1.7.x/ccs-patch/socket.diff

Index: trunk/1.7.x/ccs-patch/include/linux/ccsecurity.h
===================================================================
--- trunk/1.7.x/ccs-patch/include/linux/ccsecurity.h    (revision 3827)
+++ trunk/1.7.x/ccs-patch/include/linux/ccsecurity.h    (working copy)
@@ -138,12 +138,12 @@
                                          struct sockaddr *addr, int addr_len);
        int (*socket_bind_permission) (struct socket *sock,
                                       struct sockaddr *addr, int addr_len);
-       int (*socket_accept_permission) (struct socket *sock,
-                                        struct sockaddr *addr);
+       int (*socket_post_accept_permission) (struct socket *sock,
+                                             struct socket *newsock);
        int (*socket_sendmsg_permission) (struct socket *sock,
                                          struct msghdr *msg, int size);
-       int (*socket_recvmsg_permission) (struct sock *sk, struct sk_buff *skb,
-                                         const unsigned int flags);
+       int (*socket_post_recvmsg_permission) (struct sock *sk,
+                                              struct sk_buff *skb);
        int (*chown_permission) (struct dentry *dentry, struct vfsmount *mnt,
                                 uid_t user, gid_t group);
        int (*chmod_permission) (struct dentry *dentry, struct vfsmount *mnt,
@@ -162,135 +162,145 @@
 
 static inline int ccs_chroot_permission(struct path *path)
 {
-       return ccsecurity_ops.chroot_permission ?
-               ccsecurity_ops.chroot_permission(path) : 0;
+       int (*func) (struct path *) = ccsecurity_ops.chroot_permission;
+       return func ? func(path) : 0;
 }
 
 static inline int ccs_pivot_root_permission(struct path *old_path,
                                            struct path *new_path)
 {
-       return ccsecurity_ops.pivot_root_permission ?
-               ccsecurity_ops.pivot_root_permission(old_path, new_path) : 0;
+       int (*func) (struct path *, struct path *)
+               = ccsecurity_ops.pivot_root_permission;
+       return func ? func(old_path, new_path) : 0;
 }
 
 static inline int ccs_may_mount(struct path *path)
 {
-       return ccsecurity_ops.may_mount ?
-               ccsecurity_ops.may_mount(path) : 0;
+       int (*func) (struct path *) = ccsecurity_ops.may_mount;
+       return func ? func(path) : 0;
 }
 
 static inline int ccs_mount_permission(char *dev_name, struct path *path,
                                       char *type, unsigned long flags,
                                       void *data_page)
 {
-       return ccsecurity_ops.mount_permission ?
-               ccsecurity_ops.mount_permission(dev_name, path, type, flags,
-                                               data_page) : 0;
+       int (*func) (char *, struct path *, char *, unsigned long, void *)
+               = ccsecurity_ops.mount_permission;
+       return func ? func(dev_name, path, type, flags, data_page) : 0;
 }
 
 #else
 
 static inline int ccs_chroot_permission(struct nameidata *nd)
 {
-       return ccsecurity_ops.chroot_permission ?
-               ccsecurity_ops.chroot_permission(nd) : 0;
+       int (*func) (struct nameidata *) = ccsecurity_ops.chroot_permission;
+       return func ? func(nd) : 0;
 }
 
 static inline int ccs_pivot_root_permission(struct nameidata *old_nd,
                                            struct nameidata *new_nd)
 {
-       return ccsecurity_ops.pivot_root_permission ?
-               ccsecurity_ops.pivot_root_permission(old_nd, new_nd) : 0;
+       int (*func) (struct nameidata *, struct nameidata *)
+               = ccsecurity_ops.pivot_root_permission;
+       return func ? func(old_nd, new_nd) : 0;
 }
 
 static inline int ccs_may_mount(struct nameidata *nd)
 {
-       return ccsecurity_ops.may_mount ? ccsecurity_ops.may_mount(nd) : 0;
+       int (*func) (struct nameidata *) = ccsecurity_ops.may_mount;
+       return func ? func(nd) : 0;
 }
 
