services/core/java/com/android/server/IpSecService.java - platform/frameworks/base - Git at Google

 /*
  * Copyright (C) 2017 The Android Open Source Project
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
  *
  *      http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 package com.android.server;

 import static android.Manifest.permission.DUMP;
 import static android.net.IpSecManager.INVALID_RESOURCE_ID;
 import static android.net.IpSecManager.KEY_RESOURCE_ID;
 import static android.net.IpSecManager.KEY_SPI;
 import static android.net.IpSecManager.KEY_STATUS;

 import android.content.Context;
 import android.net.IIpSecService;
 import android.net.INetd;
 import android.net.IpSecAlgorithm;
 import android.net.IpSecConfig;
 import android.net.IpSecManager;
 import android.net.IpSecTransform;
 import android.net.util.NetdService;
 import android.os.Binder;
 import android.os.Bundle;
 import android.os.IBinder;
 import android.os.ParcelFileDescriptor;
 import android.os.RemoteException;
 import android.os.ServiceSpecificException;
 import android.util.Log;
 import android.util.Slog;
 import android.util.SparseArray;
 import com.android.internal.annotations.GuardedBy;
 import java.io.FileDescriptor;
 import java.io.PrintWriter;
 import java.util.concurrent.atomic.AtomicInteger;

 /** @hide */
 public class IpSecService extends IIpSecService.Stub {
     private static final String TAG = "IpSecService";
     private static final boolean DBG = Log.isLoggable(TAG, Log.DEBUG);
     private static final String NETD_SERVICE_NAME = "netd";
     private static final int[] DIRECTIONS =
             new int[] {IpSecTransform.DIRECTION_OUT, IpSecTransform.DIRECTION_IN};

     /** Binder context for this service */
     private final Context mContext;

     private Object mLock = new Object();

     private static final int NETD_FETCH_TIMEOUT = 5000; //ms

     private AtomicInteger mNextResourceId = new AtomicInteger(0x00FADED0);

     private abstract class ManagedResource implements IBinder.DeathRecipient {
         final int pid;
         final int uid;
         private IBinder mBinder;

         ManagedResource(IBinder binder) {
             super();
             mBinder = binder;
             pid = Binder.getCallingPid();
             uid = Binder.getCallingUid();

             try {
                 mBinder.linkToDeath(this, 0);
             } catch (RemoteException e) {
                 binderDied();
             }
         }

         /**
          * When this record is no longer needed for managing system resources this function should
          * unlink all references held by the record to allow efficient garbage collection.
          */
         public final void release() {
             //Release all the underlying system resources first
             releaseResources();

             if (mBinder != null) {
                 mBinder.unlinkToDeath(this, 0);
             }
             mBinder = null;

             //remove this record so that it can be cleaned up
             nullifyRecord();
         }

         /**
          * If the Binder object dies, this function is called to free the system resources that are
          * being managed by this record and to subsequently release this record for garbage
          * collection
          */
         public final void binderDied() {
             release();
         }

         /**
          * Implement this method to release all object references contained in the subclass to allow
          * efficient garbage collection of the record. This should remove any references to the
          * record from all other locations that hold a reference as the record is no longer valid.
          */
         protected abstract void nullifyRecord();

         /**
          * Implement this method to release all system resources that are being protected by this
          * record. Once the resources are released, the record should be invalidated and no longer
          * used by calling releaseRecord()
          */
         protected abstract void releaseResources();
     };

     private final class TransformRecord extends ManagedResource {
         private IpSecConfig mConfig;
         private int mResourceId;

