock group attribute and group for udp pcb mutexes
+        */
+       pcbinfo->mtx_grp_attr = lck_grp_attr_alloc_init();
+       lck_grp_attr_setdefault(pcbinfo->mtx_grp_attr);
+
+       pcbinfo->mtx_grp = lck_grp_alloc_init("udppcb", pcbinfo->mtx_grp_attr);
+               
+       pcbinfo->mtx_attr = lck_attr_alloc_init();
+       lck_attr_setdefault(pcbinfo->mtx_attr);
+
+       if ((pcbinfo->mtx = lck_rw_alloc_init(pcbinfo->mtx_grp, pcbinfo->mtx_attr)) == NULL)
+               return; /* pretty much dead if this fails... */
+

        in_pcb_nat_init(&udbinfo, AF_INET, IPPROTO_UDP, SOCK_DGRAM);
 #else
        udbinfo.ipi_zone = zinit("udpcb", sizeof(struct inpcb), maxsockets,
        in_pcb_nat_init(&udbinfo, AF_INET, IPPROTO_UDP, SOCK_DGRAM);
 #else
        udbinfo.ipi_zone = zinit("udpcb", sizeof(struct inpcb), maxsockets,


@@ -227,6 +260,7 @@ udp_input(m, iphlen)
        int len;
        struct ip save_ip;
        struct sockaddr *append_sa;
        int len;
        struct ip save_ip;
        struct sockaddr *append_sa;

+       struct inpcbinfo *pcbinfo = &udbinfo;

 
        udpstat.udps_ipackets++;
 
 
        udpstat.udps_ipackets++;
 


@@ -289,17 +323,26 @@ udp_input(m, iphlen)
         * Checksum extended UDP header and data.
         */
        if (uh->uh_sum) {
         * Checksum extended UDP header and data.
         */
        if (uh->uh_sum) {

-               if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
-                        if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
-                                uh->uh_sum = m->m_pkthdr.csum_data;
-                        else
-                           goto doudpcksum;
-                      uh->uh_sum ^= 0xffff;
-                } else {
+               if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
+                       if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
+                               uh->uh_sum = m->m_pkthdr.csum_data;
+                       else
+                               goto doudpcksum;
+                       uh->uh_sum ^= 0xffff;
+               } else {
+                       char b[9];

 doudpcksum:
 doudpcksum:

+                       *(uint32_t*)&b[0] = *(uint32_t*)&((struct ipovly *)ip)->ih_x1[0];
+                       *(uint32_t*)&b[4] = *(uint32_t*)&((struct ipovly *)ip)->ih_x1[4];
+                       *(uint8_t*)&b[8] = *(uint8_t*)&((struct ipovly *)ip)->ih_x1[8];
+                       

                        bzero(((struct ipovly *)ip)->ih_x1, 9);
                        ((struct ipovly *)ip)->ih_len = uh->uh_ulen;
                        uh->uh_sum = in_cksum(m, len + sizeof (struct ip));
                        bzero(((struct ipovly *)ip)->ih_x1, 9);
                        ((struct ipovly *)ip)->ih_len = uh->uh_ulen;
                        uh->uh_sum = in_cksum(m, len + sizeof (struct ip));

+                       
+                       *(uint32_t*)&((struct ipovly *)ip)->ih_x1[0] = *(uint32_t*)&b[0];
+                       *(uint32_t*)&((struct ipovly *)ip)->ih_x1[4] = *(uint32_t*)&b[4];
+                       *(uint8_t*)&((struct ipovly *)ip)->ih_x1[8] = *(uint8_t*)&b[8];

                }
                if (uh->uh_sum) {
                        udpstat.udps_badsum++;
                }
                if (uh->uh_sum) {
                        udpstat.udps_badsum++;


@@ -316,6 +359,7 @@ doudpcksum:
        if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
            in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
                struct inpcb *last;
        if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
            in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
                struct inpcb *last;

+               lck_rw_lock_shared(pcbinfo->mtx);

                /*
                 * Deliver a multicast or broadcast datagram to *all* sockets
                 * for which the local and remote addresses and ports match
                /*
                 * Deliver a multicast or broadcast datagram to *all* sockets
                 * for which the local and remote addresses and ports match


@@ -332,6 +376,7 @@ doudpcksum:
                 * fixing the interface.  Maybe 4.5BSD will remedy this?)
                 */
 
                 * fixing the interface.  Maybe 4.5BSD will remedy this?)
                 */
 

+

                /*
                 * Construct sockaddr format source address.
                 */
                /*
                 * Construct sockaddr format source address.
                 */


@@ -351,39 +396,67 @@ doudpcksum:
                        if (inp->inp_socket == &udbinfo.nat_dummy_socket)
                                continue;
 #endif
                        if (inp->inp_socket == &udbinfo.nat_dummy_socket)
                                continue;
 #endif

-#if INET6
-                       if ((inp->inp_vflag & INP_IPV4) == 0)
+                       if (inp->inp_socket == NULL) 

                                continue;
                                continue;

+                       if (inp != sotoinpcb(inp->inp_socket))
+                               panic("udp_input: bad so back ptr inp=%x\n", inp);
+#if INET6
+                        if ((inp->inp_vflag & INP_IPV4) == 0)
+                                continue;

 #endif
 #endif

-                       if (inp->inp_lport != uh->uh_dport)
+                       if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) == WNT_STOPUSING) {
+                               continue;
+                       }
+                       
+                       udp_lock(inp->inp_socket, 1, 0);        
+
+                       if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
+                               udp_unlock(inp->inp_socket, 1, 0);