 static inline int ccs_mount_permission(char *dev_name, struct nameidata *nd,
                                       char *type, unsigned long flags,
                                       void *data_page)
 {
-       return ccsecurity_ops.mount_permission ?
-               ccsecurity_ops.mount_permission(dev_name, nd, type, flags,
-                                               data_page) : 0;
+       int (*func) (char *, struct nameidata *, char *, unsigned long, void *)
+               = ccsecurity_ops.mount_permission;
+       return func ? func(dev_name, nd, type, flags, data_page) : 0;
 }
 #endif
 
 static inline int ccs_umount_permission(struct vfsmount *mnt, int flags)
 {
-       return ccsecurity_ops.umount_permission ?
-               ccsecurity_ops.umount_permission(mnt, flags) : 0;
+       int (*func) (struct vfsmount *, int)
+               = ccsecurity_ops.umount_permission;
+       return func ? func(mnt, flags) : 0;
 }
 
 static inline _Bool ccs_lport_reserved(const u16 port)
 {
-       return ccsecurity_ops.lport_reserved ?
-               ccsecurity_ops.lport_reserved(port) : 0;
+       _Bool (*func) (const u16) = ccsecurity_ops.lport_reserved;
+       return func ? func(port) : 0;
 }
 
 static inline int ccs_ptrace_permission(long request, long pid)
 {
-       return ccsecurity_ops.ptrace_permission ?
-               ccsecurity_ops.ptrace_permission(request, pid) : 0;
+       int (*func) (long, long) = ccsecurity_ops.ptrace_permission;
+       return func ? func(request, pid) : 0;
 }
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 34)
 static inline void ccs_save_open_mode(int mode)
 {
-       if (ccsecurity_ops.save_open_mode)
-               ccsecurity_ops.save_open_mode(mode);
+       void (*func) (int) = ccsecurity_ops.save_open_mode;
+       if (func)
+               func(mode);
 }
 
 static inline void ccs_clear_open_mode(void)
 {
-       if (ccsecurity_ops.clear_open_mode)
-               ccsecurity_ops.clear_open_mode();
+       void (*func) (void) = ccsecurity_ops.clear_open_mode;
+       if (func)
+               func();
 }
 #endif
 
 static inline int ccs_open_permission(struct dentry *dentry,
                                      struct vfsmount *mnt, const int flag)
 {
-       return ccsecurity_ops.open_permission ?
-               ccsecurity_ops.open_permission(dentry, mnt, flag) : 0;
+       int (*func) (struct dentry *, struct vfsmount *, const int)
+               = ccsecurity_ops.open_permission;
+       return func ? func(dentry, mnt, flag) : 0;
 }
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 33)
 static inline int ccs_fcntl_permission(struct file *file, unsigned int cmd,
                                       unsigned long arg)
 {
-       return ccsecurity_ops.fcntl_permission ?
-               ccsecurity_ops.fcntl_permission(file, cmd, arg) : 0;
+       int (*func) (struct file *, unsigned int, unsigned long)
+               = ccsecurity_ops.fcntl_permission;
+       return func ? func(file, cmd, arg) : 0;
 }
 #else
 static inline int ccs_rewrite_permission(struct file *filp)
 {
-       return ccsecurity_ops.rewrite_permission ?
-               ccsecurity_ops.rewrite_permission(filp) : 0;
+       int (*func) (struct file *) = ccsecurity_ops.rewrite_permission;
+       return func ? func(filp) : 0;
 }
 #endif
 
 static inline int ccs_ioctl_permission(struct file *filp, unsigned int cmd,
                                       unsigned long arg)
 {
-       return ccsecurity_ops.ioctl_permission ?
-               ccsecurity_ops.ioctl_permission(filp, cmd, arg) : 0;
+       int (*func) (struct file *, unsigned int, unsigned long)
+               = ccsecurity_ops.ioctl_permission;
+       return func ? func(filp, cmd, arg) : 0;
 }
 
