Index: contrib/ipfilter/netinet/ip_fil.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/contrib/ipfilter/netinet/ip_fil.c,v
retrieving revision 1.48
diff -u -r1.48 ip_fil.c
--- contrib/ipfilter/netinet/ip_fil.c	27 Aug 2004 20:01:08 -0000	1.48
+++ contrib/ipfilter/netinet/ip_fil.c	27 Sep 2004 03:17:57 -0000
@@ -312,7 +312,8 @@
 }
 # endif
 #endif /* __NetBSD_Version >= 105110000 && _KERNEL */
-#if (__FreeBSD_version >= 501108) && defined(_KERNEL)
+#if (__FreeBSD_version >= 501108) && (__FreeBSD_version < /*XXX*/ 503001) && \
+    defined(_KERNEL)
 
 static int
 fr_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir)
@@ -331,7 +332,29 @@
 		ifp, (dir == PFIL_OUT), mp));
 }
 # endif
-#endif /* __FreeBSD_version >= 501108 */
+
+#elif (__FreeBSD_version >= /*XXX*/ 503001) && defined(_KERNEL)
+
+static int
+fr_check_wrapper(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
+{
+	struct ip *ip = mtod(*mp, struct ip *);
+	return fr_check(ip, ip->ip_hl << 2, ifp, (dir == PFIL_OUT), mp);
+}
+
+# ifdef USE_INET6
+#  include <netinet/ip6.h>
+
+static int
+fr_check_wrapper6(void *arg, struct mbuf **mp, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
+{
+	return (fr_check(mtod(*mp, struct ip *), sizeof(struct ip6_hdr),
+		ifp, (dir == PFIL_OUT), mp));
+}
+# endif
+#endif /* __FreeBSD_version >= 503001 && _KERNEL */
 #ifdef	_KERNEL
 # if	defined(IPFILTER_LKM) && !defined(__sgi)
 int iplidentify(s)
Index: contrib/pf/net/pf.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/contrib/pf/net/pf.c,v
retrieving revision 1.19
diff -u -r1.19 pf.c
--- contrib/pf/net/pf.c	11 Sep 2004 11:18:25 -0000	1.19
+++ contrib/pf/net/pf.c	27 Sep 2004 03:03:06 -0000
@@ -185,11 +185,19 @@
 int			 pf_test_tcp(struct pf_rule **, struct pf_state **,
 			    int, struct pfi_kif *, struct mbuf *, int,
 			    void *, struct pf_pdesc *, struct pf_rule **,
+#ifdef __FreeBSD__
+			    struct pf_ruleset **, struct inpcb *);
+#else
 			    struct pf_ruleset **);
+#endif
 int			 pf_test_udp(struct pf_rule **, struct pf_state **,
 			    int, struct pfi_kif *, struct mbuf *, int,
 			    void *, struct pf_pdesc *, struct pf_rule **,
+#ifdef __FreeBSD__
+			    struct pf_ruleset **, struct inpcb *);
+#else
 			    struct pf_ruleset **);
+#endif
 int			 pf_test_icmp(struct pf_rule **, struct pf_state **,
 			    int, struct pfi_kif *, struct mbuf *, int,
 			    void *, struct pf_pdesc *, struct pf_rule **,
@@ -229,8 +237,13 @@
 			    struct ifnet *, struct pf_state *);
 void			 pf_route6(struct mbuf **, struct pf_rule *, int,
 			    struct ifnet *, struct pf_state *);
+#ifdef __FreeBSD__
+int			 pf_socket_lookup(uid_t *, gid_t *,
+			    int, struct pf_pdesc *, struct inpcb *);
+#else
 int			 pf_socket_lookup(uid_t *, gid_t *,
 			    int, struct pf_pdesc *);
+#endif
 u_int8_t		 pf_get_wscale(struct mbuf *, int, u_int16_t,
 			    sa_family_t);
 u_int16_t		 pf_get_mss(struct mbuf *, int, u_int16_t,
@@ -2376,7 +2389,12 @@
 }
 
 int
+#ifdef __FreeBSD__
+pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, struct pf_pdesc *pd,
+    struct inpcb *inp_arg)
+#else
 pf_socket_lookup(uid_t *uid, gid_t *gid, int direction, struct pf_pdesc *pd)
+#endif
 {
 	struct pf_addr		*saddr, *daddr;
 	u_int16_t		 sport, dport;
@@ -2389,6 +2407,16 @@
 