                                continue;
                                continue;

+                       }
+
+                       if (inp->inp_lport != uh->uh_dport) {
+                               udp_unlock(inp->inp_socket, 1, 0);
+                               continue;
+                       }

                        if (inp->inp_laddr.s_addr != INADDR_ANY) {
                                if (inp->inp_laddr.s_addr !=
                        if (inp->inp_laddr.s_addr != INADDR_ANY) {
                                if (inp->inp_laddr.s_addr !=

-                                   ip->ip_dst.s_addr)
+                                   ip->ip_dst.s_addr) {
+                                       udp_unlock(inp->inp_socket, 1, 0);

                                        continue;
                                        continue;

+                               }

                        }
                        if (inp->inp_faddr.s_addr != INADDR_ANY) {
                                if (inp->inp_faddr.s_addr !=
                                    ip->ip_src.s_addr ||
                        }
                        if (inp->inp_faddr.s_addr != INADDR_ANY) {
                                if (inp->inp_faddr.s_addr !=
                                    ip->ip_src.s_addr ||

-                                   inp->inp_fport != uh->uh_sport)
+                                   inp->inp_fport != uh->uh_sport) {
+                                       udp_unlock(inp->inp_socket, 1, 0);

                                        continue;
                                        continue;

+                               }

                        }
 
                        if (last != NULL) {
                                struct mbuf *n;
                        }
 
                        if (last != NULL) {
                                struct mbuf *n;

-

 #if IPSEC
 #if IPSEC

+                               int skipit = 0;

                                /* check AH/ESP integrity. */
                                /* check AH/ESP integrity. */

-                               if (ipsec_bypass == 0 && ipsec4_in_reject_so(m, last->inp_socket)) {
-                                       ipsecstat.in_polvio++;
-                                       /* do not inject data to pcb */
-                               } else
+                               if (ipsec_bypass == 0) {
+                                       lck_mtx_lock(sadb_mutex);
+                                       if (ipsec4_in_reject_so(m, last->inp_socket)) {
+                                               ipsecstat.in_polvio++;
+                                               /* do not inject data to pcb */
+                                               skipit = 1;
+                                       }
+                                       lck_mtx_unlock(sadb_mutex);
+                               }
+                               if (skipit == 0)

 #endif /*IPSEC*/
                                if ((n = m_copy(m, 0, M_COPYALL)) != NULL) {
                                        udp_append(last, ip, n,
                                                   iphlen +
                                                   sizeof(struct udphdr));
                                }
 #endif /*IPSEC*/
                                if ((n = m_copy(m, 0, M_COPYALL)) != NULL) {
                                        udp_append(last, ip, n,
                                                   iphlen +
                                                   sizeof(struct udphdr));
                                }

+                               udp_unlock(last->inp_socket, 1, 0);

                        }
                        last = inp;
                        /*
                        }
                        last = inp;
                        /*


@@ -397,6 +470,7 @@ doudpcksum:
                        if ((last->inp_socket->so_options&(SO_REUSEPORT|SO_REUSEADDR)) == 0)
                                break;
                }
                        if ((last->inp_socket->so_options&(SO_REUSEPORT|SO_REUSEADDR)) == 0)
                                break;
                }

+               lck_rw_done(pcbinfo->mtx);

 
                if (last == NULL) {
                        /*
 
                if (last == NULL) {
                        /*


@@ -409,14 +483,70 @@ doudpcksum:
                }
 #if IPSEC
                /* check AH/ESP integrity. */
                }
 #if IPSEC
                /* check AH/ESP integrity. */

-               if (ipsec_bypass == 0 && m && ipsec4_in_reject_so(m, last->inp_socket)) {
-                       ipsecstat.in_polvio++;
-                       goto bad;
+               if (ipsec_bypass == 0 && m) {
+                       lck_mtx_lock(sadb_mutex);
+                       if (ipsec4_in_reject_so(m, last->inp_socket)) {
+                               ipsecstat.in_polvio++;
+                               lck_mtx_unlock(sadb_mutex);
+                               udp_unlock(last->inp_socket, 1, 0);
+                               goto bad;
+                       }
+                       lck_mtx_unlock(sadb_mutex);

                }
 #endif /*IPSEC*/
                udp_append(last, ip, m, iphlen + sizeof(struct udphdr));
                }
 #endif /*IPSEC*/
                udp_append(last, ip, m, iphlen + sizeof(struct udphdr));

+               udp_unlock(last->inp_socket, 1, 0);