 static inline int ccs_parse_table(int __user *name, int nlen,
                                  void __user *oldval, void __user *newval,
                                  struct ctl_table *table)
 {
-       return ccsecurity_ops.parse_table ?
-               ccsecurity_ops.parse_table(name, nlen, oldval, newval, table) :
-               0;
+       int (*func) (int __user *, int, void __user *, void __user *,
+                    struct ctl_table *) = ccsecurity_ops.parse_table;
+       return func ? func(name, nlen, oldval, newval, table) : 0;
 }
 
 static inline _Bool ccs_capable(const u8 operation)
 {
-       return ccsecurity_ops.capable ? ccsecurity_ops.capable(operation) : 1;
+       _Bool (*func) (const u8) = ccsecurity_ops.capable;
+       return func ? func(operation) : 1;
 }
 
 static inline int ccs_mknod_permission(struct inode *dir,
@@ -298,33 +308,37 @@
                                       struct vfsmount *mnt, unsigned int mode,
                                       unsigned int dev)
 {
-       return ccsecurity_ops.mknod_permission ?
-               ccsecurity_ops.mknod_permission(dir, dentry, mnt, mode, dev) :
-               0;
+       int (*func) (struct inode *, struct dentry *, struct vfsmount *,
+                    unsigned int, unsigned int)
+               = ccsecurity_ops.mknod_permission;
+       return func ? func(dir, dentry, mnt, mode, dev) : 0;
 }
 
 static inline int ccs_mkdir_permission(struct inode *dir,
                                       struct dentry *dentry,
                                       struct vfsmount *mnt, unsigned int mode)
 {
-       return ccsecurity_ops.mkdir_permission ?
-               ccsecurity_ops.mkdir_permission(dir, dentry, mnt, mode) : 0;
+       int (*func) (struct inode *, struct dentry *, struct vfsmount *,
+                    unsigned int) = ccsecurity_ops.mkdir_permission;
+       return func ? func(dir, dentry, mnt, mode) : 0;
 }
 
 static inline int ccs_rmdir_permission(struct inode *dir,
                                       struct dentry *dentry,
                                       struct vfsmount *mnt)
 {
-       return ccsecurity_ops.rmdir_permission ?
-               ccsecurity_ops.rmdir_permission(dir, dentry, mnt) : 0;
+       int (*func) (struct inode *, struct dentry *, struct vfsmount *)
+               = ccsecurity_ops.rmdir_permission;
+       return func ? func(dir, dentry, mnt) : 0;
 }
 
 static inline int ccs_unlink_permission(struct inode *dir,
                                        struct dentry *dentry,
                                        struct vfsmount *mnt)
 {
-       return ccsecurity_ops.unlink_permission ?
-               ccsecurity_ops.unlink_permission(dir, dentry, mnt) : 0;
+       int (*func) (struct inode *, struct dentry *, struct vfsmount *)
+               = ccsecurity_ops.unlink_permission;
+       return func ? func(dir, dentry, mnt) : 0;
 }
 
 static inline int ccs_symlink_permission(struct inode *dir,
@@ -332,16 +346,18 @@
                                         struct vfsmount *mnt,
                                         const char *from)
 {
-       return ccsecurity_ops.symlink_permission ?
-               ccsecurity_ops.symlink_permission(dir, dentry, mnt, from) : 0;
+       int (*func) (struct inode *, struct dentry *, struct vfsmount *,
+                    const char *) = ccsecurity_ops.symlink_permission;
+       return func ? func(dir, dentry, mnt, from) : 0;
 }
 
 static inline int ccs_truncate_permission(struct dentry *dentry,
                                          struct vfsmount *mnt, loff_t length,
                                          unsigned int time_attrs)
 {
-       return ccsecurity_ops.truncate_permission ?
-               ccsecurity_ops.truncate_permission(dentry, mnt) : 0;
+       int (*func) (struct dentry *, struct vfsmount *)
+               = ccsecurity_ops.truncate_permission;
+       return func ? func(dentry, mnt) : 0;
 }
 