         TransformRecord(IpSecConfig config, int resourceId, IBinder binder) {
             super(binder);
             mConfig = config;
             mResourceId = resourceId;
         }

         public IpSecConfig getConfig() {
             return mConfig;
         }

         @Override
         protected void releaseResources() {
             for (int direction : DIRECTIONS) {
                 try {
                     getNetdInstance()
                             .ipSecDeleteSecurityAssociation(
                                     mResourceId,
                                     direction,
                                     (mConfig.getLocalAddress() != null)
                                             ? mConfig.getLocalAddress().getHostAddress()
                                             : "",
                                     (mConfig.getRemoteAddress() != null)
                                             ? mConfig.getRemoteAddress().getHostAddress()
                                             : "",
                                     mConfig.getSpi(direction));
                 } catch (ServiceSpecificException e) {
                     // FIXME: get the error code and throw is at an IOException from Errno Exception
                 } catch (RemoteException e) {
                     Log.e(TAG, "Failed to delete SA with ID: " + mResourceId);
                 }
             }
         }

         @Override
         protected void nullifyRecord() {
             mConfig = null;
             mResourceId = INVALID_RESOURCE_ID;
         }
     }

     private final class SpiRecord extends ManagedResource {
         private final int mDirection;
         private final String mLocalAddress;
         private final String mRemoteAddress;
         private final IBinder mBinder;
         private int mSpi;
         private int mResourceId;

         SpiRecord(
                 int resourceId,
                 int direction,
                 String localAddress,
                 String remoteAddress,
                 int spi,
                 IBinder binder) {
             super(binder);
             mResourceId = resourceId;
             mDirection = direction;
             mLocalAddress = localAddress;
             mRemoteAddress = remoteAddress;
             mSpi = spi;
             mBinder = binder;
         }

         protected void releaseResources() {
             try {
                 getNetdInstance()
                         .ipSecDeleteSecurityAssociation(
                                 mResourceId, mDirection, mLocalAddress, mRemoteAddress, mSpi);
             } catch (ServiceSpecificException e) {
                 // FIXME: get the error code and throw is at an IOException from Errno Exception
             } catch (RemoteException e) {
                 Log.e(TAG, "Failed to delete SPI reservation with ID: " + mResourceId);
             }
         }

         protected void nullifyRecord() {
             mSpi = IpSecManager.INVALID_SECURITY_PARAMETER_INDEX;
             mResourceId = INVALID_RESOURCE_ID;
         }
     }

     @GuardedBy("mSpiRecords")
     private final SparseArray<SpiRecord> mSpiRecords = new SparseArray<>();

     @GuardedBy("mTransformRecords")
     private final SparseArray<TransformRecord> mTransformRecords = new SparseArray<>();

     /**
      * Constructs a new IpSecService instance
      *
      * @param context Binder context for this service
      */
     private IpSecService(Context context) {
         mContext = context;
     }

     static IpSecService create(Context context) throws InterruptedException {
         final IpSecService service = new IpSecService(context);
         service.connectNativeNetdService();
         return service;
     }

     public void systemReady() {
         if (isNetdAlive()) {
             Slog.d(TAG, "IpSecService is ready");
         } else {
             Slog.wtf(TAG, "IpSecService not ready: failed to connect to NetD Native Service!");
         }
     }

     private void connectNativeNetdService() {
         // Avoid blocking the system server to do this
         Thread t =
                 new Thread(
                         new Runnable() {
                             @Override
                             public void run() {
                                 synchronized (mLock) {
                                     NetdService.get(NETD_FETCH_TIMEOUT);
                                 }
                             }
                         });
         t.run();
     }

     INetd getNetdInstance() throws RemoteException {
         final INetd netd = NetdService.getInstance();
         if (netd == null) {
             throw new RemoteException("Failed to Get Netd Instance");
         }
         return netd;
     }

     boolean isNetdAlive() {
         synchronized (mLock) {
             try {
                 final INetd netd = getNetdInstance();
                 if (netd == null) {
                     return false;
                 }
                 return netd.isAlive();
             } catch (RemoteException re) {
                 return false;
             }
         }
     }

