[socket] Add lwip raw UDP socket implementation (#14677)

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

esphome/components/socket/__init__.py

@@ -269,7 +269,9 @@ async def to_code(config: ConfigType) -> None:
 # consumers that called the matching require_ function.
 FILTER_SOURCE_FILES = filter_source_files_from_defines(
     {
+        "lwip_raw_common_impl.cpp": "USE_SOCKET_IMPL_LWIP_TCP",
         "lwip_raw_tcp_impl.cpp": "USE_SOCKET_IMPL_LWIP_TCP",
+        "lwip_raw_udp_impl.cpp": "USE_SOCKET_IMPL_LWIP_TCP",
         "bsd_sockets_impl.cpp": "USE_SOCKET_IMPL_BSD_SOCKETS",
         "lwip_sockets_impl.cpp": "USE_SOCKET_IMPL_LWIP_SOCKETS",
         "ipv4_resolve.cpp": "USE_SOCKET_IPV4_RESOLVE",

esphome/components/socket/bsd_sockets_impl.h

@@ -144,6 +144,9 @@ class BSDSocketImpl {
 
   int get_fd() const { return this->fd_; }
 
+  /// UDP rx drop counter parity with LWIPRawUDPImpl; drops are not counted here.
+  uint16_t get_rx_dropped() const { return 0; }
+
  protected:
   // fd_ < 0 means "not open" — used both pre-open (initial state) and post-close. This
   // replaces a separate closed_ flag: close() sets fd_ = -1 after ::close(), and the

esphome/components/socket/headers.h

@@ -20,6 +20,16 @@
 
 #define IPPROTO_IP 0
 #define IPPROTO_TCP 6
+#define IPPROTO_UDP 17
+
+#define IP_ADD_MEMBERSHIP 3
+#define IP_DROP_MEMBERSHIP 4
+
+// NOLINTNEXTLINE(readability-identifier-naming)
+struct ip_mreq {
+  struct in_addr imr_multiaddr;
+  struct in_addr imr_interface;
+};
 
 #if LWIP_IPV6
 #define AF_INET6 10

esphome/components/socket/lwip_raw_common_impl.cpp

@@ -0,0 +1,116 @@
+#include "lwip_raw_common_impl.h"
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include <cerrno>
+#include <cstring>
+
+namespace esphome::socket {
+
+int lwip_ip_to_sockaddr(sa_family_t family, const ip_addr_t *ip, uint16_t port_host, struct sockaddr *name,
+                        socklen_t *addrlen) {
+  if (family == AF_INET) {
+    if (*addrlen < sizeof(struct sockaddr_in)) {
+      errno = EINVAL;
+      return -1;
+    }
+    auto *addr = reinterpret_cast<struct sockaddr_in *>(name);
+    addr->sin_family = AF_INET;
+    *addrlen = addr->sin_len = sizeof(struct sockaddr_in);
+    addr->sin_port = htons(port_host);
+    inet_addr_from_ip4addr(&addr->sin_addr, ip_2_ip4(ip));
+    return 0;
+  }
+#if LWIP_IPV6
+  if (family == AF_INET6) {
+    if (*addrlen < sizeof(struct sockaddr_in6)) {
+      errno = EINVAL;
+      return -1;
+    }
+    auto *addr = reinterpret_cast<struct sockaddr_in6 *>(name);
+    addr->sin6_family = AF_INET6;
+    *addrlen = addr->sin6_len = sizeof(struct sockaddr_in6);
+    addr->sin6_port = htons(port_host);
+    // AF_INET6 sockets may receive IPv4 packets; convert to IPv4-mapped IPv6.
+    if (IP_IS_V4(ip)) {
+      ip_addr_t mapped;
+      ip4_2_ipv4_mapped_ipv6(ip_2_ip6(&mapped), ip_2_ip4(ip));
+      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(&mapped));
+    } else {
+      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(ip));
+    }
+    return 0;
+  }
+#endif
+  errno = EAFNOSUPPORT;
+  return -1;
+}
+
+bool sockaddr_to_lwip(const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip, uint16_t *port) {
+  // headers.h defines sockaddr and sockaddr_in with the same size, so this covers AF_INET
+  if (addrlen < sizeof(struct sockaddr))
+    return false;
+  // Zero the whole struct — the IPv6 zone byte would otherwise be stack garbage
+  memset(ip, 0, sizeof(*ip));
+  if (addr->sa_family == AF_INET) {
+    auto *addr4 = reinterpret_cast<const sockaddr_in *>(addr);
+    *port = ntohs(addr4->sin_port);
+    IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_V4);
+    ip_2_ip4(ip)->addr = addr4->sin_addr.s_addr;
+    return true;
+  }
+#if LWIP_IPV6
+  if (addr->sa_family == AF_INET6) {
+    if (addrlen < sizeof(sockaddr_in6))
+      return false;
+    auto *addr6 = reinterpret_cast<const sockaddr_in6 *>(addr);
+    *port = ntohs(addr6->sin6_port);
+    IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_V6);
+    memcpy(&ip_2_ip6(ip)->addr, &addr6->sin6_addr.un.u8_addr, 16);
+    // Unmap ::ffff:a.b.c.d so replies to recvfrom addresses route as IPv4
+    if (ip6_addr_isipv4mappedipv6(ip_2_ip6(ip))) {
+      unmap_ipv4_mapped_ipv6(ip_2_ip4(ip), ip_2_ip6(ip));
+      IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_V4);
+    }
+    return true;
+  }
+#endif
+  return false;
+}
+
+bool sockaddr_to_lwip_bind(sa_family_t family, const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip,
+                           uint16_t *port) {
+  if (!sockaddr_to_lwip(addr, addrlen, ip, port))
+    return false;
+#if LWIP_IPV6
+  // Only promote wildcard binds — a specific address must keep filtering
+  if (family == AF_INET6 && ip_addr_isany_val(*ip))
+    IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_ANY);
+#endif
+  return true;
+}
+
+int lwip_err_to_errno(err_t err) {
+  switch (err) {
+    case ERR_MEM:
+      return ENOMEM;
+    case ERR_BUF:
+      return EAGAIN;  // transient, e.g. no free local port
+    case ERR_RTE:
+      return EHOSTUNREACH;  // no route, e.g. no address yet
+    case ERR_VAL:
+    case ERR_ARG:
+      return EINVAL;
+    case ERR_USE:
+      return EADDRINUSE;
+    case ERR_ISCONN:
+      return EISCONN;
+    default:
+      return EIO;
+  }
+}
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP

esphome/components/socket/lwip_raw_common_impl.h

@@ -0,0 +1,53 @@
+#pragma once
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include "headers.h"
+#include "lwip/ip.h"
+
+namespace esphome::socket {
+
+// ---- LWIP thread safety ----
+//
+// On RP2040 (Pico W), arduino-pico sets PICO_CYW43_ARCH_THREADSAFE_BACKGROUND=1.
+// This means lwip callbacks (recv_fn, accept_fn, err_fn) run from a low-priority
+// user IRQ context, not the main loop (see low_priority_irq_handler() in pico-sdk
+// async_context_threadsafe_background.c). They can preempt main-loop code at any point.
+//
+// Without locking, this causes race conditions between recv_fn and read() on the
+// shared rx_buf_ pbuf chain — recv_fn calls pbuf_cat() while read() is freeing
+// nodes, leading to use-after-free and infinite-loop crashes. See esphome#10681.
+//
+// On ESP8266, lwip callbacks run from the SYS context which cooperates with user
+// code (CONT context) — they never preempt each other, so no locking is needed.
+//
+// esphome::LwIPLock is the platform-provided RAII guard (see helpers.h/helpers.cpp).
+// On RP2040, it acquires cyw43_arch_lwip_begin/end (WiFi) or ethernet_arch_lwip_begin/end
+// (Ethernet). On ESP8266, it's a no-op.
+//
+// Each .cpp file that needs locking defines its own LWIP_LOCK() macro:
+//   #define LWIP_LOCK() esphome::LwIPLock lwip_lock_guard
+// This is a per-TU convenience macro, not defined here to avoid macro leaking.
+
+/// Convert lwip ip_addr_t + host-order port to sockaddr, based on the socket's address family.
+/// TCP callers pass ntohs(pcb port) to preserve historical getpeername/getsockname output.
+int lwip_ip_to_sockaddr(sa_family_t family, const ip_addr_t *ip, uint16_t port_host, struct sockaddr *name,
+                        socklen_t *addrlen);
+
+/// Convert sockaddr to lwip ip_addr_t and host-order port.
+/// For IPv6, sets type to IPADDR_TYPE_V6 — correct for sendto destinations.
+/// Bind paths must use sockaddr_to_lwip_bind() instead.
+bool sockaddr_to_lwip(const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip, uint16_t *port);
+
+/// sockaddr_to_lwip variant for bind: promotes AF_INET6 sockets to
+/// IPADDR_TYPE_ANY so they accept both IPv4 and IPv6 (dual-stack).
+bool sockaddr_to_lwip_bind(sa_family_t family, const struct sockaddr *addr, socklen_t addrlen, ip_addr_t *ip,
+                           uint16_t *port);
+
+/// errno for a failed lwip call
+int lwip_err_to_errno(err_t err);
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP

esphome/components/socket/lwip_raw_tcp_impl.cpp

@@ -10,6 +10,7 @@
 #include "esphome/core/helpers.h"
 #include "esphome/core/wake.h"
 #include "esphome/core/log.h"
+#include "lwip_raw_common_impl.h"
 
 #ifdef USE_OTA_PLATFORM_ESPHOME
 extern "C" void esphome_wake_ota_component_any_context();
@@ -24,23 +25,9 @@ extern "C" void esphome_wake_ota_component_any_context();
 
 namespace esphome::socket {
 
-// ---- LWIP thread safety ----
-//
-// On RP2040 (Pico W), arduino-pico sets PICO_CYW43_ARCH_THREADSAFE_BACKGROUND=1.
-// This means lwip callbacks (recv_fn, accept_fn, err_fn) run from a low-priority
-// user IRQ context, not the main loop (see low_priority_irq_handler() in pico-sdk
-// async_context_threadsafe_background.c). They can preempt main-loop code at any point.
-//
-// Without locking, this causes race conditions between recv_fn and read() on the
-// shared rx_buf_ pbuf chain — recv_fn calls pbuf_cat() while read() is freeing
-// nodes, leading to use-after-free and infinite-loop crashes. See esphome#10681.
-//
-// On ESP8266, lwip callbacks run from the SYS context which cooperates with user
-// code (CONT context) — they never preempt each other, so no locking is needed.
-//
-// esphome::LwIPLock is the platform-provided RAII guard (see helpers.h/helpers.cpp).
-// On RP2040, it acquires cyw43_arch_lwip_begin/end (WiFi) or ethernet_arch_lwip_begin/end
-// (Ethernet). On ESP8266, it's a no-op.
+// LWIP thread safety — see lwip_raw_common_impl.h for full explanation.
+// esphome::LwIPLock is the platform-provided RAII guard.
+// On RP2040, it acquires cyw43_arch_lwip_begin/end. On ESP8266, it's a no-op.
 #define LWIP_LOCK() esphome::LwIPLock lwip_lock_guard  // NOLINT
 
 ESPHOME_LOG_TAG(TAG, "socket");
@@ -54,27 +41,6 @@ static inline void yield_to_sys() { optimistic_yield(ESP8266_YIELD_INTERVAL_US);
 static inline void yield_to_sys() {}
 #endif
 