 static inline int ccs_rename_permission(struct inode *old_dir,
@@ -350,9 +366,10 @@
                                        struct dentry *new_dentry,
                                        struct vfsmount *mnt)
 {
-       return ccsecurity_ops.rename_permission ?
-               ccsecurity_ops.rename_permission(old_dir, old_dentry, new_dir,
-                                                new_dentry, mnt) : 0;
+       int (*func) (struct inode *, struct dentry *, struct inode *,
+                    struct dentry *, struct vfsmount *)
+               = ccsecurity_ops.rename_permission;
+       return func ? func(old_dir, old_dentry, new_dir, new_dentry, mnt) : 0;
 }
 
 static inline int ccs_link_permission(struct dentry *old_dentry,
@@ -360,125 +377,131 @@
                                      struct dentry *new_dentry,
                                      struct vfsmount *mnt)
 {
-       return ccsecurity_ops.link_permission ?
-               ccsecurity_ops.link_permission(old_dentry, new_dir, new_dentry,
-                                              mnt) : 0;
+       int (*func) (struct dentry *, struct inode *, struct dentry *,
+                    struct vfsmount *) = ccsecurity_ops.link_permission;
+       return func ? func(old_dentry, new_dir, new_dentry, mnt) : 0;
 }
 
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 30)
 static inline int ccs_open_exec_permission(struct dentry *dentry,
                                           struct vfsmount *mnt)
 {
-       return ccsecurity_ops.open_exec_permission ?
-               ccsecurity_ops.open_exec_permission(dentry, mnt) : 0;
+       int (*func) (struct dentry *, struct vfsmount *)
+               = ccsecurity_ops.open_exec_permission;
+       return func ? func(dentry, mnt) : 0;
 }
 
 static inline int ccs_uselib_permission(struct dentry *dentry,
                                        struct vfsmount *mnt)
 {
-       return ccsecurity_ops.uselib_permission ?
-               ccsecurity_ops.uselib_permission(dentry, mnt) : 0;
+       int (*func) (struct dentry *, struct vfsmount *)
+               = ccsecurity_ops.uselib_permission;
+       return func ? func(dentry, mnt) : 0;
 }
 #endif
 
 static inline int ccs_kill_permission(pid_t pid, int sig)
 {
-       return ccsecurity_ops.kill_permission ?
-               ccsecurity_ops.kill_permission(pid, sig) : 0;
+       int (*func) (pid_t, int) = ccsecurity_ops.kill_permission;
+       return func ? func(pid, sig) : 0;
 }
 
 static inline int ccs_tgkill_permission(pid_t tgid, pid_t pid, int sig)
 {
-       return ccsecurity_ops.tgkill_permission ?
-               ccsecurity_ops.tgkill_permission(tgid, pid, sig) : 0;
+       int (*func) (pid_t, pid_t, int) = ccsecurity_ops.tgkill_permission;
+       return func ? func(tgid, pid, sig) : 0;
 }
 
 static inline int ccs_tkill_permission(pid_t pid, int sig)
 {
-       return ccsecurity_ops.tkill_permission ?
-               ccsecurity_ops.tkill_permission(pid, sig) : 0;
+       int (*func) (pid_t, int) = ccsecurity_ops.tkill_permission;
+       return func ? func(pid, sig) : 0;
 }
 
 static inline int ccs_socket_create_permission(int family, int type,
                                               int protocol)
 {
-       return ccsecurity_ops.socket_create_permission ?
-               ccsecurity_ops.socket_create_permission(family, type, protocol)
-               : 0;
+       int (*func) (int, int, int) = ccsecurity_ops.socket_create_permission;
+       return func ? func(family, type, protocol) : 0;
 }
 
 static inline int ccs_socket_listen_permission(struct socket *sock)
 {
-       return ccsecurity_ops.socket_listen_permission ?
-               ccsecurity_ops.socket_listen_permission(sock) : 0;
+       int (*func) (struct socket *)
+               = ccsecurity_ops.socket_listen_permission;
+       return func ? func(sock) : 0;
 }
 