 	*uid = UID_MAX;
 	*gid = GID_MAX;
+#ifdef __FreeBSD__
+	if (inp_arg != NULL) {
+		if (inp_arg->inp_socket) {
+			*uid = inp_arg->inp_socket->so_cred->cr_uid;
+			*gid = inp_arg->inp_socket->so_cred->cr_groups[0];
+			return (1);
+		} else
+			return (0);
+	}
+#endif
 	switch (pd->proto) {
 	case IPPROTO_TCP:
 		sport = pd->hdr.tcp->th_sport;
@@ -2663,7 +2691,12 @@
 int
 pf_test_tcp(struct pf_rule **rm, struct pf_state **sm, int direction,
     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
+#ifdef __FreeBSD__
+    struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
+    struct inpcb *inp)
+#else
     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm)
+#endif
 {
 	struct pf_rule		*nr = NULL;
 	struct pf_addr		*saddr = pd->src, *daddr = pd->dst;
@@ -2742,12 +2775,20 @@
 		else if ((r->flagset & th->th_flags) != r->flags)
 			r = TAILQ_NEXT(r, entries);
 		else if (r->uid.op && (lookup != -1 || (lookup =
+#ifdef __FreeBSD__
+		    pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) &&
+#else
 		    pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
+#endif
 		    !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
 		    uid))
 			r = TAILQ_NEXT(r, entries);
 		else if (r->gid.op && (lookup != -1 || (lookup =
+#ifdef __FreeBSD__
+		    pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) &&
+#else
 		    pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
+#endif
 		    !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
 		    gid))
 			r = TAILQ_NEXT(r, entries);
@@ -3023,7 +3064,12 @@
 int
 pf_test_udp(struct pf_rule **rm, struct pf_state **sm, int direction,
     struct pfi_kif *kif, struct mbuf *m, int off, void *h,
+#ifdef __FreeBSD__
+    struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm,
+    struct inpcb *inp)
+#else
     struct pf_pdesc *pd, struct pf_rule **am, struct pf_ruleset **rsm)
+#endif
 {
 	struct pf_rule		*nr = NULL;
 	struct pf_addr		*saddr = pd->src, *daddr = pd->dst;
@@ -3099,12 +3145,20 @@
 		else if (r->rule_flag & PFRULE_FRAGMENT)
 			r = TAILQ_NEXT(r, entries);
 		else if (r->uid.op && (lookup != -1 || (lookup =
+#ifdef __FreeBSD__
+		    pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) &&
+#else
 		    pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
+#endif
 		    !pf_match_uid(r->uid.op, r->uid.uid[0], r->uid.uid[1],
 		    uid))
 			r = TAILQ_NEXT(r, entries);
 		else if (r->gid.op && (lookup != -1 || (lookup =
+#ifdef __FreeBSD__
+		    pf_socket_lookup(&uid, &gid, direction, pd, inp), 1)) &&
+#else
 		    pf_socket_lookup(&uid, &gid, direction, pd), 1)) &&
+#endif
 		    !pf_match_gid(r->gid.op, r->gid.gid[0], r->gid.gid[1],
 		    gid))
 			r = TAILQ_NEXT(r, entries);
@@ -5229,7 +5283,7 @@
 	if (oifp != ifp) {
 #ifdef __FreeBSD__
 		PF_UNLOCK();
-		if (pf_test(PF_OUT, ifp, &m0) != PF_PASS) {
+		if (pf_test(PF_OUT, ifp, &m0, NULL) != PF_PASS) {
 			PF_LOCK();
 			goto bad;
 		} else if (m0 == NULL) {
@@ -5519,7 +5573,7 @@
 	if (oifp != ifp) {
 #ifdef __FreeBSD__
 		PF_UNLOCK();
-		if (pf_test6(PF_OUT, ifp, &m0) != PF_PASS) {
+		if (pf_test6(PF_OUT, ifp, &m0, NULL) != PF_PASS) {
 			PF_LOCK();
 			goto bad;
 		} else if (m0 == NULL) {
@@ -5811,7 +5865,11 @@
 
