set XFRM_STATE_AF_UNSPEC flag only in IPsec tunnel mode