 static inline int ccs_socket_connect_permission(struct socket *sock,
                                                struct sockaddr *addr,
                                                int addr_len)
 {
-       return ccsecurity_ops.socket_connect_permission ?
-               ccsecurity_ops.socket_connect_permission(sock, addr, addr_len)
-               : 0;
+       int (*func) (struct socket *, struct sockaddr *, int)
+               = ccsecurity_ops.socket_connect_permission;
+       return func ? func(sock, addr, addr_len) : 0;
 }
 
 static inline int ccs_socket_bind_permission(struct socket *sock,
                                             struct sockaddr *addr,
                                             int addr_len)
 {
-       return ccsecurity_ops.socket_bind_permission ?
-               ccsecurity_ops.socket_bind_permission(sock, addr, addr_len) :
-               0;
+       int (*func) (struct socket *, struct sockaddr *, int)
+               = ccsecurity_ops.socket_bind_permission;
+       return func ? func(sock, addr, addr_len) : 0;
 }
 
-static inline int ccs_socket_accept_permission(struct socket *sock,
-                                              struct sockaddr *addr)
+static inline int ccs_socket_post_accept_permission(struct socket *sock,
+                                                   struct socket *newsock)
 {
-       return ccsecurity_ops.socket_accept_permission ?
-               ccsecurity_ops.socket_accept_permission(sock, addr) : 0;
+       int (*func) (struct socket *, struct socket *)
+               = ccsecurity_ops.socket_post_accept_permission;
+       return func ? func(sock, newsock) : 0;
 }
 
 static inline int ccs_socket_sendmsg_permission(struct socket *sock,
                                                struct msghdr *msg,
                                                int size)
 {
-       return ccsecurity_ops.socket_sendmsg_permission ?
-               ccsecurity_ops.socket_sendmsg_permission(sock, msg, size) : 0;
+       int (*func) (struct socket *, struct msghdr *, int)
+               = ccsecurity_ops.socket_sendmsg_permission;
+       return func ? func(sock, msg, size) : 0;
 }
 
-static inline int ccs_socket_recvmsg_permission(struct sock *sk,
-                                               struct sk_buff *skb,
-                                               const unsigned int flags)
+static inline int ccs_socket_post_recvmsg_permission(struct sock *sk,
+                                                    struct sk_buff *skb)
 {
-       return ccsecurity_ops.socket_recvmsg_permission ?
-               ccsecurity_ops.socket_recvmsg_permission(sk, skb, flags) : 0;
+       int (*func) (struct sock *, struct sk_buff *)
+               = ccsecurity_ops.socket_post_recvmsg_permission;
+       return func ? func(sk, skb) : 0;
 }
 
 static inline int ccs_chown_permission(struct dentry *dentry,
                                       struct vfsmount *mnt, uid_t user,
                                       gid_t group)
 {
-       return ccsecurity_ops.chown_permission ?
-               ccsecurity_ops.chown_permission(dentry, mnt, user, group) : 0;
+       int (*func) (struct dentry *, struct vfsmount *, uid_t, gid_t)
+               = ccsecurity_ops.chown_permission;
+       return func ? func(dentry, mnt, user, group) : 0;
 }
 
 static inline int ccs_chmod_permission(struct dentry *dentry,
                                       struct vfsmount *mnt, mode_t mode)
 {
-       return ccsecurity_ops.chmod_permission ?
-               ccsecurity_ops.chmod_permission(dentry, mnt, mode) : 0;
+       int (*func) (struct dentry *, struct vfsmount *, mode_t)
+               = ccsecurity_ops.chmod_permission;
+       return func ? func(dentry, mnt, mode) : 0;
 }
 
 static inline int ccs_sigqueue_permission(pid_t pid, int sig)
 {
-       return ccsecurity_ops.sigqueue_permission ?
-               ccsecurity_ops.sigqueue_permission(pid, sig) : 0;
+       int (*func) (pid_t, int) = ccsecurity_ops.sigqueue_permission;
+       return func ? func(pid, sig) : 0;
 }
 
 static inline int ccs_tgsigqueue_permission(pid_t tgid, pid_t pid, int sig)
 {
-       return ccsecurity_ops.tgsigqueue_permission ?
-               ccsecurity_ops.tgsigqueue_permission(tgid, pid, sig) : 0;
+       int (*func) (pid_t, pid_t, int) = ccsecurity_ops.tgsigqueue_permission;
+       return func ? func(tgid, pid, sig) : 0;
 }
 
 static inline int ccs_search_binary_handler(struct linux_binprm *bprm,
@@ -487,6 +510,65 @@
        return ccsecurity_ops.search_binary_handler(bprm, regs);
 }
 