     @Override
     /** Get a new SPI and maintain the reservation in the system server */
     public Bundle reserveSecurityParameterIndex(
             int direction, String remoteAddress, int requestedSpi, IBinder binder)
             throws RemoteException {
         int resourceId = mNextResourceId.getAndIncrement();

         int spi = IpSecManager.INVALID_SECURITY_PARAMETER_INDEX;
         String localAddress = "";
         Bundle retBundle = new Bundle(3);
         try {
             spi =
                     getNetdInstance()
                             .ipSecAllocateSpi(
                                     resourceId,
                                     direction,
                                     localAddress,
                                     remoteAddress,
                                     requestedSpi);
             Log.d(TAG, "Allocated SPI " + spi);
             retBundle.putInt(KEY_STATUS, IpSecManager.Status.OK);
             retBundle.putInt(KEY_RESOURCE_ID, resourceId);
             retBundle.putInt(KEY_SPI, spi);
             synchronized (mSpiRecords) {
                 mSpiRecords.put(
                         resourceId,
                         new SpiRecord(
                                 resourceId, direction, localAddress, remoteAddress, spi, binder));
             }
         } catch (ServiceSpecificException e) {
             // TODO: Add appropriate checks when other ServiceSpecificException types are supported
             retBundle.putInt(KEY_STATUS, IpSecManager.Status.SPI_UNAVAILABLE);
             retBundle.putInt(KEY_RESOURCE_ID, resourceId);
             retBundle.putInt(KEY_SPI, spi);
         } catch (RemoteException e) {
             throw e.rethrowFromSystemServer();
         }
         return retBundle;
     }

     /** Release a previously allocated SPI that has been registered with the system server */
     @Override
     public void releaseSecurityParameterIndex(int resourceId) throws RemoteException {}

     /**
      * Open a socket via the system server and bind it to the specified port (random if port=0).
      * This will return a PFD to the user that represent a bound UDP socket. The system server will
      * cache the socket and a record of its owner so that it can and must be freed when no longer
      * needed.
      */
     @Override
     public Bundle openUdpEncapsulationSocket(int port, IBinder binder) throws RemoteException {
         return null;
     }

     /** close a socket that has been been allocated by and registered with the system server */
     @Override
     public void closeUdpEncapsulationSocket(ParcelFileDescriptor socket) {}

     /**
      * Create a transport mode transform, which represent two security associations (one in each
      * direction) in the kernel. The transform will be cached by the system server and must be freed
      * when no longer needed. It is possible to free one, deleting the SA from underneath sockets
      * that are using it, which will result in all of those sockets becoming unable to send or
      * receive data.
      */
     @Override
     public Bundle createTransportModeTransform(IpSecConfig c, IBinder binder)
             throws RemoteException {
         // TODO: Basic input validation here since it's coming over the Binder
         int resourceId = mNextResourceId.getAndIncrement();
         for (int direction : DIRECTIONS) {
             IpSecAlgorithm auth = c.getAuthentication(direction);
             IpSecAlgorithm crypt = c.getEncryption(direction);
             try {
                 int result =
                         getNetdInstance()
                                 .ipSecAddSecurityAssociation(
                                         resourceId,
                                         c.getMode(),
                                         direction,
                                         (c.getLocalAddress() != null)
                                                 ? c.getLocalAddress().getHostAddress()
                                                 : "",
                                         (c.getRemoteAddress() != null)
                                                 ? c.getRemoteAddress().getHostAddress()
                                                 : "",
                                         (c.getNetwork() != null)
                                                 ? c.getNetwork().getNetworkHandle()
                                                 : 0,
                                         c.getSpi(direction),
                                         (auth != null) ? auth.getName() : "",
                                         (auth != null) ? auth.getKey() : null,
                                         (auth != null) ? auth.getTruncationLengthBits() : 0,
                                         (crypt != null) ? crypt.getName() : "",
                                         (crypt != null) ? crypt.getKey() : null,
                                         (crypt != null) ? crypt.getTruncationLengthBits() : 0,
                                         c.getEncapType(),
                                         c.getEncapLocalPort(),
                                         c.getEncapRemotePort());
                 if (result != c.getSpi(direction)) {
                     // TODO: cleanup the first SA if creation of second SA fails
                     Bundle retBundle = new Bundle(2);
                     retBundle.putInt(KEY_STATUS, IpSecManager.Status.SPI_UNAVAILABLE);
                     retBundle.putInt(KEY_RESOURCE_ID, INVALID_RESOURCE_ID);
                     return retBundle;
                 }
             } catch (ServiceSpecificException e) {
                 // FIXME: get the error code and throw is at an IOException from Errno Exception
             }
         }
         synchronized (mTransformRecords) {
             mTransformRecords.put(resourceId, new TransformRecord(c, resourceId, binder));
         }

