diff --git a/internal/quic/conn.go b/internal/quic/conn.go
index 020bc81a4..5738b6dbb 100644
--- a/internal/quic/conn.go
+++ b/internal/quic/conn.go
@@ -25,6 +25,7 @@ type Conn struct {
 	config    *Config
 	testHooks connTestHooks
 	peerAddr  netip.AddrPort
+	localAddr netip.AddrPort
 
 	msgc  chan any
 	donec chan struct{} // closed when conn loop exits
@@ -97,7 +98,7 @@ func newConn(now time.Time, side connSide, cids newServerConnIDs, peerAddr netip
 		side:                 side,
 		endpoint:             e,
 		config:               config,
-		peerAddr:             peerAddr,
+		peerAddr:             unmapAddrPort(peerAddr),
 		msgc:                 make(chan any, 1),
 		donec:                make(chan struct{}),
 		peerAckDelayExponent: -1,
@@ -317,7 +318,11 @@ func (c *Conn) loop(now time.Time) {
 		}
 		switch m := m.(type) {
 		case *datagram:
-			c.handleDatagram(now, m)
+			if !c.handleDatagram(now, m) {
+				if c.logEnabled(QLogLevelPacket) {
+					c.logPacketDropped(m)
+				}
+			}
 			m.recycle()
 		case timerEvent:
 			// A connection timer has expired.
diff --git a/internal/quic/conn_recv.go b/internal/quic/conn_recv.go
index 1b3219723..c8d70d85c 100644
--- a/internal/quic/conn_recv.go
+++ b/internal/quic/conn_recv.go
@@ -8,17 +8,33 @@ package quic
 
 import (
 	"bytes"
-	"context"
 	"encoding/binary"
 	"errors"
 	"time"
 )
 
-func (c *Conn) handleDatagram(now time.Time, dgram *datagram) {
+func (c *Conn) handleDatagram(now time.Time, dgram *datagram) (handled bool) {
+	if !c.localAddr.IsValid() {
+		// We don't have any way to tell in the general case what address we're
+		// sending packets from. Set our address from the destination address of
+		// the first packet received from the peer.
+		c.localAddr = dgram.localAddr
+	}
+	if dgram.peerAddr.IsValid() && dgram.peerAddr != c.peerAddr {
+		if c.side == clientSide {
+			// "If a client receives packets from an unknown server address,
+			// the client MUST discard these packets."
+			// https://www.rfc-editor.org/rfc/rfc9000#section-9-6
+			return false
+		}
+		// We currently don't support connection migration,
+		// so for now the server also drops packets from an unknown address.
+		return false
+	}
 	buf := dgram.b
 	c.loss.datagramReceived(now, len(buf))
 	if c.isDraining() {
-		return
+		return false
 	}
 	for len(buf) > 0 {
 		var n int
@@ -28,7 +44,7 @@ func (c *Conn) handleDatagram(now time.Time, dgram *datagram) {
 			if c.side == serverSide && len(dgram.b) < paddedInitialDatagramSize {
 				// Discard client-sent Initial packets in too-short datagrams.
 				// https://www.rfc-editor.org/rfc/rfc9000#section-14.1-4
-				return
+				return false
 			}
 			n = c.handleLongHeader(now, ptype, initialSpace, c.keysInitial.r, buf)
 		case packetTypeHandshake:
@@ -37,10 +53,10 @@ func (c *Conn) handleDatagram(now time.Time, dgram *datagram) {
 			n = c.handle1RTT(now, buf)
 		case packetTypeRetry:
 			c.handleRetry(now, buf)
-			return
+			return true
 		case packetTypeVersionNegotiation:
 			c.handleVersionNegotiation(now, buf)
-			return
+			return true
 		default:
 			n = -1
 		}
@@ -58,20 +74,16 @@ func (c *Conn) handleDatagram(now time.Time, dgram *datagram) {
 				var token statelessResetToken
 				copy(token[:], buf[len(buf)-len(token):])
 				if c.handleStatelessReset(now, token) {
-					return
+					return true
 				}
 			}
 			// Invalid data at the end of a datagram is ignored.
-			if c.logEnabled(QLogLevelPacket) {
-				c.log.LogAttrs(context.Background(), QLogLevelPacket,
-					"connectivity:packet_dropped",
-				)
-			}
-			break
+			return false
 		}
 		c.idleHandlePacketReceived(now)
 		buf = buf[n:]
 	}
+	return true
 }
 
 func (c *Conn) handleLongHeader(now time.Time, ptype packetType, space numberSpace, k fixedKeys, buf []byte) int {
diff --git a/internal/quic/conn_send.go b/internal/quic/conn_send.go
index 575b8f9b4..12bcfe308 100644
--- a/internal/quic/conn_send.go
+++ b/internal/quic/conn_send.go
@@ -179,7 +179,10 @@ func (c *Conn) maybeSend(now time.Time) (next time.Time) {
 			}
 		}
 