+/* for net/ipv4/raw.c and net/ipv6/raw.c */
+#if defined(_RAW_H) || defined(_NET_RAWV6_H)
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
+static inline void skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
+                                    unsigned int flags)
+{
+       /* Clear queue. */
+       if (flags & MSG_PEEK) {
+               int clear = 0;
+               spin_lock_irq(&sk->receive_queue.lock);
+               if (skb == skb_peek(&sk->receive_queue)) {
+                       __skb_unlink(skb, &sk->receive_queue);
+                       clear = 1;
+               }
+               spin_unlock_irq(&sk->receive_queue.lock);
+               if (clear)
+                       kfree_skb(skb);
+       }
+       skb_free_datagram(sk, skb);
+}
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 12)
+static inline void skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
+                                    unsigned int flags)
+{
+       /* Clear queue. */
+       if (flags & MSG_PEEK) {
+               int clear = 0;
+               spin_lock_irq(&sk->sk_receive_queue.lock);
+               if (skb == skb_peek(&sk->sk_receive_queue)) {
+                       __skb_unlink(skb, &sk->sk_receive_queue);
+                       clear = 1;
+               }
+               spin_unlock_irq(&sk->sk_receive_queue.lock);
+               if (clear)
+                       kfree_skb(skb);
+       }
+       skb_free_datagram(sk, skb);
+}
+#elif LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+static inline void skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
+                                    unsigned int flags)
+{
+       /* Clear queue. */
+       if (flags & MSG_PEEK) {
+               int clear = 0;
+               spin_lock_bh(&sk->sk_receive_queue.lock);
+               if (skb == skb_peek(&sk->sk_receive_queue)) {
+                       __skb_unlink(skb, &sk->sk_receive_queue);
+                       clear = 1;
+               }
+               spin_unlock_bh(&sk->sk_receive_queue.lock);
+               if (clear)
+                       kfree_skb(skb);
+       }
+       skb_free_datagram(sk, skb);
+}
+#endif
+#endif
+
 #else
 
 #if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
@@ -712,8 +794,8 @@
        return 0;
 }
 
-static inline int ccs_socket_accept_permission(struct socket *sock,
-                                              struct sockaddr *addr)
+static inline int ccs_socket_post_accept_permission(struct socket *sock,
+                                                   struct socket *newsock)
 {
        return 0;
 }
@@ -724,9 +806,8 @@
        return 0;
 }
 
-static inline int ccs_socket_recvmsg_permission(struct sock *sk,
-                                               struct sk_buff *skb,
-                                               const unsigned int flags)
+static inline int ccs_socket_post_recvmsg_permission(struct sock *sk,
+                                                    struct sk_buff *skb)
 {
        return 0;
 }
@@ -760,8 +841,14 @@
        return search_binary_handler(bprm, regs);
 }
 
+#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
+static inline void skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
+                                    unsigned int flags) {
+}
 #endif
 