 #ifdef INET
 int
+#ifdef __FreeBSD__
+pf_test(int dir, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
+#else
 pf_test(int dir, struct ifnet *ifp, struct mbuf **m0)
+#endif
 {
 	struct pfi_kif		*kif;
 	u_short			 action, reason = 0, log = 0;
@@ -5925,8 +5983,13 @@
 			a = s->anchor.ptr;
 			log = s->log;
 		} else if (s == NULL)
+#ifdef __FreeBSD__
+			action = pf_test_tcp(&r, &s, dir, kif,
+			    m, off, h, &pd, &a, &ruleset, inp);
+#else
 			action = pf_test_tcp(&r, &s, dir, kif,
 			    m, off, h, &pd, &a, &ruleset);
+#endif
 		break;
 	}
 
@@ -5959,8 +6022,13 @@
 			a = s->anchor.ptr;
 			log = s->log;
 		} else if (s == NULL)
+#ifdef __FreeBSD__
+			action = pf_test_udp(&r, &s, dir, kif,
+			    m, off, h, &pd, &a, &ruleset, inp);
+#else
 			action = pf_test_udp(&r, &s, dir, kif,
 			    m, off, h, &pd, &a, &ruleset);
+#endif
 		break;
 	}
 
@@ -6137,7 +6205,11 @@
 
 #ifdef INET6
 int
+#ifdef __FreeBSD__
+pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0, struct inpcb *inp)
+#else
 pf_test6(int dir, struct ifnet *ifp, struct mbuf **m0)
+#endif
 {
 	struct pfi_kif		*kif;
 	u_short			 action, reason = 0, log = 0;
@@ -6274,8 +6346,13 @@
 			a = s->anchor.ptr;
 			log = s->log;
 		} else if (s == NULL)
+#ifdef __FreeBSD__
+			action = pf_test_tcp(&r, &s, dir, kif,
+			    m, off, h, &pd, &a, &ruleset, inp);
+#else
 			action = pf_test_tcp(&r, &s, dir, kif,
 			    m, off, h, &pd, &a, &ruleset);
+#endif
 		break;
 	}
 
@@ -6308,8 +6385,13 @@
 			a = s->anchor.ptr;
 			log = s->log;
 		} else if (s == NULL)
+#ifdef __FreeBSD__
+			action = pf_test_udp(&r, &s, dir, kif,
+			    m, off, h, &pd, &a, &ruleset, inp);
+#else
 			action = pf_test_udp(&r, &s, dir, kif,
 			    m, off, h, &pd, &a, &ruleset);
+#endif
 		break;
 	}
 
Index: contrib/pf/net/pf_ioctl.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/contrib/pf/net/pf_ioctl.c,v
retrieving revision 1.15
diff -u -r1.15 pf_ioctl.c
--- contrib/pf/net/pf_ioctl.c	17 Sep 2004 02:15:05 -0000	1.15
+++ contrib/pf/net/pf_ioctl.c	27 Sep 2004 02:48:49 -0000
@@ -182,14 +182,14 @@
  * Wrapper functions for pfil(9) hooks
  */
 static int pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp,
-		int dir);
+		int dir, struct inpcb *inp);
 static int pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp,
-		int dir);
+		int dir, struct inpcb *inp);
 #ifdef INET6
 static int pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp,
-		int dir);
+		int dir, struct inpcb *inp);
 static int pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp,
-		int dir);
+		int dir, struct inpcb *inp);
 #endif
 