-// errno for a failed tcp_* call
-static int lwip_err_to_errno(err_t err) {
-  switch (err) {
-    case ERR_MEM:
-      return ENOMEM;
-    case ERR_BUF:
-      return EAGAIN;  // transient, e.g. no free local port
-    case ERR_RTE:
-      return EHOSTUNREACH;  // no route, e.g. no address yet
-    case ERR_VAL:
-    case ERR_ARG:
-      return EINVAL;
-    case ERR_USE:
-      return EADDRINUSE;
-    case ERR_ISCONN:
-      return EISCONN;
-    default:
-      return EIO;
-  }
-}
-
 // set to 1 to enable verbose lwip logging
 #if 0  // NOLINT(readability-avoid-unconditional-preprocessor-if)
 #define LWIP_LOG(msg, ...) ESP_LOGVV(TAG, "socket %p: " msg, this, ##__VA_ARGS__)
@@ -125,33 +91,14 @@ LWIPRawCommon::~LWIPRawCommon() {
   }
 }
 
-bool LWIPRawCommon::sockaddr2ip_(const struct sockaddr *name, socklen_t addrlen, ip_addr_t *ip, uint16_t *port) const {
-  if (name == nullptr) {
-    errno = EINVAL;
-    return false;
-  }
-#if LWIP_IPV6
-  if (this->family_ == AF_INET6) {
-    if (addrlen < sizeof(sockaddr_in6)) {
-      errno = EINVAL;
-      return false;
-    }
-    auto *addr6 = reinterpret_cast<const sockaddr_in6 *>(name);
-    *port = ntohs(addr6->sin6_port);
-    inet6_addr_to_ip6addr(ip_2_ip6(ip), &addr6->sin6_addr);
-    // ANY lets bind() accept both families; connect() picks the concrete type
-    IP_SET_TYPE_VAL(*ip, IPADDR_TYPE_ANY);
+bool LWIPRawCommon::sockaddr2ip_(const struct sockaddr *name, socklen_t addrlen, ip_addr_t *ip, uint16_t *port,
+                                 bool for_bind) const {
+  if (name != nullptr && name->sa_family == this->family_ &&
+      (for_bind ? sockaddr_to_lwip_bind(this->family_, name, addrlen, ip, port)
+                : sockaddr_to_lwip(name, addrlen, ip, port)))
     return true;
-  }
-#endif
-  if (this->family_ != AF_INET || addrlen < sizeof(sockaddr_in)) {
-    errno = EINVAL;
-    return false;
-  }
-  auto *addr4 = reinterpret_cast<const sockaddr_in *>(name);
-  *port = ntohs(addr4->sin_port);
-  ip_addr_set_ip4_u32(ip, addr4->sin_addr.s_addr);
-  return true;
+  errno = EINVAL;
+  return false;
 }
 
 int LWIPRawCommon::bind(const struct sockaddr *name, socklen_t addrlen) {
@@ -162,7 +109,7 @@ int LWIPRawCommon::bind(const struct sockaddr *name, socklen_t addrlen) {
   }
   ip_addr_t ip;
   uint16_t port;
-  if (!this->sockaddr2ip_(name, addrlen, &ip, &port)) {
+  if (!this->sockaddr2ip_(name, addrlen, &ip, &port, true)) {
     return -1;
   }
   LWIP_LOG("tcp_bind(%p ip=%s port=%u)", this->pcb_, ipaddr_ntoa(&ip), port);
@@ -357,43 +304,8 @@ int LWIPRawCommon::setsockopt(int level, int optname, const void *optval, sockle
 }
 
 int LWIPRawCommon::ip2sockaddr_(ip_addr_t *ip, uint16_t port, struct sockaddr *name, socklen_t *addrlen) {
-  if (this->family_ == AF_INET) {
-    if (*addrlen < sizeof(struct sockaddr_in)) {
-      errno = EINVAL;
-      return -1;
-    }
-
-    struct sockaddr_in *addr = reinterpret_cast<struct sockaddr_in *>(name);
-    addr->sin_family = AF_INET;
-    *addrlen = addr->sin_len = sizeof(struct sockaddr_in);
-    addr->sin_port = port;
-    inet_addr_from_ip4addr(&addr->sin_addr, ip_2_ip4(ip));
-    return 0;
-  }
-#if LWIP_IPV6
-  else if (this->family_ == AF_INET6) {
-    if (*addrlen < sizeof(struct sockaddr_in6)) {
-      errno = EINVAL;
-      return -1;
-    }
-
-    struct sockaddr_in6 *addr = reinterpret_cast<struct sockaddr_in6 *>(name);
-    addr->sin6_family = AF_INET6;
-    *addrlen = addr->sin6_len = sizeof(struct sockaddr_in6);
-    addr->sin6_port = port;
-
-    // AF_INET6 sockets are bound to IPv4 as well, so we may encounter IPv4 addresses that must be converted to IPv6.
-    if (IP_IS_V4(ip)) {
-      ip_addr_t mapped;
-      ip4_2_ipv4_mapped_ipv6(ip_2_ip6(&mapped), ip_2_ip4(ip));
-      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(&mapped));
-    } else {
-      inet6_addr_from_ip6addr(&addr->sin6_addr, ip_2_ip6(ip));
-    }
-    return 0;
-  }
-#endif
-  return -1;
+  // lwip pcb ports are host order; ntohs preserves historical byte-swapped sin_port output
+  return lwip_ip_to_sockaddr(this->family_, ip, ntohs(port), name, addrlen);
 }
 