                return;
        }
                return;
        }

+
+#if IPSEC
+       /*
+        * UDP to port 4500 with a payload where the first four bytes are
+        * not zero is a UDP encapsulated IPSec packet. Packets where
+        * the payload is one byte and that byte is 0xFF are NAT keepalive
+        * packets. Decapsulate the ESP packet and carry on with IPSec input
+        * or discard the NAT keep-alive.
+        */
+       if (ipsec_bypass == 0 && (esp_udp_encap_port & 0xFFFF) != 0 &&
+               uh->uh_dport == ntohs((u_short)esp_udp_encap_port)) {
+               int     payload_len = len - sizeof(struct udphdr) > 4 ? 4 : len - sizeof(struct udphdr);
+               if (m->m_len < iphlen + sizeof(struct udphdr) + payload_len) {
+                       if ((m = m_pullup(m, iphlen + sizeof(struct udphdr) + payload_len)) == 0) {
+                               udpstat.udps_hdrops++;
+                               KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0,0,0,0,0);
+                               return;
+                       }
+                       ip = mtod(m, struct ip *);
+                       uh = (struct udphdr *)((caddr_t)ip + iphlen);
+               }
+               /* Check for NAT keepalive packet */
+               if (payload_len == 1 && *(u_int8_t*)((caddr_t)uh + sizeof(struct udphdr)) == 0xFF) {
+                       m_freem(m);
+                       KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0,0,0,0,0);
+                       return;
+               }
+               else if (payload_len == 4 && *(u_int32_t*)((caddr_t)uh + sizeof(struct udphdr)) != 0) {
+                       /* UDP encapsulated IPSec packet to pass through NAT */
+                       size_t stripsiz;
+
+                       stripsiz = sizeof(struct udphdr);
+
+                       ip = mtod(m, struct ip *);
+                       ovbcopy((caddr_t)ip, (caddr_t)(((u_char *)ip) + stripsiz), iphlen);
+                       m->m_data += stripsiz;
+                       m->m_len -= stripsiz;
+                       m->m_pkthdr.len -= stripsiz;
+                       ip = mtod(m, struct ip *);
+                       ip->ip_len = ip->ip_len - stripsiz;
+                       ip->ip_p = IPPROTO_ESP;
+
+                       KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0,0,0,0,0);
+                       esp4_input(m, iphlen);
+                       return;
+               }
+       }
+#endif
+

        /*
         * Locate pcb for datagram.
         */
        /*
         * Locate pcb for datagram.
         */


@@ -424,13 +554,25 @@ doudpcksum:
            ip->ip_dst, uh->uh_dport, 1, m->m_pkthdr.rcvif);
        if (inp == NULL) {
                if (log_in_vain) {
            ip->ip_dst, uh->uh_dport, 1, m->m_pkthdr.rcvif);
        if (inp == NULL) {
                if (log_in_vain) {

-                       char buf[4*sizeof "123"];
-
-                       strcpy(buf, inet_ntoa(ip->ip_dst));
-                       log(LOG_INFO,
-                           "Connection attempt to UDP %s:%d from %s:%d\n",
-                           buf, ntohs(uh->uh_dport), inet_ntoa(ip->ip_src),
-                           ntohs(uh->uh_sport));
+                       char buf[MAX_IPv4_STR_LEN];
+                       char buf2[MAX_IPv4_STR_LEN];
+
+                       /* check src and dst address */
+                       if (log_in_vain != 3)
+                               log(LOG_INFO,
+                                       "Connection attempt to UDP %s:%d from %s:%d\n",
+                                       inet_ntop(AF_INET, &ip->ip_dst, buf, sizeof(buf)),
+                                       ntohs(uh->uh_dport),
+                                       inet_ntop(AF_INET, &ip->ip_src, buf2, sizeof(buf2)),
+                                       ntohs(uh->uh_sport));
+                       else if (!(m->m_flags & (M_BCAST | M_MCAST)) &&
+                                        ip->ip_dst.s_addr != ip->ip_src.s_addr)
+                               log_in_vain_log((LOG_INFO,
+                                       "Stealth Mode connection attempt to UDP %s:%d from %s:%d\n",
+                                       inet_ntop(AF_INET, &ip->ip_dst, buf, sizeof(buf)),
+                                       ntohs(uh->uh_dport),
+                                       inet_ntop(AF_INET, &ip->ip_src, buf2, sizeof(buf2)),
+                                       ntohs(uh->uh_sport)))

                }
                udpstat.udps_noport++;
                if (m->m_flags & (M_BCAST | M_MCAST)) {
                }
                udpstat.udps_noport++;
                if (m->m_flags & (M_BCAST | M_MCAST)) {


@@ -442,18 +584,31 @@ doudpcksum:
                        goto bad;
 #endif
                if (blackhole)
                        goto bad;
 #endif
                if (blackhole)

-                       goto bad;
+                       if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type != IFT_LOOP)
+                               goto bad;

                *ip = save_ip;
                ip->ip_len += iphlen;
                icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
                KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0,0,0,0,0);
                return;
        }
                *ip = save_ip;
                ip->ip_len += iphlen;
                icmp_error(m, ICMP_UNREACH, ICMP_UNREACH_PORT, 0, 0);
                KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0,0,0,0,0);
                return;
        }

-#if IPSEC
-       if (ipsec_bypass == 0 && inp != NULL && ipsec4_in_reject_so(m, inp->inp_socket)) {
-               ipsecstat.in_polvio++;
+       udp_lock(inp->inp_socket, 1, 0);
+
+       if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
+               udp_unlock(inp->inp_socket, 1, 0);

                goto bad;
        }
                goto bad;
        }

+#if IPSEC
+       if (ipsec_bypass == 0 && inp != NULL) {
+               lck_mtx_lock(sadb_mutex);
+               if (ipsec4_in_reject_so(m, inp->inp_socket)) {
+                       ipsecstat.in_polvio++;
+                       lck_mtx_unlock(sadb_mutex);
+                       udp_unlock(inp->inp_socket, 1, 0);
+                       goto bad;
+               }
+               lck_mtx_unlock(sadb_mutex);
+       }

 #endif /*IPSEC*/
 
        /*
 #endif /*IPSEC*/
 
        /*


@@ -489,11 +644,13 @@ doudpcksum:
        } else
 #endif
        append_sa = (struct sockaddr *)&udp_in;
        } else
 #endif
        append_sa = (struct sockaddr *)&udp_in;

-       if (sbappendaddr(&inp->inp_socket->so_rcv, append_sa, m, opts) == 0) {
+       if (sbappendaddr(&inp->inp_socket->so_rcv, append_sa, m, opts, NULL) == 0) {

                udpstat.udps_fullsock++;
                udpstat.udps_fullsock++;