-		c.endpoint.sendDatagram(buf, c.peerAddr)
+		c.endpoint.sendDatagram(datagram{
+			b:        buf,
+			peerAddr: c.peerAddr,
+		})
 	}
 }
 
diff --git a/internal/quic/conn_test.go b/internal/quic/conn_test.go
index 2d3c946d6..a8f3fc7fd 100644
--- a/internal/quic/conn_test.go
+++ b/internal/quic/conn_test.go
@@ -453,6 +453,7 @@ func (tc *testConn) writeFrames(ptype packetType, frames ...debugFrame) {
 			dstConnID:   dstConnID,
 			srcConnID:   tc.peerConnID,
 		}},
+		addr: tc.conn.peerAddr,
 	}
 	if ptype == packetTypeInitial && tc.conn.side == serverSide {
 		d.paddedSize = 1200
@@ -656,6 +657,12 @@ func (tc *testConn) wantPacket(expectation string, want *testPacket) {
 }
 
 func packetEqual(a, b *testPacket) bool {
+	if a == nil && b == nil {
+		return true
+	}
+	if a == nil || b == nil {
+		return false
+	}
 	ac := *a
 	ac.frames = nil
 	ac.header = 0
diff --git a/internal/quic/dgram.go b/internal/quic/dgram.go
index 79e6650fa..615589373 100644
--- a/internal/quic/dgram.go
+++ b/internal/quic/dgram.go
@@ -12,10 +12,25 @@ import (
 )
 
 type datagram struct {
-	b    []byte
-	addr netip.AddrPort
+	b         []byte
+	localAddr netip.AddrPort
+	peerAddr  netip.AddrPort
+	ecn       ecnBits
 }
 
+// Explicit Congestion Notification bits.
+//
+// https://www.rfc-editor.org/rfc/rfc3168.html#section-5
+type ecnBits byte
+
+const (
+	ecnMask   = 0b000000_11
+	ecnNotECT = 0b000000_00
+	ecnECT1   = 0b000000_01
+	ecnECT0   = 0b000000_10
+	ecnCE     = 0b000000_11
+)
+
 var datagramPool = sync.Pool{
 	New: func() any {
 		return &datagram{
@@ -26,7 +41,9 @@ var datagramPool = sync.Pool{
 
 func newDatagram() *datagram {
 	m := datagramPool.Get().(*datagram)
-	m.b = m.b[:cap(m.b)]
+	*m = datagram{
+		b: m.b[:cap(m.b)],
+	}
 	return m
 }
 
diff --git a/internal/quic/endpoint.go b/internal/quic/endpoint.go
index 8ed67de54..6631708b8 100644
--- a/internal/quic/endpoint.go
+++ b/internal/quic/endpoint.go
@@ -22,11 +22,11 @@ import (
 //
 // Multiple goroutines may invoke methods on an Endpoint simultaneously.
 type Endpoint struct {
-	config    *Config
-	udpConn   udpConn
-	testHooks endpointTestHooks
-	resetGen  statelessResetTokenGenerator
-	retry     retryState
+	config     *Config
+	packetConn packetConn
+	testHooks  endpointTestHooks
+	resetGen   statelessResetTokenGenerator
+	retry      retryState
 
 	acceptQueue queue[*Conn] // new inbound connections
 	connsMap    connsMap     // only accessed by the listen loop
@@ -42,13 +42,12 @@ type endpointTestHooks interface {
 	newConn(c *Conn)
 }
 
-// A udpConn is a UDP connection.
-// It is implemented by net.UDPConn.
-type udpConn interface {
+// A packetConn is the interface to sending and receiving UDP packets.
+type packetConn interface {
 	Close() error
-	LocalAddr() net.Addr
-	ReadMsgUDPAddrPort(b, control []byte) (n, controln, flags int, _ netip.AddrPort, _ error)
-	WriteToUDPAddrPort(b []byte, addr netip.AddrPort) (int, error)
+	LocalAddr() netip.AddrPort
+	Read(f func(*datagram))
+	Write(datagram) error
 }
 
 // Listen listens on a local network address.
@@ -65,13 +64,17 @@ func Listen(network, address string, config *Config) (*Endpoint, error) {
 	if err != nil {
 		return nil, err
 	}
-	return newEndpoint(udpConn, config, nil)
+	pc, err := newNetUDPConn(udpConn)
+	if err != nil {
+		return nil, err
+	}
+	return newEndpoint(pc, config, nil)
 }
 
-func newEndpoint(udpConn udpConn, config *Config, hooks endpointTestHooks) (*Endpoint, error) {
+func newEndpoint(pc packetConn, config *Config, hooks endpointTestHooks) (*Endpoint, error) {
 	e := &Endpoint{
 		config:      config,
-		udpConn:     udpConn,
+		packetConn:  pc,
 		testHooks:   hooks,
 		conns:       make(map[*Conn]struct{}),
 		acceptQueue: newQueue[*Conn](),
@@ -90,8 +93,7 @@ func newEndpoint(udpConn udpConn, config *Config, hooks endpointTestHooks) (*End
 
 // LocalAddr returns the local network address.
 func (e *Endpoint) LocalAddr() netip.AddrPort {
-	a, _ := e.udpConn.LocalAddr().(*net.UDPAddr)
-	return a.AddrPort()
+	return e.packetConn.LocalAddr()
 }
 
