diff options
| author | 2021-05-11 17:48:00 +0000 | |
|---|---|---|
| committer | 2021-05-11 17:48:00 +0000 | |
| commit | 1d5e155997e781131a5c73f2bfa56faee0555650 (patch) | |
| tree | c75c0e5ed72be766b3641f6a73031d617653cd69 | |
| parent | 10c37d1a19363d59de05c596e1d0fe1fcd5ea7ea (diff) | |
| parent | 2a42aa89216dbe5ab498ed98cd782d25ff8773c2 (diff) | |
Merge "Add clarifying comments on for IPsec forward policies" am: 1a88665f3c am: 2a42aa8921
Original change: https://android-review.googlesource.com/c/platform/frameworks/base/+/1702525
Change-Id: Ifef0b1d3a1def9dfcf995fb5ddc79c0a88658ad0
| -rw-r--r-- | services/core/java/com/android/server/IpSecService.java | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/services/core/java/com/android/server/IpSecService.java b/services/core/java/com/android/server/IpSecService.java index d574e74d398f..d6ee95131ea9 100644 --- a/services/core/java/com/android/server/IpSecService.java +++ b/services/core/java/com/android/server/IpSecService.java @@ -1112,7 +1112,7 @@ public class IpSecService extends IIpSecService.Stub { case IpSecManager.DIRECTION_IN: return; case IpSecManager.DIRECTION_FWD: - // Only NETWORK_STACK or PERMISSION_NETWORK_STACK allowed to use forward policies + // Only NETWORK_STACK or MAINLINE_NETWORK_STACK allowed to use forward policies PermissionUtils.enforceNetworkStackPermission(mContext); return; } @@ -1358,6 +1358,16 @@ public class IpSecService extends IIpSecService.Stub { ikey, 0xffffffff, resourceId); + + // Add a forwarding policy on the tunnel interface. In order to support forwarding + // the IpSecTunnelInterface must have a forwarding policy matching the incoming SA. + // + // Unless a IpSecTransform is also applied against this interface in DIRECTION_FWD, + // forwarding will be blocked by default (as would be the case if this policy was + // absent). + // + // This is necessary only on the tunnel interface, and not any the interface to + // which traffic will be forwarded to. netd.ipSecAddSecurityPolicy( callerUid, selAddrFamily, |