-               goto bad;

        }
        }

-       sorwakeup(inp->inp_socket);
+       else {
+               sorwakeup(inp->inp_socket);
+       }
+       udp_unlock(inp->inp_socket, 1, 0);

        KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0,0,0,0,0);
        return;
 bad:
        KERNEL_DEBUG(DBG_FNC_UDP_INPUT | DBG_FUNC_END, 0,0,0,0,0);
        return;
 bad:


@@ -566,10 +723,7 @@ udp_append(last, ip, n, off)
 #endif
        append_sa = (struct sockaddr *)&udp_in;
        m_adj(n, off);
 #endif
        append_sa = (struct sockaddr *)&udp_in;
        m_adj(n, off);

-       if (sbappendaddr(&last->inp_socket->so_rcv, append_sa, n, opts) == 0) {
-               m_freem(n);
-               if (opts)
-                       m_freem(opts);
+       if (sbappendaddr(&last->inp_socket->so_rcv, append_sa, n, opts, NULL) == 0) {

                udpstat.udps_fullsock++;
        } else
                sorwakeup(last->inp_socket);
                udpstat.udps_fullsock++;
        } else
                sorwakeup(last->inp_socket);


@@ -597,10 +751,9 @@ udp_ctlinput(cmd, sa, vip)
 {
        struct ip *ip = vip;
        struct udphdr *uh;
 {
        struct ip *ip = vip;
        struct udphdr *uh;

-       void (*notify) __P((struct inpcb *, int)) = udp_notify;
+       void (*notify)(struct inpcb *, int) = udp_notify;

         struct in_addr faddr;
        struct inpcb *inp;
         struct in_addr faddr;
        struct inpcb *inp;

-       int s;

 
        faddr = ((struct sockaddr_in *)sa)->sin_addr;
        if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
 
        faddr = ((struct sockaddr_in *)sa)->sin_addr;
        if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)


@@ -614,21 +767,26 @@ udp_ctlinput(cmd, sa, vip)
        else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
                return;
        if (ip) {
        else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
                return;
        if (ip) {

-               s = splnet();

                uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
                inp = in_pcblookup_hash(&udbinfo, faddr, uh->uh_dport,
                     ip->ip_src, uh->uh_sport, 0, NULL);
                uh = (struct udphdr *)((caddr_t)ip + (ip->ip_hl << 2));
                inp = in_pcblookup_hash(&udbinfo, faddr, uh->uh_dport,
                     ip->ip_src, uh->uh_sport, 0, NULL);

-               if (inp != NULL && inp->inp_socket != NULL)
+               if (inp != NULL && inp->inp_socket != NULL) {
+                       udp_lock(inp->inp_socket, 1, 0);
+                       if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING)  {
+                               udp_unlock(inp->inp_socket, 1, 0);
+                               return;
+                       }

                        (*notify)(inp, inetctlerrmap[cmd]);
                        (*notify)(inp, inetctlerrmap[cmd]);

-               splx(s);
+                       udp_unlock(inp->inp_socket, 1, 0);
+               }

        } else
        } else

-               in_pcbnotifyall(&udb, faddr, inetctlerrmap[cmd], notify);
+               in_pcbnotifyall(&udbinfo, faddr, inetctlerrmap[cmd], notify);

 }
 
 static int
 udp_pcblist SYSCTL_HANDLER_ARGS
 {
 }
 
 static int
 udp_pcblist SYSCTL_HANDLER_ARGS
 {

-       int error, i, n, s;
+       int error, i, n;

        struct inpcb *inp, **inp_list;
        inp_gen_t gencnt;
        struct xinpgen xig;
        struct inpcb *inp, **inp_list;
        inp_gen_t gencnt;
        struct xinpgen xig;


@@ -637,58 +795,67 @@ udp_pcblist SYSCTL_HANDLER_ARGS
         * The process of preparing the TCB list is too time-consuming and
         * resource-intensive to repeat twice on every request.
         */
         * The process of preparing the TCB list is too time-consuming and
         * resource-intensive to repeat twice on every request.
         */

-       if (req->oldptr == 0) {
+       lck_rw_lock_exclusive(udbinfo.mtx);
+       if (req->oldptr == USER_ADDR_NULL) {

                n = udbinfo.ipi_count;
                req->oldidx = 2 * (sizeof xig)
                        + (n + n/8) * sizeof(struct xinpcb);
                n = udbinfo.ipi_count;
                req->oldidx = 2 * (sizeof xig)
                        + (n + n/8) * sizeof(struct xinpcb);

+               lck_rw_done(udbinfo.mtx);

                return 0;
        }
 
                return 0;
        }
 

-       if (req->newptr != 0)
+       if (req->newptr != USER_ADDR_NULL) {
+               lck_rw_done(udbinfo.mtx);

                return EPERM;
                return EPERM;

+       }

 
        /*
         * OK, now we're committed to doing something.
         */
 
        /*
         * OK, now we're committed to doing something.
         */

-       s = splnet();

        gencnt = udbinfo.ipi_gencnt;
        n = udbinfo.ipi_count;
        gencnt = udbinfo.ipi_gencnt;
        n = udbinfo.ipi_count;

-       splx(s);

 
 

+       bzero(&xig, sizeof(xig));

        xig.xig_len = sizeof xig;
        xig.xig_count = n;
        xig.xig_gen = gencnt;
        xig.xig_sogen = so_gencnt;
        error = SYSCTL_OUT(req, &xig, sizeof xig);
        xig.xig_len = sizeof xig;
        xig.xig_count = n;
        xig.xig_gen = gencnt;
        xig.xig_sogen = so_gencnt;
        error = SYSCTL_OUT(req, &xig, sizeof xig);