 // ---- LWIPRawImpl methods ----
@@ -462,20 +374,10 @@ int LWIPRawImpl::connect(const struct sockaddr *addr, socklen_t addrlen) {
   }
   ip_addr_t ip;
   uint16_t port;
-  if (!this->sockaddr2ip_(addr, addrlen, &ip, &port)) {
+  // Concrete type for tcp_connect; a remembered IPv4 peer arrives v4-mapped and is unmapped
+  if (!this->sockaddr2ip_(addr, addrlen, &ip, &port, false)) {
     return -1;
   }
-#if LWIP_IPV6
-  // tcp_connect needs a concrete type; a remembered IPv4 peer arrives v4-mapped
-  if (IP_IS_ANY_TYPE_VAL(ip)) {
-    if (ip6_addr_isipv4mappedipv6(ip_2_ip6(&ip))) {
-      unmap_ipv4_mapped_ipv6(ip_2_ip4(&ip), ip_2_ip6(&ip));
-      IP_SET_TYPE_VAL(ip, IPADDR_TYPE_V4);
-    } else {
-      IP_SET_TYPE_VAL(ip, IPADDR_TYPE_V6);
-    }
-  }
-#endif
   LWIP_LOG("tcp_connect(%p ip=%s port=%u)", this->pcb_, ipaddr_ntoa(&ip), port);
   err_t err = tcp_connect(this->pcb_, &ip, port, LWIPRawImpl::s_connected_fn);
   if (err != ERR_OK) {
@@ -965,11 +867,11 @@ err_t LWIPRawListenImpl::accept_fn_(struct tcp_pcb *newpcb, err_t err) {
   return ERR_OK;
 }
 
-// ---- Factory functions ----
+// ---- TCP Factory functions ----
 
 std::unique_ptr<Socket> socket(int domain, int type, int protocol) {
   if (type != SOCK_STREAM) {
-    ESP_LOGE(TAG, "UDP sockets not supported on this platform, use WiFiUDP");
+    ESP_LOGE(TAG, "Use socket_udp() for UDP sockets on this platform");
     errno = EPROTOTYPE;
     return nullptr;
   }
@@ -989,7 +891,7 @@ std::unique_ptr<Socket> socket_loop_monitored(int domain, int type, int protocol
 
 std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int protocol) {
   if (type != SOCK_STREAM) {
-    ESP_LOGE(TAG, "UDP sockets not supported on this platform, use WiFiUDP");
+    ESP_LOGE(TAG, "Use socket_udp() for UDP sockets on this platform");
     errno = EPROTOTYPE;
     return nullptr;
   }

esphome/components/socket/lwip_raw_tcp_impl.h

@@ -50,8 +50,9 @@ class LWIPRawCommon {
 
  protected:
   int ip2sockaddr_(ip_addr_t *ip, uint16_t port, struct sockaddr *name, socklen_t *addrlen);
-  /// sockaddr of this socket's family to lwip address and port; false with errno on mismatch
-  bool sockaddr2ip_(const struct sockaddr *name, socklen_t addrlen, ip_addr_t *ip, uint16_t *port) const;
+  /// sockaddr of this socket's family to lwip address and port; false with errno on mismatch.
+  /// for_bind keeps an IPv6 wildcard dual stack, otherwise the type is concrete.
+  bool sockaddr2ip_(const struct sockaddr *name, socklen_t addrlen, ip_addr_t *ip, uint16_t *port, bool for_bind) const;
 
   // Member ordering optimized to minimize padding on 32-bit systems
   struct tcp_pcb *pcb_;