 static int 		 hook_pf(void);
@@ -3203,7 +3203,8 @@
 }
 
 static int
-pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
+pf_check_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
 {
 	/*
 	 * XXX Wed Jul 9 22:03:16 2003 UTC
@@ -3222,7 +3223,7 @@
 	        HTONS(h->ip_len);
 	        HTONS(h->ip_off);
 	}
-	chk = pf_test(PF_IN, ifp, m);
+	chk = pf_test(PF_IN, ifp, m, inp);
 	if (chk && *m) {
 		m_freem(*m);
 		*m = NULL;
@@ -3237,7 +3238,8 @@
 }
 
 static int
-pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
+pf_check_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
 {
 	/*
 	 * XXX Wed Jul 9 22:03:16 2003 UTC
@@ -3261,7 +3263,7 @@
 	        HTONS(h->ip_len);
 	        HTONS(h->ip_off);
 	}
-	chk = pf_test(PF_OUT, ifp, m);
+	chk = pf_test(PF_OUT, ifp, m, inp);
 	if (chk && *m) {
 		m_freem(*m);
 		*m = NULL;
@@ -3277,14 +3279,15 @@
 
 #ifdef INET6
 static int
-pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
+pf_check6_in(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
 {
 	/*
 	 * IPv6 does not affected ip_len/ip_off byte order changes.
 	 */
 	int chk;
 
-	chk = pf_test6(PF_IN, ifp, m);
+	chk = pf_test6(PF_IN, ifp, m, inp);
 	if (chk && *m) {
 		m_freem(*m);
 		*m = NULL;
@@ -3293,7 +3296,8 @@
 }
 
 static int
-pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir)
+pf_check6_out(void *arg, struct mbuf **m, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
 {
 	/*
 	 * IPv6 does not affected ip_len/ip_off byte order changes.
@@ -3305,7 +3309,7 @@
 		in_delayed_cksum(*m);
 		(*m)->m_pkthdr.csum_flags &= ~CSUM_DELAY_DATA;
 	}
-	chk = pf_test6(PF_OUT, ifp, m);
+	chk = pf_test6(PF_OUT, ifp, m, inp);
 	if (chk && *m) {
 		m_freem(*m);
 		*m = NULL;
Index: contrib/pf/net/pfvar.h
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/contrib/pf/net/pfvar.h,v
retrieving revision 1.9
diff -u -r1.9 pfvar.h
--- contrib/pf/net/pfvar.h	23 Sep 2004 12:44:40 -0000	1.9
+++ contrib/pf/net/pfvar.h	27 Sep 2004 02:48:49 -0000
@@ -54,6 +54,9 @@
 #include <netinet/tcp_fsm.h>
 
 struct ip;
+#ifdef __FreeBSD__
+struct inpcb;
+#endif
 
 #define	PF_TCPS_PROXY_SRC	((TCP_NSTATES)+0)
 #define	PF_TCPS_PROXY_DST	((TCP_NSTATES)+1)
@@ -1453,11 +1456,19 @@
 				    struct pf_rule *);
 
 #ifdef INET
+#ifdef __FreeBSD__
+int	pf_test(int, struct ifnet *, struct mbuf **, struct inpcb *);
+#else
 int	pf_test(int, struct ifnet *, struct mbuf **);
+#endif
 #endif /* INET */
 
 #ifdef INET6
+#ifdef __FreeBSD__
+int	pf_test6(int, struct ifnet *, struct mbuf **, struct inpcb *);
+#else
 int	pf_test6(int, struct ifnet *, struct mbuf **);
+#endif
 void	pf_poolmask(struct pf_addr *, struct pf_addr*,
 	    struct pf_addr *, struct pf_addr *, u_int8_t);
 void	pf_addr_inc(struct pf_addr *, sa_family_t);
Index: net/bridge.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/net/bridge.c,v
retrieving revision 1.83
diff -u -r1.83 bridge.c
--- net/bridge.c	27 Aug 2004 15:16:22 -0000	1.83
+++ net/bridge.c	27 Sep 2004 02:46:58 -0000
@@ -1009,7 +1009,7 @@
 	    ip->ip_len = ntohs(ip->ip_len);
 	    ip->ip_off = ntohs(ip->ip_off);
 