+#endif
+
 #if LINUX_VERSION_CODE < KERNEL_VERSION(2, 5, 0)
 int ccs_may_create(struct inode *dir, struct dentry *dentry);
 #else
Index: trunk/1.7.x/ccs-patch/security/ccsecurity/compat.h
===================================================================
--- trunk/1.7.x/ccs-patch/security/ccsecurity/compat.h  (revision 3827)
+++ trunk/1.7.x/ccs-patch/security/ccsecurity/compat.h  (working copy)
@@ -180,7 +180,6 @@
 #define sk_family family
 #define sk_protocol protocol
 #define sk_type type
-#define sk_receive_queue receive_queue
 static inline struct socket *SOCKET_I(struct inode *inode)
 {
        return inode->i_sock ? &inode->u.socket_i : NULL;
Index: trunk/1.7.x/ccs-patch/security/ccsecurity/network.c
===================================================================
--- trunk/1.7.x/ccs-patch/security/ccsecurity/network.c (revision 3827)
+++ trunk/1.7.x/ccs-patch/security/ccsecurity/network.c (working copy)
@@ -531,8 +531,6 @@
 
 #else
 
-#define MAX_SOCK_ADDR 128 /* net/socket.c */
-
 /* Check permission for creating a socket. */
 static int __ccs_socket_create_permission(int family, int type, int protocol)
 {
@@ -566,8 +564,8 @@
 /* Check permission for listening a TCP socket. */
 static int __ccs_socket_listen_permission(struct socket *sock)
 {
+       struct sockaddr_storage addr;
        int error = 0;
-       char addr[MAX_SOCK_ADDR];
        int addr_len;
        /* Nothing to do if I am a kernel service. */
        if (segment_eq(get_fs(), KERNEL_DS))
@@ -583,19 +581,19 @@
        }
        if (!ccs_capable(CCS_INET_STREAM_SOCKET_LISTEN))
                return -EPERM;
-       if (sock->ops->getname(sock, (struct sockaddr *) addr, &addr_len, 0))
+       if (sock->ops->getname(sock, (struct sockaddr *) &addr, &addr_len, 0))
                return -EPERM;
-       switch (((struct sockaddr *) addr)->sa_family) {
+       switch (((struct sockaddr *) &addr)->sa_family) {
                struct sockaddr_in6 *addr6;
                struct sockaddr_in *addr4;
        case AF_INET6:
-               addr6 = (struct sockaddr_in6 *) addr;
+               addr6 = (struct sockaddr_in6 *) &addr;
                error = ccs_network_listen_acl(true,
                                               addr6->sin6_addr.s6_addr,
                                               addr6->sin6_port);
                break;
        case AF_INET:
-               addr4 = (struct sockaddr_in *) addr;
+               addr4 = (struct sockaddr_in *) &addr;
                error = ccs_network_listen_acl(false,
                                               (u8 *) &addr4->sin_addr,
                                               addr4->sin_port);
@@ -711,40 +709,38 @@
        return error;
 }
 
-/*
- * Check permission for accepting a TCP socket.
- *
- * Currently, the LSM hook for this purpose is not provided.
- */
-static int __ccs_socket_accept_permission(struct socket *sock,
-                                         struct sockaddr *addr)
+/* Check permission for accepting a TCP socket. */
+static int __ccs_socket_post_accept_permission(struct socket *sock,
+                                              struct socket *newsock)
 {
+       struct sockaddr_storage addr;
        int error = 0;
        int addr_len;
        /* Nothing to do if I am a kernel service. */
        if (segment_eq(get_fs(), KERNEL_DS))
                return 0;
-       switch (sock->sk->sk_family) {
+       switch (newsock->sk->sk_family) {
        case PF_INET:
        case PF_INET6:
                break;
        default:
                return 0;
        }
-       error = sock->ops->getname(sock, addr, &addr_len, 2);
+       error = newsock->ops->getname(newsock, (struct sockaddr *) &addr,
+                                     &addr_len, 2);
        if (error)
                return error;
-       switch (addr->sa_family) {
+       switch (((struct sockaddr *) &addr)->sa_family) {
                struct sockaddr_in6 *addr6;
                struct sockaddr_in *addr4;
        case AF_INET6:
-               addr6 = (struct sockaddr_in6 *) addr;
+               addr6 = (struct sockaddr_in6 *) &addr;
                error = ccs_network_accept_acl(true,
                                               addr6->sin6_addr.s6_addr,
                                               addr6->sin6_port);
                break;
        case AF_INET:
-               addr4 = (struct sockaddr_in *) addr;
+               addr4 = (struct sockaddr_in *) &addr;
                error = ccs_network_accept_acl(false,
                                               (u8 *) &addr4->sin_addr,
                                               addr4->sin_port);
@@ -820,53 +816,10 @@
 #endif
 #endif
 