esphome/components/socket/lwip_raw_udp_impl.cpp

@@ -0,0 +1,333 @@
+#include "socket.h"
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include <cerrno>
+#include <cstring>
+
+#include "esphome/core/helpers.h"
+#include "esphome/core/log.h"
+#include "esphome/core/wake.h"
+#include "lwip_raw_common_impl.h"
+
+#include "lwip/igmp.h"
+#include "lwip/pbuf.h"
+#include "lwip/udp.h"
+
+namespace esphome::socket {
+
+// LWIP thread safety — see lwip_raw_common_impl.h for full explanation.
+// esphome::LwIPLock is the platform-provided RAII guard.
+// On RP2040, it acquires cyw43_arch_lwip_begin/end. On ESP8266, it's a no-op.
+#define LWIP_LOCK() esphome::LwIPLock lwip_lock_guard  // NOLINT
+
+// ---- LWIPRawUDPSendImpl (send-only) methods ----
+
+LWIPRawUDPSendImpl::~LWIPRawUDPSendImpl() {
+  // Guard avoids acquiring the lwip lock when already closed
+  if (this->pcb_ != nullptr)
+    this->close();
+}
+
+int LWIPRawUDPSendImpl::bind(const struct sockaddr *name, socklen_t addrlen) {
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (name == nullptr) {
+    errno = EINVAL;
+    return -1;
+  }
+  ip_addr_t ip;
+  uint16_t port;
+  if (!sockaddr_to_lwip_bind(this->family_, name, addrlen, &ip, &port)) {
+    errno = EINVAL;
+    return -1;
+  }
+  err_t err = udp_bind(this->pcb_, &ip, port);
+  if (err != ERR_OK) {
+    errno = lwip_err_to_errno(err);
+    return -1;
+  }
+  return 0;
+}
+
+int LWIPRawUDPSendImpl::close() {
+  LWIP_LOCK();
+  return this->close_internal_locked_();
+}
+
+int LWIPRawUDPSendImpl::close_internal_locked_() {
+  // Caller must hold LWIP_LOCK
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  udp_remove(this->pcb_);
+  this->pcb_ = nullptr;
+  return 0;
+}
+
+int LWIPRawUDPSendImpl::ip2sockaddr_(const ip_addr_t *ip, uint16_t port, struct sockaddr *name, socklen_t *addrlen) {
+  // UDP recv callback provides port in host byte order
+  return lwip_ip_to_sockaddr(this->family_, ip, port, name, addrlen);
+}
+
+ssize_t LWIPRawUDPSendImpl::sendto(const void *buf, size_t len, int flags, const struct sockaddr *dest_addr,
+                                   socklen_t addrlen) {
+  (void) flags;  // Flags (MSG_DONTWAIT, etc.) are ignored; raw lwip is always non-blocking
+  if (buf == nullptr || dest_addr == nullptr) {
+    errno = EINVAL;
+    return -1;
+  }
+
+  // pbuf_alloc takes u16_t length; reject oversized packets
+  if (len > UINT16_MAX) {
+    errno = EMSGSIZE;
+    return -1;
+  }
+
+  ip_addr_t dst_ip;
+  uint16_t dst_port;
+  if (!sockaddr_to_lwip(dest_addr, addrlen, &dst_ip, &dst_port)) {
+    errno = EINVAL;
+    return -1;
+  }
+
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+
+  // Allocate pbuf and copy data
+  struct pbuf *pb = pbuf_alloc(PBUF_TRANSPORT, (uint16_t) len, PBUF_RAM);
+  if (pb == nullptr) {
+    errno = ENOMEM;
+    return -1;
+  }
+  memcpy(pb->payload, buf, len);
+
+  err_t err = udp_sendto(this->pcb_, pb, &dst_ip, dst_port);
+  pbuf_free(pb);
+
+  if (err != ERR_OK) {
+    errno = lwip_err_to_errno(err);
+    return -1;
+  }
+  return (ssize_t) len;
+}
+
+int LWIPRawUDPSendImpl::setsockopt(int level, int optname, const void *optval, socklen_t optlen) {
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (level == SOL_SOCKET && optname == SO_REUSEADDR) {
+    if (optval == nullptr || optlen < sizeof(int)) {
+      errno = EINVAL;
+      return -1;
+    }
+    // Effective only where lwip is built with SO_REUSE=1 (ESP8266 yes, RP2040 currently no)
+    if (*reinterpret_cast<const int *>(optval)) {
+      ip_set_option(this->pcb_, SOF_REUSEADDR);
+    } else {
+      ip_reset_option(this->pcb_, SOF_REUSEADDR);
+    }
+    return 0;
+  }
+  if (level == SOL_SOCKET && optname == SO_BROADCAST) {
+    if (optval == nullptr || optlen < sizeof(int)) {
+      errno = EINVAL;
+      return -1;
+    }
+    int val = *reinterpret_cast<const int *>(optval);
+    if (val) {
+      ip_set_option(this->pcb_, SOF_BROADCAST);
+    } else {
+      ip_reset_option(this->pcb_, SOF_BROADCAST);
+    }
+    return 0;
+  }
+  if (level == IPPROTO_IP && (optname == IP_ADD_MEMBERSHIP || optname == IP_DROP_MEMBERSHIP)) {
+    if (optval == nullptr || optlen < sizeof(struct ip_mreq)) {
+      errno = EINVAL;
+      return -1;
+    }
+    auto *mreq = reinterpret_cast<const struct ip_mreq *>(optval);
+    ip4_addr_t multiaddr{mreq->imr_multiaddr.s_addr};
+    ip4_addr_t ifaddr{mreq->imr_interface.s_addr};
+    err_t err =
+        optname == IP_ADD_MEMBERSHIP ? igmp_joingroup(&ifaddr, &multiaddr) : igmp_leavegroup(&ifaddr, &multiaddr);
+    if (err != ERR_OK) {
+      errno = EIO;
+      return -1;
+    }
+    return 0;
+  }
+  errno = ENOPROTOOPT;
+  return -1;
+}
+
+int LWIPRawUDPSendImpl::getsockopt(int level, int optname, void *optval, socklen_t *optlen) {
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (level == SOL_SOCKET && optname == SO_REUSEADDR) {