-	    if (pfil_run_hooks(&inet_pfil_hook, &m0, src, PFIL_IN) != 0) {
+	    if (pfil_run_hooks(&inet_pfil_hook, &m0, src, PFIL_IN, NULL) != 0) {
 		/* NB: hook should consume packet */
 		return NULL;
 	    }
Index: net/pfil.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/net/pfil.c,v
retrieving revision 1.9
diff -u -r1.9 pfil.c
--- net/pfil.c	22 Sep 2004 20:55:56 -0000	1.9
+++ net/pfil.c	27 Sep 2004 02:46:58 -0000
@@ -52,7 +52,7 @@
 static int pfil_list_add(pfil_list_t *, struct packet_filter_hook *, int);
 
 static int pfil_list_remove(pfil_list_t *,
-    int (*)(void *, struct mbuf **, struct ifnet *, int), void *);
+    int (*)(void *, struct mbuf **, struct ifnet *, int, struct inpcb *), void *);
 
 LIST_HEAD(, pfil_head) pfil_head_list =
     LIST_HEAD_INITIALIZER(&pfil_head_list);
@@ -113,7 +113,7 @@
  */
 int
 pfil_run_hooks(struct pfil_head *ph, struct mbuf **mp, struct ifnet *ifp,
-    int dir)
+    int dir, struct inpcb *inp)
 {
 	struct packet_filter_hook *pfh;
 	struct mbuf *m = *mp;
@@ -126,7 +126,7 @@
 	for (pfh = pfil_hook_get(dir, ph); pfh != NULL;
 	     pfh = TAILQ_NEXT(pfh, pfil_link)) {
 		if (pfh->pfil_func != NULL) {
-			rv = (*pfh->pfil_func)(pfh->pfil_arg, &m, ifp, dir);
+			rv = (*pfh->pfil_func)(pfh->pfil_arg, &m, ifp, dir, inp);
 			if (rv != 0 || m == NULL)
 				break;
 		}
@@ -233,7 +233,7 @@
  *	PFIL_WAITOK	OK to call malloc with M_WAITOK.
  */
 int
-pfil_add_hook(int (*func)(void *, struct mbuf **, struct ifnet *, int),
+pfil_add_hook(int (*func)(void *, struct mbuf **, struct ifnet *, int, struct inpcb *),
     void *arg, int flags, struct pfil_head *ph)
 {
 	struct packet_filter_hook *pfh1 = NULL;
@@ -305,7 +305,7 @@
  * hook list.
  */
 int
-pfil_remove_hook(int (*func)(void *, struct mbuf **, struct ifnet *, int),
+pfil_remove_hook(int (*func)(void *, struct mbuf **, struct ifnet *, int, struct inpcb *),
     void *arg, int flags, struct pfil_head *ph)
 {
 	int err = 0;
@@ -361,7 +361,7 @@
  */
 static int
 pfil_list_remove(pfil_list_t *list,
-    int (*func)(void *, struct mbuf **, struct ifnet *, int), void *arg)
+    int (*func)(void *, struct mbuf **, struct ifnet *, int, struct inpcb *), void *arg)
 {
 	struct packet_filter_hook *pfh;
 
Index: net/pfil.h
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/net/pfil.h,v
retrieving revision 1.11
diff -u -r1.11 pfil.h
--- net/pfil.h	19 Jun 2004 14:58:34 -0000	1.11
+++ net/pfil.h	27 Sep 2004 02:46:58 -0000
@@ -40,6 +40,7 @@
 
 struct mbuf;
 struct ifnet;
+struct inpcb;
 