 // Close closes the Endpoint.
@@ -114,7 +116,7 @@ func (e *Endpoint) Close(ctx context.Context) error {
 			conns = append(conns, c)
 		}
 		if len(e.conns) == 0 {
-			e.udpConn.Close()
+			e.packetConn.Close()
 		}
 	}
 	e.connsMu.Unlock()
@@ -200,34 +202,18 @@ func (e *Endpoint) connDrained(c *Conn) {
 	defer e.connsMu.Unlock()
 	delete(e.conns, c)
 	if e.closing && len(e.conns) == 0 {
-		e.udpConn.Close()
+		e.packetConn.Close()
 	}
 }
 
 func (e *Endpoint) listen() {
 	defer close(e.closec)
-	for {
-		m := newDatagram()
-		// TODO: Read and process the ECN (explicit congestion notification) field.
-		// https://tools.ietf.org/html/draft-ietf-quic-transport-32#section-13.4
-		n, _, _, addr, err := e.udpConn.ReadMsgUDPAddrPort(m.b, nil)
-		if err != nil {
-			// The user has probably closed the endpoint.
-			// We currently don't surface errors from other causes;
-			// we could check to see if the endpoint has been closed and
-			// record the unexpected error if it has not.
-			return
-		}
-		if n == 0 {
-			continue
-		}
+	e.packetConn.Read(func(m *datagram) {
 		if e.connsMap.updateNeeded.Load() {
 			e.connsMap.applyUpdates()
 		}
-		m.addr = addr
-		m.b = m.b[:n]
 		e.handleDatagram(m)
-	}
+	})
 }
 
 func (e *Endpoint) handleDatagram(m *datagram) {
@@ -277,7 +263,7 @@ func (e *Endpoint) handleUnknownDestinationDatagram(m *datagram) {
 	// If this is a 1-RTT packet, there's nothing productive we can do with it.
 	// Send a stateless reset if possible.
 	if !isLongHeader(m.b[0]) {
-		e.maybeSendStatelessReset(m.b, m.addr)
+		e.maybeSendStatelessReset(m.b, m.peerAddr)
 		return
 	}
 	p, ok := parseGenericLongHeaderPacket(m.b)
@@ -291,7 +277,7 @@ func (e *Endpoint) handleUnknownDestinationDatagram(m *datagram) {
 		return
 	default:
 		// Unknown version.
-		e.sendVersionNegotiation(p, m.addr)
+		e.sendVersionNegotiation(p, m.peerAddr)
 		return
 	}
 	if getPacketType(m.b) != packetTypeInitial {
@@ -309,7 +295,7 @@ func (e *Endpoint) handleUnknownDestinationDatagram(m *datagram) {
 	if e.config.RequireAddressValidation {
 		var ok bool
 		cids.retrySrcConnID = p.dstConnID
-		cids.originalDstConnID, ok = e.validateInitialAddress(now, p, m.addr)
+		cids.originalDstConnID, ok = e.validateInitialAddress(now, p, m.peerAddr)
 		if !ok {
 			return
 		}
@@ -317,7 +303,7 @@ func (e *Endpoint) handleUnknownDestinationDatagram(m *datagram) {
 		cids.originalDstConnID = p.dstConnID
 	}
 	var err error
-	c, err := e.newConn(now, serverSide, cids, m.addr)
+	c, err := e.newConn(now, serverSide, cids, m.peerAddr)
 	if err != nil {
 		// The accept queue is probably full.
 		// We could send a CONNECTION_CLOSE to the peer to reject the connection.
@@ -329,7 +315,7 @@ func (e *Endpoint) handleUnknownDestinationDatagram(m *datagram) {
 	m = nil // don't recycle, sendMsg takes ownership
 }
 
-func (e *Endpoint) maybeSendStatelessReset(b []byte, addr netip.AddrPort) {
+func (e *Endpoint) maybeSendStatelessReset(b []byte, peerAddr netip.AddrPort) {
 	if !e.resetGen.canReset {
 		// Config.StatelessResetKey isn't set, so we don't send stateless resets.
 		return
@@ -370,17 +356,21 @@ func (e *Endpoint) maybeSendStatelessReset(b []byte, addr netip.AddrPort) {
 	b[0] &^= headerFormLong // clear long header bit
 	b[0] |= fixedBit        // set fixed bit
 	copy(b[len(b)-statelessResetTokenLen:], token[:])
-	e.sendDatagram(b, addr)
+	e.sendDatagram(datagram{
+		b:        b,
+		peerAddr: peerAddr,
+	})
 }
 
-func (e *Endpoint) sendVersionNegotiation(p genericLongPacket, addr netip.AddrPort) {
+func (e *Endpoint) sendVersionNegotiation(p genericLongPacket, peerAddr netip.AddrPort) {
 	m := newDatagram()
 	m.b = appendVersionNegotiation(m.b[:0], p.srcConnID, p.dstConnID, quicVersion1)
-	e.sendDatagram(m.b, addr)
+	m.peerAddr = peerAddr
+	e.sendDatagram(*m)
 	m.recycle()
 }
 
-func (e *Endpoint) sendConnectionClose(in genericLongPacket, addr netip.AddrPort, code transportError) {
+func (e *Endpoint) sendConnectionClose(in genericLongPacket, peerAddr netip.AddrPort, code transportError) {
 	keys := initialKeys(in.dstConnID, serverSide)
 	var w packetWriter
 	p := longPacket{
@@ -399,12 +389,14 @@ func (e *Endpoint) sendConnectionClose(in genericLongPacket, addr netip.AddrPort
 	if len(buf) == 0 {
 		return
 	}
-	e.sendDatagram(buf, addr)
+	e.sendDatagram(datagram{
+		b:        buf,
+		peerAddr: peerAddr,
+	})
 }
 
-func (e *Endpoint) sendDatagram(p []byte, addr netip.AddrPort) error {
-	_, err := e.udpConn.WriteToUDPAddrPort(p, addr)
-	return err
+func (e *Endpoint) sendDatagram(dgram datagram) error {
+	return e.packetConn.Write(dgram)
 }
 