+    if (optval == nullptr || optlen == nullptr || *optlen < sizeof(int)) {
+      errno = EINVAL;
+      return -1;
+    }
+    *reinterpret_cast<int *>(optval) = ip_get_option(this->pcb_, SOF_REUSEADDR) ? 1 : 0;
+    *optlen = sizeof(int);
+    return 0;
+  }
+  errno = ENOPROTOOPT;
+  return -1;
+}
+
+int LWIPRawUDPSendImpl::setblocking(bool blocking) {
+  if (blocking) {
+    // blocking operation not supported on raw lwip
+    errno = EINVAL;
+    return -1;
+  }
+  return 0;
+}
+
+// ---- LWIPRawUDPImpl methods ----
+
+LWIPRawUDPImpl::LWIPRawUDPImpl(sa_family_t family, struct udp_pcb *pcb) : LWIPRawUDPSendImpl(family, pcb) {
+  // Registered here (not in bind) so unbound client sockets can receive replies
+  udp_recv(this->pcb_, LWIPRawUDPImpl::s_recv_fn, this);
+}
+
+LWIPRawUDPImpl::~LWIPRawUDPImpl() {
+  // Flush rx queue and unregister callback before base destructor removes pcb
+  if (this->pcb_ != nullptr)
+    this->close();
+}
+
+int LWIPRawUDPImpl::close() {
+  LWIP_LOCK();
+  // Unregister recv callback before removing pcb
+  if (this->pcb_ != nullptr) {
+    udp_recv(this->pcb_, nullptr, nullptr);
+  }
+  // Flush queued rx packets; slots within rx_count_ always hold a live pbuf
+  for (; this->rx_count_ > 0; this->rx_count_--) {
+    pbuf_free(this->rx_queue_[this->rx_read_idx_].pb);
+    this->rx_read_idx_ = (this->rx_read_idx_ + 1) & UDP_RX_MASK;
+  }
+  // close_internal_locked_() returns EBADF if already closed, which is fine from destructor
+  return this->close_internal_locked_();
+}
+
+ssize_t LWIPRawUDPImpl::read(void *buf, size_t len) { return this->recvfrom(buf, len, nullptr, nullptr); }
+
+ssize_t LWIPRawUDPImpl::recvfrom(void *buf, size_t len, struct sockaddr *src_addr, socklen_t *addrlen) {
+  if (buf == nullptr && len > 0) {
+    errno = EINVAL;
+    return -1;
+  }
+  LWIP_LOCK();
+  if (this->pcb_ == nullptr) {
+    errno = EBADF;
+    return -1;
+  }
+  if (this->rx_count_ == 0) {
+    errno = EWOULDBLOCK;
+    return -1;
+  }
+
+  auto &pkt = this->rx_queue_[this->rx_read_idx_];
+  // On address conversion failure, still consume the packet — the failure is
+  // deterministic (family_ and *addrlen), so keeping it would wedge the queue
+  ssize_t ret = -1;
+  if (src_addr == nullptr || addrlen == nullptr ||
+      this->ip2sockaddr_(&pkt.src_addr, pkt.src_port, src_addr, addrlen) == 0) {
+    ret = (ssize_t) std::min(len, (size_t) pkt.pb->tot_len);
+    pbuf_copy_partial(pkt.pb, buf, ret, 0);
+  }
+  pbuf_free(pkt.pb);
+  this->rx_read_idx_ = (this->rx_read_idx_ + 1) & UDP_RX_MASK;
+  this->rx_count_--;
+  return ret;
+}
+
+void LWIPRawUDPImpl::s_recv_fn(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port) {
+  auto *self = reinterpret_cast<LWIPRawUDPImpl *>(arg);
+  self->recv_fn_(p, addr, port);
+}
+
+// LWIP CALLBACK — runs from IRQ context on RP2040 (low-priority user IRQ).
+// No heap allocation allowed — malloc is not IRQ-safe (see #14687).
+// No LWIP_LOCK() needed — lwip core already holds the async_context lock.
+void LWIPRawUDPImpl::recv_fn_(struct pbuf *p, const ip_addr_t *addr, u16_t port) {
+  if (p == nullptr)
+    return;
+
+  // Check if queue is full
+  if (this->rx_count_ >= UDP_RX_QUEUE_SIZE) {
+    // Drop packet — queue full. Can't log from IRQ context, so count it
+    // (saturating) for consumers to surface via get_rx_dropped().
+    if (this->rx_dropped_ != UINT16_MAX)
+      this->rx_dropped_++;
+    pbuf_free(p);
+    return;
+  }
+
+  // Enqueue the packet
+  uint8_t write_idx = (this->rx_read_idx_ + this->rx_count_) & UDP_RX_MASK;
+  auto &slot = this->rx_queue_[write_idx];
+  slot.pb = p;
+  slot.src_addr = *addr;
+  slot.src_port = port;
+  this->rx_count_++;
+
+  esphome::wake_loop_any_context();
+}
+
+// ---- UDP Factory functions ----
+
+static struct udp_pcb *new_udp_pcb(int domain) {
+#if LWIP_IPV6
+  return udp_new_ip_type(domain == AF_INET6 ? IPADDR_TYPE_ANY : IPADDR_TYPE_V4);
+#else
+  return udp_new();
+#endif
+}
+
+std::unique_ptr<UDPSendSocket> socket_udp_send(int domain, int protocol) {
+  (void) protocol;  // Raw lwip UDP ignores protocol; kept for API compatibility
+  LWIP_LOCK();
+  auto *pcb = new_udp_pcb(domain);
+  if (pcb == nullptr) {
+    errno = ENOMEM;
+    return nullptr;
+  }
+  return make_unique<LWIPRawUDPSendImpl>((sa_family_t) domain, pcb);
+}
+
+std::unique_ptr<UDPSocket> socket_udp(int domain, int protocol) {
+  (void) protocol;  // Raw lwip UDP ignores protocol; kept for API compatibility
+  LWIP_LOCK();
+  auto *pcb = new_udp_pcb(domain);
+  if (pcb == nullptr) {
+    errno = ENOMEM;
+    return nullptr;
+  }
+  // Ctor registers the recv callback under the lock held here
+  return make_unique<LWIPRawUDPImpl>((sa_family_t) domain, pcb);
+}
+
+#undef LWIP_LOCK
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP

esphome/components/socket/lwip_raw_udp_impl.h

@@ -0,0 +1,113 @@
+#pragma once
+#include "esphome/core/defines.h"
+
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+
+#include <array>
+#include <cstdint>
+
+#include "headers.h"
+#include "lwip/ip.h"
+#include "lwip/udp.h"
+
+namespace esphome::socket {
+
+/// Send-only UDP socket implementation for LWIP raw API.
+/// Non-virtual, concrete type. Uses lwip/udp.h raw API.
+/// No receive capability — use LWIPRawUDPImpl for sockets that need to receive.
+class LWIPRawUDPSendImpl {
+ public:
+  /// The pcb is allocated by the factory (like the TCP impl); never null here.
+  LWIPRawUDPSendImpl(sa_family_t family, struct udp_pcb *pcb) : pcb_(pcb), family_(family) {}
+  ~LWIPRawUDPSendImpl();
+  LWIPRawUDPSendImpl(const LWIPRawUDPSendImpl &) = delete;
+  LWIPRawUDPSendImpl &operator=(const LWIPRawUDPSendImpl &) = delete;
+
+  int bind(const struct sockaddr *name, socklen_t addrlen);
+  int close();
+
+  /// Send a UDP packet to the specified destination.
+  ssize_t sendto(const void *buf, size_t len, int flags, const struct sockaddr *dest_addr, socklen_t addrlen);
+
+  int setsockopt(int level, int optname, const void *optval, socklen_t optlen);
+  int getsockopt(int level, int optname, void *optval, socklen_t *optlen);
+
+  int setblocking(bool blocking);
+
+  bool ready() const { return false; }
+  int get_fd() const { return -1; }
+
+ protected:
+  /// Convert lwip ip_addr_t and port to sockaddr.
+  int ip2sockaddr_(const ip_addr_t *ip, uint16_t port, struct sockaddr *name, socklen_t *addrlen);
+
+  /// Shared close logic — removes the udp pcb. Caller must hold LWIP_LOCK.
+  int close_internal_locked_();
+
+  struct udp_pcb *pcb_;
+  sa_family_t family_;
+};
+
+/// UDP socket with receive support for LWIP raw API.
+/// Extends LWIPRawUDPSendImpl with a fixed-size ring buffer for incoming packets.
+/// Inheritance is private (base dtor is non-virtual; converting to a base
+/// pointer would leak queued pbufs on destruction).
+class LWIPRawUDPImpl : private LWIPRawUDPSendImpl {
+ public:
+  /// Caller (the factory) must hold the lwip lock; registers the recv callback.
+  LWIPRawUDPImpl(sa_family_t family, struct udp_pcb *pcb);
+  ~LWIPRawUDPImpl();
+
+  using LWIPRawUDPSendImpl::bind;
+  using LWIPRawUDPSendImpl::get_fd;
+  using LWIPRawUDPSendImpl::getsockopt;
+  using LWIPRawUDPSendImpl::sendto;
+  using LWIPRawUDPSendImpl::setblocking;
+  using LWIPRawUDPSendImpl::setsockopt;
+
+  /// Close the socket, flushing any queued rx packets first.
+  int close();
+
+  /// Read the next queued packet, discarding source address info.
+  /// If buf is smaller than the packet, data is silently truncated (returns bytes copied).
+  /// Note: unlike POSIX MSG_TRUNC, this does not return the original packet length on truncation.
+  ssize_t read(void *buf, size_t len);
+  /// Read the next queued packet and return the source address.
+  /// If buf is smaller than the packet, data is silently truncated (returns bytes copied).
+  /// Note: unlike POSIX MSG_TRUNC, this does not return the original packet length on truncation.
+  ssize_t recvfrom(void *buf, size_t len, struct sockaddr *src_addr, socklen_t *addrlen);
+
+  /// Returns true if there are packets available to read.
+  /// Intentionally unlocked — same rationale as LWIPRawImpl::ready().
+  bool ready() const { return this->rx_count_ > 0; }
+
+  /// Number of packets dropped because the rx queue was full (saturating).
+  uint16_t get_rx_dropped() const { return this->rx_dropped_; }
+
+ protected:
+  static void s_recv_fn(void *arg, struct udp_pcb *pcb, struct pbuf *p, const ip_addr_t *addr, u16_t port);
+  void recv_fn_(struct pbuf *p, const ip_addr_t *addr, u16_t port);
+
+  /// Ring buffer for received UDP packets.
+  /// Both producer (recv callback) and consumer (main loop) are serialized by the
+  /// lwip lock — the callback runs under lwip core lock, and consumer methods hold
+  /// LWIP_LOCK(). All 4 slots are usable (no wasted slot for full/empty distinction).
+  /// No heap allocation in the recv callback — packets are dropped if the queue is full.
+  static constexpr uint8_t UDP_RX_QUEUE_SIZE = 4;
+  static constexpr uint8_t UDP_RX_MASK = UDP_RX_QUEUE_SIZE - 1;
+  static_assert((UDP_RX_QUEUE_SIZE & UDP_RX_MASK) == 0, "UDP_RX_QUEUE_SIZE must be power of 2");
+  // Fields are written by recv_fn_ before rx_count_ makes a slot visible
+  struct UDPRxPacket {
+    ip_addr_t src_addr;
+    struct pbuf *pb;
+    uint16_t src_port;
+  };
+  std::array<UDPRxPacket, UDP_RX_QUEUE_SIZE> rx_queue_{};
+  uint16_t rx_dropped_{0};
+  uint8_t rx_read_idx_{0};
+  uint8_t rx_count_{0};
+};
+
+}  // namespace esphome::socket
+
+#endif  // USE_SOCKET_IMPL_LWIP_TCP

esphome/components/socket/lwip_sockets_impl.h

@@ -84,6 +84,9 @@ class LwIPSocketImpl {
 
   int get_fd() const { return this->fd_; }
 
+  /// UDP rx drop counter parity with LWIPRawUDPImpl; drops are not counted here.
+  uint16_t get_rx_dropped() const { return 0; }
+
  protected:
   // fd_ < 0 means "not open" — used both pre-open (initial state) and post-close. This
   // replaces a separate closed_ flag: close() sets fd_ = -1 after lwip_close(), and the

esphome/components/socket/socket.cpp

@@ -129,25 +129,7 @@ size_t format_sockaddr_to(const struct sockaddr *addr_ptr, socklen_t len, std::s
   return 0;
 }
 
-std::unique_ptr<Socket> socket_ip(int type, int protocol) {
-#if USE_NETWORK_IPV6
-  return socket(AF_INET6, type, protocol);
-#else
-  return socket(AF_INET, type, protocol);
-#endif /* USE_NETWORK_IPV6 */
-}
-
-#ifdef USE_SOCKET_IMPL_LWIP_TCP
-// LWIP_TCP has separate Socket/ListenSocket types — needs out-of-line factory.
-// BSD and LWIP_SOCKETS define this inline in socket.h.
-std::unique_ptr<ListenSocket> socket_ip_loop_monitored(int type, int protocol) {
-#if USE_NETWORK_IPV6
-  return socket_listen_loop_monitored(AF_INET6, type, protocol);
-#else
-  return socket_listen_loop_monitored(AF_INET, type, protocol);
-#endif /* USE_NETWORK_IPV6 */
-}
-#endif
+std::unique_ptr<Socket> socket_ip(int type, int protocol) { return socket(IP_DOMAIN, type, protocol); }
 