 /*
  * The packet filter hooks are designed for anything to call them to
@@ -47,7 +48,7 @@
  */
 struct packet_filter_hook {
         TAILQ_ENTRY(packet_filter_hook) pfil_link;
-	int	(*pfil_func)(void *, struct mbuf **, struct ifnet *, int);
+	int	(*pfil_func)(void *, struct mbuf **, struct ifnet *, int, struct inpcb *);
 	void	*pfil_arg;
 	int	pfil_flags;
 };
@@ -84,12 +85,12 @@
 };
 
 int	pfil_run_hooks(struct pfil_head *, struct mbuf **, struct ifnet *,
-	    int);
+	    int, struct inpcb *inp);
 
 int	pfil_add_hook(int (*func)(void *, struct mbuf **,
-	    struct ifnet *, int), void *, int, struct pfil_head *);
+	    struct ifnet *, int, struct inpcb *), void *, int, struct pfil_head *);
 int	pfil_remove_hook(int (*func)(void *, struct mbuf **,
-	    struct ifnet *, int), void *, int, struct pfil_head *);
+	    struct ifnet *, int, struct inpcb *), void *, int, struct pfil_head *);
 
 int	pfil_head_register(struct pfil_head *);
 int	pfil_head_unregister(struct pfil_head *);
Index: netinet/ip_fastfwd.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet/ip_fastfwd.c,v
retrieving revision 1.20
diff -u -r1.20 ip_fastfwd.c
--- netinet/ip_fastfwd.c	13 Sep 2004 17:01:53 -0000	1.20
+++ netinet/ip_fastfwd.c	27 Sep 2004 02:46:58 -0000
@@ -359,7 +359,7 @@
 	if (inet_pfil_hook.ph_busy_count == -1)
 		goto passin;
 
-	if (pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN) ||
+	if (pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN, NULL) ||
 	    m == NULL)
 		return 1;
 
@@ -437,7 +437,7 @@
 	if (inet_pfil_hook.ph_busy_count == -1)
 		goto passout;
 
-	if (pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT) || m == NULL) {
+	if (pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT, NULL) || m == NULL) {
 		goto consumed;
 	}
 
Index: netinet/ip_fw.h
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet/ip_fw.h,v
retrieving revision 1.90
diff -u -r1.90 ip_fw.h
--- netinet/ip_fw.h	19 Aug 2004 17:38:47 -0000	1.90
+++ netinet/ip_fw.h	27 Sep 2004 02:46:58 -0000
@@ -425,6 +425,7 @@
 
 	struct ipfw_flow_id f_id;	/* grabbed from IP header	*/
 	u_int32_t	retval;
+	struct inpcb	*inp;
 };
 
 /*
@@ -435,8 +436,8 @@
 struct sockopt;
 struct dn_flow_set;
 
-int ipfw_check_in(void *, struct mbuf **, struct ifnet *, int);
-int ipfw_check_out(void *, struct mbuf **, struct ifnet *, int);
+int ipfw_check_in(void *, struct mbuf **, struct ifnet *, int, struct inpcb *inp);
+int ipfw_check_out(void *, struct mbuf **, struct ifnet *, int, struct inpcb *inp);
 
 int ipfw_chk(struct ip_fw_args *);
 
Index: netinet/ip_fw2.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet/ip_fw2.c,v
retrieving revision 1.76
diff -u -r1.76 ip_fw2.c
--- netinet/ip_fw2.c	13 Sep 2004 19:27:23 -0000	1.76
+++ netinet/ip_fw2.c	27 Sep 2004 02:46:58 -0000
@@ -1533,20 +1533,47 @@
 }
 
