child-sa: Add new state to track deleted but not yet destroyed CHILD_SAs

This allows us to easily identify SAs we keep around after a rekeying to
process delayed packets.

src/libcharon/sa/child_sa.c

@@ -37,6 +37,7 @@ ENUM(child_sa_state_names, CHILD_CREATED, CHILD_DESTROYING,
 	"REKEYED",
 	"RETRYING",
 	"DELETING",
+	"DELETED",
 	"DESTROYING",
 );
 

src/libcharon/sa/child_sa.h

@@ -83,6 +83,11 @@ enum child_sa_state_t {
 	 */
 	CHILD_DELETING,
 
+	/**
+	 * CHILD_SA has been deleted, but not yet destroyed
+	 */
+	CHILD_DELETED,
+
 	/**
 	 * CHILD_SA object gets destroyed
 	 */

src/libcharon/sa/ikev1/tasks/quick_delete.c

@@ -135,6 +135,7 @@ static bool delete_child(private_quick_delete_t *this, protocol_id_t protocol,
 	my_ts->destroy(my_ts);
 	other_ts->destroy(other_ts);
 
+	child_sa->set_state(child_sa, CHILD_DELETED);
 	if (!rekeyed)
 	{
 		charon->bus->child_updown(charon->bus, child_sa, FALSE);

src/libcharon/sa/ikev2/tasks/child_delete.c

@@ -265,6 +265,8 @@ static void process_payloads(private_child_delete_t *this, message_t *message)
 					case CHILD_REKEYED:
 						entry->rekeyed = TRUE;
 						break;
+					case CHILD_DELETED:
+						/* already deleted but not yet destroyed, ignore */
 					case CHILD_DELETING:
 						/* we don't send back a delete if we already initiated
 						 * a delete ourself */
@@ -324,6 +326,7 @@ static status_t destroy_and_reestablish(private_child_delete_t *this)
 	while (enumerator->enumerate(enumerator, (void**)&entry))
 	{
 		child_sa = entry->child_sa;
+		child_sa->set_state(child_sa, CHILD_DELETED);
 		/* signal child down event if we weren't rekeying */
 		protocol = child_sa->get_protocol(child_sa);
 		if (!entry->rekeyed)
@@ -456,7 +459,7 @@ METHOD(task_t, build_i, status_t,
 		this->spi = child_sa->get_spi(child_sa, TRUE);
 	}
 
-	if (child_sa->get_state(child_sa) == CHILD_DELETING)
+	if (child_sa->get_state(child_sa) == CHILD_DELETED)
 	{	/* DELETEs for this CHILD_SA were already exchanged, but it was not yet
 		 * destroyed to allow delayed packets to get processed */
 		this->ike_sa->destroy_child_sa(this->ike_sa, this->protocol, this->spi);

src/libcharon/sa/ikev2/tasks/child_rekey.c

@@ -145,8 +145,7 @@ static void find_child(private_child_rekey_t *this, message_t *message)
 			child_sa = this->ike_sa->get_child_sa(this->ike_sa, protocol,
 												  spi, FALSE);
 			if (child_sa &&
-				child_sa->get_state(child_sa) == CHILD_DELETING &&
-				child_sa->get_outbound_state(child_sa) == CHILD_OUTBOUND_NONE)
+				child_sa->get_state(child_sa) == CHILD_DELETED)
 			{	/* ignore rekeyed CHILD_SAs we keep around */
 				return;
 			}