-       if (error)
+       if (error) {
+               lck_rw_done(udbinfo.mtx);

                return error;
                return error;

+       }

     /*
      * We are done if there is no pcb
      */
     /*
      * We are done if there is no pcb
      */

-    if (n == 0)  
+    if (n == 0) {
+       lck_rw_done(udbinfo.mtx);

         return 0; 
         return 0; 

+    }

 
        inp_list = _MALLOC(n * sizeof *inp_list, M_TEMP, M_WAITOK);
        if (inp_list == 0) {
 
        inp_list = _MALLOC(n * sizeof *inp_list, M_TEMP, M_WAITOK);
        if (inp_list == 0) {

+               lck_rw_done(udbinfo.mtx);

                return ENOMEM;
        }
        
        for (inp = LIST_FIRST(udbinfo.listhead), i = 0; inp && i < n;
             inp = LIST_NEXT(inp, inp_list)) {
                return ENOMEM;
        }
        
        for (inp = LIST_FIRST(udbinfo.listhead), i = 0; inp && i < n;
             inp = LIST_NEXT(inp, inp_list)) {

-               if (inp->inp_gencnt <= gencnt)
+               if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD)

                        inp_list[i++] = inp;
        }
                        inp_list[i++] = inp;
        }

-       splx(s);

        n = i;
 
        error = 0;
        for (i = 0; i < n; i++) {
                inp = inp_list[i];
        n = i;
 
        error = 0;
        for (i = 0; i < n; i++) {
                inp = inp_list[i];

-               if (inp->inp_gencnt <= gencnt) {
+               if (inp->inp_gencnt <= gencnt && inp->inp_state != INPCB_STATE_DEAD) {

                        struct xinpcb xi;
                        struct xinpcb xi;

+
+                       bzero(&xi, sizeof(xi));

                        xi.xi_len = sizeof xi;
                        /* XXX should avoid extra copy */
                        xi.xi_len = sizeof xi;
                        /* XXX should avoid extra copy */

-                       bcopy(inp, &xi.xi_inp, sizeof *inp);
+                       inpcb_to_compat(inp, &xi.xi_inp);

                        if (inp->inp_socket)
                                sotoxsocket(inp->inp_socket, &xi.xi_socket);
                        error = SYSCTL_OUT(req, &xi, sizeof xi);
                        if (inp->inp_socket)
                                sotoxsocket(inp->inp_socket, &xi.xi_socket);
                        error = SYSCTL_OUT(req, &xi, sizeof xi);


@@ -702,14 +869,15 @@ udp_pcblist SYSCTL_HANDLER_ARGS
                 * while we were processing this request, and it
                 * might be necessary to retry.
                 */
                 * while we were processing this request, and it
                 * might be necessary to retry.
                 */

-               s = splnet();
+               bzero(&xig, sizeof(xig));
+               xig.xig_len = sizeof xig;

                xig.xig_gen = udbinfo.ipi_gencnt;
                xig.xig_sogen = so_gencnt;
                xig.xig_count = udbinfo.ipi_count;
                xig.xig_gen = udbinfo.ipi_gencnt;
                xig.xig_sogen = so_gencnt;
                xig.xig_count = udbinfo.ipi_count;

-               splx(s);

                error = SYSCTL_OUT(req, &xig, sizeof xig);
        }
        FREE(inp_list, M_TEMP);
                error = SYSCTL_OUT(req, &xig, sizeof xig);
        }
        FREE(inp_list, M_TEMP);

+       lck_rw_done(udbinfo.mtx);

        return error;
 }
 
        return error;
 }
 


@@ -718,6 +886,21 @@ SYSCTL_PROC(_net_inet_udp, UDPCTL_PCBLIST, pcblist, CTLFLAG_RD, 0, 0,
 
 
 
 
 
 

+static __inline__ u_int16_t
+get_socket_id(struct socket * s)
+{
+       u_int16_t               val;
+
+       if (s == NULL) {
+           return (0);
+       }
+       val = (u_int16_t)(((u_int32_t)s) / sizeof(struct socket));
+       if (val == 0) {
+               val = 0xffff;
+       }
+       return (val);
+}
+

 static int
 udp_output(inp, m, addr, control, p)
        register struct inpcb *inp;
 static int
 udp_output(inp, m, addr, control, p)
        register struct inpcb *inp;


@@ -728,8 +911,12 @@ udp_output(inp, m, addr, control, p)
 {
        register struct udpiphdr *ui;
        register int len = m->m_pkthdr.len;
 {
        register struct udpiphdr *ui;
        register int len = m->m_pkthdr.len;

-       struct in_addr laddr;
-       int s = 0, error = 0;
+       struct sockaddr_in *sin, src;
+       struct in_addr origladdr, laddr, faddr;
+       u_short lport, fport;
+       struct sockaddr_in *ifaddr;
+       int error = 0, udp_dodisconnect = 0;
+

 
        KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_START, 0,0,0,0,0);
 
 
        KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_START, 0,0,0,0,0);
 