 static int
+fill_ugid_cache(struct inpcb *inp, struct ip_fw_ugid *ugp)
+{
+	struct ucred *cr;
+
+	if (inp->inp_socket != NULL) {
+		cr = inp->inp_socket->so_cred;
+		ugp->fw_prid = jailed(cr) ?
+		    cr->cr_prison->pr_id : -1;
+		ugp->fw_uid = cr->cr_uid;
+		ugp->fw_ngroups = cr->cr_ngroups;
+		bcopy(cr->cr_groups, ugp->fw_groups,
+		    sizeof(ugp->fw_groups));
+	}
+	return (0);
+}
+
+static int
 check_uidgid(ipfw_insn_u32 *insn,
 	int proto, struct ifnet *oif,
 	struct in_addr dst_ip, u_int16_t dst_port,
 	struct in_addr src_ip, u_int16_t src_port,
-	struct ip_fw_ugid *ugp, int *lookup)
+	struct ip_fw_ugid *ugp, int *lookup, struct inpcb *inp)
 {
 	struct inpcbinfo *pi;
 	int wildcard;
 	struct inpcb *pcb;
 	int match;
-	struct ucred *cr;
 	gid_t *gp;
 
 	/*
+	 * Check to see if the UDP or TCP stack supplied us with
+	 * the PCB. If so, rather then holding a lock and looking
+	 * up the PCB, we can use the one that was supplied.
+	 */
+	if (inp && *lookup == 0) {
+		if (inp->inp_socket != NULL) {
+			fill_ugid_cache(inp, ugp);
+			*lookup = 1;
+		}
+	}
+	/*
 	 * If we have already been here and the packet has no
 	 * PCB entry associated with it, then we can safely
 	 * assume that this is a no match.
@@ -1563,7 +1590,7 @@
 		return 0;
 	match = 0;
 	if (*lookup == 0) {
-		INP_INFO_RLOCK(pi);	/* XXX LOR with IPFW */
+		INP_INFO_RLOCK(pi);
 		pcb =  (oif) ?
 			in_pcblookup_hash(pi,
 				dst_ip, htons(dst_port),
@@ -1576,13 +1603,7 @@
 		if (pcb != NULL) {
 			INP_LOCK(pcb);
 			if (pcb->inp_socket != NULL) {
-				cr = pcb->inp_socket->so_cred;
-				ugp->fw_prid = jailed(cr) ?
-				    cr->cr_prison->pr_id : -1;
-				ugp->fw_uid = cr->cr_uid;
-				ugp->fw_ngroups = cr->cr_ngroups;
-				bcopy(cr->cr_groups, ugp->fw_groups,
-					sizeof(ugp->fw_groups));
+				fill_ugid_cache(pcb, ugp);
 				*lookup = 1;
 			}
 			INP_UNLOCK(pcb);
@@ -1932,13 +1953,13 @@
 				if (offset!=0)
 					break;
 				if (proto == IPPROTO_TCP ||
-				    proto == IPPROTO_UDP)
+				    proto == IPPROTO_UDP) 
 					match = check_uidgid(
 						    (ipfw_insn_u32 *)cmd,
 						    proto, oif,
 						    dst_ip, dst_port,
 						    src_ip, src_port, &fw_ugid_cache,
-						    &ugid_lookup);
+						    &ugid_lookup, args->inp);
 				break;
 
 			case O_RECV:
Index: netinet/ip_fw_pfil.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet/ip_fw_pfil.c,v
retrieving revision 1.9
diff -u -r1.9 ip_fw_pfil.c
--- netinet/ip_fw_pfil.c	13 Sep 2004 19:20:14 -0000	1.9
+++ netinet/ip_fw_pfil.c	27 Sep 2004 02:46:58 -0000
@@ -73,7 +73,8 @@
 static int	ipfw_divert(struct mbuf **, int, int);
 
 int
-ipfw_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
+ipfw_check_in(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
 {
 	struct ip_fw_args args;
 	struct m_tag *dn_tag;
@@ -102,6 +103,7 @@
 
 again:
 	args.m = *m0;
+	args.inp = inp;
 	ipfw = ipfw_chk(&args);
 	*m0 = args.m;
 