 // A connsMap is an endpoint's mapping of conn ids and reset tokens to conns.
diff --git a/internal/quic/endpoint_test.go b/internal/quic/endpoint_test.go
index 6d103f061..b9fb55fb3 100644
--- a/internal/quic/endpoint_test.go
+++ b/internal/quic/endpoint_test.go
@@ -12,7 +12,6 @@ import (
 	"crypto/tls"
 	"io"
 	"log/slog"
-	"net"
 	"net/netip"
 	"testing"
 	"time"
@@ -190,13 +189,9 @@ func (te *testEndpoint) writeDatagram(d *testDatagram) {
 	for len(buf) < d.paddedSize {
 		buf = append(buf, 0)
 	}
-	addr := d.addr
-	if !addr.IsValid() {
-		addr = testClientAddr
-	}
 	te.write(&datagram{
-		b:    buf,
-		addr: addr,
+		b:        buf,
+		peerAddr: d.addr,
 	})
 }
 
@@ -303,25 +298,24 @@ func (te *testEndpointUDPConn) Close() error {
 	return nil
 }
 
-func (te *testEndpointUDPConn) LocalAddr() net.Addr {
-	return net.UDPAddrFromAddrPort(netip.MustParseAddrPort("127.0.0.1:443"))
+func (te *testEndpointUDPConn) LocalAddr() netip.AddrPort {
+	return netip.MustParseAddrPort("127.0.0.1:443")
 }
 
-func (te *testEndpointUDPConn) ReadMsgUDPAddrPort(b, control []byte) (n, controln, flags int, _ netip.AddrPort, _ error) {
+func (te *testEndpointUDPConn) Read(f func(*datagram)) {
 	for {
 		select {
 		case d, ok := <-te.recvc:
 			if !ok {
-				return 0, 0, 0, netip.AddrPort{}, io.EOF
+				return
 			}
-			n = copy(b, d.b)
-			return n, 0, 0, d.addr, nil
+			f(d)
 		case <-te.idlec:
 		}
 	}
 }
 
-func (te *testEndpointUDPConn) WriteToUDPAddrPort(b []byte, addr netip.AddrPort) (int, error) {
-	te.sentDatagrams = append(te.sentDatagrams, append([]byte(nil), b...))
-	return len(b), nil
+func (te *testEndpointUDPConn) Write(dgram datagram) error {
+	te.sentDatagrams = append(te.sentDatagrams, append([]byte(nil), dgram.b...))
+	return nil
 }
diff --git a/internal/quic/qlog.go b/internal/quic/qlog.go
index e37e2f8ce..36831252c 100644
--- a/internal/quic/qlog.go
+++ b/internal/quic/qlog.go
@@ -151,6 +151,12 @@ func (c *Conn) logConnectionClosed() {
 	)
 }
 
+func (c *Conn) logPacketDropped(dgram *datagram) {
+	c.log.LogAttrs(context.Background(), QLogLevelPacket,
+		"connectivity:packet_dropped",
+	)
+}
+
 func (c *Conn) logLongPacketReceived(p longPacket, pkt []byte) {
 	var frames slog.Attr
 	if c.logEnabled(QLogLevelFrame) {
diff --git a/internal/quic/retry.go b/internal/quic/retry.go
index 31cb57b88..5dc39d1d9 100644
--- a/internal/quic/retry.go
+++ b/internal/quic/retry.go
@@ -139,7 +139,7 @@ func (rs *retryState) additionalData(srcConnID []byte, addr netip.AddrPort) []by
 	return additional
 }
 
-func (e *Endpoint) validateInitialAddress(now time.Time, p genericLongPacket, addr netip.AddrPort) (origDstConnID []byte, ok bool) {
+func (e *Endpoint) validateInitialAddress(now time.Time, p genericLongPacket, peerAddr netip.AddrPort) (origDstConnID []byte, ok bool) {
 	// The retry token is at the start of an Initial packet's data.
 	token, n := consumeUint8Bytes(p.data)
 	if n < 0 {
@@ -151,22 +151,22 @@ func (e *Endpoint) validateInitialAddress(now time.Time, p genericLongPacket, ad
 	if len(token) == 0 {
 		// The sender has not provided a token.
 		// Send a Retry packet to them with one.
-		e.sendRetry(now, p, addr)
+		e.sendRetry(now, p, peerAddr)
 		return nil, false
 	}
-	origDstConnID, ok = e.retry.validateToken(now, token, p.srcConnID, p.dstConnID, addr)
+	origDstConnID, ok = e.retry.validateToken(now, token, p.srcConnID, p.dstConnID, peerAddr)
 	if !ok {
 		// This does not seem to be a valid token.
 		// Close the connection with an INVALID_TOKEN error.
 		// https://www.rfc-editor.org/rfc/rfc9000#section-8.1.2-5
-		e.sendConnectionClose(p, addr, errInvalidToken)
+		e.sendConnectionClose(p, peerAddr, errInvalidToken)
 		return nil, false
 	}
 	return origDstConnID, true
 }
 
