/* LSM hook implementation that authorizes that a state matches the given policy, flow combo.  */
int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp, struct flowi *fl)
/* LSM hook implementation that authorizes that a state matches the given policy, flow combo.  */
int selinux_xfrm_state_pol_flow_match(struct xfrm_state *x, struct xfrm_policy *xp, struct flowi *fl)
{
	u32 state_sid;
	int rc;
	if (!xp->security)
		if (x->security)
			return 0;
		else
			return 1;
	else
		if (!x->security)
			return 0;
		else
			if (!selinux_authorizable_xfrm(x))
				return 0;
	state_sid = x->security->ctx_sid;
	if (fl->secid != state_sid)
		return 0;
	rc = avc_has_perm(fl->secid, state_sid, SECCLASS_ASSOCIATION,
			  ASSOCIATION__SENDTO,
			  NULL)? 0:1;
	return rc;
}