/* LSM hook implementation that checks and/or returns the xfrm sid for the incoming packet.  */
int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
/* LSM hook implementation that checks and/or returns the xfrm sid for the incoming packet.  */
int selinux_xfrm_decode_session(struct sk_buff *skb, u32 *sid, int ckall)
{
	struct sec_path *sp;
	*sid = SECSID_NULL;
	if (skb == NULL)
		return 0;
	sp = skb->sp;
	if (sp) {
		int i, sid_set = 0;
		for (i = sp->len-1; i >= 0; i--) {
			struct xfrm_state *x = sp->xvec[i];
			if (selinux_authorizable_xfrm(x)) {
				struct xfrm_sec_ctx *ctx = x->security;
				if (!sid_set) {
					*sid = ctx->ctx_sid;
					sid_set = 1;
					if (!ckall)
						break;
				} else if (*sid != ctx->ctx_sid)
					return -EINVAL;
			}
		}
	}
	return 0;
}