-func (e *Endpoint) sendRetry(now time.Time, p genericLongPacket, addr netip.AddrPort) {
-	token, srcConnID, err := e.retry.makeToken(now, p.srcConnID, p.dstConnID, addr)
+func (e *Endpoint) sendRetry(now time.Time, p genericLongPacket, peerAddr netip.AddrPort) {
+	token, srcConnID, err := e.retry.makeToken(now, p.srcConnID, p.dstConnID, peerAddr)
 	if err != nil {
 		return
 	}
@@ -175,7 +175,10 @@ func (e *Endpoint) sendRetry(now time.Time, p genericLongPacket, addr netip.Addr
 		srcConnID: srcConnID,
 		token:     token,
 	})
-	e.sendDatagram(b, addr)
+	e.sendDatagram(datagram{
+		b:        b,
+		peerAddr: peerAddr,
+	})
 }
 
 type retryPacket struct {
diff --git a/internal/quic/retry_test.go b/internal/quic/retry_test.go
index 8f36e1bd3..42f2bdd4a 100644
--- a/internal/quic/retry_test.go
+++ b/internal/quic/retry_test.go
@@ -436,8 +436,8 @@ func TestRetryClientIgnoresRetryWithInvalidIntegrityTag(t *testing.T) {
 	})
 	pkt[len(pkt)-1] ^= 1 // invalidate the integrity tag
 	tc.endpoint.write(&datagram{
-		b:    pkt,
-		addr: testClientAddr,
+		b:        pkt,
+		peerAddr: testClientAddr,
 	})
 	tc.wantIdle("client ignores Retry with invalid integrity tag")
 }
diff --git a/internal/quic/stateless_reset_test.go b/internal/quic/stateless_reset_test.go
index 45a49e81e..9458d2ea9 100644
--- a/internal/quic/stateless_reset_test.go
+++ b/internal/quic/stateless_reset_test.go
@@ -57,8 +57,8 @@ func newDatagramForReset(cid []byte, size int, addr netip.AddrPort) *datagram {
 		dgram = append(dgram, byte(len(dgram))) // semi-random junk
 	}
 	return &datagram{
-		b:    dgram,
-		addr: addr,
+		b:        dgram,
+		peerAddr: addr,
 	}
 }
 