         Bundle retBundle = new Bundle(2);
         retBundle.putInt(KEY_STATUS, IpSecManager.Status.OK);
         retBundle.putInt(KEY_RESOURCE_ID, resourceId);
         return retBundle;
     }

     /**
      * Delete a transport mode transform that was previously allocated by + registered with the
      * system server. If this is called on an inactive (or non-existent) transform, it will not
      * return an error. It's safe to de-allocate transforms that may have already been deleted for
      * other reasons.
      */
     @Override
     public void deleteTransportModeTransform(int resourceId) throws RemoteException {
         synchronized (mTransformRecords) {
             TransformRecord record;
             // We want to non-destructively get so that we can check credentials before removing
             // this from the records.
             record = mTransformRecords.get(resourceId);

             if (record == null) {
                 throw new IllegalArgumentException(
                         "Transform " + resourceId + " is not available to be deleted");
             }

             if (record.pid != Binder.getCallingPid() || record.uid != Binder.getCallingUid()) {
                 throw new SecurityException("Only the owner of an IpSec Transform may delete it!");
             }

             // TODO: if releaseResources() throws RemoteException, we can try again to clean up on
             // binder death. Need to make sure that path is actually functional.
             record.releaseResources();
             mTransformRecords.remove(resourceId);
             record.nullifyRecord();
         }
     }

     /**
      * Apply an active transport mode transform to a socket, which will apply the IPsec security
      * association as a correspondent policy to the provided socket
      */
     @Override
     public void applyTransportModeTransform(ParcelFileDescriptor socket, int resourceId)
             throws RemoteException {

         synchronized (mTransformRecords) {
             TransformRecord info;
             // FIXME: this code should be factored out into a security check + getter
             info = mTransformRecords.get(resourceId);

             if (info == null) {
                 throw new IllegalArgumentException("Transform " + resourceId + " is not active");
             }

             // TODO: make this a function.
             if (info.pid != getCallingPid() || info.uid != getCallingUid()) {
                 throw new SecurityException("Only the owner of an IpSec Transform may apply it!");
             }

             IpSecConfig c = info.getConfig();
             try {
                 for (int direction : DIRECTIONS) {
                     getNetdInstance()
                             .ipSecApplyTransportModeTransform(
                                     socket.getFileDescriptor(),
                                     resourceId,
                                     direction,
                                     (c.getLocalAddress() != null)
                                             ? c.getLocalAddress().getHostAddress()
                                             : "",
                                     (c.getRemoteAddress() != null)
                                             ? c.getRemoteAddress().getHostAddress()
                                             : "",
                                     c.getSpi(direction));
                 }
             } catch (ServiceSpecificException e) {
                 // FIXME: get the error code and throw is at an IOException from Errno Exception
             }
         }
     }
     /**
      * Remove a transport mode transform from a socket, applying the default (empty) policy. This
      * will ensure that NO IPsec policy is applied to the socket (would be the equivalent of
      * applying a policy that performs no IPsec). Today the resourceId parameter is passed but not
      * used: reserved for future improved input validation.
      */
     @Override
     public void removeTransportModeTransform(ParcelFileDescriptor socket, int resourceId)
             throws RemoteException {
         try {
             getNetdInstance().ipSecRemoveTransportModeTransform(socket.getFileDescriptor());
         } catch (ServiceSpecificException e) {
             // FIXME: get the error code and throw is at an IOException from Errno Exception
         }
     }

