commit 4d2d6f18f0e5af2481662131d523ac5acb73af8e
author manojboopathi <manojboopathi@google.com> Wed Dec 06 11:11:31 2017 -0800
committer manojboopathi <manojboopathi@google.com> Mon Dec 18 14:43:09 2017 -0800
tree e46855789ee3f207abebb5226d3ed513eca7e01b
parent d2cd467ab4b283378b52ae30f7d514b57d9b5194

Add Tunnel Mode IPSec SA Support in NetD

Bug: 63588541
Test: Ran runtest -x system/netd/server/netd_unit_test.cpp
Change-Id: I0d71abcd9b84d241128472542537ba2f6dbac5ae

server/XfrmController.cpp

diff --git a/server/XfrmController.cpp b/server/XfrmController.cpp
index e70ed49..57ebc3e 100644
--- a/server/XfrmController.cpp
+++ b/server/XfrmController.cpp
@@ -465,7 +465,7 @@
             return netdutils::statusFromErrno(EINVAL, "Invalid encap type");
     }
 
-    ret = createTransportModeSecurityAssociation(saInfo, sock);
+    ret = createSecurityAssociation(saInfo, sock);
     if (!isOk(ret)) {
         ALOGD("Failed creating a Security Association, line=%d", __LINE__);
     }
@@ -631,8 +631,8 @@
     selector->ifindex = record.netId; // TODO : still need to sort this out
 }
 
-netdutils::Status XfrmController::createTransportModeSecurityAssociation(const XfrmSaInfo& record,
-                                                                         const XfrmSocket& sock) {
+netdutils::Status XfrmController::createSecurityAssociation(const XfrmSaInfo& record,
+                                                            const XfrmSocket& sock) {
     xfrm_usersa_info usersa{};
     nlattr_algo_crypt crypt{};
     nlattr_algo_auth auth{};
@@ -781,7 +781,13 @@
     usersa->family = record.addrFamily;
     usersa->mode = static_cast<uint8_t>(record.mode);
     usersa->replay_window = REPLAY_WINDOW_SIZE;
-    usersa->flags = 0; // TODO: should we actually set flags, XFRM_SA_XFLAG_DONT_ENCAP_DSCP?
+
+    if (record.mode == XfrmMode::TRANSPORT) {
+        usersa->flags = 0; // TODO: should we actually set flags, XFRM_SA_XFLAG_DONT_ENCAP_DSCP?
+    } else {
+        usersa->flags = XFRM_STATE_AF_UNSPEC;
+    }
+
     return sizeof(*usersa);
 }