diff --git a/internal/quic/udp.go b/internal/quic/udp.go
new file mode 100644
index 000000000..0a578286b
--- /dev/null
+++ b/internal/quic/udp.go
@@ -0,0 +1,30 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.21
+
+package quic
+
+import "net/netip"
+
+// Per-plaform consts describing support for various features.
+//
+// const udpECNSupport indicates whether the platform supports setting
+// the ECN (Explicit Congestion Notification) IP header bits.
+//
+// const udpInvalidLocalAddrIsError indicates whether sending a packet
+// from an local address not associated with the system is an error.
+// For example, assuming 127.0.0.2 is not a local address, does sending
+// from it (using IP_PKTINFO or some other such feature) result in an error?
+
+// unmapAddrPort returns a with any IPv4-mapped IPv6 address prefix removed.
+func unmapAddrPort(a netip.AddrPort) netip.AddrPort {
+	if a.Addr().Is4In6() {
+		return netip.AddrPortFrom(
+			a.Addr().Unmap(),
+			a.Port(),
+		)
+	}
+	return a
+}
diff --git a/internal/quic/udp_darwin.go b/internal/quic/udp_darwin.go
new file mode 100644
index 000000000..3868a36a8
--- /dev/null
+++ b/internal/quic/udp_darwin.go
@@ -0,0 +1,13 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.21 && darwin
+
+package quic
+
+// See udp.go.
+const (
+	udpECNSupport              = true
+	udpInvalidLocalAddrIsError = true
+)
diff --git a/internal/quic/udp_linux.go b/internal/quic/udp_linux.go
new file mode 100644
index 000000000..2ba3e6f2f
--- /dev/null
+++ b/internal/quic/udp_linux.go
@@ -0,0 +1,13 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.21 && linux
+
+package quic
+
+// See udp.go.
+const (
+	udpECNSupport              = true
+	udpInvalidLocalAddrIsError = false
+)
diff --git a/internal/quic/udp_msg.go b/internal/quic/udp_msg.go
new file mode 100644
index 000000000..bdc1b710d
--- /dev/null
+++ b/internal/quic/udp_msg.go
@@ -0,0 +1,248 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.21 && !quicbasicnet && (darwin || linux)
+
+package quic
+
+import (
+	"net"
+	"net/netip"
+	"sync"
+	"unsafe"
+
+	"golang.org/x/sys/unix"
+)
+
+// Network interface for platforms using sendmsg/recvmsg with cmsgs.
+
+type netUDPConn struct {
+	c         *net.UDPConn
+	localAddr netip.AddrPort
+}
+
+func newNetUDPConn(uc *net.UDPConn) (*netUDPConn, error) {
+	a, _ := uc.LocalAddr().(*net.UDPAddr)
+	localAddr := a.AddrPort()
+	if localAddr.Addr().IsUnspecified() {
+		// If the conn is not bound to a specified (non-wildcard) address,
+		// then set localAddr.Addr to an invalid netip.Addr.
+		// This better conveys that this is not an address we should be using,
+		// and is a bit more efficient to test against.
+		localAddr = netip.AddrPortFrom(netip.Addr{}, localAddr.Port())
+	}
+
+	sc, err := uc.SyscallConn()
+	if err != nil {
+		return nil, err
+	}
+	sc.Control(func(fd uintptr) {
+		// Ask for ECN info and (when we aren't bound to a fixed local address)
+		// destination info.
+		//
+		// If any of these calls fail, we won't get the requested information.
+		// That's fine, we'll gracefully handle the lack.
+		unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_RECVTOS, 1)
+		unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_RECVTCLASS, 1)
+		if !localAddr.IsValid() {
+			unix.SetsockoptInt(int(fd), unix.IPPROTO_IP, unix.IP_PKTINFO, 1)
+			unix.SetsockoptInt(int(fd), unix.IPPROTO_IPV6, unix.IPV6_RECVPKTINFO, 1)
+		}
+	})
+
+	return &netUDPConn{
+		c:         uc,
+		localAddr: localAddr,
+	}, nil
+}
+
+func (c *netUDPConn) Close() error { return c.c.Close() }
+
+func (c *netUDPConn) LocalAddr() netip.AddrPort {
+	a, _ := c.c.LocalAddr().(*net.UDPAddr)
+	return a.AddrPort()
+}
+
+func (c *netUDPConn) Read(f func(*datagram)) {
+	// We shouldn't ever see all of these messages at the same time,
+	// but the total is small so just allocate enough space for everything we use.
+	const (
+		inPktinfoSize  = 12 // int + in_addr + in_addr
+		in6PktinfoSize = 20 // in6_addr + int
+		ipTOSSize      = 4
+		ipv6TclassSize = 4
+	)
+	control := make([]byte, 0+
+		unix.CmsgSpace(inPktinfoSize)+
+		unix.CmsgSpace(in6PktinfoSize)+
+		unix.CmsgSpace(ipTOSSize)+
+		unix.CmsgSpace(ipv6TclassSize))
+
+	for {
+		d := newDatagram()
+		n, controlLen, _, peerAddr, err := c.c.ReadMsgUDPAddrPort(d.b, control)
+		if err != nil {
+			return
+		}
+		if n == 0 {
+			continue
+		}
+		d.localAddr = c.localAddr
+		d.peerAddr = unmapAddrPort(peerAddr)
+		d.b = d.b[:n]
+		parseControl(d, control[:controlLen])
+		f(d)
+	}
+}
+
+var cmsgPool = sync.Pool{
+	New: func() any {
+		return new([]byte)
+	},
+}
+
+func (c *netUDPConn) Write(dgram datagram) error {
+	controlp := cmsgPool.Get().(*[]byte)
+	control := *controlp
+	defer func() {
+		*controlp = control[:0]
+		cmsgPool.Put(controlp)
+	}()
+
+	localIP := dgram.localAddr.Addr()
+	if localIP.IsValid() {
+		if localIP.Is4() {
+			control = appendCmsgIPSourceAddrV4(control, localIP)
+		} else {
+			control = appendCmsgIPSourceAddrV6(control, localIP)
+		}
+	}
+	if dgram.ecn != ecnNotECT {
+		if dgram.peerAddr.Addr().Is4() {
+			control = appendCmsgECNv4(control, dgram.ecn)