     @Override
     protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
         mContext.enforceCallingOrSelfPermission(DUMP, TAG);

         pw.println("IpSecService Log:");
         pw.println("NetdNativeService Connection: " + (isNetdAlive() ? "alive" : "dead"));
         pw.println();
     }
 }
	/*
	* Copyright (C) 2017 The Android Open Source Project
	*
	* Licensed under the Apache License, Version 2.0 (the "License");
	* you may not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	package com.android.server;

	import static android.Manifest.permission.DUMP;
	import static android.net.IpSecManager.INVALID_RESOURCE_ID;
	import static android.net.IpSecManager.KEY_RESOURCE_ID;
	import static android.net.IpSecManager.KEY_SPI;
	import static android.net.IpSecManager.KEY_STATUS;

	import android.content.Context;
	import android.net.IIpSecService;
	import android.net.INetd;
	import android.net.IpSecAlgorithm;
	import android.net.IpSecConfig;
	import android.net.IpSecManager;
	import android.net.IpSecTransform;
	import android.net.util.NetdService;
	import android.os.Binder;
	import android.os.Bundle;
	import android.os.IBinder;
	import android.os.ParcelFileDescriptor;
	import android.os.RemoteException;
	import android.os.ServiceSpecificException;
	import android.util.Log;
	import android.util.Slog;
	import android.util.SparseArray;
	import com.android.internal.annotations.GuardedBy;
	import java.io.FileDescriptor;
	import java.io.PrintWriter;
	import java.util.concurrent.atomic.AtomicInteger;

	/** @hide */
	public class IpSecService extends IIpSecService.Stub {
	private static final String TAG = "IpSecService";
	private static final boolean DBG = Log.isLoggable(TAG, Log.DEBUG);
	private static final String NETD_SERVICE_NAME = "netd";
	private static final int[] DIRECTIONS =
	new int[] {IpSecTransform.DIRECTION_OUT, IpSecTransform.DIRECTION_IN};

	/** Binder context for this service */
	private final Context mContext;

	private Object mLock = new Object();

	private static final int NETD_FETCH_TIMEOUT = 5000; //ms

	private AtomicInteger mNextResourceId = new AtomicInteger(0x00FADED0);

	private abstract class ManagedResource implements IBinder.DeathRecipient {
	final int pid;
	final int uid;
	private IBinder mBinder;

	ManagedResource(IBinder binder) {
	super();
	mBinder = binder;
	pid = Binder.getCallingPid();
	uid = Binder.getCallingUid();

	try {
	mBinder.linkToDeath(this, 0);
	} catch (RemoteException e) {
	binderDied();
	}
	}

	/**
	* When this record is no longer needed for managing system resources this function should
	* unlink all references held by the record to allow efficient garbage collection.
	*/
	public final void release() {
	//Release all the underlying system resources first
	releaseResources();

	if (mBinder != null) {
	mBinder.unlinkToDeath(this, 0);
	}
	mBinder = null;

	//remove this record so that it can be cleaned up
	nullifyRecord();
	}

	/**
	* If the Binder object dies, this function is called to free the system resources that are
	* being managed by this record and to subsequently release this record for garbage
	* collection
	*/
	public final void binderDied() {
	release();
	}

	/**
	* Implement this method to release all object references contained in the subclass to allow
	* efficient garbage collection of the record. This should remove any references to the
	* record from all other locations that hold a reference as the record is no longer valid.
	*/
	protected abstract void nullifyRecord();

	/**
	* Implement this method to release all system resources that are being protected by this
	* record. Once the resources are released, the record should be invalidated and no longer
	* used by calling releaseRecord()
	*/
	protected abstract void releaseResources();
	};

	private final class TransformRecord extends ManagedResource {
	private IpSecConfig mConfig;
	private int mResourceId;

