/* Description: Check the various different forms of network peer labeling and determine the peer label/SID for the packet; most of the magic actually occurs in the security server function security_net_peersid_cmp(). The function returns zero if the value in @sid is valid (although it may be SECSID_NULL) or -EACCES if @sid is invalid due to inconsistencies with the different peer labels.  */
static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
/* Description: Check the various different forms of network peer labeling and determine the peer label/SID for the packet; most of the magic actually occurs in the security server function security_net_peersid_cmp(). The function returns zero if the value in @sid is valid (although it may be SECSID_NULL) or -EACCES if @sid is invalid due to inconsistencies with the different peer labels.  */
static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
{
	int err;
	u32 xfrm_sid;
	u32 nlbl_sid;
	u32 nlbl_type;
	selinux_skb_xfrm_sid(skb, &xfrm_sid);
	selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
	err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
	if (unlikely(err)) {
		printk(KERN_WARNING
		       "SELinux: failure in selinux_skb_peerlbl_sid(),"
		       " unable to determine packet's peer label\n");
		return -EACCES;
	}
	return 0;
}