@@ -745,27 +932,79 @@ udp_output(inp, m, addr, control, p)
                goto release;
        }
 
                goto release;
        }
 

+       /* If there was a routing change, discard cached route and check
+        * that we have a valid source address. 
+        * Reacquire a new source address if INADDR_ANY was specified
+        */
+
+#if 1
+        lck_mtx_assert(inp->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
+#endif
+
+       if (inp->inp_route.ro_rt && inp->inp_route.ro_rt->generation_id != route_generation) {
+               if (ifa_foraddr(inp->inp_laddr.s_addr) == 0) { /* src address is gone */
+                       if (inp->inp_flags & INP_INADDR_ANY)
+                               inp->inp_faddr.s_addr = INADDR_ANY; /* new src will be set later */
+                       else {
+                               error = EADDRNOTAVAIL;
+                               goto release;
+                       }
+               }
+               rtfree(inp->inp_route.ro_rt);
+               inp->inp_route.ro_rt = (struct rtentry *)0;
+       }
+
+       origladdr= laddr = inp->inp_laddr;
+       faddr = inp->inp_faddr;
+       lport = inp->inp_lport;
+       fport = inp->inp_fport;
+

        if (addr) {
        if (addr) {

-               laddr = inp->inp_laddr;
-               if (inp->inp_faddr.s_addr != INADDR_ANY) {
+               sin = (struct sockaddr_in *)addr;
+               if (faddr.s_addr != INADDR_ANY) {

                        error = EISCONN;
                        goto release;
                }
                        error = EISCONN;
                        goto release;
                }

-               /*
-                * Must block input while temporarily connected.
-                */
-               s = splnet();
-               error = in_pcbconnect(inp, addr, p);
-               if (error) {
-                       splx(s);
-                       goto release;
+               if (lport == 0) {
+                       /*
+                        * In case we don't have a local port set, go through the full connect.
+                        * We don't have a local port yet (ie, we can't be looked up),
+                        * so it's not an issue if the input runs at the same time we do this.
+                        */
+                       error = in_pcbconnect(inp, addr, p);
+                       if (error) {
+                               goto release;
+                       }
+                       laddr = inp->inp_laddr;
+                       lport = inp->inp_lport;
+                       faddr = inp->inp_faddr;
+                       fport = inp->inp_fport;
+                       udp_dodisconnect = 1;
+               }
+               else {  
+                       /* Fast path case
+                        * we have a full address and a local port.
+                        * use those info to build the packet without changing the pcb
+                        * and interfering with the input path. See 3851370
+                        */
+                       if (laddr.s_addr == INADDR_ANY) {
+                          if ((error = in_pcbladdr(inp, addr, &ifaddr)) != 0)
+                                  goto release;
+                          laddr = ifaddr->sin_addr;
+                          inp->inp_flags |= INP_INADDR_ANY; /* from pcbconnect: remember we don't care about src addr.*/
+                       }
+                                  
+                       faddr = sin->sin_addr;
+                       fport = sin->sin_port;

                }
        } else {
                }
        } else {

-               if (inp->inp_faddr.s_addr == INADDR_ANY) {
+               if (faddr.s_addr == INADDR_ANY) {

                        error = ENOTCONN;
                        goto release;
                }
        }
                        error = ENOTCONN;
                        goto release;
                }
        }

+
+

        /*
         * Calculate data length and get a mbuf
         * for UDP and IP headers.
        /*
         * Calculate data length and get a mbuf
         * for UDP and IP headers.


@@ -773,9 +1012,7 @@ udp_output(inp, m, addr, control, p)
        M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT);
        if (m == 0) {
                error = ENOBUFS;
        M_PREPEND(m, sizeof(struct udpiphdr), M_DONTWAIT);
        if (m == 0) {
                error = ENOBUFS;

-               if (addr)
-                       splx(s);
-               goto release;
+               goto abort;

        }
 
        /*
        }
 
        /*


@@ -785,10 +1022,10 @@ udp_output(inp, m, addr, control, p)
        ui = mtod(m, struct udpiphdr *);
        bzero(ui->ui_x1, sizeof(ui->ui_x1));    /* XXX still needed? */
        ui->ui_pr = IPPROTO_UDP;
        ui = mtod(m, struct udpiphdr *);
        bzero(ui->ui_x1, sizeof(ui->ui_x1));    /* XXX still needed? */
        ui->ui_pr = IPPROTO_UDP;

-       ui->ui_src = inp->inp_laddr;
-       ui->ui_dst = inp->inp_faddr;
-       ui->ui_sport = inp->inp_lport;
-       ui->ui_dport = inp->inp_fport;
+       ui->ui_src = laddr;
+       ui->ui_dst = faddr;
+       ui->ui_sport = lport;
+       ui->ui_dport = fport;

        ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
 
        /*
        ui->ui_ulen = htons((u_short)len + sizeof(struct udphdr));
 
        /*


@@ -813,21 +1050,27 @@ udp_output(inp, m, addr, control, p)
 #if IPSEC
        if (ipsec_bypass == 0 && ipsec_setsocket(m, inp->inp_socket) != 0) {
                error = ENOBUFS;
 #if IPSEC
        if (ipsec_bypass == 0 && ipsec_setsocket(m, inp->inp_socket) != 0) {
                error = ENOBUFS;

-               goto release;
+               goto abort;

        }
 #endif /*IPSEC*/
        }
 #endif /*IPSEC*/

-       error = ip_output(m, inp->inp_options, &inp->inp_route,
+       m->m_pkthdr.socket_id = get_socket_id(inp->inp_socket);
+       error = ip_output_list(m, 0,  inp->inp_options, &inp->inp_route,

            (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)),
            inp->inp_moptions);
 
            (inp->inp_socket->so_options & (SO_DONTROUTE | SO_BROADCAST)),
            inp->inp_moptions);
 

-       if (addr) {
+       if (udp_dodisconnect) {

                in_pcbdisconnect(inp);
                in_pcbdisconnect(inp);