	TransformRecord(IpSecConfig config, int resourceId, IBinder binder) {
	super(binder);
	mConfig = config;
	mResourceId = resourceId;
	}

	public IpSecConfig getConfig() {
	return mConfig;
	}

	@Override
	protected void releaseResources() {
	for (int direction : DIRECTIONS) {
	try {
	getNetdInstance()
	.ipSecDeleteSecurityAssociation(
	mResourceId,
	direction,
	(mConfig.getLocalAddress() != null)
	? mConfig.getLocalAddress().getHostAddress()
	: "",
	(mConfig.getRemoteAddress() != null)
	? mConfig.getRemoteAddress().getHostAddress()
	: "",
	mConfig.getSpi(direction));
	} catch (ServiceSpecificException e) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception
	} catch (RemoteException e) {
	Log.e(TAG, "Failed to delete SA with ID: " + mResourceId);
	}
	}
	}

	@Override
	protected void nullifyRecord() {
	mConfig = null;
	mResourceId = INVALID_RESOURCE_ID;
	}
	}

	private final class SpiRecord extends ManagedResource {
	private final int mDirection;
	private final String mLocalAddress;
	private final String mRemoteAddress;
	private final IBinder mBinder;
	private int mSpi;
	private int mResourceId;

	SpiRecord(
	int resourceId,
	int direction,
	String localAddress,
	String remoteAddress,
	int spi,
	IBinder binder) {
	super(binder);
	mResourceId = resourceId;
	mDirection = direction;
	mLocalAddress = localAddress;
	mRemoteAddress = remoteAddress;
	mSpi = spi;
	mBinder = binder;
	}

	protected void releaseResources() {
	try {
	getNetdInstance()
	.ipSecDeleteSecurityAssociation(
	mResourceId, mDirection, mLocalAddress, mRemoteAddress, mSpi);
	} catch (ServiceSpecificException e) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception
	} catch (RemoteException e) {
	Log.e(TAG, "Failed to delete SPI reservation with ID: " + mResourceId);
	}
	}

	protected void nullifyRecord() {
	mSpi = IpSecManager.INVALID_SECURITY_PARAMETER_INDEX;
	mResourceId = INVALID_RESOURCE_ID;
	}
	}

	@GuardedBy("mSpiRecords")
	private final SparseArray<SpiRecord> mSpiRecords = new SparseArray<>();

	@GuardedBy("mTransformRecords")
	private final SparseArray<TransformRecord> mTransformRecords = new SparseArray<>();

	/**
	* Constructs a new IpSecService instance
	*
	* @param context Binder context for this service
	*/
	private IpSecService(Context context) {
	mContext = context;
	}

	static IpSecService create(Context context) throws InterruptedException {
	final IpSecService service = new IpSecService(context);
	service.connectNativeNetdService();
	return service;
	}

	public void systemReady() {
	if (isNetdAlive()) {
	Slog.d(TAG, "IpSecService is ready");
	} else {
	Slog.wtf(TAG, "IpSecService not ready: failed to connect to NetD Native Service!");
	}
	}

	private void connectNativeNetdService() {
	// Avoid blocking the system server to do this
	Thread t =
	new Thread(
	new Runnable() {
	@Override
	public void run() {
	synchronized (mLock) {
	NetdService.get(NETD_FETCH_TIMEOUT);
	}
	}
	});
	t.run();
	}

	INetd getNetdInstance() throws RemoteException {
	final INetd netd = NetdService.getInstance();
	if (netd == null) {
	throw new RemoteException("Failed to Get Netd Instance");
	}
	return netd;
	}

	boolean isNetdAlive() {
	synchronized (mLock) {
	try {
	final INetd netd = getNetdInstance();
	if (netd == null) {
	return false;
	}
	return netd.isAlive();
	} catch (RemoteException re) {
	return false;
	}
	}
	}