 #if defined(USE_SOCKET_IMPL_BSD_SOCKETS) || defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
 // Callback must be a temporary lambda

esphome/components/socket/socket.h

@@ -20,6 +20,7 @@
 #include "lwip_sockets_impl.h"
 #elif defined(USE_SOCKET_IMPL_LWIP_TCP)
 #include "lwip_raw_tcp_impl.h"
+#include "lwip_raw_udp_impl.h"
 #endif
 
 namespace esphome::socket {
@@ -27,17 +28,32 @@ namespace esphome::socket {
 // Type aliases — only one implementation is active per build.
 // Socket is the concrete type for connected sockets.
 // ListenSocket is the concrete type for listening/server sockets.
-// On BSD and LWIP_SOCKETS, both aliases resolve to the same type.
+// UDPSocket is the concrete type for UDP sockets (send + receive).
+// UDPSendSocket is the concrete type for send-only UDP sockets.
+// On BSD and LWIP_SOCKETS, all aliases resolve to the same type.
 // On LWIP_TCP, they are different types (no virtual dispatch between them).
 #ifdef USE_SOCKET_IMPL_BSD_SOCKETS
 using Socket = BSDSocketImpl;
 using ListenSocket = BSDSocketImpl;
+using UDPSendSocket = BSDSocketImpl;
+using UDPSocket = BSDSocketImpl;
 #elif defined(USE_SOCKET_IMPL_LWIP_SOCKETS)
 using Socket = LwIPSocketImpl;
 using ListenSocket = LwIPSocketImpl;
+using UDPSendSocket = LwIPSocketImpl;
+using UDPSocket = LwIPSocketImpl;
 #elif defined(USE_SOCKET_IMPL_LWIP_TCP)
 using Socket = LWIPRawImpl;
 using ListenSocket = LWIPRawListenImpl;
+using UDPSendSocket = LWIPRawUDPSendImpl;
+using UDPSocket = LWIPRawUDPImpl;
+#endif
+
+// Domain used by the socket_ip_* helpers: newest available IP domain.
+#if USE_NETWORK_IPV6
+inline constexpr int IP_DOMAIN = AF_INET6;
+#else
+inline constexpr int IP_DOMAIN = AF_INET;
 #endif
 
 #ifdef USE_LWIP_FAST_SELECT
@@ -105,6 +121,36 @@ std::unique_ptr<Socket> socket_ip(int type, int protocol);
 /// File descriptors >= FD_SETSIZE will not be monitored and will log an error.
 std::unique_ptr<Socket> socket_loop_monitored(int domain, int type, int protocol);
 
+/// Create a send-only UDP socket (socket_udp_send), a UDP socket with receive
+/// support (socket_udp), or a UDP socket monitored for data in the main loop
+/// (socket_udp_loop_monitored).
+#ifdef USE_SOCKET_IMPL_LWIP_TCP
+std::unique_ptr<UDPSendSocket> socket_udp_send(int domain, int protocol);
+std::unique_ptr<UDPSocket> socket_udp(int domain, int protocol);
+// Wake is built into the recv callback, so monitoring needs nothing extra.
+inline std::unique_ptr<UDPSocket> socket_udp_loop_monitored(int domain, int protocol) {
+  return socket_udp(domain, protocol);
+}
+#else
+inline std::unique_ptr<UDPSendSocket> socket_udp_send(int domain, int protocol) {
+  return esphome::socket::socket(domain, SOCK_DGRAM, protocol);
+}
+inline std::unique_ptr<UDPSocket> socket_udp(int domain, int protocol) {
+  return esphome::socket::socket(domain, SOCK_DGRAM, protocol);
+}
+// Registers the socket with the Application's select() loop.
+inline std::unique_ptr<UDPSocket> socket_udp_loop_monitored(int domain, int protocol) {
+  return socket_loop_monitored(domain, SOCK_DGRAM, protocol);
+}
+#endif
+
+/// socket_udp* variants using the newest available IP domain.
+inline std::unique_ptr<UDPSendSocket> socket_ip_udp_send(int protocol) { return socket_udp_send(IP_DOMAIN, protocol); }
+inline std::unique_ptr<UDPSocket> socket_ip_udp(int protocol) { return socket_udp(IP_DOMAIN, protocol); }
+inline std::unique_ptr<UDPSocket> socket_ip_udp_loop_monitored(int protocol) {
+  return socket_udp_loop_monitored(IP_DOMAIN, protocol);
+}
+
 /// Create a listening socket of the given domain, type and protocol.
 /// Create a listening socket and monitor it for data in the main loop.
 /// Create a listening socket in the newest available IP domain and monitor it.
@@ -112,7 +158,6 @@ std::unique_ptr<Socket> socket_loop_monitored(int domain, int type, int protocol
 // LWIP_TCP has separate Socket/ListenSocket types — needs distinct factory functions.
 std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int protocol);
 std::unique_ptr<ListenSocket> socket_listen_loop_monitored(int domain, int type, int protocol);
-std::unique_ptr<ListenSocket> socket_ip_loop_monitored(int type, int protocol);
 #else
 // BSD and LWIP_SOCKETS: Socket == ListenSocket, so listen variants just delegate.
 inline std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int protocol) {
@@ -121,14 +166,10 @@ inline std::unique_ptr<ListenSocket> socket_listen(int domain, int type, int pro
 inline std::unique_ptr<ListenSocket> socket_listen_loop_monitored(int domain, int type, int protocol) {
   return socket_loop_monitored(domain, type, protocol);
 }
+#endif
 inline std::unique_ptr<ListenSocket> socket_ip_loop_monitored(int type, int protocol) {
-#if USE_NETWORK_IPV6
-  return socket_loop_monitored(AF_INET6, type, protocol);
-#else
-  return socket_loop_monitored(AF_INET, type, protocol);
-#endif
+  return socket_listen_loop_monitored(IP_DOMAIN, type, protocol);
 }
-#endif
 
 /// Set a sockaddr to the specified address and port for the IP version used by socket_ip().
 /// @param addr Destination sockaddr structure