-               inp->inp_laddr = laddr; /* XXX rehash? */
-               splx(s);
+               inp->inp_laddr = origladdr;     /* XXX rehash? */

        }
        KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0,0,0,0);
        return (error);
 
        }
        KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0,0,0,0);
        return (error);
 

+abort:
+        if (udp_dodisconnect) {
+                in_pcbdisconnect(inp);
+                inp->inp_laddr = origladdr; /* XXX rehash? */
+        }
+

 release:
        m_freem(m);
        KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0,0,0,0);
 release:
        m_freem(m);
        KERNEL_DEBUG(DBG_FNC_UDP_OUTPUT | DBG_FUNC_END, error, 0,0,0,0);


@@ -853,15 +1096,12 @@ static int
 udp_abort(struct socket *so)
 {
        struct inpcb *inp;
 udp_abort(struct socket *so)
 {
        struct inpcb *inp;

-       int s;

 
        inp = sotoinpcb(so);
        if (inp == 0)
 
        inp = sotoinpcb(so);
        if (inp == 0)

-               return EINVAL;  /* ??? possible? panic instead? */
+               panic("udp_abort: so=%x null inp\n", so);       /* ??? possible? panic instead? */

        soisdisconnected(so);
        soisdisconnected(so);

-       s = splnet();

        in_pcbdetach(inp);
        in_pcbdetach(inp);

-       splx(s);

        return 0;
 }
 
        return 0;
 }
 


@@ -869,20 +1109,18 @@ static int
 udp_attach(struct socket *so, int proto, struct proc *p)
 {
        struct inpcb *inp;
 udp_attach(struct socket *so, int proto, struct proc *p)
 {
        struct inpcb *inp;

-       int error; long s;
+       int error;

 
        inp = sotoinpcb(so);
        if (inp != 0)
 
        inp = sotoinpcb(so);
        if (inp != 0)

-               return EINVAL;
+               panic ("udp_attach so=%x inp=%x\n", so, inp);

 
 

-       error = soreserve(so, udp_sendspace, udp_recvspace);
-       if (error)
-               return error;
-       s = splnet();

        error = in_pcballoc(so, &udbinfo, p);
        error = in_pcballoc(so, &udbinfo, p);

-       splx(s);

        if (error)
                return error;
        if (error)
                return error;

+       error = soreserve(so, udp_sendspace, udp_recvspace);
+       if (error) 
+               return error;

        inp = (struct inpcb *)so->so_pcb;
        inp->inp_vflag |= INP_IPV4;
        inp->inp_ip_ttl = ip_defttl;
        inp = (struct inpcb *)so->so_pcb;
        inp->inp_vflag |= INP_IPV4;
        inp->inp_ip_ttl = ip_defttl;


@@ -893,14 +1131,12 @@ static int
 udp_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
 {
        struct inpcb *inp;
 udp_bind(struct socket *so, struct sockaddr *nam, struct proc *p)
 {
        struct inpcb *inp;

-       int s, error;
+       int error;

 
        inp = sotoinpcb(so);
        if (inp == 0)
                return EINVAL;
 
        inp = sotoinpcb(so);
        if (inp == 0)
                return EINVAL;

-       s = splnet();

        error = in_pcbbind(inp, nam, p);
        error = in_pcbbind(inp, nam, p);

-       splx(s);

        return error;
 }
 
        return error;
 }
 


@@ -908,17 +1144,15 @@ static int
 udp_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
 {
        struct inpcb *inp;
 udp_connect(struct socket *so, struct sockaddr *nam, struct proc *p)
 {
        struct inpcb *inp;

-       int s, error;
+       int error;

 
        inp = sotoinpcb(so);
        if (inp == 0)
                return EINVAL;
        if (inp->inp_faddr.s_addr != INADDR_ANY)
                return EISCONN;
 
        inp = sotoinpcb(so);
        if (inp == 0)
                return EINVAL;
        if (inp->inp_faddr.s_addr != INADDR_ANY)
                return EISCONN;

-       s = splnet();

        error = in_pcbconnect(inp, nam, p);
        error = in_pcbconnect(inp, nam, p);

-       splx(s);
-       if (error == 0)
+       if (error == 0) 

                soisconnected(so);
        return error;
 }
                soisconnected(so);
        return error;
 }


@@ -927,14 +1161,12 @@ static int
 udp_detach(struct socket *so)
 {
        struct inpcb *inp;
 udp_detach(struct socket *so)
 {
        struct inpcb *inp;

-       int s;

 
        inp = sotoinpcb(so);
        if (inp == 0)
 
        inp = sotoinpcb(so);
        if (inp == 0)

-               return EINVAL;
-       s = splnet();
+               panic("udp_detach: so=%x null inp\n", so);      /* ??? possible? panic instead? */

        in_pcbdetach(inp);
        in_pcbdetach(inp);

-       splx(s);
+       inp->inp_state = INPCB_STATE_DEAD;

        return 0;
 }
 
        return 0;
 }
 


@@ -942,7 +1174,6 @@ static int
 udp_disconnect(struct socket *so)
 {
        struct inpcb *inp;
 udp_disconnect(struct socket *so)
 {
        struct inpcb *inp;

-       int s;

 
        inp = sotoinpcb(so);
        if (inp == 0)
 
        inp = sotoinpcb(so);
        if (inp == 0)


@@ -950,10 +1181,8 @@ udp_disconnect(struct socket *so)
        if (inp->inp_faddr.s_addr == INADDR_ANY)
                return ENOTCONN;
 
        if (inp->inp_faddr.s_addr == INADDR_ANY)
                return ENOTCONN;
 