	@Override
	/** Get a new SPI and maintain the reservation in the system server */
	public Bundle reserveSecurityParameterIndex(
	int direction, String remoteAddress, int requestedSpi, IBinder binder)
	throws RemoteException {
	int resourceId = mNextResourceId.getAndIncrement();

	int spi = IpSecManager.INVALID_SECURITY_PARAMETER_INDEX;
	String localAddress = "";
	Bundle retBundle = new Bundle(3);
	try {
	spi =
	getNetdInstance()
	.ipSecAllocateSpi(
	resourceId,
	direction,
	localAddress,
	remoteAddress,
	requestedSpi);
	Log.d(TAG, "Allocated SPI " + spi);
	retBundle.putInt(KEY_STATUS, IpSecManager.Status.OK);
	retBundle.putInt(KEY_RESOURCE_ID, resourceId);
	retBundle.putInt(KEY_SPI, spi);
	synchronized (mSpiRecords) {
	mSpiRecords.put(
	resourceId,
	new SpiRecord(
	resourceId, direction, localAddress, remoteAddress, spi, binder));
	}
	} catch (ServiceSpecificException e) {
	// TODO: Add appropriate checks when other ServiceSpecificException types are supported
	retBundle.putInt(KEY_STATUS, IpSecManager.Status.SPI_UNAVAILABLE);
	retBundle.putInt(KEY_RESOURCE_ID, resourceId);
	retBundle.putInt(KEY_SPI, spi);
	} catch (RemoteException e) {
	throw e.rethrowFromSystemServer();
	}
	return retBundle;
	}

	/** Release a previously allocated SPI that has been registered with the system server */
	@Override
	public void releaseSecurityParameterIndex(int resourceId) throws RemoteException {}

	/**
	* Open a socket via the system server and bind it to the specified port (random if port=0).
	* This will return a PFD to the user that represent a bound UDP socket. The system server will
	* cache the socket and a record of its owner so that it can and must be freed when no longer
	* needed.
	*/
	@Override
	public Bundle openUdpEncapsulationSocket(int port, IBinder binder) throws RemoteException {
	return null;
	}

	/** close a socket that has been been allocated by and registered with the system server */
	@Override
	public void closeUdpEncapsulationSocket(ParcelFileDescriptor socket) {}

	/**
	* Create a transport mode transform, which represent two security associations (one in each
	* direction) in the kernel. The transform will be cached by the system server and must be freed
	* when no longer needed. It is possible to free one, deleting the SA from underneath sockets
	* that are using it, which will result in all of those sockets becoming unable to send or
	* receive data.
	*/
	@Override
	public Bundle createTransportModeTransform(IpSecConfig c, IBinder binder)
	throws RemoteException {
	// TODO: Basic input validation here since it's coming over the Binder
	int resourceId = mNextResourceId.getAndIncrement();
	for (int direction : DIRECTIONS) {
	IpSecAlgorithm auth = c.getAuthentication(direction);
	IpSecAlgorithm crypt = c.getEncryption(direction);
	try {
	int result =
	getNetdInstance()
	.ipSecAddSecurityAssociation(
	resourceId,
	c.getMode(),
	direction,
	(c.getLocalAddress() != null)
	? c.getLocalAddress().getHostAddress()
	: "",
	(c.getRemoteAddress() != null)
	? c.getRemoteAddress().getHostAddress()
	: "",
	(c.getNetwork() != null)
	? c.getNetwork().getNetworkHandle()
	: 0,
	c.getSpi(direction),
	(auth != null) ? auth.getName() : "",
	(auth != null) ? auth.getKey() : null,
	(auth != null) ? auth.getTruncationLengthBits() : 0,
	(crypt != null) ? crypt.getName() : "",
	(crypt != null) ? crypt.getKey() : null,
	(crypt != null) ? crypt.getTruncationLengthBits() : 0,
	c.getEncapType(),
	c.getEncapLocalPort(),
	c.getEncapRemotePort());
	if (result != c.getSpi(direction)) {
	// TODO: cleanup the first SA if creation of second SA fails
	Bundle retBundle = new Bundle(2);
	retBundle.putInt(KEY_STATUS, IpSecManager.Status.SPI_UNAVAILABLE);
	retBundle.putInt(KEY_RESOURCE_ID, INVALID_RESOURCE_ID);
	return retBundle;
	}
	} catch (ServiceSpecificException e) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception
	}
	}
	synchronized (mTransformRecords) {
	mTransformRecords.put(resourceId, new TransformRecord(c, resourceId, binder));
	}