+		} else {
+			control = appendCmsgECNv6(control, dgram.ecn)
+		}
+	}
+
+	_, _, err := c.c.WriteMsgUDPAddrPort(dgram.b, control, dgram.peerAddr)
+	return err
+}
+
+func parseControl(d *datagram, control []byte) {
+	for len(control) > 0 {
+		hdr, data, remainder, err := unix.ParseOneSocketControlMessage(control)
+		if err != nil {
+			return
+		}
+		control = remainder
+		switch hdr.Level {
+		case unix.IPPROTO_IP:
+			switch hdr.Type {
+			case unix.IP_TOS, unix.IP_RECVTOS:
+				// Single byte containing the IP TOS field.
+				// The low two bits are the ECN field.
+				//
+				// (Linux sets the type to IP_TOS, Darwin to IP_RECVTOS,
+				// jus check for both.)
+				if len(data) < 1 {
+					break
+				}
+				d.ecn = ecnBits(data[0] & ecnMask)
+			case unix.IP_PKTINFO:
+				if a, ok := parseInPktinfo(data); ok {
+					d.localAddr = netip.AddrPortFrom(a, d.localAddr.Port())
+				}
+			}
+		case unix.IPPROTO_IPV6:
+			switch hdr.Type {
+			case unix.IPV6_TCLASS:
+				// Single byte containing the traffic class field.
+				// The low two bits are the ECN field.
+				if len(data) < 1 {
+					break
+				}
+				d.ecn = ecnBits(data[0] & ecnMask)
+			case unix.IPV6_PKTINFO:
+				if a, ok := parseIn6Pktinfo(data); ok {
+					d.localAddr = netip.AddrPortFrom(a, d.localAddr.Port())
+				}
+			}
+		}
+	}
+}
+
+func parseInPktinfo(b []byte) (netip.Addr, bool) {
+	// struct in_pktinfo {
+	//   unsigned int   ipi_ifindex;  /* send/recv interface index */
+	//   struct in_addr ipi_spec_dst; /* Local address */
+	//   struct in_addr ipi_addr;     /* IP Header dst address */
+	// };
+	if len(b) != 12 {
+		return netip.Addr{}, false
+	}
+	return netip.AddrFrom4([4]byte(b[8:][:4])), true
+}
+
+func parseIn6Pktinfo(b []byte) (netip.Addr, bool) {
+	// struct in6_pktinfo {
+	//   struct in6_addr  ipi6_addr;    /* src/dst IPv6 address */
+	//   unsigned int     ipi6_ifindex; /* send/recv interface index */
+	// };
+	if len(b) != 20 {
+		return netip.Addr{}, false
+	}
+	return netip.AddrFrom16([16]byte(b[:16])).Unmap(), true
+}
+
+// appendCmsgIPSourceAddrV4 appends an IP_PKTINFO setting the source address
+// for an outbound datagram.
+func appendCmsgIPSourceAddrV4(b []byte, src netip.Addr) []byte {
+	// struct in_pktinfo {
+	//   unsigned int   ipi_ifindex;  /* send/recv interface index */
+	//   struct in_addr ipi_spec_dst; /* Local address */
+	//   struct in_addr ipi_addr;     /* IP Header dst address */
+	// };
+	b, data := appendCmsg(b, unix.IPPROTO_IP, unix.IP_PKTINFO, 12)
+	ip := src.As4()
+	copy(data[4:], ip[:])
+	return b
+}
+
+// appendCmsgIPSourceAddrV6 appends an IP_PKTINFO or IPV6_PKTINFO
+// setting the source address for an outbound datagram.
+func appendCmsgIPSourceAddrV6(b []byte, src netip.Addr) []byte {
+	// struct in6_pktinfo {
+	//   struct in6_addr  ipi6_addr;    /* src/dst IPv6 address */
+	//   unsigned int     ipi6_ifindex; /* send/recv interface index */
+	// };
+	b, data := appendCmsg(b, unix.IPPROTO_IPV6, unix.IPV6_PKTINFO, 20)
+	ip := src.As16()
+	copy(data[0:], ip[:])
+	return b
+}
+
+func appendCmsgECNv4(b []byte, ecn ecnBits) []byte {
+	b, data := appendCmsg(b, unix.IPPROTO_IP, unix.IP_TOS, 4)
+	data[0] = byte(ecn)
+	return b
+}
+
+func appendCmsgECNv6(b []byte, ecn ecnBits) []byte {
+	b, data := appendCmsg(b, unix.IPPROTO_IPV6, unix.IPV6_TCLASS, 4)
+	data[0] = byte(ecn)
+	return b
+}
+
+// appendCmsg appends a cmsg with the given level, type, and size to b.
+// It returns the new buffer, and the data section of the cmsg.
+func appendCmsg(b []byte, level, typ int32, size int) (_, data []byte) {
+	off := len(b)
+	b = append(b, make([]byte, unix.CmsgSpace(size))...)
+	h := (*unix.Cmsghdr)(unsafe.Pointer(&b[off]))
+	h.Level = level
+	h.Type = typ
+	h.SetLen(unix.CmsgLen(size))
+	return b, b[off+unix.CmsgSpace(0):][:size]
+}
diff --git a/internal/quic/udp_other.go b/internal/quic/udp_other.go
new file mode 100644
index 000000000..28be6d200
--- /dev/null
+++ b/internal/quic/udp_other.go
@@ -0,0 +1,62 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.21 && (quicbasicnet || !(darwin || linux))
+
+package quic
+
+import (
+	"net"
+	"net/netip"
+)
+
+// Lowest common denominator network interface: Basic net.UDPConn, no cmsgs.
+// We will not be able to send or receive ECN bits,
+// and we will not know what our local address is.
+//
+// The quicbasicnet build tag allows selecting this interface on any platform.
+
+// See udp.go.
+const (
+	udpECNSupport              = false
+	udpInvalidLocalAddrIsError = false
+)
+
+type netUDPConn struct {
+	c *net.UDPConn
+}
+
+func newNetUDPConn(uc *net.UDPConn) (*netUDPConn, error) {
+	return &netUDPConn{
+		c: uc,
+	}, nil
+}
+
+func (c *netUDPConn) Close() error { return c.c.Close() }
+
+func (c *netUDPConn) LocalAddr() netip.AddrPort {
+	a, _ := c.c.LocalAddr().(*net.UDPAddr)
+	return a.AddrPort()
+}
+
+func (c *netUDPConn) Read(f func(*datagram)) {
+	for {
+		dgram := newDatagram()
+		n, _, _, peerAddr, err := c.c.ReadMsgUDPAddrPort(dgram.b, nil)
+		if err != nil {
+			return
+		}
+		if n == 0 {
+			continue
+		}