-       s = splnet();

        in_pcbdisconnect(inp);
        inp->inp_laddr.s_addr = INADDR_ANY;
        in_pcbdisconnect(inp);
        inp->inp_laddr.s_addr = INADDR_ANY;

-       splx(s);

        so->so_state &= ~SS_ISCONNECTED;                /* XXX */
        return 0;
 }
        so->so_state &= ~SS_ISCONNECTED;                /* XXX */
        return 0;
 }


@@ -989,6 +1218,135 @@ struct pr_usrreqs udp_usrreqs = {
        pru_connect2_notsupp, in_control, udp_detach, udp_disconnect, 
        pru_listen_notsupp, in_setpeeraddr, pru_rcvd_notsupp, 
        pru_rcvoob_notsupp, udp_send, pru_sense_null, udp_shutdown,
        pru_connect2_notsupp, in_control, udp_detach, udp_disconnect, 
        pru_listen_notsupp, in_setpeeraddr, pru_rcvd_notsupp, 
        pru_rcvoob_notsupp, udp_send, pru_sense_null, udp_shutdown,

-       in_setsockaddr, sosend, soreceive, sopoll
+       in_setsockaddr, sosend, soreceive, pru_sopoll_notsupp

 };
 
 };
 

+
+int
+udp_lock(so, refcount, debug)
+       struct socket *so;
+       int refcount, debug;
+{
+       int lr_saved;
+#ifdef __ppc__
+       if (debug == 0) {
+               __asm__ volatile("mflr %0" : "=r" (lr_saved));
+       }
+       else lr_saved = debug;
+#endif
+
+       if (so->so_pcb) {
+               lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, LCK_MTX_ASSERT_NOTOWNED);
+               lck_mtx_lock(((struct inpcb *)so->so_pcb)->inpcb_mtx);
+       }
+       else {
+               panic("udp_lock: so=%x NO PCB! lr=%x\n", so, lr_saved);
+               lck_mtx_assert(so->so_proto->pr_domain->dom_mtx, LCK_MTX_ASSERT_NOTOWNED);
+               lck_mtx_lock(so->so_proto->pr_domain->dom_mtx);
+       }
+
+       if (refcount) 
+               so->so_usecount++;
+
+       so->reserved3= lr_saved;
+       return (0);
+}
+
+int
+udp_unlock(so, refcount, debug)
+       struct socket *so;
+       int refcount;
+       int debug;
+{
+       int lr_saved;
+       struct inpcb *inp = sotoinpcb(so);
+       struct inpcbinfo *pcbinfo       = &udbinfo;
+#ifdef __ppc__
+       if (debug == 0) {
+               __asm__ volatile("mflr %0" : "=r" (lr_saved));
+       }
+       else lr_saved = debug;
+#endif
+       if (refcount) {
+               so->so_usecount--;
+#if 0
+               if (so->so_usecount == 0 && (inp->inp_wantcnt == WNT_STOPUSING)) {
+                       if (lck_rw_try_lock_exclusive(pcbinfo->mtx)) {
+                               in_pcbdispose(inp);
+                               lck_rw_done(pcbinfo->mtx);
+                               return(0);
+                       }
+               }
+#endif
+       }
+       if (so->so_pcb == NULL) {
+               panic("udp_unlock: so=%x NO PCB! lr=%x\n", so, lr_saved);
+               lck_mtx_assert(so->so_proto->pr_domain->dom_mtx, LCK_MTX_ASSERT_OWNED);
+               lck_mtx_unlock(so->so_proto->pr_domain->dom_mtx);
+       }
+       else {
+               lck_mtx_assert(((struct inpcb *)so->so_pcb)->inpcb_mtx, LCK_MTX_ASSERT_OWNED);
+               lck_mtx_unlock(((struct inpcb *)so->so_pcb)->inpcb_mtx);
+       }
+
+
+       so->reserved4 = lr_saved;
+       return (0);
+}
+
+lck_mtx_t *
+udp_getlock(so, locktype)
+       struct socket *so;
+       int locktype;
+{
+       struct inpcb *inp = sotoinpcb(so);
+
+
+       if (so->so_pcb)
+               return(inp->inpcb_mtx);
+       else {
+               panic("udp_getlock: so=%x NULL so_pcb\n", so);
+               return (so->so_proto->pr_domain->dom_mtx);
+       }
+}
+
+void
+udp_slowtimo()
+{
+       struct inpcb *inp, *inpnxt;
+       struct socket *so;
+       struct inpcbinfo *pcbinfo       = &udbinfo;
+
+       lck_rw_lock_exclusive(pcbinfo->mtx);
+
+       for (inp = udb.lh_first; inp != NULL; inp = inpnxt) {
+               inpnxt = inp->inp_list.le_next;
+       
+               /* Ignore nat/SharedIP dummy pcbs */
+               if (inp->inp_socket == &udbinfo.nat_dummy_socket)
+                               continue;
+
+               if (inp->inp_wantcnt != WNT_STOPUSING) 
+                       continue;
+
+               so = inp->inp_socket;
+               if (!lck_mtx_try_lock(inp->inpcb_mtx))  /* skip if busy, no hurry for cleanup... */
+                       continue;
+
+               if (so->so_usecount == 0)
+                       in_pcbdispose(inp);
+               else 
+                       lck_mtx_unlock(inp->inpcb_mtx);
+       }
+       lck_rw_done(pcbinfo->mtx);
+}
+
+int
+ChkAddressOK( __uint32_t dstaddr, __uint32_t srcaddr )
+{
+        if ( dstaddr == srcaddr ){
+                return 0;
+        }
+        return 1;
+}
+