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 12)
-static void skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
-                             unsigned int flags)
+/* Check permission for receiving a datagram via a UDP or RAW socket. */
+static int __ccs_socket_post_recvmsg_permission(struct sock *sk,
+                                               struct sk_buff *skb)
 {
-       /* Clear queue. */
-       if (flags & MSG_PEEK) {
-               int clear = 0;
-               spin_lock_irq(&sk->sk_receive_queue.lock);
-               if (skb == skb_peek(&sk->sk_receive_queue)) {
-                       __skb_unlink(skb, &sk->sk_receive_queue);
-                       clear = 1;
-               }
-               spin_unlock_irq(&sk->sk_receive_queue.lock);
-               if (clear)
-                       kfree_skb(skb);
-       }
-       skb_free_datagram(sk, skb);
-}
-#elif LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 16)
-static void skb_kill_datagram(struct sock *sk, struct sk_buff *skb,
-                             unsigned int flags)
-{
-       /* Clear queue. */
-       if (flags & MSG_PEEK) {
-               int clear = 0;
-               spin_lock_bh(&sk->sk_receive_queue.lock);
-               if (skb == skb_peek(&sk->sk_receive_queue)) {
-                       __skb_unlink(skb, &sk->sk_receive_queue);
-                       clear = 1;
-               }
-               spin_unlock_bh(&sk->sk_receive_queue.lock);
-               if (clear)
-                       kfree_skb(skb);
-       }
-       skb_free_datagram(sk, skb);
-}
-#endif
-
-/*
- * Check permission for receiving a datagram via a UDP or RAW socket.
- *
- * Currently, the LSM hook for this purpose is not provided.
- */
-static int __ccs_socket_recvmsg_permission(struct sock *sk,
-                                          struct sk_buff *skb,
-                                          const unsigned int flags)
-{
        int error = 0;
        const unsigned int type = sk->sk_type;
        if (type != SOCK_DGRAM && type != SOCK_RAW)
@@ -907,34 +860,7 @@
                                                (u8 *) &sin4, port);
                break;
        }
-       if (!error)
-               return 0;
-       /*
-        * Remove from queue if MSG_PEEK is used so that
-        * the head message from unwanted source in receive queue will not
-        * prevent the caller from picking up next message from wanted source
-        * when the caller is using MSG_PEEK flag for picking up.
-        */
-       {
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
-               bool slow = false;
-               if (type == SOCK_DGRAM)
-                       slow = lock_sock_fast(sk);
-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
-               if (type == SOCK_DGRAM)
-                       lock_sock(sk);
-#endif
-               skb_kill_datagram(sk, skb, flags);
-#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 35)
-               if (type == SOCK_DGRAM)
-                       unlock_sock_fast(sk, slow);
-#elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25)
-               if (type == SOCK_DGRAM)
-                       release_sock(sk);
-#endif
-       }
-       /* Hope less harmful than -EPERM. */
-       return -ENOMEM;
+       return error;
 }
 
 void __init ccs_network_init(void)
@@ -946,12 +872,12 @@
        ccsecurity_ops.socket_connect_permission =
                __ccs_socket_connect_permission;
        ccsecurity_ops.socket_bind_permission = __ccs_socket_bind_permission;
-       ccsecurity_ops.socket_accept_permission =
-               __ccs_socket_accept_permission;
+       ccsecurity_ops.socket_post_accept_permission =
+               __ccs_socket_post_accept_permission;
        ccsecurity_ops.socket_sendmsg_permission =
                __ccs_socket_sendmsg_permission;
-       ccsecurity_ops.socket_recvmsg_permission =
-               __ccs_socket_recvmsg_permission;
+       ccsecurity_ops.socket_post_recvmsg_permission =
+               __ccs_socket_post_recvmsg_permission;
 }
 
 #endif