+		dgram.peerAddr = unmapAddrPort(peerAddr)
+		dgram.b = dgram.b[:n]
+		f(dgram)
+	}
+}
+
+func (c *netUDPConn) Write(dgram datagram) error {
+	_, err := c.c.WriteToUDPAddrPort(dgram.b, dgram.peerAddr)
+	return err
+}
diff --git a/internal/quic/udp_test.go b/internal/quic/udp_test.go
new file mode 100644
index 000000000..27eddf811
--- /dev/null
+++ b/internal/quic/udp_test.go
@@ -0,0 +1,176 @@
+// Copyright 2023 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build go1.21
+
+package quic
+
+import (
+	"bytes"
+	"fmt"
+	"net"
+	"net/netip"
+	"runtime"
+	"testing"
+)
+
+func TestUDPSourceUnspecified(t *testing.T) {
+	// Send datagram with no source address set.
+	runUDPTest(t, func(t *testing.T, test udpTest) {
+		data := []byte("source unspecified")
+		if err := test.src.Write(datagram{
+			b:        data,
+			peerAddr: test.dstAddr,
+		}); err != nil {
+			t.Fatalf("Write: %v", err)
+		}
+		got := <-test.dgramc
+		if !bytes.Equal(got.b, data) {
+			t.Errorf("got datagram {%x}, want {%x}", got.b, data)
+		}
+	})
+}
+
+func TestUDPSourceSpecified(t *testing.T) {
+	// Send datagram with source address set.
+	runUDPTest(t, func(t *testing.T, test udpTest) {
+		data := []byte("source specified")
+		if err := test.src.Write(datagram{
+			b:         data,
+			peerAddr:  test.dstAddr,
+			localAddr: test.src.LocalAddr(),
+		}); err != nil {
+			t.Fatalf("Write: %v", err)
+		}
+		got := <-test.dgramc
+		if !bytes.Equal(got.b, data) {
+			t.Errorf("got datagram {%x}, want {%x}", got.b, data)
+		}
+	})
+}
+
+func TestUDPSourceInvalid(t *testing.T) {
+	// Send datagram with source address set to an address not associated with the connection.
+	if !udpInvalidLocalAddrIsError {
+		t.Skipf("%v: sending from invalid source succeeds", runtime.GOOS)
+	}
+	runUDPTest(t, func(t *testing.T, test udpTest) {
+		var localAddr netip.AddrPort
+		if test.src.LocalAddr().Addr().Is4() {
+			localAddr = netip.MustParseAddrPort("127.0.0.2:1234")
+		} else {
+			localAddr = netip.MustParseAddrPort("[::2]:1234")
+		}
+		data := []byte("source invalid")
+		if err := test.src.Write(datagram{
+			b:         data,
+			peerAddr:  test.dstAddr,
+			localAddr: localAddr,
+		}); err == nil {
+			t.Errorf("Write with invalid localAddr succeeded; want error")
+		}
+	})
+}
+
+func TestUDPECN(t *testing.T) {
+	if !udpECNSupport {
+		t.Skipf("%v: no ECN support", runtime.GOOS)
+	}
+	// Send datagrams with ECN bits set, verify the ECN bits are received.
+	runUDPTest(t, func(t *testing.T, test udpTest) {
+		for _, ecn := range []ecnBits{ecnNotECT, ecnECT1, ecnECT0, ecnCE} {
+			if err := test.src.Write(datagram{
+				b:        []byte{1, 2, 3, 4},
+				peerAddr: test.dstAddr,
+				ecn:      ecn,
+			}); err != nil {
+				t.Fatalf("Write: %v", err)
+			}
+			got := <-test.dgramc
+			if got.ecn != ecn {
+				t.Errorf("sending ECN bits %x, got %x", ecn, got.ecn)
+			}
+		}
+	})
+}
+
+type udpTest struct {
+	src     *netUDPConn
+	dst     *netUDPConn
+	dstAddr netip.AddrPort
+	dgramc  chan *datagram
+}
+
+// runUDPTest calls f with a pair of UDPConns in a matrix of network variations:
+// udp, udp4, and udp6, and variations on binding to an unspecified address (0.0.0.0)
+// or a specified one.
+func runUDPTest(t *testing.T, f func(t *testing.T, u udpTest)) {
+	for _, test := range []struct {
+		srcNet, srcAddr, dstNet, dstAddr string
+	}{
+		{"udp4", "127.0.0.1", "udp", ""},
+		{"udp4", "127.0.0.1", "udp4", ""},
+		{"udp4", "127.0.0.1", "udp4", "127.0.0.1"},
+		{"udp6", "::1", "udp", ""},
+		{"udp6", "::1", "udp6", ""},
+		{"udp6", "::1", "udp6", "::1"},
+	} {
+		spec := "spec"
+		if test.dstAddr == "" {
+			spec = "unspec"
+		}
+		t.Run(fmt.Sprintf("%v/%v/%v", test.srcNet, test.dstNet, spec), func(t *testing.T) {
+			srcAddr := netip.AddrPortFrom(netip.MustParseAddr(test.srcAddr), 0)
+			srcConn, err := net.ListenUDP(test.srcNet, net.UDPAddrFromAddrPort(srcAddr))
+			if err != nil {
+				// If ListenUDP fails here, we presumably don't have
+				// IPv4/IPv6 configured.
+				t.Skipf("ListenUDP(%q, %v) = %v", test.srcNet, srcAddr, err)
+			}
+			t.Cleanup(func() { srcConn.Close() })
+			src, err := newNetUDPConn(srcConn)
+			if err != nil {
+				t.Fatalf("newNetUDPConn: %v", err)
+			}
+
+			var dstAddr netip.AddrPort
+			if test.dstAddr != "" {
+				dstAddr = netip.AddrPortFrom(netip.MustParseAddr(test.dstAddr), 0)
+			}
+			dstConn, err := net.ListenUDP(test.dstNet, net.UDPAddrFromAddrPort(dstAddr))
+			if err != nil {
+				t.Skipf("ListenUDP(%q, nil) = %v", test.dstNet, err)
+			}
+			dst, err := newNetUDPConn(dstConn)
+			if err != nil {
+				dstConn.Close()
+				t.Fatalf("newNetUDPConn: %v", err)
+			}
+
+			dgramc := make(chan *datagram)
+			go func() {
+				defer close(dgramc)
+				dst.Read(func(dgram *datagram) {
+					dgramc <- dgram
+				})
+			}()
+			t.Cleanup(func() {
+				dstConn.Close()
+				for range dgramc {
+					t.Errorf("test read unexpected datagram")
+				}
+			})
+
+			f(t, udpTest{
+				src: src,
+				dst: dst,
+				dstAddr: netip.AddrPortFrom(
+					srcAddr.Addr(),
+					dst.LocalAddr().Port(),
+				),
+				dgramc: dgramc,
+			})
+		})
+	}
+}