@@ -156,7 +158,8 @@
 }
 
 int
-ipfw_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir)
+ipfw_check_out(void *arg, struct mbuf **m0, struct ifnet *ifp, int dir,
+    struct inpcb *inp)
 {
 	struct ip_fw_args args;
 	struct m_tag *dn_tag;
@@ -186,6 +189,7 @@
 again:
 	args.m = *m0;
 	args.oif = ifp;
+	args.inp = inp;
 	ipfw = ipfw_chk(&args);
 	*m0 = args.m;
 
Index: netinet/ip_input.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet/ip_input.c,v
retrieving revision 1.290
diff -u -r1.290 ip_input.c
--- netinet/ip_input.c	24 Sep 2004 12:18:40 -0000	1.290
+++ netinet/ip_input.c	27 Sep 2004 02:46:58 -0000
@@ -437,7 +437,7 @@
 
 	odst = ip->ip_dst;
 	if (pfil_run_hooks(&inet_pfil_hook, &m, m->m_pkthdr.rcvif,
-	    PFIL_IN) != 0)
+	    PFIL_IN, NULL) != 0)
 		return;
 	if (m == NULL)			/* consumed by filter */
 		return;
Index: netinet/ip_output.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet/ip_output.c,v
retrieving revision 1.231
diff -u -r1.231 ip_output.c
--- netinet/ip_output.c	13 Sep 2004 17:09:06 -0000	1.231
+++ netinet/ip_output.c	27 Sep 2004 02:46:58 -0000
@@ -662,7 +662,7 @@
 
 	/* Run through list of hooks for output packets. */
 	odst.s_addr = ip->ip_dst.s_addr;
-	error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT);
+	error = pfil_run_hooks(&inet_pfil_hook, &m, ifp, PFIL_OUT, inp);
 	if (error != 0 || m == NULL)
 		goto done;
 
Index: netinet6/ip6_forward.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet6/ip6_forward.c,v
retrieving revision 1.26
diff -u -r1.26 ip6_forward.c
--- netinet6/ip6_forward.c	27 Aug 2004 15:16:23 -0000	1.26
+++ netinet6/ip6_forward.c	27 Sep 2004 02:46:58 -0000
@@ -580,7 +580,7 @@
 		goto pass;
 
 	/* Run through list of hooks for output packets. */
-	error = pfil_run_hooks(&inet6_pfil_hook, &m, rt->rt_ifp, PFIL_OUT);
+	error = pfil_run_hooks(&inet6_pfil_hook, &m, rt->rt_ifp, PFIL_OUT, NULL);
 	if (error != 0)
 		goto senderr;
 	if (m == NULL)
Index: netinet6/ip6_input.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet6/ip6_input.c,v
retrieving revision 1.77
diff -u -r1.77 ip6_input.c
--- netinet6/ip6_input.c	27 Aug 2004 15:16:23 -0000	1.77
+++ netinet6/ip6_input.c	27 Sep 2004 02:46:58 -0000
@@ -424,7 +424,7 @@
 	if (inet6_pfil_hook.ph_busy_count == -1)
 		goto passin;
 
-	if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN))
+	if (pfil_run_hooks(&inet6_pfil_hook, &m, m->m_pkthdr.rcvif, PFIL_IN, NULL))
 		return;
 	if (m == NULL)			/* consumed by filter */
 		return;
Index: netinet6/ip6_output.c
===================================================================
RCS file: /usr/store/mlaier/fcvs/src/sys/netinet6/ip6_output.c,v
retrieving revision 1.83
diff -u -r1.83 ip6_output.c
--- netinet6/ip6_output.c	27 Aug 2004 15:16:23 -0000	1.83
+++ netinet6/ip6_output.c	27 Sep 2004 02:46:58 -0000
@@ -938,7 +938,7 @@
 		goto passout;
 
 	/* Run through list of hooks for output packets. */
-	error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT);
+	error = pfil_run_hooks(&inet6_pfil_hook, &m, ifp, PFIL_OUT, inp);
 	if (error != 0 || m == NULL)
 		goto done;
 	ip6 = mtod(m, struct ip6_hdr *);