xfrm: validate attributes