	Bundle retBundle = new Bundle(2);
	retBundle.putInt(KEY_STATUS, IpSecManager.Status.OK);
	retBundle.putInt(KEY_RESOURCE_ID, resourceId);
	return retBundle;
	}

	/**
	* Delete a transport mode transform that was previously allocated by + registered with the
	* system server. If this is called on an inactive (or non-existent) transform, it will not
	* return an error. It's safe to de-allocate transforms that may have already been deleted for
	* other reasons.
	*/
	@Override
	public void deleteTransportModeTransform(int resourceId) throws RemoteException {
	synchronized (mTransformRecords) {
	TransformRecord record;
	// We want to non-destructively get so that we can check credentials before removing
	// this from the records.
	record = mTransformRecords.get(resourceId);

	if (record == null) {
	throw new IllegalArgumentException(
	"Transform " + resourceId + " is not available to be deleted");
	}

	if (record.pid != Binder.getCallingPid() \|\| record.uid != Binder.getCallingUid()) {
	throw new SecurityException("Only the owner of an IpSec Transform may delete it!");
	}

	// TODO: if releaseResources() throws RemoteException, we can try again to clean up on
	// binder death. Need to make sure that path is actually functional.
	record.releaseResources();
	mTransformRecords.remove(resourceId);
	record.nullifyRecord();
	}
	}

	/**
	* Apply an active transport mode transform to a socket, which will apply the IPsec security
	* association as a correspondent policy to the provided socket
	*/
	@Override
	public void applyTransportModeTransform(ParcelFileDescriptor socket, int resourceId)
	throws RemoteException {

	synchronized (mTransformRecords) {
	TransformRecord info;
	// FIXME: this code should be factored out into a security check + getter
	info = mTransformRecords.get(resourceId);

	if (info == null) {
	throw new IllegalArgumentException("Transform " + resourceId + " is not active");
	}

	// TODO: make this a function.
	if (info.pid != getCallingPid() \|\| info.uid != getCallingUid()) {
	throw new SecurityException("Only the owner of an IpSec Transform may apply it!");
	}

	IpSecConfig c = info.getConfig();
	try {
	for (int direction : DIRECTIONS) {
	getNetdInstance()
	.ipSecApplyTransportModeTransform(
	socket.getFileDescriptor(),
	resourceId,
	direction,
	(c.getLocalAddress() != null)
	? c.getLocalAddress().getHostAddress()
	: "",
	(c.getRemoteAddress() != null)
	? c.getRemoteAddress().getHostAddress()
	: "",
	c.getSpi(direction));
	}
	} catch (ServiceSpecificException e) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception
	}
	}
	}
	/**
	* Remove a transport mode transform from a socket, applying the default (empty) policy. This
	* will ensure that NO IPsec policy is applied to the socket (would be the equivalent of
	* applying a policy that performs no IPsec). Today the resourceId parameter is passed but not
	* used: reserved for future improved input validation.
	*/
	@Override
	public void removeTransportModeTransform(ParcelFileDescriptor socket, int resourceId)
	throws RemoteException {
	try {
	getNetdInstance().ipSecRemoveTransportModeTransform(socket.getFileDescriptor());
	} catch (ServiceSpecificException e) {
	// FIXME: get the error code and throw is at an IOException from Errno Exception
	}
	}

	@Override
	protected void dump(FileDescriptor fd, PrintWriter pw, String[] args) {
	mContext.enforceCallingOrSelfPermission(DUMP, TAG);

	pw.println("IpSecService Log:");
	pw.println("NetdNativeService Connection: " + (isNetdAlive() ? "alive" : "dead"));
	pw.println();
	}
	}